To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 750
- compare with another revision
- download diff
- download tarball
- view history from revision 750
- Committer: Teddy Hogeborn
- Date: 2015-05-30 16:47:00 UTC
- Revision ID: teddy@recompile.se-20150530164700-77zrd7964gdhbk1f
mandos: Disable D-Bus if any DBusException is raised when connecting.
- files added:
- debian/upstream
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
72
81
73
82
import dbus
74
83
import dbus.service
75
import gobject
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
76
88
import avahi
77
89
from dbus.mainloop.glib import DBusGMainLoop
78
90
import ctypes
88
100
except ImportError:
89
101
SO_BINDTODEVICE = None
90
102
91
version = "1.6.4"
103
if sys.version_info.major == 2:
104
str = unicode
105
106
version = "1.6.9"
92
107
stored_state_file = "clients.pickle"
93
108
94
109
logger = logging.getLogger()
95
110
syslogger = None
96
111
97
112
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
101
115
except (OSError, AttributeError):
116
102
117
def if_nametoindex(interface):
103
118
"Get an interface index the hard way, i.e. using fcntl()"
104
119
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
120
with contextlib.closing(socket.socket()) as s:
106
121
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
122
struct.pack(b"16s16x", interface))
123
interface_index = struct.unpack("I", ifreq[16:20])[0]
111
124
return interface_index
112
125
113
126
114
127
def initlogger(debug, level=logging.WARNING):
115
128
"""init logger and add loglevel"""
116
129
117
syslogger = (logging.handlers.SysLogHandler
118
(facility =
119
logging.handlers.SysLogHandler.LOG_DAEMON,
120
address = str("/dev/log")))
130
global syslogger
131
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
121
134
syslogger.setFormatter(logging.Formatter
122
135
('Mandos [%(process)d]: %(levelname)s:'
123
136
' %(message)s'))
140
153
141
154
class PGPEngine(object):
142
155
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
143
157
def __init__(self):
144
158
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
159
self.gnupgargs = ['--batch',
184
198
185
199
def encrypt(self, data, password):
186
200
passphrase = self.password_encode(password)
187
with tempfile.NamedTemporaryFile(dir=self.tempdir
188
) as passfile:
201
with tempfile.NamedTemporaryFile(
202
dir=self.tempdir) as passfile:
189
203
passfile.write(passphrase)
190
204
passfile.flush()
191
205
proc = subprocess.Popen(['gpg', '--symmetric',
202
216
203
217
def decrypt(self, data, password):
204
218
passphrase = self.password_encode(password)
205
with tempfile.NamedTemporaryFile(dir = self.tempdir
206
) as passfile:
219
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
207
221
passfile.write(passphrase)
208
222
passfile.flush()
209
223
proc = subprocess.Popen(['gpg', '--decrypt',
213
227
stdin = subprocess.PIPE,
214
228
stdout = subprocess.PIPE,
215
229
stderr = subprocess.PIPE)
216
decrypted_plaintext, err = proc.communicate(input
217
= data)
230
decrypted_plaintext, err = proc.communicate(input = data)
218
231
if proc.returncode != 0:
219
232
raise PGPError(err)
220
233
return decrypted_plaintext
223
236
class AvahiError(Exception):
224
237
def __init__(self, value, *args, **kwargs):
225
238
self.value = value
226
super(AvahiError, self).__init__(value, *args, **kwargs)
227
def __unicode__(self):
228
return unicode(repr(self.value))
239
return super(AvahiError, self).__init__(value, *args,
240
**kwargs)
241
229
242
230
243
class AvahiServiceError(AvahiError):
231
244
pass
232
245
246
233
247
class AvahiGroupError(AvahiError):
234
248
pass
235
249
255
269
bus: dbus.SystemBus()
256
270
"""
257
271
258
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
259
servicetype = None, port = None, TXT = None,
260
domain = "", host = "", max_renames = 32768,
261
protocol = avahi.PROTO_UNSPEC, bus = None):
272
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
262
283
self.interface = interface
263
284
self.name = name
264
285
self.type = servicetype
274
295
self.bus = bus
275
296
self.entry_group_state_changed_match = None
276
297
277
def rename(self):
298
def rename(self, remove=True):
278
299
"""Derived from the Avahi example code"""
279
300
if self.rename_count >= self.max_renames:
280
301
logger.critical("No suitable Zeroconf service name found"
281
302
" after %i retries, exiting.",
282
303
self.rename_count)
283
304
raise AvahiServiceError("Too many renames")
284
self.name = unicode(self.server
285
.GetAlternativeServiceName(self.name))
305
self.name = str(
306
self.server.GetAlternativeServiceName(self.name))
307
self.rename_count += 1
286
308
logger.info("Changing Zeroconf service name to %r ...",
287
309
self.name)
288
self.remove()
310
if remove:
311
self.remove()
289
312
try:
290
313
self.add()
291
314
except dbus.exceptions.DBusException as error:
292
logger.critical("D-Bus Exception", exc_info=error)
293
self.cleanup()
294
os._exit(1)
295
self.rename_count += 1
315
if (error.get_dbus_name()
316
== "org.freedesktop.Avahi.CollisionError"):
317
logger.info("Local Zeroconf service name collision.")
318
return self.rename(remove=False)
319
else:
320
logger.critical("D-Bus Exception", exc_info=error)
321
self.cleanup()
322
os._exit(1)
296
323
297
324
def remove(self):
298
325
"""Derived from the Avahi example code"""
336
363
self.rename()
337
364
elif state == avahi.ENTRY_GROUP_FAILURE:
338
365
logger.critical("Avahi: Error in group state changed %s",
339
unicode(error))
340
raise AvahiGroupError("State changed: {0!s}"
341
.format(error))
366
str(error))
367
raise AvahiGroupError("State changed: {!s}".format(error))
342
368
343
369
def cleanup(self):
344
370
"""Derived from the Avahi example code"""
354
380
def server_state_changed(self, state, error=None):
355
381
"""Derived from the Avahi example code"""
356
382
logger.debug("Avahi server state change: %i", state)
357
bad_states = { avahi.SERVER_INVALID:
358
"Zeroconf server invalid",
359
avahi.SERVER_REGISTERING: None,
360
avahi.SERVER_COLLISION:
361
"Zeroconf server name collision",
362
avahi.SERVER_FAILURE:
363
"Zeroconf server failure" }
383
bad_states = {
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
388
}
364
389
if state in bad_states:
365
390
if bad_states[state] is not None:
366
391
if error is None:
385
410
follow_name_owner_changes=True),
386
411
avahi.DBUS_INTERFACE_SERVER)
387
412
self.server.connect_to_signal("StateChanged",
388
self.server_state_changed)
413
self.server_state_changed)
389
414
self.server_state_changed(self.server.GetState())
390
415
391
416
392
417
class AvahiServiceToSyslog(AvahiService):
393
def rename(self):
418
def rename(self, *args, **kwargs):
394
419
"""Add the new name to the syslog messages"""
395
ret = AvahiService.rename(self)
396
syslogger.setFormatter(logging.Formatter
397
('Mandos ({0}) [%(process)d]:'
398
' %(levelname)s: %(message)s'
399
.format(self.name)))
420
ret = AvahiService.rename(self, *args, **kwargs)
421
syslogger.setFormatter(logging.Formatter(
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
.format(self.name)))
400
424
return ret
401
425
402
426
403
def timedelta_to_milliseconds(td):
404
"Convert a datetime.timedelta() to milliseconds"
405
return ((td.days * 24 * 60 * 60 * 1000)
406
+ (td.seconds * 1000)
407
+ (td.microseconds // 1000))
408
409
410
427
class Client(object):
411
428
"""A representation of a client host served by this server.
