101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
104
116
except (OSError, AttributeError):
105
118
def if_nametoindex(interface):
106
119
"Get an interface index the hard way, i.e. using fcntl()"
107
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
187
200
def encrypt(self, data, password):
188
201
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
191
204
passfile.write(passphrase)
193
206
proc = subprocess.Popen(['gpg', '--symmetric',
205
218
def decrypt(self, data, password):
206
219
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
209
222
passfile.write(passphrase)
211
224
proc = subprocess.Popen(['gpg', '--decrypt',
256
270
bus: dbus.SystemBus()
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
274
interface = avahi.IF_UNSPEC,
282
protocol = avahi.PROTO_UNSPEC,
263
284
self.interface = interface
265
286
self.type = servicetype
361
381
def server_state_changed(self, state, error=None):
362
382
"""Derived from the Avahi example code"""
363
383
logger.debug("Avahi server state change: %i", state)
364
bad_states = { avahi.SERVER_INVALID:
365
"Zeroconf server invalid",
366
avahi.SERVER_REGISTERING: None,
367
avahi.SERVER_COLLISION:
368
"Zeroconf server name collision",
369
avahi.SERVER_FAILURE:
370
"Zeroconf server failure" }
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
371
390
if state in bad_states:
372
391
if bad_states[state] is not None:
373
392
if error is None:
400
419
def rename(self, *args, **kwargs):
401
420
"""Add the new name to the syslog messages"""
402
421
ret = AvahiService.rename(self, *args, **kwargs)
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
456
474
"fingerprint", "host", "interval",
457
475
"last_approval_request", "last_checked_ok",
458
476
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
462
"checker": "fping -q -- %%(host)s",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
479
"extended_timeout": "PT15M",
481
"checker": "fping -q -- %%(host)s",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
471
490
def config_parser(config):
549
568
self.current_checker_command = None
550
569
self.approved = None
551
570
self.approvals_pending = 0
552
self.changedstate = (multiprocessing_manager
553
.Condition(multiprocessing_manager
555
self.client_structure = [attr for attr in
556
self.__dict__.iterkeys()
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
557
575
if not attr.startswith("_")]
558
576
self.client_structure.append("client_structure")
560
for name, t in inspect.getmembers(type(self),
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
564
580
if not name.startswith("_"):
565
581
self.client_structure.append(name)
608
624
# and every interval from then on.
609
625
if self.checker_initiator_tag is not None:
610
626
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
613
.total_seconds() * 1000),
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
615
630
# Schedule a disable() when 'timeout' has passed
616
631
if self.disable_initiator_tag is not None:
617
632
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
620
.total_seconds() * 1000),
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
622
635
# Also start a new checker *right now*.
623
636
self.start_checker()
654
666
gobject.source_remove(self.disable_initiator_tag)
655
667
self.disable_initiator_tag = None
656
668
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
660
671
self.expires = datetime.datetime.utcnow() + timeout
662
673
def need_approval(self):
693
704
# Start a new checker if needed
694
705
if self.checker is None:
695
706
# Escape attributes for the shell
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
700
711
command = self.checker_command % escaped_attrs
701
712
except TypeError as error:
702
713
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
714
self.checker_command,
716
return True # Try again later
705
717
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
719
logger.info("Starting checker %r for %s", command,
709
721
# We don't need to redirect stdout and stderr, since
710
722
# in normal mode, that is already done by daemon(),
711
723
# and in debug mode we don't want to. (Stdin is
720
732
"stderr": wnull })
721
733
self.checker = subprocess.Popen(command,
725
738
except OSError as error:
726
739
logger.error("Failed to start subprocess",
729
self.checker_callback_tag = (gobject.child_watch_add
731
self.checker_callback,
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
733
744
# The checker may have completed before the gobject
734
745
# watch was added. Check for this.
871
891
def _get_all_dbus_things(self, thing):
872
892
"""Returns a generator of (name, attribute) pairs
874
return ((getattr(athing.__get__(self), "_dbus_name",
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
876
895
athing.__get__(self))
877
896
for cls in self.__class__.__mro__
878
897
for name, athing in
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
882
900
def _get_dbus_property(self, interface_name, property_name):
883
901
"""Returns a bound method if one exists which is a D-Bus
884
902
property with the specified name and interface.
