/mandos/trunk : revision 794

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

47

50

import gnutls.library.functions

48

51

import gnutls.library.constants

49

52

import gnutls.library.types

50

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

51

57

import sys

52

58

import re

53

59

import os

62

68

import struct

63

69

import fcntl

64

70

import functools

65

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

66

75

import multiprocessing

67

76

import types

68

77

import binascii

69

78

import tempfile

70

79

import itertools

71

80

import collections

81

import codecs

72

82

73

83

import dbus

74

84

import dbus.service

75

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

76

89

import avahi

77

90

from dbus.mainloop.glib import DBusGMainLoop

78

91

import ctypes

91

104

if sys.version_info.major == 2:

92

105

str = unicode

93

106

94

version = "1.6.8"

107

version = "1.7.1"

95

108

stored_state_file = "clients.pickle"

96

109

97

110

logger = logging.getLogger()

98

111

syslogger = None

99

112

100

113

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

104

116

except (OSError, AttributeError):

117

105

118

def if_nametoindex(interface):

106

119

"Get an interface index the hard way, i.e. using fcntl()"

107

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

116

129

"""init logger and add loglevel"""

117

130

118

131

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

123

135

syslogger.setFormatter(logging.Formatter

124

136

('Mandos [%(process)d]: %(levelname)s:'

125

137

' %(message)s'))

142

154

143

155

class PGPEngine(object):

144

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

145

158

def __init__(self):

146

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

160

self.gnupgargs = ['--batch',

186

199

187

200

def encrypt(self, data, password):

188

201

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

191

204

passfile.write(passphrase)

192

205

passfile.flush()

193

206

proc = subprocess.Popen(['gpg', '--symmetric',

204

217

205

218

def decrypt(self, data, password):

206

219

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

209

222

passfile.write(passphrase)

210

223

passfile.flush()

211

224

proc = subprocess.Popen(['gpg', '--decrypt',

215

228

stdin = subprocess.PIPE,

216

229

stdout = subprocess.PIPE,

217

230

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

231

decrypted_plaintext, err = proc.communicate(input = data)

220

232

if proc.returncode != 0:

221

233

raise PGPError(err)

222

234

return decrypted_plaintext

228

240

return super(AvahiError, self).__init__(value, *args,

229

241

**kwargs)

230

242

243

231

244

class AvahiServiceError(AvahiError):

232

245

pass

233

246

247

234

248

class AvahiGroupError(AvahiError):

235

249

pass

236

250

256

270

bus: dbus.SystemBus()

257

271

"""

258

272

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

263

284

self.interface = interface

264

285

self.name = name

265

286

self.type = servicetype

275

296

self.bus = bus

276

297

self.entry_group_state_changed_match = None

277

298

278

def rename(self):

299

def rename(self, remove=True):

279

300

"""Derived from the Avahi example code"""

280

301

if self.rename_count >= self.max_renames:

281

302

logger.critical("No suitable Zeroconf service name found"

282

303

" after %i retries, exiting.",

283

304

self.rename_count)

284

305

raise AvahiServiceError("Too many renames")

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

287

309

logger.info("Changing Zeroconf service name to %r ...",

288

310

self.name)

289

self.remove()

311

if remove:

312

self.remove()

290

313

try:

291

314

self.add()

292

315

except dbus.exceptions.DBusException as error:

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

297

324

298

325

def remove(self):

299

326

"""Derived from the Avahi example code"""

338

365

elif state == avahi.ENTRY_GROUP_FAILURE:

339

366

logger.critical("Avahi: Error in group state changed %s",

340

367

str(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

343

369

344

370

def cleanup(self):

345

371

"""Derived from the Avahi example code"""

355

381

def server_state_changed(self, state, error=None):

356

382

"""Derived from the Avahi example code"""

357

383

logger.debug("Avahi server state change: %i", state)

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

365

390

if state in bad_states:

366

391

if bad_states[state] is not None:

367

392

if error is None:

370

395

logger.error(bad_states[state] + ": %r", error)

371

396

self.cleanup()

372

397

elif state == avahi.SERVER_RUNNING:

373

self.add()

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

374

410

else:

375

411

if error is None:

376

412

logger.debug("Unknown state: %r", state)

386

422

follow_name_owner_changes=True),

387

423

avahi.DBUS_INTERFACE_SERVER)

388

424

self.server.connect_to_signal("StateChanged",

389

self.server_state_changed)

425

self.server_state_changed)

390

426

self.server_state_changed(self.server.GetState())

391

427

392

428

393

429

class AvahiServiceToSyslog(AvahiService):

394

def rename(self):

430

def rename(self, *args, **kwargs):

395

431

"""Add the new name to the syslog messages"""

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

401

436

return ret

402

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

403

447

404

448

class Client(object):

405

449

"""A representation of a client host served by this server.

432

476

last_checker_status: integer between 0 and 255 reflecting exit

433

477

status of last checker. -1 reflects crashed

434

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

435

481

last_enabled: datetime.datetime(); (UTC) or None

436

482

name: string; from the config file, used in log messages and

437

483

D-Bus identifiers

450

496

"fingerprint", "host", "interval",

451

497

"last_approval_request", "last_checked_ok",

452

498

"last_enabled", "name", "timeout")

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

463

510

464

511

@staticmethod

465

512

def config_parser(config):

481

528

client["enabled"] = config.getboolean(client_name,

482

529

"enabled")

483

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

484

534

client["fingerprint"] = (section["fingerprint"].upper()

485

535

.replace(" ", ""))

486

536

if "secret" in section:

528

578

self.expires = None

529

579

530

580

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

534

581

logger.debug(" Fingerprint: %s", self.fingerprint)

535

582

self.created = settings.get("created",

536

583

datetime.datetime.utcnow())

543

590

self.current_checker_command = None

544

591

self.approved = None

545

592

self.approvals_pending = 0

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

551

597

if not attr.startswith("_")]

552

598

self.client_structure.append("client_structure")

553

599

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

558

602

if not name.startswith("_"):

559

603

self.client_structure.append(name)

560

604

602

646

# and every interval from then on.

603

647

if self.checker_initiator_tag is not None:

604

648

gobject.source_remove(self.checker_initiator_tag)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

609

652

# Schedule a disable() when 'timeout' has passed

610

653

if self.disable_initiator_tag is not None:

611

654

gobject.source_remove(self.disable_initiator_tag)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

616

657

# Also start a new checker *right now*.

617

658

self.start_checker()

618

659

619

def checker_callback(self, pid, condition, command):

660

def checker_callback(self, source, condition, connection,

661

command):

620

662

"""The checker has completed, so take appropriate actions."""

621

663

self.checker_callback_tag = None

622

664

self.checker = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

625

672

if self.last_checker_status == 0:

626

673

logger.info("Checker for %(name)s succeeded",

627

674

vars(self))

628

675

self.checked_ok()

629

676

else:

630

logger.info("Checker for %(name)s failed",

631

vars(self))

677

logger.info("Checker for %(name)s failed", vars(self))

632

678

else:

633

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

634

681

logger.warning("Checker for %(name)s crashed?",

635

682

vars(self))

683

return False

636

684

637

685

def checked_ok(self):

638

686

"""Assert that the client has been seen, alive and well."""

639

687

self.last_checked_ok = datetime.datetime.utcnow()

640

688

self.last_checker_status = 0

689

self.last_checker_signal = None

641

690

self.bump_timeout()

642

691

643

692

def bump_timeout(self, timeout=None):

648

697

gobject.source_remove(self.disable_initiator_tag)

649

698

self.disable_initiator_tag = None

650

699

if getattr(self, "enabled", False):

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

654

702

self.expires = datetime.datetime.utcnow() + timeout

655

703

656

704

def need_approval(self):

670

718

# than 'timeout' for the client to be disabled, which is as it

671

719

# should be.

672

720

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

687

725

# Start a new checker if needed

688

726

if self.checker is None:

689

727

# Escape attributes for the shell

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

693

731

try:

694

732

command = self.checker_command % escaped_attrs

695

733

except TypeError as error:

696

734

logger.error('Could not format string "%s"',

697

self.checker_command, exc_info=error)

698

return True # Try again later

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

699

738

self.current_checker_command = command

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

# The exception is when not debugging but nevertheless

708

# running in the foreground; use the previously

709

# created wnull.

710

popen_args = {}

711

if (not self.server_settings["debug"]

712

and self.server_settings["foreground"]):

713

popen_args.update({"stdout": wnull,

714

"stderr": wnull })

715

self.checker = subprocess.Popen(command,

716

close_fds=True,

717

shell=True, cwd="/",

718

**popen_args)

719

except OSError as error:

720

logger.error("Failed to start subprocess",

721

exc_info=error)

722

return True

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

727

# The checker may have completed before the gobject

728

# watch was added. Check for this.

729

try:

730

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

731

except OSError as error:

732

if error.errno == errno.ECHILD:

733

# This should never happen

734

logger.error("Child process vanished",

735

exc_info=error)

736

return True

737

raise

738

if pid:

739

gobject.source_remove(self.checker_callback_tag)

740

self.checker_callback(pid, status, command)

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

741

764

# Re-run this periodically if run by gobject.timeout_add

742

765

return True

743

766

749

772

if getattr(self, "checker", None) is None:

750

773

return

751

774

logger.debug("Stopping checker for %(name)s", vars(self))

752

try:

753

self.checker.terminate()

754

#time.sleep(0.5)

755

#if self.checker.poll() is None:

756

# self.checker.kill()

757

except OSError as error:

758

if error.errno != errno.ESRCH: # No such process

759

raise

775

self.checker.terminate()

760

776

self.checker = None

761

777

762

778

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

765

783

"""Decorators for marking methods of a DBusObjectWithProperties to

766

784

become properties on the D-Bus.

767

785

777

795

if byte_arrays and signature != "ay":

778

796

raise ValueError("Byte arrays not supported for non-'ay'"

779

797

" signature {!r}".format(signature))

798

780

799

def decorator(func):

781

800

func._dbus_is_property = True

782

801

func._dbus_interface = dbus_interface

787

806

func._dbus_name = func._dbus_name[:-14]

788

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

789

808

return func

809

790

810

return decorator

791

811

792

812

801

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

802

822

"false"}

803

823

"""

824

804

825

def decorator(func):

805

826

func._dbus_is_interface = True

806

827

func._dbus_interface = dbus_interface

807

828

func._dbus_name = dbus_interface

808

829

return func

830

809

831

return decorator

810

832

811

833

813

835

"""Decorator to annotate D-Bus methods, signals or properties

814

836

Usage:

815

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

816

841

@dbus_service_property("org.example.Interface", signature="b",

817

842

access="r")

818

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

819

"org.freedesktop.DBus.Property."

820

"EmitsChangedSignal": "false"})

821

843

def Property_dbus_property(self):

822

844

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

823

847

"""

848

824

849

def decorator(func):

825

850

func._dbus_annotations = annotations

826

851

return func

852

827

853

return decorator

828

854

829

855

832

858

"""

833

859

pass

834

860

861

835

862

class DBusPropertyAccessException(DBusPropertyException):

836

863

"""A property's access permissions disallows an operation.

837

864

"""

844

871

pass

845

872

846

873

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

849

876

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

853

879

"""

854

880

855

881

@staticmethod

865

891

def _get_all_dbus_things(self, thing):

866

892

"""Returns a generator of (name, attribute) pairs

867

893

"""

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

870

895

athing.__get__(self))

871

896

for cls in self.__class__.__mro__

872

897

for name, athing in

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

875

970

876

971

def _get_dbus_property(self, interface_name, property_name):

877

972

"""Returns a bound method if one exists which is a D-Bus

878

973

property with the specified name and interface.

879

974

"""

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

884

978

if (value._dbus_name == property_name

885

979

and value._dbus_interface == interface_name):

886

980

return value.__get__(self)

887

981

888

982

# No such property

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

892

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

894

997

out_signature="v")

895

998

def Get(self, interface_name, property_name):

896

999

"""Standard D-Bus property Get() method, see D-Bus standard.

921

1024

for byte in value))

922

1025

prop(value)

923

1026

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

925

1029

out_signature="a{sv}")

926

1030

def GetAll(self, interface_name):

927

1031

"""Standard D-Bus property GetAll() method, see D-Bus

942

1046

if not hasattr(value, "variant_level"):

943

1047

properties[name] = value

944

1048

continue

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

947

1051

return dbus.Dictionary(properties, signature="sv")

948

1052

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1054

def PropertiesChanged(self, interface_name, changed_properties,

1055

invalidated_properties):

1056

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1057

standard.

1058

"""

1059

pass

1060

949

1061

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

950

1062

out_signature="s",

951

1063

path_keyword='object_path',

955

1067

956

1068

Inserts property tags and interface annotation tags.

957

1069

"""

958

xmlstring = dbus.service.Object.Introspect(self, object_path,

959

connection)

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

960

1073

try:

961

1074

document = xml.dom.minidom.parseString(xmlstring)

1075

962

1076

def make_tag(document, name, prop):

963

1077

e = document.createElement("property")

964

1078

e.setAttribute("name", name)

965

1079

e.setAttribute("type", prop._dbus_signature)

966

1080

e.setAttribute("access", prop._dbus_access)

967

1081

return e

1082

968

1083

for if_tag in document.getElementsByTagName("interface"):

969

1084

# Add property tags

970

1085

for tag in (make_tag(document, name, prop)

973

1088

if prop._dbus_interface

974

1089

== if_tag.getAttribute("name")):

975

1090

if_tag.appendChild(tag)

976

# Add annotation tags

977

for typ in ("method", "signal", "property"):

978

for tag in if_tag.getElementsByTagName(typ):

979

annots = dict()

980

for name, prop in (self.

981

_get_all_dbus_things(typ)):

982

if (name == tag.getAttribute("name")

983

and prop._dbus_interface

984

== if_tag.getAttribute("name")):

985

annots.update(getattr

986

(prop,

987

"_dbus_annotations",

988

{}))

989

for name, value in annots.items():

990

ann_tag = document.createElement(

991

"annotation")

992

ann_tag.setAttribute("name", name)

993

ann_tag.setAttribute("value", value)

994

tag.appendChild(ann_tag)

995

# Add interface annotation tags

996

for annotation, value in dict(

997

itertools.chain.from_iterable(

998

annotations().items()

999

for name, annotations in

1000

self._get_all_dbus_things("interface")

1001

if name == if_tag.getAttribute("name")

1002

)).items():

1003

ann_tag = document.createElement("annotation")

1004

ann_tag.setAttribute("name", annotation)

1005

ann_tag.setAttribute("value", value)

1006

if_tag.appendChild(ann_tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

1007

1107

# Add the names to the return values for the

1008

1108

# "org.freedesktop.DBus.Properties" methods

1009

1109

if (if_tag.getAttribute("name")

1027

1127

exc_info=error)

1028

1128

return xmlstring

1029

1129

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1158

def InterfacesRemoved(self, object_path, interfaces):

1159

pass

1160

1161

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1162

out_signature = "s",

1163

path_keyword = 'object_path',

1164

connection_keyword = 'connection')

1165

def Introspect(self, object_path, connection):

1166

"""Overloading of standard D-Bus method.

1167

1168

Override return argument name of GetManagedObjects to be

1169

"objpath_interfaces_and_properties"

1170

"""

1171

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1172

object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1030

1198

1031

1199

def datetime_to_dbus(dt, variant_level=0):

1032

1200

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1033

1201

if dt is None:

1034

1202

return dbus.String("", variant_level = variant_level)

1035

return dbus.String(dt.isoformat(),

1036

variant_level=variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1037

1204

1038

1205

1039

1206

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1059

1226

(from DBusObjectWithProperties) and interfaces (from the

1060

1227

dbus_interface_annotations decorator).

1061

1228

"""

1229

1062

1230

def wrapper(cls):

1063

1231

for orig_interface_name, alt_interface_name in (

1064

alt_interface_names.items()):

1232

alt_interface_names.items()):

1065

1233

attr = {}

1066

1234

interface_names = set()

1067

1235

# Go though all attributes of the class

1069

1237

# Ignore non-D-Bus attributes, and D-Bus attributes

1070

1238

# with the wrong interface name

1071

1239

if (not hasattr(attribute, "_dbus_interface")

1072

or not attribute._dbus_interface

1073

.startswith(orig_interface_name)):

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1074

1242

continue

1075

1243

# Create an alternate D-Bus interface name based on

1076

1244

# the current name

1077

alt_interface = (attribute._dbus_interface

1078

.replace(orig_interface_name,

1079

alt_interface_name))

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1080

1247

interface_names.add(alt_interface)

1081

1248

# Is this a D-Bus signal?

1082

1249

if getattr(attribute, "_dbus_is_signal", False):

1083

# Extract the original non-method undecorated

1084

# function by black magic

1085

nonmethod_func = (dict(

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1086

1254

zip(attribute.func_code.co_freevars,

1087

attribute.__closure__))["func"]

1088

.cell_contents)

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1089

1259

# Create a new, but exactly alike, function

1090

1260

# object, and decorate it to be a new D-Bus signal

1091

1261

# with the alternate D-Bus interface name

1092

new_function = (dbus.service.signal

1093

(alt_interface,

1094

attribute._dbus_signature)

1095

(types.FunctionType(

1096

nonmethod_func.func_code,

1097

nonmethod_func.func_globals,

1098

nonmethod_func.func_name,

1099

nonmethod_func.func_defaults,

1100

nonmethod_func.func_closure)))

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1101

1279

# Copy annotations, if any

1102

1280

try:

1103

new_function._dbus_annotations = (

1104

dict(attribute._dbus_annotations))

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1105

1283

except AttributeError:

1106

1284

pass

1107

1285

# Define a creator of a function to call both the

1112

1290

"""This function is a scope container to pass

1113

1291

func1 and func2 to the "call_both" function

1114

1292

outside of its arguments"""

1293

1294

@functools.wraps(func2)

1115

1295

def call_both(*args, **kwargs):

1116

1296

"""This function will emit two D-Bus

1117

1297

signals by calling func1 and func2"""

1118

1298

func1(*args, **kwargs)

1119

1299

func2(*args, **kwargs)

1300

# Make wrapper function look like a D-Bus signal

1301

for name, attr in inspect.getmembers(func2):

1302

if name.startswith("_dbus_"):

1303

setattr(call_both, name, attr)

1304

1120

1305

return call_both

1121

1306

# Create the "call_both" function and add it to

1122

1307

# the class

1127

1312

# object. Decorate it to be a new D-Bus method

1128

1313

# with the alternate D-Bus interface name. Add it

1129

1314

# to the class.

1130

attr[attrname] = (dbus.service.method

1131

(alt_interface,

1132

attribute._dbus_in_signature,

1133

attribute._dbus_out_signature)

1134

(types.FunctionType

1135

(attribute.func_code,

1136

attribute.func_globals,

1137

attribute.func_name,

1138

attribute.func_defaults,

1139

attribute.func_closure)))

1315

attr[attrname] = (

1316

dbus.service.method(

1317

alt_interface,

1318

attribute._dbus_in_signature,

1319

attribute._dbus_out_signature)

1320

(types.FunctionType(attribute.func_code,

1321

attribute.func_globals,

1322

attribute.func_name,

1323

attribute.func_defaults,

1324

attribute.func_closure)))

1140

1325

# Copy annotations, if any

1141

1326

try:

1142

attr[attrname]._dbus_annotations = (

1143

dict(attribute._dbus_annotations))

1327

attr[attrname]._dbus_annotations = dict(

1328

attribute._dbus_annotations)

1144

1329

except AttributeError:

1145

1330

pass

1146

1331

# Is this a D-Bus property?

1149

1334

# object, and decorate it to be a new D-Bus

1150

1335

# property with the alternate D-Bus interface

1151

1336

# name. Add it to the class.

1152

attr[attrname] = (dbus_service_property

1153

(alt_interface,

1154

attribute._dbus_signature,

1155

attribute._dbus_access,

1156

attribute

1157

._dbus_get_args_options

1158

["byte_arrays"])

1159

(types.FunctionType

1160

(attribute.func_code,

1161

attribute.func_globals,

1162

attribute.func_name,

1163

attribute.func_defaults,

1164

attribute.func_closure)))

1337

attr[attrname] = (dbus_service_property(

1338

alt_interface, attribute._dbus_signature,

1339

attribute._dbus_access,

1340

attribute._dbus_get_args_options

1341

["byte_arrays"])

1342

(types.FunctionType(

1343

attribute.func_code,

1344

attribute.func_globals,

1345

attribute.func_name,

1346

attribute.func_defaults,

1347

attribute.func_closure)))

1165

1348

# Copy annotations, if any

1166

1349

try:

1167

attr[attrname]._dbus_annotations = (

1168

dict(attribute._dbus_annotations))

1350

attr[attrname]._dbus_annotations = dict(

1351

attribute._dbus_annotations)

1169

1352

except AttributeError:

1170

1353

pass

1171

1354

# Is this a D-Bus interface?

1174

1357

# object. Decorate it to be a new D-Bus interface

1175

1358

# with the alternate D-Bus interface name. Add it

1176

1359

# to the class.

1177

attr[attrname] = (dbus_interface_annotations

1178

(alt_interface)

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1360

attr[attrname] = (

1361

dbus_interface_annotations(alt_interface)

1362

(types.FunctionType(attribute.func_code,

1363

attribute.func_globals,

1364

attribute.func_name,

1365

attribute.func_defaults,

1366

attribute.func_closure)))

1185

1367

if deprecate:

1186

1368

# Deprecate all alternate interfaces

1187

1369

iname="_AlternateDBusNames_interface_annotation{}"

1188

1370

for interface_name in interface_names:

1371

1189

1372

@dbus_interface_annotations(interface_name)

1190

1373

def func(self):

1191

1374

return { "org.freedesktop.DBus.Deprecated":

1192

"true" }

1375

"true" }

1193

1376

# Find an unused name

1194

1377

for aname in (iname.format(i)

1195

1378

for i in itertools.count()):

1200

1383

# Replace the class with a new subclass of it with

1201

1384

# methods, signals, etc. as created above.

1202

1385

cls = type(b"{}Alternate".format(cls.__name__),

1203

(cls,), attr)

1386

(cls, ), attr)

1204

1387

return cls

1388

1205

1389

return wrapper

1206

1390

1207

1391

1208

1392

@alternate_dbus_interfaces({"se.recompile.Mandos":

1209

"se.bsnet.fukt.Mandos"})

1393

"se.bsnet.fukt.Mandos"})

1210

1394

class ClientDBus(Client, DBusObjectWithProperties):

1211

1395

"""A Client class using D-Bus

1212

1396

1216

1400

"""

1217

1401

1218

1402

runtime_expansions = (Client.runtime_expansions

1219

+ ("dbus_object_path",))

1403

+ ("dbus_object_path", ))

1404

1405

_interface = "se.recompile.Mandos.Client"

1220

1406

1221

1407

# dbus.service.Object doesn't use super(), so we can't either.

1222

1408

1228

1414

client_object_name = str(self.name).translate(

1229

1415

{ord("."): ord("_"),

1230

1416

ord("-"): ord("_")})

1231

self.dbus_object_path = (dbus.ObjectPath

1232

("/clients/" + client_object_name))

1417

self.dbus_object_path = dbus.ObjectPath(

1418

"/clients/" + client_object_name)

1233

1419

DBusObjectWithProperties.__init__(self, self.bus,

1234

1420

self.dbus_object_path)

1235

1421

1236

def notifychangeproperty(transform_func,

1237

dbus_name, type_func=lambda x: x,

1238

variant_level=1):

1422

def notifychangeproperty(transform_func, dbus_name,

1423

type_func=lambda x: x,

1424

variant_level=1,

1425

invalidate_only=False,

1426

_interface=_interface):

1239

1427

""" Modify a variable so that it's a property which announces

1240

1428

its changes to DBus.

1241

1429

1247

1435

variant_level: D-Bus variant level. Default: 1

1248

1436

"""

1249

1437

attrname = "_{}".format(dbus_name)

1438

1250

1439

def setter(self, value):

1251

1440

if hasattr(self, "dbus_object_path"):

1252

1441

if (not hasattr(self, attrname) or

1253

1442

type_func(getattr(self, attrname, None))

1254

1443

!= type_func(value)):

1255

dbus_value = transform_func(type_func(value),

1256

variant_level

1257

=variant_level)

1258

self.PropertyChanged(dbus.String(dbus_name),

1259

dbus_value)

1444

if invalidate_only:

1445

self.PropertiesChanged(

1446

_interface, dbus.Dictionary(),

1447

dbus.Array((dbus_name, )))

1448

else:

1449

dbus_value = transform_func(

1450

type_func(value),

1451

variant_level = variant_level)

1452

self.PropertyChanged(dbus.String(dbus_name),

1453

dbus_value)

1454

self.PropertiesChanged(

1455

_interface,

1456

dbus.Dictionary({ dbus.String(dbus_name):

1457

dbus_value }),

1458

dbus.Array())

1260

1459

setattr(self, attrname, value)

1261

1460

1262

1461

return property(lambda self: getattr(self, attrname), setter)

1268

1467

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1269

1468

last_enabled = notifychangeproperty(datetime_to_dbus,

1270

1469

"LastEnabled")

1271

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1272

type_func = lambda checker:

1273

checker is not None)

1470

checker = notifychangeproperty(

1471

dbus.Boolean, "CheckerRunning",

1472

type_func = lambda checker: checker is not None)

1274

1473

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1275

1474

"LastCheckedOK")

1276

1475

last_checker_status = notifychangeproperty(dbus.Int16,

1279

1478

datetime_to_dbus, "LastApprovalRequest")

1280

1479

approved_by_default = notifychangeproperty(dbus.Boolean,

1281

1480

"ApprovedByDefault")

1282

approval_delay = notifychangeproperty(dbus.UInt64,

1283

"ApprovalDelay",

1284

type_func =

1285

lambda td: td.total_seconds()

1286

* 1000)

1481

approval_delay = notifychangeproperty(

1482

dbus.UInt64, "ApprovalDelay",

1483

type_func = lambda td: td.total_seconds() * 1000)

1287

1484

approval_duration = notifychangeproperty(

1288

1485

dbus.UInt64, "ApprovalDuration",

1289

1486

type_func = lambda td: td.total_seconds() * 1000)

1290

1487

host = notifychangeproperty(dbus.String, "Host")

1291

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1292

type_func = lambda td:

1293

td.total_seconds() * 1000)

1488

timeout = notifychangeproperty(

1489

dbus.UInt64, "Timeout",

1490

type_func = lambda td: td.total_seconds() * 1000)

1294

1491

extended_timeout = notifychangeproperty(

1295

1492

dbus.UInt64, "ExtendedTimeout",

1296

1493

type_func = lambda td: td.total_seconds() * 1000)

1297

interval = notifychangeproperty(dbus.UInt64,

1298

"Interval",

1299

type_func =

1300

lambda td: td.total_seconds()

1301

* 1000)

1494

interval = notifychangeproperty(

1495

dbus.UInt64, "Interval",

1496

type_func = lambda td: td.total_seconds() * 1000)

1302

1497

checker_command = notifychangeproperty(dbus.String, "Checker")

1498

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1499

invalidate_only=True)

1303

1500

1304

1501

del notifychangeproperty

1305

1502

1312

1509

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1313

1510

Client.__del__(self, *args, **kwargs)

1314

1511

1315

def checker_callback(self, pid, condition, command,

1316

*args, **kwargs):

1317

self.checker_callback_tag = None

1318

self.checker = None

1319

if os.WIFEXITED(condition):

1320

exitstatus = os.WEXITSTATUS(condition)

1512

def checker_callback(self, source, condition,

1513

connection, command, *args, **kwargs):

1514

ret = Client.checker_callback(self, source, condition,

1515

connection, command, *args,

1516

**kwargs)

1517

exitstatus = self.last_checker_status

1518

if exitstatus >= 0:

1321

1519

# Emit D-Bus signal

1322

1520

self.CheckerCompleted(dbus.Int16(exitstatus),

1323

dbus.Int64(condition),

1521

# This is specific to GNU libC

1522

dbus.Int64(exitstatus << 8),

1324

1523

dbus.String(command))

1325

1524

else:

1326

1525

# Emit D-Bus signal

1327

1526

self.CheckerCompleted(dbus.Int16(-1),

1328

dbus.Int64(condition),

1527

dbus.Int64(

1528

# This is specific to GNU libC

1529

(exitstatus << 8)

1530

| self.last_checker_signal),

1329

1531

dbus.String(command))

1330

1331

return Client.checker_callback(self, pid, condition, command,

1332

*args, **kwargs)

1532

return ret

1333

1533

1334

1534

def start_checker(self, *args, **kwargs):

1335

1535

old_checker_pid = getattr(self.checker, "pid", None)

1352

1552

self.send_changedstate()

1353

1553

1354

1554

## D-Bus methods, signals & properties

1355

_interface = "se.recompile.Mandos.Client"

1356

1555

1357

1556

## Interfaces

1358

1557

1359

@dbus_interface_annotations(_interface)

1360

def _foo(self):

1361

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1362

"false"}

1363

1364

1558

## Signals

1365

1559

1366

1560

# CheckerCompleted - signal

1376

1570

pass

1377

1571

1378

1572

# PropertyChanged - signal

1573

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1379

1574

@dbus.service.signal(_interface, signature="sv")

1380

1575

def PropertyChanged(self, property, value):

1381

1576

"D-Bus signal"

1415

1610

self.checked_ok()

1416

1611

1417

1612

# Enable - method

1613

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1418

1614

@dbus.service.method(_interface)

1419

1615

def Enable(self):

1420

1616

"D-Bus method"

1421

1617

self.enable()

1422

1618

1423

1619

# StartChecker - method

1620

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1424

1621

@dbus.service.method(_interface)

1425

1622

def StartChecker(self):

1426

1623

"D-Bus method"

1427

1624

self.start_checker()

1428

1625

1429

1626

# Disable - method

1627

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1430

1628

@dbus.service.method(_interface)

1431

1629

def Disable(self):

1432

1630

"D-Bus method"

1433

1631

self.disable()

1434

1632

1435

1633

# StopChecker - method

1634

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1436

1635

@dbus.service.method(_interface)

1437

1636

def StopChecker(self):

1438

1637

self.stop_checker()

1445

1644

return dbus.Boolean(bool(self.approvals_pending))

1446

1645

1447

1646

# ApprovedByDefault - property

1448

@dbus_service_property(_interface, signature="b",

1647

@dbus_service_property(_interface,

1648

signature="b",

1449

1649

access="readwrite")

1450

1650

def ApprovedByDefault_dbus_property(self, value=None):

1451

1651

if value is None: # get

1453

1653

self.approved_by_default = bool(value)

1454

1654

1455

1655

# ApprovalDelay - property

1456

@dbus_service_property(_interface, signature="t",

1656

@dbus_service_property(_interface,

1657

signature="t",

1457

1658

access="readwrite")

1458

1659

def ApprovalDelay_dbus_property(self, value=None):

1459

1660

if value is None: # get

1462

1663

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1463

1664

1464

1665

# ApprovalDuration - property

1465

@dbus_service_property(_interface, signature="t",

1666

@dbus_service_property(_interface,

1667

signature="t",

1466

1668

access="readwrite")

1467

1669

def ApprovalDuration_dbus_property(self, value=None):

1468

1670

if value is None: # get

1471

1673

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1472

1674

1473

1675

# Name - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1474

1678

@dbus_service_property(_interface, signature="s", access="read")

1475

1679

def Name_dbus_property(self):

1476

1680

return dbus.String(self.name)

1477

1681

1478

1682

# Fingerprint - property

1683

@dbus_annotations(

1684

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1479

1685

@dbus_service_property(_interface, signature="s", access="read")

1480

1686

def Fingerprint_dbus_property(self):

1481

1687

return dbus.String(self.fingerprint)

1482

1688

1483

1689

# Host - property

1484

@dbus_service_property(_interface, signature="s",

1690

@dbus_service_property(_interface,

1691

signature="s",

1485

1692

access="readwrite")

1486

1693

def Host_dbus_property(self, value=None):

1487

1694

if value is None: # get

1489

1696

self.host = str(value)

1490

1697

1491

1698

# Created - property

1699

@dbus_annotations(

1700

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1492

1701

@dbus_service_property(_interface, signature="s", access="read")

1493

1702

def Created_dbus_property(self):

1494

1703

return datetime_to_dbus(self.created)

1499

1708

return datetime_to_dbus(self.last_enabled)

1500

1709

1501

1710

# Enabled - property

1502

@dbus_service_property(_interface, signature="b",

1711

@dbus_service_property(_interface,

1712

signature="b",

1503

1713

access="readwrite")

1504

1714

def Enabled_dbus_property(self, value=None):

1505

1715

if value is None: # get

1510

1720

self.disable()

1511

1721

1512

1722

# LastCheckedOK - property

1513

@dbus_service_property(_interface, signature="s",

1723

@dbus_service_property(_interface,

1724

signature="s",

1514

1725

access="readwrite")

1515

1726

def LastCheckedOK_dbus_property(self, value=None):

1516

1727

if value is not None:

1519

1730

return datetime_to_dbus(self.last_checked_ok)

1520

1731

1521

1732

# LastCheckerStatus - property

1522

@dbus_service_property(_interface, signature="n",

1523

access="read")

1733

@dbus_service_property(_interface, signature="n", access="read")

1524

1734

def LastCheckerStatus_dbus_property(self):

1525

1735

return dbus.Int16(self.last_checker_status)

1526

1736

1535

1745

return datetime_to_dbus(self.last_approval_request)

1536

1746

1537

1747

# Timeout - property

1538

@dbus_service_property(_interface, signature="t",

1748

@dbus_service_property(_interface,

1749

signature="t",

1539

1750

access="readwrite")

1540

1751

def Timeout_dbus_property(self, value=None):

1541

1752

if value is None: # get

1554

1765

is None):

1555

1766

return

1556

1767

gobject.source_remove(self.disable_initiator_tag)

1557

self.disable_initiator_tag = (

1558

gobject.timeout_add(

1559

int((self.expires - now).total_seconds()

1560

* 1000), self.disable))

1768

self.disable_initiator_tag = gobject.timeout_add(

1769

int((self.expires - now).total_seconds() * 1000),

1770

self.disable)

1561

1771

1562

1772

# ExtendedTimeout - property

1563

@dbus_service_property(_interface, signature="t",

1773

@dbus_service_property(_interface,

1774

signature="t",

1564

1775

access="readwrite")

1565

1776

def ExtendedTimeout_dbus_property(self, value=None):

1566

1777

if value is None: # get

1569

1780

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1570

1781

1571

1782

# Interval - property

1572

@dbus_service_property(_interface, signature="t",

1783

@dbus_service_property(_interface,

1784

signature="t",

1573

1785

access="readwrite")

1574

1786

def Interval_dbus_property(self, value=None):

1575

1787

if value is None: # get

1580

1792

if self.enabled:

1581

1793

# Reschedule checker run

1582

1794

gobject.source_remove(self.checker_initiator_tag)

1583

self.checker_initiator_tag = (gobject.timeout_add

1584

(value, self.start_checker))

1585

self.start_checker() # Start one now, too

1795

self.checker_initiator_tag = gobject.timeout_add(

1796

value, self.start_checker)

1797

self.start_checker() # Start one now, too

1586

1798

1587

1799

# Checker - property

1588

@dbus_service_property(_interface, signature="s",

1800

@dbus_service_property(_interface,

1801

signature="s",

1589

1802

access="readwrite")

1590

1803

def Checker_dbus_property(self, value=None):

1591

1804

if value is None: # get

1593

1806

self.checker_command = str(value)

1594

1807

1595

1808

# CheckerRunning - property

1596

@dbus_service_property(_interface, signature="b",

1809

@dbus_service_property(_interface,

1810

signature="b",

1597

1811

access="readwrite")

1598

1812

def CheckerRunning_dbus_property(self, value=None):

1599

1813

if value is None: # get

1604

1818

self.stop_checker()

1605

1819

1606

1820

# ObjectPath - property

1821

@dbus_annotations(

1822

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1823

"org.freedesktop.DBus.Deprecated": "true"})

1607

1824

@dbus_service_property(_interface, signature="o", access="read")

1608

1825

def ObjectPath_dbus_property(self):

1609

1826

return self.dbus_object_path # is already a dbus.ObjectPath

1610

1827

1611

1828

# Secret = property

1612

@dbus_service_property(_interface, signature="ay",

1613

access="write", byte_arrays=True)

1829

@dbus_annotations(

1830

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1831

"invalidates"})

1832

@dbus_service_property(_interface,

1833

signature="ay",

1834

access="write",

1835

byte_arrays=True)

1614

1836

def Secret_dbus_property(self, value):

1615

1837

self.secret = bytes(value)

1616

1838

1622

1844

self._pipe = child_pipe

1623

1845

self._pipe.send(('init', fpr, address))

1624

1846

if not self._pipe.recv():

1625

raise KeyError()

1847

raise KeyError(fpr)

1626

1848

1627

1849

def __getattribute__(self, name):

1628

1850

if name == '_pipe':

1632

1854

if data[0] == 'data':

1633

1855

return data[1]

1634

1856

if data[0] == 'function':

1857

1635

1858

def func(*args, **kwargs):

1636

1859

self._pipe.send(('funcall', name, args, kwargs))

1637

1860

return self._pipe.recv()[1]

1861

1638

1862

return func

1639

1863

1640

1864

def __setattr__(self, name, value):

1656

1880

logger.debug("Pipe FD: %d",

1657

1881

self.server.child_pipe.fileno())

1658

1882

1659

session = (gnutls.connection

1660

.ClientSession(self.request,

1661

gnutls.connection

1662

.X509Credentials()))

1883

session = gnutls.connection.ClientSession(

1884

self.request, gnutls.connection .X509Credentials())

1663

1885

1664

1886

# Note: gnutls.connection.X509Credentials is really a

1665

1887

# generic GnuTLS certificate credentials object so long as

1674

1896

priority = self.server.gnutls_priority

1675

1897

if priority is None:

1676

1898

priority = "NORMAL"

1677

(gnutls.library.functions

1678

.gnutls_priority_set_direct(session._c_object,

1679

priority, None))

1899

gnutls.library.functions.gnutls_priority_set_direct(

1900

session._c_object, priority, None)

1680

1901

1681

1902

# Start communication using the Mandos protocol

1682

1903

# Get protocol number

1702

1923

approval_required = False

1703

1924

try:

1704

1925

try:

1705

fpr = self.fingerprint(self.peer_certificate

1706

(session))

1926

fpr = self.fingerprint(

1927

self.peer_certificate(session))

1707

1928

except (TypeError,

1708

1929

gnutls.errors.GNUTLSError) as error:

1709

1930

logger.warning("Bad certificate: %s", error)

1724

1945

while True:

1725

1946

if not client.enabled:

1726

1947

logger.info("Client %s is disabled",

1727

client.name)

1948

client.name)

1728

1949

if self.server.use_dbus:

1729

1950

# Emit D-Bus signal

1730

1951

client.Rejected("Disabled")

1777

1998

logger.warning("gnutls send failed",

1778

1999

exc_info=error)

1779

2000

return

1780

logger.debug("Sent: %d, remaining: %d",

1781

sent, len(client.secret)

1782

- (sent_size + sent))

2001

logger.debug("Sent: %d, remaining: %d", sent,

2002

len(client.secret) - (sent_size

2003

+ sent))

1783

2004

sent_size += sent

1784

2005

1785

2006

logger.info("Sending secret to %s", client.name)

1802

2023

def peer_certificate(session):

1803

2024

"Return the peer's OpenPGP certificate as a bytestring"

1804

2025

# If not an OpenPGP certificate...

1805

if (gnutls.library.functions

1806

.gnutls_certificate_type_get(session._c_object)

2026

if (gnutls.library.functions.gnutls_certificate_type_get(

2027

session._c_object)

1807

2028

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1808

2029

# ...do the normal thing

1809

2030

return session.peer_certificate

1823

2044

def fingerprint(openpgp):

1824

2045

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1825

2046

# New GnuTLS "datum" with the OpenPGP public key

1826

datum = (gnutls.library.types

1827

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1828

ctypes.POINTER

1829

(ctypes.c_ubyte)),

1830

ctypes.c_uint(len(openpgp))))

2047

datum = gnutls.library.types.gnutls_datum_t(

2048

ctypes.cast(ctypes.c_char_p(openpgp),

2049

ctypes.POINTER(ctypes.c_ubyte)),

2050

ctypes.c_uint(len(openpgp)))

1831

2051

# New empty GnuTLS certificate

1832

2052

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2053

gnutls.library.functions.gnutls_openpgp_crt_init(

2054

ctypes.byref(crt))

1835

2055

# Import the OpenPGP public key into the certificate

1836

(gnutls.library.functions

1837

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1838

gnutls.library.constants

1839

.GNUTLS_OPENPGP_FMT_RAW))

2056

gnutls.library.functions.gnutls_openpgp_crt_import(

2057

crt, ctypes.byref(datum),

2058

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1840

2059

# Verify the self signature in the key

1841

2060

crtverify = ctypes.c_uint()

1842

(gnutls.library.functions

1843

.gnutls_openpgp_crt_verify_self(crt, 0,

1844

ctypes.byref(crtverify)))

2061

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2062

crt, 0, ctypes.byref(crtverify))

1845

2063

if crtverify.value != 0:

1846

2064

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1847

raise (gnutls.errors.CertificateSecurityError

1848

("Verify failed"))

2065

raise gnutls.errors.CertificateSecurityError(

2066

"Verify failed")

1849

2067

# New buffer for the fingerprint

1850

2068

buf = ctypes.create_string_buffer(20)

1851

2069

buf_len = ctypes.c_size_t()

1852

2070

# Get the fingerprint from the certificate into the buffer

1853

(gnutls.library.functions

1854

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1855

ctypes.byref(buf_len)))

2071

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2072

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1856

2073

# Deinit the certificate

1857

2074

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1858

2075

# Convert the buffer to a Python bytestring

1864

2081

1865

2082

class MultiprocessingMixIn(object):

1866

2083

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2084

1867

2085

def sub_process_main(self, request, address):

1868

2086

try:

1869

2087

self.finish_request(request, address)

1881

2099

1882

2100

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1883

2101

""" adds a pipe to the MixIn """

2102

1884

2103

def process_request(self, request, client_address):

1885

2104

"""Overrides and wraps the original process_request().

1886

2105

1907

2126

interface: None or a network interface name (string)

1908

2127

use_ipv6: Boolean; to use IPv6 or not

1909

2128

"""

2129

1910

2130

def __init__(self, server_address, RequestHandlerClass,

1911

interface=None, use_ipv6=True, socketfd=None):

2131

interface=None,

2132

use_ipv6=True,

2133

socketfd=None):

1912

2134

"""If socketfd is set, use that file descriptor instead of

1913

2135

creating a new one with socket.socket().

1914

2136

"""

1955

2177

self.interface)

1956

2178

else:

1957

2179

try:

1958

self.socket.setsockopt(socket.SOL_SOCKET,

1959

SO_BINDTODEVICE,

1960

(self.interface + "\0")

1961

.encode("utf-8"))

2180

self.socket.setsockopt(

2181

socket.SOL_SOCKET, SO_BINDTODEVICE,

2182

(self.interface + "\0").encode("utf-8"))

1962

2183

except socket.error as error:

1963

2184

if error.errno == errno.EPERM:

1964

2185

logger.error("No permission to bind to"

1982

2203

self.server_address = (any_address,

1983

2204

self.server_address[1])

1984

2205

elif not self.server_address[1]:

1985

self.server_address = (self.server_address[0],

1986

0)

2206

self.server_address = (self.server_address[0], 0)

1987

2207

# if self.interface:

1988

2208

# self.server_address = (self.server_address[0],

1989

2209

# 0, # port

2003

2223

2004

2224

Assumes a gobject.MainLoop event loop.

2005

2225

"""

2226

2006

2227

def __init__(self, server_address, RequestHandlerClass,

2007

interface=None, use_ipv6=True, clients=None,

2008

gnutls_priority=None, use_dbus=True, socketfd=None):

2228

interface=None,

2229

use_ipv6=True,

2230

clients=None,

2231

gnutls_priority=None,

2232

use_dbus=True,

2233

socketfd=None):

2009

2234

self.enabled = False

2010

2235

self.clients = clients

2011

2236

if self.clients is None:

2017

2242

interface = interface,

2018

2243

use_ipv6 = use_ipv6,

2019

2244

socketfd = socketfd)

2245

2020

2246

def server_activate(self):

2021

2247

if self.enabled:

2022

2248

return socketserver.TCPServer.server_activate(self)

2026

2252

2027

2253

def add_pipe(self, parent_pipe, proc):

2028

2254

# Call "handle_ipc" for both data and EOF events

2029

gobject.io_add_watch(parent_pipe.fileno(),

2030

gobject.IO_IN | gobject.IO_HUP,

2031

functools.partial(self.handle_ipc,

2032

parent_pipe =

2033

parent_pipe,

2034

proc = proc))

2255

gobject.io_add_watch(

2256

parent_pipe.fileno(),

2257

gobject.IO_IN | gobject.IO_HUP,

2258

functools.partial(self.handle_ipc,

2259

parent_pipe = parent_pipe,

2260

proc = proc))

2035

2261

2036

def handle_ipc(self, source, condition, parent_pipe=None,

2037

proc = None, client_object=None):

2262

def handle_ipc(self, source, condition,

2263

parent_pipe=None,

2264

proc = None,

2265

client_object=None):

2038

2266

# error, or the other end of multiprocessing.Pipe has closed

2039

2267

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2040

2268

# Wait for other process to exit

2063

2291

parent_pipe.send(False)

2064

2292

return False

2065

2293

2066

gobject.io_add_watch(parent_pipe.fileno(),

2067

gobject.IO_IN | gobject.IO_HUP,

2068

functools.partial(self.handle_ipc,

2069

parent_pipe =

2070

parent_pipe,

2071

proc = proc,

2072

client_object =

2073

client))

2294

gobject.io_add_watch(

2295

parent_pipe.fileno(),

2296

gobject.IO_IN | gobject.IO_HUP,

2297

functools.partial(self.handle_ipc,

2298

parent_pipe = parent_pipe,

2299

proc = proc,

2300

client_object = client))

2074

2301

parent_pipe.send(True)

2075

2302

# remove the old hook in favor of the new above hook on

2076

2303

# same fileno

2082

2309

2083

2310

parent_pipe.send(('data', getattr(client_object,

2084

2311

funcname)(*args,

2085

**kwargs)))

2312

**kwargs)))

2086

2313

2087

2314

if command == 'getattr':

2088

2315

attrname = request[1]

2089

if callable(client_object.__getattribute__(attrname)):

2090

parent_pipe.send(('function',))

2316

if isinstance(client_object.__getattribute__(attrname),

2317

collections.Callable):

2318

parent_pipe.send(('function', ))

2091

2319

else:

2092

parent_pipe.send(('data', client_object

2093

.__getattribute__(attrname)))

2320

parent_pipe.send((

2321

'data', client_object.__getattribute__(attrname)))

2094

2322

2095

2323

if command == 'setattr':

2096

2324

attrname = request[1]

2127

2355

# avoid excessive use of external libraries.

2128

2356

2129

2357

# New type for defining tokens, syntax, and semantics all-in-one

2130

Token = collections.namedtuple("Token",

2131

("regexp", # To match token; if

2132

# "value" is not None,

2133

# must have a "group"

2134

# containing digits

2135

"value", # datetime.timedelta or

2136

# None

2137

"followers")) # Tokens valid after

2138

# this token

2358

Token = collections.namedtuple("Token", (

2359

"regexp", # To match token; if "value" is not None, must have

2360

# a "group" containing digits

2361

"value", # datetime.timedelta or None

2362

"followers")) # Tokens valid after this token

2139

2363

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2140

2364

# the "duration" ABNF definition in RFC 3339, Appendix A.

2141

2365

token_end = Token(re.compile(r"$"), None, frozenset())

2142

2366

token_second = Token(re.compile(r"(\d+)S"),

2143

2367

datetime.timedelta(seconds=1),

2144

frozenset((token_end,)))

2368

frozenset((token_end, )))

2145

2369

token_minute = Token(re.compile(r"(\d+)M"),

2146

2370

datetime.timedelta(minutes=1),

2147

2371

frozenset((token_second, token_end)))

2163

2387

frozenset((token_month, token_end)))

2164

2388

token_week = Token(re.compile(r"(\d+)W"),

2165

2389

datetime.timedelta(weeks=1),

2166

frozenset((token_end,)))

2390

frozenset((token_end, )))

2167

2391

token_duration = Token(re.compile(r"P"), None,

2168

2392

frozenset((token_year, token_month,

2169

2393

token_day, token_time,

2171

2395

# Define starting values

2172

2396

value = datetime.timedelta() # Value so far

2173

2397

found_token = None

2174

followers = frozenset((token_duration,)) # Following valid tokens

2398

followers = frozenset((token_duration, )) # Following valid tokens

2175

2399

s = duration # String left to parse

2176

2400

# Loop until end token is found

2177

2401

while found_token is not token_end:

2194

2418

break

2195

2419

else:

2196

2420

# No currently valid tokens were found

2197

raise ValueError("Invalid RFC 3339 duration")

2421

raise ValueError("Invalid RFC 3339 duration: {!r}"

2422

.format(duration))

2198

2423

# End token found

2199

2424

return value

2200

2425

2237

2462

elif suffix == "w":

2238

2463

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2239

2464

else:

2240

raise ValueError("Unknown suffix {!r}"

2241

.format(suffix))

2465

raise ValueError("Unknown suffix {!r}".format(suffix))

2242

2466

except IndexError as e:

2243

2467

raise ValueError(*(e.args))

2244

2468

timevalue += delta

2260

2484

# Close all standard open file descriptors

2261

2485

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2262

2486

if not stat.S_ISCHR(os.fstat(null).st_mode):

2263

raise OSError(errno.ENODEV, "{} not a character device"

2487

raise OSError(errno.ENODEV,

2488

"{} not a character device"

2264

2489

.format(os.devnull))

2265

2490

os.dup2(null, sys.stdin.fileno())

2266

2491

os.dup2(null, sys.stdout.fileno())

2332

2557

"port": "",

2333

2558

"debug": "False",

2334

2559

"priority":

2335

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2560

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2561

":+SIGN-DSA-SHA256",

2336

2562

"servicename": "Mandos",

2337

2563

"use_dbus": "True",

2338

2564

"use_ipv6": "True",

2342

2568

"statedir": "/var/lib/mandos",

2343

2569

"foreground": "False",

2344

2570

"zeroconf": "True",

2345

}

2571

}

2346

2572

2347

2573

# Parse config file for server-global settings

2348

2574

server_config = configparser.SafeConfigParser(server_defaults)

2349

2575

del server_defaults

2350

server_config.read(os.path.join(options.configdir,

2351

"mandos.conf"))

2576

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2352

2577

# Convert the SafeConfigParser object to a dict

2353

2578

server_settings = server_config.defaults()

2354

2579

# Use the appropriate methods on the non-string config options

2372

2597

# Override the settings from the config file with command line

2373

2598

# options, if set.

2374

2599

for option in ("interface", "address", "port", "debug",

2375

"priority", "servicename", "configdir",

2376

"use_dbus", "use_ipv6", "debuglevel", "restore",

2377

"statedir", "socket", "foreground", "zeroconf"):

2600

"priority", "servicename", "configdir", "use_dbus",

2601

"use_ipv6", "debuglevel", "restore", "statedir",

2602

"socket", "foreground", "zeroconf"):

2378

2603

value = getattr(options, option)

2379

2604

if value is not None:

2380

2605

server_settings[option] = value

2395

2620

2396

2621

##################################################################

2397

2622

2398

if (not server_settings["zeroconf"] and

2399

not (server_settings["port"]

2400

or server_settings["socket"] != "")):

2401

parser.error("Needs port or socket to work without"

2402

" Zeroconf")

2623

if (not server_settings["zeroconf"]

2624

and not (server_settings["port"]

2625

or server_settings["socket"] != "")):

2626

parser.error("Needs port or socket to work without Zeroconf")

2403

2627

2404

2628

# For convenience

2405

2629

debug = server_settings["debug"]

2421

2645

initlogger(debug, level)

2422

2646

2423

2647

if server_settings["servicename"] != "Mandos":

2424

syslogger.setFormatter(logging.Formatter

2425

('Mandos ({}) [%(process)d]:'

2426

' %(levelname)s: %(message)s'

2427

.format(server_settings

2428

["servicename"])))

2648

syslogger.setFormatter(

2649

logging.Formatter('Mandos ({}) [%(process)d]:'

2650

' %(levelname)s: %(message)s'.format(

2651

server_settings["servicename"])))

2429

2652

2430

2653

# Parse config file with clients

2431

2654

client_config = configparser.SafeConfigParser(Client

2439

2662

socketfd = None

2440

2663

if server_settings["socket"] != "":

2441

2664

socketfd = server_settings["socket"]

2442

tcp_server = MandosServer((server_settings["address"],

2443

server_settings["port"]),

2444

ClientHandler,

2445

interface=(server_settings["interface"]

2446

or None),

2447

use_ipv6=use_ipv6,

2448

gnutls_priority=

2449

server_settings["priority"],

2450

use_dbus=use_dbus,

2451

socketfd=socketfd)

2665

tcp_server = MandosServer(

2666

(server_settings["address"], server_settings["port"]),

2667

ClientHandler,

2668

interface=(server_settings["interface"] or None),

2669

use_ipv6=use_ipv6,

2670

gnutls_priority=server_settings["priority"],

2671

use_dbus=use_dbus,

2672

socketfd=socketfd)

2452

2673

if not foreground:

2453

2674

pidfilename = "/run/mandos.pid"

2454

2675

if not os.path.isdir("/run/."):

2455

2676

pidfilename = "/var/run/mandos.pid"

2456

2677

pidfile = None

2457

2678

try:

2458

pidfile = open(pidfilename, "w")

2679

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2459

2680

except IOError as e:

2460

2681

logger.error("Could not open file %r", pidfilename,

2461

2682

exc_info=e)

2488

2709

def debug_gnutls(level, string):

2489

2710

logger.debug("GnuTLS: %s", string[:-1])

2490

2711

2491

(gnutls.library.functions

2492

.gnutls_global_set_log_function(debug_gnutls))

2712

gnutls.library.functions.gnutls_global_set_log_function(

2713

debug_gnutls)

2493

2714

2494

2715

# Redirect stdin so all checkers get /dev/null

2495

2716

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2515

2736

if use_dbus:

2516

2737

try:

2517

2738

bus_name = dbus.service.BusName("se.recompile.Mandos",

2518

bus, do_not_queue=True)

2519

old_bus_name = (dbus.service.BusName

2520

("se.bsnet.fukt.Mandos", bus,

2521

do_not_queue=True))

2522

except dbus.exceptions.NameExistsException as e:

2739

bus,

2740

do_not_queue=True)

2741

old_bus_name = dbus.service.BusName(

2742

"se.bsnet.fukt.Mandos", bus,

2743

do_not_queue=True)

2744

except dbus.exceptions.DBusException as e:

2523

2745

logger.error("Disabling D-Bus:", exc_info=e)

2524

2746

use_dbus = False

2525

2747

server_settings["use_dbus"] = False

2526

2748

tcp_server.use_dbus = False

2527

2749

if zeroconf:

2528

2750

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2529

service = AvahiServiceToSyslog(name =

2530

server_settings["servicename"],

2531

servicetype = "_mandos._tcp",

2532

protocol = protocol, bus = bus)

2751

service = AvahiServiceToSyslog(

2752

name = server_settings["servicename"],

2753

servicetype = "_mandos._tcp",

2754

protocol = protocol,

2755

bus = bus)

2533

2756

if server_settings["interface"]:

2534

service.interface = (if_nametoindex

2535

(server_settings["interface"]

2536

.encode("utf-8")))

2757

service.interface = if_nametoindex(

2758

server_settings["interface"].encode("utf-8"))

2537

2759

2538

2760

global multiprocessing_manager

2539

2761

multiprocessing_manager = multiprocessing.Manager()

2558

2780

if server_settings["restore"]:

2559

2781

try:

2560

2782

with open(stored_state_path, "rb") as stored_state:

2561

clients_data, old_client_settings = (pickle.load

2562

(stored_state))

2783

clients_data, old_client_settings = pickle.load(

2784

stored_state)

2563

2785

os.remove(stored_state_path)

2564

2786

except IOError as e:

2565

2787

if e.errno == errno.ENOENT:

2566

logger.warning("Could not load persistent state: {}"

2567

.format(os.strerror(e.errno)))

2788

logger.warning("Could not load persistent state:"

2789

" {}".format(os.strerror(e.errno)))

2568

2790

else:

2569

2791

logger.critical("Could not load persistent state:",

2570

2792

exc_info=e)

2571

2793

raise

2572

2794

except EOFError as e:

2573

2795

logger.warning("Could not load persistent state: "

2574

"EOFError:", exc_info=e)

2796

"EOFError:",

2797

exc_info=e)

2575

2798

2576

2799

with PGPEngine() as pgp:

2577

2800

for client_name, client in clients_data.items():

2589

2812

# For each value in new config, check if it

2590

2813

# differs from the old config value (Except for

2591

2814

# the "secret" attribute)

2592

if (name != "secret" and

2593

value != old_client_settings[client_name]

2594

[name]):

2815

if (name != "secret"

2816

and (value !=

2817

old_client_settings[client_name][name])):

2595

2818

client[name] = value

2596

2819

except KeyError:

2597

2820

pass

2598

2821

2599

2822

# Clients who has passed its expire date can still be

2600

# enabled if its last checker was successful. Clients

2823

# enabled if its last checker was successful. A Client

2601

2824

# whose checker succeeded before we stored its state is

2602

2825

# assumed to have successfully run all checkers during

2603

2826

# downtime.

2606

2829

if not client["last_checked_ok"]:

2607

2830

logger.warning(

2608

2831

"disabling client {} - Client never "

2609

"performed a successful checker"

2610

.format(client_name))

2832

"performed a successful checker".format(

2833

client_name))

2611

2834

client["enabled"] = False

2612

2835

elif client["last_checker_status"] != 0:

2613

2836

logger.warning(

2614

2837

"disabling client {} - Client last"

2615

" checker failed with error code {}"

2616

.format(client_name,

2617

client["last_checker_status"]))

2838

" checker failed with error code"

2839

" {}".format(

2840

client_name,

2841

client["last_checker_status"]))

2618

2842

client["enabled"] = False

2619

2843

else:

2620

client["expires"] = (datetime.datetime

2621

.utcnow()

2622

+ client["timeout"])

2844

client["expires"] = (

2845

datetime.datetime.utcnow()

2846

+ client["timeout"])

2623

2847

logger.debug("Last checker succeeded,"

2624

" keeping {} enabled"

2625

.format(client_name))

2848

" keeping {} enabled".format(

2849

client_name))

2626

2850

try:

2627

client["secret"] = (

2628

pgp.decrypt(client["encrypted_secret"],

2629

client_settings[client_name]

2630

["secret"]))

2851

client["secret"] = pgp.decrypt(

2852

client["encrypted_secret"],

2853

client_settings[client_name]["secret"])

2631

2854

except PGPError:

2632

2855

# If decryption fails, we use secret from new settings

2633

logger.debug("Failed to decrypt {} old secret"

2634

.format(client_name))

2635

client["secret"] = (

2636

client_settings[client_name]["secret"])

2856

logger.debug("Failed to decrypt {} old secret".format(

2857

client_name))

2858

client["secret"] = (client_settings[client_name]

2859

["secret"])

2637

2860

2638

2861

# Add/remove clients based on new changes made to config

2639

2862

for client_name in (set(old_client_settings)

2646

2869

# Create all client objects

2647

2870

for client_name, client in clients_data.items():

2648

2871

tcp_server.clients[client_name] = client_class(

2649

name = client_name, settings = client,

2872

name = client_name,

2873

settings = client,

2650

2874

server_settings = server_settings)

2651

2875

2652

2876

if not tcp_server.clients:

2654

2878

2655

2879

if not foreground:

2656

2880

if pidfile is not None:

2881

pid = os.getpid()

2657

2882

try:

2658

2883

with pidfile:

2659

pid = os.getpid()

2660

pidfile.write("{}\n".format(pid).encode("utf-8"))

2884

print(pid, file=pidfile)

2661

2885

except IOError:

2662

2886

logger.error("Could not write to file %r with PID %d",

2663

2887

pidfilename, pid)

2668

2892

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2669

2893

2670

2894

if use_dbus:

2671

@alternate_dbus_interfaces({"se.recompile.Mandos":

2672

"se.bsnet.fukt.Mandos"})

2673

class MandosDBusService(DBusObjectWithProperties):

2895

2896

@alternate_dbus_interfaces(

2897

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2898

class MandosDBusService(DBusObjectWithObjectManager):

2674

2899

"""A D-Bus proxy object"""

2900

2675

2901

def __init__(self):

2676

2902

dbus.service.Object.__init__(self, bus, "/")

2903

2677

2904

_interface = "se.recompile.Mandos"

2678

2905

2679

@dbus_interface_annotations(_interface)

2680

def _foo(self):

2681

return { "org.freedesktop.DBus.Property"

2682

".EmitsChangedSignal":

2683

"false"}

2684

2685

2906

@dbus.service.signal(_interface, signature="o")

2686

2907

def ClientAdded(self, objpath):

2687

2908

"D-Bus signal"

2692

2913

"D-Bus signal"

2693

2914

pass

2694

2915

2916

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2917

"true"})

2695

2918

@dbus.service.signal(_interface, signature="os")

2696

2919

def ClientRemoved(self, objpath, name):

2697

2920

"D-Bus signal"

2698

2921

pass

2699

2922

2923

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2924

"true"})

2700

2925

@dbus.service.method(_interface, out_signature="ao")

2701

2926

def GetAllClients(self):

2702

2927

"D-Bus method"

2703

return dbus.Array(c.dbus_object_path

2704

for c in

2928

return dbus.Array(c.dbus_object_path for c in

2705

2929

tcp_server.clients.itervalues())

2706

2930

2931

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2932

"true"})

2707

2933

@dbus.service.method(_interface,

2708

2934

out_signature="a{oa{sv}}")

2709

2935

def GetAllClientsWithProperties(self):

2710

2936

"D-Bus method"

2711

2937

return dbus.Dictionary(

2712

((c.dbus_object_path, c.GetAll(""))

2713

for c in tcp_server.clients.itervalues()),

2938

{ c.dbus_object_path: c.GetAll(

2939

"se.recompile.Mandos.Client")

2940

for c in tcp_server.clients.itervalues() },

2714

2941

signature="oa{sv}")

2715

2942

2716

2943

@dbus.service.method(_interface, in_signature="o")

2720

2947

if c.dbus_object_path == object_path:

2721

2948

del tcp_server.clients[c.name]

2722

2949

c.remove_from_connection()

2723

# Don't signal anything except ClientRemoved

2950

# Don't signal the disabling

2724

2951

c.disable(quiet=True)

2725

# Emit D-Bus signal

2726

self.ClientRemoved(object_path, c.name)

2952

# Emit D-Bus signal for removal

2953

self.client_removed_signal(c)

2727

2954

return

2728

2955

raise KeyError(object_path)

2729

2956

2730

2957

del _interface

2958

2959

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2960

out_signature = "a{oa{sa{sv}}}")

2961

def GetManagedObjects(self):

2962

"""D-Bus method"""

2963

return dbus.Dictionary(

2964

{ client.dbus_object_path:

2965

dbus.Dictionary(

2966

{ interface: client.GetAll(interface)

2967

for interface in

2968

client._get_all_interface_names()})

2969

for client in tcp_server.clients.values()})

2970

2971

def client_added_signal(self, client):

2972

"""Send the new standard signal and the old signal"""

2973

if use_dbus:

2974

# New standard signal

2975

self.InterfacesAdded(

2976

client.dbus_object_path,

2977

dbus.Dictionary(

2978

{ interface: client.GetAll(interface)

2979

for interface in

2980

client._get_all_interface_names()}))

2981

# Old signal

2982

self.ClientAdded(client.dbus_object_path)

2983

2984

def client_removed_signal(self, client):

2985

"""Send the new standard signal and the old signal"""

2986

if use_dbus:

2987

# New standard signal

2988

self.InterfacesRemoved(

2989

client.dbus_object_path,

2990

client._get_all_interface_names())

2991

# Old signal

2992

self.ClientRemoved(client.dbus_object_path,

2993

client.name)

2731

2994

2732

2995

mandos_dbus_service = MandosDBusService()

2733

2996

2756

3019

# + secret.

2757

3020

exclude = { "bus", "changedstate", "secret",

2758

3021

"checker", "server_settings" }

2759

for name, typ in (inspect.getmembers

2760

(dbus.service.Object)):

3022

for name, typ in inspect.getmembers(dbus.service

3023

.Object):

2761

3024

exclude.add(name)

2762

3025

2763

3026

client_dict["encrypted_secret"] = (client

2770

3033

del client_settings[client.name]["secret"]

2771

3034

2772

3035

try:

2773

with (tempfile.NamedTemporaryFile

2774

(mode='wb', suffix=".pickle", prefix='clients-',

2775

dir=os.path.dirname(stored_state_path),

2776

delete=False)) as stored_state:

3036

with tempfile.NamedTemporaryFile(

3037

mode='wb',

3038

suffix=".pickle",

3039

prefix='clients-',

3040

dir=os.path.dirname(stored_state_path),

3041

delete=False) as stored_state:

2777

3042

pickle.dump((clients, client_settings), stored_state)

2778

tempname=stored_state.name

3043

tempname = stored_state.name

2779

3044

os.rename(tempname, stored_state_path)

2780

3045

except (IOError, OSError) as e:

2781

3046

if not debug:

2796

3061

name, client = tcp_server.clients.popitem()

2797

3062

if use_dbus:

2798

3063

client.remove_from_connection()

2799

# Don't signal anything except ClientRemoved

3064

# Don't signal the disabling

2800

3065

client.disable(quiet=True)

2801

if use_dbus:

2802

# Emit D-Bus signal

2803

mandos_dbus_service.ClientRemoved(client

2804

.dbus_object_path,

2805

client.name)

3066

# Emit D-Bus signal for removal

3067

mandos_dbus_service.client_removed_signal(client)

2806

3068

client_settings.clear()

2807

3069

2808

3070

atexit.register(cleanup)

2809

3071

2810

3072

for client in tcp_server.clients.itervalues():

2811

3073

if use_dbus:

2812

# Emit D-Bus signal

2813

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3074

# Emit D-Bus signal for adding

3075

mandos_dbus_service.client_added_signal(client)

2814

3076

# Need to initiate checking of clients

2815

3077

if client.enabled:

2816

3078

client.init_checker()

2861

3123

# Must run before the D-Bus bus name gets deregistered

2862

3124

cleanup()

2863

3125

3126

2864

3127

if __name__ == '__main__':

2865

3128

main()