412
429
456
473
"fingerprint", "host", "interval",
457
474
"last_approval_request", "last_checked_ok",
458
475
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
469
470
def timeout_milliseconds(self):
471
"Return the 'timeout' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.timeout)
473
474
def extended_timeout_milliseconds(self):
475
"Return the 'extended_timeout' attribute in milliseconds"
476
return timedelta_to_milliseconds(self.extended_timeout)
477
478
def interval_milliseconds(self):
479
"Return the 'interval' attribute in milliseconds"
480
return timedelta_to_milliseconds(self.interval)
481
482
def approval_delay_milliseconds(self):
483
return timedelta_to_milliseconds(self.approval_delay)
476
client_defaults = {
477
"timeout": "PT5M",
478
"extended_timeout": "PT15M",
479
"interval": "PT2M",
480
"checker": "fping -q -- %%(host)s",
481
"host": "",
482
"approval_delay": "PT0S",
483
"approval_duration": "PT1S",
484
"approved_by_default": "True",
485
"enabled": "True",
486
}
484
487
485
488
@staticmethod
486
489
def config_parser(config):
502
505
client["enabled"] = config.getboolean(client_name,
503
506
"enabled")
504
507
508
# Uppercase and remove spaces from fingerprint for later
509
# comparison purposes with return value from the
510
# fingerprint() function
505
511
client["fingerprint"] = (section["fingerprint"].upper()
506
512
.replace(" ", ""))
507
513
if "secret" in section:
512
518
"rb") as secfile:
513
519
client["secret"] = secfile.read()
514
520
else:
515
raise TypeError("No secret or secfile for section {0}"
521
raise TypeError("No secret or secfile for section {}"
516
522
.format(section))
517
523
client["timeout"] = string_to_delta(section["timeout"])
518
524
client["extended_timeout"] = string_to_delta(
535
541
server_settings = {}
536
542
self.server_settings = server_settings
537
543
# adding all client settings
538
for setting, value in settings.iteritems():
544
for setting, value in settings.items():
539
545
setattr(self, setting, value)
540
546
541
547
if self.enabled:
549
555
self.expires = None
550
556
551
557
logger.debug("Creating client %r", self.name)
552
# Uppercase and remove spaces from fingerprint for later
553
# comparison purposes with return value from the fingerprint()
554
# function
555
558
logger.debug(" Fingerprint: %s", self.fingerprint)
556
559
self.created = settings.get("created",
557
560
datetime.datetime.utcnow())
564
567
self.current_checker_command = None
565
568
self.approved = None
566
569
self.approvals_pending = 0
567
self.changedstate = (multiprocessing_manager
568
.Condition(multiprocessing_manager
569
.Lock()))
570
self.client_structure = [attr for attr in
571
self.__dict__.iterkeys()
570
self.changedstate = multiprocessing_manager.Condition(
571
multiprocessing_manager.Lock())
572
self.client_structure = [attr
573
for attr in self.__dict__.iterkeys()
572
574
if not attr.startswith("_")]
573
575
self.client_structure.append("client_structure")
574
576
575
for name, t in inspect.getmembers(type(self),
576
lambda obj:
577
isinstance(obj,
578
property)):
577
for name, t in inspect.getmembers(
578
type(self), lambda obj: isinstance(obj, property)):
579
579
if not name.startswith("_"):
580
580
self.client_structure.append(name)
581
581
623
623
# and every interval from then on.
624
624
if self.checker_initiator_tag is not None:
625
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = (gobject.timeout_add
627
(self.interval_milliseconds(),
628
self.start_checker))
626
self.checker_initiator_tag = gobject.timeout_add(
627
int(self.interval.total_seconds() * 1000),
628
self.start_checker)
629
629
# Schedule a disable() when 'timeout' has passed
630
630
if self.disable_initiator_tag is not None:
631
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = (gobject.timeout_add
633
(self.timeout_milliseconds(),
634
self.disable))
632
self.disable_initiator_tag = gobject.timeout_add(
633
int(self.timeout.total_seconds() * 1000), self.disable)
635
634
# Also start a new checker *right now*.
636
635
self.start_checker()
637
636
646
645
vars(self))
647
646
self.checked_ok()
648
647
else:
649
logger.info("Checker for %(name)s failed",
650
vars(self))
648
logger.info("Checker for %(name)s failed", vars(self))
651
649
else:
652
650
self.last_checker_status = -1
653
651
logger.warning("Checker for %(name)s crashed?",
667
665
gobject.source_remove(self.disable_initiator_tag)
668
666
self.disable_initiator_tag = None
669
667
if getattr(self, "enabled", False):
670
self.disable_initiator_tag = (gobject.timeout_add
671
(timedelta_to_milliseconds
672
(timeout), self.disable))
668
self.disable_initiator_tag = gobject.timeout_add(
669
int(timeout.total_seconds() * 1000), self.disable)
673
670
self.expires = datetime.datetime.utcnow() + timeout
674
671
675
672
def need_approval(self):
706
703
# Start a new checker if needed
707
704
if self.checker is None:
708
705
# Escape attributes for the shell
709
escaped_attrs = dict(
710
(attr, re.escape(unicode(getattr(self, attr))))
711
for attr in
712
self.runtime_expansions)
706
escaped_attrs = {
707
attr: re.escape(str(getattr(self, attr)))
708
for attr in self.runtime_expansions }
713
709
try:
714
710
command = self.checker_command % escaped_attrs
715
711
except TypeError as error:
716
712
logger.error('Could not format string "%s"',
717
self.checker_command, exc_info=error)
718
return True # Try again later
713
self.checker_command,
714
exc_info=error)
715
return True # Try again later
719
716
self.current_checker_command = command
720
717
try:
721
logger.info("Starting checker %r for %s",
722
command, self.name)
718
logger.info("Starting checker %r for %s", command,
719
self.name)
723
720
# We don't need to redirect stdout and stderr, since
724
721
# in normal mode, that is already done by daemon(),
725
722
# and in debug mode we don't want to. (Stdin is
734
731
"stderr": wnull })
735
732
self.checker = subprocess.Popen(command,
736
733
close_fds=True,
737
shell=True, cwd="/",
734
shell=True,
735
cwd="/",
738
736
**popen_args)
739
737
except OSError as error:
740
738
logger.error("Failed to start subprocess",
741
739
exc_info=error)
742
740
return True
743
self.checker_callback_tag = (gobject.child_watch_add
744
(self.checker.pid,
745
self.checker_callback,
746
data=command))
741
self.checker_callback_tag = gobject.child_watch_add(
742
self.checker.pid, self.checker_callback, data=command)
747
743
# The checker may have completed before the gobject
748
744
# watch was added. Check for this.
749
745
try:
780
776
self.checker = None
781
777
782
778
783
def dbus_service_property(dbus_interface, signature="v",
784
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
785
783
"""Decorators for marking methods of a DBusObjectWithProperties to
786
784
become properties on the D-Bus.
787
785
796
794
# "Set" method, so we fail early here:
797
795
if byte_arrays and signature != "ay":
798
796
raise ValueError("Byte arrays not supported for non-'ay'"
799
" signature {0!r}".format(signature))
797
" signature {!r}".format(signature))
798
800
799
def decorator(func):
801
800
func._dbus_is_property = True
802
801
func._dbus_interface = dbus_interface
807
806
func._dbus_name = func._dbus_name[:-14]
808
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
809
808
return func
809
810
810
return decorator
811
811
812
812
821
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
822
822
"false"}
823
823
"""
824
824
825
def decorator(func):
825
826
func._dbus_is_interface = True
826
827
func._dbus_interface = dbus_interface
827
828
func._dbus_name = dbus_interface
828
829
return func
830
829
831
return decorator
830
832
831
833
833
835
"""Decorator to annotate D-Bus methods, signals or properties
834
836
Usage:
835
837
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
836
841
@dbus_service_property("org.example.Interface", signature="b",
837
842
access="r")
838
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
843
def Property_dbus_property(self):
842
844
return dbus.Boolean(False)
843
845
"""
846
844
847
def decorator(func):
845
848
func._dbus_annotations = annotations
846
849
return func
850
847
851
return decorator
848
852
849
853
850
854
class DBusPropertyException(dbus.exceptions.DBusException):
851
855
"""A base class for D-Bus property-related exceptions
852
856
"""
853
def __unicode__(self):
854
return unicode(str(self))
857
pass
855
858
856
859
857
860
class DBusPropertyAccessException(DBusPropertyException):
881
884
If called like _is_dbus_thing("method") it returns a function
882
885
suitable for use as predicate to inspect.getmembers().
883
886
"""
884
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
888
False)
886
889
887
890
def _get_all_dbus_things(self, thing):
888
891
"""Returns a generator of (name, attribute) pairs
889
892
"""
890
return ((getattr(athing.__get__(self), "_dbus_name",
891
name),
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
892
894
athing.__get__(self))
893
895
for cls in self.__class__.__mro__
894
896
for name, athing in
895
inspect.getmembers(cls,
896
self._is_dbus_thing(thing)))
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
897
898
898
899
def _get_dbus_property(self, interface_name, property_name):
899
900
"""Returns a bound method if one exists which is a D-Bus
900
901
property with the specified name and interface.
901
902
"""
902
for cls in self.__class__.__mro__:
903
for name, value in (inspect.getmembers
904
(cls,
905
self._is_dbus_thing("property"))):
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
906
906
if (value._dbus_name == property_name
907
907
and value._dbus_interface == interface_name):
908
908
return value.__get__(self)
909
909
910
910
# No such property
911
raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
+ interface_name + "."
913
+ property_name)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
914
913
915
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
915
in_signature="ss",
916
916
out_signature="v")
917
917
def Get(self, interface_name, property_name):
918
918
"""Standard D-Bus property Get() method, see D-Bus standard.