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
889
self._is_dbus_thing("property"))):
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
890
907
if (value._dbus_name == property_name
891
908
and value._dbus_interface == interface_name):
892
909
return value.__get__(self)
894
911
# No such property
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
900
917
out_signature="v")
901
918
def Get(self, interface_name, property_name):
902
919
"""Standard D-Bus property Get() method, see D-Bus standard.
948
966
if not hasattr(value, "variant_level"):
949
967
properties[name] = value
951
properties[name] = type(value)(value, variant_level=
952
value.variant_level+1)
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
953
971
return dbus.Dictionary(properties, signature="sv")
955
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
975
993
document = xml.dom.minidom.parseString(xmlstring)
976
995
def make_tag(document, name, prop):
977
996
e = document.createElement("property")
978
997
e.setAttribute("name", name)
979
998
e.setAttribute("type", prop._dbus_signature)
980
999
e.setAttribute("access", prop._dbus_access)
982
1002
for if_tag in document.getElementsByTagName("interface"):
983
1003
# Add property tags
984
1004
for tag in (make_tag(document, name, prop)
1083
1101
# Ignore non-D-Bus attributes, and D-Bus attributes
1084
1102
# with the wrong interface name
1085
1103
if (not hasattr(attribute, "_dbus_interface")
1086
or not attribute._dbus_interface
1087
.startswith(orig_interface_name)):
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1089
1107
# Create an alternate D-Bus interface name based on
1090
1108
# the current name
1091
alt_interface = (attribute._dbus_interface
1092
.replace(orig_interface_name,
1093
alt_interface_name))
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1094
1111
interface_names.add(alt_interface)
1095
1112
# Is this a D-Bus signal?
1096
1113
if getattr(attribute, "_dbus_is_signal", False):
1097
# Extract the original non-method undecorated
1098
# function by black magic
1099
nonmethod_func = (dict(
1114
if sys.version == 2:
1115
# Extract the original non-method undecorated
1116
# function by black magic
1117
nonmethod_func = (dict(
1100
1118
zip(attribute.func_code.co_freevars,
1101
attribute.__closure__))["func"]
1119
attribute.__closure__))
1120
["func"].cell_contents)
1122
nonmethod_func = attribute
1103
1123
# Create a new, but exactly alike, function
1104
1124
# object, and decorate it to be a new D-Bus signal
1105
1125
# with the alternate D-Bus interface name
1106
new_function = (dbus.service.signal
1108
attribute._dbus_signature)
1109
(types.FunctionType(
1110
nonmethod_func.func_code,
1111
nonmethod_func.func_globals,
1112
nonmethod_func.func_name,
1113
nonmethod_func.func_defaults,
1114
nonmethod_func.func_closure)))
1126
if sys.version == 2:
1127
new_function = types.FunctionType(
1128
nonmethod_func.func_code,
1129
nonmethod_func.func_globals,
1130
nonmethod_func.func_name,
1131
nonmethod_func.func_defaults,
1132
nonmethod_func.func_closure)
1134
new_function = types.FunctionType(
1135
nonmethod_func.__code__,
1136
nonmethod_func.__globals__,
1137
nonmethod_func.__name__,
1138
nonmethod_func.__defaults__,
1139
nonmethod_func.__closure__)
1140
new_function = (dbus.service.signal(
1142
attribute._dbus_signature)(new_function))
1115
1143
# Copy annotations, if any
1117
new_function._dbus_annotations = (
1118
dict(attribute._dbus_annotations))
1145
new_function._dbus_annotations = dict(
1146
attribute._dbus_annotations)
1119
1147
except AttributeError:
1121
1149
# Define a creator of a function to call both the
1141
1171
# object. Decorate it to be a new D-Bus method
1142
1172
# with the alternate D-Bus interface name. Add it
1143
1173
# to the class.
1144
attr[attrname] = (dbus.service.method
1146
attribute._dbus_in_signature,
1147
attribute._dbus_out_signature)
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1175
dbus.service.method(
1177
attribute._dbus_in_signature,
1178
attribute._dbus_out_signature)
1179
(types.FunctionType(attribute.func_code,
1180
attribute.func_globals,
1181
attribute.func_name,
1182
attribute.func_defaults,
1183
attribute.func_closure)))
1154
1184
# Copy annotations, if any
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1186
attr[attrname]._dbus_annotations = dict(
1187
attribute._dbus_annotations)
1158
1188
except AttributeError:
1160
1190
# Is this a D-Bus property?
1163
1193
# object, and decorate it to be a new D-Bus
1164
1194
# property with the alternate D-Bus interface
1165
1195
# name. Add it to the class.
1166
attr[attrname] = (dbus_service_property
1168
attribute._dbus_signature,
1169
attribute._dbus_access,
1171
._dbus_get_args_options
1174
(attribute.func_code,
1175
attribute.func_globals,
1176
attribute.func_name,
1177
attribute.func_defaults,
1178
attribute.func_closure)))
1196
attr[attrname] = (dbus_service_property(
1197
alt_interface, attribute._dbus_signature,
1198
attribute._dbus_access,
1199
attribute._dbus_get_args_options
1201
(types.FunctionType(
1202
attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1179
1207
# Copy annotations, if any
1181
attr[attrname]._dbus_annotations = (
1182
dict(attribute._dbus_annotations))
1209
attr[attrname]._dbus_annotations = dict(
1210
attribute._dbus_annotations)
1183
1211
except AttributeError:
1185
1213
# Is this a D-Bus interface?
1188
1216
# object. Decorate it to be a new D-Bus interface
1189
1217
# with the alternate D-Bus interface name. Add it
1190
1218
# to the class.
1191
attr[attrname] = (dbus_interface_annotations
1194
(attribute.func_code,
1195
attribute.func_globals,
1196
attribute.func_name,
1197
attribute.func_defaults,
1198
attribute.func_closure)))
1220
dbus_interface_annotations(alt_interface)
1221
(types.FunctionType(attribute.func_code,
1222
attribute.func_globals,
1223
attribute.func_name,
1224
attribute.func_defaults,
1225
attribute.func_closure)))
1200
1227
# Deprecate all alternate interfaces
1201
1228
iname="_AlternateDBusNames_interface_annotation{}"
1202
1229
for interface_name in interface_names:
1203
1231
@dbus_interface_annotations(interface_name)
1204
1232
def func(self):
1205
1233
return { "org.freedesktop.DBus.Deprecated":
1207
1235
# Find an unused name
1208
1236
for aname in (iname.format(i)
1209
1237
for i in itertools.count()):
1244
1273
client_object_name = str(self.name).translate(
1245
1274
{ord("."): ord("_"),
1246
1275
ord("-"): ord("_")})
1247
self.dbus_object_path = (dbus.ObjectPath
1248
("/clients/" + client_object_name))
1276
self.dbus_object_path = dbus.ObjectPath(
1277
"/clients/" + client_object_name)
1249
1278
DBusObjectWithProperties.__init__(self, self.bus,
1250
1279
self.dbus_object_path)
1252
def notifychangeproperty(transform_func,
1253
dbus_name, type_func=lambda x: x,
1254
variant_level=1, invalidate_only=False,
1281
def notifychangeproperty(transform_func, dbus_name,
1282
type_func=lambda x: x,
1284
invalidate_only=False,
1255
1285
_interface=_interface):
1256
1286
""" Modify a variable so that it's a property which announces
1257
1287
its changes to DBus.
