/mandos/trunk : revision 777

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

39

try:

43

40

import SocketServer as socketserver

47

44

import argparse

48

45

import datetime

49

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

50

53

try:

51

54

import ConfigParser as configparser

52

55

except ImportError:

79

82

80

83

import dbus

81

84

import dbus.service

82

from gi.repository import GLib

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

89

import avahi

83

90

from dbus.mainloop.glib import DBusGMainLoop

84

91

import ctypes

85

92

import ctypes.util

97

104

if sys.version_info.major == 2:

98

105

str = unicode

99

106

100

version = "1.7.7"

107

version = "1.6.9"

101

108

stored_state_file = "clients.pickle"

102

109

103

110

logger = logging.getLogger()

118

125

return interface_index

119

126

120

127

121

def copy_function(func):

122

"""Make a copy of a function"""

123

if sys.version_info.major == 2:

124

return types.FunctionType(func.func_code,

125

func.func_globals,

126

func.func_name,

127

func.func_defaults,

128

func.func_closure)

129

else:

130

return types.FunctionType(func.__code__,

131

func.__globals__,

132

func.__name__,

133

func.__defaults__,

134

func.__closure__)

135

136

137

128

def initlogger(debug, level=logging.WARNING):

138

129

"""init logger and add loglevel"""

139

130

166

157

167

158

def __init__(self):

168

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

169

self.gpg = "gpg"

170

try:

171

output = subprocess.check_output(["gpgconf"])

172

for line in output.splitlines():

173

name, text, path = line.split(b":")

174

if name == "gpg":

175

self.gpg = path

176

break

177

except OSError as e:

178

if e.errno != errno.ENOENT:

179

raise

180

160

self.gnupgargs = ['--batch',

181

'--homedir', self.tempdir,

161

'--home', self.tempdir,

182

162

'--force-mdc',

183

'--quiet']

184

# Only GPG version 1 has the --no-use-agent option.

185

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

186

self.gnupgargs.append("--no-use-agent")

163

'--quiet',

164

'--no-use-agent']

187

165

188

166

def __enter__(self):

189

167

return self

225

203

dir=self.tempdir) as passfile:

226

204

passfile.write(passphrase)

227

205

passfile.flush()

228

proc = subprocess.Popen([self.gpg, '--symmetric',

206

proc = subprocess.Popen(['gpg', '--symmetric',

229

207

'--passphrase-file',

230

208

passfile.name]

231

209

+ self.gnupgargs,

243

221

dir = self.tempdir) as passfile:

244

222

passfile.write(passphrase)

245

223

passfile.flush()

246

proc = subprocess.Popen([self.gpg, '--decrypt',

224

proc = subprocess.Popen(['gpg', '--decrypt',

247

225

'--passphrase-file',

248

226

passfile.name]

249

227

+ self.gnupgargs,

255

233

raise PGPError(err)

256

234

return decrypted_plaintext

257

235

258

# Pretend that we have an Avahi module

259

class Avahi(object):

260

"""This isn't so much a class as it is a module-like namespace.

261

It is instantiated once, and simulates having an Avahi module."""

262

IF_UNSPEC = -1 # avahi-common/address.h

263

PROTO_UNSPEC = -1 # avahi-common/address.h

264

PROTO_INET = 0 # avahi-common/address.h

265

PROTO_INET6 = 1 # avahi-common/address.h

266

DBUS_NAME = "org.freedesktop.Avahi"

267

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

268

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

269

DBUS_PATH_SERVER = "/"

270

def string_array_to_txt_array(self, t):

271

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

272

for s in t), signature="ay")

273

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

274

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

275

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

276

SERVER_INVALID = 0 # avahi-common/defs.h

277

SERVER_REGISTERING = 1 # avahi-common/defs.h

278

SERVER_RUNNING = 2 # avahi-common/defs.h

279

SERVER_COLLISION = 3 # avahi-common/defs.h

280

SERVER_FAILURE = 4 # avahi-common/defs.h

281

avahi = Avahi()

282

236

283

237

class AvahiError(Exception):

284

238

def __init__(self, value, *args, **kwargs):

481

435

.format(self.name)))

482

436

return ret

483

437

484

# Pretend that we have a GnuTLS module

485

class GnuTLS(object):

486

"""This isn't so much a class as it is a module-like namespace.

487

It is instantiated once, and simulates having a GnuTLS module."""

488

489

_library = ctypes.cdll.LoadLibrary(

490

ctypes.util.find_library("gnutls"))

491

_need_version = b"3.3.0"

492

def __init__(self):

493

# Need to use class name "GnuTLS" here, since this method is

494

# called before the assignment to the "gnutls" global variable

495

# happens.

496

if GnuTLS.check_version(self._need_version) is None:

497

raise GnuTLS.Error("Needs GnuTLS {} or later"

498

.format(self._need_version))

499

500

# Unless otherwise indicated, the constants and types below are

501

# all from the gnutls/gnutls.h C header file.

502

503

# Constants

504

E_SUCCESS = 0

505

E_INTERRUPTED = -52

506

E_AGAIN = -28

507

CRT_OPENPGP = 2

508

CLIENT = 2

509

SHUT_RDWR = 0

510

CRD_CERTIFICATE = 1

511

E_NO_CERTIFICATE_FOUND = -49

512

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

513

514

# Types

515

class session_int(ctypes.Structure):

516

_fields_ = []

517

session_t = ctypes.POINTER(session_int)

518

class certificate_credentials_st(ctypes.Structure):

519

_fields_ = []

520

certificate_credentials_t = ctypes.POINTER(

521

certificate_credentials_st)

522

certificate_type_t = ctypes.c_int

523

class datum_t(ctypes.Structure):

524

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

525

('size', ctypes.c_uint)]

526

class openpgp_crt_int(ctypes.Structure):

527

_fields_ = []

528

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

529

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

530

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

531

credentials_type_t = ctypes.c_int

532

transport_ptr_t = ctypes.c_void_p

533

close_request_t = ctypes.c_int

534

535

# Exceptions

536

class Error(Exception):

537

# We need to use the class name "GnuTLS" here, since this

538

# exception might be raised from within GnuTLS.__init__,

539

# which is called before the assignment to the "gnutls"

540

# global variable has happened.

541

def __init__(self, message = None, code = None, args=()):

542

# Default usage is by a message string, but if a return

543

# code is passed, convert it to a string with

544

# gnutls.strerror()

545

self.code = code

546

if message is None and code is not None:

547

message = GnuTLS.strerror(code)

548

return super(GnuTLS.Error, self).__init__(

549

message, *args)

550

551

class CertificateSecurityError(Error):

552

pass

553

554

# Classes

555

class Credentials(object):