937
937
# signatures other than "ay".
938
938
if prop._dbus_signature != "ay":
939
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {0!r}"
940
"'ay' signature {!r}"
941
941
.format(prop._dbus_signature))
942
942
value = dbus.ByteArray(b''.join(chr(byte)
943
943
for byte in value))
944
944
prop(value)
945
945
946
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
in_signature="s",
947
948
out_signature="a{sv}")
948
949
def GetAll(self, interface_name):
949
950
"""Standard D-Bus property GetAll() method, see D-Bus
964
965
if not hasattr(value, "variant_level"):
965
966
properties[name] = value
966
967
continue
967
properties[name] = type(value)(value, variant_level=
968
value.variant_level+1)
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
969
970
return dbus.Dictionary(properties, signature="sv")
970
971
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
976
standard.
977
"""
978
pass
979
971
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
972
981
out_signature="s",
973
982
path_keyword='object_path',
981
990
connection)
982
991
try:
983
992
document = xml.dom.minidom.parseString(xmlstring)
993
984
994
def make_tag(document, name, prop):
985
995
e = document.createElement("property")
986
996
e.setAttribute("name", name)
987
997
e.setAttribute("type", prop._dbus_signature)
988
998
e.setAttribute("access", prop._dbus_access)
989
999
return e
1000
990
1001
for if_tag in document.getElementsByTagName("interface"):
991
1002
# Add property tags
992
1003
for tag in (make_tag(document, name, prop)
1004
1015
if (name == tag.getAttribute("name")
1005
1016
and prop._dbus_interface
1006
1017
== if_tag.getAttribute("name")):
1007
annots.update(getattr
1008
(prop,
1009
"_dbus_annotations",
1010
{}))
1011
for name, value in annots.iteritems():
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1012
1021
ann_tag = document.createElement(
1013
1022
"annotation")
1014
1023
ann_tag.setAttribute("name", name)
1017
1026
# Add interface annotation tags
1018
1027
for annotation, value in dict(
1019
1028
itertools.chain.from_iterable(
1020
annotations().iteritems()
1021
for name, annotations in
1022
self._get_all_dbus_things("interface")
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1023
1032
if name == if_tag.getAttribute("name")
1024
)).iteritems():
1033
)).items():
1025
1034
ann_tag = document.createElement("annotation")
1026
1035
ann_tag.setAttribute("name", annotation)
1027
1036
ann_tag.setAttribute("value", value)
1054
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1055
1064
if dt is None:
1056
1065
return dbus.String("", variant_level = variant_level)
1057
return dbus.String(dt.isoformat(),
1058
variant_level=variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1059
1067
1060
1068
1061
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1081
1089
(from DBusObjectWithProperties) and interfaces (from the
1082
1090
dbus_interface_annotations decorator).
1083
1091
"""
1092
1084
1093
def wrapper(cls):
1085
1094
for orig_interface_name, alt_interface_name in (
1086
alt_interface_names.iteritems()):
1095
alt_interface_names.items()):
1087
1096
attr = {}
1088
1097
interface_names = set()
1089
1098
# Go though all attributes of the class
1091
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1092
1101
# with the wrong interface name
1093
1102
if (not hasattr(attribute, "_dbus_interface")
1094
or not attribute._dbus_interface
1095
.startswith(orig_interface_name)):
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1096
1105
continue
1097
1106
# Create an alternate D-Bus interface name based on
1098
1107
# the current name
1099
alt_interface = (attribute._dbus_interface
1100
.replace(orig_interface_name,
1101
alt_interface_name))
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1102
1110
interface_names.add(alt_interface)
1103
1111
# Is this a D-Bus signal?
1104
1112
if getattr(attribute, "_dbus_is_signal", False):
1105
1113
# Extract the original non-method undecorated
1106
1114
# function by black magic
1107
1115
nonmethod_func = (dict(
1108
zip(attribute.func_code.co_freevars,
1109
attribute.__closure__))["func"]
1110
.cell_contents)
1116
zip(attribute.func_code.co_freevars,
1117
attribute.__closure__))
1118
["func"].cell_contents)
1111
1119
# Create a new, but exactly alike, function
1112
1120
# object, and decorate it to be a new D-Bus signal
1113
1121
# with the alternate D-Bus interface name
1114
new_function = (dbus.service.signal
1115
(alt_interface,
1116
attribute._dbus_signature)
1122
new_function = (dbus.service.signal(
1123
alt_interface, attribute._dbus_signature)
1117
1124
(types.FunctionType(
1118
nonmethod_func.func_code,
1119
nonmethod_func.func_globals,
1120
nonmethod_func.func_name,
1121
nonmethod_func.func_defaults,
1122
nonmethod_func.func_closure)))
1125
nonmethod_func.func_code,
1126
nonmethod_func.func_globals,
1127
nonmethod_func.func_name,
1128
nonmethod_func.func_defaults,
1129
nonmethod_func.func_closure)))
1123
1130
# Copy annotations, if any
1124
1131
try:
1125
new_function._dbus_annotations = (
1126
dict(attribute._dbus_annotations))
1132
new_function._dbus_annotations = dict(
1133
attribute._dbus_annotations)
1127
1134
except AttributeError:
1128
1135
pass
1129
1136
# Define a creator of a function to call both the
1134
1141
"""This function is a scope container to pass
1135
1142
func1 and func2 to the "call_both" function
1136
1143
outside of its arguments"""
1144
1137
1145
def call_both(*args, **kwargs):
1138
1146
"""This function will emit two D-Bus
1139
1147
signals by calling func1 and func2"""
1140
1148
func1(*args, **kwargs)
1141
1149
func2(*args, **kwargs)
1150
1142
1151
return call_both
1143
1152
# Create the "call_both" function and add it to
1144
1153
# the class
1149
1158
# object. Decorate it to be a new D-Bus method
1150
1159
# with the alternate D-Bus interface name. Add it
1151
1160
# to the class.
1152
attr[attrname] = (dbus.service.method
1153
(alt_interface,
1154
attribute._dbus_in_signature,
1155
attribute._dbus_out_signature)
1156
(types.FunctionType
1157
(attribute.func_code,
1158
attribute.func_globals,
1159
attribute.func_name,
1160
attribute.func_defaults,
1161
attribute.func_closure)))
1161
attr[attrname] = (
1162
dbus.service.method(
1163
alt_interface,
1164
attribute._dbus_in_signature,
1165
attribute._dbus_out_signature)
1166
(types.FunctionType(attribute.func_code,
1167
attribute.func_globals,
1168
attribute.func_name,
1169
attribute.func_defaults,
1170
attribute.func_closure)))
1162
1171
# Copy annotations, if any
1163
1172
try:
1164
attr[attrname]._dbus_annotations = (
1165
dict(attribute._dbus_annotations))
1173
attr[attrname]._dbus_annotations = dict(
1174
attribute._dbus_annotations)
1166
1175
except AttributeError:
1167
1176
pass
1168
1177
# Is this a D-Bus property?
1171
1180
# object, and decorate it to be a new D-Bus
1172
1181
# property with the alternate D-Bus interface
1173
1182
# name. Add it to the class.
1174
attr[attrname] = (dbus_service_property
1175
(alt_interface,
1176
attribute._dbus_signature,
1177
attribute._dbus_access,
1178
attribute
1179
._dbus_get_args_options
1180
["byte_arrays"])
1181
(types.FunctionType
1182
(attribute.func_code,
1183
attribute.func_globals,
1184
attribute.func_name,
1185
attribute.func_defaults,
1186
attribute.func_closure)))
1183
attr[attrname] = (dbus_service_property(
1184
alt_interface, attribute._dbus_signature,
1185
attribute._dbus_access,
1186
attribute._dbus_get_args_options
1187
["byte_arrays"])
1188
(types.FunctionType(
1189
attribute.func_code,
1190
attribute.func_globals,
1191
attribute.func_name,
1192
attribute.func_defaults,
1193
attribute.func_closure)))
1187
1194
# Copy annotations, if any
1188
1195
try:
1189
attr[attrname]._dbus_annotations = (
1190
dict(attribute._dbus_annotations))
1196
attr[attrname]._dbus_annotations = dict(
1197
attribute._dbus_annotations)
1191
1198
except AttributeError:
1192
1199
pass
1193
1200
# Is this a D-Bus interface?
1196
1203
# object. Decorate it to be a new D-Bus interface
1197
1204
# with the alternate D-Bus interface name. Add it
1198
1205
# to the class.
1199
attr[attrname] = (dbus_interface_annotations
1200
(alt_interface)
1201
(types.FunctionType
1202
(attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1206
attr[attrname] = (
1207
dbus_interface_annotations(alt_interface)
1208
(types.FunctionType(attribute.func_code,
1209
attribute.func_globals,
1210
attribute.func_name,
1211
attribute.func_defaults,
1212
attribute.func_closure)))
1207
1213
if deprecate:
1208
1214
# Deprecate all alternate interfaces
1209
iname="_AlternateDBusNames_interface_annotation{0}"
1215
iname="_AlternateDBusNames_interface_annotation{}"
1210
1216
for interface_name in interface_names:
1217
1211
1218
@dbus_interface_annotations(interface_name)
1212
1219
def func(self):
1213
1220
return { "org.freedesktop.DBus.Deprecated":
1214
"true" }
1221
"true" }
1215
1222
# Find an unused name
1216
1223
for aname in (iname.format(i)
1217
1224
for i in itertools.count()):
1221
1228
if interface_names:
1222
1229
# Replace the class with a new subclass of it with
1223
1230
# methods, signals, etc. as created above.
1224
cls = type(b"{0}Alternate".format(cls.__name__),
1225
(cls,), attr)
1231
cls = type(b"{}Alternate".format(cls.__name__),
1232
(cls, ), attr)
1226
1233
return cls
1234
1227
1235
return wrapper
1228
1236
1229
1237
1230
1238
@alternate_dbus_interfaces({"se.recompile.Mandos":
1231
"se.bsnet.fukt.Mandos"})
1239
"se.bsnet.fukt.Mandos"})
1232
1240
class ClientDBus(Client, DBusObjectWithProperties):
1233
1241
"""A Client class using D-Bus
1234
1242
1238
1246
"""
1239
1247
1240
1248
runtime_expansions = (Client.runtime_expansions
1241
+ ("dbus_object_path",))
1249
+ ("dbus_object_path", ))
1250
1251
_interface = "se.recompile.Mandos.Client"
1242
1252
1243
1253
# dbus.service.Object doesn't use super(), so we can't either.
1244
1254
1247
1257
Client.__init__(self, *args, **kwargs)
1248
1258
# Only now, when this client is initialized, can it show up on
1249
1259
# the D-Bus
1250
client_object_name = unicode(self.name).translate(
1260
client_object_name = str(self.name).translate(
1251
1261
{ord("."): ord("_"),
1252
1262
ord("-"): ord("_")})
1253
self.dbus_object_path = (dbus.ObjectPath
1254
("/clients/" + client_object_name))
1263
self.dbus_object_path = dbus.ObjectPath(
1264
"/clients/" + client_object_name)
1255
1265
DBusObjectWithProperties.__init__(self, self.bus,
1256
1266
self.dbus_object_path)
1257
1267
1258
def notifychangeproperty(transform_func,
1259
dbus_name, type_func=lambda x: x,
1260
variant_level=1):
1268
def notifychangeproperty(transform_func, dbus_name,
1269
type_func=lambda x: x,
1270
variant_level=1,
1271
invalidate_only=False,
1272
_interface=_interface):
1261
1273
""" Modify a variable so that it's a property which announces
1262
1274
its changes to DBus.
1263
1275
1268
1280
to the D-Bus. Default: no transform
1269
1281
variant_level: D-Bus variant level. Default: 1
1270
1282
"""
1271
attrname = "_{0}".format(dbus_name)
1283
attrname = "_{}".format(dbus_name)
1284
1272
1285
def setter(self, value):
1273
1286
if hasattr(self, "dbus_object_path"):
1274
1287
if (not hasattr(self, attrname) or
1275
1288
type_func(getattr(self, attrname, None))
1276
1289
!= type_func(value)):
1277
dbus_value = transform_func(type_func(value),
1278
variant_level
1279
=variant_level)
1280
self.PropertyChanged(dbus.String(dbus_name),
1281
dbus_value)
1290
if invalidate_only:
1291
self.PropertiesChanged(
1292
_interface, dbus.Dictionary(),
1293
dbus.Array((dbus_name, )))
1294
else:
1295
dbus_value = transform_func(
1296
type_func(value),
1297
variant_level = variant_level)
1298
self.PropertyChanged(dbus.String(dbus_name),
1299
dbus_value)
1300
self.PropertiesChanged(
1301
_interface,
1302
dbus.Dictionary({ dbus.String(dbus_name):
1303
dbus_value }),
1304
dbus.Array())
1282
1305
setattr(self, attrname, value)
1283
1306
1284
1307
return property(lambda self: getattr(self, attrname), setter)
1290
1313
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1291
1314
last_enabled = notifychangeproperty(datetime_to_dbus,
1292
1315
"LastEnabled")
1293
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1294
type_func = lambda checker:
1295
checker is not None)
1316
checker = notifychangeproperty(
1317
dbus.Boolean, "CheckerRunning",
1318
type_func = lambda checker: checker is not None)
1296
1319
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1297
1320
"LastCheckedOK")
1298
1321
last_checker_status = notifychangeproperty(dbus.Int16,
1301
1324
datetime_to_dbus, "LastApprovalRequest")
1302
1325
approved_by_default = notifychangeproperty(dbus.Boolean,
1303
1326
"ApprovedByDefault")
1304
approval_delay = notifychangeproperty(dbus.UInt64,
1305
"ApprovalDelay",
1306
type_func =
1307
timedelta_to_milliseconds)
1327
approval_delay = notifychangeproperty(
1328
dbus.UInt64, "ApprovalDelay",
1329
type_func = lambda td: td.total_seconds() * 1000)
1308
1330
approval_duration = notifychangeproperty(
1309
1331
dbus.UInt64, "ApprovalDuration",
1310
type_func = timedelta_to_milliseconds)
1332
type_func = lambda td: td.total_seconds() * 1000)
1311
1333
host = notifychangeproperty(dbus.String, "Host")
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func =
1314
timedelta_to_milliseconds)
1334
timeout = notifychangeproperty(
1335
dbus.UInt64, "Timeout",
1336
type_func = lambda td: td.total_seconds() * 1000)
1315
1337
extended_timeout = notifychangeproperty(
1316
1338
dbus.UInt64, "ExtendedTimeout",
1317
type_func = timedelta_to_milliseconds)
1318
interval = notifychangeproperty(dbus.UInt64,
1319
"Interval",
1320
type_func =
1321
timedelta_to_milliseconds)
1339
type_func = lambda td: td.total_seconds() * 1000)
1340
interval = notifychangeproperty(
1341
dbus.UInt64, "Interval",
1342
type_func = lambda td: td.total_seconds() * 1000)
1322
1343
checker_command = notifychangeproperty(dbus.String, "Checker")
1344
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1345
invalidate_only=True)
1323
1346
1324
1347
del notifychangeproperty
1325
1348
1352
1375
*args, **kwargs)
1353
1376
1354
1377
def start_checker(self, *args, **kwargs):
1355
old_checker = self.checker
1356
if self.checker is not None:
1357
old_checker_pid = self.checker.pid
1358
else:
1359
old_checker_pid = None
1378
old_checker_pid = getattr(self.checker, "pid", None)
1360
1379
r = Client.start_checker(self, *args, **kwargs)
1361
1380
# Only if new checker process was started
1362
1381
if (self.checker is not None
1371
1390
1372
1391
def approve(self, value=True):
1373
1392
self.approved = value
1374
gobject.timeout_add(timedelta_to_milliseconds
1375
(self.approval_duration),
1376
self._reset_approved)
1393
gobject.timeout_add(int(self.approval_duration.total_seconds()
1394
* 1000), self._reset_approved)
1377
1395
self.send_changedstate()
1378
1396
1379
1397
## D-Bus methods, signals & properties
1380
_interface = "se.recompile.Mandos.Client"
1381
1398
1382
1399
## Interfaces
1383
1400
1384
@dbus_interface_annotations(_interface)
1385
def _foo(self):
1386
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1387
"false"}
1388
1389
1401
## Signals
1390
1402
1391
1403
# CheckerCompleted - signal
1401
1413
pass
1402
1414
1403
1415
# PropertyChanged - signal
1416
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1404
1417
@dbus.service.signal(_interface, signature="sv")
1405
1418
def PropertyChanged(self, property, value):
1406
1419
"D-Bus signal"
1470
1483
return dbus.Boolean(bool(self.approvals_pending))
1471
1484
1472
1485
# ApprovedByDefault - property
1473
@dbus_service_property(_interface, signature="b",
1486
@dbus_service_property(_interface,
1487
signature="b",
1474
1488
access="readwrite")
1475
1489
def ApprovedByDefault_dbus_property(self, value=None):
1476
1490
if value is None: # get
1478
1492
self.approved_by_default = bool(value)
1479
1493
1480
1494
# ApprovalDelay - property
1481
@dbus_service_property(_interface, signature="t",
1495
@dbus_service_property(_interface,
1496
signature="t",
1482
1497
access="readwrite")
1483
1498
def ApprovalDelay_dbus_property(self, value=None):
1484
1499
if value is None: # get
1485
return dbus.UInt64(self.approval_delay_milliseconds())
1500
return dbus.UInt64(self.approval_delay.total_seconds()
1501
* 1000)
1486
1502
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
1503
1488
1504
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1505
@dbus_service_property(_interface,
1506
signature="t",
1490
1507
access="readwrite")
1491
1508
def ApprovalDuration_dbus_property(self, value=None):
1492
1509
if value is None: # get
1493
return dbus.UInt64(timedelta_to_milliseconds(
1494
self.approval_duration))
1510
return dbus.UInt64(self.approval_duration.total_seconds()
1511
* 1000)
1495
1512
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1496
1513
1497
1514
# Name - property
1505
1522
return dbus.String(self.fingerprint)
1506
1523
1507
1524
# Host - property
1508
@dbus_service_property(_interface, signature="s",
1525
@dbus_service_property(_interface,