1264
1294
variant_level: D-Bus variant level. Default: 1
1266
1296
attrname = "_{}".format(dbus_name)
1267
1298
def setter(self, value):
1268
1299
if hasattr(self, "dbus_object_path"):
1269
1300
if (not hasattr(self, attrname) or
1270
1301
type_func(getattr(self, attrname, None))
1271
1302
!= type_func(value)):
1272
1303
if invalidate_only:
1273
self.PropertiesChanged(_interface,
1304
self.PropertiesChanged(
1305
_interface, dbus.Dictionary(),
1306
dbus.Array((dbus_name, )))
1278
dbus_value = transform_func(type_func(value),
1308
dbus_value = transform_func(
1310
variant_level = variant_level)
1281
1311
self.PropertyChanged(dbus.String(dbus_name),
1283
self.PropertiesChanged(_interface,
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1313
self.PropertiesChanged(
1315
dbus.Dictionary({ dbus.String(dbus_name):
1287
1318
setattr(self, attrname, value)
1289
1320
return property(lambda self: getattr(self, attrname), setter)
1295
1326
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1296
1327
last_enabled = notifychangeproperty(datetime_to_dbus,
1298
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
type_func = lambda checker:
1300
checker is not None)
1329
checker = notifychangeproperty(
1330
dbus.Boolean, "CheckerRunning",
1331
type_func = lambda checker: checker is not None)
1301
1332
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1302
1333
"LastCheckedOK")
1303
1334
last_checker_status = notifychangeproperty(dbus.Int16,
1306
1337
datetime_to_dbus, "LastApprovalRequest")
1307
1338
approved_by_default = notifychangeproperty(dbus.Boolean,
1308
1339
"ApprovedByDefault")
1309
approval_delay = notifychangeproperty(dbus.UInt64,
1312
lambda td: td.total_seconds()
1340
approval_delay = notifychangeproperty(
1341
dbus.UInt64, "ApprovalDelay",
1342
type_func = lambda td: td.total_seconds() * 1000)
1314
1343
approval_duration = notifychangeproperty(
1315
1344
dbus.UInt64, "ApprovalDuration",
1316
1345
type_func = lambda td: td.total_seconds() * 1000)
1317
1346
host = notifychangeproperty(dbus.String, "Host")
1318
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1319
type_func = lambda td:
1320
td.total_seconds() * 1000)
1347
timeout = notifychangeproperty(
1348
dbus.UInt64, "Timeout",
1349
type_func = lambda td: td.total_seconds() * 1000)
1321
1350
extended_timeout = notifychangeproperty(
1322
1351
dbus.UInt64, "ExtendedTimeout",
1323
1352
type_func = lambda td: td.total_seconds() * 1000)
1324
interval = notifychangeproperty(dbus.UInt64,
1327
lambda td: td.total_seconds()
1353
interval = notifychangeproperty(
1354
dbus.UInt64, "Interval",
1355
type_func = lambda td: td.total_seconds() * 1000)
1329
1356
checker_command = notifychangeproperty(dbus.String, "Checker")
1330
1357
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1331
1358
invalidate_only=True)
1486
1515
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1488
1517
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1518
@dbus_service_property(_interface,
1490
1520
access="readwrite")
1491
1521
def ApprovalDuration_dbus_property(self, value=None):
1492
1522
if value is None: # get
1580
1613
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
int((self.expires - now).total_seconds()
1584
* 1000), self.disable))
1614
self.disable_initiator_tag = gobject.timeout_add(
1615
int((self.expires - now).total_seconds() * 1000),
1586
1618
# ExtendedTimeout - property
1587
@dbus_service_property(_interface, signature="t",
1619
@dbus_service_property(_interface,
1588
1621
access="readwrite")
1589
1622
def ExtendedTimeout_dbus_property(self, value=None):
1590
1623
if value is None: # get
1604
1638
if self.enabled:
1605
1639
# Reschedule checker run
1606
1640
gobject.source_remove(self.checker_initiator_tag)
