/mandos/trunk : revision 753

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

39

try:

43

40

import SocketServer as socketserver

47

44

import argparse

48

45

import datetime

49

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

50

53

try:

51

54

import ConfigParser as configparser

52

55

except ImportError:

80

83

import dbus

81

84

import dbus.service

82

85

try:

83

from gi.repository import GObject

86

import gobject

84

87

except ImportError:

85

import gobject as GObject

88

from gi.repository import GObject as gobject

89

import avahi

86

90

from dbus.mainloop.glib import DBusGMainLoop

87

91

import ctypes

88

92

import ctypes.util

100

104

if sys.version_info.major == 2:

101

105

str = unicode

102

106

103

version = "1.7.5"

107

version = "1.6.9"

104

108

stored_state_file = "clients.pickle"

105

109

106

110

logger = logging.getLogger()

121

125

return interface_index

122

126

123

127

124

def copy_function(func):

125

"""Make a copy of a function"""

126

if sys.version_info.major == 2:

127

return types.FunctionType(func.func_code,

128

func.func_globals,

129

func.func_name,

130

func.func_defaults,

131

func.func_closure)

132

else:

133

return types.FunctionType(func.__code__,

134

func.__globals__,

135

func.__name__,

136

func.__defaults__,

137

func.__closure__)

138

139

140

128

def initlogger(debug, level=logging.WARNING):

141

129

"""init logger and add loglevel"""

142

130

169

157

170

158

def __init__(self):

171

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

172

self.gpg = "gpg"

173

try:

174

output = subprocess.check_output(["gpgconf"])

175

for line in output.splitlines():

176

name, text, path = line.split(b":")

177

if name == "gpg":

178

self.gpg = path

179

break

180

except OSError as e:

181

if e.errno != errno.ENOENT:

182

raise

183

160

self.gnupgargs = ['--batch',

184

'--homedir', self.tempdir,

161

'--home', self.tempdir,

185

162

'--force-mdc',

186

163

'--quiet',

187

164

'--no-use-agent']

226

203

dir=self.tempdir) as passfile:

227

204

passfile.write(passphrase)

228

205

passfile.flush()

229

proc = subprocess.Popen([self.gpg, '--symmetric',

206

proc = subprocess.Popen(['gpg', '--symmetric',

230

207

'--passphrase-file',

231

208

passfile.name]

232

209

+ self.gnupgargs,

244

221

dir = self.tempdir) as passfile:

245

222

passfile.write(passphrase)

246

223

passfile.flush()

247

proc = subprocess.Popen([self.gpg, '--decrypt',

224

proc = subprocess.Popen(['gpg', '--decrypt',

248

225

'--passphrase-file',

249

226

passfile.name]

250

227

+ self.gnupgargs,

256

233

raise PGPError(err)

257

234

return decrypted_plaintext

258

235

259

# Pretend that we have an Avahi module

260

class Avahi(object):

261

"""This isn't so much a class as it is a module-like namespace.

262

It is instantiated once, and simulates having an Avahi module."""

263

IF_UNSPEC = -1 # avahi-common/address.h

264

PROTO_UNSPEC = -1 # avahi-common/address.h

265

PROTO_INET = 0 # avahi-common/address.h

266

PROTO_INET6 = 1 # avahi-common/address.h

267

DBUS_NAME = "org.freedesktop.Avahi"

268

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

269

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

270

DBUS_PATH_SERVER = "/"

271

def string_array_to_txt_array(self, t):

272

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

273

for s in t), signature="ay")

274

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

275

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

276

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

277

SERVER_INVALID = 0 # avahi-common/defs.h

278

SERVER_REGISTERING = 1 # avahi-common/defs.h

279

SERVER_RUNNING = 2 # avahi-common/defs.h

280

SERVER_COLLISION = 3 # avahi-common/defs.h

281

SERVER_FAILURE = 4 # avahi-common/defs.h

282

avahi = Avahi()

283

236

284

237

class AvahiError(Exception):

285

238

def __init__(self, value, *args, **kwargs):

442

395

logger.error(bad_states[state] + ": %r", error)

443

396

self.cleanup()

444

397

elif state == avahi.SERVER_RUNNING:

445

try:

446

self.add()

447

except dbus.exceptions.DBusException as error:

448

if (error.get_dbus_name()

449

== "org.freedesktop.Avahi.CollisionError"):

450

logger.info("Local Zeroconf service name"

451

" collision.")

452

return self.rename(remove=False)

453

else:

454

logger.critical("D-Bus Exception", exc_info=error)

455

self.cleanup()

456

os._exit(1)

398

self.add()

457

399

else:

458

400

if error is None:

459

401

logger.debug("Unknown state: %r", state)

482

424

.format(self.name)))

483

425

return ret

484

426

485

# Pretend that we have a GnuTLS module

486

class GnuTLS(object):

487

"""This isn't so much a class as it is a module-like namespace.

488

It is instantiated once, and simulates having a GnuTLS module."""

489

490

_library = ctypes.cdll.LoadLibrary(

491

ctypes.util.find_library("gnutls"))

492

_need_version = b"3.3.0"

493

def __init__(self):

494

# Need to use class name "GnuTLS" here, since this method is

495

# called before the assignment to the "gnutls" global variable

496

# happens.

497

if GnuTLS.check_version(self._need_version) is None:

498

raise GnuTLS.Error("Needs GnuTLS {} or later"

499

.format(self._need_version))

500

501

# Unless otherwise indicated, the constants and types below are

502

# all from the gnutls/gnutls.h C header file.

503

504

# Constants

505

E_SUCCESS = 0

506

E_INTERRUPTED = -52

507

E_AGAIN = -28

508

CRT_OPENPGP = 2

509

CLIENT = 2

510

SHUT_RDWR = 0

511

CRD_CERTIFICATE = 1

512

E_NO_CERTIFICATE_FOUND = -49

513

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

514

515

# Types

516

class session_int(ctypes.Structure):

517

_fields_ = []

518

session_t = ctypes.POINTER(session_int)

519

class certificate_credentials_st(ctypes.Structure):

520

_fields_ = []

521

certificate_credentials_t = ctypes.POINTER(

522

certificate_credentials_st)

523

certificate_type_t = ctypes.c_int

524

class datum_t(ctypes.Structure):

525

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

526

('size', ctypes.c_uint)]

527

class openpgp_crt_int(ctypes.Structure):

528

_fields_ = []

529

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

530

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

531

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

532

credentials_type_t = ctypes.c_int

533

transport_ptr_t = ctypes.c_void_p

534

close_request_t = ctypes.c_int

535

536

# Exceptions

537

class Error(Exception):

538

# We need to use the class name "GnuTLS" here, since this

539

# exception might be raised from within GnuTLS.__init__,

540

# which is called before the assignment to the "gnutls"

541

# global variable has happened.

542

def __init__(self, message = None, code = None, args=()):

543

# Default usage is by a message string, but if a return

544

# code is passed, convert it to a string with

545

# gnutls.strerror()

546

self.code = code

547

if message is None and code is not None:

548

message = GnuTLS.strerror(code)

549

return super(GnuTLS.Error, self).__init__(

550

message, *args)

551

552

class CertificateSecurityError(Error):

553

pass

554

555

# Classes

556

class Credentials(object):

557

def __init__(self):

558

self._c_object = gnutls.certificate_credentials_t()

559

gnutls.certificate_allocate_credentials(

560

ctypes.byref(self._c_object))

561

self.type = gnutls.CRD_CERTIFICATE

562

563

def __del__(self):

