/mandos/trunk : revision 753

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

47

50

import gnutls.library.functions

48

51

import gnutls.library.constants

49

52

import gnutls.library.types

50

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

51

57

import sys

52

58

import re

53

59

import os

62

68

import struct

63

69

import fcntl

64

70

import functools

65

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

66

75

import multiprocessing

67

76

import types

68

77

import binascii

69

78

import tempfile

70

79

import itertools

71

80

import collections

81

import codecs

72

82

73

83

import dbus

74

84

import dbus.service

75

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

76

89

import avahi

77

90

from dbus.mainloop.glib import DBusGMainLoop

78

91

import ctypes

79

92

import ctypes.util

80

93

import xml.dom.minidom

81

94

import inspect

82

import GnuPGInterface

83

95

84

96

try:

85

97

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

89

101

except ImportError:

90

102

SO_BINDTODEVICE = None

91

103

92

version = "1.6.0"

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

93

108

stored_state_file = "clients.pickle"

94

109

95

110

logger = logging.getLogger()

96

syslogger = (logging.handlers.SysLogHandler

97

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

98

address = str("/dev/log")))

111

syslogger = None

99

112

100

113

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

104

116

except (OSError, AttributeError):

117

105

118

def if_nametoindex(interface):

106

119

"Get an interface index the hard way, i.e. using fcntl()"

107

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

121

with contextlib.closing(socket.socket()) as s:

109

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(str("16s16x"),

111

interface))

112

interface_index = struct.unpack(str("I"),

113

ifreq[16:20])[0]

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

114

125

return interface_index

115

126

116

127

117

128

def initlogger(debug, level=logging.WARNING):

118

129

"""init logger and add loglevel"""

119

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

120

135

syslogger.setFormatter(logging.Formatter

121

136

('Mandos [%(process)d]: %(levelname)s:'

122

137

' %(message)s'))

139

154

140

155

class PGPEngine(object):

141

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

142

158

def __init__(self):

143

self.gnupg = GnuPGInterface.GnuPG()

144

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

145

self.gnupg = GnuPGInterface.GnuPG()

146

self.gnupg.options.meta_interactive = False

147

self.gnupg.options.homedir = self.tempdir

148

self.gnupg.options.extra_args.extend(['--force-mdc',

149

'--quiet',

150

'--no-use-agent'])

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

151

165

152

166

def __enter__(self):

153

167

return self

175

189

def password_encode(self, password):

176

190

# Passphrase can not be empty and can not contain newlines or

177

191

# NUL bytes. So we prefix it and hex encode it.

178

return b"mandos" + binascii.hexlify(password)

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

179

199

180

200

def encrypt(self, data, password):

181

self.gnupg.passphrase = self.password_encode(password)

182

with open(os.devnull, "w") as devnull:

183

try:

184

proc = self.gnupg.run(['--symmetric'],

185

create_fhs=['stdin', 'stdout'],

186

attach_fhs={'stderr': devnull})

187

with contextlib.closing(proc.handles['stdin']) as f:

188

f.write(data)

189

with contextlib.closing(proc.handles['stdout']) as f:

190

ciphertext = f.read()

191

proc.wait()

192

except IOError as e:

193

raise PGPError(e)

194

self.gnupg.passphrase = None

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

195

216

return ciphertext

196

217

197

218

def decrypt(self, data, password):

198

self.gnupg.passphrase = self.password_encode(password)

199

with open(os.devnull, "w") as devnull:

200

try:

201

proc = self.gnupg.run(['--decrypt'],

202

create_fhs=['stdin', 'stdout'],

203

attach_fhs={'stderr': devnull})

204

with contextlib.closing(proc.handles['stdin']) as f:

205

f.write(data)

206

with contextlib.closing(proc.handles['stdout']) as f:

207

decrypted_plaintext = f.read()

208

proc.wait()

209

except IOError as e:

210

raise PGPError(e)

211

self.gnupg.passphrase = None

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

212

234

return decrypted_plaintext

213

235

214

236

215

237

class AvahiError(Exception):

216

238

def __init__(self, value, *args, **kwargs):

217

239

self.value = value

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

221

243

222

244

class AvahiServiceError(AvahiError):

223

245

pass

224

246

247

225

248

class AvahiGroupError(AvahiError):

226

249

pass

227

250

234

257

Used to optionally bind to the specified interface.

235

258

name: string; Example: 'Mandos'

236

259

type: string; Example: '_mandos._tcp'.

237

See <http://www.dns-sd.org/ServiceTypes.html>

260

See <https://www.iana.org/assignments/service-names-port-numbers>

238

261

port: integer; what port to announce

239

262

TXT: list of strings; TXT record for the service

240

263

domain: string; Domain to publish on, default to .local if empty.

247

270

bus: dbus.SystemBus()

248

271

"""

249

272

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

254

284

self.interface = interface

255

285

self.name = name

256

286

self.type = servicetype

266

296

self.bus = bus

267

297

self.entry_group_state_changed_match = None

268

298

269

def rename(self):

299

def rename(self, remove=True):

270

300

"""Derived from the Avahi example code"""

271

301

if self.rename_count >= self.max_renames:

272

302

logger.critical("No suitable Zeroconf service name found"

273

303

" after %i retries, exiting.",

274

304

self.rename_count)

275

305

raise AvahiServiceError("Too many renames")

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

278

309

logger.info("Changing Zeroconf service name to %r ...",

279

310

self.name)

280

self.remove()

311

if remove:

312

self.remove()

281

313

try:

282

314

self.add()

283

315

except dbus.exceptions.DBusException as error:

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

287

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

288

324

289

325

def remove(self):

290

326

"""Derived from the Avahi example code"""

328

364

self.rename()

329

365

elif state == avahi.ENTRY_GROUP_FAILURE:

330

366

logger.critical("Avahi: Error in group state changed %s",

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

334

369

335

370

def cleanup(self):

336

371

"""Derived from the Avahi example code"""

346

381

def server_state_changed(self, state, error=None):

347

382

"""Derived from the Avahi example code"""

348

383

logger.debug("Avahi server state change: %i", state)

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

356

390

if state in bad_states:

357

391

if bad_states[state] is not None:

358

392

if error is None:

377

411

follow_name_owner_changes=True),

378

412

avahi.DBUS_INTERFACE_SERVER)

379

413

self.server.connect_to_signal("StateChanged",

380

self.server_state_changed)

414

self.server_state_changed)

381

415

self.server_state_changed(self.server.GetState())

382

416

383

417

384

418

class AvahiServiceToSyslog(AvahiService):

385

def rename(self):

419

def rename(self, *args, **kwargs):

386

420

"""Add the new name to the syslog messages"""

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

421

ret = AvahiService.rename(self, *args, **kwargs)

422

syslogger.setFormatter(logging.Formatter(

423

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

424

.format(self.name)))

392

425

return ret

393

426

394

427

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

400

401

402

428

class Client(object):

403

429

"""A representation of a client host served by this server.

404

430

440

466

runtime_expansions: Allowed attributes for runtime expansion.

441

467

expires: datetime.datetime(); time (UTC) when a client will be

442

468

disabled, or None

469

server_settings: The server_settings dict from main()

443

470

"""

444

471

445

472

runtime_expansions = ("approval_delay", "approval_duration",

447

474

"fingerprint", "host", "interval",

448

475

"last_approval_request", "last_checked_ok",

449

476

"last_enabled", "name", "timeout")

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

460

461

def timeout_milliseconds(self):

462

"Return the 'timeout' attribute in milliseconds"

463

return timedelta_to_milliseconds(self.timeout)

464

465

def extended_timeout_milliseconds(self):

466

"Return the 'extended_timeout' attribute in milliseconds"

467

return timedelta_to_milliseconds(self.extended_timeout)

468

469

def interval_milliseconds(self):

470

"Return the 'interval' attribute in milliseconds"

471

return timedelta_to_milliseconds(self.interval)

472

473

def approval_delay_milliseconds(self):

474

return timedelta_to_milliseconds(self.approval_delay)

477

client_defaults = {

478

"timeout": "PT5M",

479

"extended_timeout": "PT15M",

480

"interval": "PT2M",

481

"checker": "fping -q -- %%(host)s",

482

"host": "",

483

"approval_delay": "PT0S",

484

"approval_duration": "PT1S",

485

"approved_by_default": "True",

486

"enabled": "True",

487

}

475

488

476

489

@staticmethod

477

490

def config_parser(config):

493

506

client["enabled"] = config.getboolean(client_name,

494

507

"enabled")

495

508

509

# Uppercase and remove spaces from fingerprint for later

510

# comparison purposes with return value from the

511

# fingerprint() function

496

512

client["fingerprint"] = (section["fingerprint"].upper()

497

513

.replace(" ", ""))

498

514

if "secret" in section:

503

519

"rb") as secfile:

504

520

client["secret"] = secfile.read()

505

521

else:

506

raise TypeError("No secret or secfile for section {0}"

522

raise TypeError("No secret or secfile for section {}"

507

523

.format(section))

508

524

client["timeout"] = string_to_delta(section["timeout"])

509

525

client["extended_timeout"] = string_to_delta(

520

536

521

537

return settings

522

538

523

def __init__(self, settings, name = None):

539

def __init__(self, settings, name = None, server_settings=None):

524

540

self.name = name

541

if server_settings is None:

542

server_settings = {}

543

self.server_settings = server_settings

525

544

# adding all client settings

526

for setting, value in settings.iteritems():

545

for setting, value in settings.items():

527

546

setattr(self, setting, value)

528

547

529

548

if self.enabled:

537

556

self.expires = None

538

557

539

558

logger.debug("Creating client %r", self.name)

540

# Uppercase and remove spaces from fingerprint for later

541

# comparison purposes with return value from the fingerprint()

542

# function

543

559

logger.debug(" Fingerprint: %s", self.fingerprint)