1607
self.checker_initiator_tag = (gobject.timeout_add
1608
(value, self.start_checker))
1609
self.start_checker() # Start one now, too
1641
self.checker_initiator_tag = gobject.timeout_add(
1642
value, self.start_checker)
1643
self.start_checker() # Start one now, too
1611
1645
# Checker - property
1612
@dbus_service_property(_interface, signature="s",
1646
@dbus_service_property(_interface,
1613
1648
access="readwrite")
1614
1649
def Checker_dbus_property(self, value=None):
1615
1650
if value is None: # get
1633
1669
return self.dbus_object_path # is already a dbus.ObjectPath
1635
1671
# Secret = property
1636
@dbus_service_property(_interface, signature="ay",
1637
access="write", byte_arrays=True)
1672
@dbus_service_property(_interface,
1638
1676
def Secret_dbus_property(self, value):
1639
1677
self.secret = bytes(value)
1680
1720
logger.debug("Pipe FD: %d",
1681
1721
self.server.child_pipe.fileno())
1683
session = (gnutls.connection
1684
.ClientSession(self.request,
1686
.X509Credentials()))
1723
session = gnutls.connection.ClientSession(
1724
self.request, gnutls.connection .X509Credentials())
1688
1726
# Note: gnutls.connection.X509Credentials is really a
1689
1727
# generic GnuTLS certificate credentials object so long as
1826
1863
def peer_certificate(session):
1827
1864
"Return the peer's OpenPGP certificate as a bytestring"
1828
1865
# If not an OpenPGP certificate...
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
1866
if (gnutls.library.functions.gnutls_certificate_type_get(
1831
1868
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
1869
# ...do the normal thing
1833
1870
return session.peer_certificate
1847
1884
def fingerprint(openpgp):
1848
1885
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
1886
# New GnuTLS "datum" with the OpenPGP public key
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1854
ctypes.c_uint(len(openpgp))))
1887
datum = gnutls.library.types.gnutls_datum_t(
1888
ctypes.cast(ctypes.c_char_p(openpgp),
1889
ctypes.POINTER(ctypes.c_ubyte)),
1890
ctypes.c_uint(len(openpgp)))
1855
1891
# New empty GnuTLS certificate
1856
1892
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1893
gnutls.library.functions.gnutls_openpgp_crt_init(
1859
1895
# Import the OpenPGP public key into the certificate
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
1896
gnutls.library.functions.gnutls_openpgp_crt_import(
1897
crt, ctypes.byref(datum),
1898
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1864
1899
# Verify the self signature in the key
1865
1900
crtverify = ctypes.c_uint()
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
1901
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1902
crt, 0, ctypes.byref(crtverify))
1869
1903
if crtverify.value != 0:
1870
1904
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
1905
raise gnutls.errors.CertificateSecurityError(
1873
1907
# New buffer for the fingerprint
1874
1908
buf = ctypes.create_string_buffer(20)
1875
1909
buf_len = ctypes.c_size_t()
1876
1910
# Get the fingerprint from the certificate into the buffer
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
1911
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1912
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1880
1913
# Deinit the certificate
1881
1914
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1882
1915
# Convert the buffer to a Python bytestring
1931
1966
interface: None or a network interface name (string)
1932
1967
use_ipv6: Boolean; to use IPv6 or not
1934
1970
def __init__(self, server_address, RequestHandlerClass,
1935
interface=None, use_ipv6=True, socketfd=None):
1936
1974
"""If socketfd is set, use that file descriptor instead of
1937
1975
creating a new one with socket.socket().
