201
241
def decrypt(self, data, password):
202
242
passphrase = self.password_encode(password)
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
243
with tempfile.NamedTemporaryFile(
244
dir = self.tempdir) as passfile:
205
245
passfile.write(passphrase)
207
proc = subprocess.Popen(['gpg', '--decrypt',
247
proc = subprocess.Popen([self.gpg, '--decrypt',
208
248
'--passphrase-file',
210
250
+ self.gnupgargs,
211
251
stdin = subprocess.PIPE,
212
252
stdout = subprocess.PIPE,
213
253
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
254
decrypted_plaintext, err = proc.communicate(input = data)
216
255
if proc.returncode != 0:
217
256
raise PGPError(err)
218
257
return decrypted_plaintext
259
# Pretend that we have an Avahi module
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
267
DBUS_NAME = "org.freedesktop.Avahi"
268
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
269
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
270
DBUS_PATH_SERVER = "/"
271
def string_array_to_txt_array(self, t):
272
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
273
for s in t), signature="ay")
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
221
284
class AvahiError(Exception):
222
285
def __init__(self, value, *args, **kwargs):
223
286
self.value = value
224
super(AvahiError, self).__init__(value, *args, **kwargs)
225
def __unicode__(self):
226
return unicode(repr(self.value))
287
return super(AvahiError, self).__init__(value, *args,
228
291
class AvahiServiceError(AvahiError):
231
295
class AvahiGroupError(AvahiError):
383
469
follow_name_owner_changes=True),
384
470
avahi.DBUS_INTERFACE_SERVER)
385
471
self.server.connect_to_signal("StateChanged",
386
self.server_state_changed)
472
self.server_state_changed)
387
473
self.server_state_changed(self.server.GetState())
390
476
class AvahiServiceToSyslog(AvahiService):
477
def rename(self, *args, **kwargs):
392
478
"""Add the new name to the syslog messages"""
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({0}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
479
ret = AvahiService.rename(self, *args, **kwargs)
480
syslogger.setFormatter(logging.Formatter(
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
401
def timedelta_to_milliseconds(td):
402
"Convert a datetime.timedelta() to milliseconds"
403
return ((td.days * 24 * 60 * 60 * 1000)
404
+ (td.seconds * 1000)
405
+ (td.microseconds // 1000))
485
# Pretend that we have a GnuTLS module
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
501
# Unless otherwise indicated, the constants and types below are
502
# all from the gnutls/gnutls.h C header file.
512
E_NO_CERTIFICATE_FOUND = -49
513
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
516
class session_int(ctypes.Structure):
518
session_t = ctypes.POINTER(session_int)
519
class certificate_credentials_st(ctypes.Structure):
521
certificate_credentials_t = ctypes.POINTER(
522
certificate_credentials_st)
523
certificate_type_t = ctypes.c_int
524
class datum_t(ctypes.Structure):
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
('size', ctypes.c_uint)]
527
class openpgp_crt_int(ctypes.Structure):
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
531
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
532
credentials_type_t = ctypes.c_int
533
transport_ptr_t = ctypes.c_void_p
534
close_request_t = ctypes.c_int
537
class Error(Exception):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
543
# Default usage is by a message string, but if a return
544
# code is passed, convert it to a string with
547
if message is None and code is not None:
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
552
class CertificateSecurityError(Error):
556
class Credentials(object):
558
self._c_object = gnutls.certificate_credentials_t()
559
gnutls.certificate_allocate_credentials(
560
ctypes.byref(self._c_object))
561
self.type = gnutls.CRD_CERTIFICATE
564
gnutls.certificate_free_credentials(self._c_object)
566
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
568
self._c_object = gnutls.session_t()
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
570
gnutls.set_default_priority(self._c_object)
571
gnutls.transport_set_ptr(self._c_object, socket.fileno())
572
gnutls.handshake_set_private_extensions(self._c_object,
575
if credentials is None:
576
credentials = gnutls.Credentials()
577
gnutls.credentials_set(self._c_object, credentials.type,
578
ctypes.cast(credentials._c_object,
580
self.credentials = credentials
583
gnutls.deinit(self._c_object)
586
return gnutls.handshake(self._c_object)
588
def send(self, data):
592
data_len -= gnutls.record_send(self._c_object,
597
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
599
# Error handling functions
600
def _error_code(result):
601
"""A function to raise exceptions on errors, suitable
602
for the 'restype' attribute on ctypes functions"""
605
if result == gnutls.E_NO_CERTIFICATE_FOUND:
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
609
def _retry_on_error(result, func, arguments):
610
"""A function to retry on some errors, suitable
611
for the 'errcheck' attribute on ctypes functions"""
613
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
614
return _error_code(result)
615
result = func(*arguments)
618
# Unless otherwise indicated, the function declarations below are
619
# all from the gnutls/gnutls.h C header file.
622
priority_set_direct = _library.gnutls_priority_set_direct
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
624
ctypes.POINTER(ctypes.c_char_p)]
625
priority_set_direct.restype = _error_code
627
init = _library.gnutls_init
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
629
init.restype = _error_code
631
set_default_priority = _library.gnutls_set_default_priority
632
set_default_priority.argtypes = [session_t]
633
set_default_priority.restype = _error_code
635
record_send = _library.gnutls_record_send
636
record_send.argtypes = [session_t, ctypes.c_void_p,
638
record_send.restype = ctypes.c_ssize_t
639
record_send.errcheck = _retry_on_error
641
certificate_allocate_credentials = (
642
_library.gnutls_certificate_allocate_credentials)
643
certificate_allocate_credentials.argtypes = [
644
ctypes.POINTER(certificate_credentials_t)]
645
certificate_allocate_credentials.restype = _error_code
647
certificate_free_credentials = (
648
_library.gnutls_certificate_free_credentials)
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
650
certificate_free_credentials.restype = None
652
handshake_set_private_extensions = (
653
_library.gnutls_handshake_set_private_extensions)
654
handshake_set_private_extensions.argtypes = [session_t,
656
handshake_set_private_extensions.restype = None
658
credentials_set = _library.gnutls_credentials_set
659
credentials_set.argtypes = [session_t, credentials_type_t,
661
credentials_set.restype = _error_code
663
strerror = _library.gnutls_strerror
664
strerror.argtypes = [ctypes.c_int]
665
strerror.restype = ctypes.c_char_p
667
certificate_type_get = _library.gnutls_certificate_type_get
668
certificate_type_get.argtypes = [session_t]
669
certificate_type_get.restype = _error_code
671
certificate_get_peers = _library.gnutls_certificate_get_peers
672
certificate_get_peers.argtypes = [session_t,
673
ctypes.POINTER(ctypes.c_uint)]
674
certificate_get_peers.restype = ctypes.POINTER(datum_t)
676
global_set_log_level = _library.gnutls_global_set_log_level
677
global_set_log_level.argtypes = [ctypes.c_int]
678
global_set_log_level.restype = None
680
global_set_log_function = _library.gnutls_global_set_log_function
681
global_set_log_function.argtypes = [log_func]
682
global_set_log_function.restype = None
684
deinit = _library.gnutls_deinit
685
deinit.argtypes = [session_t]
686
deinit.restype = None
688
handshake = _library.gnutls_handshake
689
handshake.argtypes = [session_t]
690
handshake.restype = _error_code
691
handshake.errcheck = _retry_on_error
693
transport_set_ptr = _library.gnutls_transport_set_ptr
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
695
transport_set_ptr.restype = None
697
bye = _library.gnutls_bye
698
bye.argtypes = [session_t, close_request_t]
699
bye.restype = _error_code
700
bye.errcheck = _retry_on_error
702
check_version = _library.gnutls_check_version
703
check_version.argtypes = [ctypes.c_char_p]
704
check_version.restype = ctypes.c_char_p
706
# All the function declarations below are from gnutls/openpgp.h
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
716
openpgp_crt_import.restype = _error_code
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
733
openpgp_crt_get_fingerprint.restype = _error_code
735
# Remove non-public functions
736
del _error_code, _retry_on_error
737
# Create the global "gnutls" object, simulating a module
740
def call_pipe(connection, # : multiprocessing.Connection
741
func, *args, **kwargs):
742
"""This function is meant to be called by multiprocessing.Process
744
This function runs func(*args, **kwargs), and writes the resulting
745
return value on the provided multiprocessing.Connection.
747
connection.send(func(*args, **kwargs))
408
750
class Client(object):
409
751
"""A representation of a client host served by this server.
620
949
# Schedule a new checker to be started an 'interval' from now,
621
950
# and every interval from then on.
622
951
if self.checker_initiator_tag is not None:
623
gobject.source_remove(self.checker_initiator_tag)
624
self.checker_initiator_tag = (gobject.timeout_add
625
(self.interval_milliseconds(),
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
954
int(self.interval.total_seconds() * 1000),
627
956
# Schedule a disable() when 'timeout' has passed
628
957
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
self.disable_initiator_tag = (gobject.timeout_add
631
(self.timeout_milliseconds(),
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
960
int(self.timeout.total_seconds() * 1000), self.disable)
633
961
# Also start a new checker *right now*.
634
962
self.start_checker()
636
def checker_callback(self, pid, condition, command):
964
def checker_callback(self, source, condition, connection,
637
966
"""The checker has completed, so take appropriate actions."""
638
967
self.checker_callback_tag = None
639
968
self.checker = None
640
if os.WIFEXITED(condition):
641
self.last_checker_status = os.WEXITSTATUS(condition)
969
# Read return code from connection (see call_pipe)
970
returncode = connection.recv()
974
self.last_checker_status = returncode
975
self.last_checker_signal = None
642
976
if self.last_checker_status == 0:
643
977
logger.info("Checker for %(name)s succeeded",
645
979
self.checked_ok()
647
logger.info("Checker for %(name)s failed",
981
logger.info("Checker for %(name)s failed", vars(self))
650
983
self.last_checker_status = -1
984
self.last_checker_signal = -returncode
651
985
logger.warning("Checker for %(name)s crashed?",
654
989
def checked_ok(self):
655
990
"""Assert that the client has been seen, alive and well."""
656
991
self.last_checked_ok = datetime.datetime.utcnow()
657
992
self.last_checker_status = 0
993
self.last_checker_signal = None
658
994
self.bump_timeout()
660
996
def bump_timeout(self, timeout=None):
687
1022
# than 'timeout' for the client to be disabled, which is as it
690
# If a checker exists, make sure it is not a zombie
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
695
except OSError as error:
696
if error.errno != errno.ECHILD:
700
logger.warning("Checker was a zombie")
701
gobject.source_remove(self.checker_callback_tag)
702
self.checker_callback(pid, status,
703
self.current_checker_command)
1025
if self.checker is not None and not self.checker.is_alive():
1026
logger.warning("Checker was not alive; joining")
704
1029
# Start a new checker if needed
705
1030
if self.checker is None:
706
1031
# Escape attributes for the shell
707
escaped_attrs = dict(
708
(attr, re.escape(unicode(getattr(self, attr))))
710
self.runtime_expansions)
1033
attr: re.escape(str(getattr(self, attr)))
1034
for attr in self.runtime_expansions }
712
1036
command = self.checker_command % escaped_attrs
713
1037
except TypeError as error:
714
1038
logger.error('Could not format string "%s"',
715
self.checker_command, exc_info=error)
716
return True # Try again later
1039
self.checker_command,
1041
return True # Try again later
717
1042
self.current_checker_command = command
719
logger.info("Starting checker %r for %s",
721
# We don't need to redirect stdout and stderr, since
722
# in normal mode, that is already done by daemon(),
723
# and in debug mode we don't want to. (Stdin is
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
733
self.checker = subprocess.Popen(command,
737
except OSError as error:
738
logger.error("Failed to start subprocess",
741
self.checker_callback_tag = (gobject.child_watch_add
743
self.checker_callback,
745
# The checker may have completed before the gobject
746
# watch was added. Check for this.
748
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
749
except OSError as error:
750
if error.errno == errno.ECHILD:
751
# This should never happen
752
logger.error("Child process vanished",
757
gobject.source_remove(self.checker_callback_tag)
758
self.checker_callback(pid, status, command)
759
# Re-run this periodically if run by gobject.timeout_add
1043
logger.info("Starting checker %r for %s", command,
1045
# We don't need to redirect stdout and stderr, since
1046
# in normal mode, that is already done by daemon(),
1047
# and in debug mode we don't want to. (Stdin is
1048
# always replaced by /dev/null.)
1049
# The exception is when not debugging but nevertheless
1050
# running in the foreground; use the previously
1052
popen_args = { "close_fds": True,
1055
if (not self.server_settings["debug"]
1056
and self.server_settings["foreground"]):
1057
popen_args.update({"stdout": wnull,
1059
pipe = multiprocessing.Pipe(duplex = False)
1060
self.checker = multiprocessing.Process(
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1064
self.checker.start()
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1067
self.checker_callback, pipe[0], command)
1068
# Re-run this periodically if run by GObject.timeout_add
762
1071
def stop_checker(self):
763
1072
"""Force the checker process, if any, to stop."""
764
1073
if self.checker_callback_tag:
765
gobject.source_remove(self.checker_callback_tag)
1074
GObject.source_remove(self.checker_callback_tag)
766
1075
self.checker_callback_tag = None
767
1076
if getattr(self, "checker", None) is None:
769
1078
logger.debug("Stopping checker for %(name)s", vars(self))
771
self.checker.terminate()
773
#if self.checker.poll() is None:
774
# self.checker.kill()
775
except OSError as error:
776
if error.errno != errno.ESRCH: # No such process
1079
self.checker.terminate()
778
1080
self.checker = None
781
def dbus_service_property(dbus_interface, signature="v",
782
access="readwrite", byte_arrays=False):
1083
def dbus_service_property(dbus_interface,
783
1087
"""Decorators for marking methods of a DBusObjectWithProperties to
784
1088
become properties on the D-Bus.
879
1189
If called like _is_dbus_thing("method") it returns a function
880
1190
suitable for use as predicate to inspect.getmembers().
882
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1192
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
1195
def _get_all_dbus_things(self, thing):
886
1196
"""Returns a generator of (name, attribute) pairs
888
return ((getattr(athing.__get__(self), "_dbus_name",
1198
return ((getattr(athing.__get__(self), "_dbus_name", name),
890
1199
athing.__get__(self))
891
1200
for cls in self.__class__.__mro__
892
1201
for name, athing in
893
inspect.getmembers(cls,
894
self._is_dbus_thing(thing)))
1202
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1204
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1208
def Introspect(self, object_path, connection):
1209
"""Overloading of standard D-Bus method.
1211
Inserts annotation tags on methods and signals.
1213
xmlstring = dbus.service.Object.Introspect(self, object_path,
1216
document = xml.dom.minidom.parseString(xmlstring)
1218
for if_tag in document.getElementsByTagName("interface"):
1219
# Add annotation tags
1220
for typ in ("method", "signal"):
1221
for tag in if_tag.getElementsByTagName(typ):
1223
for name, prop in (self.
1224
_get_all_dbus_things(typ)):
1225
if (name == tag.getAttribute("name")
1226
and prop._dbus_interface
1227
== if_tag.getAttribute("name")):
1228
annots.update(getattr(
1229
prop, "_dbus_annotations", {}))
1230
for name, value in annots.items():
1231
ann_tag = document.createElement(
1233
ann_tag.setAttribute("name", name)
1234
ann_tag.setAttribute("value", value)
1235
tag.appendChild(ann_tag)
1236
# Add interface annotation tags
1237
for annotation, value in dict(
1238
itertools.chain.from_iterable(
1239
annotations().items()
1240
for name, annotations
1241
in self._get_all_dbus_things("interface")
1242
if name == if_tag.getAttribute("name")
1244
ann_tag = document.createElement("annotation")
1245
ann_tag.setAttribute("name", annotation)
1246
ann_tag.setAttribute("value", value)
1247
if_tag.appendChild(ann_tag)
1248
# Fix argument name for the Introspect method itself
1249
if (if_tag.getAttribute("name")
1250
== dbus.INTROSPECTABLE_IFACE):
1251
for cn in if_tag.getElementsByTagName("method"):
1252
if cn.getAttribute("name") == "Introspect":
1253
for arg in cn.getElementsByTagName("arg"):
1254
if (arg.getAttribute("direction")
1256
arg.setAttribute("name",
1258
xmlstring = document.toxml("utf-8")
1260
except (AttributeError, xml.dom.DOMException,
1261
xml.parsers.expat.ExpatError) as error:
1262
logger.error("Failed to override Introspection method",
1267
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1268
"""A D-Bus object with properties.
1270
Classes inheriting from this can use the dbus_service_property
1271
decorator to expose methods as D-Bus properties. It exposes the
1272
standard Get(), Set(), and GetAll() methods on the D-Bus.
896
1275
def _get_dbus_property(self, interface_name, property_name):
897
1276
"""Returns a bound method if one exists which is a D-Bus
898
1277
property with the specified name and interface.
900
for cls in self.__class__.__mro__:
901
for name, value in (inspect.getmembers
903
self._is_dbus_thing("property"))):
1279
for cls in self.__class__.__mro__:
1280
for name, value in inspect.getmembers(
1281
cls, self._is_dbus_thing("property")):
904
1282
if (value._dbus_name == property_name
905
1283
and value._dbus_interface == interface_name):
906
1284
return value.__get__(self)
908
1286
# No such property
909
raise DBusPropertyNotFound(self.dbus_object_path + ":"
910
+ interface_name + "."
913
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1287
raise DBusPropertyNotFound("{}:{}.{}".format(
1288
self.dbus_object_path, interface_name, property_name))
1291
def _get_all_interface_names(cls):
1292
"""Get a sequence of all interfaces supported by an object"""
1293
return (name for name in set(getattr(getattr(x, attr),
1294
"_dbus_interface", None)
1295
for x in (inspect.getmro(cls))
1297
if name is not None)
1299
@dbus.service.method(dbus.PROPERTIES_IFACE,
914
1301
out_signature="v")
915
1302
def Get(self, interface_name, property_name):
916
1303
"""Standard D-Bus property Get() method, see D-Bus standard.
1047
1431
exc_info=error)
1048
1432
return xmlstring
1435
dbus.OBJECT_MANAGER_IFACE
1436
except AttributeError:
1437
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1439
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1440
"""A D-Bus object with an ObjectManager.
1442
Classes inheriting from this exposes the standard
1443
GetManagedObjects call and the InterfacesAdded and
1444
InterfacesRemoved signals on the standard
1445
"org.freedesktop.DBus.ObjectManager" interface.
1447
Note: No signals are sent automatically; they must be sent
1450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1451
out_signature = "a{oa{sa{sv}}}")
1452
def GetManagedObjects(self):
1453
"""This function must be overridden"""
1454
raise NotImplementedError()
1456
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1457
signature = "oa{sa{sv}}")
1458
def InterfacesAdded(self, object_path, interfaces_and_properties):
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1462
def InterfacesRemoved(self, object_path, interfaces):
1465
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1469
def Introspect(self, object_path, connection):
1470
"""Overloading of standard D-Bus method.
1472
Override return argument name of GetManagedObjects to be
1473
"objpath_interfaces_and_properties"
1475
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1479
document = xml.dom.minidom.parseString(xmlstring)
1481
for if_tag in document.getElementsByTagName("interface"):
1482
# Fix argument name for the GetManagedObjects method
1483
if (if_tag.getAttribute("name")
1484
== dbus.OBJECT_MANAGER_IFACE):
1485
for cn in if_tag.getElementsByTagName("method"):
1486
if (cn.getAttribute("name")
1487
== "GetManagedObjects"):
1488
for arg in cn.getElementsByTagName("arg"):
1489
if (arg.getAttribute("direction")
1493
"objpath_interfaces"
1495
xmlstring = document.toxml("utf-8")
1497
except (AttributeError, xml.dom.DOMException,
1498
xml.parsers.expat.ExpatError) as error:
1499
logger.error("Failed to override Introspection method",
1051
1503
def datetime_to_dbus(dt, variant_level=0):
1052
1504
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1054
1506
return dbus.String("", variant_level = variant_level)
1055
return dbus.String(dt.isoformat(),
1056
variant_level=variant_level)
1507
return dbus.String(dt.isoformat(), variant_level=variant_level)
1059
1510
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1089
1541
# Ignore non-D-Bus attributes, and D-Bus attributes
1090
1542
# with the wrong interface name
1091
1543
if (not hasattr(attribute, "_dbus_interface")
1092
or not attribute._dbus_interface
1093
.startswith(orig_interface_name)):
1544
or not attribute._dbus_interface.startswith(
1545
orig_interface_name)):
1095
1547
# Create an alternate D-Bus interface name based on
1096
1548
# the current name
1097
alt_interface = (attribute._dbus_interface
1098
.replace(orig_interface_name,
1099
alt_interface_name))
1549
alt_interface = attribute._dbus_interface.replace(
1550
orig_interface_name, alt_interface_name)
1100
1551
interface_names.add(alt_interface)
1101
1552
# Is this a D-Bus signal?
1102
1553
if getattr(attribute, "_dbus_is_signal", False):
1103
1554
# Extract the original non-method undecorated
1104
1555
# function by black magic
1105
nonmethod_func = (dict(
1556
if sys.version_info.major == 2:
1557
nonmethod_func = (dict(
1106
1558
zip(attribute.func_code.co_freevars,
1107
attribute.__closure__))["func"]
1559
attribute.__closure__))
1560
["func"].cell_contents)
1562
nonmethod_func = (dict(
1563
zip(attribute.__code__.co_freevars,
1564
attribute.__closure__))
1565
["func"].cell_contents)
1109
1566
# Create a new, but exactly alike, function
1110
1567
# object, and decorate it to be a new D-Bus signal
1111
1568
# with the alternate D-Bus interface name
1112
new_function = (dbus.service.signal
1114
attribute._dbus_signature)
1115
(types.FunctionType(
1116
nonmethod_func.func_code,
1117
nonmethod_func.func_globals,
1118
nonmethod_func.func_name,
1119
nonmethod_func.func_defaults,
1120
nonmethod_func.func_closure)))
1569
new_function = copy_function(nonmethod_func)
1570
new_function = (dbus.service.signal(
1572
attribute._dbus_signature)(new_function))
1121
1573
# Copy annotations, if any
1123
new_function._dbus_annotations = (
1124
dict(attribute._dbus_annotations))
1575
new_function._dbus_annotations = dict(
1576
attribute._dbus_annotations)
1125
1577
except AttributeError:
1127
1579
# Define a creator of a function to call both the
1330
1794
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1331
1795
Client.__del__(self, *args, **kwargs)
1333
def checker_callback(self, pid, condition, command,
1335
self.checker_callback_tag = None
1337
if os.WIFEXITED(condition):
1338
exitstatus = os.WEXITSTATUS(condition)
1797
def checker_callback(self, source, condition,
1798
connection, command, *args, **kwargs):
1799
ret = Client.checker_callback(self, source, condition,
1800
connection, command, *args,
1802
exitstatus = self.last_checker_status
1339
1804
# Emit D-Bus signal
1340
1805
self.CheckerCompleted(dbus.Int16(exitstatus),
1341
dbus.Int64(condition),
1806
# This is specific to GNU libC
1807
dbus.Int64(exitstatus << 8),
1342
1808
dbus.String(command))
1344
1810
# Emit D-Bus signal
1345
1811
self.CheckerCompleted(dbus.Int16(-1),
1346
dbus.Int64(condition),
1813
# This is specific to GNU libC
1815
| self.last_checker_signal),
1347
1816
dbus.String(command))
1349
return Client.checker_callback(self, pid, condition, command,
1352
1819
def start_checker(self, *args, **kwargs):
1353
old_checker = self.checker
1354
if self.checker is not None:
1355
old_checker_pid = self.checker.pid
1357
old_checker_pid = None
1820
old_checker_pid = getattr(self.checker, "pid", None)
1358
1821
r = Client.start_checker(self, *args, **kwargs)
1359
1822
# Only if new checker process was started
1360
1823
if (self.checker is not None
1476
1938
self.approved_by_default = bool(value)
1478
1940
# ApprovalDelay - property
1479
@dbus_service_property(_interface, signature="t",
1941
@dbus_service_property(_interface,
1480
1943
access="readwrite")
1481
1944
def ApprovalDelay_dbus_property(self, value=None):
1482
1945
if value is None: # get
1483
return dbus.UInt64(self.approval_delay_milliseconds())
1946
return dbus.UInt64(self.approval_delay.total_seconds()
1484
1948
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1486
1950
# ApprovalDuration - property
1487
@dbus_service_property(_interface, signature="t",
1951
@dbus_service_property(_interface,
1488
1953
access="readwrite")
1489
1954
def ApprovalDuration_dbus_property(self, value=None):
1490
1955
if value is None: # get
1491
return dbus.UInt64(timedelta_to_milliseconds(
1492
self.approval_duration))
1956
return dbus.UInt64(self.approval_duration.total_seconds()
1493
1958
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1495
1960
# Name - property
1962
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1496
1963
@dbus_service_property(_interface, signature="s", access="read")
1497
1964
def Name_dbus_property(self):
1498
1965
return dbus.String(self.name)
1500
1967
# Fingerprint - property
1969
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1501
1970
@dbus_service_property(_interface, signature="s", access="read")
1502
1971
def Fingerprint_dbus_property(self):
1503
1972
return dbus.String(self.fingerprint)
1505
1974
# Host - property
1506
@dbus_service_property(_interface, signature="s",
1975
@dbus_service_property(_interface,
1507
1977
access="readwrite")
1508
1978
def Host_dbus_property(self, value=None):
1509
1979
if value is None: # get
1510
1980
return dbus.String(self.host)
1511
self.host = unicode(value)
1981
self.host = str(value)
1513
1983
# Created - property
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1514
1986
@dbus_service_property(_interface, signature="s", access="read")
1515
1987
def Created_dbus_property(self):
1516
1988
return datetime_to_dbus(self.created)
1575
2049
if (getattr(self, "disable_initiator_tag", None)
1578
gobject.source_remove(self.disable_initiator_tag)
1579
self.disable_initiator_tag = (
1580
gobject.timeout_add(
1581
timedelta_to_milliseconds(self.expires - now),
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2054
int((self.expires - now).total_seconds() * 1000),
1584
2057
# ExtendedTimeout - property
1585
@dbus_service_property(_interface, signature="t",
2058
@dbus_service_property(_interface,
1586
2060
access="readwrite")
1587
2061
def ExtendedTimeout_dbus_property(self, value=None):
1588
2062
if value is None: # get
1589
return dbus.UInt64(self.extended_timeout_milliseconds())
2063
return dbus.UInt64(self.extended_timeout.total_seconds()
1590
2065
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1592
2067
# Interval - property
1593
@dbus_service_property(_interface, signature="t",
2068
@dbus_service_property(_interface,
1594
2070
access="readwrite")
1595
2071
def Interval_dbus_property(self, value=None):
1596
2072
if value is None: # get
1597
return dbus.UInt64(self.interval_milliseconds())
2073
return dbus.UInt64(self.interval.total_seconds() * 1000)
1598
2074
self.interval = datetime.timedelta(0, 0, 0, value)
1599
2075
if getattr(self, "checker_initiator_tag", None) is None:
1601
2077
if self.enabled:
1602
2078
# Reschedule checker run
1603
gobject.source_remove(self.checker_initiator_tag)
1604
self.checker_initiator_tag = (gobject.timeout_add
1605
(value, self.start_checker))
1606
self.start_checker() # Start one now, too
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2081
value, self.start_checker)
2082
self.start_checker() # Start one now, too
1608
2084
# Checker - property
1609
@dbus_service_property(_interface, signature="s",
2085
@dbus_service_property(_interface,
1610
2087
access="readwrite")
1611
2088
def Checker_dbus_property(self, value=None):
1612
2089
if value is None: # get
1613
2090
return dbus.String(self.checker_command)
1614
self.checker_command = unicode(value)
2091
self.checker_command = str(value)
1616
2093
# CheckerRunning - property
1617
@dbus_service_property(_interface, signature="b",
2094
@dbus_service_property(_interface,
1618
2096
access="readwrite")
1619
2097
def CheckerRunning_dbus_property(self, value=None):
1620
2098
if value is None: # get
1846
2313
def fingerprint(openpgp):
1847
2314
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1848
2315
# New GnuTLS "datum" with the OpenPGP public key
1849
datum = (gnutls.library.types
1850
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1853
ctypes.c_uint(len(openpgp))))
2316
datum = gnutls.datum_t(
2317
ctypes.cast(ctypes.c_char_p(openpgp),
2318
ctypes.POINTER(ctypes.c_ubyte)),
2319
ctypes.c_uint(len(openpgp)))
1854
2320
# New empty GnuTLS certificate
1855
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2321
crt = gnutls.openpgp_crt_t()
2322
gnutls.openpgp_crt_init(ctypes.byref(crt))
1858
2323
# Import the OpenPGP public key into the certificate
1859
(gnutls.library.functions
1860
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1861
gnutls.library.constants
1862
.GNUTLS_OPENPGP_FMT_RAW))
2324
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2325
gnutls.OPENPGP_FMT_RAW)
1863
2326
# Verify the self signature in the key
1864
2327
crtverify = ctypes.c_uint()
1865
(gnutls.library.functions
1866
.gnutls_openpgp_crt_verify_self(crt, 0,
1867
ctypes.byref(crtverify)))
2328
gnutls.openpgp_crt_verify_self(crt, 0,
2329
ctypes.byref(crtverify))
1868
2330
if crtverify.value != 0:
1869
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1870
raise (gnutls.errors.CertificateSecurityError
2331
gnutls.openpgp_crt_deinit(crt)
2332
raise gnutls.CertificateSecurityError("Verify failed")
1872
2333
# New buffer for the fingerprint
1873
2334
buf = ctypes.create_string_buffer(20)
1874
2335
buf_len = ctypes.c_size_t()
1875
2336
# Get the fingerprint from the certificate into the buffer
1876
(gnutls.library.functions
1877
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1878
ctypes.byref(buf_len)))
2337
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2338
ctypes.byref(buf_len))
1879
2339
# Deinit the certificate
1880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2340
gnutls.openpgp_crt_deinit(crt)
1881
2341
# Convert the buffer to a Python bytestring
1882
2342
fpr = ctypes.string_at(buf, buf_len.value)
1883
2343
# Convert the bytestring to hexadecimal notation
2511
2995
# Close all input and output, do double fork, etc.
2514
# multiprocessing will use threads, so before we use gobject we
2515
# need to inform gobject that threads will be used.
2516
gobject.threads_init()
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
2518
3002
global main_loop
2519
3003
# From the Avahi example code
2520
3004
DBusGMainLoop(set_as_default=True)
2521
main_loop = gobject.MainLoop()
3005
main_loop = GObject.MainLoop()
2522
3006
bus = dbus.SystemBus()
2523
3007
# End of Avahi example code
2526
3010
bus_name = dbus.service.BusName("se.recompile.Mandos",
2527
bus, do_not_queue=True)
2528
old_bus_name = (dbus.service.BusName
2529
("se.bsnet.fukt.Mandos", bus,
2531
except dbus.exceptions.NameExistsException as e:
3013
old_bus_name = dbus.service.BusName(
3014
"se.bsnet.fukt.Mandos", bus,
3016
except dbus.exceptions.DBusException as e:
2532
3017
logger.error("Disabling D-Bus:", exc_info=e)
2533
3018
use_dbus = False
2534
3019
server_settings["use_dbus"] = False
2535
3020
tcp_server.use_dbus = False
2536
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2537
service = AvahiServiceToSyslog(name =
2538
server_settings["servicename"],
2539
servicetype = "_mandos._tcp",
2540
protocol = protocol, bus = bus)
2541
if server_settings["interface"]:
2542
service.interface = (if_nametoindex
2543
(str(server_settings["interface"])))
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3023
service = AvahiServiceToSyslog(
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3028
if server_settings["interface"]:
3029
service.interface = if_nametoindex(
3030
server_settings["interface"].encode("utf-8"))
2545
3032
global multiprocessing_manager
2546
3033
multiprocessing_manager = multiprocessing.Manager()
2565
3052
if server_settings["restore"]:
2567
3054
with open(stored_state_path, "rb") as stored_state:
2568
clients_data, old_client_settings = (pickle.load
3055
if sys.version_info.major == 2:
3056
clients_data, old_client_settings = pickle.load(
3059
bytes_clients_data, bytes_old_client_settings = (
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3068
bytes_clients_data.items() }
3069
del bytes_clients_data
3070
for key in clients_data:
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3074
clients_data[key].items() }
3075
clients_data[key] = value
3077
value["client_structure"] = [
3079
if isinstance(s, bytes)
3081
value["client_structure"] ]
3083
for k in ("name", "host"):
3084
if isinstance(value[k], bytes):
3085
value[k] = value[k].decode("utf-8")
3086
## old_client_settings
3088
old_client_settings = {
3089
(key.decode("utf-8")
3090
if isinstance(key, bytes)
3093
bytes_old_client_settings.items() }
3094
del bytes_old_client_settings
3096
for value in old_client_settings.values():
3097
if isinstance(value["host"], bytes):
3098
value["host"] = (value["host"]
2570
3100
os.remove(stored_state_path)
2571
3101
except IOError as e:
2572
3102
if e.errno == errno.ENOENT:
2573
logger.warning("Could not load persistent state: {0}"
2574
.format(os.strerror(e.errno)))
3103
logger.warning("Could not load persistent state:"
3104
" {}".format(os.strerror(e.errno)))
2576
3106
logger.critical("Could not load persistent state:",
2579
3109
except EOFError as e:
2580
3110
logger.warning("Could not load persistent state: "
2581
"EOFError:", exc_info=e)
2583
3114
with PGPEngine() as pgp:
2584
for client_name, client in clients_data.iteritems():
3115
for client_name, client in clients_data.items():
2585
3116
# Skip removed clients
2586
3117
if client_name not in client_settings:
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2702
3233
@dbus.service.signal(_interface, signature="os")
2703
3234
def ClientRemoved(self, objpath, name):
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2707
3240
@dbus.service.method(_interface, out_signature="ao")
2708
3241
def GetAllClients(self):
2710
return dbus.Array(c.dbus_object_path
2712
tcp_server.clients.itervalues())
3243
return dbus.Array(c.dbus_object_path for c in
3244
tcp_server.clients.values())
3246
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2714
3248
@dbus.service.method(_interface,
2715
3249
out_signature="a{oa{sv}}")
2716
3250
def GetAllClientsWithProperties(self):
2718
3252
return dbus.Dictionary(
2719
((c.dbus_object_path, c.GetAll(""))
2720
for c in tcp_server.clients.itervalues()),
3253
{ c.dbus_object_path: c.GetAll(
3254
"se.recompile.Mandos.Client")
3255
for c in tcp_server.clients.values() },
2721
3256
signature="oa{sv}")
2723
3258
@dbus.service.method(_interface, in_signature="o")
2724
3259
def RemoveClient(self, object_path):
2726
for c in tcp_server.clients.itervalues():
3261
for c in tcp_server.clients.values():
2727
3262
if c.dbus_object_path == object_path:
2728
3263
del tcp_server.clients[c.name]
2729
3264
c.remove_from_connection()
2730
# Don't signal anything except ClientRemoved
3265
# Don't signal the disabling
2731
3266
c.disable(quiet=True)
2733
self.ClientRemoved(object_path, c.name)
3267
# Emit D-Bus signal for removal
3268
self.client_removed_signal(c)
2735
3270
raise KeyError(object_path)
3274
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3275
out_signature = "a{oa{sa{sv}}}")
3276
def GetManagedObjects(self):
3278
return dbus.Dictionary(
3279
{ client.dbus_object_path:
3281
{ interface: client.GetAll(interface)
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3286
def client_added_signal(self, client):
3287
"""Send the new standard signal and the old signal"""
3289
# New standard signal
3290
self.InterfacesAdded(
3291
client.dbus_object_path,
3293
{ interface: client.GetAll(interface)
3295
client._get_all_interface_names()}))
3297
self.ClientAdded(client.dbus_object_path)
3299
def client_removed_signal(self, client):
3300
"""Send the new standard signal and the old signal"""
3302
# New standard signal
3303
self.InterfacesRemoved(
3304
client.dbus_object_path,
3305
client._get_all_interface_names())
3307
self.ClientRemoved(client.dbus_object_path,
2739
3310
mandos_dbus_service = MandosDBusService()
2742
3313
"Cleanup function; run on exit"
2745
3317
multiprocessing.active_children()