544

560

self.created = settings.get("created",

545

561

datetime.datetime.utcnow())

552

568

self.current_checker_command = None

553

569

self.approved = None

554

570

self.approvals_pending = 0

555

self.changedstate = (multiprocessing_manager

556

.Condition(multiprocessing_manager

557

.Lock()))

558

self.client_structure = [attr for attr in

559

self.__dict__.iterkeys()

571

self.changedstate = multiprocessing_manager.Condition(

572

multiprocessing_manager.Lock())

573

self.client_structure = [attr

574

for attr in self.__dict__.iterkeys()

560

575

if not attr.startswith("_")]

561

576

self.client_structure.append("client_structure")

562

577

563

for name, t in inspect.getmembers(type(self),

564

lambda obj:

565

isinstance(obj,

566

property)):

578

for name, t in inspect.getmembers(

579

type(self), lambda obj: isinstance(obj, property)):

567

580

if not name.startswith("_"):

568

581

self.client_structure.append(name)

569

582

611

624

# and every interval from then on.

612

625

if self.checker_initiator_tag is not None:

613

626

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = (gobject.timeout_add

615

(self.interval_milliseconds(),

616

self.start_checker))

627

self.checker_initiator_tag = gobject.timeout_add(

628

int(self.interval.total_seconds() * 1000),

629

self.start_checker)

617

630

# Schedule a disable() when 'timeout' has passed

618

631

if self.disable_initiator_tag is not None:

619

632

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = (gobject.timeout_add

621

(self.timeout_milliseconds(),

622

self.disable))

633

self.disable_initiator_tag = gobject.timeout_add(

634

int(self.timeout.total_seconds() * 1000), self.disable)

623

635

# Also start a new checker *right now*.

624

636

self.start_checker()

625

637

634

646

vars(self))

635

647

self.checked_ok()

636

648

else:

637

logger.info("Checker for %(name)s failed",

638

vars(self))

649

logger.info("Checker for %(name)s failed", vars(self))

639

650

else:

640

651

self.last_checker_status = -1

641

652

logger.warning("Checker for %(name)s crashed?",

655

666

gobject.source_remove(self.disable_initiator_tag)

656

667

self.disable_initiator_tag = None

657

668

if getattr(self, "enabled", False):

658

self.disable_initiator_tag = (gobject.timeout_add

659

(timedelta_to_milliseconds

660

(timeout), self.disable))

669

self.disable_initiator_tag = gobject.timeout_add(

670

int(timeout.total_seconds() * 1000), self.disable)

661

671

self.expires = datetime.datetime.utcnow() + timeout

662

672

663

673

def need_approval(self):

680

690

# If a checker exists, make sure it is not a zombie

681

691

try:

682

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

683

except (AttributeError, OSError) as error:

684

if (isinstance(error, OSError)

685

and error.errno != errno.ECHILD):

686

raise error

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

687

698

else:

688

699

if pid:

689

700

logger.warning("Checker was a zombie")

693

704

# Start a new checker if needed

694

705

if self.checker is None:

695

706

# Escape attributes for the shell

696

escaped_attrs = dict(

697

(attr, re.escape(unicode(getattr(self, attr))))

698

for attr in

699

self.runtime_expansions)

707

escaped_attrs = {

708

attr: re.escape(str(getattr(self, attr)))

709

for attr in self.runtime_expansions }

700

710

try:

701

711

command = self.checker_command % escaped_attrs

702

712

except TypeError as error:

703

713

logger.error('Could not format string "%s"',

704

self.checker_command, exc_info=error)

705

return True # Try again later

714

self.checker_command,

715

exc_info=error)

716

return True # Try again later

706

717

self.current_checker_command = command

707

718

try:

708

logger.info("Starting checker %r for %s",

709

command, self.name)

719

logger.info("Starting checker %r for %s", command,

720

self.name)

710

721

# We don't need to redirect stdout and stderr, since

711

722

# in normal mode, that is already done by daemon(),

712

723

# and in debug mode we don't want to. (Stdin is

713

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

714

733

self.checker = subprocess.Popen(command,

715

734

close_fds=True,

716

shell=True, cwd="/")

735

shell=True,

736

cwd="/",

737

**popen_args)

717

738

except OSError as error:

718

739

logger.error("Failed to start subprocess",

719

740

exc_info=error)

720

self.checker_callback_tag = (gobject.child_watch_add

721

(self.checker.pid,

722

self.checker_callback,

723

data=command))

741

return True

742

self.checker_callback_tag = gobject.child_watch_add(

743

self.checker.pid, self.checker_callback, data=command)

724

744

# The checker may have completed before the gobject

725

745

# watch was added. Check for this.

726

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

746

try:

747

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

748

except OSError as error:

749

if error.errno == errno.ECHILD:

750

# This should never happen

751

logger.error("Child process vanished",

752

exc_info=error)

753

return True

754

raise

727

755

if pid:

728

756

gobject.source_remove(self.checker_callback_tag)

729

757

self.checker_callback(pid, status, command)

749

777

self.checker = None

750

778

751

779

752

def dbus_service_property(dbus_interface, signature="v",

753

access="readwrite", byte_arrays=False):

780

def dbus_service_property(dbus_interface,

781

signature="v",

782

access="readwrite",

783

byte_arrays=False):

754

784

"""Decorators for marking methods of a DBusObjectWithProperties to

755

785

become properties on the D-Bus.

756

786

765

795

# "Set" method, so we fail early here:

766

796

if byte_arrays and signature != "ay":

767

797

raise ValueError("Byte arrays not supported for non-'ay'"

768

" signature {0!r}".format(signature))

798

" signature {!r}".format(signature))

799

769

800

def decorator(func):

770

801

func._dbus_is_property = True

771

802

func._dbus_interface = dbus_interface

776

807

func._dbus_name = func._dbus_name[:-14]

777

808

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

778

809

return func

810

779

811

return decorator

780

812

781

813

790

822

"org.freedesktop.DBus.Property.EmitsChangedSignal":

791

823

"false"}

792

824

"""

825

793

826

def decorator(func):

794

827

func._dbus_is_interface = True

795

828

func._dbus_interface = dbus_interface

796

829

func._dbus_name = dbus_interface

797

830

return func

831

798

832

return decorator

799

833

800

834

802

836

"""Decorator to annotate D-Bus methods, signals or properties

803

837

Usage:

804

838

839

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

840

"org.freedesktop.DBus.Property."

841

"EmitsChangedSignal": "false"})

805

842

@dbus_service_property("org.example.Interface", signature="b",

806

843

access="r")

807

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

808

"org.freedesktop.DBus.Property."

809

"EmitsChangedSignal": "false"})

810

844

def Property_dbus_property(self):

811

845

return dbus.Boolean(False)

812

846

"""

847

813

848

def decorator(func):

814

849

func._dbus_annotations = annotations

815

850

return func

851

816

852

return decorator

817

853

818

854

819

855

class DBusPropertyException(dbus.exceptions.DBusException):

820

856

"""A base class for D-Bus property-related exceptions

821

857

"""

822

def __unicode__(self):

823

return unicode(str(self))

858

pass

824

859

825

860

826

861

class DBusPropertyAccessException(DBusPropertyException):

850

885

If called like _is_dbus_thing("method") it returns a function

851

886

suitable for use as predicate to inspect.getmembers().

852

887

"""

853

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

854

889

False)

855

890

856

891

def _get_all_dbus_things(self, thing):

857

892

"""Returns a generator of (name, attribute) pairs

858

893

"""

859

return ((getattr(athing.__get__(self), "_dbus_name",

860

name),

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

861

895

athing.__get__(self))

862

896

for cls in self.__class__.__mro__

863

897

for name, athing in

864

inspect.getmembers(cls,

865

self._is_dbus_thing(thing)))

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

866

899

867

900

def _get_dbus_property(self, interface_name, property_name):

868

901

"""Returns a bound method if one exists which is a D-Bus

869

902

property with the specified name and interface.

870

903

"""

871

for cls in self.__class__.__mro__:

872

for name, value in (inspect.getmembers

873

(cls,

874

self._is_dbus_thing("property"))):

904

for cls in self.__class__.__mro__:

905

for name, value in inspect.getmembers(

906

cls, self._is_dbus_thing("property")):

875

907

if (value._dbus_name == property_name

876

908

and value._dbus_interface == interface_name):

877

909

return value.__get__(self)

878

910

879

911

# No such property

880

raise DBusPropertyNotFound(self.dbus_object_path + ":"

881

+ interface_name + "."

882

+ property_name)

912

raise DBusPropertyNotFound("{}:{}.{}".format(

913

self.dbus_object_path, interface_name, property_name))

883

914

884

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

915

@dbus.service.method(dbus.PROPERTIES_IFACE,

916

in_signature="ss",

885

917

out_signature="v")

886

918

def Get(self, interface_name, property_name):

887

919

"""Standard D-Bus property Get() method, see D-Bus standard.

905

937

# The byte_arrays option is not supported yet on

906

938

# signatures other than "ay".

907

939

if prop._dbus_signature != "ay":

908

raise ValueError

940

raise ValueError("Byte arrays not supported for non-"

941

"'ay' signature {!r}"

942

.format(prop._dbus_signature))

909

943

value = dbus.ByteArray(b''.join(chr(byte)

910

944

for byte in value))

911

945

prop(value)

912

946

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

947

@dbus.service.method(dbus.PROPERTIES_IFACE,

948

in_signature="s",

914

949

out_signature="a{sv}")

915

950

def GetAll(self, interface_name):

916

951

"""Standard D-Bus property GetAll() method, see D-Bus

931

966

if not hasattr(value, "variant_level"):

932

967

properties[name] = value

933

968

continue

934

properties[name] = type(value)(value, variant_level=

935

value.variant_level+1)

969

properties[name] = type(value)(

970

value, variant_level = value.variant_level + 1)

936

971

return dbus.Dictionary(properties, signature="sv")

937

972

973

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

974

def PropertiesChanged(self, interface_name, changed_properties,

975

invalidated_properties):

976

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

977

standard.