1526
signature="s",
1509
1527
access="readwrite")
1510
1528
def Host_dbus_property(self, value=None):
1511
1529
if value is None: # get
1512
1530
return dbus.String(self.host)
1513
self.host = unicode(value)
1531
self.host = str(value)
1514
1532
1515
1533
# Created - property
1516
1534
@dbus_service_property(_interface, signature="s", access="read")
1523
1541
return datetime_to_dbus(self.last_enabled)
1524
1542
1525
1543
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
1544
@dbus_service_property(_interface,
1545
signature="b",
1527
1546
access="readwrite")
1528
1547
def Enabled_dbus_property(self, value=None):
1529
1548
if value is None: # get
1534
1553
self.disable()
1535
1554
1536
1555
# LastCheckedOK - property
1537
@dbus_service_property(_interface, signature="s",
1556
@dbus_service_property(_interface,
1557
signature="s",
1538
1558
access="readwrite")
1539
1559
def LastCheckedOK_dbus_property(self, value=None):
1540
1560
if value is not None:
1543
1563
return datetime_to_dbus(self.last_checked_ok)
1544
1564
1545
1565
# LastCheckerStatus - property
1546
@dbus_service_property(_interface, signature="n",
1547
access="read")
1566
@dbus_service_property(_interface, signature="n", access="read")
1548
1567
def LastCheckerStatus_dbus_property(self):
1549
1568
return dbus.Int16(self.last_checker_status)
1550
1569
1559
1578
return datetime_to_dbus(self.last_approval_request)
1560
1579
1561
1580
# Timeout - property
1562
@dbus_service_property(_interface, signature="t",
1581
@dbus_service_property(_interface,
1582
signature="t",
1563
1583
access="readwrite")
1564
1584
def Timeout_dbus_property(self, value=None):
1565
1585
if value is None: # get
1566
return dbus.UInt64(self.timeout_milliseconds())
1586
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1567
1587
old_timeout = self.timeout
1568
1588
self.timeout = datetime.timedelta(0, 0, 0, value)
1569
1589
# Reschedule disabling
1578
1598
is None):
1579
1599
return
1580
1600
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
timedelta_to_milliseconds(self.expires - now),
1584
self.disable))
1601
self.disable_initiator_tag = gobject.timeout_add(
1602
int((self.expires - now).total_seconds() * 1000),
1603
self.disable)
1585
1604
1586
1605
# ExtendedTimeout - property
1587
@dbus_service_property(_interface, signature="t",
1606
@dbus_service_property(_interface,
1607
signature="t",
1588
1608
access="readwrite")
1589
1609
def ExtendedTimeout_dbus_property(self, value=None):
1590
1610
if value is None: # get
1591
return dbus.UInt64(self.extended_timeout_milliseconds())
1611
return dbus.UInt64(self.extended_timeout.total_seconds()
1612
* 1000)
1592
1613
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1593
1614
1594
1615
# Interval - property
1595
@dbus_service_property(_interface, signature="t",
1616
@dbus_service_property(_interface,
1617
signature="t",
1596
1618
access="readwrite")
1597
1619
def Interval_dbus_property(self, value=None):
1598
1620
if value is None: # get
1599
return dbus.UInt64(self.interval_milliseconds())
1621
return dbus.UInt64(self.interval.total_seconds() * 1000)
1600
1622
self.interval = datetime.timedelta(0, 0, 0, value)
1601
1623
if getattr(self, "checker_initiator_tag", None) is None:
1602
1624
return
1603
1625
if self.enabled:
1604
1626
# Reschedule checker run
1605
1627
gobject.source_remove(self.checker_initiator_tag)
1606
self.checker_initiator_tag = (gobject.timeout_add
1607
(value, self.start_checker))
1608
self.start_checker() # Start one now, too
1628
self.checker_initiator_tag = gobject.timeout_add(
1629
value, self.start_checker)
1630
self.start_checker() # Start one now, too
1609
1631
1610
1632
# Checker - property
1611
@dbus_service_property(_interface, signature="s",
1633
@dbus_service_property(_interface,
1634
signature="s",
1612
1635
access="readwrite")
1613
1636
def Checker_dbus_property(self, value=None):
1614
1637
if value is None: # get
1615
1638
return dbus.String(self.checker_command)
1616
self.checker_command = unicode(value)
1639
self.checker_command = str(value)
1617
1640
1618
1641
# CheckerRunning - property
1619
@dbus_service_property(_interface, signature="b",
1642
@dbus_service_property(_interface,
1643
signature="b",
1620
1644
access="readwrite")
1621
1645
def CheckerRunning_dbus_property(self, value=None):
1622
1646
if value is None: # get
1632
1656
return self.dbus_object_path # is already a dbus.ObjectPath
1633
1657
1634
1658
# Secret = property
1635
@dbus_service_property(_interface, signature="ay",
1636
access="write", byte_arrays=True)
1659
@dbus_service_property(_interface,
1660
signature="ay",
1661
access="write",
1662
byte_arrays=True)
1637
1663
def Secret_dbus_property(self, value):
1638
self.secret = str(value)
1664
self.secret = bytes(value)
1639
1665
1640
1666
del _interface
1641
1667
1655
1681
if data[0] == 'data':
1656
1682
return data[1]
1657
1683
if data[0] == 'function':
1684
1658
1685
def func(*args, **kwargs):
1659
1686
self._pipe.send(('funcall', name, args, kwargs))
1660
1687
return self._pipe.recv()[1]
1688
1661
1689
return func
1662
1690
1663
1691
def __setattr__(self, name, value):
1675
1703
def handle(self):
1676
1704
with contextlib.closing(self.server.child_pipe) as child_pipe:
1677
1705
logger.info("TCP connection from: %s",
1678
unicode(self.client_address))
1706
str(self.client_address))
1679
1707
logger.debug("Pipe FD: %d",
1680
1708
self.server.child_pipe.fileno())
1681
1709
1682
session = (gnutls.connection
1683
.ClientSession(self.request,
1684
gnutls.connection
1685
.X509Credentials()))
1710
session = gnutls.connection.ClientSession(
1711
self.request, gnutls.connection .X509Credentials())
1686
1712
1687
1713
# Note: gnutls.connection.X509Credentials is really a
1688
1714
# generic GnuTLS certificate credentials object so long as
1697
1723
priority = self.server.gnutls_priority
1698
1724
if priority is None:
1699
1725
priority = "NORMAL"
1700
(gnutls.library.functions
1701
.gnutls_priority_set_direct(session._c_object,
1702
priority, None))
1726
gnutls.library.functions.gnutls_priority_set_direct(
1727
session._c_object, priority, None)
1703
1728
1704
1729
# Start communication using the Mandos protocol
1705
1730
# Get protocol number
1725
1750
approval_required = False
1726
1751
try:
1727
1752
try:
1728
fpr = self.fingerprint(self.peer_certificate
1729
(session))
1753
fpr = self.fingerprint(
1754
self.peer_certificate(session))
1730
1755
except (TypeError,
1731
1756
gnutls.errors.GNUTLSError) as error:
1732
1757
logger.warning("Bad certificate: %s", error)
1747
1772
while True:
1748
1773
if not client.enabled:
1749
1774
logger.info("Client %s is disabled",
1750
client.name)
1775
client.name)
1751
1776
if self.server.use_dbus:
1752
1777
# Emit D-Bus signal
1753
1778
client.Rejected("Disabled")
1762
1787
if self.server.use_dbus:
1763
1788
# Emit D-Bus signal
1764
1789
client.NeedApproval(
1765
client.approval_delay_milliseconds(),
1766
client.approved_by_default)
1790
client.approval_delay.total_seconds()
1791
* 1000, client.approved_by_default)
1767
1792
else:
1768
1793
logger.warning("Client %s was not approved",
1769
1794
client.name)
1775
1800
#wait until timeout or approved
1776
1801
time = datetime.datetime.now()
1777
1802
client.changedstate.acquire()
1778
client.changedstate.wait(
1779
float(timedelta_to_milliseconds(delay)
1780
/ 1000))
1803
client.changedstate.wait(delay.total_seconds())
1781
1804
client.changedstate.release()
1782
1805
time2 = datetime.datetime.now()
1783
1806
if (time2 - time) >= delay:
1802
1825
logger.warning("gnutls send failed",
1803
1826
exc_info=error)
1804
1827
return
1805
logger.debug("Sent: %d, remaining: %d",
1806
sent, len(client.secret)
1807
- (sent_size + sent))
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
1830
+ sent))
1808
1831
sent_size += sent
1809
1832
1810
1833
logger.info("Sending secret to %s", client.name)
1827
1850
def peer_certificate(session):
1828
1851
"Return the peer's OpenPGP certificate as a bytestring"