564

gnutls.certificate_free_credentials(self._c_object)

565

566

class ClientSession(object):

567

def __init__(self, socket, credentials = None):

568

self._c_object = gnutls.session_t()

569

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

570

gnutls.set_default_priority(self._c_object)

571

gnutls.transport_set_ptr(self._c_object, socket.fileno())

572

gnutls.handshake_set_private_extensions(self._c_object,

573

True)

574

self.socket = socket

575

if credentials is None:

576

credentials = gnutls.Credentials()

577

gnutls.credentials_set(self._c_object, credentials.type,

578

ctypes.cast(credentials._c_object,

579

ctypes.c_void_p))

580

self.credentials = credentials

581

582

def __del__(self):

583

gnutls.deinit(self._c_object)

584

585

def handshake(self):

586

return gnutls.handshake(self._c_object)

587

588

def send(self, data):

589

data = bytes(data)

590

data_len = len(data)

591

while data_len > 0:

592

data_len -= gnutls.record_send(self._c_object,

593

data[-data_len:],

594

data_len)

595

596

def bye(self):

597

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

598

599

# Error handling functions

600

def _error_code(result):

601

"""A function to raise exceptions on errors, suitable

602

for the 'restype' attribute on ctypes functions"""

603

if result >= 0:

604

return result

605

if result == gnutls.E_NO_CERTIFICATE_FOUND:

606

raise gnutls.CertificateSecurityError(code = result)

607

raise gnutls.Error(code = result)

608

609

def _retry_on_error(result, func, arguments):

610

"""A function to retry on some errors, suitable

611

for the 'errcheck' attribute on ctypes functions"""

612

while result < 0:

613

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

614

return _error_code(result)

615

result = func(*arguments)

616

return result

617

618

# Unless otherwise indicated, the function declarations below are

619

# all from the gnutls/gnutls.h C header file.

620

621

# Functions

622

priority_set_direct = _library.gnutls_priority_set_direct

623

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

624

ctypes.POINTER(ctypes.c_char_p)]

625

priority_set_direct.restype = _error_code

626

627

init = _library.gnutls_init

628

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

629

init.restype = _error_code

630

631

set_default_priority = _library.gnutls_set_default_priority

632

set_default_priority.argtypes = [session_t]

633

set_default_priority.restype = _error_code

634

635

record_send = _library.gnutls_record_send

636

record_send.argtypes = [session_t, ctypes.c_void_p,

637

ctypes.c_size_t]

638

record_send.restype = ctypes.c_ssize_t

639

record_send.errcheck = _retry_on_error

640

641

certificate_allocate_credentials = (

642

_library.gnutls_certificate_allocate_credentials)

643

certificate_allocate_credentials.argtypes = [

644

ctypes.POINTER(certificate_credentials_t)]

645

certificate_allocate_credentials.restype = _error_code

646

647

certificate_free_credentials = (

648

_library.gnutls_certificate_free_credentials)

649

certificate_free_credentials.argtypes = [certificate_credentials_t]

650

certificate_free_credentials.restype = None

651

652

handshake_set_private_extensions = (

653

_library.gnutls_handshake_set_private_extensions)

654

handshake_set_private_extensions.argtypes = [session_t,

655

ctypes.c_int]

656

handshake_set_private_extensions.restype = None

657

658

credentials_set = _library.gnutls_credentials_set

659

credentials_set.argtypes = [session_t, credentials_type_t,

660

ctypes.c_void_p]

661

credentials_set.restype = _error_code

662

663

strerror = _library.gnutls_strerror

664

strerror.argtypes = [ctypes.c_int]

665

strerror.restype = ctypes.c_char_p

666

667

certificate_type_get = _library.gnutls_certificate_type_get

668

certificate_type_get.argtypes = [session_t]

669

certificate_type_get.restype = _error_code

670

671

certificate_get_peers = _library.gnutls_certificate_get_peers

672

certificate_get_peers.argtypes = [session_t,

673

ctypes.POINTER(ctypes.c_uint)]

674

certificate_get_peers.restype = ctypes.POINTER(datum_t)

675

676

global_set_log_level = _library.gnutls_global_set_log_level

677

global_set_log_level.argtypes = [ctypes.c_int]

678

global_set_log_level.restype = None

679

680

global_set_log_function = _library.gnutls_global_set_log_function

681

global_set_log_function.argtypes = [log_func]

682

global_set_log_function.restype = None

683

684

deinit = _library.gnutls_deinit

685

deinit.argtypes = [session_t]

686

deinit.restype = None

687

688

handshake = _library.gnutls_handshake

689

handshake.argtypes = [session_t]

690

handshake.restype = _error_code

691

handshake.errcheck = _retry_on_error

692

693

transport_set_ptr = _library.gnutls_transport_set_ptr

694

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

695

transport_set_ptr.restype = None

696

697

bye = _library.gnutls_bye

698

bye.argtypes = [session_t, close_request_t]

699

bye.restype = _error_code

700

bye.errcheck = _retry_on_error

701

702

check_version = _library.gnutls_check_version

703

check_version.argtypes = [ctypes.c_char_p]

704

check_version.restype = ctypes.c_char_p

705

706

# All the function declarations below are from gnutls/openpgp.h

707

708

openpgp_crt_init = _library.gnutls_openpgp_crt_init

709

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

710

openpgp_crt_init.restype = _error_code

711

712

openpgp_crt_import = _library.gnutls_openpgp_crt_import

713

openpgp_crt_import.argtypes = [openpgp_crt_t,

714

ctypes.POINTER(datum_t),

715

openpgp_crt_fmt_t]

716

openpgp_crt_import.restype = _error_code

717

718

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

719

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

720

ctypes.POINTER(ctypes.c_uint)]

721

openpgp_crt_verify_self.restype = _error_code

722

723

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

724

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

725

openpgp_crt_deinit.restype = None

726

727

openpgp_crt_get_fingerprint = (

728

_library.gnutls_openpgp_crt_get_fingerprint)

729

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

730

ctypes.c_void_p,

731

ctypes.POINTER(

732

ctypes.c_size_t)]

733

openpgp_crt_get_fingerprint.restype = _error_code

734

735

# Remove non-public functions

736

del _error_code, _retry_on_error

737

# Create the global "gnutls" object, simulating a module

738

gnutls = GnuTLS()

739

740

def call_pipe(connection, # : multiprocessing.Connection

741

func, *args, **kwargs):

742

"""This function is meant to be called by multiprocessing.Process

743

744

This function runs func(*args, **kwargs), and writes the resulting

745

return value on the provided multiprocessing.Connection.

746

"""

747

connection.send(func(*args, **kwargs))

748

connection.close()

749

427

750

428

class Client(object):

751

429

"""A representation of a client host served by this server.

757

435

checker: subprocess.Popen(); a running checker process used

758

436

to see if the client lives.

759

437

'None' if no process is running.

760

checker_callback_tag: a GObject event source tag, or None

438

checker_callback_tag: a gobject event source tag, or None

761

439

checker_command: string; External command which is run to check

762

440

if client lives. %() expansions are done at

763

441

runtime with vars(self) as dict, so that for

764

442

instance %(name)s can be used in the command.

765

checker_initiator_tag: a GObject event source tag, or None

443

checker_initiator_tag: a gobject event source tag, or None

766

444

created: datetime.datetime(); (UTC) object creation

767

445

client_structure: Object describing what attributes a client has

768

446

and is used for storing the client at exit

769

447

current_checker_command: string; current running checker_command

770

disable_initiator_tag: a GObject event source tag, or None

448

disable_initiator_tag: a gobject event source tag, or None

771

449

enabled: bool()

772

450

fingerprint: string (40 or 32 hexadecimal digits); used to

773

451

uniquely identify the client

778

456

last_checker_status: integer between 0 and 255 reflecting exit

779

457

status of last checker. -1 reflects crashed

780

458

checker, -2 means no checker completed yet.

781

last_checker_signal: The signal which killed the last checker, if

782

last_checker_status is -1

783

459

last_enabled: datetime.datetime(); (UTC) or None

784

460

name: string; from the config file, used in log messages and

785

461

D-Bus identifiers

836

512

client["fingerprint"] = (section["fingerprint"].upper()

837

513

.replace(" ", ""))

838

514

if "secret" in section:

839

client["secret"] = codecs.decode(section["secret"]

840

.encode("utf-8"),

841

"base64")

515

client["secret"] = section["secret"].decode("base64")

842

516

elif "secfile" in section:

843

517

with open(os.path.expanduser(os.path.expandvars

844

518

(section["secfile"])),

897

571

self.changedstate = multiprocessing_manager.Condition(

898

572

multiprocessing_manager.Lock())

899

573

self.client_structure = [attr

900

for attr in self.__dict__.keys()

574

for attr in self.__dict__.iterkeys()

901

575

if not attr.startswith("_")]

902

576

self.client_structure.append("client_structure")

903

577

929

603

if not quiet:

930

604

logger.info("Disabling client %s", self.name)

931

605

if getattr(self, "disable_initiator_tag", None) is not None:

932

GObject.source_remove(self.disable_initiator_tag)

606

gobject.source_remove(self.disable_initiator_tag)

933

607

self.disable_initiator_tag = None

934

608

self.expires = None

935

609

if getattr(self, "checker_initiator_tag", None) is not None:

936

GObject.source_remove(self.checker_initiator_tag)

610

gobject.source_remove(self.checker_initiator_tag)

937

611

self.checker_initiator_tag = None

938

612

self.stop_checker()

939

613

self.enabled = False

940

614

if not quiet:

941

615

self.send_changedstate()

942

# Do not run this again if called by a GObject.timeout_add

616

# Do not run this again if called by a gobject.timeout_add

943

617

return False

944

618

945

619

def __del__(self):

949

623

# Schedule a new checker to be started an 'interval' from now,

950

624

# and every interval from then on.

951

625

if self.checker_initiator_tag is not None:

952

GObject.source_remove(self.checker_initiator_tag)

953

self.checker_initiator_tag = GObject.timeout_add(

626

gobject.source_remove(self.checker_initiator_tag)

627

self.checker_initiator_tag = gobject.timeout_add(

954

628

int(self.interval.total_seconds() * 1000),

955

629

self.start_checker)

956

630

# Schedule a disable() when 'timeout' has passed

957

631

if self.disable_initiator_tag is not None:

958

GObject.source_remove(self.disable_initiator_tag)

959

self.disable_initiator_tag = GObject.timeout_add(

632

gobject.source_remove(self.disable_initiator_tag)

633

self.disable_initiator_tag = gobject.timeout_add(

960

634

int(self.timeout.total_seconds() * 1000), self.disable)

961

635

# Also start a new checker *right now*.

962

636

self.start_checker()

963

637

964

def checker_callback(self, source, condition, connection,

965

command):

638

def checker_callback(self, pid, condition, command):

966

639

"""The checker has completed, so take appropriate actions."""

967

640

self.checker_callback_tag = None

968

641

self.checker = None

969

# Read return code from connection (see call_pipe)

970

returncode = connection.recv()

971

connection.close()

972

973

if returncode >= 0:

974

self.last_checker_status = returncode

975

self.last_checker_signal = None

642

if os.WIFEXITED(condition):

643

self.last_checker_status = os.WEXITSTATUS(condition)

976

644

if self.last_checker_status == 0:

977

645

logger.info("Checker for %(name)s succeeded",

978

646

vars(self))

981

649

logger.info("Checker for %(name)s failed", vars(self))

982

650

else:

983

651

self.last_checker_status = -1

984

self.last_checker_signal = -returncode

985

652

logger.warning("Checker for %(name)s crashed?",

986

653

vars(self))

987

return False

988

654

989

655

def checked_ok(self):

990

656

"""Assert that the client has been seen, alive and well."""

991

657

self.last_checked_ok = datetime.datetime.utcnow()

992

658

self.last_checker_status = 0

993

self.last_checker_signal = None

994

659

self.bump_timeout()

995

660

996

661

def bump_timeout(self, timeout=None):

998

663

if timeout is None:

999

664

timeout = self.timeout

1000

665

if self.disable_initiator_tag is not None:

1001

GObject.source_remove(self.disable_initiator_tag)

666

gobject.source_remove(self.disable_initiator_tag)

1002

667

self.disable_initiator_tag = None

1003

668

if getattr(self, "enabled", False):

1004

self.disable_initiator_tag = GObject.timeout_add(

669

self.disable_initiator_tag = gobject.timeout_add(

1005

670

int(timeout.total_seconds() * 1000), self.disable)

1006

671

self.expires = datetime.datetime.utcnow() + timeout

1007

672

1022

687

# than 'timeout' for the client to be disabled, which is as it

1023

688

# should be.

1024

689

1025

if self.checker is not None and not self.checker.is_alive():

1026

logger.warning("Checker was not alive; joining")

1027

self.checker.join()

1028

self.checker = None

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

1029

704

# Start a new checker if needed

1030

705

if self.checker is None:

1031

706

# Escape attributes for the shell

1040

715

exc_info=error)

1041

716

return True # Try again later

1042

717

self.current_checker_command = command

1043

logger.info("Starting checker %r for %s", command,

1044

self.name)

1045

# We don't need to redirect stdout and stderr, since

1046

# in normal mode, that is already done by daemon(),

1047

# and in debug mode we don't want to. (Stdin is

1048

# always replaced by /dev/null.)

1049

# The exception is when not debugging but nevertheless

1050

# running in the foreground; use the previously

1051

# created wnull.

1052

popen_args = { "close_fds": True,

1053

"shell": True,

1054

"cwd": "/" }

1055

if (not self.server_settings["debug"]

1056

and self.server_settings["foreground"]):

1057

popen_args.update({"stdout": wnull,

1058

"stderr": wnull })

1059

pipe = multiprocessing.Pipe(duplex = False)

1060

self.checker = multiprocessing.Process(

1061

target = call_pipe,

1062

args = (pipe[1], subprocess.call, command),

1063

kwargs = popen_args)

1064

self.checker.start()

1065

self.checker_callback_tag = GObject.io_add_watch(

1066

pipe[0].fileno(), GObject.IO_IN,

1067

self.checker_callback, pipe[0], command)

1068

# Re-run this periodically if run by GObject.timeout_add

718

try:

719

logger.info("Starting checker %r for %s", command,

720

self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True,

736

cwd="/",

737

**popen_args)

738

except OSError as error:

739

logger.error("Failed to start subprocess",

740

exc_info=error)

741

return True

742

self.checker_callback_tag = gobject.child_watch_add(

743

self.checker.pid, self.checker_callback, data=command)

744

# The checker may have completed before the gobject

745

# watch was added. Check for this.

746

try:

747

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

748

except OSError as error:

749

if error.errno == errno.ECHILD:

750

# This should never happen

751

logger.error("Child process vanished",

752

exc_info=error)

753

return True

754

raise

755

if pid:

756

gobject.source_remove(self.checker_callback_tag)

757

self.checker_callback(pid, status, command)

758

# Re-run this periodically if run by gobject.timeout_add

1069

759

return True

1070

760

1071

761

def stop_checker(self):

1072

762

"""Force the checker process, if any, to stop."""

1073

763

if self.checker_callback_tag:

1074

GObject.source_remove(self.checker_callback_tag)

764

gobject.source_remove(self.checker_callback_tag)

1075

765

self.checker_callback_tag = None

1076

766

if getattr(self, "checker", None) is None:

1077

767

return

1078

768

logger.debug("Stopping checker for %(name)s", vars(self))

1079

self.checker.terminate()

769

try:

770

self.checker.terminate()

771

#time.sleep(0.5)

772

#if self.checker.poll() is None:

773

# self.checker.kill()

774

except OSError as error:

775

if error.errno != errno.ESRCH: # No such process

776

raise

1080

777

self.checker = None

1081

778

1082

779

1146

843

access="r")

1147

844

def Property_dbus_property(self):

1148

845

return dbus.Boolean(False)

1149

1150

See also the DBusObjectWithAnnotations class.

1151

846

"""

1152

847

1153

848

def decorator(func):

1175

870

pass

1176

871

1177

872

1178

class DBusObjectWithAnnotations(dbus.service.Object):

1179

"""A D-Bus object with annotations.

873

class DBusObjectWithProperties(dbus.service.Object):

874

"""A D-Bus object with properties.

1180

875

1181

Classes inheriting from this can use the dbus_annotations

1182

decorator to add annotations to methods or signals.

876

Classes inheriting from this can use the dbus_service_property

877

decorator to expose methods as D-Bus properties. It exposes the

878

standard Get(), Set(), and GetAll() methods on the D-Bus.

1183

879

"""

1184

880

1185

881

@staticmethod

1201

897

for name, athing in

1202

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1203

899

1204

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1205

out_signature = "s",

1206

path_keyword = 'object_path',

1207

connection_keyword = 'connection')

1208

def Introspect(self, object_path, connection):

1209

"""Overloading of standard D-Bus method.

1210

1211

Inserts annotation tags on methods and signals.

1212

"""

1213

xmlstring = dbus.service.Object.Introspect(self, object_path,

1214

connection)

1215

try:

1216

document = xml.dom.minidom.parseString(xmlstring)

1217

1218

for if_tag in document.getElementsByTagName("interface"):

1219

# Add annotation tags

1220

for typ in ("method", "signal"):

1221

for tag in if_tag.getElementsByTagName(typ):

1222

annots = dict()

1223

for name, prop in (self.

1224

_get_all_dbus_things(typ)):

1225

if (name == tag.getAttribute("name")

1226

and prop._dbus_interface

1227

== if_tag.getAttribute("name")):

1228

annots.update(getattr(

1229

prop, "_dbus_annotations", {}))

1230

for name, value in annots.items():

1231

ann_tag = document.createElement(

1232

"annotation")

1233

ann_tag.setAttribute("name", name)

1234

ann_tag.setAttribute("value", value)

1235

tag.appendChild(ann_tag)

1236

# Add interface annotation tags

1237

for annotation, value in dict(

1238

itertools.chain.from_iterable(

1239

annotations().items()

1240

for name, annotations

1241

in self._get_all_dbus_things("interface")

1242

if name == if_tag.getAttribute("name")

1243

)).items():

1244

ann_tag = document.createElement("annotation")

1245

ann_tag.setAttribute("name", annotation)

1246

ann_tag.setAttribute("value", value)

1247

if_tag.appendChild(ann_tag)

1248

# Fix argument name for the Introspect method itself

1249

if (if_tag.getAttribute("name")

1250

== dbus.INTROSPECTABLE_IFACE):

1251

for cn in if_tag.getElementsByTagName("method"):

1252

if cn.getAttribute("name") == "Introspect":

1253

for arg in cn.getElementsByTagName("arg"):

1254

if (arg.getAttribute("direction")

1255

== "out"):

1256

arg.setAttribute("name",

1257

"xml_data")

1258

xmlstring = document.toxml("utf-8")

1259

document.unlink()

1260

except (AttributeError, xml.dom.DOMException,

1261

xml.parsers.expat.ExpatError) as error:

1262

logger.error("Failed to override Introspection method",

1263

exc_info=error)

1264

return xmlstring

1265

1266

1267

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1268

"""A D-Bus object with properties.

1269

1270

Classes inheriting from this can use the dbus_service_property

1271

decorator to expose methods as D-Bus properties. It exposes the

1272

standard Get(), Set(), and GetAll() methods on the D-Bus.

1273

"""

1274

1275

900

def _get_dbus_property(self, interface_name, property_name):

1276

901

"""Returns a bound method if one exists which is a D-Bus

1277

902

property with the specified name and interface.

1287

912

raise DBusPropertyNotFound("{}:{}.{}".format(

1288

913

self.dbus_object_path, interface_name, property_name))

1289

914

1290

@classmethod

1291

def _get_all_interface_names(cls):

1292

"""Get a sequence of all interfaces supported by an object"""

1293

return (name for name in set(getattr(getattr(x, attr),

1294

"_dbus_interface", None)

1295

for x in (inspect.getmro(cls))

1296

for attr in dir(x))

1297

if name is not None)

1298

1299

915

@dbus.service.method(dbus.PROPERTIES_IFACE,

1300

916

in_signature="ss",

1301

917

out_signature="v")

1371

987

1372

988

Inserts property tags and interface annotation tags.

1373

989

"""

1374

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1375

object_path,

1376

connection)

990

xmlstring = dbus.service.Object.Introspect(self, object_path,

991

connection)

1377

992

try:

1378

993

document = xml.dom.minidom.parseString(xmlstring)

1379

994

1392

1007

if prop._dbus_interface

1393

1008

== if_tag.getAttribute("name")):

1394

1009

if_tag.appendChild(tag)

1395

# Add annotation tags for properties

1396

for tag in if_tag.getElementsByTagName("property"):

1397

annots = dict()

1398

for name, prop in self._get_all_dbus_things(

1399

"property"):

1400

if (name == tag.getAttribute("name")

1401

and prop._dbus_interface

1402

== if_tag.getAttribute("name")):

1403

annots.update(getattr(

1404

prop, "_dbus_annotations", {}))

1405

for name, value in annots.items():

1406

ann_tag = document.createElement(

1407

"annotation")

1408

ann_tag.setAttribute("name", name)

1409

ann_tag.setAttribute("value", value)

1410

tag.appendChild(ann_tag)

1010

# Add annotation tags

1011

for typ in ("method", "signal", "property"):

1012

for tag in if_tag.getElementsByTagName(typ):

1013

annots = dict()

1014

for name, prop in (self.

1015

_get_all_dbus_things(typ)):

1016

if (name == tag.getAttribute("name")

1017

and prop._dbus_interface

1018

== if_tag.getAttribute("name")):

1019

annots.update(getattr(

1020

prop, "_dbus_annotations", {}))

1021

for name, value in annots.items():

1022

ann_tag = document.createElement(

1023

"annotation")

1024

ann_tag.setAttribute("name", name)

1025

ann_tag.setAttribute("value", value)

1026

tag.appendChild(ann_tag)

1027

# Add interface annotation tags

1028

for annotation, value in dict(

1029

itertools.chain.from_iterable(

1030

annotations().items()

1031

for name, annotations

1032

in self._get_all_dbus_things("interface")

1033

if name == if_tag.getAttribute("name")

1034

)).items():

1035

ann_tag = document.createElement("annotation")

1036

ann_tag.setAttribute("name", annotation)

1037

ann_tag.setAttribute("value", value)

1038

if_tag.appendChild(ann_tag)

1411

1039

# Add the names to the return values for the

1412

1040

# "org.freedesktop.DBus.Properties" methods

1413

1041

if (if_tag.getAttribute("name")

1431

1059

exc_info=error)

1432

1060

return xmlstring

1433

1061

1434

try:

1435

dbus.OBJECT_MANAGER_IFACE

1436

except AttributeError:

1437

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1438

1439

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1440

"""A D-Bus object with an ObjectManager.

1441

1442

Classes inheriting from this exposes the standard

1443

GetManagedObjects call and the InterfacesAdded and

1444

InterfacesRemoved signals on the standard

1445

"org.freedesktop.DBus.ObjectManager" interface.

1446

1447

Note: No signals are sent automatically; they must be sent

1448

manually.

1449

"""

1450

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1451

out_signature = "a{oa{sa{sv}}}")

1452

def GetManagedObjects(self):

1453

"""This function must be overridden"""

1454

raise NotImplementedError()

1455

1456

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1457

signature = "oa{sa{sv}}")

1458

def InterfacesAdded(self, object_path, interfaces_and_properties):

1459

pass

1460

1461

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1462

def InterfacesRemoved(self, object_path, interfaces):

1463

pass

1464

1465

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1466

out_signature = "s",

1467

path_keyword = 'object_path',

1468

connection_keyword = 'connection')

1469

def Introspect(self, object_path, connection):

1470

"""Overloading of standard D-Bus method.

1471

1472

Override return argument name of GetManagedObjects to be

1473

"objpath_interfaces_and_properties"

1474

"""

1475

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1476

object_path,

1477

connection)

1478

try:

1479

document = xml.dom.minidom.parseString(xmlstring)

1480

1481

for if_tag in document.getElementsByTagName("interface"):

1482

# Fix argument name for the GetManagedObjects method

1483

if (if_tag.getAttribute("name")

1484

== dbus.OBJECT_MANAGER_IFACE):

1485

for cn in if_tag.getElementsByTagName("method"):

1486

if (cn.getAttribute("name")

1487

== "GetManagedObjects"):

1488

for arg in cn.getElementsByTagName("arg"):

1489

if (arg.getAttribute("direction")

1490

== "out"):

1491

arg.setAttribute(

1492

"name",

1493

"objpath_interfaces"

1494

"_and_properties")

1495

xmlstring = document.toxml("utf-8")

1496

document.unlink()

1497

except (AttributeError, xml.dom.DOMException,

1498

xml.parsers.expat.ExpatError) as error:

1499

logger.error("Failed to override Introspection method",

1500

exc_info = error)

1501

return xmlstring

1502

1062

1503

1063

def datetime_to_dbus(dt, variant_level=0):

1504

1064

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1553

1113

if getattr(attribute, "_dbus_is_signal", False):

1554

1114

# Extract the original non-method undecorated

1555

1115

# function by black magic

1556

if sys.version_info.major == 2:

1557

nonmethod_func = (dict(

1558

zip(attribute.func_code.co_freevars,

1559

attribute.__closure__))

1560

["func"].cell_contents)

1561

else:

1562

nonmethod_func = (dict(

1563

zip(attribute.__code__.co_freevars,

1564

attribute.__closure__))

1565

["func"].cell_contents)

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1566

1120

# Create a new, but exactly alike, function

1567

1121

# object, and decorate it to be a new D-Bus signal

1568

1122

# with the alternate D-Bus interface name

1569

new_function = copy_function(nonmethod_func)

1570

1123

new_function = (dbus.service.signal(

1571

alt_interface,

1572

attribute._dbus_signature)(new_function))

1124

alt_interface, attribute._dbus_signature)

1125

(types.FunctionType(

1126

nonmethod_func.func_code,

1127

nonmethod_func.func_globals,

1128

nonmethod_func.func_name,

1129

nonmethod_func.func_defaults,

1130

nonmethod_func.func_closure)))

1573

1131

# Copy annotations, if any

1574

1132

try:

1575

1133

new_function._dbus_annotations = dict(

1585

1143

func1 and func2 to the "call_both" function

1586

1144

outside of its arguments"""

1587

1145

1588

@functools.wraps(func2)

1589

1146

def call_both(*args, **kwargs):

1590

1147

"""This function will emit two D-Bus

1591

1148

signals by calling func1 and func2"""

1592

1149

func1(*args, **kwargs)

1593

1150

func2(*args, **kwargs)

1594

# Make wrapper function look like a D-Bus signal

1595

for name, attr in inspect.getmembers(func2):

1596

if name.startswith("_dbus_"):

1597

setattr(call_both, name, attr)

1598

1151

1599

1152

return call_both

1600

1153

# Create the "call_both" function and add it to

1611

1164

alt_interface,

1612

1165

attribute._dbus_in_signature,

1613

1166

attribute._dbus_out_signature)

1614

(copy_function(attribute)))

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1615

1172

# Copy annotations, if any

1616

1173

try:

1617

1174

attr[attrname]._dbus_annotations = dict(

1629

1186

attribute._dbus_access,

1630

1187

attribute._dbus_get_args_options

1631

1188

["byte_arrays"])

1632

(copy_function(attribute)))

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1633

1195

# Copy annotations, if any

1634

1196

try:

1635

1197

attr[attrname]._dbus_annotations = dict(

1644

1206

# to the class.

1645

1207

attr[attrname] = (

1646

1208

dbus_interface_annotations(alt_interface)

1647

(copy_function(attribute)))

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1648

1214

if deprecate:

1649

1215

# Deprecate all alternate interfaces

1650

1216

iname="_AlternateDBusNames_interface_annotation{}"

1663

1229

if interface_names:

1664

1230

# Replace the class with a new subclass of it with

1665

1231

# methods, signals, etc. as created above.

1666

if sys.version_info.major == 2:

1667

cls = type(b"{}Alternate".format(cls.__name__),

1668

(cls, ), attr)

1669

else:

1670

cls = type("{}Alternate".format(cls.__name__),

1671

(cls, ), attr)

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1672

1234

return cls

1673

1235

1674

1236

return wrapper

1794

1356

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1795

1357

Client.__del__(self, *args, **kwargs)

1796

1358

1797

def checker_callback(self, source, condition,

1798

connection, command, *args, **kwargs):

1799

ret = Client.checker_callback(self, source, condition,

1800

connection, command, *args,

1801

**kwargs)

1802

exitstatus = self.last_checker_status

1803

if exitstatus >= 0:

1359

def checker_callback(self, pid, condition, command,

1360

*args, **kwargs):

1361

self.checker_callback_tag = None

1362

self.checker = None

1363

if os.WIFEXITED(condition):

1364

exitstatus = os.WEXITSTATUS(condition)

1804

1365

# Emit D-Bus signal

1805

1366

self.CheckerCompleted(dbus.Int16(exitstatus),

1806

# This is specific to GNU libC

1807

dbus.Int64(exitstatus << 8),

1367

dbus.Int64(condition),

1808

1368

dbus.String(command))

1809

1369

else:

1810

1370

# Emit D-Bus signal

1811

1371

self.CheckerCompleted(dbus.Int16(-1),

1812

dbus.Int64(

1813

# This is specific to GNU libC

1814

(exitstatus << 8)

1815

| self.last_checker_signal),

1372

dbus.Int64(condition),

1816

1373

dbus.String(command))

1817

return ret

1374

1375

return Client.checker_callback(self, pid, condition, command,

1376

*args, **kwargs)

1818

1377

1819

1378

def start_checker(self, *args, **kwargs):

1820

1379

old_checker_pid = getattr(self.checker, "pid", None)

1832

1391

1833

1392

def approve(self, value=True):

1834

1393

self.approved = value

1835

GObject.timeout_add(int(self.approval_duration.total_seconds()

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1836

1395

* 1000), self._reset_approved)

1837

1396

self.send_changedstate()

1838

1397

1895

1454

self.checked_ok()

1896

1455

1897

1456

# Enable - method

1898

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1899

1457

@dbus.service.method(_interface)

1900

1458

def Enable(self):

1901

1459

"D-Bus method"

1902

1460

self.enable()

1903

1461

1904

1462

# StartChecker - method

1905

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1906

1463

@dbus.service.method(_interface)

1907

1464

def StartChecker(self):

1908

1465

"D-Bus method"

1909

1466

self.start_checker()

1910

1467

1911

1468

# Disable - method

1912

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1913

1469

@dbus.service.method(_interface)

1914

1470

def Disable(self):

1915

1471

"D-Bus method"

1916

1472

self.disable()

1917

1473

1918

1474

# StopChecker - method

1919

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1920

1475

@dbus.service.method(_interface)

1921

1476

def StopChecker(self):

1922

1477

self.stop_checker()

1958

1513

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1959

1514

1960

1515

# Name - property

1961

@dbus_annotations(

1962

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1963

1516

@dbus_service_property(_interface, signature="s", access="read")

1964

1517

def Name_dbus_property(self):

1965

1518

return dbus.String(self.name)

1966

1519

1967

1520

# Fingerprint - property

1968

@dbus_annotations(

1969

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1970

1521

@dbus_service_property(_interface, signature="s", access="read")

1971

1522

def Fingerprint_dbus_property(self):

1972

1523

return dbus.String(self.fingerprint)

1981

1532

self.host = str(value)

1982

1533

1983

1534

# Created - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1986

1535

@dbus_service_property(_interface, signature="s", access="read")

1987

1536

def Created_dbus_property(self):

1988

1537

return datetime_to_dbus(self.created)

2049

1598

if (getattr(self, "disable_initiator_tag", None)

2050

1599

is None):

2051

1600

return

2052

GObject.source_remove(self.disable_initiator_tag)

2053

self.disable_initiator_tag = GObject.timeout_add(

1601

gobject.source_remove(self.disable_initiator_tag)

1602

self.disable_initiator_tag = gobject.timeout_add(

2054

1603

int((self.expires - now).total_seconds() * 1000),

2055

1604

self.disable)

2056

1605

2076

1625

return

2077

1626

if self.enabled:

2078

1627

# Reschedule checker run

2079

GObject.source_remove(self.checker_initiator_tag)

2080

self.checker_initiator_tag = GObject.timeout_add(

1628

gobject.source_remove(self.checker_initiator_tag)

1629

self.checker_initiator_tag = gobject.timeout_add(

2081

1630

value, self.start_checker)

2082

1631

self.start_checker() # Start one now, too

2083

1632

2103

1652

self.stop_checker()

2104

1653

2105

1654

# ObjectPath - property

2106

@dbus_annotations(

2107

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2108

"org.freedesktop.DBus.Deprecated": "true"})

2109

1655

@dbus_service_property(_interface, signature="o", access="read")

2110

1656

def ObjectPath_dbus_property(self):

2111

1657

return self.dbus_object_path # is already a dbus.ObjectPath

2112

1658

2113

1659

# Secret = property

2114

@dbus_annotations(

2115

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2116

"invalidates"})

2117

1660

@dbus_service_property(_interface,

2118

1661

signature="ay",

2119

1662

access="write",

2165

1708

logger.debug("Pipe FD: %d",

2166

1709

self.server.child_pipe.fileno())

2167

1710

2168

session = gnutls.ClientSession(self.request)

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1713

1714

# Note: gnutls.connection.X509Credentials is really a

1715

# generic GnuTLS certificate credentials object so long as

1716

# no X.509 keys are added to it. Therefore, we can use it

1717

# here despite using OpenPGP certificates.

2169

1718

2170

1719

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2171

1720

# "+AES-256-CBC", "+SHA1",

2175

1724

priority = self.server.gnutls_priority

2176

1725

if priority is None:

2177

1726

priority = "NORMAL"

2178

gnutls.priority_set_direct(session._c_object, priority,

2179

None)

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

2180

1729

2181

1730

# Start communication using the Mandos protocol

2182

1731

# Get protocol number

2192

1741

# Start GnuTLS connection

2193

1742

try:

2194

1743

session.handshake()

2195

except gnutls.Error as error:

1744

except gnutls.errors.GNUTLSError as error:

2196

1745

logger.warning("Handshake failed: %s", error)

2197

1746

# Do not run session.bye() here: the session is not

2198

1747

# established. Just abandon the request.

2204

1753

try:

2205

1754

fpr = self.fingerprint(

2206

1755

self.peer_certificate(session))

2207

except (TypeError, gnutls.Error) as error:

1756

except (TypeError,

1757

gnutls.errors.GNUTLSError) as error:

2208

1758

logger.warning("Bad certificate: %s", error)

2209

1759

return

2210

1760

logger.debug("Fingerprint: %s", fpr)

2268

1818

else:

2269

1819

delay -= time2 - time

2270

1820

2271

try:

2272

session.send(client.secret)

2273

except gnutls.Error as error:

2274

logger.warning("gnutls send failed",

2275

exc_info = error)

2276

return

1821

sent_size = 0

1822

while sent_size < len(client.secret):

1823

try:

1824

sent = session.send(client.secret[sent_size:])

1825

except gnutls.errors.GNUTLSError as error:

1826

logger.warning("gnutls send failed",

1827

exc_info=error)

1828

return

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1832

sent_size += sent

2277

1833

2278

1834

logger.info("Sending secret to %s", client.name)

2279

1835

# bump the timeout using extended_timeout

2287

1843

client.approvals_pending -= 1

2288

1844

try:

2289

1845

session.bye()

2290

except gnutls.Error as error:

1846

except gnutls.errors.GNUTLSError as error:

2291

1847

logger.warning("GnuTLS bye failed",

2292

1848

exc_info=error)

2293

1849

2295

1851

def peer_certificate(session):

2296

1852

"Return the peer's OpenPGP certificate as a bytestring"

2297

1853

# If not an OpenPGP certificate...

2298

if (gnutls.certificate_type_get(session._c_object)

2299

!= gnutls.CRT_OPENPGP):

2300

# ...return invalid data

2301

return b""

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1856

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1857

# ...do the normal thing

1858

return session.peer_certificate

2302

1859

list_size = ctypes.c_uint(1)

2303

cert_list = (gnutls.certificate_get_peers

1860

cert_list = (gnutls.library.functions

1861

.gnutls_certificate_get_peers

2304

1862

(session._c_object, ctypes.byref(list_size)))

2305

1863

if not bool(cert_list) and list_size.value != 0:

2306

raise gnutls.Error("error getting peer certificate")

1864

raise gnutls.errors.GNUTLSError("error getting peer"

1865

" certificate")

2307

1866

if list_size.value == 0:

2308

1867

return None

2309

1868

cert = cert_list[0]

2313

1872

def fingerprint(openpgp):

2314

1873

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2315

1874

# New GnuTLS "datum" with the OpenPGP public key

2316

datum = gnutls.datum_t(

1875

datum = gnutls.library.types.gnutls_datum_t(

2317

1876

ctypes.cast(ctypes.c_char_p(openpgp),

2318

1877

ctypes.POINTER(ctypes.c_ubyte)),

2319

1878

ctypes.c_uint(len(openpgp)))

2320

1879

# New empty GnuTLS certificate

2321

crt = gnutls.openpgp_crt_t()

2322

gnutls.openpgp_crt_init(ctypes.byref(crt))

1880

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

2323

1883

# Import the OpenPGP public key into the certificate

2324

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2325

gnutls.OPENPGP_FMT_RAW)

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2326

1887

# Verify the self signature in the key

2327

1888

crtverify = ctypes.c_uint()

2328

gnutls.openpgp_crt_verify_self(crt, 0,

2329

ctypes.byref(crtverify))

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

2330

1891

if crtverify.value != 0:

2331

gnutls.openpgp_crt_deinit(crt)

2332

raise gnutls.CertificateSecurityError("Verify failed")

1892

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

2333

1895

# New buffer for the fingerprint

2334

1896

buf = ctypes.create_string_buffer(20)

2335

1897

buf_len = ctypes.c_size_t()

2336

1898

# Get the fingerprint from the certificate into the buffer

2337

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2338

ctypes.byref(buf_len))

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2339

1901

# Deinit the certificate

2340

gnutls.openpgp_crt_deinit(crt)

1902

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2341

1903

# Convert the buffer to a Python bytestring

2342

1904

fpr = ctypes.string_at(buf, buf_len.value)

2343

1905

# Convert the bytestring to hexadecimal notation

2487

2049

gnutls_priority GnuTLS priority string

2488

2050

use_dbus: Boolean; to emit D-Bus signals or not

2489

2051

2490

Assumes a GObject.MainLoop event loop.

2052

Assumes a gobject.MainLoop event loop.

2491

2053

"""

2492

2054

2493

2055

def __init__(self, server_address, RequestHandlerClass,

2518

2080

2519

2081

def add_pipe(self, parent_pipe, proc):

2520

2082

# Call "handle_ipc" for both data and EOF events

2521

GObject.io_add_watch(

2083

gobject.io_add_watch(

2522

2084

parent_pipe.fileno(),

2523

GObject.IO_IN | GObject.IO_HUP,

2085

gobject.IO_IN | gobject.IO_HUP,

2524

2086

functools.partial(self.handle_ipc,

2525

2087

parent_pipe = parent_pipe,

2526

2088

proc = proc))

2530

2092

proc = None,

2531

2093

client_object=None):

2532

2094

# error, or the other end of multiprocessing.Pipe has closed

2533

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2095

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2534

2096

# Wait for other process to exit

2535

2097

proc.join()

2536

2098

return False

2543

2105

fpr = request[1]

2544

2106

address = request[2]

2545

2107

2546

for c in self.clients.values():

2108

for c in self.clients.itervalues():

2547

2109

if c.fingerprint == fpr:

2548

2110

client = c

2549

2111

break

2557

2119

parent_pipe.send(False)

2558

2120

return False

2559

2121

2560

GObject.io_add_watch(

2122

gobject.io_add_watch(

2561

2123

parent_pipe.fileno(),

2562

GObject.IO_IN | GObject.IO_HUP,

2124

gobject.IO_IN | gobject.IO_HUP,

2563

2125

functools.partial(self.handle_ipc,

2564

2126

parent_pipe = parent_pipe,

2565

2127

proc = proc,

2579

2141

2580

2142

if command == 'getattr':

2581

2143

attrname = request[1]

2582

if isinstance(client_object.__getattribute__(attrname),

2583

collections.Callable):

2144

if callable(client_object.__getattribute__(attrname)):

2584

2145

parent_pipe.send(('function', ))

2585

2146

else:

2586

2147

parent_pipe.send((

2824

2385

"debug": "False",

2825

2386

"priority":

2826

2387

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2827

":+SIGN-DSA-SHA256",

2388

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2828

2389

"servicename": "Mandos",

2829

2390

"use_dbus": "True",

2830

2391

"use_ipv6": "True",

2947

2508

logger.error("Could not open file %r", pidfilename,

2948

2509

exc_info=e)

2949

2510

2950

for name, group in (("_mandos", "_mandos"),

2951

("mandos", "mandos"),

2952

("nobody", "nogroup")):

2511

for name in ("_mandos", "mandos", "nobody"):

2953

2512

try:

2954

2513

uid = pwd.getpwnam(name).pw_uid

2955

gid = pwd.getpwnam(group).pw_gid

2514

gid = pwd.getpwnam(name).pw_gid

2956

2515

break

2957

2516

except KeyError:

2958

2517

continue

2962

2521

try:

2963

2522

os.setgid(gid)

2964

2523

os.setuid(uid)

2965

if debug:

2966

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2967

gid))

2968

2524

except OSError as error:

2969

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2970

.format(uid, gid, os.strerror(error.errno)))

2971

2525

if error.errno != errno.EPERM:

2972

2526

raise

2973

2527

2976

2530

2977

2531

# "Use a log level over 10 to enable all debugging options."

2978

2532

# - GnuTLS manual

2979

gnutls.global_set_log_level(11)

2533

gnutls.library.functions.gnutls_global_set_log_level(11)

2980

2534

2981

@gnutls.log_func

2535

@gnutls.library.types.gnutls_log_func

2982

2536

def debug_gnutls(level, string):

2983

2537

logger.debug("GnuTLS: %s", string[:-1])

2984

2538

2985

gnutls.global_set_log_function(debug_gnutls)

2539

gnutls.library.functions.gnutls_global_set_log_function(

2540

debug_gnutls)

2986

2541

2987

2542

# Redirect stdin so all checkers get /dev/null

2988

2543

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2995

2550

# Close all input and output, do double fork, etc.

2996

2551

daemon()

2997

2552

2998

# multiprocessing will use threads, so before we use GObject we

2999

# need to inform GObject that threads will be used.

3000

GObject.threads_init()

2553

# multiprocessing will use threads, so before we use gobject we

2554

# need to inform gobject that threads will be used.

2555

gobject.threads_init()

3001

2556

3002

2557

global main_loop

3003

2558

# From the Avahi example code

3004

2559

DBusGMainLoop(set_as_default=True)

3005

main_loop = GObject.MainLoop()

2560

main_loop = gobject.MainLoop()

3006

2561

bus = dbus.SystemBus()

3007

2562

# End of Avahi example code

3008

2563

if use_dbus:

3052

2607

if server_settings["restore"]:

3053

2608

try:

3054

2609

with open(stored_state_path, "rb") as stored_state:

3055

if sys.version_info.major == 2:

3056

clients_data, old_client_settings = pickle.load(

3057

stored_state)

3058

else:

3059

bytes_clients_data, bytes_old_client_settings = (

3060

pickle.load(stored_state, encoding = "bytes"))

3061

### Fix bytes to strings

3062

## clients_data

3063

# .keys()

3064

clients_data = { (key.decode("utf-8")

3065

if isinstance(key, bytes)

3066

else key): value

3067

for key, value in

3068

bytes_clients_data.items() }

3069

del bytes_clients_data

3070

for key in clients_data:

3071

value = { (k.decode("utf-8")

3072

if isinstance(k, bytes) else k): v

3073

for k, v in

3074

clients_data[key].items() }

3075

clients_data[key] = value

3076

# .client_structure

3077

value["client_structure"] = [

3078

(s.decode("utf-8")

3079

if isinstance(s, bytes)

3080

else s) for s in

3081

value["client_structure"] ]

3082

# .name & .host

3083

for k in ("name", "host"):

3084

if isinstance(value[k], bytes):

3085

value[k] = value[k].decode("utf-8")

3086

## old_client_settings

3087

# .keys()

3088

old_client_settings = {

3089

(key.decode("utf-8")

3090

if isinstance(key, bytes)

3091

else key): value

3092

for key, value in

3093

bytes_old_client_settings.items() }

3094

del bytes_old_client_settings

3095

# .host

3096

for value in old_client_settings.values():

3097

if isinstance(value["host"], bytes):

3098

value["host"] = (value["host"]

3099

.decode("utf-8"))

2610

clients_data, old_client_settings = pickle.load(

2611

stored_state)

3100

2612

os.remove(stored_state_path)

3101

2613

except IOError as e:

3102

2614

if e.errno == errno.ENOENT:

3135

2647

pass

3136

2648

3137

2649

# Clients who has passed its expire date can still be

3138

# enabled if its last checker was successful. A Client

2650

# enabled if its last checker was successful. Clients

3139

2651

# whose checker succeeded before we stored its state is

3140

2652

# assumed to have successfully run all checkers during

3141

2653

# downtime.

3210

2722

3211

2723

@alternate_dbus_interfaces(

3212

2724

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3213

class MandosDBusService(DBusObjectWithObjectManager):

2725

class MandosDBusService(DBusObjectWithProperties):

3214

2726

"""A D-Bus proxy object"""

3215

2727

3216

2728

def __init__(self):

3218

2730

3219

2731

_interface = "se.recompile.Mandos"

3220

2732

2733

@dbus_interface_annotations(_interface)

2734

def _foo(self):

2735

return {

2736

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2737

"false" }

2738

3221

2739

@dbus.service.signal(_interface, signature="o")

3222

2740

def ClientAdded(self, objpath):

3223

2741

"D-Bus signal"

3228

2746

"D-Bus signal"

3229

2747

pass

3230

2748

3231

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3232

"true"})

3233

2749

@dbus.service.signal(_interface, signature="os")

3234

2750

def ClientRemoved(self, objpath, name):

3235

2751

"D-Bus signal"

3236

2752

pass

3237

2753

3238

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3239

"true"})

3240

2754

@dbus.service.method(_interface, out_signature="ao")

3241

2755

def GetAllClients(self):

3242

2756

"D-Bus method"

3243

2757

return dbus.Array(c.dbus_object_path for c in

3244

tcp_server.clients.values())

2758

tcp_server.clients.itervalues())

3245

2759

3246

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3247

"true"})

3248

2760

@dbus.service.method(_interface,

3249

2761

out_signature="a{oa{sv}}")

3250

2762

def GetAllClientsWithProperties(self):

3251

2763

"D-Bus method"

3252

2764

return dbus.Dictionary(

3253

{ c.dbus_object_path: c.GetAll(

3254

"se.recompile.Mandos.Client")

3255

for c in tcp_server.clients.values() },

2765

{ c.dbus_object_path: c.GetAll("")

2766

for c in tcp_server.clients.itervalues() },

3256

2767

signature="oa{sv}")

3257

2768

3258

2769

@dbus.service.method(_interface, in_signature="o")

3259

2770

def RemoveClient(self, object_path):

3260

2771

"D-Bus method"

3261

for c in tcp_server.clients.values():

2772

for c in tcp_server.clients.itervalues():

3262

2773

if c.dbus_object_path == object_path:

3263

2774

del tcp_server.clients[c.name]

3264

2775

c.remove_from_connection()

3265

# Don't signal the disabling

2776

# Don't signal anything except ClientRemoved

3266

2777

c.disable(quiet=True)

3267

# Emit D-Bus signal for removal

3268

self.client_removed_signal(c)

2778

# Emit D-Bus signal

2779

self.ClientRemoved(object_path, c.name)

3269

2780

return

3270

2781

raise KeyError(object_path)

3271

2782

3272

2783

del _interface

3273

3274

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3275

out_signature = "a{oa{sa{sv}}}")

3276

def GetManagedObjects(self):

3277

"""D-Bus method"""

3278

return dbus.Dictionary(

3279

{ client.dbus_object_path:

3280

dbus.Dictionary(

3281

{ interface: client.GetAll(interface)

3282

for interface in

3283

client._get_all_interface_names()})

3284

for client in tcp_server.clients.values()})

3285

3286

def client_added_signal(self, client):

3287

"""Send the new standard signal and the old signal"""

3288

if use_dbus:

3289

# New standard signal

3290

self.InterfacesAdded(

3291

client.dbus_object_path,

3292

dbus.Dictionary(

3293

{ interface: client.GetAll(interface)

3294

for interface in

3295

client._get_all_interface_names()}))

3296

# Old signal

3297

self.ClientAdded(client.dbus_object_path)

3298

3299

def client_removed_signal(self, client):

3300

"""Send the new standard signal and the old signal"""

3301

if use_dbus:

3302

# New standard signal

3303

self.InterfacesRemoved(

3304

client.dbus_object_path,

3305

client._get_all_interface_names())

3306

# Old signal

3307

self.ClientRemoved(client.dbus_object_path,

3308

client.name)

3309

2784

3310

2785

mandos_dbus_service = MandosDBusService()

3311

2786

3324

2799

# removed/edited, old secret will thus be unrecovable.

3325

2800

clients = {}

3326

2801

with PGPEngine() as pgp:

3327

for client in tcp_server.clients.values():

2802

for client in tcp_server.clients.itervalues():

3328

2803

key = client_settings[client.name]["secret"]

3329

2804

client.encrypted_secret = pgp.encrypt(client.secret,

3330

2805

key)

3354

2829

prefix='clients-',

3355

2830

dir=os.path.dirname(stored_state_path),

3356

2831

delete=False) as stored_state:

3357

pickle.dump((clients, client_settings), stored_state,

3358

protocol = 2)

2832

pickle.dump((clients, client_settings), stored_state)

3359

2833

tempname = stored_state.name

3360

2834

os.rename(tempname, stored_state_path)

3361

2835

except (IOError, OSError) as e:

3377

2851

name, client = tcp_server.clients.popitem()

3378

2852

if use_dbus:

3379

2853

client.remove_from_connection()

3380

# Don't signal the disabling

2854

# Don't signal anything except ClientRemoved

3381

2855

client.disable(quiet=True)

3382

# Emit D-Bus signal for removal

3383

2856

if use_dbus:

3384

mandos_dbus_service.client_removed_signal(client)

2857

# Emit D-Bus signal

2858

mandos_dbus_service.ClientRemoved(

2859

client.dbus_object_path, client.name)

3385

2860

client_settings.clear()

3386

2861

3387

2862

atexit.register(cleanup)

3388

2863

3389

for client in tcp_server.clients.values():

2864

for client in tcp_server.clients.itervalues():

3390

2865

if use_dbus:

3391

# Emit D-Bus signal for adding

3392

mandos_dbus_service.client_added_signal(client)

2866

# Emit D-Bus signal

2867

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3393

2868

# Need to initiate checking of clients

3394

2869

if client.enabled:

3395

2870

client.init_checker()

3421

2896

sys.exit(1)

3422

2897

# End of Avahi example code

3423

2898

3424

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2899

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3425

2900

lambda *args, **kwargs:

3426

2901

(tcp_server.handle_request

3427

2902

(*args[2:], **kwargs) or True))