978

"""

979

pass

980

938

981

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

939

982

out_signature="s",

940

983

path_keyword='object_path',

948

991

connection)

949

992

try:

950

993

document = xml.dom.minidom.parseString(xmlstring)

994

951

995

def make_tag(document, name, prop):

952

996

e = document.createElement("property")

953

997

e.setAttribute("name", name)

954

998

e.setAttribute("type", prop._dbus_signature)

955

999

e.setAttribute("access", prop._dbus_access)

956

1000

return e

1001

957

1002

for if_tag in document.getElementsByTagName("interface"):

958

1003

# Add property tags

959

1004

for tag in (make_tag(document, name, prop)

971

1016

if (name == tag.getAttribute("name")

972

1017

and prop._dbus_interface

973

1018

== if_tag.getAttribute("name")):

974

annots.update(getattr

975

(prop,

976

"_dbus_annotations",

977

{}))

978

for name, value in annots.iteritems():

1019

annots.update(getattr(

1020

prop, "_dbus_annotations", {}))

1021

for name, value in annots.items():

979

1022

ann_tag = document.createElement(

980

1023

"annotation")

981

1024

ann_tag.setAttribute("name", name)

984

1027

# Add interface annotation tags

985

1028

for annotation, value in dict(

986

1029

itertools.chain.from_iterable(

987

annotations().iteritems()

988

for name, annotations in

989

self._get_all_dbus_things("interface")

1030

annotations().items()

1031

for name, annotations

1032

in self._get_all_dbus_things("interface")

990

1033

if name == if_tag.getAttribute("name")

991

)).iteritems():

1034

)).items():

992

1035

ann_tag = document.createElement("annotation")

993

1036

ann_tag.setAttribute("name", annotation)

994

1037

ann_tag.setAttribute("value", value)

1021

1064

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1022

1065

if dt is None:

1023

1066

return dbus.String("", variant_level = variant_level)

1024

return dbus.String(dt.isoformat(),

1025

variant_level=variant_level)

1067

return dbus.String(dt.isoformat(), variant_level=variant_level)

1026

1068

1027

1069

1028

1070

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1048

1090

(from DBusObjectWithProperties) and interfaces (from the

1049

1091

dbus_interface_annotations decorator).

1050

1092

"""

1093

1051

1094

def wrapper(cls):

1052

1095

for orig_interface_name, alt_interface_name in (

1053

alt_interface_names.iteritems()):

1096

alt_interface_names.items()):

1054

1097

attr = {}

1055

1098

interface_names = set()

1056

1099

# Go though all attributes of the class

1058

1101

# Ignore non-D-Bus attributes, and D-Bus attributes

1059

1102

# with the wrong interface name

1060

1103

if (not hasattr(attribute, "_dbus_interface")

1061

or not attribute._dbus_interface

1062

.startswith(orig_interface_name)):

1104

or not attribute._dbus_interface.startswith(

1105

orig_interface_name)):

1063

1106

continue

1064

1107

# Create an alternate D-Bus interface name based on

1065

1108

# the current name

1066

alt_interface = (attribute._dbus_interface

1067

.replace(orig_interface_name,

1068

alt_interface_name))

1109

alt_interface = attribute._dbus_interface.replace(

1110

orig_interface_name, alt_interface_name)

1069

1111

interface_names.add(alt_interface)

1070

1112

# Is this a D-Bus signal?

1071

1113

if getattr(attribute, "_dbus_is_signal", False):

1072

# Extract the original non-method function by

1073

# black magic

1114

# Extract the original non-method undecorated

1115

# function by black magic

1074

1116

nonmethod_func = (dict(

1075

zip(attribute.func_code.co_freevars,

1076

attribute.__closure__))["func"]

1077

.cell_contents)

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1078

1120

# Create a new, but exactly alike, function

1079

1121

# object, and decorate it to be a new D-Bus signal

1080

1122

# with the alternate D-Bus interface name

1081

new_function = (dbus.service.signal

1082

(alt_interface,

1083

attribute._dbus_signature)

1123

new_function = (dbus.service.signal(

1124

alt_interface, attribute._dbus_signature)

1084

1125

(types.FunctionType(

1085

nonmethod_func.func_code,

1086

nonmethod_func.func_globals,

1087

nonmethod_func.func_name,

1088

nonmethod_func.func_defaults,

1089

nonmethod_func.func_closure)))

1126

nonmethod_func.func_code,

1127

nonmethod_func.func_globals,

1128

nonmethod_func.func_name,

1129

nonmethod_func.func_defaults,

1130

nonmethod_func.func_closure)))

1090

1131

# Copy annotations, if any

1091

1132

try:

1092

new_function._dbus_annotations = (

1093

dict(attribute._dbus_annotations))

1133

new_function._dbus_annotations = dict(

1134

attribute._dbus_annotations)

1094

1135

except AttributeError:

1095

1136

pass

1096

1137

# Define a creator of a function to call both the

1101

1142

"""This function is a scope container to pass

1102

1143

func1 and func2 to the "call_both" function

1103

1144

outside of its arguments"""

1145

1104

1146

def call_both(*args, **kwargs):

1105

1147

"""This function will emit two D-Bus

1106

1148

signals by calling func1 and func2"""

1107

1149

func1(*args, **kwargs)

1108

1150

func2(*args, **kwargs)

1151

1109

1152

return call_both

1110

1153

# Create the "call_both" function and add it to

1111

1154

# the class

1116

1159

# object. Decorate it to be a new D-Bus method

1117

1160

# with the alternate D-Bus interface name. Add it

1118

1161

# to the class.

1119

attr[attrname] = (dbus.service.method

1120

(alt_interface,

1121

attribute._dbus_in_signature,

1122

attribute._dbus_out_signature)

1123

(types.FunctionType

1124

(attribute.func_code,

1125

attribute.func_globals,

1126

attribute.func_name,

1127

attribute.func_defaults,

1128

attribute.func_closure)))

1162

attr[attrname] = (

1163

dbus.service.method(

1164

alt_interface,

1165

attribute._dbus_in_signature,

1166

attribute._dbus_out_signature)

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1129

1172

# Copy annotations, if any

1130

1173

try:

1131

attr[attrname]._dbus_annotations = (

1132

dict(attribute._dbus_annotations))

1174

attr[attrname]._dbus_annotations = dict(

1175

attribute._dbus_annotations)

1133

1176

except AttributeError:

1134

1177

pass

1135

1178

# Is this a D-Bus property?

1138

1181

# object, and decorate it to be a new D-Bus

1139

1182

# property with the alternate D-Bus interface

1140

1183

# name. Add it to the class.

1141

attr[attrname] = (dbus_service_property

1142

(alt_interface,

1143

attribute._dbus_signature,

1144

attribute._dbus_access,

1145

attribute

1146

._dbus_get_args_options

1147

["byte_arrays"])

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1184

attr[attrname] = (dbus_service_property(

1185

alt_interface, attribute._dbus_signature,

1186

attribute._dbus_access,

1187

attribute._dbus_get_args_options

1188

["byte_arrays"])

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1154

1195

# Copy annotations, if any

1155

1196

try:

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1197

attr[attrname]._dbus_annotations = dict(

1198

attribute._dbus_annotations)

1158

1199

except AttributeError:

1159

1200

pass

1160

1201

# Is this a D-Bus interface?

1163

1204

# object. Decorate it to be a new D-Bus interface

1164

1205

# with the alternate D-Bus interface name. Add it

1165

1206

# to the class.

1166

attr[attrname] = (dbus_interface_annotations

1167

(alt_interface)

1168

(types.FunctionType

1169

(attribute.func_code,

1170

attribute.func_globals,

1171

attribute.func_name,

1172

attribute.func_defaults,

1173

attribute.func_closure)))

1207

attr[attrname] = (

1208

dbus_interface_annotations(alt_interface)

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1174

1214

if deprecate:

1175

1215

# Deprecate all alternate interfaces

1176

iname="_AlternateDBusNames_interface_annotation{0}"

1216

iname="_AlternateDBusNames_interface_annotation{}"

1177

1217

for interface_name in interface_names:

1218

1178

1219

@dbus_interface_annotations(interface_name)

1179

1220

def func(self):

1180

1221

return { "org.freedesktop.DBus.Deprecated":

1181

"true" }

1222

"true" }

1182

1223

# Find an unused name

1183

1224

for aname in (iname.format(i)

1184

1225

for i in itertools.count()):

1188

1229

if interface_names:

1189

1230

# Replace the class with a new subclass of it with

1190

1231

# methods, signals, etc. as created above.

1191

cls = type(b"{0}Alternate".format(cls.__name__),

1192

(cls,), attr)

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1193

1234

return cls

1235

1194

1236

return wrapper

1195

1237

1196

1238

1197

1239

@alternate_dbus_interfaces({"se.recompile.Mandos":

1198

"se.bsnet.fukt.Mandos"})

1240

"se.bsnet.fukt.Mandos"})

1199

1241

class ClientDBus(Client, DBusObjectWithProperties):

1200

1242

"""A Client class using D-Bus

1201

1243

1205

1247

"""

1206

1248

1207

1249

runtime_expansions = (Client.runtime_expansions

1208

+ ("dbus_object_path",))

1250

+ ("dbus_object_path", ))

1251

1252

_interface = "se.recompile.Mandos.Client"

1209

1253

1210

1254

# dbus.service.Object doesn't use super(), so we can't either.

1211

1255

1214

1258

Client.__init__(self, *args, **kwargs)

1215

1259

# Only now, when this client is initialized, can it show up on

1216

1260

# the D-Bus

1217

client_object_name = unicode(self.name).translate(

1261

client_object_name = str(self.name).translate(

1218

1262

{ord("."): ord("_"),

1219

1263

ord("-"): ord("_")})

1220

self.dbus_object_path = (dbus.ObjectPath

1221

("/clients/" + client_object_name))

1264

self.dbus_object_path = dbus.ObjectPath(

1265

"/clients/" + client_object_name)

1222

1266

DBusObjectWithProperties.__init__(self, self.bus,

1223

1267

self.dbus_object_path)

1224

1268

1225

def notifychangeproperty(transform_func,

1226

dbus_name, type_func=lambda x: x,

1227

variant_level=1):

1269

def notifychangeproperty(transform_func, dbus_name,

1270

type_func=lambda x: x,

1271

variant_level=1,

1272

invalidate_only=False,

1273

_interface=_interface):

1228

1274

""" Modify a variable so that it's a property which announces

1229

1275

its changes to DBus.

1230

1276

1235

1281

to the D-Bus. Default: no transform

1236

1282

variant_level: D-Bus variant level. Default: 1

1237

1283

"""

1238

attrname = "_{0}".format(dbus_name)

1284

attrname = "_{}".format(dbus_name)

1285

1239

1286

def setter(self, value):

1240

1287

if hasattr(self, "dbus_object_path"):

1241

1288

if (not hasattr(self, attrname) or

1242

1289

type_func(getattr(self, attrname, None))

1243

1290

!= type_func(value)):

1244

dbus_value = transform_func(type_func(value),

1245

variant_level

1246

=variant_level)

1247

self.PropertyChanged(dbus.String(dbus_name),

1248

dbus_value)

1291

if invalidate_only:

1292

self.PropertiesChanged(

1293

_interface, dbus.Dictionary(),

1294

dbus.Array((dbus_name, )))

1295

else:

1296

dbus_value = transform_func(

1297

type_func(value),

1298

variant_level = variant_level)

1299

self.PropertyChanged(dbus.String(dbus_name),

1300

dbus_value)

1301

self.PropertiesChanged(

1302

_interface,

1303

dbus.Dictionary({ dbus.String(dbus_name):

1304

dbus_value }),

1305

dbus.Array())

1249

1306

setattr(self, attrname, value)

1250

1307

1251

1308

return property(lambda self: getattr(self, attrname), setter)

1257

1314

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1258

1315

last_enabled = notifychangeproperty(datetime_to_dbus,

1259

1316

"LastEnabled")

1260

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1261

type_func = lambda checker:

1262

checker is not None)

1317

checker = notifychangeproperty(

1318

dbus.Boolean, "CheckerRunning",

1319

type_func = lambda checker: checker is not None)

1263

1320

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1264

1321

"LastCheckedOK")

1265

1322

last_checker_status = notifychangeproperty(dbus.Int16,

1268

1325

datetime_to_dbus, "LastApprovalRequest")

1269

1326

approved_by_default = notifychangeproperty(dbus.Boolean,

1270

1327

"ApprovedByDefault")

1271

approval_delay = notifychangeproperty(dbus.UInt64,

1272

"ApprovalDelay",

1273

type_func =

1274

timedelta_to_milliseconds)

1328

approval_delay = notifychangeproperty(

1329

dbus.UInt64, "ApprovalDelay",

1330

type_func = lambda td: td.total_seconds() * 1000)

1275

1331

approval_duration = notifychangeproperty(

1276

1332

dbus.UInt64, "ApprovalDuration",

1277

type_func = timedelta_to_milliseconds)

1333

type_func = lambda td: td.total_seconds() * 1000)

1278

1334

host = notifychangeproperty(dbus.String, "Host")

1279

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1280

type_func =

1281

timedelta_to_milliseconds)

1335

timeout = notifychangeproperty(

1336

dbus.UInt64, "Timeout",

1337

type_func = lambda td: td.total_seconds() * 1000)

1282

1338

extended_timeout = notifychangeproperty(

1283

1339

dbus.UInt64, "ExtendedTimeout",

1284

type_func = timedelta_to_milliseconds)

1285

interval = notifychangeproperty(dbus.UInt64,

1286

"Interval",

1287

type_func =

1288

timedelta_to_milliseconds)

1340

type_func = lambda td: td.total_seconds() * 1000)

1341

interval = notifychangeproperty(

1342

dbus.UInt64, "Interval",

1343

type_func = lambda td: td.total_seconds() * 1000)

1289

1344

checker_command = notifychangeproperty(dbus.String, "Checker")

1345

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1346

invalidate_only=True)

1290

1347

1291

1348

del notifychangeproperty

1292

1349

1319

1376

*args, **kwargs)

1320

1377

1321

1378

def start_checker(self, *args, **kwargs):

1322

old_checker = self.checker

1323

if self.checker is not None:

1324

old_checker_pid = self.checker.pid

1325

else:

1326

old_checker_pid = None

1379

old_checker_pid = getattr(self.checker, "pid", None)

1327

1380

r = Client.start_checker(self, *args, **kwargs)

1328

1381

# Only if new checker process was started

1329

1382

if (self.checker is not None

1338

1391

1339

1392

def approve(self, value=True):

1340

1393

self.approved = value

1341

gobject.timeout_add(timedelta_to_milliseconds

1342

(self.approval_duration),

1343

self._reset_approved)

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1395

* 1000), self._reset_approved)

1344

1396

self.send_changedstate()

1345

1397

1346

1398

## D-Bus methods, signals & properties

1347

_interface = "se.recompile.Mandos.Client"

1348

1399

1349

1400

## Interfaces

1350

1401

1351

@dbus_interface_annotations(_interface)

1352

def _foo(self):

1353

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1354

"false"}

1355

1356

1402

## Signals

1357

1403

1358

1404

# CheckerCompleted - signal

1368

1414

pass

1369

1415

1370

1416

# PropertyChanged - signal

1417

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1371

1418

@dbus.service.signal(_interface, signature="sv")

1372

1419

def PropertyChanged(self, property, value):

1373

1420

"D-Bus signal"

1437

1484

return dbus.Boolean(bool(self.approvals_pending))

1438

1485

1439

1486

# ApprovedByDefault - property

1440

@dbus_service_property(_interface, signature="b",

1487

@dbus_service_property(_interface,

1488

signature="b",

1441

1489

access="readwrite")

1442

1490

def ApprovedByDefault_dbus_property(self, value=None):

1443

1491

if value is None: # get

1445

1493

self.approved_by_default = bool(value)

1446

1494

1447

1495

# ApprovalDelay - property

1448

@dbus_service_property(_interface, signature="t",

1496

@dbus_service_property(_interface,

1497

signature="t",

1449

1498

access="readwrite")

1450

1499

def ApprovalDelay_dbus_property(self, value=None):

1451

1500

if value is None: # get

1452

return dbus.UInt64(self.approval_delay_milliseconds())

1501

return dbus.UInt64(self.approval_delay.total_seconds()

1502

* 1000)

1453

1503

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1454

1504

1455

1505

# ApprovalDuration - property

1456

@dbus_service_property(_interface, signature="t",

1506

@dbus_service_property(_interface,

1507

signature="t",

1457

1508

access="readwrite")

1458

1509

def ApprovalDuration_dbus_property(self, value=None):

1459

1510

if value is None: # get

1460

return dbus.UInt64(timedelta_to_milliseconds(

1461

self.approval_duration))

1511

return dbus.UInt64(self.approval_duration.total_seconds()

1512

* 1000)

1462

1513

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1463

1514

1464

1515

# Name - property

1472

1523

return dbus.String(self.fingerprint)

1473

1524

1474

1525

# Host - property

1475

@dbus_service_property(_interface, signature="s",

1526

@dbus_service_property(_interface,

1527

signature="s",

1476

1528

access="readwrite")

1477

1529

def Host_dbus_property(self, value=None):

1478

1530

if value is None: # get

1479

1531

return dbus.String(self.host)

1480

self.host = unicode(value)

1532

self.host = str(value)

1481

1533

1482

1534

# Created - property

1483

1535

@dbus_service_property(_interface, signature="s", access="read")

1490

1542

return datetime_to_dbus(self.last_enabled)

1491

1543

1492

1544

# Enabled - property

1493

@dbus_service_property(_interface, signature="b",

1545

@dbus_service_property(_interface,

1546

signature="b",

1494

1547

access="readwrite")

1495

1548

def Enabled_dbus_property(self, value=None):

1496

1549

if value is None: # get

1501

1554

self.disable()

1502

1555

1503

1556

# LastCheckedOK - property

1504

@dbus_service_property(_interface, signature="s",

1557

@dbus_service_property(_interface,

1558

signature="s",

1505

1559

access="readwrite")

1506

1560

def LastCheckedOK_dbus_property(self, value=None):

1507

1561

if value is not None:

1510

1564

return datetime_to_dbus(self.last_checked_ok)

1511

1565

1512

1566

# LastCheckerStatus - property

1513

@dbus_service_property(_interface, signature="n",

1514

access="read")

1567

@dbus_service_property(_interface, signature="n", access="read")

1515

1568

def LastCheckerStatus_dbus_property(self):

1516

1569

return dbus.Int16(self.last_checker_status)

1517

1570

1526

1579

return datetime_to_dbus(self.last_approval_request)

1527

1580

1528

1581

# Timeout - property

1529

@dbus_service_property(_interface, signature="t",

1582

@dbus_service_property(_interface,

1583

signature="t",

1530

1584

access="readwrite")

1531

1585

def Timeout_dbus_property(self, value=None):

1532

1586

if value is None: # get

1533

return dbus.UInt64(self.timeout_milliseconds())