1829
1852
# If not an OpenPGP certificate...
1830
if (gnutls.library.functions
1831
.gnutls_certificate_type_get(session._c_object)
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
1854
session._c_object)
1832
1855
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1833
1856
# ...do the normal thing
1834
1857
return session.peer_certificate
1848
1871
def fingerprint(openpgp):
1849
1872
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1850
1873
# New GnuTLS "datum" with the OpenPGP public key
1851
datum = (gnutls.library.types
1852
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1853
ctypes.POINTER
1854
(ctypes.c_ubyte)),
1855
ctypes.c_uint(len(openpgp))))
1874
datum = gnutls.library.types.gnutls_datum_t(
1875
ctypes.cast(ctypes.c_char_p(openpgp),
1876
ctypes.POINTER(ctypes.c_ubyte)),
1877
ctypes.c_uint(len(openpgp)))
1856
1878
# New empty GnuTLS certificate
1857
1879
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1880
gnutls.library.functions.gnutls_openpgp_crt_init(
1881
ctypes.byref(crt))
1860
1882
# Import the OpenPGP public key into the certificate
1861
(gnutls.library.functions
1862
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1863
gnutls.library.constants
1864
.GNUTLS_OPENPGP_FMT_RAW))
1883
gnutls.library.functions.gnutls_openpgp_crt_import(
1884
crt, ctypes.byref(datum),
1885
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1865
1886
# Verify the self signature in the key
1866
1887
crtverify = ctypes.c_uint()
1867
(gnutls.library.functions
1868
.gnutls_openpgp_crt_verify_self(crt, 0,
1869
ctypes.byref(crtverify)))
1888
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1889
crt, 0, ctypes.byref(crtverify))
1870
1890
if crtverify.value != 0:
1871
1891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1872
raise (gnutls.errors.CertificateSecurityError
1873
("Verify failed"))
1892
raise gnutls.errors.CertificateSecurityError(
1893
"Verify failed")
1874
1894
# New buffer for the fingerprint
1875
1895
buf = ctypes.create_string_buffer(20)
1876
1896
buf_len = ctypes.c_size_t()
1877
1897
# Get the fingerprint from the certificate into the buffer
1878
(gnutls.library.functions
1879
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1880
ctypes.byref(buf_len)))
1898
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1899
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1881
1900
# Deinit the certificate
1882
1901
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1883
1902
# Convert the buffer to a Python bytestring
1889
1908
1890
1909
class MultiprocessingMixIn(object):
1891
1910
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1911
1892
1912
def sub_process_main(self, request, address):
1893
1913
try:
1894
1914
self.finish_request(request, address)
1906
1926
1907
1927
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1908
1928
""" adds a pipe to the MixIn """
1929
1909
1930
def process_request(self, request, client_address):
1910
1931
"""Overrides and wraps the original process_request().
1911
1932
1932
1953
interface: None or a network interface name (string)
1933
1954
use_ipv6: Boolean; to use IPv6 or not
1934
1955
"""
1956
1935
1957
def __init__(self, server_address, RequestHandlerClass,
1936
interface=None, use_ipv6=True, socketfd=None):
1958
interface=None,
1959
use_ipv6=True,
1960
socketfd=None):
1937
1961
"""If socketfd is set, use that file descriptor instead of
1938
1962
creating a new one with socket.socket().
1939
1963
"""
1980
2004
self.interface)
1981
2005
else:
1982
2006
try:
1983
self.socket.setsockopt(socket.SOL_SOCKET,
1984
SO_BINDTODEVICE,
1985
str(self.interface + '\0'))
2007
self.socket.setsockopt(
2008
socket.SOL_SOCKET, SO_BINDTODEVICE,
2009
(self.interface + "\0").encode("utf-8"))
1986
2010
except socket.error as error:
1987
2011
if error.errno == errno.EPERM:
1988
2012
logger.error("No permission to bind to"
2006
2030
self.server_address = (any_address,
2007
2031
self.server_address[1])
2008
2032
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2010
0)
2033
self.server_address = (self.server_address[0], 0)
2011
2034
# if self.interface:
2012
2035
# self.server_address = (self.server_address[0],
2013
2036
# 0, # port
2027
2050
2028
2051
Assumes a gobject.MainLoop event loop.
2029
2052
"""
2053
2030
2054
def __init__(self, server_address, RequestHandlerClass,
2031
interface=None, use_ipv6=True, clients=None,
2032
gnutls_priority=None, use_dbus=True, socketfd=None):
2055
interface=None,
2056
use_ipv6=True,
2057
clients=None,
2058
gnutls_priority=None,
2059
use_dbus=True,
2060
socketfd=None):
2033
2061
self.enabled = False
2034
2062
self.clients = clients
2035
2063
if self.clients is None:
2041
2069
interface = interface,
2042
2070
use_ipv6 = use_ipv6,
2043
2071
socketfd = socketfd)
2072
2044
2073
def server_activate(self):
2045
2074
if self.enabled:
2046
2075
return socketserver.TCPServer.server_activate(self)
2050
2079
2051
2080
def add_pipe(self, parent_pipe, proc):
2052
2081
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2056
parent_pipe =
2057
parent_pipe,
2058
proc = proc))
2082
gobject.io_add_watch(
2083
parent_pipe.fileno(),
2084
gobject.IO_IN | gobject.IO_HUP,
2085
functools.partial(self.handle_ipc,
2086
parent_pipe = parent_pipe,
2087
proc = proc))
2059
2088
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2089
def handle_ipc(self, source, condition,
2090
parent_pipe=None,
2091
proc = None,
2092
client_object=None):
2062
2093
# error, or the other end of multiprocessing.Pipe has closed
2063
2094
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2064
2095
# Wait for other process to exit
2087
2118
parent_pipe.send(False)
2088
2119
return False
2089
2120
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2093
parent_pipe =
2094
parent_pipe,
2095
proc = proc,
2096
client_object =
2097
client))
2121
gobject.io_add_watch(
2122
parent_pipe.fileno(),
2123
gobject.IO_IN | gobject.IO_HUP,
2124
functools.partial(self.handle_ipc,
2125
parent_pipe = parent_pipe,
2126
proc = proc,
2127
client_object = client))
2098
2128
parent_pipe.send(True)
2099
2129
# remove the old hook in favor of the new above hook on
2100
2130
# same fileno
2106
2136
2107
2137
parent_pipe.send(('data', getattr(client_object,
2108
2138
funcname)(*args,
2109
**kwargs)))
2139
**kwargs)))
2110
2140
2111
2141
if command == 'getattr':
2112
2142
attrname = request[1]
2113
2143
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2144
parent_pipe.send(('function', ))
2115
2145
else:
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2146
parent_pipe.send((
2147
'data', client_object.__getattribute__(attrname)))
2118
2148
2119
2149
if command == 'setattr':
2120
2150
attrname = request[1]
2160
2190
# None
2161
2191
"followers")) # Tokens valid after
2162
2192
# this token
2193
Token = collections.namedtuple("Token", (
2194
"regexp", # To match token; if "value" is not None, must have
2195
# a "group" containing digits
2196
"value", # datetime.timedelta or None
2197
"followers")) # Tokens valid after this token
2163
2198
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2199
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2200
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2201
token_second = Token(re.compile(r"(\d+)S"),
2167
2202
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2203
frozenset((token_end, )))
2169
2204
token_minute = Token(re.compile(r"(\d+)M"),
2170
2205
datetime.timedelta(minutes=1),
2171
2206
frozenset((token_second, token_end)))
2187
2222
frozenset((token_month, token_end)))
2188
2223
token_week = Token(re.compile(r"(\d+)W"),
2189
2224
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2225
frozenset((token_end, )))
2191
2226
token_duration = Token(re.compile(r"P"), None,
2192
2227
frozenset((token_year, token_month,
2193
2228
token_day, token_time,
2194
token_week))),
2229
token_week)))
2195
2230
# Define starting values
2196
2231
value = datetime.timedelta() # Value so far
2197
2232
found_token = None
2198
followers = frozenset(token_duration,) # Following valid tokens
2233
followers = frozenset((token_duration,)) # Following valid tokens
2199
2234
s = duration # String left to parse
2200
2235
# Loop until end token is found
2201
2236
while found_token is not token_end:
2248
2283
timevalue = datetime.timedelta(0)
2249
2284
for s in interval.split():
2250
2285
try:
2251
suffix = unicode(s[-1])
2286
suffix = s[-1]
2252
2287
value = int(s[:-1])
2253
2288
if suffix == "d":
2254
2289
delta = datetime.timedelta(value)
2261
2296
elif suffix == "w":
2262
2297
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
2298
else:
2264
raise ValueError("Unknown suffix {0!r}"
2265
.format(suffix))
2299
raise ValueError("Unknown suffix {!r}".format(suffix))
2266
2300
except IndexError as e:
2267
2301
raise ValueError(*(e.args))
2268
2302
timevalue += delta
2285
2319
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2320
if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
2321
raise OSError(errno.ENODEV,
2288
"{0} not a character device"
2322
"{} not a character device"
2289
2323
.format(os.devnull))
2290
2324
os.dup2(null, sys.stdin.fileno())
2291
2325
os.dup2(null, sys.stdout.fileno())
2301
2335
2302
2336
parser = argparse.ArgumentParser()
2303
2337
parser.add_argument("-v", "--version", action="version",
2304
version = "%(prog)s {0}".format(version),
2338
version = "%(prog)s {}".format(version),
2305
2339
help="show version number and exit")
2306
2340
parser.add_argument("-i", "--interface", metavar="IF",
2307
2341
help="Bind to interface IF")
2340
2374
help="Directory to save/restore state in")
2341
2375
parser.add_argument("--foreground", action="store_true",
2342
2376
help="Run in foreground", default=None)
2377
parser.add_argument("--no-zeroconf", action="store_false",
2378
dest="zeroconf", help="Do not use Zeroconf",
2379
default=None)
2343
2380
2344
2381
options = parser.parse_args()
2345
2382
2354
2391
"port": "",
2355
2392
"debug": "False",
2356
2393
"priority":
2357
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2394
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2395
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2358
2396
"servicename": "Mandos",
2359
2397
"use_dbus": "True",
2360
2398
"use_ipv6": "True",
2363
2401
"socket": "",
2364
2402
"statedir": "/var/lib/mandos",
2365
2403
"foreground": "False",
2366
}
2404
"zeroconf": "True",
2405
}
2367
2406
2368
2407
# Parse config file for server-global settings
2369
2408
server_config = configparser.SafeConfigParser(server_defaults)
2370
2409
del server_defaults
2371
server_config.read(os.path.join(options.configdir,
2372
"mandos.conf"))
2410
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2373
2411
# Convert the SafeConfigParser object to a dict
2374
2412
server_settings = server_config.defaults()
