/mandos/trunk : revision 821

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

43

46

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

import cPickle as pickle

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

66

69

import multiprocessing

67

70

import types

68

71

import binascii

69

72

import tempfile

70

73

import itertools

71

74

import collections

75

import codecs

72

76

73

77

import dbus

74

78

import dbus.service

75

import gobject

79

try:

80

from gi.repository import GObject

81

except ImportError:

82

import gobject as GObject

76

83

import avahi

77

84

from dbus.mainloop.glib import DBusGMainLoop

78

85

import ctypes

91

98

if sys.version_info.major == 2:

92

99

str = unicode

93

100

94

version = "1.6.9"

101

version = "1.7.3"

95

102

stored_state_file = "clients.pickle"

96

103

97

104

logger = logging.getLogger()

98

105

syslogger = None

99

106

100

107

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

104

110

except (OSError, AttributeError):

111

105

112

def if_nametoindex(interface):

106

113

"Get an interface index the hard way, i.e. using fcntl()"

107

114

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

116

123

"""init logger and add loglevel"""

117

124

118

125

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

123

129

syslogger.setFormatter(logging.Formatter

124

130

('Mandos [%(process)d]: %(levelname)s:'

125

131

' %(message)s'))

142

148

143

149

class PGPEngine(object):

144

150

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

145

152

def __init__(self):

146

153

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

self.gpg = "gpg"

155

try:

156

output = subprocess.check_output(["gpgconf"])

157

for line in output.splitlines():

158

name, text, path = line.split(":")

159

if name == "gpg":

160

self.gpg = path

161

break

162

except OSError as e:

163

if e.errno != errno.ENOENT:

164

raise

147

165

self.gnupgargs = ['--batch',

148

'--home', self.tempdir,

166

'--homedir', self.tempdir,

149

167

'--force-mdc',

150

168

'--quiet',

151

169

'--no-use-agent']

186

204

187

205

def encrypt(self, data, password):

188

206

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

207

with tempfile.NamedTemporaryFile(

208

dir=self.tempdir) as passfile:

191

209

passfile.write(passphrase)

192

210

passfile.flush()

193

proc = subprocess.Popen(['gpg', '--symmetric',

211

proc = subprocess.Popen([self.gpg, '--symmetric',

194

212

'--passphrase-file',

195

213

passfile.name]

196

214

+ self.gnupgargs,

204

222

205

223

def decrypt(self, data, password):

206

224

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

225

with tempfile.NamedTemporaryFile(

226

dir = self.tempdir) as passfile:

209

227

passfile.write(passphrase)

210

228

passfile.flush()

211

proc = subprocess.Popen(['gpg', '--decrypt',

229

proc = subprocess.Popen([self.gpg, '--decrypt',

212

230

'--passphrase-file',

213

231

passfile.name]

214

232

+ self.gnupgargs,

215

233

stdin = subprocess.PIPE,

216

234

stdout = subprocess.PIPE,

217

235

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

236

decrypted_plaintext, err = proc.communicate(input = data)

220

237

if proc.returncode != 0:

221

238

raise PGPError(err)

222

239

return decrypted_plaintext

228

245

return super(AvahiError, self).__init__(value, *args,

229

246

**kwargs)

230

247

248

231

249

class AvahiServiceError(AvahiError):

232

250

pass

233

251

252

234

253

class AvahiGroupError(AvahiError):

235

254

pass

236

255

256

275

bus: dbus.SystemBus()

257

276

"""

258

277

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

278

def __init__(self,

279

interface = avahi.IF_UNSPEC,

280

name = None,

281

servicetype = None,

282

port = None,

283

TXT = None,

284

domain = "",

285

host = "",

286

max_renames = 32768,

287

protocol = avahi.PROTO_UNSPEC,

288

bus = None):

263

289

self.interface = interface

264

290

self.name = name

265

291

self.type = servicetype

282

308

" after %i retries, exiting.",

283

309

self.rename_count)

284

310

raise AvahiServiceError("Too many renames")

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

311

self.name = str(

312

self.server.GetAlternativeServiceName(self.name))

287

313

self.rename_count += 1

288

314

logger.info("Changing Zeroconf service name to %r ...",

289

315

self.name)

344

370

elif state == avahi.ENTRY_GROUP_FAILURE:

345

371

logger.critical("Avahi: Error in group state changed %s",

346

372

str(error))

347

raise AvahiGroupError("State changed: {!s}"

348

.format(error))

373

raise AvahiGroupError("State changed: {!s}".format(error))

349

374

350

375

def cleanup(self):

351

376

"""Derived from the Avahi example code"""

361

386

def server_state_changed(self, state, error=None):

362

387

"""Derived from the Avahi example code"""

363

388

logger.debug("Avahi server state change: %i", state)

364

bad_states = { avahi.SERVER_INVALID:

365

"Zeroconf server invalid",

366

avahi.SERVER_REGISTERING: None,

367

avahi.SERVER_COLLISION:

368

"Zeroconf server name collision",

369

avahi.SERVER_FAILURE:

370

"Zeroconf server failure" }

389

bad_states = {

390

avahi.SERVER_INVALID: "Zeroconf server invalid",

391

avahi.SERVER_REGISTERING: None,

392

avahi.SERVER_COLLISION: "Zeroconf server name collision",

393

avahi.SERVER_FAILURE: "Zeroconf server failure",

394

}

371

395

if state in bad_states:

372

396

if bad_states[state] is not None:

373

397

if error is None:

376

400

logger.error(bad_states[state] + ": %r", error)

377

401

self.cleanup()

378

402

elif state == avahi.SERVER_RUNNING:

379

self.add()

403

try:

404

self.add()

405

except dbus.exceptions.DBusException as error:

406

if (error.get_dbus_name()

407

== "org.freedesktop.Avahi.CollisionError"):

408

logger.info("Local Zeroconf service name"

409

" collision.")

410

return self.rename(remove=False)

411

else:

412

logger.critical("D-Bus Exception", exc_info=error)

413

self.cleanup()

414

os._exit(1)

380

415

else:

381

416

if error is None:

382

417

logger.debug("Unknown state: %r", state)

392

427

follow_name_owner_changes=True),

393

428

avahi.DBUS_INTERFACE_SERVER)

394

429

self.server.connect_to_signal("StateChanged",

395

self.server_state_changed)

430

self.server_state_changed)

396

431

self.server_state_changed(self.server.GetState())

397

432

398

433

400

435

def rename(self, *args, **kwargs):

401

436

"""Add the new name to the syslog messages"""

402

437

ret = AvahiService.rename(self, *args, **kwargs)

403

syslogger.setFormatter(logging.Formatter

404

('Mandos ({}) [%(process)d]:'

405

' %(levelname)s: %(message)s'

406

.format(self.name)))

438

syslogger.setFormatter(logging.Formatter(

439

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

440

.format(self.name)))

407

441

return ret

408

442

443

# Pretend that we have a GnuTLS module

444

class GnuTLS(object):

445

"""This isn't so much a class as it is a module-like namespace.

446

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

451

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

459

# Unless otherwise indicated, the constants and types below are

460

# all from the gnutls/gnutls.h C header file.

461

462

# Constants

463

E_SUCCESS = 0

464

E_INTERRUPTED = -52

465

E_AGAIN = -28

466

CRT_OPENPGP = 2

467

CLIENT = 2

468

SHUT_RDWR = 0

469

CRD_CERTIFICATE = 1

470

E_NO_CERTIFICATE_FOUND = -49

471

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

473

# Types

474

class session_int(ctypes.Structure):

475

_fields_ = []

476

session_t = ctypes.POINTER(session_int)

477

class certificate_credentials_st(ctypes.Structure):

478

_fields_ = []

479

certificate_credentials_t = ctypes.POINTER(

480

certificate_credentials_st)

481

certificate_type_t = ctypes.c_int

482

class datum_t(ctypes.Structure):

483

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

('size', ctypes.c_uint)]

485

class openpgp_crt_int(ctypes.Structure):

486

_fields_ = []

487

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int #

491

transport_ptr_t = ctypes.c_void_p

492

close_request_t = ctypes.c_int

493

494

# Exceptions

495

class Error(Exception):

496

# We need to use the class name "GnuTLS" here, since this

497

# exception might be raised from within GnuTLS.__init__,

498

# which is called before the assignment to the "gnutls"

499

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

501

# Default usage is by a message string, but if a return

502

# code is passed, convert it to a string with

503

# gnutls.strerror()

504

self.code = code

505

if message is None and code is not None:

506

message = GnuTLS.strerror(code)

507

return super(GnuTLS.Error, self).__init__(

508

message, *args)

509

510

class CertificateSecurityError(Error):

511

pass

512

513

# Classes

514

class Credentials(object):

515

def __init__(self):

516

self._c_object = gnutls.certificate_credentials_t()

517

gnutls.certificate_allocate_credentials(

518

ctypes.byref(self._c_object))

519

self.type = gnutls.CRD_CERTIFICATE

520

521

def __del__(self):

522

gnutls.certificate_free_credentials(self._c_object)

523

524

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

526

self._c_object = gnutls.session_t()

527

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

gnutls.set_default_priority(self._c_object)

529

gnutls.transport_set_ptr(self._c_object, socket.fileno())

530

gnutls.handshake_set_private_extensions(self._c_object,

531

True)

532

self.socket = socket

533

if credentials is None:

534

credentials = gnutls.Credentials()

535

gnutls.credentials_set(self._c_object, credentials.type,

536

ctypes.cast(credentials._c_object,

537

ctypes.c_void_p))

538

self.credentials = credentials

539

540

def __del__(self):

541

gnutls.deinit(self._c_object)

542

543

def handshake(self):

544

return gnutls.handshake(self._c_object)

545

546

def send(self, data):

547

data = bytes(data)

548

data_len = len(data)

549

while data_len > 0:

550

data_len -= gnutls.record_send(self._c_object,

551

data[-data_len:],

552

data_len)

553

554

def bye(self):

555

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

557

# Error handling functions

558

def _error_code(result):

559

"""A function to raise exceptions on errors, suitable

560

for the 'restype' attribute on ctypes functions"""

561

if result >= 0:

562

return result

563

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

567

def _retry_on_error(result, func, arguments):

568

"""A function to retry on some errors, suitable

569

for the 'errcheck' attribute on ctypes functions"""

570

while result < 0:

571

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

572

return _error_code(result)

573

result = func(*arguments)

574

return result

575

576

# Unless otherwise indicated, the function declarations below are

577

# all from the gnutls/gnutls.h C header file.

578

579

# Functions

580

priority_set_direct = _library.gnutls_priority_set_direct

581

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

ctypes.POINTER(ctypes.c_char_p)]

583

priority_set_direct.restype = _error_code

584

585

init = _library.gnutls_init

586

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

init.restype = _error_code

588

589

set_default_priority = _library.gnutls_set_default_priority

590

set_default_priority.argtypes = [session_t]

591

set_default_priority.restype = _error_code

592

593

record_send = _library.gnutls_record_send

594

record_send.argtypes = [session_t, ctypes.c_void_p,

595

ctypes.c_size_t]

596

record_send.restype = ctypes.c_ssize_t

597

record_send.errcheck = _retry_on_error

598

599

certificate_allocate_credentials = (

600

_library.gnutls_certificate_allocate_credentials)

601

certificate_allocate_credentials.argtypes = [

602

ctypes.POINTER(certificate_credentials_t)]

603

certificate_allocate_credentials.restype = _error_code

604

605

certificate_free_credentials = (

606

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

608

certificate_free_credentials.restype = None

609

610

handshake_set_private_extensions = (

611

_library.gnutls_handshake_set_private_extensions)

612

handshake_set_private_extensions.argtypes = [session_t,

613

ctypes.c_int]

614

handshake_set_private_extensions.restype = None

615

616

credentials_set = _library.gnutls_credentials_set

617

credentials_set.argtypes = [session_t, credentials_type_t,

618

ctypes.c_void_p]

619

credentials_set.restype = _error_code

620

621

strerror = _library.gnutls_strerror

622

strerror.argtypes = [ctypes.c_int]

623

strerror.restype = ctypes.c_char_p

624

625

certificate_type_get = _library.gnutls_certificate_type_get

626

certificate_type_get.argtypes = [session_t]

627

certificate_type_get.restype = _error_code

628

629

certificate_get_peers = _library.gnutls_certificate_get_peers

630

certificate_get_peers.argtypes = [session_t,

631

ctypes.POINTER(ctypes.c_uint)]

632

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

634

global_set_log_level = _library.gnutls_global_set_log_level

635

global_set_log_level.argtypes = [ctypes.c_int]

636

global_set_log_level.restype = None

637

638

global_set_log_function = _library.gnutls_global_set_log_function

639

global_set_log_function.argtypes = [log_func]

640

global_set_log_function.restype = None

641

642

deinit = _library.gnutls_deinit

643

deinit.argtypes = [session_t]

644

deinit.restype = None

645

646

handshake = _library.gnutls_handshake

647

handshake.argtypes = [session_t]

648

handshake.restype = _error_code

649

handshake.errcheck = _retry_on_error

650

651

transport_set_ptr = _library.gnutls_transport_set_ptr

652

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

transport_set_ptr.restype = None

654

655

bye = _library.gnutls_bye

656

bye.argtypes = [session_t, close_request_t]

657

bye.restype = _error_code

658

bye.errcheck = _retry_on_error

659

660

check_version = _library.gnutls_check_version

661

check_version.argtypes = [ctypes.c_char_p]

662

check_version.restype = ctypes.c_char_p

663

664

# All the function declarations below are from gnutls/openpgp.h

665

666

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

openpgp_crt_init.restype = _error_code

669

670

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

ctypes.POINTER(datum_t),

673

openpgp_crt_fmt_t]

674

openpgp_crt_import.restype = _error_code

675

676

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

ctypes.POINTER(ctypes.c_uint)]

679

openpgp_crt_verify_self.restype = _error_code

680

681

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

openpgp_crt_deinit.restype = None

684

685

openpgp_crt_get_fingerprint = (

686

_library.gnutls_openpgp_crt_get_fingerprint)

687

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

688

ctypes.c_void_p,

689

ctypes.POINTER(

690

ctypes.c_size_t)]

691

openpgp_crt_get_fingerprint.restype = _error_code

692

693

# Remove non-public functions

694

del _error_code, _retry_on_error

695

# Create the global "gnutls" object, simulating a module

696

gnutls = GnuTLS()

697

698

def call_pipe(connection, # : multiprocessing.Connection

699

func, *args, **kwargs):

700

"""This function is meant to be called by multiprocessing.Process

701

702

This function runs func(*args, **kwargs), and writes the resulting

703

return value on the provided multiprocessing.Connection.

704

"""

705

connection.send(func(*args, **kwargs))

706

connection.close()

409

707

410

708

class Client(object):

411

709

"""A representation of a client host served by this server.

417

715

checker: subprocess.Popen(); a running checker process used

418

716

to see if the client lives.

419

717

'None' if no process is running.

420

checker_callback_tag: a gobject event source tag, or None

718

checker_callback_tag: a GObject event source tag, or None

421

719

checker_command: string; External command which is run to check

422

720

if client lives. %() expansions are done at

423

721

runtime with vars(self) as dict, so that for

424

722

instance %(name)s can be used in the command.

425

checker_initiator_tag: a gobject event source tag, or None

723

checker_initiator_tag: a GObject event source tag, or None

426

724

created: datetime.datetime(); (UTC) object creation

427

725

client_structure: Object describing what attributes a client has

428

726

and is used for storing the client at exit

429

727

current_checker_command: string; current running checker_command

430

disable_initiator_tag: a gobject event source tag, or None

728

disable_initiator_tag: a GObject event source tag, or None

431

729

enabled: bool()

432

730

fingerprint: string (40 or 32 hexadecimal digits); used to

433

731

uniquely identify the client

438

736

last_checker_status: integer between 0 and 255 reflecting exit

439

737

status of last checker. -1 reflects crashed

440

738

checker, -2 means no checker completed yet.

739

last_checker_signal: The signal which killed the last checker, if

740

last_checker_status is -1

441

741

last_enabled: datetime.datetime(); (UTC) or None

442

742

name: string; from the config file, used in log messages and

443

743

D-Bus identifiers

456

756

"fingerprint", "host", "interval",

457

757

"last_approval_request", "last_checked_ok",

458

758

"last_enabled", "name", "timeout")

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

759

client_defaults = {

760

"timeout": "PT5M",

761

"extended_timeout": "PT15M",

762

"interval": "PT2M",

763

"checker": "fping -q -- %%(host)s",

764

"host": "",

765

"approval_delay": "PT0S",

766

"approval_duration": "PT1S",

767

"approved_by_default": "True",

768

"enabled": "True",

769

}

469

770

470

771

@staticmethod

471

772

def config_parser(config):

487

788

client["enabled"] = config.getboolean(client_name,

488

789

"enabled")

489

790

791

# Uppercase and remove spaces from fingerprint for later

792

# comparison purposes with return value from the

793

# fingerprint() function

490

794

client["fingerprint"] = (section["fingerprint"].upper()

491

795

.replace(" ", ""))

492

796

if "secret" in section:

534

838

self.expires = None

535

839

536

840

logger.debug("Creating client %r", self.name)

537

# Uppercase and remove spaces from fingerprint for later

538

# comparison purposes with return value from the fingerprint()

539

# function

540

841

logger.debug(" Fingerprint: %s", self.fingerprint)

541

842

self.created = settings.get("created",

542

843

datetime.datetime.utcnow())

549

850

self.current_checker_command = None

550

851

self.approved = None

551

852

self.approvals_pending = 0

552

self.changedstate = (multiprocessing_manager

553

.Condition(multiprocessing_manager

554

.Lock()))

555

self.client_structure = [attr for attr in

556

self.__dict__.iterkeys()

853

self.changedstate = multiprocessing_manager.Condition(

854

multiprocessing_manager.Lock())

855

self.client_structure = [attr

856

for attr in self.__dict__.iterkeys()

557

857

if not attr.startswith("_")]

558

858

self.client_structure.append("client_structure")

559

859

560

for name, t in inspect.getmembers(type(self),

561

lambda obj:

562

isinstance(obj,

563

property)):

860

for name, t in inspect.getmembers(

861

type(self), lambda obj: isinstance(obj, property)):

564

862

if not name.startswith("_"):

565

863

self.client_structure.append(name)

566

864

587

885

if not quiet:

588

886

logger.info("Disabling client %s", self.name)

589

887

if getattr(self, "disable_initiator_tag", None) is not None:

590

gobject.source_remove(self.disable_initiator_tag)

888

GObject.source_remove(self.disable_initiator_tag)

591

889

self.disable_initiator_tag = None

592

890

self.expires = None

593

891

if getattr(self, "checker_initiator_tag", None) is not None:

594

gobject.source_remove(self.checker_initiator_tag)

892

GObject.source_remove(self.checker_initiator_tag)

595

893

self.checker_initiator_tag = None

596

894

self.stop_checker()

597

895

self.enabled = False

598

896

if not quiet:

599

897

self.send_changedstate()

600

# Do not run this again if called by a gobject.timeout_add

898

# Do not run this again if called by a GObject.timeout_add

601

899

return False

602

900

603

901

def __del__(self):

607

905

# Schedule a new checker to be started an 'interval' from now,

608

906

# and every interval from then on.

609

907

if self.checker_initiator_tag is not None:

610

gobject.source_remove(self.checker_initiator_tag)

611

self.checker_initiator_tag = (gobject.timeout_add

612

(int(self.interval

613

.total_seconds() * 1000),

614

self.start_checker))

908

GObject.source_remove(self.checker_initiator_tag)

909

self.checker_initiator_tag = GObject.timeout_add(

910

int(self.interval.total_seconds() * 1000),

911

self.start_checker)

615

912

# Schedule a disable() when 'timeout' has passed

616

913

if self.disable_initiator_tag is not None:

617

gobject.source_remove(self.disable_initiator_tag)

618

self.disable_initiator_tag = (gobject.timeout_add

619

(int(self.timeout

620

.total_seconds() * 1000),

621

self.disable))

914

GObject.source_remove(self.disable_initiator_tag)

915

self.disable_initiator_tag = GObject.timeout_add(

916

int(self.timeout.total_seconds() * 1000), self.disable)

622

917

# Also start a new checker *right now*.

623

918

self.start_checker()

624

919

625

def checker_callback(self, pid, condition, command):

920

def checker_callback(self, source, condition, connection,

921

command):

626

922

"""The checker has completed, so take appropriate actions."""

627

923

self.checker_callback_tag = None

628

924

self.checker = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

925

# Read return code from connection (see call_pipe)

926

returncode = connection.recv()

927

connection.close()

928

929

if returncode >= 0:

930

self.last_checker_status = returncode

931

self.last_checker_signal = None

631

932

if self.last_checker_status == 0:

632

933

logger.info("Checker for %(name)s succeeded",

633

934

vars(self))

634

935

self.checked_ok()

635

936

else:

636

logger.info("Checker for %(name)s failed",

637

vars(self))

937

logger.info("Checker for %(name)s failed", vars(self))

638

938

else:

639

939

self.last_checker_status = -1

940

self.last_checker_signal = -returncode

640

941

logger.warning("Checker for %(name)s crashed?",

641

942

vars(self))

943

return False

642

944

643

945

def checked_ok(self):

644

946

"""Assert that the client has been seen, alive and well."""

645

947

self.last_checked_ok = datetime.datetime.utcnow()

646

948

self.last_checker_status = 0

949

self.last_checker_signal = None

647

950

self.bump_timeout()

648

951

649

952

def bump_timeout(self, timeout=None):

651

954

if timeout is None:

652

955

timeout = self.timeout

653

956

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

957

GObject.source_remove(self.disable_initiator_tag)

655

958

self.disable_initiator_tag = None

656

959

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(int(timeout.total_seconds()

659

* 1000), self.disable))

960

self.disable_initiator_tag = GObject.timeout_add(

961

int(timeout.total_seconds() * 1000), self.disable)

660

962

self.expires = datetime.datetime.utcnow() + timeout

661

963

662

964

def need_approval(self):

676

978

# than 'timeout' for the client to be disabled, which is as it

677

979

# should be.

678

980

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except AttributeError:

683

pass

684

except OSError as error:

685

if error.errno != errno.ECHILD:

686

raise

687

else:

688

if pid:

689

logger.warning("Checker was a zombie")

690

gobject.source_remove(self.checker_callback_tag)

691

self.checker_callback(pid, status,

692

self.current_checker_command)

981

if self.checker is not None and not self.checker.is_alive():

982

logger.warning("Checker was not alive; joining")

983

self.checker.join()

984

self.checker = None

693

985

# Start a new checker if needed

694

986

if self.checker is None:

695

987

# Escape attributes for the shell

696

escaped_attrs = { attr:

697

re.escape(str(getattr(self, attr)))

698

for attr in self.runtime_expansions }

988

escaped_attrs = {

989

attr: re.escape(str(getattr(self, attr)))

990

for attr in self.runtime_expansions }

699

991

try:

700

992

command = self.checker_command % escaped_attrs

701

993

except TypeError as error:

702

994

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

995

self.checker_command,

996

exc_info=error)

997

return True # Try again later

705

998

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

# The exception is when not debugging but nevertheless

714

# running in the foreground; use the previously

715

# created wnull.

716

popen_args = {}

717

if (not self.server_settings["debug"]

718

and self.server_settings["foreground"]):

719

popen_args.update({"stdout": wnull,

720

"stderr": wnull })

721

self.checker = subprocess.Popen(command,

722

close_fds=True,

723

shell=True, cwd="/",

724

**popen_args)

725

except OSError as error:

726

logger.error("Failed to start subprocess",

727

exc_info=error)

728

return True

729

self.checker_callback_tag = (gobject.child_watch_add

730

(self.checker.pid,

731

self.checker_callback,

732

data=command))

733

# The checker may have completed before the gobject

734

# watch was added. Check for this.

735

try:

736

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

737

except OSError as error:

738

if error.errno == errno.ECHILD:

739

# This should never happen

740

logger.error("Child process vanished",

741

exc_info=error)

742

return True

743

raise

744

if pid:

745

gobject.source_remove(self.checker_callback_tag)

746

self.checker_callback(pid, status, command)

747

# Re-run this periodically if run by gobject.timeout_add

999

logger.info("Starting checker %r for %s", command,

1000

self.name)

1001

# We don't need to redirect stdout and stderr, since

1002

# in normal mode, that is already done by daemon(),

1003

# and in debug mode we don't want to. (Stdin is

1004

# always replaced by /dev/null.)

1005

# The exception is when not debugging but nevertheless

1006

# running in the foreground; use the previously

1007

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1011

if (not self.server_settings["debug"]

1012

and self.server_settings["foreground"]):

1013

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1016

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1020

self.checker.start()

1021

self.checker_callback_tag = GObject.io_add_watch(

1022

pipe[0].fileno(), GObject.IO_IN,

1023

self.checker_callback, pipe[0], command)

1024

# Re-run this periodically if run by GObject.timeout_add

748

1025

return True

749

1026

750

1027

def stop_checker(self):

751

1028

"""Force the checker process, if any, to stop."""

752

1029

if self.checker_callback_tag:

753

gobject.source_remove(self.checker_callback_tag)

1030

GObject.source_remove(self.checker_callback_tag)

754

1031

self.checker_callback_tag = None

755

1032

if getattr(self, "checker", None) is None:

756

1033

return

757

1034

logger.debug("Stopping checker for %(name)s", vars(self))

758

try:

759

self.checker.terminate()

760

#time.sleep(0.5)

761

#if self.checker.poll() is None:

762

# self.checker.kill()

763

except OSError as error:

764

if error.errno != errno.ESRCH: # No such process

765

raise

1035

self.checker.terminate()

766

1036

self.checker = None

767

1037

768

1038

769

def dbus_service_property(dbus_interface, signature="v",

770

access="readwrite", byte_arrays=False):

1039

def dbus_service_property(dbus_interface,

1040

signature="v",

1041

access="readwrite",

1042

byte_arrays=False):

771

1043

"""Decorators for marking methods of a DBusObjectWithProperties to

772

1044

become properties on the D-Bus.

773

1045

783

1055

if byte_arrays and signature != "ay":

784

1056

raise ValueError("Byte arrays not supported for non-'ay'"

785

1057

" signature {!r}".format(signature))

1058

786

1059

def decorator(func):

787

1060

func._dbus_is_property = True

788

1061

func._dbus_interface = dbus_interface

793

1066

func._dbus_name = func._dbus_name[:-14]

794

1067

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

795

1068

return func

1069

796

1070

return decorator

797

1071

798

1072

807

1081

"org.freedesktop.DBus.Property.EmitsChangedSignal":

808

1082

"false"}

809

1083

"""

1084

810

1085

def decorator(func):

811

1086

func._dbus_is_interface = True

812

1087

func._dbus_interface = dbus_interface

813

1088

func._dbus_name = dbus_interface

814

1089

return func

1090

815

1091

return decorator

816

1092

817

1093

826

1102

access="r")

827

1103

def Property_dbus_property(self):

828

1104

return dbus.Boolean(False)

1105

1106

See also the DBusObjectWithAnnotations class.

829

1107

"""

1108

830

1109

def decorator(func):

831

1110

func._dbus_annotations = annotations

832

1111

return func

1112

833

1113

return decorator

834

1114

835

1115

838

1118

"""

839

1119

pass

840

1120

1121

841

1122

class DBusPropertyAccessException(DBusPropertyException):

842

1123

"""A property's access permissions disallows an operation.

843

1124

"""

850

1131

pass

851

1132

852

1133

853

class DBusObjectWithProperties(dbus.service.Object):

854

"""A D-Bus object with properties.

1134

class DBusObjectWithAnnotations(dbus.service.Object):

1135

"""A D-Bus object with annotations.

855

1136

856

Classes inheriting from this can use the dbus_service_property

857

decorator to expose methods as D-Bus properties. It exposes the

858

standard Get(), Set(), and GetAll() methods on the D-Bus.

1137

Classes inheriting from this can use the dbus_annotations

1138

decorator to add annotations to methods or signals.

859

1139

"""

860

1140

861

1141

@staticmethod

871

1151

def _get_all_dbus_things(self, thing):

872

1152

"""Returns a generator of (name, attribute) pairs

873

1153

"""

874

return ((getattr(athing.__get__(self), "_dbus_name",

875

name),

1154

return ((getattr(athing.__get__(self), "_dbus_name", name),

876

1155

athing.__get__(self))

877

1156

for cls in self.__class__.__mro__

878

1157

for name, athing in

879

inspect.getmembers(cls,

880

self._is_dbus_thing(thing)))

1158

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

1160

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1164

def Introspect(self, object_path, connection):

1165

"""Overloading of standard D-Bus method.

1166

1167

Inserts annotation tags on methods and signals.

1168

"""

1169

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

connection)

1171

try:

1172

document = xml.dom.minidom.parseString(xmlstring)

1173

1174

for if_tag in document.getElementsByTagName("interface"):

1175

# Add annotation tags

1176

for typ in ("method", "signal"):

1177

for tag in if_tag.getElementsByTagName(typ):

1178

annots = dict()

1179

for name, prop in (self.

1180

_get_all_dbus_things(typ)):

1181

if (name == tag.getAttribute("name")

1182

and prop._dbus_interface

1183

== if_tag.getAttribute("name")):

1184

annots.update(getattr(

1185

prop, "_dbus_annotations", {}))

1186

for name, value in annots.items():

1187

ann_tag = document.createElement(

1188

"annotation")

1189

ann_tag.setAttribute("name", name)

1190

ann_tag.setAttribute("value", value)

1191

tag.appendChild(ann_tag)

1192

# Add interface annotation tags

1193

for annotation, value in dict(

1194

itertools.chain.from_iterable(

1195

annotations().items()

1196

for name, annotations

1197

in self._get_all_dbus_things("interface")

1198

if name == if_tag.getAttribute("name")

1199

)).items():

1200

ann_tag = document.createElement("annotation")

1201

ann_tag.setAttribute("name", annotation)

1202

ann_tag.setAttribute("value", value)

1203

if_tag.appendChild(ann_tag)

1204

# Fix argument name for the Introspect method itself

1205

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1207

for cn in if_tag.getElementsByTagName("method"):

1208

if cn.getAttribute("name") == "Introspect":

1209

for arg in cn.getElementsByTagName("arg"):

1210

if (arg.getAttribute("direction")

1211

== "out"):

1212

arg.setAttribute("name",

1213

"xml_data")

1214

xmlstring = document.toxml("utf-8")

1215

document.unlink()

1216

except (AttributeError, xml.dom.DOMException,

1217

xml.parsers.expat.ExpatError) as error:

1218

logger.error("Failed to override Introspection method",

1219

exc_info=error)

1220

return xmlstring

1221

1222

1223

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1224

"""A D-Bus object with properties.

1225

1226

Classes inheriting from this can use the dbus_service_property

1227

decorator to expose methods as D-Bus properties. It exposes the

1228

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

"""

881

1230

882

1231

def _get_dbus_property(self, interface_name, property_name):

883

1232

"""Returns a bound method if one exists which is a D-Bus

884

1233

property with the specified name and interface.

885

1234

"""

886

for cls in self.__class__.__mro__:

887

for name, value in (inspect.getmembers

888

(cls,

889

self._is_dbus_thing("property"))):

1235

for cls in self.__class__.__mro__:

1236

for name, value in inspect.getmembers(

1237

cls, self._is_dbus_thing("property")):

890

1238

if (value._dbus_name == property_name

891

1239

and value._dbus_interface == interface_name):

892

1240

return value.__get__(self)

893

1241

894

1242

# No such property

895

raise DBusPropertyNotFound(self.dbus_object_path + ":"

896

+ interface_name + "."

897

+ property_name)

898

899

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1243

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

self.dbus_object_path, interface_name, property_name))

1245

1246

@classmethod

1247

def _get_all_interface_names(cls):

1248

"""Get a sequence of all interfaces supported by an object"""

1249

return (name for name in set(getattr(getattr(x, attr),

1250

"_dbus_interface", None)

1251

for x in (inspect.getmro(cls))

1252

for attr in dir(x))

1253

if name is not None)

1254

1255

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

in_signature="ss",

900

1257

out_signature="v")

901

1258

def Get(self, interface_name, property_name):

902

1259

"""Standard D-Bus property Get() method, see D-Bus standard.

927

1284

for byte in value))

928

1285

prop(value)

929

1286

930

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1287

@dbus.service.method(dbus.PROPERTIES_IFACE,

1288

in_signature="s",

931

1289

out_signature="a{sv}")

932

1290

def GetAll(self, interface_name):

933

1291

"""Standard D-Bus property GetAll() method, see D-Bus

948

1306

if not hasattr(value, "variant_level"):

949

1307

properties[name] = value

950

1308

continue

951

properties[name] = type(value)(value, variant_level=

952

value.variant_level+1)

1309

properties[name] = type(value)(

1310

value, variant_level = value.variant_level + 1)

953

1311

return dbus.Dictionary(properties, signature="sv")

954

1312

955

1313

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

969

1327

970

1328

Inserts property tags and interface annotation tags.

971

1329

"""

972

xmlstring = dbus.service.Object.Introspect(self, object_path,

973

connection)

1330

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1331

object_path,

1332

connection)

974

1333

try:

975

1334

document = xml.dom.minidom.parseString(xmlstring)

1335

976

1336

def make_tag(document, name, prop):

977

1337

e = document.createElement("property")

978

1338

e.setAttribute("name", name)

979

1339

e.setAttribute("type", prop._dbus_signature)

980

1340

e.setAttribute("access", prop._dbus_access)

981

1341

return e

1342

982

1343

for if_tag in document.getElementsByTagName("interface"):

983

1344

# Add property tags

984

1345

for tag in (make_tag(document, name, prop)

987

1348

if prop._dbus_interface

988

1349

== if_tag.getAttribute("name")):

989

1350

if_tag.appendChild(tag)

990

# Add annotation tags

991

for typ in ("method", "signal", "property"):

992

for tag in if_tag.getElementsByTagName(typ):

993

annots = dict()

994

for name, prop in (self.

995

_get_all_dbus_things(typ)):

996

if (name == tag.getAttribute("name")

997

and prop._dbus_interface

998

== if_tag.getAttribute("name")):

999

annots.update(getattr

1000

(prop,

1001

"_dbus_annotations",

1002

{}))

1003

for name, value in annots.items():

1004

ann_tag = document.createElement(

1005

"annotation")

1006

ann_tag.setAttribute("name", name)

1007

ann_tag.setAttribute("value", value)

1008

tag.appendChild(ann_tag)

1009

# Add interface annotation tags

1010

for annotation, value in dict(

1011

itertools.chain.from_iterable(

1012

annotations().items()

1013

for name, annotations in

1014

self._get_all_dbus_things("interface")

1015

if name == if_tag.getAttribute("name")

1016

)).items():

1017

ann_tag = document.createElement("annotation")

1018

ann_tag.setAttribute("name", annotation)

1019

ann_tag.setAttribute("value", value)

1020

if_tag.appendChild(ann_tag)

1351

# Add annotation tags for properties

1352

for tag in if_tag.getElementsByTagName("property"):

1353

annots = dict()

1354

for name, prop in self._get_all_dbus_things(

1355

"property"):

1356

if (name == tag.getAttribute("name")

1357

and prop._dbus_interface

1358

== if_tag.getAttribute("name")):

1359

annots.update(getattr(

1360

prop, "_dbus_annotations", {}))

1361

for name, value in annots.items():

1362

ann_tag = document.createElement(

1363

"annotation")

1364

ann_tag.setAttribute("name", name)

1365

ann_tag.setAttribute("value", value)

1366

tag.appendChild(ann_tag)

1021

1367

# Add the names to the return values for the

1022

1368

# "org.freedesktop.DBus.Properties" methods

1023

1369

if (if_tag.getAttribute("name")

1041

1387

exc_info=error)

1042

1388

return xmlstring

1043

1389

1390

try:

1391

dbus.OBJECT_MANAGER_IFACE

1392

except AttributeError:

1393

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1395

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

"""A D-Bus object with an ObjectManager.

1397

1398

Classes inheriting from this exposes the standard

1399

GetManagedObjects call and the InterfacesAdded and

1400

InterfacesRemoved signals on the standard

1401

"org.freedesktop.DBus.ObjectManager" interface.

1402

1403

Note: No signals are sent automatically; they must be sent

1404

manually.

1405

"""

1406

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1408

def GetManagedObjects(self):

1409

"""This function must be overridden"""

1410

raise NotImplementedError()

1411

1412

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1414

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1418

def InterfacesRemoved(self, object_path, interfaces):

1419

pass

1420

1421

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1425

def Introspect(self, object_path, connection):

1426

"""Overloading of standard D-Bus method.

1427

1428

Override return argument name of GetManagedObjects to be

1429

"objpath_interfaces_and_properties"

1430

"""

1431

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1432

object_path,

1433

connection)

1434

try:

1435

document = xml.dom.minidom.parseString(xmlstring)

1436

1437

for if_tag in document.getElementsByTagName("interface"):

1438

# Fix argument name for the GetManagedObjects method

1439

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1441

for cn in if_tag.getElementsByTagName("method"):

1442

if (cn.getAttribute("name")

1443

== "GetManagedObjects"):

1444

for arg in cn.getElementsByTagName("arg"):

1445

if (arg.getAttribute("direction")

1446

== "out"):

1447

arg.setAttribute(

1448

"name",

1449

"objpath_interfaces"

1450

"_and_properties")

1451

xmlstring = document.toxml("utf-8")

1452

document.unlink()

1453

except (AttributeError, xml.dom.DOMException,

1454

xml.parsers.expat.ExpatError) as error:

1455

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1457

return xmlstring

1044

1458

1045

1459

def datetime_to_dbus(dt, variant_level=0):

1046

1460

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1047

1461

if dt is None:

1048

1462

return dbus.String("", variant_level = variant_level)

1049

return dbus.String(dt.isoformat(),

1050

variant_level=variant_level)

1463

return dbus.String(dt.isoformat(), variant_level=variant_level)

1051

1464

1052

1465

1053

1466

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1073

1486

(from DBusObjectWithProperties) and interfaces (from the

1074

1487

dbus_interface_annotations decorator).

1075

1488

"""

1489

1076

1490

def wrapper(cls):

1077

1491

for orig_interface_name, alt_interface_name in (

1078

alt_interface_names.items()):

1492

alt_interface_names.items()):

1079

1493

attr = {}

1080

1494

interface_names = set()

1081

1495

# Go though all attributes of the class

1083

1497

# Ignore non-D-Bus attributes, and D-Bus attributes

1084

1498

# with the wrong interface name

1085

1499

if (not hasattr(attribute, "_dbus_interface")

1086

or not attribute._dbus_interface

1087

.startswith(orig_interface_name)):

1500

or not attribute._dbus_interface.startswith(

1501

orig_interface_name)):

1088

1502

continue

1089

1503

# Create an alternate D-Bus interface name based on

1090

1504

# the current name

1091

alt_interface = (attribute._dbus_interface

1092

.replace(orig_interface_name,

1093

alt_interface_name))

1505

alt_interface = attribute._dbus_interface.replace(

1506

orig_interface_name, alt_interface_name)

1094

1507

interface_names.add(alt_interface)

1095

1508

# Is this a D-Bus signal?

1096

1509

if getattr(attribute, "_dbus_is_signal", False):

1097

# Extract the original non-method undecorated

1098

# function by black magic

1099

nonmethod_func = (dict(

1510

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

nonmethod_func = (dict(

1100

1514

zip(attribute.func_code.co_freevars,

1101

attribute.__closure__))["func"]

1102

.cell_contents)

1515

attribute.__closure__))

1516

["func"].cell_contents)

1517

else:

1518

nonmethod_func = attribute

1103

1519

# Create a new, but exactly alike, function

1104

1520

# object, and decorate it to be a new D-Bus signal

1105

1521

# with the alternate D-Bus interface name

1106

new_function = (dbus.service.signal

1107

(alt_interface,

1108

attribute._dbus_signature)

1109

(types.FunctionType(

1110

nonmethod_func.func_code,

1111

nonmethod_func.func_globals,

1112

nonmethod_func.func_name,

1113

nonmethod_func.func_defaults,

1114

nonmethod_func.func_closure)))

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1536

new_function = (dbus.service.signal(

1537

alt_interface,

1538

attribute._dbus_signature)(new_function))

1115

1539

# Copy annotations, if any

1116

1540

try:

1117

new_function._dbus_annotations = (

1118

dict(attribute._dbus_annotations))

1541

new_function._dbus_annotations = dict(

1542

attribute._dbus_annotations)

1119

1543

except AttributeError:

1120

1544

pass

1121

1545

# Define a creator of a function to call both the

1126

1550

"""This function is a scope container to pass

1127

1551

func1 and func2 to the "call_both" function

1128

1552

outside of its arguments"""

1553

1554

@functools.wraps(func2)

1129

1555

def call_both(*args, **kwargs):

1130

1556

"""This function will emit two D-Bus

1131

1557

signals by calling func1 and func2"""

1132

1558

func1(*args, **kwargs)

1133

1559

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1561

for name, attr in inspect.getmembers(func2):

1562

if name.startswith("_dbus_"):

1563

setattr(call_both, name, attr)

1564

1134

1565

return call_both

1135

1566

# Create the "call_both" function and add it to

1136

1567

# the class

1141

1572

# object. Decorate it to be a new D-Bus method

1142

1573

# with the alternate D-Bus interface name. Add it

1143

1574

# to the class.

1144

attr[attrname] = (dbus.service.method

1145

(alt_interface,

1146

attribute._dbus_in_signature,

1147

attribute._dbus_out_signature)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1575

attr[attrname] = (

1576

dbus.service.method(

1577

alt_interface,

1578

attribute._dbus_in_signature,

1579

attribute._dbus_out_signature)

1580

(types.FunctionType(attribute.func_code,

1581

attribute.func_globals,

1582

attribute.func_name,

1583

attribute.func_defaults,

1584

attribute.func_closure)))

1154

1585

# Copy annotations, if any

1155

1586

try:

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1587

attr[attrname]._dbus_annotations = dict(

1588

attribute._dbus_annotations)

1158

1589

except AttributeError:

1159

1590

pass

1160

1591

# Is this a D-Bus property?

1163

1594

# object, and decorate it to be a new D-Bus

1164

1595

# property with the alternate D-Bus interface

1165

1596

# name. Add it to the class.

1166

attr[attrname] = (dbus_service_property

1167

(alt_interface,

1168

attribute._dbus_signature,

1169

attribute._dbus_access,

1170

attribute

1171

._dbus_get_args_options

1172

["byte_arrays"])

1173

(types.FunctionType

1174

(attribute.func_code,

1175

attribute.func_globals,

1176

attribute.func_name,

1177

attribute.func_defaults,

1178

attribute.func_closure)))

1597

attr[attrname] = (dbus_service_property(

1598

alt_interface, attribute._dbus_signature,

1599

attribute._dbus_access,

1600

attribute._dbus_get_args_options

1601

["byte_arrays"])

1602

(types.FunctionType(

1603

attribute.func_code,

1604

attribute.func_globals,

1605

attribute.func_name,

1606

attribute.func_defaults,

1607

attribute.func_closure)))

1179

1608

# Copy annotations, if any

1180

1609

try:

1181

attr[attrname]._dbus_annotations = (

1182

dict(attribute._dbus_annotations))

1610

attr[attrname]._dbus_annotations = dict(

1611

attribute._dbus_annotations)

1183

1612

except AttributeError:

1184

1613

pass

1185

1614

# Is this a D-Bus interface?

1188

1617

# object. Decorate it to be a new D-Bus interface

1189

1618

# with the alternate D-Bus interface name. Add it

1190

1619

# to the class.

1191

attr[attrname] = (dbus_interface_annotations

1192

(alt_interface)

1193

(types.FunctionType

1194

(attribute.func_code,

1195

attribute.func_globals,

1196

attribute.func_name,

1197

attribute.func_defaults,

1198

attribute.func_closure)))

1620

attr[attrname] = (

1621

dbus_interface_annotations(alt_interface)

1622

(types.FunctionType(attribute.func_code,

1623

attribute.func_globals,

1624

attribute.func_name,

1625

attribute.func_defaults,

1626

attribute.func_closure)))

1199

1627

if deprecate:

1200

1628

# Deprecate all alternate interfaces

1201

1629

iname="_AlternateDBusNames_interface_annotation{}"

1202

1630

for interface_name in interface_names:

1631

1203

1632

@dbus_interface_annotations(interface_name)

1204

1633

def func(self):

1205

1634

return { "org.freedesktop.DBus.Deprecated":

1206

"true" }

1635

"true" }

1207

1636

# Find an unused name

1208

1637

for aname in (iname.format(i)

1209

1638

for i in itertools.count()):

1214

1643

# Replace the class with a new subclass of it with

1215

1644

# methods, signals, etc. as created above.

1216

1645

cls = type(b"{}Alternate".format(cls.__name__),

1217

(cls,), attr)

1646

(cls, ), attr)

1218

1647

return cls

1648

1219

1649

return wrapper

1220

1650

1221

1651

1222

1652

@alternate_dbus_interfaces({"se.recompile.Mandos":

1223

"se.bsnet.fukt.Mandos"})

1653

"se.bsnet.fukt.Mandos"})

1224

1654

class ClientDBus(Client, DBusObjectWithProperties):

1225

1655

"""A Client class using D-Bus

1226

1656

1230

1660

"""

1231

1661

1232

1662

runtime_expansions = (Client.runtime_expansions

1233

+ ("dbus_object_path",))

1663

+ ("dbus_object_path", ))

1234

1664

1235

1665

_interface = "se.recompile.Mandos.Client"

1236

1666

1244

1674

client_object_name = str(self.name).translate(

1245

1675

{ord("."): ord("_"),

1246

1676

ord("-"): ord("_")})

1247

self.dbus_object_path = (dbus.ObjectPath

1248

("/clients/" + client_object_name))

1677

self.dbus_object_path = dbus.ObjectPath(

1678

"/clients/" + client_object_name)

1249

1679

DBusObjectWithProperties.__init__(self, self.bus,

1250

1680

self.dbus_object_path)

1251

1681

1252

def notifychangeproperty(transform_func,

1253

dbus_name, type_func=lambda x: x,

1254

variant_level=1, invalidate_only=False,

1682

def notifychangeproperty(transform_func, dbus_name,

1683

type_func=lambda x: x,

1684

variant_level=1,

1685

invalidate_only=False,

1255

1686

_interface=_interface):

1256

1687

""" Modify a variable so that it's a property which announces

1257

1688

its changes to DBus.

1264

1695

variant_level: D-Bus variant level. Default: 1

1265

1696

"""

1266

1697

attrname = "_{}".format(dbus_name)

1698

1267

1699

def setter(self, value):

1268

1700

if hasattr(self, "dbus_object_path"):

1269

1701

if (not hasattr(self, attrname) or

1270

1702

type_func(getattr(self, attrname, None))

1271

1703

!= type_func(value)):

1272

1704

if invalidate_only:

1273

self.PropertiesChanged(_interface,

1274

dbus.Dictionary(),

1275

dbus.Array

1276

((dbus_name,)))

1705

self.PropertiesChanged(

1706

_interface, dbus.Dictionary(),

1707

dbus.Array((dbus_name, )))

1277

1708

else:

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1709

dbus_value = transform_func(

1710

type_func(value),

1711

variant_level = variant_level)

1281

1712

self.PropertyChanged(dbus.String(dbus_name),

1282

1713

dbus_value)

1283

self.PropertiesChanged(_interface,

1284

dbus.Dictionary({

1285

dbus.String(dbus_name):

1286

dbus_value }), dbus.Array())

1714

self.PropertiesChanged(

1715

_interface,

1716

dbus.Dictionary({ dbus.String(dbus_name):

1717

dbus_value }),

1718

dbus.Array())

1287

1719

setattr(self, attrname, value)

1288

1720

1289

1721

return property(lambda self: getattr(self, attrname), setter)

1295

1727

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1296

1728

last_enabled = notifychangeproperty(datetime_to_dbus,

1297

1729

"LastEnabled")

1298

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1299

type_func = lambda checker:

1300

checker is not None)

1730

checker = notifychangeproperty(

1731

dbus.Boolean, "CheckerRunning",

1732

type_func = lambda checker: checker is not None)

1301

1733

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1302

1734

"LastCheckedOK")

1303

1735

last_checker_status = notifychangeproperty(dbus.Int16,

1306

1738

datetime_to_dbus, "LastApprovalRequest")

1307

1739

approved_by_default = notifychangeproperty(dbus.Boolean,

1308

1740

"ApprovedByDefault")

1309

approval_delay = notifychangeproperty(dbus.UInt64,

1310

"ApprovalDelay",

1311

type_func =

1312

lambda td: td.total_seconds()

1313

* 1000)

1741

approval_delay = notifychangeproperty(

1742

dbus.UInt64, "ApprovalDelay",

1743

type_func = lambda td: td.total_seconds() * 1000)

1314

1744

approval_duration = notifychangeproperty(

1315

1745

dbus.UInt64, "ApprovalDuration",

1316

1746

type_func = lambda td: td.total_seconds() * 1000)

1317

1747

host = notifychangeproperty(dbus.String, "Host")

1318

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1319

type_func = lambda td:

1320

td.total_seconds() * 1000)

1748

timeout = notifychangeproperty(

1749

dbus.UInt64, "Timeout",

1750

type_func = lambda td: td.total_seconds() * 1000)

1321

1751

extended_timeout = notifychangeproperty(

1322

1752

dbus.UInt64, "ExtendedTimeout",

1323

1753

type_func = lambda td: td.total_seconds() * 1000)

1324

interval = notifychangeproperty(dbus.UInt64,

1325

"Interval",

1326

type_func =

1327

lambda td: td.total_seconds()

1328

* 1000)

1754

interval = notifychangeproperty(

1755

dbus.UInt64, "Interval",

1756

type_func = lambda td: td.total_seconds() * 1000)

1329

1757

checker_command = notifychangeproperty(dbus.String, "Checker")

1330

1758

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1331

1759

invalidate_only=True)

1341

1769

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1342

1770

Client.__del__(self, *args, **kwargs)

1343

1771

1344

def checker_callback(self, pid, condition, command,

1345

*args, **kwargs):

1346

self.checker_callback_tag = None

1347

self.checker = None

1348

if os.WIFEXITED(condition):

1349

exitstatus = os.WEXITSTATUS(condition)

1772

def checker_callback(self, source, condition,

1773

connection, command, *args, **kwargs):

1774

ret = Client.checker_callback(self, source, condition,

1775

connection, command, *args,

1776

**kwargs)

1777

exitstatus = self.last_checker_status

1778

if exitstatus >= 0:

1350

1779

# Emit D-Bus signal

1351

1780

self.CheckerCompleted(dbus.Int16(exitstatus),

1352

dbus.Int64(condition),

1781

# This is specific to GNU libC

1782

dbus.Int64(exitstatus << 8),

1353

1783

dbus.String(command))

1354

1784

else:

1355

1785

# Emit D-Bus signal

1356

1786

self.CheckerCompleted(dbus.Int16(-1),

1357

dbus.Int64(condition),

1787

dbus.Int64(

1788

# This is specific to GNU libC

1789

(exitstatus << 8)

1790

| self.last_checker_signal),

1358

1791

dbus.String(command))

1359

1360

return Client.checker_callback(self, pid, condition, command,

1361

*args, **kwargs)

1792

return ret

1362

1793

1363

1794

def start_checker(self, *args, **kwargs):

1364

1795

old_checker_pid = getattr(self.checker, "pid", None)

1376

1807

1377

1808

def approve(self, value=True):

1378

1809

self.approved = value

1379

gobject.timeout_add(int(self.approval_duration.total_seconds()

1810

GObject.timeout_add(int(self.approval_duration.total_seconds()

1380

1811

* 1000), self._reset_approved)

1381

1812

self.send_changedstate()

1382

1813

1439

1870

self.checked_ok()

1440

1871

1441

1872

# Enable - method

1873

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1442

1874

@dbus.service.method(_interface)

1443

1875

def Enable(self):

1444

1876

"D-Bus method"

1445

1877

self.enable()

1446

1878

1447

1879

# StartChecker - method

1880

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1448

1881

@dbus.service.method(_interface)

1449

1882

def StartChecker(self):

1450

1883

"D-Bus method"

1451

1884

self.start_checker()

1452

1885

1453

1886

# Disable - method

1887

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1454

1888

@dbus.service.method(_interface)

1455

1889

def Disable(self):

1456

1890

"D-Bus method"

1457

1891

self.disable()

1458

1892

1459

1893

# StopChecker - method

1894

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1460

1895

@dbus.service.method(_interface)

1461

1896

def StopChecker(self):

1462

1897

self.stop_checker()

1469

1904

return dbus.Boolean(bool(self.approvals_pending))

1470

1905

1471

1906

# ApprovedByDefault - property

1472

@dbus_service_property(_interface, signature="b",

1907

@dbus_service_property(_interface,

1908

signature="b",

1473

1909

access="readwrite")

1474

1910

def ApprovedByDefault_dbus_property(self, value=None):

1475

1911

if value is None: # get

1477

1913

self.approved_by_default = bool(value)

1478

1914

1479

1915

# ApprovalDelay - property

1480

@dbus_service_property(_interface, signature="t",

1916

@dbus_service_property(_interface,

1917

signature="t",

1481

1918

access="readwrite")

1482

1919

def ApprovalDelay_dbus_property(self, value=None):

1483

1920

if value is None: # get

1486

1923

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1487

1924

1488

1925

# ApprovalDuration - property

1489

@dbus_service_property(_interface, signature="t",

1926

@dbus_service_property(_interface,

1927

signature="t",

1490

1928

access="readwrite")

1491

1929

def ApprovalDuration_dbus_property(self, value=None):

1492

1930

if value is None: # get

1495

1933

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1496

1934

1497

1935

# Name - property

1936

@dbus_annotations(

1937

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1498

1938

@dbus_service_property(_interface, signature="s", access="read")

1499

1939

def Name_dbus_property(self):

1500

1940

return dbus.String(self.name)

1501

1941

1502

1942

# Fingerprint - property

1943

@dbus_annotations(

1944

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1503

1945

@dbus_service_property(_interface, signature="s", access="read")

1504

1946

def Fingerprint_dbus_property(self):

1505

1947

return dbus.String(self.fingerprint)

1506

1948

1507

1949

# Host - property

1508

@dbus_service_property(_interface, signature="s",

1950

@dbus_service_property(_interface,

1951

signature="s",

1509

1952

access="readwrite")

1510

1953

def Host_dbus_property(self, value=None):

1511

1954

if value is None: # get

1513

1956

self.host = str(value)

1514

1957

1515

1958

# Created - property

1959

@dbus_annotations(

1960

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1516

1961

@dbus_service_property(_interface, signature="s", access="read")

1517

1962

def Created_dbus_property(self):

1518

1963

return datetime_to_dbus(self.created)

1523

1968

return datetime_to_dbus(self.last_enabled)

1524

1969

1525

1970

# Enabled - property

1526

@dbus_service_property(_interface, signature="b",

1971

@dbus_service_property(_interface,

1972

signature="b",

1527

1973

access="readwrite")

1528

1974

def Enabled_dbus_property(self, value=None):

1529

1975

if value is None: # get

1534

1980

self.disable()

1535

1981

1536

1982

# LastCheckedOK - property

1537

@dbus_service_property(_interface, signature="s",

1983

@dbus_service_property(_interface,

1984

signature="s",

1538

1985

access="readwrite")

1539

1986

def LastCheckedOK_dbus_property(self, value=None):

1540

1987

if value is not None:

1543

1990

return datetime_to_dbus(self.last_checked_ok)

1544

1991

1545

1992

# LastCheckerStatus - property

1546

@dbus_service_property(_interface, signature="n",

1547

access="read")

1993

@dbus_service_property(_interface, signature="n", access="read")

1548

1994

def LastCheckerStatus_dbus_property(self):

1549

1995

return dbus.Int16(self.last_checker_status)

1550

1996

1559

2005

return datetime_to_dbus(self.last_approval_request)

1560

2006

1561

2007

# Timeout - property

1562

@dbus_service_property(_interface, signature="t",

2008

@dbus_service_property(_interface,

2009

signature="t",

1563

2010

access="readwrite")

1564

2011

def Timeout_dbus_property(self, value=None):

1565

2012

if value is None: # get

1577

2024

if (getattr(self, "disable_initiator_tag", None)

1578

2025

is None):

1579

2026

return

1580

gobject.source_remove(self.disable_initiator_tag)

1581

self.disable_initiator_tag = (

1582

gobject.timeout_add(

1583

int((self.expires - now).total_seconds()

1584

* 1000), self.disable))

2027

GObject.source_remove(self.disable_initiator_tag)

2028

self.disable_initiator_tag = GObject.timeout_add(

2029

int((self.expires - now).total_seconds() * 1000),

2030

self.disable)

1585

2031

1586

2032

# ExtendedTimeout - property

1587

@dbus_service_property(_interface, signature="t",

2033

@dbus_service_property(_interface,

2034

signature="t",

1588

2035

access="readwrite")

1589

2036

def ExtendedTimeout_dbus_property(self, value=None):

1590

2037

if value is None: # get

1593

2040

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1594

2041

1595

2042

# Interval - property

1596

@dbus_service_property(_interface, signature="t",

2043

@dbus_service_property(_interface,

2044

signature="t",

1597

2045

access="readwrite")

1598

2046

def Interval_dbus_property(self, value=None):

1599

2047

if value is None: # get

1603

2051

return

1604

2052

if self.enabled:

1605

2053

# Reschedule checker run

1606

gobject.source_remove(self.checker_initiator_tag)

1607

self.checker_initiator_tag = (gobject.timeout_add

1608

(value, self.start_checker))

1609

self.start_checker() # Start one now, too

2054

GObject.source_remove(self.checker_initiator_tag)

2055

self.checker_initiator_tag = GObject.timeout_add(

2056

value, self.start_checker)

2057

self.start_checker() # Start one now, too

1610

2058

1611

2059

# Checker - property

1612

@dbus_service_property(_interface, signature="s",

2060

@dbus_service_property(_interface,

2061

signature="s",

1613

2062

access="readwrite")

1614

2063

def Checker_dbus_property(self, value=None):

1615

2064

if value is None: # get

1617

2066

self.checker_command = str(value)

1618

2067

1619

2068

# CheckerRunning - property

1620

@dbus_service_property(_interface, signature="b",

2069

@dbus_service_property(_interface,

2070

signature="b",

1621

2071

access="readwrite")

1622

2072

def CheckerRunning_dbus_property(self, value=None):

1623

2073

if value is None: # get

1628

2078

self.stop_checker()

1629

2079

1630

2080

# ObjectPath - property

2081

@dbus_annotations(

2082

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

"org.freedesktop.DBus.Deprecated": "true"})

1631

2084

@dbus_service_property(_interface, signature="o", access="read")

1632

2085

def ObjectPath_dbus_property(self):

1633

2086

return self.dbus_object_path # is already a dbus.ObjectPath

1634

2087

1635

2088

# Secret = property

1636

@dbus_service_property(_interface, signature="ay",

1637

access="write", byte_arrays=True)

2089

@dbus_annotations(

2090

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2091

"invalidates"})

2092

@dbus_service_property(_interface,

2093

signature="ay",

2094

access="write",

2095

byte_arrays=True)

1638

2096

def Secret_dbus_property(self, value):

1639

2097

self.secret = bytes(value)

1640

2098

1646

2104

self._pipe = child_pipe

1647

2105

self._pipe.send(('init', fpr, address))

1648

2106

if not self._pipe.recv():

1649

raise KeyError()

2107

raise KeyError(fpr)

1650

2108

1651

2109

def __getattribute__(self, name):

1652

2110

if name == '_pipe':

1656

2114

if data[0] == 'data':

1657

2115

return data[1]

1658

2116

if data[0] == 'function':

2117

1659

2118

def func(*args, **kwargs):

1660

2119

self._pipe.send(('funcall', name, args, kwargs))

1661

2120

return self._pipe.recv()[1]

2121

1662

2122

return func

1663

2123

1664

2124

def __setattr__(self, name, value):

1680

2140

logger.debug("Pipe FD: %d",

1681

2141

self.server.child_pipe.fileno())

1682

2142

1683

session = (gnutls.connection

1684

.ClientSession(self.request,

1685

gnutls.connection

1686

.X509Credentials()))

1687

1688

# Note: gnutls.connection.X509Credentials is really a

1689

# generic GnuTLS certificate credentials object so long as

1690

# no X.509 keys are added to it. Therefore, we can use it

1691

# here despite using OpenPGP certificates.

2143

session = gnutls.ClientSession(self.request)

1692

2144

1693

2145

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1694

2146

# "+AES-256-CBC", "+SHA1",

1698

2150

priority = self.server.gnutls_priority

1699

2151

if priority is None:

1700

2152

priority = "NORMAL"

1701

(gnutls.library.functions

1702

.gnutls_priority_set_direct(session._c_object,

1703

priority, None))

2153

gnutls.priority_set_direct(session._c_object, priority,

2154

None)

1704

2155

1705

2156

# Start communication using the Mandos protocol

1706

2157

# Get protocol number

1716

2167

# Start GnuTLS connection

1717

2168

try:

1718

2169

session.handshake()

1719

except gnutls.errors.GNUTLSError as error:

2170

except gnutls.Error as error:

1720

2171

logger.warning("Handshake failed: %s", error)

1721

2172

# Do not run session.bye() here: the session is not

1722

2173

# established. Just abandon the request.

1726

2177

approval_required = False

1727

2178

try:

1728

2179

try:

1729

fpr = self.fingerprint(self.peer_certificate

1730

(session))

1731

except (TypeError,

1732

gnutls.errors.GNUTLSError) as error:

2180

fpr = self.fingerprint(

2181

self.peer_certificate(session))

2182

except (TypeError, gnutls.Error) as error:

1733

2183

logger.warning("Bad certificate: %s", error)

1734

2184

return

1735

2185

logger.debug("Fingerprint: %s", fpr)

1748

2198

while True:

1749

2199

if not client.enabled:

1750

2200

logger.info("Client %s is disabled",

1751

client.name)

2201

client.name)

1752

2202

if self.server.use_dbus:

1753

2203

# Emit D-Bus signal

1754

2204

client.Rejected("Disabled")

1793

2243

else:

1794

2244

delay -= time2 - time

1795

2245

1796

sent_size = 0

1797

while sent_size < len(client.secret):

1798

try:

1799

sent = session.send(client.secret[sent_size:])

1800

except gnutls.errors.GNUTLSError as error:

1801

logger.warning("gnutls send failed",

1802

exc_info=error)

1803

return

1804

logger.debug("Sent: %d, remaining: %d",

1805

sent, len(client.secret)

1806

- (sent_size + sent))

1807

sent_size += sent

2246

try:

2247

session.send(client.secret)

2248

except gnutls.Error as error:

2249

logger.warning("gnutls send failed",

2250

exc_info = error)

2251

return

1808

2252

1809

2253

logger.info("Sending secret to %s", client.name)

1810

2254

# bump the timeout using extended_timeout

1818

2262

client.approvals_pending -= 1

1819

2263

try:

1820

2264

session.bye()

1821

except gnutls.errors.GNUTLSError as error:

2265

except gnutls.Error as error:

1822

2266

logger.warning("GnuTLS bye failed",

1823

2267

exc_info=error)

1824

2268

1826

2270

def peer_certificate(session):

1827

2271

"Return the peer's OpenPGP certificate as a bytestring"

1828

2272

# If not an OpenPGP certificate...

1829

if (gnutls.library.functions

1830

.gnutls_certificate_type_get(session._c_object)

1831

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1832

# ...do the normal thing

1833

return session.peer_certificate

2273

if (gnutls.certificate_type_get(session._c_object)

2274

!= gnutls.CRT_OPENPGP):

2275

# ...return invalid data

2276

return b""

1834

2277

list_size = ctypes.c_uint(1)

1835

cert_list = (gnutls.library.functions

1836

.gnutls_certificate_get_peers

2278

cert_list = (gnutls.certificate_get_peers

1837

2279

(session._c_object, ctypes.byref(list_size)))

1838

2280

if not bool(cert_list) and list_size.value != 0:

1839

raise gnutls.errors.GNUTLSError("error getting peer"

1840

" certificate")

2281

raise gnutls.Error("error getting peer certificate")

1841

2282

if list_size.value == 0:

1842

2283

return None

1843

2284

cert = cert_list[0]

1847

2288

def fingerprint(openpgp):

1848

2289

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1849

2290

# New GnuTLS "datum" with the OpenPGP public key

1850

datum = (gnutls.library.types

1851

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1852

ctypes.POINTER

1853

(ctypes.c_ubyte)),

1854

ctypes.c_uint(len(openpgp))))

2291

datum = gnutls.datum_t(

2292

ctypes.cast(ctypes.c_char_p(openpgp),

2293

ctypes.POINTER(ctypes.c_ubyte)),

2294

ctypes.c_uint(len(openpgp)))

1855

2295

# New empty GnuTLS certificate

1856

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2296

crt = gnutls.openpgp_crt_t()

2297

gnutls.openpgp_crt_init(ctypes.byref(crt))

1859

2298

# Import the OpenPGP public key into the certificate

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1862

gnutls.library.constants

1863

.GNUTLS_OPENPGP_FMT_RAW))

2299

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2300

gnutls.OPENPGP_FMT_RAW)

1864

2301

# Verify the self signature in the key

1865

2302

crtverify = ctypes.c_uint()

1866

(gnutls.library.functions

1867

.gnutls_openpgp_crt_verify_self(crt, 0,

1868

ctypes.byref(crtverify)))

2303

gnutls.openpgp_crt_verify_self(crt, 0,

2304

ctypes.byref(crtverify))

1869

2305

if crtverify.value != 0:

1870

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1871

raise (gnutls.errors.CertificateSecurityError

1872

("Verify failed"))

2306

gnutls.openpgp_crt_deinit(crt)

2307

raise gnutls.CertificateSecurityError("Verify failed")

1873

2308

# New buffer for the fingerprint

1874

2309

buf = ctypes.create_string_buffer(20)

1875

2310

buf_len = ctypes.c_size_t()

1876

2311

# Get the fingerprint from the certificate into the buffer

1877

(gnutls.library.functions

1878

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1879

ctypes.byref(buf_len)))

2312

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2313

ctypes.byref(buf_len))

1880

2314

# Deinit the certificate

1881

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2315

gnutls.openpgp_crt_deinit(crt)

1882

2316

# Convert the buffer to a Python bytestring

1883

2317

fpr = ctypes.string_at(buf, buf_len.value)

1884

2318

# Convert the bytestring to hexadecimal notation

1888

2322

1889

2323

class MultiprocessingMixIn(object):

1890

2324

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2325

1891

2326

def sub_process_main(self, request, address):

1892

2327

try:

1893

2328

self.finish_request(request, address)

1905

2340

1906

2341

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1907

2342

""" adds a pipe to the MixIn """

2343

1908

2344

def process_request(self, request, client_address):

1909

2345

"""Overrides and wraps the original process_request().

1910

2346

1931

2367

interface: None or a network interface name (string)

1932

2368

use_ipv6: Boolean; to use IPv6 or not

1933

2369

"""

2370

1934

2371

def __init__(self, server_address, RequestHandlerClass,

1935

interface=None, use_ipv6=True, socketfd=None):

2372

interface=None,

2373

use_ipv6=True,

2374

socketfd=None):

1936

2375

"""If socketfd is set, use that file descriptor instead of

1937

2376

creating a new one with socket.socket().

1938

2377

"""

1979

2418

self.interface)

1980

2419

else:

1981

2420

try:

1982

self.socket.setsockopt(socket.SOL_SOCKET,

1983

SO_BINDTODEVICE,

1984

(self.interface + "\0")

1985

.encode("utf-8"))

2421

self.socket.setsockopt(

2422

socket.SOL_SOCKET, SO_BINDTODEVICE,

2423

(self.interface + "\0").encode("utf-8"))

1986

2424

except socket.error as error:

1987

2425

if error.errno == errno.EPERM:

1988

2426

logger.error("No permission to bind to"

2006

2444

self.server_address = (any_address,

2007

2445

self.server_address[1])

2008

2446

elif not self.server_address[1]:

2009

self.server_address = (self.server_address[0],

2010

0)

2447

self.server_address = (self.server_address[0], 0)

2011

2448

# if self.interface:

2012

2449

# self.server_address = (self.server_address[0],

2013

2450

# 0, # port

2025

2462

gnutls_priority GnuTLS priority string

2026

2463

use_dbus: Boolean; to emit D-Bus signals or not

2027

2464

2028

Assumes a gobject.MainLoop event loop.

2465

Assumes a GObject.MainLoop event loop.

2029

2466

"""

2467

2030

2468

def __init__(self, server_address, RequestHandlerClass,

2031

interface=None, use_ipv6=True, clients=None,

2032

gnutls_priority=None, use_dbus=True, socketfd=None):

2469

interface=None,

2470

use_ipv6=True,

2471

clients=None,

2472

gnutls_priority=None,

2473

use_dbus=True,

2474

socketfd=None):

2033

2475

self.enabled = False

2034

2476

self.clients = clients

2035

2477

if self.clients is None:

2041

2483

interface = interface,

2042

2484

use_ipv6 = use_ipv6,

2043

2485

socketfd = socketfd)

2486

2044

2487

def server_activate(self):

2045

2488

if self.enabled:

2046

2489

return socketserver.TCPServer.server_activate(self)

2050

2493

2051

2494

def add_pipe(self, parent_pipe, proc):

2052

2495

# Call "handle_ipc" for both data and EOF events

2053

gobject.io_add_watch(parent_pipe.fileno(),

2054

gobject.IO_IN | gobject.IO_HUP,

2055

functools.partial(self.handle_ipc,

2056

parent_pipe =

2057

parent_pipe,

2058

proc = proc))

2496

GObject.io_add_watch(

2497

parent_pipe.fileno(),

2498

GObject.IO_IN | GObject.IO_HUP,

2499

functools.partial(self.handle_ipc,

2500

parent_pipe = parent_pipe,

2501

proc = proc))

2059

2502

2060

def handle_ipc(self, source, condition, parent_pipe=None,

2061

proc = None, client_object=None):

2503

def handle_ipc(self, source, condition,

2504

parent_pipe=None,

2505

proc = None,

2506

client_object=None):

2062

2507

# error, or the other end of multiprocessing.Pipe has closed

2063

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2508

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2064

2509

# Wait for other process to exit

2065

2510

proc.join()

2066

2511

return False

2087

2532

parent_pipe.send(False)

2088

2533

return False

2089

2534

2090

gobject.io_add_watch(parent_pipe.fileno(),

2091

gobject.IO_IN | gobject.IO_HUP,

2092

functools.partial(self.handle_ipc,

2093

parent_pipe =

2094

parent_pipe,

2095

proc = proc,

2096

client_object =

2097

client))

2535

GObject.io_add_watch(

2536

parent_pipe.fileno(),

2537

GObject.IO_IN | GObject.IO_HUP,

2538

functools.partial(self.handle_ipc,

2539

parent_pipe = parent_pipe,

2540

proc = proc,

2541

client_object = client))

2098

2542

parent_pipe.send(True)

2099

2543

# remove the old hook in favor of the new above hook on

2100

2544

# same fileno

2106

2550

2107

2551

parent_pipe.send(('data', getattr(client_object,

2108

2552

funcname)(*args,

2109

**kwargs)))

2553

**kwargs)))

2110

2554

2111

2555

if command == 'getattr':

2112

2556

attrname = request[1]

2113

if callable(client_object.__getattribute__(attrname)):

2114

parent_pipe.send(('function',))

2557

if isinstance(client_object.__getattribute__(attrname),

2558

collections.Callable):

2559

parent_pipe.send(('function', ))

2115

2560

else:

2116

parent_pipe.send(('data', client_object

2117

.__getattribute__(attrname)))

2561

parent_pipe.send((

2562

'data', client_object.__getattribute__(attrname)))

2118

2563

2119

2564

if command == 'setattr':

2120

2565

attrname = request[1]

2151

2596

# avoid excessive use of external libraries.

2152

2597

2153

2598

# New type for defining tokens, syntax, and semantics all-in-one

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2599

Token = collections.namedtuple("Token", (

2600

"regexp", # To match token; if "value" is not None, must have

2601

# a "group" containing digits

2602

"value", # datetime.timedelta or None

2603

"followers")) # Tokens valid after this token

2163

2604

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2164

2605

# the "duration" ABNF definition in RFC 3339, Appendix A.

2165

2606

token_end = Token(re.compile(r"$"), None, frozenset())

2166

2607

token_second = Token(re.compile(r"(\d+)S"),

2167

2608

datetime.timedelta(seconds=1),

2168

frozenset((token_end,)))

2609

frozenset((token_end, )))

2169

2610

token_minute = Token(re.compile(r"(\d+)M"),

2170

2611

datetime.timedelta(minutes=1),

2171

2612

frozenset((token_second, token_end)))

2187

2628

frozenset((token_month, token_end)))

2188

2629

token_week = Token(re.compile(r"(\d+)W"),

2189

2630

datetime.timedelta(weeks=1),

2190

frozenset((token_end,)))

2631

frozenset((token_end, )))

2191

2632

token_duration = Token(re.compile(r"P"), None,

2192

2633

frozenset((token_year, token_month,

2193

2634

token_day, token_time,

2195

2636

# Define starting values

2196

2637

value = datetime.timedelta() # Value so far

2197

2638

found_token = None

2198

followers = frozenset((token_duration,)) # Following valid tokens

2639

followers = frozenset((token_duration, )) # Following valid tokens

2199

2640

s = duration # String left to parse

2200

2641

# Loop until end token is found

2201

2642

while found_token is not token_end:

2218

2659

break

2219

2660

else:

2220

2661

# No currently valid tokens were found

2221

raise ValueError("Invalid RFC 3339 duration")

2662

raise ValueError("Invalid RFC 3339 duration: {!r}"

2663

.format(duration))

2222

2664

# End token found

2223

2665

return value

2224

2666

2261

2703

elif suffix == "w":

2262

2704

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2263

2705

else:

2264

raise ValueError("Unknown suffix {!r}"

2265

.format(suffix))

2706

raise ValueError("Unknown suffix {!r}".format(suffix))

2266

2707

except IndexError as e:

2267

2708

raise ValueError(*(e.args))

2268

2709

timevalue += delta

2284

2725

# Close all standard open file descriptors

2285

2726

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2286

2727

if not stat.S_ISCHR(os.fstat(null).st_mode):

2287

raise OSError(errno.ENODEV, "{} not a character device"

2728

raise OSError(errno.ENODEV,

2729

"{} not a character device"

2288

2730

.format(os.devnull))

2289

2731

os.dup2(null, sys.stdin.fileno())

2290

2732

os.dup2(null, sys.stdout.fileno())

2356

2798

"port": "",

2357

2799

"debug": "False",

2358

2800

"priority":

2359

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2801

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2360

2803

"servicename": "Mandos",

2361

2804

"use_dbus": "True",

2362

2805

"use_ipv6": "True",

2366

2809

"statedir": "/var/lib/mandos",

2367

2810

"foreground": "False",

2368

2811

"zeroconf": "True",

2369

}

2812

}

2370

2813

2371

2814

# Parse config file for server-global settings

2372

2815

server_config = configparser.SafeConfigParser(server_defaults)

2373

2816

del server_defaults

2374

server_config.read(os.path.join(options.configdir,

2375

"mandos.conf"))

2817

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2376

2818

# Convert the SafeConfigParser object to a dict

2377

2819

server_settings = server_config.defaults()

2378

2820

# Use the appropriate methods on the non-string config options

2396

2838

# Override the settings from the config file with command line

2397

2839

# options, if set.

2398

2840

for option in ("interface", "address", "port", "debug",

2399

"priority", "servicename", "configdir",

2400

"use_dbus", "use_ipv6", "debuglevel", "restore",

2401

"statedir", "socket", "foreground", "zeroconf"):

2841

"priority", "servicename", "configdir", "use_dbus",

2842

"use_ipv6", "debuglevel", "restore", "statedir",

2843

"socket", "foreground", "zeroconf"):

2402

2844

value = getattr(options, option)

2403

2845

if value is not None:

2404

2846

server_settings[option] = value

2419

2861

2420

2862

##################################################################

2421

2863

2422

if (not server_settings["zeroconf"] and

2423

not (server_settings["port"]

2424

or server_settings["socket"] != "")):

2425

parser.error("Needs port or socket to work without"

2426

" Zeroconf")

2864

if (not server_settings["zeroconf"]

2865

and not (server_settings["port"]

2866

or server_settings["socket"] != "")):

2867

parser.error("Needs port or socket to work without Zeroconf")

2427

2868

2428

2869

# For convenience

2429

2870

debug = server_settings["debug"]

2445

2886

initlogger(debug, level)

2446

2887

2447

2888

if server_settings["servicename"] != "Mandos":

2448

syslogger.setFormatter(logging.Formatter

2449

('Mandos ({}) [%(process)d]:'

2450

' %(levelname)s: %(message)s'

2451

.format(server_settings

2452

["servicename"])))

2889

syslogger.setFormatter(

2890

logging.Formatter('Mandos ({}) [%(process)d]:'

2891

' %(levelname)s: %(message)s'.format(

2892

server_settings["servicename"])))

2453

2893

2454

2894

# Parse config file with clients

2455

2895

client_config = configparser.SafeConfigParser(Client

2463

2903

socketfd = None

2464

2904

if server_settings["socket"] != "":

2465

2905

socketfd = server_settings["socket"]

2466

tcp_server = MandosServer((server_settings["address"],

2467

server_settings["port"]),

2468

ClientHandler,

2469

interface=(server_settings["interface"]

2470

or None),

2471

use_ipv6=use_ipv6,

2472

gnutls_priority=

2473

server_settings["priority"],

2474

use_dbus=use_dbus,

2475

socketfd=socketfd)

2906

tcp_server = MandosServer(

2907

(server_settings["address"], server_settings["port"]),

2908

ClientHandler,

2909

interface=(server_settings["interface"] or None),

2910

use_ipv6=use_ipv6,

2911

gnutls_priority=server_settings["priority"],

2912

use_dbus=use_dbus,

2913

socketfd=socketfd)

2476

2914

if not foreground:

2477

2915

pidfilename = "/run/mandos.pid"

2478

2916

if not os.path.isdir("/run/."):

2479

2917

pidfilename = "/var/run/mandos.pid"

2480

2918

pidfile = None

2481

2919

try:

2482

pidfile = open(pidfilename, "w")

2920

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2483

2921

except IOError as e:

2484

2922

logger.error("Could not open file %r", pidfilename,

2485

2923

exc_info=e)

2486

2924

2487

for name in ("_mandos", "mandos", "nobody"):

2925

for name, group in (("_mandos", "_mandos"),

2926

("mandos", "mandos"),

2927

("nobody", "nogroup")):

2488

2928

try:

2489

2929

uid = pwd.getpwnam(name).pw_uid

2490

gid = pwd.getpwnam(name).pw_gid

2930

gid = pwd.getpwnam(group).pw_gid

2491

2931

break

2492

2932

except KeyError:

2493

2933

continue

2506

2946

2507

2947

# "Use a log level over 10 to enable all debugging options."

2508

2948

# - GnuTLS manual

2509

gnutls.library.functions.gnutls_global_set_log_level(11)

2949

gnutls.global_set_log_level(11)

2510

2950

2511

@gnutls.library.types.gnutls_log_func

2951

@gnutls.log_func

2512

2952

def debug_gnutls(level, string):

2513

2953

logger.debug("GnuTLS: %s", string[:-1])

2514

2954

2515

(gnutls.library.functions

2516

.gnutls_global_set_log_function(debug_gnutls))

2955

gnutls.global_set_log_function(debug_gnutls)

2517

2956

2518

2957

# Redirect stdin so all checkers get /dev/null

2519

2958

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2526

2965

# Close all input and output, do double fork, etc.

2527

2966

daemon()

2528

2967

2529

# multiprocessing will use threads, so before we use gobject we

2530

# need to inform gobject that threads will be used.

2531

gobject.threads_init()

2968

# multiprocessing will use threads, so before we use GObject we

2969

# need to inform GObject that threads will be used.

2970

GObject.threads_init()

2532

2971

2533

2972

global main_loop

2534

2973

# From the Avahi example code

2535

2974

DBusGMainLoop(set_as_default=True)

2536

main_loop = gobject.MainLoop()

2975

main_loop = GObject.MainLoop()

2537

2976

bus = dbus.SystemBus()

2538

2977

# End of Avahi example code

2539

2978

if use_dbus:

2540

2979

try:

2541

2980

bus_name = dbus.service.BusName("se.recompile.Mandos",

2542

bus, do_not_queue=True)

2543

old_bus_name = (dbus.service.BusName

2544

("se.bsnet.fukt.Mandos", bus,

2545

do_not_queue=True))

2546

except dbus.exceptions.NameExistsException as e:

2981

bus,

2982

do_not_queue=True)

2983

old_bus_name = dbus.service.BusName(

2984

"se.bsnet.fukt.Mandos", bus,

2985

do_not_queue=True)

2986

except dbus.exceptions.DBusException as e:

2547

2987

logger.error("Disabling D-Bus:", exc_info=e)

2548

2988

use_dbus = False

2549

2989

server_settings["use_dbus"] = False

2550

2990

tcp_server.use_dbus = False

2551

2991

if zeroconf:

2552

2992

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2553

service = AvahiServiceToSyslog(name =

2554

server_settings["servicename"],

2555

servicetype = "_mandos._tcp",

2556

protocol = protocol, bus = bus)

2993

service = AvahiServiceToSyslog(

2994

name = server_settings["servicename"],

2995

servicetype = "_mandos._tcp",

2996

protocol = protocol,

2997

bus = bus)

2557

2998

if server_settings["interface"]:

2558

service.interface = (if_nametoindex

2559

(server_settings["interface"]

2560

.encode("utf-8")))

2999

service.interface = if_nametoindex(

3000

server_settings["interface"].encode("utf-8"))

2561

3001

2562

3002

global multiprocessing_manager

2563

3003

multiprocessing_manager = multiprocessing.Manager()

2582

3022

if server_settings["restore"]:

2583

3023

try:

2584

3024

with open(stored_state_path, "rb") as stored_state:

2585

clients_data, old_client_settings = (pickle.load

2586

(stored_state))

3025

clients_data, old_client_settings = pickle.load(

3026

stored_state)

2587

3027

os.remove(stored_state_path)

2588

3028

except IOError as e:

2589

3029

if e.errno == errno.ENOENT:

2590

logger.warning("Could not load persistent state: {}"

2591

.format(os.strerror(e.errno)))

3030

logger.warning("Could not load persistent state:"

3031

" {}".format(os.strerror(e.errno)))

2592

3032

else:

2593

3033

logger.critical("Could not load persistent state:",

2594

3034

exc_info=e)

2595

3035

raise

2596

3036

except EOFError as e:

2597

3037

logger.warning("Could not load persistent state: "

2598

"EOFError:", exc_info=e)

3038

"EOFError:",

3039

exc_info=e)

2599

3040

2600

3041

with PGPEngine() as pgp:

2601

3042

for client_name, client in clients_data.items():

2613

3054

# For each value in new config, check if it

2614

3055

# differs from the old config value (Except for

2615

3056

# the "secret" attribute)

2616

if (name != "secret" and

2617

value != old_client_settings[client_name]

2618

[name]):

3057

if (name != "secret"

3058

and (value !=

3059

old_client_settings[client_name][name])):

2619

3060

client[name] = value

2620

3061

except KeyError:

2621

3062

pass

2622

3063

2623

3064

# Clients who has passed its expire date can still be

2624

# enabled if its last checker was successful. Clients

3065

# enabled if its last checker was successful. A Client

2625

3066

# whose checker succeeded before we stored its state is

2626

3067

# assumed to have successfully run all checkers during

2627

3068

# downtime.

2630

3071

if not client["last_checked_ok"]:

2631

3072

logger.warning(

2632

3073

"disabling client {} - Client never "

2633

"performed a successful checker"

2634

.format(client_name))

3074

"performed a successful checker".format(

3075

client_name))

2635

3076

client["enabled"] = False

2636

3077

elif client["last_checker_status"] != 0:

2637

3078

logger.warning(

2638

3079

"disabling client {} - Client last"

2639

" checker failed with error code {}"

2640

.format(client_name,

2641

client["last_checker_status"]))

3080

" checker failed with error code"

3081

" {}".format(

3082

client_name,

3083

client["last_checker_status"]))

2642

3084

client["enabled"] = False

2643

3085

else:

2644

client["expires"] = (datetime.datetime

2645

.utcnow()

2646

+ client["timeout"])

3086

client["expires"] = (

3087

datetime.datetime.utcnow()

3088

+ client["timeout"])

2647

3089

logger.debug("Last checker succeeded,"

2648

" keeping {} enabled"

2649

.format(client_name))

3090

" keeping {} enabled".format(

3091

client_name))

2650

3092

try:

2651

client["secret"] = (

2652

pgp.decrypt(client["encrypted_secret"],

2653

client_settings[client_name]

2654

["secret"]))

3093

client["secret"] = pgp.decrypt(

3094

client["encrypted_secret"],

3095

client_settings[client_name]["secret"])

2655

3096

except PGPError:

2656

3097

# If decryption fails, we use secret from new settings

2657

logger.debug("Failed to decrypt {} old secret"

2658

.format(client_name))

2659

client["secret"] = (

2660

client_settings[client_name]["secret"])

3098

logger.debug("Failed to decrypt {} old secret".format(

3099

client_name))

3100

client["secret"] = (client_settings[client_name]

3101

["secret"])

2661

3102

2662

3103

# Add/remove clients based on new changes made to config

2663

3104

for client_name in (set(old_client_settings)

2670

3111

# Create all client objects

2671

3112

for client_name, client in clients_data.items():

2672

3113

tcp_server.clients[client_name] = client_class(

2673

name = client_name, settings = client,

3114

name = client_name,

3115

settings = client,

2674

3116

server_settings = server_settings)

2675

3117

2676

3118

if not tcp_server.clients:

2678

3120

2679

3121

if not foreground:

2680

3122

if pidfile is not None:

3123

pid = os.getpid()

2681

3124

try:

2682

3125

with pidfile:

2683

pid = os.getpid()

2684

pidfile.write("{}\n".format(pid).encode("utf-8"))

3126

print(pid, file=pidfile)

2685

3127

except IOError:

2686

3128

logger.error("Could not write to file %r with PID %d",

2687

3129

pidfilename, pid)

2692

3134

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2693

3135

2694

3136

if use_dbus:

2695

@alternate_dbus_interfaces({"se.recompile.Mandos":

2696

"se.bsnet.fukt.Mandos"})

2697

class MandosDBusService(DBusObjectWithProperties):

3137

3138

@alternate_dbus_interfaces(

3139

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3140

class MandosDBusService(DBusObjectWithObjectManager):

2698

3141

"""A D-Bus proxy object"""

3142

2699

3143

def __init__(self):

2700

3144

dbus.service.Object.__init__(self, bus, "/")

3145

2701

3146

_interface = "se.recompile.Mandos"

2702

3147

2703

@dbus_interface_annotations(_interface)

2704

def _foo(self):

2705

return { "org.freedesktop.DBus.Property"

2706

".EmitsChangedSignal":

2707

"false"}

2708

2709

3148

@dbus.service.signal(_interface, signature="o")

2710

3149

def ClientAdded(self, objpath):

2711

3150

"D-Bus signal"

2716

3155

"D-Bus signal"

2717

3156

pass

2718

3157

3158

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3159

"true"})

2719

3160

@dbus.service.signal(_interface, signature="os")

2720

3161

def ClientRemoved(self, objpath, name):

2721

3162

"D-Bus signal"

2722

3163

pass

2723

3164

3165

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3166

"true"})

2724

3167

@dbus.service.method(_interface, out_signature="ao")

2725

3168

def GetAllClients(self):

2726

3169

"D-Bus method"

2727

return dbus.Array(c.dbus_object_path

2728

for c in

3170

return dbus.Array(c.dbus_object_path for c in

2729

3171

tcp_server.clients.itervalues())

2730

3172

3173

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3174

"true"})

2731

3175

@dbus.service.method(_interface,

2732

3176

out_signature="a{oa{sv}}")

2733

3177

def GetAllClientsWithProperties(self):

2734

3178

"D-Bus method"

2735

3179

return dbus.Dictionary(

2736

{ c.dbus_object_path: c.GetAll("")

3180

{ c.dbus_object_path: c.GetAll(

3181

"se.recompile.Mandos.Client")

2737

3182

for c in tcp_server.clients.itervalues() },

2738

3183

signature="oa{sv}")

2739

3184

2744

3189

if c.dbus_object_path == object_path:

2745

3190

del tcp_server.clients[c.name]

2746

3191

c.remove_from_connection()

2747

# Don't signal anything except ClientRemoved

3192

# Don't signal the disabling

2748

3193

c.disable(quiet=True)

2749

# Emit D-Bus signal

2750

self.ClientRemoved(object_path, c.name)

3194

# Emit D-Bus signal for removal

3195

self.client_removed_signal(c)

2751

3196

return

2752

3197

raise KeyError(object_path)

2753

3198

2754

3199

del _interface

3200

3201

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3202

out_signature = "a{oa{sa{sv}}}")

3203

def GetManagedObjects(self):

3204

"""D-Bus method"""

3205

return dbus.Dictionary(

3206

{ client.dbus_object_path:

3207

dbus.Dictionary(

3208

{ interface: client.GetAll(interface)

3209

for interface in

3210

client._get_all_interface_names()})

3211

for client in tcp_server.clients.values()})

3212

3213

def client_added_signal(self, client):

3214

"""Send the new standard signal and the old signal"""

3215

if use_dbus:

3216

# New standard signal

3217

self.InterfacesAdded(

3218

client.dbus_object_path,

3219

dbus.Dictionary(

3220

{ interface: client.GetAll(interface)

3221

for interface in

3222

client._get_all_interface_names()}))

3223

# Old signal

3224

self.ClientAdded(client.dbus_object_path)

3225

3226

def client_removed_signal(self, client):

3227

"""Send the new standard signal and the old signal"""

3228

if use_dbus:

3229

# New standard signal

3230

self.InterfacesRemoved(

3231

client.dbus_object_path,

3232

client._get_all_interface_names())

3233

# Old signal

3234

self.ClientRemoved(client.dbus_object_path,

3235

client.name)

2755

3236

2756

3237

mandos_dbus_service = MandosDBusService()

2757

3238

2780

3261

# + secret.

2781

3262

exclude = { "bus", "changedstate", "secret",

2782

3263

"checker", "server_settings" }

2783

for name, typ in (inspect.getmembers

2784

(dbus.service.Object)):

3264

for name, typ in inspect.getmembers(dbus.service

3265

.Object):

2785

3266

exclude.add(name)

2786

3267

2787

3268

client_dict["encrypted_secret"] = (client

2794

3275

del client_settings[client.name]["secret"]

2795

3276

2796

3277

try:

2797

with (tempfile.NamedTemporaryFile

2798

(mode='wb', suffix=".pickle", prefix='clients-',

2799

dir=os.path.dirname(stored_state_path),

2800

delete=False)) as stored_state:

3278

with tempfile.NamedTemporaryFile(

3279

mode='wb',

3280

suffix=".pickle",

3281

prefix='clients-',

3282

dir=os.path.dirname(stored_state_path),

3283

delete=False) as stored_state:

2801

3284

pickle.dump((clients, client_settings), stored_state)

2802

tempname=stored_state.name

3285

tempname = stored_state.name

2803

3286

os.rename(tempname, stored_state_path)

2804

3287

except (IOError, OSError) as e:

2805

3288

if not debug:

2820

3303

name, client = tcp_server.clients.popitem()

2821

3304

if use_dbus:

2822

3305

client.remove_from_connection()

2823

# Don't signal anything except ClientRemoved

3306

# Don't signal the disabling

2824

3307

client.disable(quiet=True)

3308

# Emit D-Bus signal for removal

2825

3309

if use_dbus:

2826

# Emit D-Bus signal

2827

mandos_dbus_service.ClientRemoved(client

2828

.dbus_object_path,

2829

client.name)

3310

mandos_dbus_service.client_removed_signal(client)

2830

3311

client_settings.clear()

2831

3312

2832

3313

atexit.register(cleanup)

2833

3314

2834

3315

for client in tcp_server.clients.itervalues():

2835

3316

if use_dbus:

2836

# Emit D-Bus signal

2837

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3317

# Emit D-Bus signal for adding

3318

mandos_dbus_service.client_added_signal(client)

2838

3319

# Need to initiate checking of clients

2839

3320

if client.enabled:

2840

3321

client.init_checker()

2866

3347

sys.exit(1)

2867

3348

# End of Avahi example code

2868

3349

2869

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3350

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2870

3351

lambda *args, **kwargs:

2871

3352

(tcp_server.handle_request

2872

3353

(*args[2:], **kwargs) or True))

2885

3366

# Must run before the D-Bus bus name gets deregistered

2886

3367

cleanup()

2887

3368

3369

2888

3370

if __name__ == '__main__':

2889

3371

main()