1587

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1534

1588

old_timeout = self.timeout

1535

1589

self.timeout = datetime.timedelta(0, 0, 0, value)

1536

1590

# Reschedule disabling

1545

1599

is None):

1546

1600

return

1547

1601

gobject.source_remove(self.disable_initiator_tag)

1548

self.disable_initiator_tag = (

1549

gobject.timeout_add(

1550

timedelta_to_milliseconds(self.expires - now),

1551

self.disable))

1602

self.disable_initiator_tag = gobject.timeout_add(

1603

int((self.expires - now).total_seconds() * 1000),

1604

self.disable)

1552

1605

1553

1606

# ExtendedTimeout - property

1554

@dbus_service_property(_interface, signature="t",

1607

@dbus_service_property(_interface,

1608

signature="t",

1555

1609

access="readwrite")

1556

1610

def ExtendedTimeout_dbus_property(self, value=None):

1557

1611

if value is None: # get

1558

return dbus.UInt64(self.extended_timeout_milliseconds())

1612

return dbus.UInt64(self.extended_timeout.total_seconds()

1613

* 1000)

1559

1614

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1560

1615

1561

1616

# Interval - property

1562

@dbus_service_property(_interface, signature="t",

1617

@dbus_service_property(_interface,

1618

signature="t",

1563

1619

access="readwrite")

1564

1620

def Interval_dbus_property(self, value=None):

1565

1621

if value is None: # get

1566

return dbus.UInt64(self.interval_milliseconds())

1622

return dbus.UInt64(self.interval.total_seconds() * 1000)

1567

1623

self.interval = datetime.timedelta(0, 0, 0, value)

1568

1624

if getattr(self, "checker_initiator_tag", None) is None:

1569

1625

return

1570

1626

if self.enabled:

1571

1627

# Reschedule checker run

1572

1628

gobject.source_remove(self.checker_initiator_tag)

1573

self.checker_initiator_tag = (gobject.timeout_add

1574

(value, self.start_checker))

1575

self.start_checker() # Start one now, too

1629

self.checker_initiator_tag = gobject.timeout_add(

1630

value, self.start_checker)

1631

self.start_checker() # Start one now, too

1576

1632

1577

1633

# Checker - property

1578

@dbus_service_property(_interface, signature="s",

1634

@dbus_service_property(_interface,

1635

signature="s",

1579

1636

access="readwrite")

1580

1637

def Checker_dbus_property(self, value=None):

1581

1638

if value is None: # get

1582

1639

return dbus.String(self.checker_command)

1583

self.checker_command = unicode(value)

1640

self.checker_command = str(value)

1584

1641

1585

1642

# CheckerRunning - property

1586

@dbus_service_property(_interface, signature="b",

1643

@dbus_service_property(_interface,

1644

signature="b",

1587

1645

access="readwrite")

1588

1646

def CheckerRunning_dbus_property(self, value=None):

1589

1647

if value is None: # get

1599

1657

return self.dbus_object_path # is already a dbus.ObjectPath

1600

1658

1601

1659

# Secret = property

1602

@dbus_service_property(_interface, signature="ay",

1603

access="write", byte_arrays=True)

1660

@dbus_service_property(_interface,

1661

signature="ay",

1662

access="write",

1663

byte_arrays=True)

1604

1664

def Secret_dbus_property(self, value):

1605

self.secret = str(value)

1665

self.secret = bytes(value)

1606

1666

1607

1667

del _interface

1608

1668

1612

1672

self._pipe = child_pipe

1613

1673

self._pipe.send(('init', fpr, address))

1614

1674

if not self._pipe.recv():

1615

raise KeyError()

1675

raise KeyError(fpr)

1616

1676

1617

1677

def __getattribute__(self, name):

1618

1678

if name == '_pipe':

1622

1682

if data[0] == 'data':

1623

1683

return data[1]

1624

1684

if data[0] == 'function':

1685

1625

1686

def func(*args, **kwargs):

1626

1687

self._pipe.send(('funcall', name, args, kwargs))

1627

1688

return self._pipe.recv()[1]

1689

1628

1690

return func

1629

1691

1630

1692

def __setattr__(self, name, value):

1642

1704

def handle(self):

1643

1705

with contextlib.closing(self.server.child_pipe) as child_pipe:

1644

1706

logger.info("TCP connection from: %s",

1645

unicode(self.client_address))

1707

str(self.client_address))

1646

1708

logger.debug("Pipe FD: %d",

1647

1709

self.server.child_pipe.fileno())

1648

1710

1649

session = (gnutls.connection

1650

.ClientSession(self.request,

1651

gnutls.connection

1652

.X509Credentials()))

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1653

1713

1654

1714

# Note: gnutls.connection.X509Credentials is really a

1655

1715

# generic GnuTLS certificate credentials object so long as

1664

1724

priority = self.server.gnutls_priority

1665

1725

if priority is None:

1666

1726

priority = "NORMAL"

1667

(gnutls.library.functions

1668

.gnutls_priority_set_direct(session._c_object,

1669

priority, None))

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

1670

1729

1671

1730

# Start communication using the Mandos protocol

1672

1731

# Get protocol number

1674

1733

logger.debug("Protocol version: %r", line)

1675

1734

try:

1676

1735

if int(line.strip().split()[0]) > 1:

1677

raise RuntimeError

1736

raise RuntimeError(line)

1678

1737

except (ValueError, IndexError, RuntimeError) as error:

1679

1738

logger.error("Unknown protocol version: %s", error)

1680

1739

return

1692

1751

approval_required = False

1693

1752

try:

1694

1753

try:

1695

fpr = self.fingerprint(self.peer_certificate

1696

(session))

1754

fpr = self.fingerprint(

1755

self.peer_certificate(session))

1697

1756

except (TypeError,

1698

1757

gnutls.errors.GNUTLSError) as error:

1699

1758

logger.warning("Bad certificate: %s", error)

1714

1773

while True:

1715

1774

if not client.enabled:

1716

1775

logger.info("Client %s is disabled",

1717

client.name)

1776

client.name)

1718

1777

if self.server.use_dbus:

1719

1778

# Emit D-Bus signal

1720

1779

client.Rejected("Disabled")

1729

1788

if self.server.use_dbus:

1730

1789

# Emit D-Bus signal

1731

1790

client.NeedApproval(

1732

client.approval_delay_milliseconds(),

1733

client.approved_by_default)

1791

client.approval_delay.total_seconds()

1792

* 1000, client.approved_by_default)

1734

1793

else:

1735

1794

logger.warning("Client %s was not approved",

1736

1795

client.name)

1742

1801

#wait until timeout or approved

1743

1802

time = datetime.datetime.now()

1744

1803

client.changedstate.acquire()

1745

client.changedstate.wait(

1746

float(timedelta_to_milliseconds(delay)

1747

/ 1000))

1804

client.changedstate.wait(delay.total_seconds())

1748

1805

client.changedstate.release()

1749

1806

time2 = datetime.datetime.now()

1750

1807

if (time2 - time) >= delay:

1769

1826

logger.warning("gnutls send failed",

1770

1827

exc_info=error)

1771

1828

return

1772

logger.debug("Sent: %d, remaining: %d",

1773

sent, len(client.secret)

1774

- (sent_size + sent))

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1775

1832

sent_size += sent

1776

1833

1777

1834

logger.info("Sending secret to %s", client.name)

1794

1851

def peer_certificate(session):

1795

1852

"Return the peer's OpenPGP certificate as a bytestring"

1796

1853

# If not an OpenPGP certificate...

1797

if (gnutls.library.functions

1798

.gnutls_certificate_type_get(session._c_object)

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1799

1856

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1800

1857

# ...do the normal thing

1801

1858

return session.peer_certificate

1815

1872

def fingerprint(openpgp):

1816

1873

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1817

1874

# New GnuTLS "datum" with the OpenPGP public key

1818

datum = (gnutls.library.types

1819

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1820

ctypes.POINTER

1821

(ctypes.c_ubyte)),

1822

ctypes.c_uint(len(openpgp))))

1875

datum = gnutls.library.types.gnutls_datum_t(

1876

ctypes.cast(ctypes.c_char_p(openpgp),

1877

ctypes.POINTER(ctypes.c_ubyte)),

1878

ctypes.c_uint(len(openpgp)))

1823

1879

# New empty GnuTLS certificate

1824

1880

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1825

(gnutls.library.functions

1826

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

1827

1883

# Import the OpenPGP public key into the certificate

1828

(gnutls.library.functions

1829

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1830

gnutls.library.constants

1831

.GNUTLS_OPENPGP_FMT_RAW))

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1832

1887

# Verify the self signature in the key

1833

1888

crtverify = ctypes.c_uint()

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_verify_self(crt, 0,

1836

ctypes.byref(crtverify)))

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

1837

1891

if crtverify.value != 0:

1838

1892

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1839

raise (gnutls.errors.CertificateSecurityError

1840

("Verify failed"))

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

1841

1895

# New buffer for the fingerprint

1842

1896

buf = ctypes.create_string_buffer(20)

1843

1897

buf_len = ctypes.c_size_t()

1844

1898

# Get the fingerprint from the certificate into the buffer

1845

(gnutls.library.functions

1846

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1847

ctypes.byref(buf_len)))

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1848

1901

# Deinit the certificate

1849

1902

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1850

1903

# Convert the buffer to a Python bytestring

1856

1909

1857

1910

class MultiprocessingMixIn(object):

1858

1911

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1912

1859

1913

def sub_process_main(self, request, address):

1860

1914

try:

1861

1915

self.finish_request(request, address)

1873

1927

1874

1928

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1875

1929

""" adds a pipe to the MixIn """

1930

1876

1931

def process_request(self, request, client_address):

1877

1932

"""Overrides and wraps the original process_request().

1878

1933

1887

1942

1888

1943

def add_pipe(self, parent_pipe, proc):

1889

1944

"""Dummy function; override as necessary"""

1890

raise NotImplementedError

1945

raise NotImplementedError()

1891

1946

1892

1947

1893

1948

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1899

1954

interface: None or a network interface name (string)

1900

1955

use_ipv6: Boolean; to use IPv6 or not

1901

1956

"""

1957

1902

1958

def __init__(self, server_address, RequestHandlerClass,

1903

interface=None, use_ipv6=True, socketfd=None):

1959

interface=None,

1960

use_ipv6=True,

1961

socketfd=None):

1904

1962

"""If socketfd is set, use that file descriptor instead of

1905

1963

creating a new one with socket.socket().

1906

1964

"""

1947

2005

self.interface)

1948

2006

else:

1949

2007

try:

1950

self.socket.setsockopt(socket.SOL_SOCKET,

1951

SO_BINDTODEVICE,

1952

str(self.interface + '\0'))

2008

self.socket.setsockopt(

2009

socket.SOL_SOCKET, SO_BINDTODEVICE,

2010

(self.interface + "\0").encode("utf-8"))

1953

2011

except socket.error as error:

1954

2012

if error.errno == errno.EPERM:

1955

2013

logger.error("No permission to bind to"

1969

2027

if self.address_family == socket.AF_INET6:

1970

2028

any_address = "::" # in6addr_any

1971

2029

else:

1972

any_address = socket.INADDR_ANY

2030

any_address = "0.0.0.0" # INADDR_ANY

1973

2031

self.server_address = (any_address,

1974

2032

self.server_address[1])

1975

2033

elif not self.server_address[1]:

1976

self.server_address = (self.server_address[0],

1977

0)

2034

self.server_address = (self.server_address[0], 0)

1978

2035

# if self.interface:

1979

2036

# self.server_address = (self.server_address[0],

1980

2037

# 0, # port

1994

2051

1995

2052

Assumes a gobject.MainLoop event loop.

1996

2053

"""

2054

1997

2055

def __init__(self, server_address, RequestHandlerClass,

1998

interface=None, use_ipv6=True, clients=None,

1999

gnutls_priority=None, use_dbus=True, socketfd=None):

2056

interface=None,

2057

use_ipv6=True,

2058

clients=None,

2059

gnutls_priority=None,

2060

use_dbus=True,

2061

socketfd=None):

2000

2062

self.enabled = False

2001

2063

self.clients = clients

2002

2064

if self.clients is None:

2008

2070

interface = interface,

2009

2071

use_ipv6 = use_ipv6,

2010

2072

socketfd = socketfd)

2073

2011

2074

def server_activate(self):

2012

2075

if self.enabled:

2013

2076

return socketserver.TCPServer.server_activate(self)

2017

2080

2018

2081

def add_pipe(self, parent_pipe, proc):

2019

2082

# Call "handle_ipc" for both data and EOF events

2020

gobject.io_add_watch(parent_pipe.fileno(),

2021

gobject.IO_IN | gobject.IO_HUP,

2022

functools.partial(self.handle_ipc,

2023

parent_pipe =

2024

parent_pipe,

2025

proc = proc))

2083

gobject.io_add_watch(

2084

parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe = parent_pipe,

2088

proc = proc))

2026

2089

2027

def handle_ipc(self, source, condition, parent_pipe=None,

2028

proc = None, client_object=None):

2090

def handle_ipc(self, source, condition,

2091

parent_pipe=None,

2092

proc = None,

2093

client_object=None):

2029

2094

# error, or the other end of multiprocessing.Pipe has closed

2030

2095

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2031

2096

# Wait for other process to exit

2054

2119

parent_pipe.send(False)

2055

2120

return False

2056

2121

2057

gobject.io_add_watch(parent_pipe.fileno(),

2058

gobject.IO_IN | gobject.IO_HUP,

2059

functools.partial(self.handle_ipc,

2060

parent_pipe =

2061

parent_pipe,

2062

proc = proc,

2063

client_object =

2064

client))

2122

gobject.io_add_watch(

2123

parent_pipe.fileno(),

2124

gobject.IO_IN | gobject.IO_HUP,

2125

functools.partial(self.handle_ipc,

2126

parent_pipe = parent_pipe,

2127

proc = proc,

2128

client_object = client))

2065

2129

parent_pipe.send(True)

2066

2130

# remove the old hook in favor of the new above hook on

2067

2131

# same fileno

2073

2137

2074

2138

parent_pipe.send(('data', getattr(client_object,

2075

2139

funcname)(*args,

2076

**kwargs)))

2140

**kwargs)))

2077

2141

2078

2142

if command == 'getattr':

2079

2143

attrname = request[1]

2080

2144

if callable(client_object.__getattribute__(attrname)):

2081

parent_pipe.send(('function',))

2145

parent_pipe.send(('function', ))

2082

2146

else:

2083

parent_pipe.send(('data', client_object

2084

.__getattribute__(attrname)))

2147

parent_pipe.send((

2148

'data', client_object.__getattribute__(attrname)))

2085

2149

2086

2150

if command == 'setattr':

2087

2151

attrname = request[1]

2118

2182

# avoid excessive use of external libraries.

2119

2183

2120

2184

# New type for defining tokens, syntax, and semantics all-in-one

2121

Token = collections.namedtuple("Token",

2122

("regexp", # To match token; if

2123

# "value" is not None,

2124

# must have a "group"

2125

# containing digits

2126

"value", # datetime.timedelta or

2127

# None

2128

"followers")) # Tokens valid after

2129

# this token

2185

Token = collections.namedtuple("Token", (

2186

"regexp", # To match token; if "value" is not None, must have

2187

# a "group" containing digits

2188

"value", # datetime.timedelta or None

2189

"followers")) # Tokens valid after this token

2130

2190

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2131

2191

# the "duration" ABNF definition in RFC 3339, Appendix A.

2132

2192

token_end = Token(re.compile(r"$"), None, frozenset())

2133

2193

token_second = Token(re.compile(r"(\d+)S"),

2134

2194

datetime.timedelta(seconds=1),

2135

frozenset((token_end,)))

2195

frozenset((token_end, )))

2136

2196

token_minute = Token(re.compile(r"(\d+)M"),

2137

2197

datetime.timedelta(minutes=1),

2138

2198

frozenset((token_second, token_end)))

2154

2214

frozenset((token_month, token_end)))

2155

2215

token_week = Token(re.compile(r"(\d+)W"),

2156

2216

datetime.timedelta(weeks=1),

2157

frozenset((token_end,)))

2217

frozenset((token_end, )))

2158

2218

token_duration = Token(re.compile(r"P"), None,

2159

2219

frozenset((token_year, token_month,

2160

2220

token_day, token_time,

2161

token_week))),

2221

token_week)))

2162

2222

# Define starting values

2163

2223

value = datetime.timedelta() # Value so far

2164

2224

found_token = None

2165

followers = frozenset(token_duration,) # Following valid tokens

2225

followers = frozenset((token_duration, )) # Following valid tokens

2166

2226

s = duration # String left to parse

2167

2227

# Loop until end token is found

2168

2228

while found_token is not token_end:

2185

2245

break

2186

2246

else:

2187

2247

# No currently valid tokens were found

2188

raise ValueError("Invalid RFC 3339 duration")

2248

raise ValueError("Invalid RFC 3339 duration: {!r}"

2249

.format(duration))

2189

2250

# End token found

2190

2251

return value

2191

2252

2215

2276

timevalue = datetime.timedelta(0)

2216

2277

for s in interval.split():

2217

2278

try:

2218

suffix = unicode(s[-1])

2279

suffix = s[-1]

2219

2280

value = int(s[:-1])

2220

2281

if suffix == "d":

2221

2282

delta = datetime.timedelta(value)

2228

2289

elif suffix == "w":

2229

2290

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2230

2291

else:

2231

raise ValueError("Unknown suffix {0!r}"

2232

.format(suffix))

2233

except (ValueError, IndexError) as e:

2292

raise ValueError("Unknown suffix {!r}".format(suffix))

2293

except IndexError as e:

2234

2294

raise ValueError(*(e.args))

2235

2295

timevalue += delta

2236

2296

return timevalue

2252

2312

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2253

2313

if not stat.S_ISCHR(os.fstat(null).st_mode):

2254

2314

raise OSError(errno.ENODEV,

2255

"{0} not a character device"

2315

"{} not a character device"

2256

2316

.format(os.devnull))

2257

2317

os.dup2(null, sys.stdin.fileno())

2258

2318

os.dup2(null, sys.stdout.fileno())

2268

2328

2269

2329

parser = argparse.ArgumentParser()

2270

2330

parser.add_argument("-v", "--version", action="version",

2271

version = "%(prog)s {0}".format(version),

2331

version = "%(prog)s {}".format(version),

2272

2332

help="show version number and exit")

2273

2333

parser.add_argument("-i", "--interface", metavar="IF",

2274

2334

help="Bind to interface IF")

2280

2340

help="Run self-test")

2281

2341

parser.add_argument("--debug", action="store_true",

2282

2342

help="Debug mode; run in foreground and log"

2283

" to terminal")

2343

" to terminal", default=None)

2284

2344

parser.add_argument("--debuglevel", metavar="LEVEL",

2285

2345

help="Debug level for stdout output")

2286

2346

parser.add_argument("--priority", help="GnuTLS"

2293

2353

" files")

2294

2354

parser.add_argument("--no-dbus", action="store_false",

2295

2355

dest="use_dbus", help="Do not provide D-Bus"

2296

" system bus interface")

2356

" system bus interface", default=None)

2297

2357

parser.add_argument("--no-ipv6", action="store_false",

2298

dest="use_ipv6", help="Do not use IPv6")

2358

dest="use_ipv6", help="Do not use IPv6",

2359

default=None)

2299

2360

parser.add_argument("--no-restore", action="store_false",

2300

2361

dest="restore", help="Do not restore stored"

2301

" state")

2362

" state", default=None)

2302

2363

parser.add_argument("--socket", type=int,

2303

2364

help="Specify a file descriptor to a network"

2304

2365

" socket to use instead of creating one")

2305

2366

parser.add_argument("--statedir", metavar="DIR",

2306

2367

help="Directory to save/restore state in")

2307

2368

parser.add_argument("--foreground", action="store_true",

2308

help="Run in foreground")

2369

help="Run in foreground", default=None)

2370

parser.add_argument("--no-zeroconf", action="store_false",

2371

dest="zeroconf", help="Do not use Zeroconf",

2372

default=None)

2309

2373

2310

2374

options = parser.parse_args()

2311

2375

2312

2376

if options.check:

2313

2377

import doctest

2314

doctest.testmod()

2315

sys.exit()

2378

fail_count, test_count = doctest.testmod()

2379

sys.exit(os.EX_OK if fail_count == 0 else 1)

2316

2380

2317

2381

# Default values for config file for server-global settings

2318

2382

server_defaults = { "interface": "",

2320

2384

"port": "",

2321

2385

"debug": "False",

2322

2386

"priority":

2323

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2387

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2388

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2324

2389

"servicename": "Mandos",

2325

2390

"use_dbus": "True",

2326

2391

"use_ipv6": "True",

2329

2394

"socket": "",

2330

2395

"statedir": "/var/lib/mandos",

2331

2396

"foreground": "False",

2332

}

2397

"zeroconf": "True",

2398

}

2333

2399

2334

2400

# Parse config file for server-global settings

2335

2401

server_config = configparser.SafeConfigParser(server_defaults)

2336

2402

del server_defaults

2337

server_config.read(os.path.join(options.configdir,

2338

"mandos.conf"))

2403

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2339

2404

# Convert the SafeConfigParser object to a dict

2340

2405

server_settings = server_config.defaults()

2341

2406

# Use the appropriate methods on the non-string config options

2359

2424

# Override the settings from the config file with command line

2360

2425

# options, if set.

2361

2426

for option in ("interface", "address", "port", "debug",

2362

"priority", "servicename", "configdir",

2363

"use_dbus", "use_ipv6", "debuglevel", "restore",

2364

"statedir", "socket", "foreground"):

2427

"priority", "servicename", "configdir", "use_dbus",

2428

"use_ipv6", "debuglevel", "restore", "statedir",

2429

"socket", "foreground", "zeroconf"):

2365

2430

value = getattr(options, option)

2366

2431

if value is not None:

2367

2432

server_settings[option] = value

2368

2433

del options

2369

2434

# Force all strings to be unicode

2370

2435

for option in server_settings.keys():

2371

if type(server_settings[option]) is str:

2372

server_settings[option] = unicode(server_settings[option])

2436

if isinstance(server_settings[option], bytes):

2437

server_settings[option] = (server_settings[option]

2438

.decode("utf-8"))

2439

# Force all boolean options to be boolean

2440

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2441

"foreground", "zeroconf"):

2442

server_settings[option] = bool(server_settings[option])

2373

2443

# Debug implies foreground

2374

2444

if server_settings["debug"]:

2375

2445

server_settings["foreground"] = True

2377

2447

2378

2448

##################################################################

2379

2449

2450

if (not server_settings["zeroconf"]

2451

and not (server_settings["port"]

2452

or server_settings["socket"] != "")):

2453

parser.error("Needs port or socket to work without Zeroconf")

2454

2380

2455

# For convenience

2381

2456

debug = server_settings["debug"]

2382

2457

debuglevel = server_settings["debuglevel"]

2385

2460

stored_state_path = os.path.join(server_settings["statedir"],

2386

2461

stored_state_file)

2387

2462

foreground = server_settings["foreground"]

2463

zeroconf = server_settings["zeroconf"]

2388

2464

2389

2465

if debug:

2390

2466

initlogger(debug, logging.DEBUG)

2396

2472

initlogger(debug, level)

2397

2473

2398

2474

if server_settings["servicename"] != "Mandos":

2399

syslogger.setFormatter(logging.Formatter

2400

('Mandos ({0}) [%(process)d]:'

2401

' %(levelname)s: %(message)s'

2402

.format(server_settings

2403

["servicename"])))

2475

syslogger.setFormatter(

2476

logging.Formatter('Mandos ({}) [%(process)d]:'

2477

' %(levelname)s: %(message)s'.format(

2478

server_settings["servicename"])))

2404

2479

2405

2480

# Parse config file with clients

2406

2481

client_config = configparser.SafeConfigParser(Client

2411

2486

global mandos_dbus_service

2412

2487

mandos_dbus_service = None

2413

2488

2414

tcp_server = MandosServer((server_settings["address"],

2415

server_settings["port"]),

2416

ClientHandler,

2417

interface=(server_settings["interface"]

2418

or None),

2419

use_ipv6=use_ipv6,

2420

gnutls_priority=

2421

server_settings["priority"],

2422

use_dbus=use_dbus,

2423

socketfd=(server_settings["socket"]

2424

or None))

2489

socketfd = None

2490

if server_settings["socket"] != "":

2491

socketfd = server_settings["socket"]

2492

tcp_server = MandosServer(

2493

(server_settings["address"], server_settings["port"]),

2494

ClientHandler,

2495

interface=(server_settings["interface"] or None),

2496

use_ipv6=use_ipv6,

2497

gnutls_priority=server_settings["priority"],

2498

use_dbus=use_dbus,

2499

socketfd=socketfd)

2425

2500

if not foreground:

2426

pidfilename = "/var/run/mandos.pid"

2501

pidfilename = "/run/mandos.pid"

2502

if not os.path.isdir("/run/."):

2503

pidfilename = "/var/run/mandos.pid"

2427

2504

pidfile = None

2428

2505

try:

2429

pidfile = open(pidfilename, "w")

2506

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2430

2507

except IOError as e:

2431

2508

logger.error("Could not open file %r", pidfilename,

2432

2509

exc_info=e)

2446

2523

os.setuid(uid)

2447

2524

except OSError as error:

2448

2525

if error.errno != errno.EPERM:

2449

raise error

2526

raise

2450

2527

2451

2528

if debug:

2452

2529

# Enable all possible GnuTLS debugging

2459

2536

def debug_gnutls(level, string):

2460

2537

logger.debug("GnuTLS: %s", string[:-1])

2461

2538

2462

(gnutls.library.functions

2463

.gnutls_global_set_log_function(debug_gnutls))

2539

gnutls.library.functions.gnutls_global_set_log_function(

2540

debug_gnutls)

2464

2541

2465

2542

# Redirect stdin so all checkers get /dev/null

2466

2543

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2486

2563

if use_dbus:

2487

2564

try:

2488

2565

bus_name = dbus.service.BusName("se.recompile.Mandos",

2489

bus, do_not_queue=True)

2490

old_bus_name = (dbus.service.BusName

2491

("se.bsnet.fukt.Mandos", bus,

2492

do_not_queue=True))

2493

except dbus.exceptions.NameExistsException as e:

2566

bus,

2567

do_not_queue=True)

2568

old_bus_name = dbus.service.BusName(

2569

"se.bsnet.fukt.Mandos", bus,

2570

do_not_queue=True)

2571

except dbus.exceptions.DBusException as e:

2494

2572

logger.error("Disabling D-Bus:", exc_info=e)

2495

2573

use_dbus = False

2496

2574

server_settings["use_dbus"] = False

2497

2575

tcp_server.use_dbus = False

2498

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2499

service = AvahiServiceToSyslog(name =

2500

server_settings["servicename"],

2501

servicetype = "_mandos._tcp",

2502

protocol = protocol, bus = bus)

2503

if server_settings["interface"]:

2504

service.interface = (if_nametoindex

2505

(str(server_settings["interface"])))

2576

if zeroconf:

2577

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2578

service = AvahiServiceToSyslog(

2579

name = server_settings["servicename"],

2580

servicetype = "_mandos._tcp",

2581

protocol = protocol,

2582

bus = bus)

2583

if server_settings["interface"]:

2584

service.interface = if_nametoindex(

2585

server_settings["interface"].encode("utf-8"))

2506

2586

2507

2587

global multiprocessing_manager

2508

2588

multiprocessing_manager = multiprocessing.Manager()

2515

2595

old_client_settings = {}

2516

2596

clients_data = {}

2517

2597

2598

# This is used to redirect stdout and stderr for checker processes

2599

global wnull

2600

wnull = open(os.devnull, "w") # A writable /dev/null

2601

# Only used if server is running in foreground but not in debug

2602

# mode

2603

if debug or not foreground:

2604

wnull.close()

2605

2518

2606

# Get client data and settings from last running state.

2519

2607

if server_settings["restore"]:

2520

2608

try:

2521

2609

with open(stored_state_path, "rb") as stored_state:

2522

clients_data, old_client_settings = (pickle.load

2523

(stored_state))

2610

clients_data, old_client_settings = pickle.load(

2611

stored_state)

2524

2612

os.remove(stored_state_path)

2525

2613

except IOError as e:

2526

2614

if e.errno == errno.ENOENT:

2527

logger.warning("Could not load persistent state: {0}"

2528

.format(os.strerror(e.errno)))

2615

logger.warning("Could not load persistent state:"

2616

" {}".format(os.strerror(e.errno)))

2529

2617

else:

2530

2618

logger.critical("Could not load persistent state:",

2531

2619

exc_info=e)

2532

2620

raise

2533

2621

except EOFError as e:

2534

2622

logger.warning("Could not load persistent state: "

2535

"EOFError:", exc_info=e)

2623

"EOFError:",

2624

exc_info=e)

2536

2625

2537

2626

with PGPEngine() as pgp:

2538

for client_name, client in clients_data.iteritems():

2627

for client_name, client in clients_data.items():

2628

# Skip removed clients

2629

if client_name not in client_settings:

2630

continue

2631

2539

2632

# Decide which value to use after restoring saved state.

2540

2633

# We have three different values: Old config file,

2541

2634

# new config file, and saved state.

2546

2639

# For each value in new config, check if it

2547

2640

# differs from the old config value (Except for

2548

2641

# the "secret" attribute)

2549

if (name != "secret" and

2550

value != old_client_settings[client_name]

2551

[name]):

2642

if (name != "secret"

2643

and (value !=

2644

old_client_settings[client_name][name])):

2552

2645

client[name] = value

2553

2646

except KeyError:

2554

2647

pass

2562

2655

if datetime.datetime.utcnow() >= client["expires"]:

2563

2656

if not client["last_checked_ok"]:

2564

2657

logger.warning(

2565

"disabling client {0} - Client never "

2566

"performed a successful checker"

2567

.format(client_name))

2658

"disabling client {} - Client never "

2659

"performed a successful checker".format(

2660

client_name))

2568

2661

client["enabled"] = False

2569

2662

elif client["last_checker_status"] != 0:

2570

2663

logger.warning(

2571

"disabling client {0} - Client "

2572

"last checker failed with error code {1}"

2573

.format(client_name,

2574

client["last_checker_status"]))

2664

"disabling client {} - Client last"

2665

" checker failed with error code"

2666

" {}".format(

2667

client_name,

2668

client["last_checker_status"]))

2575

2669

client["enabled"] = False

2576

2670

else:

2577

client["expires"] = (datetime.datetime

2578

.utcnow()

2579

+ client["timeout"])

2671

client["expires"] = (

2672

datetime.datetime.utcnow()

2673

+ client["timeout"])

2580

2674

logger.debug("Last checker succeeded,"

2581

" keeping {0} enabled"

2582

.format(client_name))

2675

" keeping {} enabled".format(

2676

client_name))

2583

2677

try:

2584

client["secret"] = (

2585

pgp.decrypt(client["encrypted_secret"],

2586

client_settings[client_name]

2587

["secret"]))

2678

client["secret"] = pgp.decrypt(

2679

client["encrypted_secret"],

2680

client_settings[client_name]["secret"])

2588

2681

except PGPError:

2589

2682

# If decryption fails, we use secret from new settings

2590

logger.debug("Failed to decrypt {0} old secret"

2591

.format(client_name))

2592

client["secret"] = (

2593

client_settings[client_name]["secret"])

2683

logger.debug("Failed to decrypt {} old secret".format(

2684

client_name))

2685

client["secret"] = (client_settings[client_name]

2686

["secret"])

2594

2687

2595

2688

# Add/remove clients based on new changes made to config

2596

2689

for client_name in (set(old_client_settings)

2601

2694

clients_data[client_name] = client_settings[client_name]

2602

2695

2603

2696

# Create all client objects

2604

for client_name, client in clients_data.iteritems():

2697

for client_name, client in clients_data.items():

2605

2698

tcp_server.clients[client_name] = client_class(

2606

name = client_name, settings = client)

2699

name = client_name,

2700

settings = client,

2701

server_settings = server_settings)

2607

2702

2608

2703

if not tcp_server.clients:

2609

2704

logger.warning("No clients defined")

2610

2705

2611

2706

if not foreground:

2612

2707

if pidfile is not None:

2708

pid = os.getpid()

2613

2709

try:

2614

2710

with pidfile:

2615

pid = os.getpid()

2616

pidfile.write(str(pid) + "\n".encode("utf-8"))

2711

print(pid, file=pidfile)

2617

2712

except IOError:

2618

2713

logger.error("Could not write to file %r with PID %d",

2619

2714

pidfilename, pid)

2624

2719

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2625

2720

2626

2721

if use_dbus:

2627

@alternate_dbus_interfaces({"se.recompile.Mandos":

2628

"se.bsnet.fukt.Mandos"})

2722

2723

@alternate_dbus_interfaces(

2724

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2629

2725

class MandosDBusService(DBusObjectWithProperties):

2630

2726

"""A D-Bus proxy object"""

2727

2631

2728

def __init__(self):

2632

2729

dbus.service.Object.__init__(self, bus, "/")

2730

2633

2731

_interface = "se.recompile.Mandos"

2634

2732

2635

2733

@dbus_interface_annotations(_interface)

2636

2734

def _foo(self):

2637

return { "org.freedesktop.DBus.Property"

2638

".EmitsChangedSignal":

2639

"false"}

2735

return {

2736

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2737

"false" }

2640

2738

2641

2739

@dbus.service.signal(_interface, signature="o")

2642

2740

def ClientAdded(self, objpath):

2656

2754

@dbus.service.method(_interface, out_signature="ao")

2657

2755

def GetAllClients(self):

2658

2756

"D-Bus method"

2659

return dbus.Array(c.dbus_object_path

2660

for c in

2757

return dbus.Array(c.dbus_object_path for c in

2661

2758

tcp_server.clients.itervalues())

2662

2759

2663

2760

@dbus.service.method(_interface,

2665

2762

def GetAllClientsWithProperties(self):

2666

2763

"D-Bus method"

2667

2764

return dbus.Dictionary(

2668

((c.dbus_object_path, c.GetAll(""))

2669

for c in tcp_server.clients.itervalues()),

2765

{ c.dbus_object_path: c.GetAll("")

2766

for c in tcp_server.clients.itervalues() },

2670

2767

signature="oa{sv}")

2671

2768

2672

2769

@dbus.service.method(_interface, in_signature="o")

2689

2786

2690

2787

def cleanup():

2691

2788

"Cleanup function; run on exit"

2692

service.cleanup()

2789

if zeroconf:

2790

service.cleanup()

2693

2791

2694

2792

multiprocessing.active_children()

2793

wnull.close()

2695

2794

if not (tcp_server.clients or client_settings):

2696

2795

return

2697

2796

2708

2807

2709

2808

# A list of attributes that can not be pickled

2710

2809

# + secret.

2711

exclude = set(("bus", "changedstate", "secret",

2712

"checker"))

2713

for name, typ in (inspect.getmembers

2714

(dbus.service.Object)):

2810

exclude = { "bus", "changedstate", "secret",

2811

"checker", "server_settings" }

2812

for name, typ in inspect.getmembers(dbus.service

2813

.Object):

2715

2814

exclude.add(name)

2716

2815

2717

2816

client_dict["encrypted_secret"] = (client

2724

2823

del client_settings[client.name]["secret"]

2725

2824

2726

2825

try:

2727

with (tempfile.NamedTemporaryFile

2728

(mode='wb', suffix=".pickle", prefix='clients-',

2729

dir=os.path.dirname(stored_state_path),

2730

delete=False)) as stored_state:

2826

with tempfile.NamedTemporaryFile(

2827

mode='wb',

2828

suffix=".pickle",

2829

prefix='clients-',

2830

dir=os.path.dirname(stored_state_path),

2831

delete=False) as stored_state:

2731

2832

pickle.dump((clients, client_settings), stored_state)

2732

tempname=stored_state.name

2833

tempname = stored_state.name

2733

2834

os.rename(tempname, stored_state_path)

2734

2835

except (IOError, OSError) as e:

2735

2836

if not debug:

2738

2839

except NameError:

2739

2840

pass

2740

2841

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2741

logger.warning("Could not save persistent state: {0}"

2842

logger.warning("Could not save persistent state: {}"

2742

2843

.format(os.strerror(e.errno)))

2743

2844

else:

2744

2845

logger.warning("Could not save persistent state:",

2745

2846

exc_info=e)

2746

raise e

2847

raise

2747

2848

2748

2849

# Delete all clients, and settings from config

2749

2850

while tcp_server.clients:

2754

2855

client.disable(quiet=True)

2755

2856

if use_dbus:

2756

2857

# Emit D-Bus signal

2757

mandos_dbus_service.ClientRemoved(client

2758

.dbus_object_path,

2759

client.name)

2858

mandos_dbus_service.ClientRemoved(

2859

client.dbus_object_path, client.name)

2760

2860

client_settings.clear()

2761

2861

2762

2862

atexit.register(cleanup)

2773

2873

tcp_server.server_activate()

2774

2874

2775

2875

# Find out what port we got

2776

service.port = tcp_server.socket.getsockname()[1]

2876

if zeroconf:

2877

service.port = tcp_server.socket.getsockname()[1]

2777

2878

if use_ipv6:

2778

2879

logger.info("Now listening on address %r, port %d,"

2779

2880

" flowinfo %d, scope_id %d",

2785

2886

#service.interface = tcp_server.socket.getsockname()[3]

2786

2887

2787

2888

try:

2788

# From the Avahi example code

2789

try:

2790

service.activate()

2791

except dbus.exceptions.DBusException as error:

2792

logger.critical("D-Bus Exception", exc_info=error)

2793

cleanup()

2794

sys.exit(1)

2795

# End of Avahi example code

2889

if zeroconf:

2890

# From the Avahi example code

2891

try:

2892

service.activate()

2893

except dbus.exceptions.DBusException as error:

2894

logger.critical("D-Bus Exception", exc_info=error)

2895

cleanup()

2896

sys.exit(1)

2897

# End of Avahi example code

2796

2898

2797

2899

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2798

2900

lambda *args, **kwargs:

2813

2915

# Must run before the D-Bus bus name gets deregistered

2814

2916

cleanup()

2815

2917

2918

2816

2919

if __name__ == '__main__':

2817

2920

main()