556

def __init__(self):

557

self._c_object = gnutls.certificate_credentials_t()

558

gnutls.certificate_allocate_credentials(

559

ctypes.byref(self._c_object))

560

self.type = gnutls.CRD_CERTIFICATE

561

562

def __del__(self):

563

gnutls.certificate_free_credentials(self._c_object)

564

565

class ClientSession(object):

566

def __init__(self, socket, credentials = None):

567

self._c_object = gnutls.session_t()

568

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

569

gnutls.set_default_priority(self._c_object)

570

gnutls.transport_set_ptr(self._c_object, socket.fileno())

571

gnutls.handshake_set_private_extensions(self._c_object,

572

True)

573

self.socket = socket

574

if credentials is None:

575

credentials = gnutls.Credentials()

576

gnutls.credentials_set(self._c_object, credentials.type,

577

ctypes.cast(credentials._c_object,

578

ctypes.c_void_p))

579

self.credentials = credentials

580

581

def __del__(self):

582

gnutls.deinit(self._c_object)

583

584

def handshake(self):

585

return gnutls.handshake(self._c_object)

586

587

def send(self, data):

588

data = bytes(data)

589

data_len = len(data)

590

while data_len > 0:

591

data_len -= gnutls.record_send(self._c_object,

592

data[-data_len:],

593

data_len)

594

595

def bye(self):

596

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

597

598

# Error handling functions

599

def _error_code(result):

600

"""A function to raise exceptions on errors, suitable

601

for the 'restype' attribute on ctypes functions"""

602

if result >= 0:

603

return result

604

if result == gnutls.E_NO_CERTIFICATE_FOUND:

605

raise gnutls.CertificateSecurityError(code = result)

606

raise gnutls.Error(code = result)

607

608

def _retry_on_error(result, func, arguments):

609

"""A function to retry on some errors, suitable

610

for the 'errcheck' attribute on ctypes functions"""

611

while result < 0:

612

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

613

return _error_code(result)

614

result = func(*arguments)

615

return result

616

617

# Unless otherwise indicated, the function declarations below are

618

# all from the gnutls/gnutls.h C header file.

619

620

# Functions

621

priority_set_direct = _library.gnutls_priority_set_direct

622

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

623

ctypes.POINTER(ctypes.c_char_p)]

624

priority_set_direct.restype = _error_code

625

626

init = _library.gnutls_init

627

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

628

init.restype = _error_code

629

630

set_default_priority = _library.gnutls_set_default_priority

631

set_default_priority.argtypes = [session_t]

632

set_default_priority.restype = _error_code

633

634

record_send = _library.gnutls_record_send

635

record_send.argtypes = [session_t, ctypes.c_void_p,

636

ctypes.c_size_t]

637

record_send.restype = ctypes.c_ssize_t

638

record_send.errcheck = _retry_on_error

639

640

certificate_allocate_credentials = (

641

_library.gnutls_certificate_allocate_credentials)

642

certificate_allocate_credentials.argtypes = [

643

ctypes.POINTER(certificate_credentials_t)]

644

certificate_allocate_credentials.restype = _error_code

645

646

certificate_free_credentials = (

647

_library.gnutls_certificate_free_credentials)

648

certificate_free_credentials.argtypes = [certificate_credentials_t]

649

certificate_free_credentials.restype = None

650

651

handshake_set_private_extensions = (

652

_library.gnutls_handshake_set_private_extensions)

653

handshake_set_private_extensions.argtypes = [session_t,

654

ctypes.c_int]

655

handshake_set_private_extensions.restype = None

656

657

credentials_set = _library.gnutls_credentials_set

658

credentials_set.argtypes = [session_t, credentials_type_t,

659

ctypes.c_void_p]

660

credentials_set.restype = _error_code

661

662

strerror = _library.gnutls_strerror

663

strerror.argtypes = [ctypes.c_int]

664

strerror.restype = ctypes.c_char_p

665

666

certificate_type_get = _library.gnutls_certificate_type_get

667

certificate_type_get.argtypes = [session_t]

668

certificate_type_get.restype = _error_code

669

670

certificate_get_peers = _library.gnutls_certificate_get_peers

671

certificate_get_peers.argtypes = [session_t,

672

ctypes.POINTER(ctypes.c_uint)]

673

certificate_get_peers.restype = ctypes.POINTER(datum_t)

674

675

global_set_log_level = _library.gnutls_global_set_log_level

676

global_set_log_level.argtypes = [ctypes.c_int]

677

global_set_log_level.restype = None

678

679

global_set_log_function = _library.gnutls_global_set_log_function

680

global_set_log_function.argtypes = [log_func]

681

global_set_log_function.restype = None

682

683

deinit = _library.gnutls_deinit

684

deinit.argtypes = [session_t]

685

deinit.restype = None

686

687

handshake = _library.gnutls_handshake

688

handshake.argtypes = [session_t]

689

handshake.restype = _error_code

690

handshake.errcheck = _retry_on_error

691

692

transport_set_ptr = _library.gnutls_transport_set_ptr

693

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

694

transport_set_ptr.restype = None

695

696

bye = _library.gnutls_bye

697

bye.argtypes = [session_t, close_request_t]

698

bye.restype = _error_code

699

bye.errcheck = _retry_on_error

700

701

check_version = _library.gnutls_check_version

702

check_version.argtypes = [ctypes.c_char_p]

703

check_version.restype = ctypes.c_char_p

704

705

# All the function declarations below are from gnutls/openpgp.h

706

707

openpgp_crt_init = _library.gnutls_openpgp_crt_init

708

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

709

openpgp_crt_init.restype = _error_code

710

711

openpgp_crt_import = _library.gnutls_openpgp_crt_import

712

openpgp_crt_import.argtypes = [openpgp_crt_t,

713

ctypes.POINTER(datum_t),

714

openpgp_crt_fmt_t]

715

openpgp_crt_import.restype = _error_code

716

717

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

718

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

719

ctypes.POINTER(ctypes.c_uint)]

720

openpgp_crt_verify_self.restype = _error_code

721

722

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

723

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

724

openpgp_crt_deinit.restype = None

725

726

openpgp_crt_get_fingerprint = (

727

_library.gnutls_openpgp_crt_get_fingerprint)

728

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

729

ctypes.c_void_p,

730

ctypes.POINTER(

731

ctypes.c_size_t)]

732

openpgp_crt_get_fingerprint.restype = _error_code

733

734

# Remove non-public functions

735

del _error_code, _retry_on_error

736

# Create the global "gnutls" object, simulating a module

737

gnutls = GnuTLS()

738

739

438

def call_pipe(connection, # : multiprocessing.Connection

740

439

func, *args, **kwargs):

741

440

"""This function is meant to be called by multiprocessing.Process

756

455

checker: subprocess.Popen(); a running checker process used

757

456

to see if the client lives.

758

457

'None' if no process is running.

759

checker_callback_tag: a GLib event source tag, or None

458

checker_callback_tag: a gobject event source tag, or None

760

459

checker_command: string; External command which is run to check

761

460

if client lives. %() expansions are done at

762

461

runtime with vars(self) as dict, so that for

763

462

instance %(name)s can be used in the command.

764

checker_initiator_tag: a GLib event source tag, or None

463

checker_initiator_tag: a gobject event source tag, or None

765

464

created: datetime.datetime(); (UTC) object creation

766

465

client_structure: Object describing what attributes a client has

767

466

and is used for storing the client at exit

768

467

current_checker_command: string; current running checker_command

769

disable_initiator_tag: a GLib event source tag, or None

468

disable_initiator_tag: a gobject event source tag, or None

770

469

enabled: bool()

771

470

fingerprint: string (40 or 32 hexadecimal digits); used to

772

471

uniquely identify the client

835

534

client["fingerprint"] = (section["fingerprint"].upper()

836

535

.replace(" ", ""))

837

536

if "secret" in section:

838

client["secret"] = codecs.decode(section["secret"]

839

.encode("utf-8"),

840

"base64")

537

client["secret"] = section["secret"].decode("base64")

841

538

elif "secfile" in section:

842

539

with open(os.path.expanduser(os.path.expandvars

843

540

(section["secfile"])),

896

593

self.changedstate = multiprocessing_manager.Condition(

897

594

multiprocessing_manager.Lock())

898

595

self.client_structure = [attr

899

for attr in self.__dict__.keys()

596

for attr in self.__dict__.iterkeys()

900

597

if not attr.startswith("_")]

901

598

self.client_structure.append("client_structure")

902

599

928

625

if not quiet:

929

626

logger.info("Disabling client %s", self.name)

930

627

if getattr(self, "disable_initiator_tag", None) is not None:

931

GLib.source_remove(self.disable_initiator_tag)

628

gobject.source_remove(self.disable_initiator_tag)

932

629

self.disable_initiator_tag = None

933

630

self.expires = None

934

631

if getattr(self, "checker_initiator_tag", None) is not None:

935

GLib.source_remove(self.checker_initiator_tag)

632

gobject.source_remove(self.checker_initiator_tag)

936

633

self.checker_initiator_tag = None

937

634

self.stop_checker()

938

635

self.enabled = False

939

636

if not quiet:

940

637

self.send_changedstate()

941

# Do not run this again if called by a GLib.timeout_add

638

# Do not run this again if called by a gobject.timeout_add

942

639

return False

943

640

944

641

def __del__(self):

948

645

# Schedule a new checker to be started an 'interval' from now,

949

646

# and every interval from then on.

950

647

if self.checker_initiator_tag is not None:

951

GLib.source_remove(self.checker_initiator_tag)

952

self.checker_initiator_tag = GLib.timeout_add(

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

953

650

int(self.interval.total_seconds() * 1000),

954

651

self.start_checker)

955

652

# Schedule a disable() when 'timeout' has passed

956

653

if self.disable_initiator_tag is not None:

957

GLib.source_remove(self.disable_initiator_tag)

958

self.disable_initiator_tag = GLib.timeout_add(

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

959

656

int(self.timeout.total_seconds() * 1000), self.disable)

960

657

# Also start a new checker *right now*.

961

658

self.start_checker()

997

694

if timeout is None:

998

695

timeout = self.timeout

999

696

if self.disable_initiator_tag is not None:

1000

GLib.source_remove(self.disable_initiator_tag)

697

gobject.source_remove(self.disable_initiator_tag)

1001

698

self.disable_initiator_tag = None

1002

699

if getattr(self, "enabled", False):

1003

self.disable_initiator_tag = GLib.timeout_add(

700

self.disable_initiator_tag = gobject.timeout_add(

1004

701

int(timeout.total_seconds() * 1000), self.disable)

1005

702

self.expires = datetime.datetime.utcnow() + timeout

1006

703

1061

758

args = (pipe[1], subprocess.call, command),

1062

759

kwargs = popen_args)

1063

760

self.checker.start()

1064

self.checker_callback_tag = GLib.io_add_watch(

1065

pipe[0].fileno(), GLib.IO_IN,

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

1066

763

self.checker_callback, pipe[0], command)

1067

# Re-run this periodically if run by GLib.timeout_add

764

# Re-run this periodically if run by gobject.timeout_add

1068

765

return True

1069

766

1070

767

def stop_checker(self):

1071

768

"""Force the checker process, if any, to stop."""

1072

769

if self.checker_callback_tag:

1073

GLib.source_remove(self.checker_callback_tag)

770

gobject.source_remove(self.checker_callback_tag)

1074

771

self.checker_callback_tag = None

1075

772

if getattr(self, "checker", None) is None:

1076

773

return

1145

842

access="r")

1146

843

def Property_dbus_property(self):

1147

844

return dbus.Boolean(False)

1148

1149

See also the DBusObjectWithAnnotations class.

1150

845

"""

1151

846

1152

847

def decorator(func):

1174

869

pass

1175

870

1176

871

1177

class DBusObjectWithAnnotations(dbus.service.Object):

1178

"""A D-Bus object with annotations.

872

class DBusObjectWithProperties(dbus.service.Object):

873

"""A D-Bus object with properties.

1179

874

1180

Classes inheriting from this can use the dbus_annotations

1181

decorator to add annotations to methods or signals.

875

Classes inheriting from this can use the dbus_service_property

876

decorator to expose methods as D-Bus properties. It exposes the

877

standard Get(), Set(), and GetAll() methods on the D-Bus.

1182

878

"""

1183

879

1184

880

@staticmethod

1200

896

for name, athing in

1201

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1202

898

1203

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1204

out_signature = "s",

1205

path_keyword = 'object_path',

1206

connection_keyword = 'connection')

1207

def Introspect(self, object_path, connection):

1208

"""Overloading of standard D-Bus method.

1209

1210

Inserts annotation tags on methods and signals.

1211

"""

1212

xmlstring = dbus.service.Object.Introspect(self, object_path,

1213

connection)

1214

try:

1215

document = xml.dom.minidom.parseString(xmlstring)

1216

1217

for if_tag in document.getElementsByTagName("interface"):

1218

# Add annotation tags

1219

for typ in ("method", "signal"):

1220

for tag in if_tag.getElementsByTagName(typ):

1221

annots = dict()

1222

for name, prop in (self.

1223

_get_all_dbus_things(typ)):

1224

if (name == tag.getAttribute("name")

1225

and prop._dbus_interface

1226

== if_tag.getAttribute("name")):

1227

annots.update(getattr(

1228

prop, "_dbus_annotations", {}))

1229

for name, value in annots.items():

1230

ann_tag = document.createElement(

1231

"annotation")

1232

ann_tag.setAttribute("name", name)

1233

ann_tag.setAttribute("value", value)

1234

tag.appendChild(ann_tag)

1235

# Add interface annotation tags

1236

for annotation, value in dict(

1237

itertools.chain.from_iterable(

1238

annotations().items()

1239

for name, annotations

1240

in self._get_all_dbus_things("interface")

1241

if name == if_tag.getAttribute("name")

1242

)).items():

1243

ann_tag = document.createElement("annotation")

1244

ann_tag.setAttribute("name", annotation)

1245

ann_tag.setAttribute("value", value)

1246

if_tag.appendChild(ann_tag)

1247

# Fix argument name for the Introspect method itself

1248

if (if_tag.getAttribute("name")

1249

== dbus.INTROSPECTABLE_IFACE):

1250

for cn in if_tag.getElementsByTagName("method"):

1251

if cn.getAttribute("name") == "Introspect":

1252

for arg in cn.getElementsByTagName("arg"):

1253

if (arg.getAttribute("direction")

1254

== "out"):

1255

arg.setAttribute("name",

1256

"xml_data")

1257

xmlstring = document.toxml("utf-8")

1258

document.unlink()

1259

except (AttributeError, xml.dom.DOMException,

1260

xml.parsers.expat.ExpatError) as error:

1261

logger.error("Failed to override Introspection method",

1262

exc_info=error)

1263

return xmlstring

1264

1265

1266

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1267

"""A D-Bus object with properties.

1268

1269

Classes inheriting from this can use the dbus_service_property

1270

decorator to expose methods as D-Bus properties. It exposes the

1271

standard Get(), Set(), and GetAll() methods on the D-Bus.

1272

"""

1273

1274

899

def _get_dbus_property(self, interface_name, property_name):

1275

900

"""Returns a bound method if one exists which is a D-Bus

1276

901

property with the specified name and interface.

1286

911

raise DBusPropertyNotFound("{}:{}.{}".format(

1287

912

self.dbus_object_path, interface_name, property_name))

1288

913

1289

@classmethod

1290

def _get_all_interface_names(cls):

1291

"""Get a sequence of all interfaces supported by an object"""

1292

return (name for name in set(getattr(getattr(x, attr),

1293

"_dbus_interface", None)

1294

for x in (inspect.getmro(cls))

1295

for attr in dir(x))

1296

if name is not None)

1297

1298

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

1299

915

in_signature="ss",

1300

916

out_signature="v")

1370

986

1371

987

Inserts property tags and interface annotation tags.

1372

988

"""

1373

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1374

object_path,

1375

connection)

989

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

connection)

1376

991

try:

1377

992

document = xml.dom.minidom.parseString(xmlstring)

1378

993

1391

1006

if prop._dbus_interface

1392

1007

== if_tag.getAttribute("name")):

1393

1008

if_tag.appendChild(tag)

1394

# Add annotation tags for properties

1395

for tag in if_tag.getElementsByTagName("property"):

1396

annots = dict()

1397

for name, prop in self._get_all_dbus_things(

1398

"property"):

1399

if (name == tag.getAttribute("name")

1400

and prop._dbus_interface

1401

== if_tag.getAttribute("name")):

1402

annots.update(getattr(

1403

prop, "_dbus_annotations", {}))

1404

for name, value in annots.items():

1405

ann_tag = document.createElement(

1406

"annotation")

1407

ann_tag.setAttribute("name", name)

1408

ann_tag.setAttribute("value", value)

1409

tag.appendChild(ann_tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1410

1038

# Add the names to the return values for the

1411

1039

# "org.freedesktop.DBus.Properties" methods

1412

1040

if (if_tag.getAttribute("name")

1430

1058

exc_info=error)

1431

1059

return xmlstring

1432

1060

1433

try:

1434

dbus.OBJECT_MANAGER_IFACE

1435

except AttributeError:

1436

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1437

1438

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1439

"""A D-Bus object with an ObjectManager.

1440

1441

Classes inheriting from this exposes the standard

1442

GetManagedObjects call and the InterfacesAdded and

1443

InterfacesRemoved signals on the standard

1444

"org.freedesktop.DBus.ObjectManager" interface.

1445

1446

Note: No signals are sent automatically; they must be sent

1447

manually.

1448

"""

1449

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1450

out_signature = "a{oa{sa{sv}}}")

1451

def GetManagedObjects(self):

1452

"""This function must be overridden"""

1453

raise NotImplementedError()

1454

1455

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1456

signature = "oa{sa{sv}}")

1457

def InterfacesAdded(self, object_path, interfaces_and_properties):

1458

pass

1459

1460

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1461

def InterfacesRemoved(self, object_path, interfaces):

1462

pass

1463

1464

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1465

out_signature = "s",

1466

path_keyword = 'object_path',

1467

connection_keyword = 'connection')

1468

def Introspect(self, object_path, connection):

1469

"""Overloading of standard D-Bus method.

1470

1471

Override return argument name of GetManagedObjects to be

1472

"objpath_interfaces_and_properties"

1473

"""

1474

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1475

object_path,

1476

connection)

1477

try:

1478

document = xml.dom.minidom.parseString(xmlstring)

1479

1480

for if_tag in document.getElementsByTagName("interface"):

1481

# Fix argument name for the GetManagedObjects method

1482

if (if_tag.getAttribute("name")

1483

== dbus.OBJECT_MANAGER_IFACE):

1484

for cn in if_tag.getElementsByTagName("method"):

1485

if (cn.getAttribute("name")

1486

== "GetManagedObjects"):

1487

for arg in cn.getElementsByTagName("arg"):

1488

if (arg.getAttribute("direction")

1489

== "out"):

1490

arg.setAttribute(

1491

"name",

1492

"objpath_interfaces"

1493

"_and_properties")

1494

xmlstring = document.toxml("utf-8")

1495

document.unlink()

1496

except (AttributeError, xml.dom.DOMException,

1497

xml.parsers.expat.ExpatError) as error:

1498

logger.error("Failed to override Introspection method",

1499

exc_info = error)

1500

return xmlstring

1501

1061

1502

1062

def datetime_to_dbus(dt, variant_level=0):

1503

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1550

1110

interface_names.add(alt_interface)

1551

1111

# Is this a D-Bus signal?

1552

1112

if getattr(attribute, "_dbus_is_signal", False):

1553

# Extract the original non-method undecorated

1554

# function by black magic

1555

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1556

1116

nonmethod_func = (dict(

1557

1117

zip(attribute.func_code.co_freevars,

1558

1118

attribute.__closure__))

1559

1119

["func"].cell_contents)

1560

1120

else:

1561

nonmethod_func = (dict(

1562

zip(attribute.__code__.co_freevars,

1563

attribute.__closure__))

1564

["func"].cell_contents)

1121

nonmethod_func = attribute

1565

1122

# Create a new, but exactly alike, function

1566

1123

# object, and decorate it to be a new D-Bus signal

1567

1124

# with the alternate D-Bus interface name

1568

new_function = copy_function(nonmethod_func)

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1569

1139

new_function = (dbus.service.signal(

1570

1140

alt_interface,

1571

1141

attribute._dbus_signature)(new_function))

1584

1154

func1 and func2 to the "call_both" function

1585

1155

outside of its arguments"""

1586

1156

1587

@functools.wraps(func2)

1588

1157

def call_both(*args, **kwargs):

1589

1158

"""This function will emit two D-Bus

1590

1159

signals by calling func1 and func2"""

1591

1160

func1(*args, **kwargs)

1592

1161

func2(*args, **kwargs)

1593

# Make wrapper function look like a D-Bus signal

1594

for name, attr in inspect.getmembers(func2):

1595

if name.startswith("_dbus_"):

1596

setattr(call_both, name, attr)

1597

1162

1598

1163

return call_both

1599

1164

# Create the "call_both" function and add it to

1610

1175

alt_interface,

1611

1176

attribute._dbus_in_signature,

1612

1177

attribute._dbus_out_signature)

1613

(copy_function(attribute)))

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1614

1183

# Copy annotations, if any

1615

1184

try:

1616

1185

attr[attrname]._dbus_annotations = dict(

1628

1197

attribute._dbus_access,

1629

1198

attribute._dbus_get_args_options

1630

1199

["byte_arrays"])

1631

(copy_function(attribute)))

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1632

1206

# Copy annotations, if any

1633

1207

try:

1634

1208

attr[attrname]._dbus_annotations = dict(

1643

1217

# to the class.

1644

1218

attr[attrname] = (

1645

1219

dbus_interface_annotations(alt_interface)

1646

(copy_function(attribute)))

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1647

1225

if deprecate:

1648

1226

# Deprecate all alternate interfaces

1649

1227

iname="_AlternateDBusNames_interface_annotation{}"

1662

1240

if interface_names:

1663

1241

# Replace the class with a new subclass of it with

1664

1242

# methods, signals, etc. as created above.

1665

if sys.version_info.major == 2:

1666

cls = type(b"{}Alternate".format(cls.__name__),

1667

(cls, ), attr)

1668

else:

1669

cls = type("{}Alternate".format(cls.__name__),

1670

(cls, ), attr)

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1671

1245

return cls

1672

1246

1673

1247

return wrapper

1802

1376

if exitstatus >= 0:

1803

1377

# Emit D-Bus signal

1804

1378

self.CheckerCompleted(dbus.Int16(exitstatus),

1805

# This is specific to GNU libC

1806

dbus.Int64(exitstatus << 8),

1379

dbus.Int64(0),

1807

1380

dbus.String(command))

1808

1381

else:

1809

1382

# Emit D-Bus signal

1810

1383

self.CheckerCompleted(dbus.Int16(-1),

1811

1384

dbus.Int64(

1812

# This is specific to GNU libC

1813

(exitstatus << 8)

1814

| self.last_checker_signal),

1385

self.last_checker_signal),

1815

1386

dbus.String(command))

1816

1387

return ret

1817

1388

1831

1402

1832

1403

def approve(self, value=True):

1833

1404

self.approved = value

1834

GLib.timeout_add(int(self.approval_duration.total_seconds()

1835

* 1000), self._reset_approved)

1405

gobject.timeout_add(int(self.approval_duration.total_seconds()

1406

* 1000), self._reset_approved)

1836

1407

self.send_changedstate()

1837

1408

1838

1409

## D-Bus methods, signals & properties

1894

1465

self.checked_ok()

1895

1466

1896

1467

# Enable - method

1897

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1898

1468

@dbus.service.method(_interface)

1899

1469

def Enable(self):

1900

1470

"D-Bus method"

1901

1471

self.enable()

1902

1472

1903

1473

# StartChecker - method

1904

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1905

1474

@dbus.service.method(_interface)

1906

1475

def StartChecker(self):

1907

1476

"D-Bus method"

1908

1477

self.start_checker()

1909

1478

1910

1479

# Disable - method

1911

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1912

1480

@dbus.service.method(_interface)

1913

1481

def Disable(self):

1914

1482

"D-Bus method"

1915

1483

self.disable()

1916

1484

1917

1485

# StopChecker - method

1918

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1919

1486

@dbus.service.method(_interface)

1920

1487

def StopChecker(self):

1921

1488

self.stop_checker()

1957

1524

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1958

1525

1959

1526

# Name - property

1960

@dbus_annotations(

1961

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1962

1527

@dbus_service_property(_interface, signature="s", access="read")

1963

1528

def Name_dbus_property(self):

1964

1529

return dbus.String(self.name)

1965

1530

1966

1531

# Fingerprint - property

1967

@dbus_annotations(

1968

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1969

1532

@dbus_service_property(_interface, signature="s", access="read")

1970

1533

def Fingerprint_dbus_property(self):

1971

1534

return dbus.String(self.fingerprint)

1980

1543

self.host = str(value)

1981

1544

1982

1545

# Created - property

1983

@dbus_annotations(

1984

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1985

1546

@dbus_service_property(_interface, signature="s", access="read")

1986

1547

def Created_dbus_property(self):

1987

1548

return datetime_to_dbus(self.created)

2048

1609

if (getattr(self, "disable_initiator_tag", None)

2049

1610

is None):

2050

1611

return

2051

GLib.source_remove(self.disable_initiator_tag)

2052

self.disable_initiator_tag = GLib.timeout_add(

1612

gobject.source_remove(self.disable_initiator_tag)

1613

self.disable_initiator_tag = gobject.timeout_add(

2053

1614

int((self.expires - now).total_seconds() * 1000),

2054

1615

self.disable)

2055

1616

2075

1636

return

2076

1637

if self.enabled:

2077

1638

# Reschedule checker run

2078

GLib.source_remove(self.checker_initiator_tag)

2079

self.checker_initiator_tag = GLib.timeout_add(

1639

gobject.source_remove(self.checker_initiator_tag)

1640

self.checker_initiator_tag = gobject.timeout_add(

2080

1641

value, self.start_checker)

2081

1642

self.start_checker() # Start one now, too

2082

1643

2102

1663

self.stop_checker()

2103

1664

2104

1665

# ObjectPath - property

2105

@dbus_annotations(

2106

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2107

"org.freedesktop.DBus.Deprecated": "true"})

2108

1666

@dbus_service_property(_interface, signature="o", access="read")

2109

1667

def ObjectPath_dbus_property(self):

2110

1668

return self.dbus_object_path # is already a dbus.ObjectPath

2111

1669

2112

1670

# Secret = property

2113

@dbus_annotations(

2114

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2115

"invalidates"})

2116

1671

@dbus_service_property(_interface,

2117

1672

signature="ay",

2118

1673

access="write",

2164

1719

logger.debug("Pipe FD: %d",

2165

1720

self.server.child_pipe.fileno())

2166

1721

2167

session = gnutls.ClientSession(self.request)

1722

session = gnutls.connection.ClientSession(

1723

self.request, gnutls.connection .X509Credentials())

1724

1725

# Note: gnutls.connection.X509Credentials is really a

1726

# generic GnuTLS certificate credentials object so long as

1727

# no X.509 keys are added to it. Therefore, we can use it

1728

# here despite using OpenPGP certificates.

2168

1729

2169

1730

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2170

1731

# "+AES-256-CBC", "+SHA1",

2174

1735

priority = self.server.gnutls_priority

2175

1736

if priority is None:

2176

1737

priority = "NORMAL"

2177

gnutls.priority_set_direct(session._c_object, priority,

2178

None)

1738

gnutls.library.functions.gnutls_priority_set_direct(

1739

session._c_object, priority, None)

2179

1740

2180

1741

# Start communication using the Mandos protocol

2181

1742

# Get protocol number

2191

1752

# Start GnuTLS connection

2192

1753

try:

2193

1754

session.handshake()

2194

except gnutls.Error as error:

1755

except gnutls.errors.GNUTLSError as error:

2195

1756

logger.warning("Handshake failed: %s", error)

2196

1757

# Do not run session.bye() here: the session is not

2197

1758

# established. Just abandon the request.

2203

1764

try:

2204

1765

fpr = self.fingerprint(

2205

1766

self.peer_certificate(session))

2206

except (TypeError, gnutls.Error) as error:

1767

except (TypeError,

1768

gnutls.errors.GNUTLSError) as error:

2207

1769

logger.warning("Bad certificate: %s", error)

2208

1770

return

2209

1771

logger.debug("Fingerprint: %s", fpr)

2267

1829

else:

2268

1830

delay -= time2 - time

2269

1831

2270

try:

2271

session.send(client.secret)

2272

except gnutls.Error as error:

2273

logger.warning("gnutls send failed",

2274

exc_info = error)

2275

return

1832

sent_size = 0

1833

while sent_size < len(client.secret):

1834

try:

1835

sent = session.send(client.secret[sent_size:])

1836

except gnutls.errors.GNUTLSError as error:

1837

logger.warning("gnutls send failed",

1838

exc_info=error)

1839

return

1840

logger.debug("Sent: %d, remaining: %d", sent,

1841

len(client.secret) - (sent_size

1842

+ sent))

1843

sent_size += sent

2276

1844

2277

1845

logger.info("Sending secret to %s", client.name)

2278

1846

# bump the timeout using extended_timeout

2286

1854

client.approvals_pending -= 1

2287

1855

try:

2288

1856

session.bye()

2289

except gnutls.Error as error:

1857

except gnutls.errors.GNUTLSError as error:

2290

1858

logger.warning("GnuTLS bye failed",

2291

1859

exc_info=error)

2292

1860

2294

1862

def peer_certificate(session):

2295

1863

"Return the peer's OpenPGP certificate as a bytestring"

2296

1864

# If not an OpenPGP certificate...

2297

if (gnutls.certificate_type_get(session._c_object)

2298

!= gnutls.CRT_OPENPGP):

2299

# ...return invalid data

2300

return b""

1865

if (gnutls.library.functions.gnutls_certificate_type_get(

1866

session._c_object)

1867

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1868

# ...do the normal thing

1869

return session.peer_certificate

2301

1870

list_size = ctypes.c_uint(1)

2302

cert_list = (gnutls.certificate_get_peers

1871

cert_list = (gnutls.library.functions

1872

.gnutls_certificate_get_peers

2303

1873

(session._c_object, ctypes.byref(list_size)))

2304

1874

if not bool(cert_list) and list_size.value != 0:

2305

raise gnutls.Error("error getting peer certificate")

1875

raise gnutls.errors.GNUTLSError("error getting peer"

1876

" certificate")

2306

1877

if list_size.value == 0:

2307

1878

return None

2308

1879

cert = cert_list[0]

2312

1883

def fingerprint(openpgp):

2313

1884

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2314

1885

# New GnuTLS "datum" with the OpenPGP public key

2315

datum = gnutls.datum_t(

1886

datum = gnutls.library.types.gnutls_datum_t(

2316

1887

ctypes.cast(ctypes.c_char_p(openpgp),

2317

1888

ctypes.POINTER(ctypes.c_ubyte)),

2318

1889

ctypes.c_uint(len(openpgp)))

2319

1890

# New empty GnuTLS certificate

2320

crt = gnutls.openpgp_crt_t()

2321

gnutls.openpgp_crt_init(ctypes.byref(crt))

1891

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1892

gnutls.library.functions.gnutls_openpgp_crt_init(

1893

ctypes.byref(crt))

2322

1894

# Import the OpenPGP public key into the certificate

2323

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2324

gnutls.OPENPGP_FMT_RAW)

1895

gnutls.library.functions.gnutls_openpgp_crt_import(

1896

crt, ctypes.byref(datum),

1897

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2325

1898

# Verify the self signature in the key

2326

1899

crtverify = ctypes.c_uint()

2327

gnutls.openpgp_crt_verify_self(crt, 0,

2328

ctypes.byref(crtverify))

1900

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1901

crt, 0, ctypes.byref(crtverify))

2329

1902

if crtverify.value != 0:

2330

gnutls.openpgp_crt_deinit(crt)

2331

raise gnutls.CertificateSecurityError("Verify failed")

1903

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1904

raise gnutls.errors.CertificateSecurityError(

1905

"Verify failed")

2332

1906

# New buffer for the fingerprint

2333

1907

buf = ctypes.create_string_buffer(20)

2334

1908

buf_len = ctypes.c_size_t()

2335

1909

# Get the fingerprint from the certificate into the buffer

2336

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2337

ctypes.byref(buf_len))

1910

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1911

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2338

1912

# Deinit the certificate

2339

gnutls.openpgp_crt_deinit(crt)

1913

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2340

1914

# Convert the buffer to a Python bytestring

2341

1915

fpr = ctypes.string_at(buf, buf_len.value)

2342

1916

# Convert the bytestring to hexadecimal notation

2486

2060

gnutls_priority GnuTLS priority string

2487

2061

use_dbus: Boolean; to emit D-Bus signals or not

2488

2062

2489

Assumes a GLib.MainLoop event loop.

2063

Assumes a gobject.MainLoop event loop.

2490

2064

"""

2491

2065

2492

2066

def __init__(self, server_address, RequestHandlerClass,

2517

2091

2518

2092

def add_pipe(self, parent_pipe, proc):

2519

2093

# Call "handle_ipc" for both data and EOF events

2520

GLib.io_add_watch(

2094

gobject.io_add_watch(

2521

2095

parent_pipe.fileno(),

2522

GLib.IO_IN | GLib.IO_HUP,

2096

gobject.IO_IN | gobject.IO_HUP,

2523

2097

functools.partial(self.handle_ipc,

2524

2098

parent_pipe = parent_pipe,

2525

2099

proc = proc))

2529

2103

proc = None,

2530

2104

client_object=None):

2531

2105

# error, or the other end of multiprocessing.Pipe has closed

2532

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2106

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2533

2107

# Wait for other process to exit

2534

2108

proc.join()

2535

2109

return False

2542

2116

fpr = request[1]

2543

2117

address = request[2]

2544

2118

2545

for c in self.clients.values():

2119

for c in self.clients.itervalues():

2546

2120

if c.fingerprint == fpr:

2547

2121

client = c

2548

2122

break

2556

2130

parent_pipe.send(False)

2557

2131

return False

2558

2132

2559

GLib.io_add_watch(

2133

gobject.io_add_watch(

2560

2134

parent_pipe.fileno(),

2561

GLib.IO_IN | GLib.IO_HUP,

2135

gobject.IO_IN | gobject.IO_HUP,

2562

2136

functools.partial(self.handle_ipc,

2563

2137

parent_pipe = parent_pipe,

2564

2138

proc = proc,

2946

2520

logger.error("Could not open file %r", pidfilename,

2947

2521

exc_info=e)

2948

2522

2949

for name, group in (("_mandos", "_mandos"),

2950

("mandos", "mandos"),

2951

("nobody", "nogroup")):

2523

for name in ("_mandos", "mandos", "nobody"):

2952

2524

try:

2953

2525

uid = pwd.getpwnam(name).pw_uid

2954

gid = pwd.getpwnam(group).pw_gid

2526

gid = pwd.getpwnam(name).pw_gid

2955

2527

break

2956

2528

except KeyError:

2957

2529

continue

2961

2533

try:

2962

2534

os.setgid(gid)

2963

2535

os.setuid(uid)

2964

if debug:

2965

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2966

gid))

2967

2536

except OSError as error:

2968

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2969

.format(uid, gid, os.strerror(error.errno)))

2970

2537

if error.errno != errno.EPERM:

2971

2538

raise

2972

2539

2975

2542

2976

2543

# "Use a log level over 10 to enable all debugging options."

2977

2544

# - GnuTLS manual

2978

gnutls.global_set_log_level(11)

2545

gnutls.library.functions.gnutls_global_set_log_level(11)

2979

2546

2980

@gnutls.log_func

2547

@gnutls.library.types.gnutls_log_func

2981

2548

def debug_gnutls(level, string):

2982

2549

logger.debug("GnuTLS: %s", string[:-1])

2983

2550

2984

gnutls.global_set_log_function(debug_gnutls)

2551

gnutls.library.functions.gnutls_global_set_log_function(

2552

debug_gnutls)

2985

2553

2986

2554

# Redirect stdin so all checkers get /dev/null

2987

2555

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2994

2562

# Close all input and output, do double fork, etc.

2995

2563

daemon()

2996

2564

2997

# multiprocessing will use threads, so before we use GLib we need

2998

# to inform GLib that threads will be used.

2999

GLib.threads_init()

2565

# multiprocessing will use threads, so before we use gobject we

2566

# need to inform gobject that threads will be used.

2567

gobject.threads_init()

3000

2568

3001

2569

global main_loop

3002

2570

# From the Avahi example code

3003

2571

DBusGMainLoop(set_as_default=True)

3004

main_loop = GLib.MainLoop()

2572

main_loop = gobject.MainLoop()

3005

2573

bus = dbus.SystemBus()

3006

2574

# End of Avahi example code

3007

2575

if use_dbus:

3051

2619

if server_settings["restore"]:

3052

2620

try:

3053

2621

with open(stored_state_path, "rb") as stored_state:

3054

if sys.version_info.major == 2:

3055

clients_data, old_client_settings = pickle.load(

3056

stored_state)

3057

else:

3058

bytes_clients_data, bytes_old_client_settings = (

3059

pickle.load(stored_state, encoding = "bytes"))

3060

### Fix bytes to strings

3061

## clients_data

3062

# .keys()

3063

clients_data = { (key.decode("utf-8")

3064

if isinstance(key, bytes)

3065

else key): value

3066

for key, value in

3067

bytes_clients_data.items() }

3068

del bytes_clients_data

3069

for key in clients_data:

3070

value = { (k.decode("utf-8")

3071

if isinstance(k, bytes) else k): v

3072

for k, v in

3073

clients_data[key].items() }

3074

clients_data[key] = value

3075

# .client_structure

3076

value["client_structure"] = [

3077

(s.decode("utf-8")

3078

if isinstance(s, bytes)

3079

else s) for s in

3080

value["client_structure"] ]

3081

# .name & .host

3082

for k in ("name", "host"):

3083

if isinstance(value[k], bytes):

3084

value[k] = value[k].decode("utf-8")

3085

## old_client_settings

3086

# .keys()

3087

old_client_settings = {

3088

(key.decode("utf-8")

3089

if isinstance(key, bytes)

3090

else key): value

3091

for key, value in

3092

bytes_old_client_settings.items() }

3093

del bytes_old_client_settings

3094

# .host

3095

for value in old_client_settings.values():

3096

if isinstance(value["host"], bytes):

3097

value["host"] = (value["host"]

3098

.decode("utf-8"))

2622

clients_data, old_client_settings = pickle.load(

2623

stored_state)

3099

2624

os.remove(stored_state_path)

3100

2625

except IOError as e:

3101

2626

if e.errno == errno.ENOENT:

3202

2727

del pidfile

3203

2728

del pidfilename

3204

2729

3205

for termsig in (signal.SIGHUP, signal.SIGTERM):

3206

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3207

lambda: main_loop.quit() and False)

2730

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2731

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3208

2732

3209

2733

if use_dbus:

3210

2734

3211

2735

@alternate_dbus_interfaces(

3212

2736

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3213

class MandosDBusService(DBusObjectWithObjectManager):

2737

class MandosDBusService(DBusObjectWithProperties):

3214

2738

"""A D-Bus proxy object"""

3215

2739

3216

2740

def __init__(self):

3218

2742

3219

2743

_interface = "se.recompile.Mandos"

3220

2744

2745

@dbus_interface_annotations(_interface)

2746

def _foo(self):

2747

return {

2748

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2749

"false" }

2750

3221

2751

@dbus.service.signal(_interface, signature="o")

3222

2752

def ClientAdded(self, objpath):

3223

2753

"D-Bus signal"

3228

2758

"D-Bus signal"

3229

2759

pass

3230

2760

3231

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3232

"true"})

3233

2761

@dbus.service.signal(_interface, signature="os")

3234

2762

def ClientRemoved(self, objpath, name):

3235

2763

"D-Bus signal"

3236

2764

pass

3237

2765

3238

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3239

"true"})

3240

2766

@dbus.service.method(_interface, out_signature="ao")

3241

2767

def GetAllClients(self):

3242

2768

"D-Bus method"

3243

2769

return dbus.Array(c.dbus_object_path for c in

3244

tcp_server.clients.values())

2770

tcp_server.clients.itervalues())

3245

2771

3246

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3247

"true"})

3248

2772

@dbus.service.method(_interface,

3249

2773

out_signature="a{oa{sv}}")

3250

2774

def GetAllClientsWithProperties(self):

3251

2775

"D-Bus method"

3252

2776

return dbus.Dictionary(

3253

{ c.dbus_object_path: c.GetAll(

3254

"se.recompile.Mandos.Client")

3255

for c in tcp_server.clients.values() },

2777

{ c.dbus_object_path: c.GetAll("")

2778

for c in tcp_server.clients.itervalues() },

3256

2779

signature="oa{sv}")

3257

2780

3258

2781

@dbus.service.method(_interface, in_signature="o")

3259

2782

def RemoveClient(self, object_path):

3260

2783

"D-Bus method"

3261

for c in tcp_server.clients.values():

2784

for c in tcp_server.clients.itervalues():

3262

2785

if c.dbus_object_path == object_path:

3263

2786

del tcp_server.clients[c.name]

3264

2787

c.remove_from_connection()

3265

# Don't signal the disabling

2788

# Don't signal anything except ClientRemoved

3266

2789

c.disable(quiet=True)

3267

# Emit D-Bus signal for removal

3268

self.client_removed_signal(c)

2790

# Emit D-Bus signal

2791

self.ClientRemoved(object_path, c.name)

3269

2792

return

3270

2793

raise KeyError(object_path)

3271

2794

3272

2795

del _interface

3273

3274

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3275

out_signature = "a{oa{sa{sv}}}")

3276

def GetManagedObjects(self):

3277

"""D-Bus method"""

3278

return dbus.Dictionary(

3279

{ client.dbus_object_path:

3280

dbus.Dictionary(

3281

{ interface: client.GetAll(interface)

3282

for interface in

3283

client._get_all_interface_names()})

3284

for client in tcp_server.clients.values()})

3285

3286

def client_added_signal(self, client):

3287

"""Send the new standard signal and the old signal"""

3288

if use_dbus:

3289

# New standard signal

3290

self.InterfacesAdded(

3291

client.dbus_object_path,

3292

dbus.Dictionary(

3293

{ interface: client.GetAll(interface)

3294

for interface in

3295

client._get_all_interface_names()}))

3296

# Old signal

3297

self.ClientAdded(client.dbus_object_path)

3298

3299

def client_removed_signal(self, client):

3300

"""Send the new standard signal and the old signal"""

3301

if use_dbus:

3302

# New standard signal

3303

self.InterfacesRemoved(

3304

client.dbus_object_path,

3305

client._get_all_interface_names())

3306

# Old signal

3307

self.ClientRemoved(client.dbus_object_path,

3308

client.name)

3309

2796

3310

2797

mandos_dbus_service = MandosDBusService()

3311

2798

3324

2811

# removed/edited, old secret will thus be unrecovable.

3325

2812

clients = {}

3326

2813

with PGPEngine() as pgp:

3327

for client in tcp_server.clients.values():

2814

for client in tcp_server.clients.itervalues():

3328

2815

key = client_settings[client.name]["secret"]

3329

2816

client.encrypted_secret = pgp.encrypt(client.secret,

3330

2817

key)

3354

2841

prefix='clients-',

3355

2842

dir=os.path.dirname(stored_state_path),

3356

2843

delete=False) as stored_state:

3357

pickle.dump((clients, client_settings), stored_state,

3358

protocol = 2)

2844

pickle.dump((clients, client_settings), stored_state)

3359

2845

tempname = stored_state.name

3360

2846

os.rename(tempname, stored_state_path)

3361

2847

except (IOError, OSError) as e:

3377

2863

name, client = tcp_server.clients.popitem()

3378

2864

if use_dbus:

3379

2865

client.remove_from_connection()

3380

# Don't signal the disabling

2866

# Don't signal anything except ClientRemoved

3381

2867

client.disable(quiet=True)

3382

# Emit D-Bus signal for removal

3383

2868

if use_dbus:

3384

mandos_dbus_service.client_removed_signal(client)

2869

# Emit D-Bus signal

2870

mandos_dbus_service.ClientRemoved(

2871

client.dbus_object_path, client.name)

3385

2872

client_settings.clear()

3386

2873

3387

2874

atexit.register(cleanup)

3388

2875

3389

for client in tcp_server.clients.values():

2876

for client in tcp_server.clients.itervalues():

3390

2877

if use_dbus:

3391

# Emit D-Bus signal for adding

3392

mandos_dbus_service.client_added_signal(client)

2878

# Emit D-Bus signal

2879

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3393

2880

# Need to initiate checking of clients

3394

2881

if client.enabled:

3395

2882

client.init_checker()

3421

2908

sys.exit(1)

3422

2909

# End of Avahi example code

3423

2910

3424

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3425

lambda *args, **kwargs:

3426

(tcp_server.handle_request

3427

(*args[2:], **kwargs) or True))

2911

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2912

lambda *args, **kwargs:

2913

(tcp_server.handle_request

2914

(*args[2:], **kwargs) or True))

3428

2915

3429

2916

logger.debug("Starting main loop")

3430

2917

main_loop.run()