2051
2093
def add_pipe(self, parent_pipe, proc):
2052
2094
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2095
gobject.io_add_watch(
2096
parent_pipe.fileno(),
2097
gobject.IO_IN | gobject.IO_HUP,
2098
functools.partial(self.handle_ipc,
2099
parent_pipe = parent_pipe,
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2102
def handle_ipc(self, source, condition,
2105
client_object=None):
2062
2106
# error, or the other end of multiprocessing.Pipe has closed
2063
2107
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2064
2108
# Wait for other process to exit
2087
2131
parent_pipe.send(False)
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2134
gobject.io_add_watch(
2135
parent_pipe.fileno(),
2136
gobject.IO_IN | gobject.IO_HUP,
2137
functools.partial(self.handle_ipc,
2138
parent_pipe = parent_pipe,
2140
client_object = client))
2098
2141
parent_pipe.send(True)
2099
2142
# remove the old hook in favor of the new above hook on
2107
2150
parent_pipe.send(('data', getattr(client_object,
2108
2151
funcname)(*args,
2111
2154
if command == 'getattr':
2112
2155
attrname = request[1]
2113
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2156
if isinstance(client_object.__getattribute__(attrname),
2157
collections.Callable):
2158
parent_pipe.send(('function', ))
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2161
'data', client_object.__getattribute__(attrname)))
2119
2163
if command == 'setattr':
2120
2164
attrname = request[1]
2151
2195
# avoid excessive use of external libraries.
2153
2197
# New type for defining tokens, syntax, and semantics all-in-one
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2159
"value", # datetime.timedelta or
2161
"followers")) # Tokens valid after
2198
Token = collections.namedtuple("Token", (
2199
"regexp", # To match token; if "value" is not None, must have
2200
# a "group" containing digits
2201
"value", # datetime.timedelta or None
2202
"followers")) # Tokens valid after this token
2163
2203
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2204
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2205
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2206
token_second = Token(re.compile(r"(\d+)S"),
2167
2207
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2208
frozenset((token_end, )))
2169
2209
token_minute = Token(re.compile(r"(\d+)M"),
2170
2210
datetime.timedelta(minutes=1),
2171
2211
frozenset((token_second, token_end)))
2187
2227
frozenset((token_month, token_end)))
2188
2228
token_week = Token(re.compile(r"(\d+)W"),
2189
2229
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2230
frozenset((token_end, )))
2191
2231
token_duration = Token(re.compile(r"P"), None,
2192
2232
frozenset((token_year, token_month,
2193
2233
token_day, token_time,
2284
2324
# Close all standard open file descriptors
2285
2325
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2326
if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
raise OSError(errno.ENODEV, "{} not a character device"
2327
raise OSError(errno.ENODEV,
2328
"{} not a character device"
2288
2329
.format(os.devnull))
2289
2330
os.dup2(null, sys.stdin.fileno())
2290
2331
os.dup2(null, sys.stdout.fileno())
2366
2408
"statedir": "/var/lib/mandos",
2367
2409
"foreground": "False",
2368
2410
"zeroconf": "True",
2371
2413
# Parse config file for server-global settings
2372
2414
server_config = configparser.SafeConfigParser(server_defaults)
2373
2415
del server_defaults
2374
server_config.read(os.path.join(options.configdir,
2416
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2376
2417
# Convert the SafeConfigParser object to a dict
2377
2418
server_settings = server_config.defaults()
