/mandos/trunk : revision 752

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

47

50

import gnutls.library.functions

48

51

import gnutls.library.constants

49

52

import gnutls.library.types

50

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

51

57

import sys

52

58

import re

53

59

import os

62

68

import struct

63

69

import fcntl

64

70

import functools

65

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

66

75

import multiprocessing

67

76

import types

68

77

import binascii

69

78

import tempfile

70

79

import itertools

71

80

import collections

81

import codecs

72

82

73

83

import dbus

74

84

import dbus.service

75

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

76

89

import avahi

77

90

from dbus.mainloop.glib import DBusGMainLoop

78

91

import ctypes

88

101

except ImportError:

89

102

SO_BINDTODEVICE = None

90

103

91

version = "1.6.3"

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

92

108

stored_state_file = "clients.pickle"

93

109

94

110

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

111

syslogger = None

98

112

99

113

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

103

116

except (OSError, AttributeError):

117

104

118

def if_nametoindex(interface):

105

119

"Get an interface index the hard way, i.e. using fcntl()"

106

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

121

with contextlib.closing(socket.socket()) as s:

108

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

125

return interface_index

114

126

115

127

116

128

def initlogger(debug, level=logging.WARNING):

117

129

"""init logger and add loglevel"""

118

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

119

135

syslogger.setFormatter(logging.Formatter

120

136

('Mandos [%(process)d]: %(levelname)s:'

121

137

' %(message)s'))

138

154

139

155

class PGPEngine(object):

140

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

141

158

def __init__(self):

142

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

143

160

self.gnupgargs = ['--batch',

182

199

183

200

def encrypt(self, data, password):

184

201

passphrase = self.password_encode(password)

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

187

204

passfile.write(passphrase)

188

205

passfile.flush()

189

206

proc = subprocess.Popen(['gpg', '--symmetric',

200

217

201

218

def decrypt(self, data, password):

202

219

passphrase = self.password_encode(password)

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

205

222

passfile.write(passphrase)

206

223

passfile.flush()

207

224

proc = subprocess.Popen(['gpg', '--decrypt',

211

228

stdin = subprocess.PIPE,

212

229

stdout = subprocess.PIPE,

213

230

stderr = subprocess.PIPE)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

231

decrypted_plaintext, err = proc.communicate(input = data)

216

232

if proc.returncode != 0:

217

233

raise PGPError(err)

218

234

return decrypted_plaintext

221

237

class AvahiError(Exception):

222

238

def __init__(self, value, *args, **kwargs):

223

239

self.value = value

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

227

243

228

244

class AvahiServiceError(AvahiError):

229

245

pass

230

246

247

231

248

class AvahiGroupError(AvahiError):

232

249

pass

233

250

253

270

bus: dbus.SystemBus()

254

271

"""

255

272

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

260

284

self.interface = interface

261

285

self.name = name

262

286

self.type = servicetype

272

296

self.bus = bus

273

297

self.entry_group_state_changed_match = None

274

298

275

def rename(self):

299

def rename(self, remove=True):

276

300

"""Derived from the Avahi example code"""

277

301

if self.rename_count >= self.max_renames:

278

302

logger.critical("No suitable Zeroconf service name found"

279

303

" after %i retries, exiting.",

280

304

self.rename_count)

281

305

raise AvahiServiceError("Too many renames")

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

284

309

logger.info("Changing Zeroconf service name to %r ...",

285

310

self.name)

286

self.remove()

311

if remove:

312

self.remove()

287

313

try:

288

314

self.add()

289

315

except dbus.exceptions.DBusException as error:

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

294

324

295

325

def remove(self):

296

326

"""Derived from the Avahi example code"""

334

364

self.rename()

335

365

elif state == avahi.ENTRY_GROUP_FAILURE:

336

366

logger.critical("Avahi: Error in group state changed %s",

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

340

369

341

370

def cleanup(self):

342

371

"""Derived from the Avahi example code"""

352

381

def server_state_changed(self, state, error=None):

353

382

"""Derived from the Avahi example code"""

354

383

logger.debug("Avahi server state change: %i", state)

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

362

390

if state in bad_states:

363

391

if bad_states[state] is not None:

364

392

if error is None:

383

411

follow_name_owner_changes=True),

384

412

avahi.DBUS_INTERFACE_SERVER)

385

413

self.server.connect_to_signal("StateChanged",

386

self.server_state_changed)

414

self.server_state_changed)

387

415

self.server_state_changed(self.server.GetState())

388

416

389

417

390

418

class AvahiServiceToSyslog(AvahiService):

391

def rename(self):

419

def rename(self, *args, **kwargs):

392

420

"""Add the new name to the syslog messages"""

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

421

ret = AvahiService.rename(self, *args, **kwargs)

422

syslogger.setFormatter(logging.Formatter(

423

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

424

.format(self.name)))

398

425

return ret

399

426

400

427

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

407

408

428

class Client(object):

409

429

"""A representation of a client host served by this server.

410

430

454

474

"fingerprint", "host", "interval",

455

475

"last_approval_request", "last_checked_ok",

456

476

"last_enabled", "name", "timeout")

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

477

client_defaults = {

478

"timeout": "PT5M",

479

"extended_timeout": "PT15M",

480

"interval": "PT2M",

481

"checker": "fping -q -- %%(host)s",

482

"host": "",

483

"approval_delay": "PT0S",

484

"approval_duration": "PT1S",

485

"approved_by_default": "True",

486

"enabled": "True",

487

}

482

488

483

489

@staticmethod

484

490

def config_parser(config):

500

506

client["enabled"] = config.getboolean(client_name,

501

507

"enabled")

502

508

509

# Uppercase and remove spaces from fingerprint for later

510

# comparison purposes with return value from the

511

# fingerprint() function

503

512

client["fingerprint"] = (section["fingerprint"].upper()

504

513

.replace(" ", ""))

505

514

if "secret" in section:

510

519

"rb") as secfile:

511

520

client["secret"] = secfile.read()

512

521

else:

513

raise TypeError("No secret or secfile for section {0}"

522

raise TypeError("No secret or secfile for section {}"

514

523

.format(section))

515

524

client["timeout"] = string_to_delta(section["timeout"])

516

525

client["extended_timeout"] = string_to_delta(

533

542

server_settings = {}

534

543

self.server_settings = server_settings

535

544

# adding all client settings

536

for setting, value in settings.iteritems():

545

for setting, value in settings.items():

537

546

setattr(self, setting, value)

538

547

539

548

if self.enabled:

547

556

self.expires = None

548

557

549

558

logger.debug("Creating client %r", self.name)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

553

559

logger.debug(" Fingerprint: %s", self.fingerprint)

554

560

self.created = settings.get("created",

555

561

datetime.datetime.utcnow())

562

568

self.current_checker_command = None

563

569

self.approved = None

564

570

self.approvals_pending = 0

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

571

self.changedstate = multiprocessing_manager.Condition(

572

multiprocessing_manager.Lock())

573

self.client_structure = [attr

574

for attr in self.__dict__.iterkeys()

570

575

if not attr.startswith("_")]

571

576

self.client_structure.append("client_structure")

572

577

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

578

for name, t in inspect.getmembers(

579

type(self), lambda obj: isinstance(obj, property)):

577

580

if not name.startswith("_"):

578

581

self.client_structure.append(name)

579

582

621

624

# and every interval from then on.

622

625

if self.checker_initiator_tag is not None:

623

626

gobject.source_remove(self.checker_initiator_tag)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

627

self.checker_initiator_tag = gobject.timeout_add(

628

int(self.interval.total_seconds() * 1000),

629

self.start_checker)

627

630

# Schedule a disable() when 'timeout' has passed

628

631

if self.disable_initiator_tag is not None:

629

632

gobject.source_remove(self.disable_initiator_tag)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

633

self.disable_initiator_tag = gobject.timeout_add(

634

int(self.timeout.total_seconds() * 1000), self.disable)

633

635

# Also start a new checker *right now*.

634

636

self.start_checker()

635

637

644

646

vars(self))

645

647

self.checked_ok()

646

648

else:

647

logger.info("Checker for %(name)s failed",

648

vars(self))

649

logger.info("Checker for %(name)s failed", vars(self))

649

650

else:

650

651

self.last_checker_status = -1

651

652

logger.warning("Checker for %(name)s crashed?",

665

666

gobject.source_remove(self.disable_initiator_tag)

666

667

self.disable_initiator_tag = None

667

668

if getattr(self, "enabled", False):

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

669

self.disable_initiator_tag = gobject.timeout_add(

670

int(timeout.total_seconds() * 1000), self.disable)

671

self.expires = datetime.datetime.utcnow() + timeout

672

673

def need_approval(self):

704

# Start a new checker if needed

705

if self.checker is None:

706

# Escape attributes for the shell

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

707

escaped_attrs = {

708

attr: re.escape(str(getattr(self, attr)))

709

for attr in self.runtime_expansions }

711

710

try:

712

711

command = self.checker_command % escaped_attrs

713

712

except TypeError as error:

714

713

logger.error('Could not format string "%s"',

715

self.checker_command, exc_info=error)

716

return True # Try again later

714

self.checker_command,

715

exc_info=error)

716

return True # Try again later

717

self.current_checker_command = command

718

try:

719

logger.info("Starting checker %r for %s",

720

command, self.name)

719

logger.info("Starting checker %r for %s", command,

720

self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True, cwd="/",

735

shell=True,

736

cwd="/",

736

737

**popen_args)

737

738

except OSError as error:

738

739

logger.error("Failed to start subprocess",

739

740

exc_info=error)

740

741

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

742

self.checker_callback_tag = gobject.child_watch_add(

743

self.checker.pid, self.checker_callback, data=command)

745

744

# The checker may have completed before the gobject

746

745

# watch was added. Check for this.

747

746

try:

778

777

self.checker = None

779

778

780

779

781

def dbus_service_property(dbus_interface, signature="v",

782

access="readwrite", byte_arrays=False):

780

def dbus_service_property(dbus_interface,

781

signature="v",

782

access="readwrite",

783

byte_arrays=False):

783

784

"""Decorators for marking methods of a DBusObjectWithProperties to

784

785

become properties on the D-Bus.

785

786

794

795

# "Set" method, so we fail early here:

795

796

if byte_arrays and signature != "ay":

796

797

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {0!r}".format(signature))

798

" signature {!r}".format(signature))

799

798

800

def decorator(func):

799

801

func._dbus_is_property = True

800

802

func._dbus_interface = dbus_interface

805

807

func._dbus_name = func._dbus_name[:-14]

806

808

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

807

809

return func

810

808

811

return decorator

809

812

810

813

819

822

"org.freedesktop.DBus.Property.EmitsChangedSignal":

820

823

"false"}

821

824

"""

825

822

826

def decorator(func):

823

827

func._dbus_is_interface = True

824

828

func._dbus_interface = dbus_interface

825

829

func._dbus_name = dbus_interface

826

830

return func

831

827

832

return decorator

828

833

829

834

831

836

"""Decorator to annotate D-Bus methods, signals or properties

832

837

Usage:

833

838

839

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

840

"org.freedesktop.DBus.Property."

841

"EmitsChangedSignal": "false"})

834

842

@dbus_service_property("org.example.Interface", signature="b",

835

843

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

839

844

def Property_dbus_property(self):

840

845

return dbus.Boolean(False)

841

846

"""

847

842

848

def decorator(func):

843

849

func._dbus_annotations = annotations

844

850

return func

851

845

852

return decorator

846

853

847

854

848

855

class DBusPropertyException(dbus.exceptions.DBusException):

849

856

"""A base class for D-Bus property-related exceptions

850

857

"""

851

def __unicode__(self):

852

return unicode(str(self))

858

pass

853

859

854

860

855

861

class DBusPropertyAccessException(DBusPropertyException):

879

885

If called like _is_dbus_thing("method") it returns a function

880

886

suitable for use as predicate to inspect.getmembers().

881

887

"""

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

883

889

False)

884

890

885

891

def _get_all_dbus_things(self, thing):

886

892

"""Returns a generator of (name, attribute) pairs

887

893

"""

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

890

895

athing.__get__(self))

891

896

for cls in self.__class__.__mro__

892

897

for name, athing in

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

895

899

896

900

def _get_dbus_property(self, interface_name, property_name):

897

901

"""Returns a bound method if one exists which is a D-Bus

898

902

property with the specified name and interface.

899

903

"""

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

904

for cls in self.__class__.__mro__:

905

for name, value in inspect.getmembers(

906

cls, self._is_dbus_thing("property")):

904

907

if (value._dbus_name == property_name

905

908

and value._dbus_interface == interface_name):

906

909

return value.__get__(self)

907

910

908

911

# No such property

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

+ interface_name + "."

911

+ property_name)

912

raise DBusPropertyNotFound("{}:{}.{}".format(

913

self.dbus_object_path, interface_name, property_name))

912

914

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

915

@dbus.service.method(dbus.PROPERTIES_IFACE,

916

in_signature="ss",

914

917

out_signature="v")

915

918

def Get(self, interface_name, property_name):

916

919

"""Standard D-Bus property Get() method, see D-Bus standard.

935

938

# signatures other than "ay".

936

939

if prop._dbus_signature != "ay":

937

940

raise ValueError("Byte arrays not supported for non-"

938

"'ay' signature {0!r}"

941

"'ay' signature {!r}"

939

942

.format(prop._dbus_signature))

940

943

value = dbus.ByteArray(b''.join(chr(byte)

941

944

for byte in value))

942

945

prop(value)

943

946

944

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

947

@dbus.service.method(dbus.PROPERTIES_IFACE,

948

in_signature="s",

945

949

out_signature="a{sv}")

946

950

def GetAll(self, interface_name):

947

951

"""Standard D-Bus property GetAll() method, see D-Bus

962

966

if not hasattr(value, "variant_level"):

963

967

properties[name] = value

964

968

continue

965

properties[name] = type(value)(value, variant_level=

966

value.variant_level+1)

969

properties[name] = type(value)(

970

value, variant_level = value.variant_level + 1)

967

971

return dbus.Dictionary(properties, signature="sv")

968

972

973

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

974

def PropertiesChanged(self, interface_name, changed_properties,

975

invalidated_properties):

976

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

977

standard.

978

"""

979

pass

980

969

981

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

970

982

out_signature="s",

971

983

path_keyword='object_path',

979

991

connection)

980

992

try:

981

993

document = xml.dom.minidom.parseString(xmlstring)

994

982

995

def make_tag(document, name, prop):

983

996

e = document.createElement("property")

984

997

e.setAttribute("name", name)

985

998

e.setAttribute("type", prop._dbus_signature)

986

999

e.setAttribute("access", prop._dbus_access)

987

1000

return e

1001

988

1002

for if_tag in document.getElementsByTagName("interface"):

989

1003

# Add property tags

990

1004

for tag in (make_tag(document, name, prop)

1002

1016

if (name == tag.getAttribute("name")

1003

1017

and prop._dbus_interface

1004

1018

== if_tag.getAttribute("name")):

1005

annots.update(getattr

1006

(prop,

1007

"_dbus_annotations",

1008

{}))

1009

for name, value in annots.iteritems():

1019

annots.update(getattr(

1020

prop, "_dbus_annotations", {}))

1021

for name, value in annots.items():

1010

1022

ann_tag = document.createElement(

1011

1023

"annotation")

1012

1024

ann_tag.setAttribute("name", name)

1015

1027

# Add interface annotation tags

1016

1028

for annotation, value in dict(

1017

1029

itertools.chain.from_iterable(

1018

annotations().iteritems()

1019

for name, annotations in

1020

self._get_all_dbus_things("interface")

1030

annotations().items()

1031

for name, annotations

1032

in self._get_all_dbus_things("interface")

1021

1033

if name == if_tag.getAttribute("name")

1022

)).iteritems():

1034

)).items():

1023

1035

ann_tag = document.createElement("annotation")

1024

1036

ann_tag.setAttribute("name", annotation)

1025

1037

ann_tag.setAttribute("value", value)

1052

1064

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1053

1065

if dt is None:

1054

1066

return dbus.String("", variant_level = variant_level)

1055

return dbus.String(dt.isoformat(),

1056

variant_level=variant_level)

1067

return dbus.String(dt.isoformat(), variant_level=variant_level)

1057

1068

1058

1069

1059

1070

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1079

1090

(from DBusObjectWithProperties) and interfaces (from the

1080

1091

dbus_interface_annotations decorator).

1081

1092

"""

1093

1082

1094

def wrapper(cls):

1083

1095

for orig_interface_name, alt_interface_name in (

1084

alt_interface_names.iteritems()):

1096

alt_interface_names.items()):

1085

1097

attr = {}

1086

1098

interface_names = set()

1087

1099

# Go though all attributes of the class

1089

1101

# Ignore non-D-Bus attributes, and D-Bus attributes

1090

1102

# with the wrong interface name

1091

1103

if (not hasattr(attribute, "_dbus_interface")

1092

or not attribute._dbus_interface

1093

.startswith(orig_interface_name)):

1104

or not attribute._dbus_interface.startswith(

1105

orig_interface_name)):

1094

1106

continue

1095

1107

# Create an alternate D-Bus interface name based on

1096

1108

# the current name

1097

alt_interface = (attribute._dbus_interface

1098

.replace(orig_interface_name,

1099

alt_interface_name))

1109

alt_interface = attribute._dbus_interface.replace(

1110

orig_interface_name, alt_interface_name)

1100

1111

interface_names.add(alt_interface)

1101

1112

# Is this a D-Bus signal?

1102

1113

if getattr(attribute, "_dbus_is_signal", False):

1103

1114

# Extract the original non-method undecorated

1104

1115

# function by black magic

1105

1116

nonmethod_func = (dict(

1106

zip(attribute.func_code.co_freevars,

1107

attribute.__closure__))["func"]

1108

.cell_contents)

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1109

1120

# Create a new, but exactly alike, function

1110

1121

# object, and decorate it to be a new D-Bus signal

1111

1122

# with the alternate D-Bus interface name

1112

new_function = (dbus.service.signal

1113

(alt_interface,

1114

attribute._dbus_signature)

1123

new_function = (dbus.service.signal(

1124

alt_interface, attribute._dbus_signature)

1115

1125

(types.FunctionType(

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)))

1126

nonmethod_func.func_code,

1127

nonmethod_func.func_globals,

1128

nonmethod_func.func_name,

1129

nonmethod_func.func_defaults,

1130

nonmethod_func.func_closure)))

1121

1131

# Copy annotations, if any

1122

1132

try:

1123

new_function._dbus_annotations = (

1124

dict(attribute._dbus_annotations))

1133

new_function._dbus_annotations = dict(

1134

attribute._dbus_annotations)

1125

1135

except AttributeError:

1126

1136

pass

1127

1137

# Define a creator of a function to call both the

1132

1142

"""This function is a scope container to pass

1133

1143

func1 and func2 to the "call_both" function

1134

1144

outside of its arguments"""

1145

1135

1146

def call_both(*args, **kwargs):

1136

1147

"""This function will emit two D-Bus

1137

1148

signals by calling func1 and func2"""

1138

1149

func1(*args, **kwargs)

1139

1150

func2(*args, **kwargs)

1151

1140

1152

return call_both

1141

1153

# Create the "call_both" function and add it to

1142

1154

# the class

1147

1159

# object. Decorate it to be a new D-Bus method

1148

1160

# with the alternate D-Bus interface name. Add it

1149

1161

# to the class.

1150

attr[attrname] = (dbus.service.method

1151

(alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType

1155

(attribute.func_code,

1156

attribute.func_globals,

1157

attribute.func_name,

1158

attribute.func_defaults,

1159

attribute.func_closure)))

1162

attr[attrname] = (

1163

dbus.service.method(

1164

alt_interface,

1165

attribute._dbus_in_signature,

1166

attribute._dbus_out_signature)

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1160

1172

# Copy annotations, if any

1161

1173

try:

1162

attr[attrname]._dbus_annotations = (

1163

dict(attribute._dbus_annotations))

1174

attr[attrname]._dbus_annotations = dict(

1175

attribute._dbus_annotations)

1164

1176

except AttributeError:

1165

1177

pass

1166

1178

# Is this a D-Bus property?

1169

1181

# object, and decorate it to be a new D-Bus

1170

1182

# property with the alternate D-Bus interface

1171

1183

# name. Add it to the class.

1172

attr[attrname] = (dbus_service_property

1173

(alt_interface,

1174

attribute._dbus_signature,

1175

attribute._dbus_access,

1176

attribute

1177

._dbus_get_args_options

1178

["byte_arrays"])

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1184

attr[attrname] = (dbus_service_property(

1185

alt_interface, attribute._dbus_signature,

1186

attribute._dbus_access,

1187

attribute._dbus_get_args_options

1188

["byte_arrays"])

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1185

1195

# Copy annotations, if any

1186

1196

try:

1187

attr[attrname]._dbus_annotations = (

1188

dict(attribute._dbus_annotations))

1197

attr[attrname]._dbus_annotations = dict(

1198

attribute._dbus_annotations)

1189

1199

except AttributeError:

1190

1200

pass

1191

1201

# Is this a D-Bus interface?

1194

1204

# object. Decorate it to be a new D-Bus interface

1195

1205

# with the alternate D-Bus interface name. Add it

1196

1206

# to the class.

1197

attr[attrname] = (dbus_interface_annotations

1198

(alt_interface)

1199

(types.FunctionType

1200

(attribute.func_code,

1201

attribute.func_globals,

1202

attribute.func_name,

1203

attribute.func_defaults,

1204

attribute.func_closure)))

1207

attr[attrname] = (

1208

dbus_interface_annotations(alt_interface)

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1205

1214

if deprecate:

1206

1215

# Deprecate all alternate interfaces

1207

iname="_AlternateDBusNames_interface_annotation{0}"

1216

iname="_AlternateDBusNames_interface_annotation{}"

1208

1217

for interface_name in interface_names:

1218

1209

1219

@dbus_interface_annotations(interface_name)

1210

1220

def func(self):

1211

1221

return { "org.freedesktop.DBus.Deprecated":

1212

"true" }

1222

"true" }

1213

1223

# Find an unused name

1214

1224

for aname in (iname.format(i)

1215

1225

for i in itertools.count()):

1219

1229

if interface_names:

1220

1230

# Replace the class with a new subclass of it with

1221

1231

# methods, signals, etc. as created above.

1222

cls = type(b"{0}Alternate".format(cls.__name__),

1223

(cls,), attr)

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1224

1234

return cls

1235

1225

1236

return wrapper

1226

1237

1227

1238

1228

1239

@alternate_dbus_interfaces({"se.recompile.Mandos":

1229

"se.bsnet.fukt.Mandos"})

1240

"se.bsnet.fukt.Mandos"})

1230

1241

class ClientDBus(Client, DBusObjectWithProperties):

1231

1242

"""A Client class using D-Bus

1232

1243

1236

1247

"""

1237

1248

1238

1249

runtime_expansions = (Client.runtime_expansions

1239

+ ("dbus_object_path",))

1250

+ ("dbus_object_path", ))

1251

1252

_interface = "se.recompile.Mandos.Client"

1240

1253

1241

1254

# dbus.service.Object doesn't use super(), so we can't either.

1242

1255

1245

1258

Client.__init__(self, *args, **kwargs)

1246

1259

# Only now, when this client is initialized, can it show up on

1247

1260

# the D-Bus

1248

client_object_name = unicode(self.name).translate(

1261

client_object_name = str(self.name).translate(

1249

1262

{ord("."): ord("_"),

1250

1263

ord("-"): ord("_")})

1251

self.dbus_object_path = (dbus.ObjectPath

1252

("/clients/" + client_object_name))

1264

self.dbus_object_path = dbus.ObjectPath(

1265

"/clients/" + client_object_name)

1253

1266

DBusObjectWithProperties.__init__(self, self.bus,

1254

1267

self.dbus_object_path)

1255

1268

1256

def notifychangeproperty(transform_func,

1257

dbus_name, type_func=lambda x: x,

1258

variant_level=1):

1269

def notifychangeproperty(transform_func, dbus_name,

1270

type_func=lambda x: x,

1271

variant_level=1,

1272

invalidate_only=False,

1273

_interface=_interface):

1259

1274

""" Modify a variable so that it's a property which announces

1260

1275

its changes to DBus.

1261

1276

1266

1281

to the D-Bus. Default: no transform

1267

1282

variant_level: D-Bus variant level. Default: 1

1268

1283

"""

1269

attrname = "_{0}".format(dbus_name)

1284

attrname = "_{}".format(dbus_name)

1285

1270

1286

def setter(self, value):

1271

1287

if hasattr(self, "dbus_object_path"):

1272

1288

if (not hasattr(self, attrname) or

1273

1289

type_func(getattr(self, attrname, None))

1274

1290

!= type_func(value)):

1275

dbus_value = transform_func(type_func(value),

1276

variant_level

1277

=variant_level)

1278

self.PropertyChanged(dbus.String(dbus_name),

1279

dbus_value)

1291

if invalidate_only:

1292

self.PropertiesChanged(

1293

_interface, dbus.Dictionary(),

1294

dbus.Array((dbus_name, )))

1295

else:

1296

dbus_value = transform_func(

1297

type_func(value),

1298

variant_level = variant_level)

1299

self.PropertyChanged(dbus.String(dbus_name),

1300

dbus_value)

1301

self.PropertiesChanged(

1302

_interface,

1303

dbus.Dictionary({ dbus.String(dbus_name):

1304

dbus_value }),

1305

dbus.Array())

1280

1306

setattr(self, attrname, value)

1281

1307

1282

1308

return property(lambda self: getattr(self, attrname), setter)

1288

1314

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1289

1315

last_enabled = notifychangeproperty(datetime_to_dbus,

1290

1316

"LastEnabled")

1291

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1292

type_func = lambda checker:

1293

checker is not None)

1317

checker = notifychangeproperty(

1318

dbus.Boolean, "CheckerRunning",

1319

type_func = lambda checker: checker is not None)

1294

1320

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1295

1321

"LastCheckedOK")

1296

1322

last_checker_status = notifychangeproperty(dbus.Int16,

1299

1325

datetime_to_dbus, "LastApprovalRequest")

1300

1326

approved_by_default = notifychangeproperty(dbus.Boolean,

1301

1327

"ApprovedByDefault")

1302

approval_delay = notifychangeproperty(dbus.UInt64,

1303

"ApprovalDelay",

1304

type_func =

1305

timedelta_to_milliseconds)

1328

approval_delay = notifychangeproperty(

1329

dbus.UInt64, "ApprovalDelay",

1330

type_func = lambda td: td.total_seconds() * 1000)

1306

1331

approval_duration = notifychangeproperty(

1307

1332

dbus.UInt64, "ApprovalDuration",

1308

type_func = timedelta_to_milliseconds)

1333

type_func = lambda td: td.total_seconds() * 1000)

1309

1334

host = notifychangeproperty(dbus.String, "Host")

1310

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1311

type_func =

1312

timedelta_to_milliseconds)

1335

timeout = notifychangeproperty(

1336

dbus.UInt64, "Timeout",

1337

type_func = lambda td: td.total_seconds() * 1000)

1313

1338

extended_timeout = notifychangeproperty(

1314

1339

dbus.UInt64, "ExtendedTimeout",

1315

type_func = timedelta_to_milliseconds)

1316

interval = notifychangeproperty(dbus.UInt64,

1317

"Interval",

1318

type_func =

1319

timedelta_to_milliseconds)

1340

type_func = lambda td: td.total_seconds() * 1000)

1341

interval = notifychangeproperty(

1342

dbus.UInt64, "Interval",

1343

type_func = lambda td: td.total_seconds() * 1000)

1320

1344

checker_command = notifychangeproperty(dbus.String, "Checker")

1345

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1346

invalidate_only=True)

1321

1347

1322

1348

del notifychangeproperty

1323

1349

1350

1376

*args, **kwargs)

1351

1377

1352

1378

def start_checker(self, *args, **kwargs):

1353

old_checker = self.checker

1354

if self.checker is not None:

1355

old_checker_pid = self.checker.pid

1356

else:

1357

old_checker_pid = None

1379

old_checker_pid = getattr(self.checker, "pid", None)

1358

1380

r = Client.start_checker(self, *args, **kwargs)

1359

1381

# Only if new checker process was started

1360

1382

if (self.checker is not None

1369

1391

1370

1392

def approve(self, value=True):

1371

1393

self.approved = value

1372

gobject.timeout_add(timedelta_to_milliseconds

1373

(self.approval_duration),

1374

self._reset_approved)

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1395

* 1000), self._reset_approved)

1375

1396

self.send_changedstate()

1376

1397

1377

1398

## D-Bus methods, signals & properties

1378

_interface = "se.recompile.Mandos.Client"

1379

1399

1380

1400

## Interfaces

1381

1401

1382

@dbus_interface_annotations(_interface)

1383

def _foo(self):

1384

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1385

"false"}

1386

1387

1402

## Signals

1388

1403

1389

1404

# CheckerCompleted - signal

1399

1414

pass

1400

1415

1401

1416

# PropertyChanged - signal

1417

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1402

1418

@dbus.service.signal(_interface, signature="sv")

1403

1419

def PropertyChanged(self, property, value):

1404

1420

"D-Bus signal"

1468

1484

return dbus.Boolean(bool(self.approvals_pending))

1469

1485

1470

1486

# ApprovedByDefault - property

1471

@dbus_service_property(_interface, signature="b",

1487

@dbus_service_property(_interface,

1488

signature="b",

1472

1489

access="readwrite")

1473

1490

def ApprovedByDefault_dbus_property(self, value=None):

1474

1491

if value is None: # get

1476

1493

self.approved_by_default = bool(value)

1477

1494

1478

1495

# ApprovalDelay - property

1479

@dbus_service_property(_interface, signature="t",

1496

@dbus_service_property(_interface,

1497

signature="t",

1480

1498

access="readwrite")

1481

1499

def ApprovalDelay_dbus_property(self, value=None):

1482

1500

if value is None: # get

1483

return dbus.UInt64(self.approval_delay_milliseconds())

1501

return dbus.UInt64(self.approval_delay.total_seconds()

1502

* 1000)

1484

1503

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1485

1504

1486

1505

# ApprovalDuration - property

1487

@dbus_service_property(_interface, signature="t",

1506

@dbus_service_property(_interface,

1507

signature="t",

1488

1508

access="readwrite")

1489

1509

def ApprovalDuration_dbus_property(self, value=None):

1490

1510

if value is None: # get

1491

return dbus.UInt64(timedelta_to_milliseconds(

1492

self.approval_duration))

1511

return dbus.UInt64(self.approval_duration.total_seconds()

1512

* 1000)

1493

1513

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1494

1514

1495

1515

# Name - property

1503

1523

return dbus.String(self.fingerprint)

1504

1524

1505

1525

# Host - property

1506

@dbus_service_property(_interface, signature="s",

1526

@dbus_service_property(_interface,

1527

signature="s",

1507

1528

access="readwrite")

1508

1529

def Host_dbus_property(self, value=None):

1509

1530

if value is None: # get

1510

1531

return dbus.String(self.host)

1511

self.host = unicode(value)

1532

self.host = str(value)

1512

1533

1513

1534

# Created - property

1514

1535

@dbus_service_property(_interface, signature="s", access="read")

1521

1542

return datetime_to_dbus(self.last_enabled)

1522

1543

1523

1544

# Enabled - property

1524

@dbus_service_property(_interface, signature="b",

1545

@dbus_service_property(_interface,

1546

signature="b",

1525

1547

access="readwrite")

1526

1548

def Enabled_dbus_property(self, value=None):

1527

1549

if value is None: # get

1532

1554

self.disable()

1533

1555

1534

1556

# LastCheckedOK - property

1535

@dbus_service_property(_interface, signature="s",

1557

@dbus_service_property(_interface,

1558

signature="s",

1536

1559

access="readwrite")

1537

1560

def LastCheckedOK_dbus_property(self, value=None):

1538

1561

if value is not None:

1541

1564

return datetime_to_dbus(self.last_checked_ok)

1542

1565

1543

1566

# LastCheckerStatus - property

1544

@dbus_service_property(_interface, signature="n",

1545

access="read")

1567

@dbus_service_property(_interface, signature="n", access="read")

1546

1568

def LastCheckerStatus_dbus_property(self):

1547

1569

return dbus.Int16(self.last_checker_status)

1548

1570

1557

1579

return datetime_to_dbus(self.last_approval_request)

1558

1580

1559

1581

# Timeout - property

1560

@dbus_service_property(_interface, signature="t",

1582

@dbus_service_property(_interface,

1583

signature="t",

1561

1584

access="readwrite")

1562

1585

def Timeout_dbus_property(self, value=None):

1563

1586

if value is None: # get

1564

return dbus.UInt64(self.timeout_milliseconds())

1587

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1565

1588

old_timeout = self.timeout

1566

1589

self.timeout = datetime.timedelta(0, 0, 0, value)

1567

1590

# Reschedule disabling

1576

1599

is None):

1577

1600

return

1578

1601

gobject.source_remove(self.disable_initiator_tag)

1579

self.disable_initiator_tag = (

1580

gobject.timeout_add(

1581

timedelta_to_milliseconds(self.expires - now),

1582

self.disable))

1602

self.disable_initiator_tag = gobject.timeout_add(

1603

int((self.expires - now).total_seconds() * 1000),

1604

self.disable)

1583

1605

1584

1606

# ExtendedTimeout - property

1585

@dbus_service_property(_interface, signature="t",

1607

@dbus_service_property(_interface,

1608

signature="t",

1586

1609

access="readwrite")

1587

1610

def ExtendedTimeout_dbus_property(self, value=None):

1588

1611

if value is None: # get

1589

return dbus.UInt64(self.extended_timeout_milliseconds())

1612

return dbus.UInt64(self.extended_timeout.total_seconds()

1613

* 1000)

1590

1614

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1591

1615

1592

1616

# Interval - property

1593

@dbus_service_property(_interface, signature="t",

1617

@dbus_service_property(_interface,

1618

signature="t",

1594

1619

access="readwrite")

1595

1620

def Interval_dbus_property(self, value=None):

1596

1621

if value is None: # get

1597

return dbus.UInt64(self.interval_milliseconds())

1622

return dbus.UInt64(self.interval.total_seconds() * 1000)

1598

1623

self.interval = datetime.timedelta(0, 0, 0, value)

1599

1624

if getattr(self, "checker_initiator_tag", None) is None:

1600

1625

return

1601

1626

if self.enabled:

1602

1627

# Reschedule checker run

1603

1628

gobject.source_remove(self.checker_initiator_tag)

1604

self.checker_initiator_tag = (gobject.timeout_add

1605

(value, self.start_checker))

1606

self.start_checker() # Start one now, too

1629

self.checker_initiator_tag = gobject.timeout_add(

1630

value, self.start_checker)

1631

self.start_checker() # Start one now, too

1607

1632

1608

1633

# Checker - property

1609

@dbus_service_property(_interface, signature="s",

1634

@dbus_service_property(_interface,

1635

signature="s",

1610

1636

access="readwrite")

1611

1637

def Checker_dbus_property(self, value=None):

1612

1638

if value is None: # get

1613

1639

return dbus.String(self.checker_command)

1614

self.checker_command = unicode(value)

1640

self.checker_command = str(value)

1615

1641

1616

1642

# CheckerRunning - property

1617

@dbus_service_property(_interface, signature="b",

1643

@dbus_service_property(_interface,

1644

signature="b",

1618

1645

access="readwrite")

1619

1646

def CheckerRunning_dbus_property(self, value=None):

1620

1647

if value is None: # get

1630

1657

return self.dbus_object_path # is already a dbus.ObjectPath

1631

1658

1632

1659

# Secret = property

1633

@dbus_service_property(_interface, signature="ay",

1634

access="write", byte_arrays=True)

1660

@dbus_service_property(_interface,

1661

signature="ay",

1662

access="write",

1663

byte_arrays=True)

1635

1664

def Secret_dbus_property(self, value):

1636

self.secret = str(value)

1665

self.secret = bytes(value)

1637

1666

1638

1667

del _interface

1639

1668

1643

1672

self._pipe = child_pipe

1644

1673

self._pipe.send(('init', fpr, address))

1645

1674

if not self._pipe.recv():

1646

raise KeyError()

1675

raise KeyError(fpr)

1647

1676

1648

1677

def __getattribute__(self, name):

1649

1678

if name == '_pipe':

1653

1682

if data[0] == 'data':

1654

1683

return data[1]

1655

1684

if data[0] == 'function':

1685

1656

1686

def func(*args, **kwargs):

1657

1687

self._pipe.send(('funcall', name, args, kwargs))

1658

1688

return self._pipe.recv()[1]

1689

1659

1690

return func

1660

1691

1661

1692

def __setattr__(self, name, value):

1673

1704

def handle(self):

1674

1705

with contextlib.closing(self.server.child_pipe) as child_pipe:

1675

1706

logger.info("TCP connection from: %s",

1676

unicode(self.client_address))

1707

str(self.client_address))

1677

1708

logger.debug("Pipe FD: %d",

1678

1709

self.server.child_pipe.fileno())

1679

1710

1680

session = (gnutls.connection

1681

.ClientSession(self.request,

1682

gnutls.connection

1683

.X509Credentials()))

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1684

1713

1685

1714

# Note: gnutls.connection.X509Credentials is really a

1686

1715

# generic GnuTLS certificate credentials object so long as

1695

1724

priority = self.server.gnutls_priority

1696

1725

if priority is None:

1697

1726

priority = "NORMAL"

1698

(gnutls.library.functions

1699

.gnutls_priority_set_direct(session._c_object,

1700

priority, None))

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

1701

1729

1702

1730

# Start communication using the Mandos protocol

1703

1731

# Get protocol number

1723

1751

approval_required = False

1724

1752

try:

1725

1753

try:

1726

fpr = self.fingerprint(self.peer_certificate

1727

(session))

1754

fpr = self.fingerprint(

1755

self.peer_certificate(session))

1728

1756

except (TypeError,

1729

1757

gnutls.errors.GNUTLSError) as error:

1730

1758

logger.warning("Bad certificate: %s", error)

1745

1773

while True:

1746

1774

if not client.enabled:

1747

1775

logger.info("Client %s is disabled",

1748

client.name)

1776

client.name)

1749

1777

if self.server.use_dbus:

1750

1778

# Emit D-Bus signal

1751

1779

client.Rejected("Disabled")

1760

1788

if self.server.use_dbus:

1761

1789

# Emit D-Bus signal

1762

1790

client.NeedApproval(

1763

client.approval_delay_milliseconds(),

1764

client.approved_by_default)

1791

client.approval_delay.total_seconds()

1792

* 1000, client.approved_by_default)

1765

1793

else:

1766

1794

logger.warning("Client %s was not approved",

1767

1795

client.name)

1773

1801

#wait until timeout or approved

1774

1802

time = datetime.datetime.now()

1775

1803

client.changedstate.acquire()

1776

client.changedstate.wait(

1777

float(timedelta_to_milliseconds(delay)

1778

/ 1000))

1804

client.changedstate.wait(delay.total_seconds())

1779

1805

client.changedstate.release()

1780

1806

time2 = datetime.datetime.now()

1781

1807

if (time2 - time) >= delay:

1800

1826

logger.warning("gnutls send failed",

1801

1827

exc_info=error)

1802

1828

return

1803

logger.debug("Sent: %d, remaining: %d",

1804

sent, len(client.secret)

1805

- (sent_size + sent))

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1806

1832

sent_size += sent

1807

1833

1808

1834

logger.info("Sending secret to %s", client.name)

1825

1851

def peer_certificate(session):

1826

1852

"Return the peer's OpenPGP certificate as a bytestring"

1827

1853

# If not an OpenPGP certificate...

1828

if (gnutls.library.functions

1829

.gnutls_certificate_type_get(session._c_object)

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1830

1856

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1831

1857

# ...do the normal thing

1832

1858

return session.peer_certificate

1846

1872

def fingerprint(openpgp):

1847

1873

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1848

1874

# New GnuTLS "datum" with the OpenPGP public key

1849

datum = (gnutls.library.types

1850

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1851

ctypes.POINTER

1852

(ctypes.c_ubyte)),

1853

ctypes.c_uint(len(openpgp))))

1875

datum = gnutls.library.types.gnutls_datum_t(

1876

ctypes.cast(ctypes.c_char_p(openpgp),

1877

ctypes.POINTER(ctypes.c_ubyte)),

1878

ctypes.c_uint(len(openpgp)))

1854

1879

# New empty GnuTLS certificate

1855

1880

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

1858

1883

# Import the OpenPGP public key into the certificate

1859

(gnutls.library.functions

1860

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1861

gnutls.library.constants

1862

.GNUTLS_OPENPGP_FMT_RAW))

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1863

1887

# Verify the self signature in the key

1864

1888

crtverify = ctypes.c_uint()

1865

(gnutls.library.functions

1866

.gnutls_openpgp_crt_verify_self(crt, 0,

1867

ctypes.byref(crtverify)))

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

1868

1891

if crtverify.value != 0:

1869

1892

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1870

raise (gnutls.errors.CertificateSecurityError

1871

("Verify failed"))

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

1872

1895

# New buffer for the fingerprint

1873

1896

buf = ctypes.create_string_buffer(20)

1874

1897

buf_len = ctypes.c_size_t()

1875

1898

# Get the fingerprint from the certificate into the buffer

1876

(gnutls.library.functions

1877

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1878

ctypes.byref(buf_len)))

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1879

1901

# Deinit the certificate

1880

1902

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1881

1903

# Convert the buffer to a Python bytestring

1887

1909

1888

1910

class MultiprocessingMixIn(object):

1889

1911

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1912

1890

1913

def sub_process_main(self, request, address):

1891

1914

try:

1892

1915

self.finish_request(request, address)

1904

1927

1905

1928

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1906

1929

""" adds a pipe to the MixIn """

1930

1907

1931

def process_request(self, request, client_address):

1908

1932

"""Overrides and wraps the original process_request().

1909

1933

1930

1954

interface: None or a network interface name (string)

1931

1955

use_ipv6: Boolean; to use IPv6 or not

1932

1956

"""

1957

1933

1958

def __init__(self, server_address, RequestHandlerClass,

1934

interface=None, use_ipv6=True, socketfd=None):

1959

interface=None,

1960

use_ipv6=True,

1961

socketfd=None):

1935

1962

"""If socketfd is set, use that file descriptor instead of

1936

1963

creating a new one with socket.socket().

1937

1964

"""

1978

2005

self.interface)

1979

2006

else:

1980

2007

try:

1981

self.socket.setsockopt(socket.SOL_SOCKET,

1982

SO_BINDTODEVICE,

1983

str(self.interface + '\0'))

2008

self.socket.setsockopt(

2009

socket.SOL_SOCKET, SO_BINDTODEVICE,

2010

(self.interface + "\0").encode("utf-8"))

1984

2011

except socket.error as error:

1985

2012

if error.errno == errno.EPERM:

1986

2013

logger.error("No permission to bind to"

2004

2031

self.server_address = (any_address,

2005

2032

self.server_address[1])

2006

2033

elif not self.server_address[1]:

2007

self.server_address = (self.server_address[0],

2008

0)

2034

self.server_address = (self.server_address[0], 0)

2009

2035

# if self.interface:

2010

2036

# self.server_address = (self.server_address[0],

2011

2037

# 0, # port

2025

2051

2026

2052

Assumes a gobject.MainLoop event loop.

2027

2053

"""

2054

2028

2055

def __init__(self, server_address, RequestHandlerClass,

2029

interface=None, use_ipv6=True, clients=None,

2030

gnutls_priority=None, use_dbus=True, socketfd=None):

2056

interface=None,

2057

use_ipv6=True,

2058

clients=None,

2059

gnutls_priority=None,

2060

use_dbus=True,

2061

socketfd=None):

2031

2062

self.enabled = False

2032

2063

self.clients = clients

2033

2064

if self.clients is None:

2039

2070

interface = interface,

2040

2071

use_ipv6 = use_ipv6,

2041

2072

socketfd = socketfd)

2073

2042

2074

def server_activate(self):

2043

2075

if self.enabled:

2044

2076

return socketserver.TCPServer.server_activate(self)

2048

2080

2049

2081

def add_pipe(self, parent_pipe, proc):

2050

2082

# Call "handle_ipc" for both data and EOF events

2051

gobject.io_add_watch(parent_pipe.fileno(),

2052

gobject.IO_IN | gobject.IO_HUP,

2053

functools.partial(self.handle_ipc,

2054

parent_pipe =

2055

parent_pipe,

2056

proc = proc))

2083

gobject.io_add_watch(

2084

parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe = parent_pipe,

2088

proc = proc))

2057

2089

2058

def handle_ipc(self, source, condition, parent_pipe=None,

2059

proc = None, client_object=None):

2090

def handle_ipc(self, source, condition,

2091

parent_pipe=None,

2092

proc = None,

2093

client_object=None):

2060

2094

# error, or the other end of multiprocessing.Pipe has closed

2061

2095

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2062

2096

# Wait for other process to exit

2085

2119

parent_pipe.send(False)

2086

2120

return False

2087

2121

2088

gobject.io_add_watch(parent_pipe.fileno(),

2089

gobject.IO_IN | gobject.IO_HUP,

2090

functools.partial(self.handle_ipc,

2091

parent_pipe =

2092

parent_pipe,

2093

proc = proc,

2094

client_object =

2095

client))

2122

gobject.io_add_watch(

2123

parent_pipe.fileno(),

2124

gobject.IO_IN | gobject.IO_HUP,

2125

functools.partial(self.handle_ipc,

2126

parent_pipe = parent_pipe,

2127

proc = proc,

2128

client_object = client))

2096

2129

parent_pipe.send(True)

2097

2130

# remove the old hook in favor of the new above hook on

2098

2131

# same fileno

2104

2137

2105

2138

parent_pipe.send(('data', getattr(client_object,

2106

2139

funcname)(*args,

2107

**kwargs)))

2140

**kwargs)))

2108

2141

2109

2142

if command == 'getattr':

2110

2143

attrname = request[1]

2111

2144

if callable(client_object.__getattribute__(attrname)):

2112

parent_pipe.send(('function',))

2145

parent_pipe.send(('function', ))

2113

2146

else:

2114

parent_pipe.send(('data', client_object

2115

.__getattribute__(attrname)))

2147

parent_pipe.send((

2148

'data', client_object.__getattribute__(attrname)))

2116

2149

2117

2150

if command == 'setattr':

2118

2151

attrname = request[1]

2158

2191

# None

2159

2192

"followers")) # Tokens valid after

2160

2193

# this token

2194

Token = collections.namedtuple("Token", (

2195

"regexp", # To match token; if "value" is not None, must have

2196

# a "group" containing digits

2197

"value", # datetime.timedelta or None

2198

"followers")) # Tokens valid after this token

2161

2199

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2162

2200

# the "duration" ABNF definition in RFC 3339, Appendix A.

2163

2201

token_end = Token(re.compile(r"$"), None, frozenset())

2164

2202

token_second = Token(re.compile(r"(\d+)S"),

2165

2203

datetime.timedelta(seconds=1),

2166

frozenset((token_end,)))

2204

frozenset((token_end, )))

2167

2205

token_minute = Token(re.compile(r"(\d+)M"),

2168

2206

datetime.timedelta(minutes=1),

2169

2207

frozenset((token_second, token_end)))

2185

2223

frozenset((token_month, token_end)))

2186

2224

token_week = Token(re.compile(r"(\d+)W"),

2187

2225

datetime.timedelta(weeks=1),

2188

frozenset((token_end,)))

2226

frozenset((token_end, )))

2189

2227

token_duration = Token(re.compile(r"P"), None,

2190

2228

frozenset((token_year, token_month,

2191

2229

token_day, token_time,

2192

token_week))),

2230

token_week)))

2193

2231

# Define starting values

2194

2232

value = datetime.timedelta() # Value so far

2195

2233

found_token = None

2196

followers = frozenset(token_duration,) # Following valid tokens

2234

followers = frozenset((token_duration,)) # Following valid tokens

2197

2235

s = duration # String left to parse

2198

2236

# Loop until end token is found

2199

2237

while found_token is not token_end:

2216

2254

break

2217

2255

else:

2218

2256

# No currently valid tokens were found

2219

raise ValueError("Invalid RFC 3339 duration")

2257

raise ValueError("Invalid RFC 3339 duration: {!r}"

2258

.format(duration))

2220

2259

# End token found

2221

2260

return value

2222

2261

2246

2285

timevalue = datetime.timedelta(0)

2247

2286

for s in interval.split():

2248

2287

try:

2249

suffix = unicode(s[-1])

2288

suffix = s[-1]

2250

2289

value = int(s[:-1])

2251

2290

if suffix == "d":

2252

2291

delta = datetime.timedelta(value)

2259

2298

elif suffix == "w":

2260

2299

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2261

2300

else:

2262

raise ValueError("Unknown suffix {0!r}"

2263

.format(suffix))

2301

raise ValueError("Unknown suffix {!r}".format(suffix))

2264

2302

except IndexError as e:

2265

2303

raise ValueError(*(e.args))

2266

2304

timevalue += delta

2283

2321

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2284

2322

if not stat.S_ISCHR(os.fstat(null).st_mode):

2285

2323

raise OSError(errno.ENODEV,

2286

"{0} not a character device"

2324

"{} not a character device"

2287

2325

.format(os.devnull))

2288

2326

os.dup2(null, sys.stdin.fileno())

2289

2327

os.dup2(null, sys.stdout.fileno())

2299

2337

2300

2338

parser = argparse.ArgumentParser()

2301

2339

parser.add_argument("-v", "--version", action="version",

2302

version = "%(prog)s {0}".format(version),

2340

version = "%(prog)s {}".format(version),

2303

2341

help="show version number and exit")

2304

2342

parser.add_argument("-i", "--interface", metavar="IF",

2305

2343

help="Bind to interface IF")

2338

2376

help="Directory to save/restore state in")

2339

2377

parser.add_argument("--foreground", action="store_true",

2340

2378

help="Run in foreground", default=None)

2379

parser.add_argument("--no-zeroconf", action="store_false",

2380

dest="zeroconf", help="Do not use Zeroconf",

2381

default=None)

2341

2382

2342

2383

options = parser.parse_args()

2343

2384

2352

2393

"port": "",

2353

2394

"debug": "False",

2354

2395

"priority":

2355

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2396

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2397

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2356

2398

"servicename": "Mandos",

2357

2399

"use_dbus": "True",

2358

2400

"use_ipv6": "True",

2361

2403

"socket": "",

2362

2404

"statedir": "/var/lib/mandos",

2363

2405

"foreground": "False",

2364

}

2406

"zeroconf": "True",

2407

}

2365

2408

2366

2409

# Parse config file for server-global settings

2367

2410

server_config = configparser.SafeConfigParser(server_defaults)

2368

2411

del server_defaults

2369

server_config.read(os.path.join(options.configdir,

2370

"mandos.conf"))

2412

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2371

2413

# Convert the SafeConfigParser object to a dict

2372

2414

server_settings = server_config.defaults()

2373

2415

# Use the appropriate methods on the non-string config options

2391

2433

# Override the settings from the config file with command line

2392

2434

# options, if set.

2393

2435

for option in ("interface", "address", "port", "debug",

2394

"priority", "servicename", "configdir",

2395

"use_dbus", "use_ipv6", "debuglevel", "restore",

2396

"statedir", "socket", "foreground"):

2436

"priority", "servicename", "configdir", "use_dbus",

2437

"use_ipv6", "debuglevel", "restore", "statedir",

2438

"socket", "foreground", "zeroconf"):

2397

2439

value = getattr(options, option)

2398

2440

if value is not None:

2399

2441

server_settings[option] = value

2400

2442

del options

2401

2443

# Force all strings to be unicode

2402

2444

for option in server_settings.keys():

2403

if type(server_settings[option]) is str:

2404

server_settings[option] = unicode(server_settings[option])

2445

if isinstance(server_settings[option], bytes):

2446

server_settings[option] = (server_settings[option]

2447

.decode("utf-8"))

2405

2448

# Force all boolean options to be boolean

2406

2449

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2407

"foreground"):

2450

"foreground", "zeroconf"):

2408

2451

server_settings[option] = bool(server_settings[option])

2409

2452

# Debug implies foreground

2410

2453

if server_settings["debug"]:

2413

2456

2414

2457

##################################################################

2415

2458

2459

if (not server_settings["zeroconf"]

2460

and not (server_settings["port"]

2461

or server_settings["socket"] != "")):

2462

parser.error("Needs port or socket to work without Zeroconf")

2463

2416

2464

# For convenience

2417

2465

debug = server_settings["debug"]

2418

2466

debuglevel = server_settings["debuglevel"]

2421

2469

stored_state_path = os.path.join(server_settings["statedir"],

2422

2470

stored_state_file)

2423

2471

foreground = server_settings["foreground"]

2472

zeroconf = server_settings["zeroconf"]

2424

2473

2425

2474

if debug:

2426

2475

initlogger(debug, logging.DEBUG)

2432

2481

initlogger(debug, level)

2433

2482

2434

2483

if server_settings["servicename"] != "Mandos":

2435

syslogger.setFormatter(logging.Formatter

2436

('Mandos ({0}) [%(process)d]:'

2437

' %(levelname)s: %(message)s'

2438

.format(server_settings

2439

["servicename"])))

2484

syslogger.setFormatter(

2485

logging.Formatter('Mandos ({}) [%(process)d]:'

2486

' %(levelname)s: %(message)s'.format(

2487

server_settings["servicename"])))

2440

2488

2441

2489

# Parse config file with clients

2442

2490

client_config = configparser.SafeConfigParser(Client

2447

2495

global mandos_dbus_service

2448

2496

mandos_dbus_service = None

2449

2497

2450

tcp_server = MandosServer((server_settings["address"],

2451

server_settings["port"]),

2452

ClientHandler,

2453

interface=(server_settings["interface"]

2454

or None),

2455

use_ipv6=use_ipv6,

2456

gnutls_priority=

2457

server_settings["priority"],

2458

use_dbus=use_dbus,

2459

socketfd=(server_settings["socket"]

2460

or None))

2498

socketfd = None

2499

if server_settings["socket"] != "":

2500

socketfd = server_settings["socket"]

2501

tcp_server = MandosServer(

2502

(server_settings["address"], server_settings["port"]),

2503

ClientHandler,

2504

interface=(server_settings["interface"] or None),

2505

use_ipv6=use_ipv6,

2506

gnutls_priority=server_settings["priority"],

2507

use_dbus=use_dbus,

2508

socketfd=socketfd)

2461

2509

if not foreground:

2462

2510

pidfilename = "/run/mandos.pid"

2463

2511

if not os.path.isdir("/run/."):

2464

2512

pidfilename = "/var/run/mandos.pid"

2465

2513

pidfile = None

2466

2514

try:

2467

pidfile = open(pidfilename, "w")

2515

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2468

2516

except IOError as e:

2469

2517

logger.error("Could not open file %r", pidfilename,

2470

2518

exc_info=e)

2497

2545

def debug_gnutls(level, string):

2498

2546

logger.debug("GnuTLS: %s", string[:-1])

2499

2547

2500

(gnutls.library.functions

2501

.gnutls_global_set_log_function(debug_gnutls))

2548

gnutls.library.functions.gnutls_global_set_log_function(

2549

debug_gnutls)

2502

2550

2503

2551

# Redirect stdin so all checkers get /dev/null

2504

2552

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2524

2572

if use_dbus:

2525

2573

try:

2526

2574

bus_name = dbus.service.BusName("se.recompile.Mandos",

2527

bus, do_not_queue=True)

2528

old_bus_name = (dbus.service.BusName

2529

("se.bsnet.fukt.Mandos", bus,

2530

do_not_queue=True))

2531

except dbus.exceptions.NameExistsException as e:

2575

bus,

2576

do_not_queue=True)

2577

old_bus_name = dbus.service.BusName(

2578

"se.bsnet.fukt.Mandos", bus,

2579

do_not_queue=True)

2580

except dbus.exceptions.DBusException as e:

2532

2581

logger.error("Disabling D-Bus:", exc_info=e)

2533

2582

use_dbus = False

2534

2583

server_settings["use_dbus"] = False

2535

2584

tcp_server.use_dbus = False

2536

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2537

service = AvahiServiceToSyslog(name =

2538

server_settings["servicename"],

2539

servicetype = "_mandos._tcp",

2540

protocol = protocol, bus = bus)

2541

if server_settings["interface"]:

2542

service.interface = (if_nametoindex

2543

(str(server_settings["interface"])))

2585

if zeroconf:

2586

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2587

service = AvahiServiceToSyslog(

2588

name = server_settings["servicename"],

2589

servicetype = "_mandos._tcp",

2590

protocol = protocol,

2591

bus = bus)

2592

if server_settings["interface"]:

2593

service.interface = if_nametoindex(

2594

server_settings["interface"].encode("utf-8"))

2544

2595

2545

2596

global multiprocessing_manager

2546

2597

multiprocessing_manager = multiprocessing.Manager()

2565

2616

if server_settings["restore"]:

2566

2617

try:

2567

2618

with open(stored_state_path, "rb") as stored_state:

2568

clients_data, old_client_settings = (pickle.load

2569

(stored_state))

2619

clients_data, old_client_settings = pickle.load(

2620

stored_state)

2570

2621

os.remove(stored_state_path)

2571

2622

except IOError as e:

2572

2623

if e.errno == errno.ENOENT:

2573

logger.warning("Could not load persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2624

logger.warning("Could not load persistent state:"

2625

" {}".format(os.strerror(e.errno)))

2575

2626

else:

2576

2627

logger.critical("Could not load persistent state:",

2577

2628

exc_info=e)

2578

2629

raise

2579

2630

except EOFError as e:

2580

2631

logger.warning("Could not load persistent state: "

2581

"EOFError:", exc_info=e)

2632

"EOFError:",

2633

exc_info=e)

2582

2634

2583

2635

with PGPEngine() as pgp:

2584

for client_name, client in clients_data.iteritems():

2636

for client_name, client in clients_data.items():

2585

2637

# Skip removed clients

2586

2638

if client_name not in client_settings:

2587

2639

continue

2596

2648

# For each value in new config, check if it

2597

2649

# differs from the old config value (Except for

2598

2650

# the "secret" attribute)

2599

if (name != "secret" and

2600

value != old_client_settings[client_name]

2601

[name]):

2651

if (name != "secret"

2652

and (value !=

2653

old_client_settings[client_name][name])):

2602

2654

client[name] = value

2603

2655

except KeyError:

2604

2656

pass

2612

2664

if datetime.datetime.utcnow() >= client["expires"]:

2613

2665

if not client["last_checked_ok"]:

2614

2666

logger.warning(

2615

"disabling client {0} - Client never "

2616

"performed a successful checker"

2617

.format(client_name))

2667

"disabling client {} - Client never "

2668

"performed a successful checker".format(

2669

client_name))

2618

2670

client["enabled"] = False

2619

2671

elif client["last_checker_status"] != 0:

2620

2672

logger.warning(

2621

"disabling client {0} - Client "

2622

"last checker failed with error code {1}"

2623

.format(client_name,

2624

client["last_checker_status"]))

2673

"disabling client {} - Client last"

2674

" checker failed with error code"

2675

" {}".format(

2676

client_name,

2677

client["last_checker_status"]))

2625

2678

client["enabled"] = False

2626

2679

else:

2627

client["expires"] = (datetime.datetime

2628

.utcnow()

2629

+ client["timeout"])

2680

client["expires"] = (

2681

datetime.datetime.utcnow()

2682

+ client["timeout"])

2630

2683

logger.debug("Last checker succeeded,"

2631

" keeping {0} enabled"

2632

.format(client_name))

2684

" keeping {} enabled".format(

2685

client_name))

2633

2686

try:

2634

client["secret"] = (

2635

pgp.decrypt(client["encrypted_secret"],

2636

client_settings[client_name]

2637

["secret"]))

2687

client["secret"] = pgp.decrypt(

2688

client["encrypted_secret"],

2689

client_settings[client_name]["secret"])

2638

2690

except PGPError:

2639

2691

# If decryption fails, we use secret from new settings

2640

logger.debug("Failed to decrypt {0} old secret"

2641

.format(client_name))

2642

client["secret"] = (

2643

client_settings[client_name]["secret"])

2692

logger.debug("Failed to decrypt {} old secret".format(

2693

client_name))

2694

client["secret"] = (client_settings[client_name]

2695

["secret"])

2644

2696

2645

2697

# Add/remove clients based on new changes made to config

2646

2698

for client_name in (set(old_client_settings)

2651

2703

clients_data[client_name] = client_settings[client_name]

2652

2704

2653

2705

# Create all client objects

2654

for client_name, client in clients_data.iteritems():

2706

for client_name, client in clients_data.items():

2655

2707

tcp_server.clients[client_name] = client_class(

2656

name = client_name, settings = client,

2708

name = client_name,

2709

settings = client,

2657

2710

server_settings = server_settings)

2658

2711

2659

2712

if not tcp_server.clients:

2661

2714

2662

2715

if not foreground:

2663

2716

if pidfile is not None:

2717

pid = os.getpid()

2664

2718

try:

2665

2719

with pidfile:

2666

pid = os.getpid()

2667

pidfile.write(str(pid) + "\n".encode("utf-8"))

2720

print(pid, file=pidfile)

2668

2721

except IOError:

2669

2722

logger.error("Could not write to file %r with PID %d",

2670

2723

pidfilename, pid)

2675

2728

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2676

2729

2677

2730

if use_dbus:

2678

@alternate_dbus_interfaces({"se.recompile.Mandos":

2679

"se.bsnet.fukt.Mandos"})

2731

2732

@alternate_dbus_interfaces(

2733

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2680

2734

class MandosDBusService(DBusObjectWithProperties):

2681

2735

"""A D-Bus proxy object"""

2736

2682

2737

def __init__(self):

2683

2738

dbus.service.Object.__init__(self, bus, "/")

2739

2684

2740

_interface = "se.recompile.Mandos"

2685

2741

2686

2742

@dbus_interface_annotations(_interface)

2687

2743

def _foo(self):

2688

return { "org.freedesktop.DBus.Property"

2689

".EmitsChangedSignal":

2690

"false"}

2744

return {

2745

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2746

"false" }

2691

2747

2692

2748

@dbus.service.signal(_interface, signature="o")

2693

2749

def ClientAdded(self, objpath):

2707

2763

@dbus.service.method(_interface, out_signature="ao")

2708

2764

def GetAllClients(self):

2709

2765

"D-Bus method"

2710

return dbus.Array(c.dbus_object_path

2711

for c in

2766

return dbus.Array(c.dbus_object_path for c in

2712

2767

tcp_server.clients.itervalues())

2713

2768

2714

2769

@dbus.service.method(_interface,

2716

2771

def GetAllClientsWithProperties(self):

2717

2772

"D-Bus method"

2718

2773

return dbus.Dictionary(

2719

((c.dbus_object_path, c.GetAll(""))

2720

for c in tcp_server.clients.itervalues()),

2774

{ c.dbus_object_path: c.GetAll("")

2775

for c in tcp_server.clients.itervalues() },

2721

2776

signature="oa{sv}")

2722

2777

2723

2778

@dbus.service.method(_interface, in_signature="o")

2740

2795

2741

2796

def cleanup():

2742

2797

"Cleanup function; run on exit"

2743

service.cleanup()

2798

if zeroconf:

2799

service.cleanup()

2744

2800

2745

2801

multiprocessing.active_children()

2746

2802

wnull.close()

2760

2816

2761

2817

# A list of attributes that can not be pickled

2762

2818

# + secret.

2763

exclude = set(("bus", "changedstate", "secret",

2764

"checker", "server_settings"))

2765

for name, typ in (inspect.getmembers

2766

(dbus.service.Object)):

2819

exclude = { "bus", "changedstate", "secret",

2820

"checker", "server_settings" }

2821

for name, typ in inspect.getmembers(dbus.service

2822

.Object):

2767

2823

exclude.add(name)

2768

2824

2769

2825

client_dict["encrypted_secret"] = (client

2776

2832

del client_settings[client.name]["secret"]

2777

2833

2778

2834

try:

2779

with (tempfile.NamedTemporaryFile

2780

(mode='wb', suffix=".pickle", prefix='clients-',

2781

dir=os.path.dirname(stored_state_path),

2782

delete=False)) as stored_state:

2835

with tempfile.NamedTemporaryFile(

2836

mode='wb',

2837

suffix=".pickle",

2838

prefix='clients-',

2839

dir=os.path.dirname(stored_state_path),

2840

delete=False) as stored_state:

2783

2841

pickle.dump((clients, client_settings), stored_state)

2784

tempname=stored_state.name

2842

tempname = stored_state.name

2785

2843

os.rename(tempname, stored_state_path)

2786

2844

except (IOError, OSError) as e:

2787

2845

if not debug:

2790

2848

except NameError:

2791

2849

pass

2792

2850

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2793

logger.warning("Could not save persistent state: {0}"

2851

logger.warning("Could not save persistent state: {}"

2794

2852

.format(os.strerror(e.errno)))

2795

2853

else:

2796

2854

logger.warning("Could not save persistent state:",

2806

2864

client.disable(quiet=True)

2807

2865

if use_dbus:

2808

2866

# Emit D-Bus signal

2809

mandos_dbus_service.ClientRemoved(client

2810

.dbus_object_path,

2811

client.name)

2867

mandos_dbus_service.ClientRemoved(

2868

client.dbus_object_path, client.name)

2812

2869

client_settings.clear()

2813

2870

2814

2871

atexit.register(cleanup)

2825

2882

tcp_server.server_activate()

2826

2883

2827

2884

# Find out what port we got

2828

service.port = tcp_server.socket.getsockname()[1]

2885

if zeroconf:

2886

service.port = tcp_server.socket.getsockname()[1]

2829

2887

if use_ipv6:

2830

2888

logger.info("Now listening on address %r, port %d,"

2831

2889

" flowinfo %d, scope_id %d",

2837

2895

#service.interface = tcp_server.socket.getsockname()[3]

2838

2896

2839

2897

try:

2840

# From the Avahi example code

2841

try:

2842

service.activate()

2843

except dbus.exceptions.DBusException as error:

2844

logger.critical("D-Bus Exception", exc_info=error)

2845

cleanup()

2846

sys.exit(1)

2847

# End of Avahi example code

2898

if zeroconf:

2899

# From the Avahi example code

2900

try:

2901

service.activate()

2902

except dbus.exceptions.DBusException as error:

2903

logger.critical("D-Bus Exception", exc_info=error)

2904

cleanup()

2905

sys.exit(1)

2906

# End of Avahi example code

2848

2907

2849

2908

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2850

2909

lambda *args, **kwargs:

2865

2924

# Must run before the D-Bus bus name gets deregistered

2866

2925

cleanup()

2867

2926

2927

2868

2928

if __name__ == '__main__':

2869

2929

main()