2375
2413
# Use the appropriate methods on the non-string config options
2393
2431
# Override the settings from the config file with command line
2394
2432
# options, if set.
2395
2433
for option in ("interface", "address", "port", "debug",
2396
"priority", "servicename", "configdir",
2397
"use_dbus", "use_ipv6", "debuglevel", "restore",
2398
"statedir", "socket", "foreground"):
2434
"priority", "servicename", "configdir", "use_dbus",
2435
"use_ipv6", "debuglevel", "restore", "statedir",
2436
"socket", "foreground", "zeroconf"):
2399
2437
value = getattr(options, option)
2400
2438
if value is not None:
2401
2439
server_settings[option] = value
2402
2440
del options
2403
2441
# Force all strings to be unicode
2404
2442
for option in server_settings.keys():
2405
if type(server_settings[option]) is str:
2406
server_settings[option] = unicode(server_settings[option])
2443
if isinstance(server_settings[option], bytes):
2444
server_settings[option] = (server_settings[option]
2445
.decode("utf-8"))
2407
2446
# Force all boolean options to be boolean
2408
2447
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2409
"foreground"):
2448
"foreground", "zeroconf"):
2410
2449
server_settings[option] = bool(server_settings[option])
2411
2450
# Debug implies foreground
2412
2451
if server_settings["debug"]:
2415
2454
2416
2455
##################################################################
2417
2456
2457
if (not server_settings["zeroconf"]
2458
and not (server_settings["port"]
2459
or server_settings["socket"] != "")):
2460
parser.error("Needs port or socket to work without Zeroconf")
2461
2418
2462
# For convenience
2419
2463
debug = server_settings["debug"]
2420
2464
debuglevel = server_settings["debuglevel"]
2423
2467
stored_state_path = os.path.join(server_settings["statedir"],
2424
2468
stored_state_file)
2425
2469
foreground = server_settings["foreground"]
2470
zeroconf = server_settings["zeroconf"]
2426
2471
2427
2472
if debug:
2428
2473
initlogger(debug, logging.DEBUG)
2434
2479
initlogger(debug, level)
2435
2480
2436
2481
if server_settings["servicename"] != "Mandos":
2437
syslogger.setFormatter(logging.Formatter
2438
('Mandos ({0}) [%(process)d]:'
2439
' %(levelname)s: %(message)s'
2440
.format(server_settings
2441
["servicename"])))
2482
syslogger.setFormatter(
2483
logging.Formatter('Mandos ({}) [%(process)d]:'
2484
' %(levelname)s: %(message)s'.format(
2485
server_settings["servicename"])))
2442
2486
2443
2487
# Parse config file with clients
2444
2488
client_config = configparser.SafeConfigParser(Client
2449
2493
global mandos_dbus_service
2450
2494
mandos_dbus_service = None
2451
2495
2452
tcp_server = MandosServer((server_settings["address"],
2453
server_settings["port"]),
2454
ClientHandler,
2455
interface=(server_settings["interface"]
2456
or None),
2457
use_ipv6=use_ipv6,
2458
gnutls_priority=
2459
server_settings["priority"],
2460
use_dbus=use_dbus,
2461
socketfd=(server_settings["socket"]
2462
or None))
2496
socketfd = None
2497
if server_settings["socket"] != "":
2498
socketfd = server_settings["socket"]
2499
tcp_server = MandosServer(
2500
(server_settings["address"], server_settings["port"]),
2501
ClientHandler,
2502
interface=(server_settings["interface"] or None),
2503
use_ipv6=use_ipv6,
2504
gnutls_priority=server_settings["priority"],
2505
use_dbus=use_dbus,
2506
socketfd=socketfd)
2463
2507
if not foreground:
2464
2508
pidfilename = "/run/mandos.pid"
2465
2509
if not os.path.isdir("/run/."):
2499
2543
def debug_gnutls(level, string):
2500
2544
logger.debug("GnuTLS: %s", string[:-1])
2501
2545
2502
(gnutls.library.functions
2503
.gnutls_global_set_log_function(debug_gnutls))
2546
gnutls.library.functions.gnutls_global_set_log_function(
2547
debug_gnutls)
2504
2548
2505
2549
# Redirect stdin so all checkers get /dev/null
2506
2550
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2526
2570
if use_dbus:
2527
2571
try:
2528
2572
bus_name = dbus.service.BusName("se.recompile.Mandos",
2529
bus, do_not_queue=True)
2530
old_bus_name = (dbus.service.BusName
2531
("se.bsnet.fukt.Mandos", bus,
2532
do_not_queue=True))
2533
except dbus.exceptions.NameExistsException as e:
2573
bus,
2574
do_not_queue=True)
2575
old_bus_name = dbus.service.BusName(
2576
"se.bsnet.fukt.Mandos", bus,
2577
do_not_queue=True)
2578
except dbus.exceptions.DBusException as e:
2534
2579
logger.error("Disabling D-Bus:", exc_info=e)
2535
2580
use_dbus = False
2536
2581
server_settings["use_dbus"] = False
2537
2582
tcp_server.use_dbus = False
2538
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2539
service = AvahiServiceToSyslog(name =
2540
server_settings["servicename"],
2541
servicetype = "_mandos._tcp",
2542
protocol = protocol, bus = bus)
2543
if server_settings["interface"]:
2544
service.interface = (if_nametoindex
2545
(str(server_settings["interface"])))
2583
if zeroconf:
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2585
service = AvahiServiceToSyslog(
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
2589
bus = bus)
2590
if server_settings["interface"]:
2591
service.interface = if_nametoindex(
2592
server_settings["interface"].encode("utf-8"))
2546
2593
2547
2594
global multiprocessing_manager
2548
2595
multiprocessing_manager = multiprocessing.Manager()
2567
2614
if server_settings["restore"]:
2568
2615
try:
2569
2616
with open(stored_state_path, "rb") as stored_state:
2570
clients_data, old_client_settings = (pickle.load
2571
(stored_state))
2617
clients_data, old_client_settings = pickle.load(
2618
stored_state)
2572
2619
os.remove(stored_state_path)
2573
2620
except IOError as e:
2574
2621
if e.errno == errno.ENOENT:
2575
logger.warning("Could not load persistent state: {0}"
2576
.format(os.strerror(e.errno)))
2622
logger.warning("Could not load persistent state:"
2623
" {}".format(os.strerror(e.errno)))
2577
2624
else:
2578
2625
logger.critical("Could not load persistent state:",
2579
2626
exc_info=e)
2580
2627
raise
2581
2628
except EOFError as e:
2582
2629
logger.warning("Could not load persistent state: "
2583
"EOFError:", exc_info=e)
2630
"EOFError:",
2631
exc_info=e)
2584
2632
2585
2633
with PGPEngine() as pgp:
2586
for client_name, client in clients_data.iteritems():
2634
for client_name, client in clients_data.items():
2587
2635
# Skip removed clients
2588
2636
if client_name not in client_settings:
2589
2637
continue
2598
2646
# For each value in new config, check if it
2599
2647
# differs from the old config value (Except for
2600
2648
# the "secret" attribute)
2601
if (name != "secret" and
2602
value != old_client_settings[client_name]
2603
[name]):
2649
if (name != "secret"
2650
and (value !=
2651
old_client_settings[client_name][name])):
2604
2652
client[name] = value
2605
2653
except KeyError:
2606
2654
pass
2614
2662
if datetime.datetime.utcnow() >= client["expires"]:
2615
2663
if not client["last_checked_ok"]:
2616
2664
logger.warning(
2617
"disabling client {0} - Client never "
2618
"performed a successful checker"
2619
.format(client_name))
2665
"disabling client {} - Client never "
2666
"performed a successful checker".format(
2667
client_name))
2620
2668
client["enabled"] = False
2621
2669
elif client["last_checker_status"] != 0:
2622
2670
logger.warning(
2623
"disabling client {0} - Client "
2624
"last checker failed with error code {1}"
2625
.format(client_name,
2626
client["last_checker_status"]))
2671
"disabling client {} - Client last"
2672
" checker failed with error code"
2673
" {}".format(
2674
client_name,
2675
client["last_checker_status"]))
2627
2676
client["enabled"] = False
2628
2677
else:
2629
client["expires"] = (datetime.datetime
2630
.utcnow()
2631
+ client["timeout"])
2678
client["expires"] = (
2679
datetime.datetime.utcnow()
2680
+ client["timeout"])
2632
2681
logger.debug("Last checker succeeded,"
2633
" keeping {0} enabled"
2634
.format(client_name))
2682
" keeping {} enabled".format(
2683
client_name))
2635
2684
try:
2636
client["secret"] = (
2637
pgp.decrypt(client["encrypted_secret"],
2638
client_settings[client_name]
2639
["secret"]))
2685
client["secret"] = pgp.decrypt(
2686
client["encrypted_secret"],
2687
client_settings[client_name]["secret"])
2640
2688
except PGPError:
2641
2689
# If decryption fails, we use secret from new settings
2642
logger.debug("Failed to decrypt {0} old secret"
2643
.format(client_name))
2644
client["secret"] = (
2645
client_settings[client_name]["secret"])
2690
logger.debug("Failed to decrypt {} old secret".format(
2691
client_name))
2692
client["secret"] = (client_settings[client_name]
2693
["secret"])
2646
2694
2647
2695
# Add/remove clients based on new changes made to config
2648
2696
for client_name in (set(old_client_settings)
2653
2701
clients_data[client_name] = client_settings[client_name]
2654
2702
2655
2703
# Create all client objects
2656
for client_name, client in clients_data.iteritems():
2704
for client_name, client in clients_data.items():
2657
2705
tcp_server.clients[client_name] = client_class(
2658
name = client_name, settings = client,
2706
name = client_name,
2707
settings = client,
2659
2708
server_settings = server_settings)
2660
2709
2661
2710
if not tcp_server.clients:
2666
2715
try:
2667
2716
with pidfile:
2668
2717
pid = os.getpid()
2669
pidfile.write(str(pid) + "\n".encode("utf-8"))
2718
pidfile.write("{}\n".format(pid).encode("utf-8"))
2670
2719
except IOError:
2671
2720
logger.error("Could not write to file %r with PID %d",
2672
2721
pidfilename, pid)
2677
2726
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2678
2727
2679
2728
if use_dbus:
2680
@alternate_dbus_interfaces({"se.recompile.Mandos":
2681
"se.bsnet.fukt.Mandos"})
2729
2730
@alternate_dbus_interfaces(
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2682
2732
class MandosDBusService(DBusObjectWithProperties):
2683
2733
"""A D-Bus proxy object"""
2734
2684
2735
def __init__(self):
2685
2736
dbus.service.Object.__init__(self, bus, "/")
2737
2686
2738
_interface = "se.recompile.Mandos"
2687
2739
2688
2740
@dbus_interface_annotations(_interface)
2689
2741
def _foo(self):
2690
return { "org.freedesktop.DBus.Property"
2691
".EmitsChangedSignal":
2692
"false"}
2742
return {
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2744
"false" }
2693
2745
2694
2746
@dbus.service.signal(_interface, signature="o")
2695
2747
def ClientAdded(self, objpath):
2709
2761
@dbus.service.method(_interface, out_signature="ao")
2710
2762
def GetAllClients(self):
2711
2763
"D-Bus method"
2712
return dbus.Array(c.dbus_object_path
2713
for c in
2764
return dbus.Array(c.dbus_object_path for c in
2714
2765
tcp_server.clients.itervalues())
2715
2766
2716
2767
@dbus.service.method(_interface,
2718
2769
def GetAllClientsWithProperties(self):
2719
2770
"D-Bus method"
2720
2771
return dbus.Dictionary(
2721
((c.dbus_object_path, c.GetAll(""))
2722
for c in tcp_server.clients.itervalues()),
2772
{ c.dbus_object_path: c.GetAll("")
2773
for c in tcp_server.clients.itervalues() },
2723
2774
signature="oa{sv}")
2724
2775
2725
2776
@dbus.service.method(_interface, in_signature="o")
2742
2793
2743
2794
def cleanup():
2744
2795
"Cleanup function; run on exit"
2745
service.cleanup()
2796
if zeroconf:
2797
service.cleanup()
2746
2798
2747
2799
multiprocessing.active_children()
2748
2800
wnull.close()
2762
2814
2763
2815
# A list of attributes that can not be pickled
2764
2816
# + secret.
2765
exclude = set(("bus", "changedstate", "secret",
2766
"checker", "server_settings"))
2767
for name, typ in (inspect.getmembers
2768
(dbus.service.Object)):
2817
exclude = { "bus", "changedstate", "secret",
2818
"checker", "server_settings" }
2819
for name, typ in inspect.getmembers(dbus.service
2820
.Object):
2769
2821
exclude.add(name)
2770
2822
2771
2823
client_dict["encrypted_secret"] = (client
2778
2830
del client_settings[client.name]["secret"]
2779
2831
2780
2832
try:
2781
with (tempfile.NamedTemporaryFile
2782
(mode='wb', suffix=".pickle", prefix='clients-',
2783
dir=os.path.dirname(stored_state_path),
2784
delete=False)) as stored_state:
2833
with tempfile.NamedTemporaryFile(
2834
mode='wb',
2835
suffix=".pickle",
2836
prefix='clients-',
2837
dir=os.path.dirname(stored_state_path),
2838
delete=False) as stored_state:
2785
2839
pickle.dump((clients, client_settings), stored_state)
2786
tempname=stored_state.name
2840
tempname = stored_state.name
2787
2841
os.rename(tempname, stored_state_path)
2788
2842
except (IOError, OSError) as e:
2789
2843
if not debug:
2792
2846
except NameError:
2793
2847
pass
2794
2848
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2795
logger.warning("Could not save persistent state: {0}"
2849
logger.warning("Could not save persistent state: {}"
2796
2850
.format(os.strerror(e.errno)))
2797
2851
else:
2798
2852
logger.warning("Could not save persistent state:",
2808
2862
client.disable(quiet=True)
2809
2863
if use_dbus:
2810
2864
# Emit D-Bus signal
2811
mandos_dbus_service.ClientRemoved(client
2812
.dbus_object_path,
2813
client.name)
2865
mandos_dbus_service.ClientRemoved(
2866
client.dbus_object_path, client.name)
2814
2867
client_settings.clear()
2815
2868
2816
2869
atexit.register(cleanup)
2827
2880
tcp_server.server_activate()
2828
2881
2829
2882
# Find out what port we got
2830
service.port = tcp_server.socket.getsockname()[1]
2883
if zeroconf:
2884
service.port = tcp_server.socket.getsockname()[1]
2831
2885
if use_ipv6:
2832
2886
logger.info("Now listening on address %r, port %d,"
2833
2887
" flowinfo %d, scope_id %d",
2839
2893
#service.interface = tcp_server.socket.getsockname()[3]
2840
2894
2841
2895
try:
2842
# From the Avahi example code
2843
try:
2844
service.activate()
2845
except dbus.exceptions.DBusException as error:
2846
logger.critical("D-Bus Exception", exc_info=error)
2847
cleanup()
2848
sys.exit(1)
2849
# End of Avahi example code
2896
if zeroconf:
2897
# From the Avahi example code
2898
try:
2899
service.activate()
2900
except dbus.exceptions.DBusException as error:
2901
logger.critical("D-Bus Exception", exc_info=error)
2902
cleanup()
2903
sys.exit(1)
2904
# End of Avahi example code
2850
2905
2851
2906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2852
2907
lambda *args, **kwargs:
2867
2922
# Must run before the D-Bus bus name gets deregistered
2868
2923
cleanup()
2869
2924
2925
2870
2926
if __name__ == '__main__':
2871
2927
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0