2378
2419
# Use the appropriate methods on the non-string config options
2396
2437
# Override the settings from the config file with command line
2397
2438
# options, if set.
2398
2439
for option in ("interface", "address", "port", "debug",
2399
"priority", "servicename", "configdir",
2400
"use_dbus", "use_ipv6", "debuglevel", "restore",
2401
"statedir", "socket", "foreground", "zeroconf"):
2440
"priority", "servicename", "configdir", "use_dbus",
2441
"use_ipv6", "debuglevel", "restore", "statedir",
2442
"socket", "foreground", "zeroconf"):
2402
2443
value = getattr(options, option)
2403
2444
if value is not None:
2404
2445
server_settings[option] = value
2420
2461
##################################################################
2422
if (not server_settings["zeroconf"] and
2423
not (server_settings["port"]
2424
or server_settings["socket"] != "")):
2425
parser.error("Needs port or socket to work without"
2463
if (not server_settings["zeroconf"]
2464
and not (server_settings["port"]
2465
or server_settings["socket"] != "")):
2466
parser.error("Needs port or socket to work without Zeroconf")
2428
2468
# For convenience
2429
2469
debug = server_settings["debug"]
2445
2485
initlogger(debug, level)
2447
2487
if server_settings["servicename"] != "Mandos":
2448
syslogger.setFormatter(logging.Formatter
2449
('Mandos ({}) [%(process)d]:'
2450
' %(levelname)s: %(message)s'
2451
.format(server_settings
2488
syslogger.setFormatter(
2489
logging.Formatter('Mandos ({}) [%(process)d]:'
2490
' %(levelname)s: %(message)s'.format(
2491
server_settings["servicename"])))
2454
2493
# Parse config file with clients
2455
2494
client_config = configparser.SafeConfigParser(Client
2463
2502
socketfd = None
2464
2503
if server_settings["socket"] != "":
2465
2504
socketfd = server_settings["socket"]
2466
tcp_server = MandosServer((server_settings["address"],
2467
server_settings["port"]),
2469
interface=(server_settings["interface"]
2473
server_settings["priority"],
2505
tcp_server = MandosServer(
2506
(server_settings["address"], server_settings["port"]),
2508
interface=(server_settings["interface"] or None),
2510
gnutls_priority=server_settings["priority"],
2476
2513
if not foreground:
2477
2514
pidfilename = "/run/mandos.pid"
2478
2515
if not os.path.isdir("/run/."):
2479
2516
pidfilename = "/var/run/mandos.pid"
2482
pidfile = open(pidfilename, "w")
2519
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2483
2520
except IOError as e:
2484
2521
logger.error("Could not open file %r", pidfilename,
2512
2549
def debug_gnutls(level, string):
2513
2550
logger.debug("GnuTLS: %s", string[:-1])
2515
(gnutls.library.functions
2516
.gnutls_global_set_log_function(debug_gnutls))
2552
gnutls.library.functions.gnutls_global_set_log_function(
2518
2555
# Redirect stdin so all checkers get /dev/null
2519
2556
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2541
2578
bus_name = dbus.service.BusName("se.recompile.Mandos",
2542
bus, do_not_queue=True)
2543
old_bus_name = (dbus.service.BusName
2544
("se.bsnet.fukt.Mandos", bus,
2546
except dbus.exceptions.NameExistsException as e:
2581
old_bus_name = dbus.service.BusName(
2582
"se.bsnet.fukt.Mandos", bus,
2584
except dbus.exceptions.DBusException as e:
2547
2585
logger.error("Disabling D-Bus:", exc_info=e)
2548
2586
use_dbus = False
2549
2587
server_settings["use_dbus"] = False
2550
2588
tcp_server.use_dbus = False
2552
2590
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2553
service = AvahiServiceToSyslog(name =
2554
server_settings["servicename"],
2555
servicetype = "_mandos._tcp",
2556
protocol = protocol, bus = bus)
2591
service = AvahiServiceToSyslog(
2592
name = server_settings["servicename"],
2593
servicetype = "_mandos._tcp",
2594
protocol = protocol,
2557
2596
if server_settings["interface"]:
2558
service.interface = (if_nametoindex
2559
(server_settings["interface"]
2597
service.interface = if_nametoindex(
2598
server_settings["interface"].encode("utf-8"))
2562
2600
global multiprocessing_manager
2563
2601
multiprocessing_manager = multiprocessing.Manager()
2582
2620
if server_settings["restore"]:
2584
2622
with open(stored_state_path, "rb") as stored_state:
2585
clients_data, old_client_settings = (pickle.load
2623
clients_data, old_client_settings = pickle.load(
2587
2625
os.remove(stored_state_path)
2588
2626
except IOError as e:
2589
2627
if e.errno == errno.ENOENT:
2590
logger.warning("Could not load persistent state: {}"
2591
.format(os.strerror(e.errno)))
2628
logger.warning("Could not load persistent state:"
2629
" {}".format(os.strerror(e.errno)))
2593
2631
logger.critical("Could not load persistent state:",
2596
2634
except EOFError as e:
2597
2635
logger.warning("Could not load persistent state: "
2598
"EOFError:", exc_info=e)
2600
2639
with PGPEngine() as pgp:
2601
2640
for client_name, client in clients_data.items():
2630
2669
if not client["last_checked_ok"]:
2631
2670
logger.warning(
2632
2671
"disabling client {} - Client never "
2633
"performed a successful checker"
2634
.format(client_name))
2672
"performed a successful checker".format(
2635
2674
client["enabled"] = False
2636
2675
elif client["last_checker_status"] != 0:
2637
2676
logger.warning(
2638
2677
"disabling client {} - Client last"
2639
" checker failed with error code {}"
2640
.format(client_name,
2641
client["last_checker_status"]))
2678
" checker failed with error code"
2681
client["last_checker_status"]))
2642
2682
client["enabled"] = False
2644
client["expires"] = (datetime.datetime
2646
+ client["timeout"])
2684
client["expires"] = (
2685
datetime.datetime.utcnow()
2686
+ client["timeout"])
2647
2687
logger.debug("Last checker succeeded,"
2648
" keeping {} enabled"
2649
.format(client_name))
2688
" keeping {} enabled".format(
2651
client["secret"] = (
2652
pgp.decrypt(client["encrypted_secret"],
2653
client_settings[client_name]
2691
client["secret"] = pgp.decrypt(
2692
client["encrypted_secret"],
2693
client_settings[client_name]["secret"])
2655
2694
except PGPError:
2656
2695
# If decryption fails, we use secret from new settings
2657
logger.debug("Failed to decrypt {} old secret"
2658
.format(client_name))
2659
client["secret"] = (
2660
client_settings[client_name]["secret"])
2696
logger.debug("Failed to decrypt {} old secret".format(
2698
client["secret"] = (client_settings[client_name]
2662
2701
# Add/remove clients based on new changes made to config
2663
2702
for client_name in (set(old_client_settings)
2692
2732
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2695
@alternate_dbus_interfaces({"se.recompile.Mandos":
2696
"se.bsnet.fukt.Mandos"})
2736
@alternate_dbus_interfaces(
2737
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2697
2738
class MandosDBusService(DBusObjectWithProperties):
2698
2739
"""A D-Bus proxy object"""
2699
2741
def __init__(self):
2700
2742
dbus.service.Object.__init__(self, bus, "/")
2701
2744
_interface = "se.recompile.Mandos"
2703
2746
@dbus_interface_annotations(_interface)
2704
2747
def _foo(self):
2705
return { "org.freedesktop.DBus.Property"
2706
".EmitsChangedSignal":
2749
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2709
2752
@dbus.service.signal(_interface, signature="o")
2710
2753
def ClientAdded(self, objpath):
2794
2836
del client_settings[client.name]["secret"]
2797
with (tempfile.NamedTemporaryFile
2798
(mode='wb', suffix=".pickle", prefix='clients-',
2799
dir=os.path.dirname(stored_state_path),
2800
delete=False)) as stored_state:
2839
with tempfile.NamedTemporaryFile(
2843
dir=os.path.dirname(stored_state_path),
2844
delete=False) as stored_state:
2801
2845
pickle.dump((clients, client_settings), stored_state)
2802
tempname=stored_state.name
2846
tempname = stored_state.name
2803
2847
os.rename(tempname, stored_state_path)
2804
2848
except (IOError, OSError) as e: