/mandos/trunk : revision 829

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

38

41

39

import SocketServer as socketserver

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

40

46

import socket

41

47

import argparse

42

48

import datetime

43

49

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

51

54

import sys

52

55

import re

53

56

import os

62

65

import struct

63

66

import fcntl

64

67

import functools

65

import cPickle as pickle

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

66

72

import multiprocessing

67

73

import types

68

74

import binascii

69

75

import tempfile

70

76

import itertools

71

77

import collections

78

import codecs

72

79

73

80

import dbus

74

81

import dbus.service

75

import gobject

76

import avahi

82

try:

83

from gi.repository import GObject

84

except ImportError:

85

import gobject as GObject

77

86

from dbus.mainloop.glib import DBusGMainLoop

78

87

import ctypes

79

88

import ctypes.util

91

100

if sys.version_info.major == 2:

92

101

str = unicode

93

102

94

version = "1.6.9"

103

version = "1.7.5"

95

104

stored_state_file = "clients.pickle"

96

105

97

106

logger = logging.getLogger()

112

121

return interface_index

113

122

114

123

124

def copy_function(func):

125

"""Make a copy of a function"""

126

if sys.version_info.major == 2:

127

return types.FunctionType(func.func_code,

128

func.func_globals,

129

func.func_name,

130

func.func_defaults,

131

func.func_closure)

132

else:

133

return types.FunctionType(func.__code__,

134

func.__globals__,

135

func.__name__,

136

func.__defaults__,

137

func.__closure__)

138

139

115

140

def initlogger(debug, level=logging.WARNING):

116

141

"""init logger and add loglevel"""

117

142

144

169

145

170

def __init__(self):

146

171

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

172

self.gpg = "gpg"

173

try:

174

output = subprocess.check_output(["gpgconf"])

175

for line in output.splitlines():

176

name, text, path = line.split(b":")

177

if name == "gpg":

178

self.gpg = path

179

break

180

except OSError as e:

181

if e.errno != errno.ENOENT:

182

raise

147

183

self.gnupgargs = ['--batch',

148

'--home', self.tempdir,

184

'--homedir', self.tempdir,

149

185

'--force-mdc',

150

186

'--quiet',

151

187

'--no-use-agent']

190

226

dir=self.tempdir) as passfile:

191

227

passfile.write(passphrase)

192

228

passfile.flush()

193

proc = subprocess.Popen(['gpg', '--symmetric',

229

proc = subprocess.Popen([self.gpg, '--symmetric',

194

230

'--passphrase-file',

195

231

passfile.name]

196

232

+ self.gnupgargs,

208

244

dir = self.tempdir) as passfile:

209

245

passfile.write(passphrase)

210

246

passfile.flush()

211

proc = subprocess.Popen(['gpg', '--decrypt',

247

proc = subprocess.Popen([self.gpg, '--decrypt',

212

248

'--passphrase-file',

213

249

passfile.name]

214

250

+ self.gnupgargs,

220

256

raise PGPError(err)

221

257

return decrypted_plaintext

222

258

259

# Pretend that we have an Avahi module

260

class Avahi(object):

261

"""This isn't so much a class as it is a module-like namespace.

262

It is instantiated once, and simulates having an Avahi module."""

263

IF_UNSPEC = -1 # avahi-common/address.h

264

PROTO_UNSPEC = -1 # avahi-common/address.h

265

PROTO_INET = 0 # avahi-common/address.h

266

PROTO_INET6 = 1 # avahi-common/address.h

267

DBUS_NAME = "org.freedesktop.Avahi"

268

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

269

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

270

DBUS_PATH_SERVER = "/"

271

def string_array_to_txt_array(self, t):

272

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

273

for s in t), signature="ay")

274

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

275

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

276

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

277

SERVER_INVALID = 0 # avahi-common/defs.h

278

SERVER_REGISTERING = 1 # avahi-common/defs.h

279

SERVER_RUNNING = 2 # avahi-common/defs.h

280

SERVER_COLLISION = 3 # avahi-common/defs.h

281

SERVER_FAILURE = 4 # avahi-common/defs.h

282

avahi = Avahi()

223

283

224

284

class AvahiError(Exception):

225

285

def __init__(self, value, *args, **kwargs):

382

442

logger.error(bad_states[state] + ": %r", error)

383

443

self.cleanup()

384

444

elif state == avahi.SERVER_RUNNING:

385

self.add()

445

try:

446

self.add()

447

except dbus.exceptions.DBusException as error:

448

if (error.get_dbus_name()

449

== "org.freedesktop.Avahi.CollisionError"):

450

logger.info("Local Zeroconf service name"

451

" collision.")

452

return self.rename(remove=False)

453

else:

454

logger.critical("D-Bus Exception", exc_info=error)

455

self.cleanup()

456

os._exit(1)

386

457

else:

387

458

if error is None:

388

459

logger.debug("Unknown state: %r", state)

411

482

.format(self.name)))

412

483

return ret

413

484

485

# Pretend that we have a GnuTLS module

486

class GnuTLS(object):

487

"""This isn't so much a class as it is a module-like namespace.

488

It is instantiated once, and simulates having a GnuTLS module."""

489

490

_library = ctypes.cdll.LoadLibrary(

491

ctypes.util.find_library("gnutls"))

492

_need_version = b"3.3.0"

493

def __init__(self):

494

# Need to use class name "GnuTLS" here, since this method is

495

# called before the assignment to the "gnutls" global variable

496

# happens.

497

if GnuTLS.check_version(self._need_version) is None:

498

raise GnuTLS.Error("Needs GnuTLS {} or later"

499

.format(self._need_version))

500

501

# Unless otherwise indicated, the constants and types below are

502

# all from the gnutls/gnutls.h C header file.

503

504

# Constants

505

E_SUCCESS = 0

506

E_INTERRUPTED = -52

507

E_AGAIN = -28

508

CRT_OPENPGP = 2

509

CLIENT = 2

510

SHUT_RDWR = 0

511

CRD_CERTIFICATE = 1

512

E_NO_CERTIFICATE_FOUND = -49

513

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

514

515

# Types

516

class session_int(ctypes.Structure):

517

_fields_ = []

518

session_t = ctypes.POINTER(session_int)

519

class certificate_credentials_st(ctypes.Structure):

520

_fields_ = []

521

certificate_credentials_t = ctypes.POINTER(

522

certificate_credentials_st)

523

certificate_type_t = ctypes.c_int

524

class datum_t(ctypes.Structure):

525

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

526

('size', ctypes.c_uint)]

527

class openpgp_crt_int(ctypes.Structure):

528

_fields_ = []

529

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

530

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

531

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

532

credentials_type_t = ctypes.c_int

533

transport_ptr_t = ctypes.c_void_p

534

close_request_t = ctypes.c_int

535

536

# Exceptions

537

class Error(Exception):

538

# We need to use the class name "GnuTLS" here, since this

539

# exception might be raised from within GnuTLS.__init__,

540

# which is called before the assignment to the "gnutls"

541

# global variable has happened.

542

def __init__(self, message = None, code = None, args=()):

543

# Default usage is by a message string, but if a return

544

# code is passed, convert it to a string with

545

# gnutls.strerror()

546

self.code = code

547

if message is None and code is not None:

548

message = GnuTLS.strerror(code)

549

return super(GnuTLS.Error, self).__init__(

550

message, *args)

551

552

class CertificateSecurityError(Error):

553

pass

554

555

# Classes

556

class Credentials(object):

557

def __init__(self):

558

self._c_object = gnutls.certificate_credentials_t()

559

gnutls.certificate_allocate_credentials(

560

ctypes.byref(self._c_object))

561

self.type = gnutls.CRD_CERTIFICATE

562

563

def __del__(self):

564

gnutls.certificate_free_credentials(self._c_object)

565

566

class ClientSession(object):

567

def __init__(self, socket, credentials = None):

568

self._c_object = gnutls.session_t()

569

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

570

gnutls.set_default_priority(self._c_object)

571

gnutls.transport_set_ptr(self._c_object, socket.fileno())

572

gnutls.handshake_set_private_extensions(self._c_object,

573

True)

574

self.socket = socket

575

if credentials is None:

576

credentials = gnutls.Credentials()

577

gnutls.credentials_set(self._c_object, credentials.type,

578

ctypes.cast(credentials._c_object,

579

ctypes.c_void_p))

580

self.credentials = credentials

581

582

def __del__(self):

583

gnutls.deinit(self._c_object)

584

585

def handshake(self):

586

return gnutls.handshake(self._c_object)

587

588

def send(self, data):

589

data = bytes(data)

590

data_len = len(data)

591

while data_len > 0:

592

data_len -= gnutls.record_send(self._c_object,

593

data[-data_len:],

594

data_len)

595

596

def bye(self):

597

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

598

599

# Error handling functions

600

def _error_code(result):

601

"""A function to raise exceptions on errors, suitable

602

for the 'restype' attribute on ctypes functions"""

603

if result >= 0:

604

return result

605

if result == gnutls.E_NO_CERTIFICATE_FOUND:

606

raise gnutls.CertificateSecurityError(code = result)

607

raise gnutls.Error(code = result)

608

609

def _retry_on_error(result, func, arguments):

610

"""A function to retry on some errors, suitable

611

for the 'errcheck' attribute on ctypes functions"""

612

while result < 0:

613

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

614

return _error_code(result)

615

result = func(*arguments)

616

return result

617

618

# Unless otherwise indicated, the function declarations below are

619

# all from the gnutls/gnutls.h C header file.

620

621

# Functions

622

priority_set_direct = _library.gnutls_priority_set_direct

623

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

624

ctypes.POINTER(ctypes.c_char_p)]

625

priority_set_direct.restype = _error_code

626

627

init = _library.gnutls_init

628

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

629

init.restype = _error_code

630

631

set_default_priority = _library.gnutls_set_default_priority

632

set_default_priority.argtypes = [session_t]

633

set_default_priority.restype = _error_code

634

635

record_send = _library.gnutls_record_send

636

record_send.argtypes = [session_t, ctypes.c_void_p,

637

ctypes.c_size_t]

638

record_send.restype = ctypes.c_ssize_t

639

record_send.errcheck = _retry_on_error

640

641

certificate_allocate_credentials = (

642

_library.gnutls_certificate_allocate_credentials)

643

certificate_allocate_credentials.argtypes = [

644

ctypes.POINTER(certificate_credentials_t)]

645

certificate_allocate_credentials.restype = _error_code

646

647

certificate_free_credentials = (

648

_library.gnutls_certificate_free_credentials)

649

certificate_free_credentials.argtypes = [certificate_credentials_t]

650

certificate_free_credentials.restype = None

651

652

handshake_set_private_extensions = (

653

_library.gnutls_handshake_set_private_extensions)

654

handshake_set_private_extensions.argtypes = [session_t,

655

ctypes.c_int]

656

handshake_set_private_extensions.restype = None

657

658

credentials_set = _library.gnutls_credentials_set

659

credentials_set.argtypes = [session_t, credentials_type_t,

660

ctypes.c_void_p]

661

credentials_set.restype = _error_code

662

663

strerror = _library.gnutls_strerror

664

strerror.argtypes = [ctypes.c_int]

665

strerror.restype = ctypes.c_char_p

666

667

certificate_type_get = _library.gnutls_certificate_type_get

668

certificate_type_get.argtypes = [session_t]

669

certificate_type_get.restype = _error_code

670

671

certificate_get_peers = _library.gnutls_certificate_get_peers

672

certificate_get_peers.argtypes = [session_t,

673

ctypes.POINTER(ctypes.c_uint)]

674

certificate_get_peers.restype = ctypes.POINTER(datum_t)

675

676

global_set_log_level = _library.gnutls_global_set_log_level

677

global_set_log_level.argtypes = [ctypes.c_int]

678

global_set_log_level.restype = None

679

680

global_set_log_function = _library.gnutls_global_set_log_function

681

global_set_log_function.argtypes = [log_func]

682

global_set_log_function.restype = None

683

684

deinit = _library.gnutls_deinit

685

deinit.argtypes = [session_t]

686

deinit.restype = None

687

688

handshake = _library.gnutls_handshake

689

handshake.argtypes = [session_t]

690

handshake.restype = _error_code

691

handshake.errcheck = _retry_on_error

692

693

transport_set_ptr = _library.gnutls_transport_set_ptr

694

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

695

transport_set_ptr.restype = None

696

697

bye = _library.gnutls_bye

698

bye.argtypes = [session_t, close_request_t]

699

bye.restype = _error_code

700

bye.errcheck = _retry_on_error

701

702

check_version = _library.gnutls_check_version

703

check_version.argtypes = [ctypes.c_char_p]

704

check_version.restype = ctypes.c_char_p

705

706

# All the function declarations below are from gnutls/openpgp.h

707

708

openpgp_crt_init = _library.gnutls_openpgp_crt_init

709

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

710

openpgp_crt_init.restype = _error_code

711

712

openpgp_crt_import = _library.gnutls_openpgp_crt_import

713

openpgp_crt_import.argtypes = [openpgp_crt_t,

714

ctypes.POINTER(datum_t),

715

openpgp_crt_fmt_t]

716

openpgp_crt_import.restype = _error_code

717

718

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

719

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

720

ctypes.POINTER(ctypes.c_uint)]

721

openpgp_crt_verify_self.restype = _error_code

722

723

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

724

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

725

openpgp_crt_deinit.restype = None

726

727

openpgp_crt_get_fingerprint = (

728

_library.gnutls_openpgp_crt_get_fingerprint)

729

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

730

ctypes.c_void_p,

731

ctypes.POINTER(

732

ctypes.c_size_t)]

733

openpgp_crt_get_fingerprint.restype = _error_code

734

735

# Remove non-public functions

736

del _error_code, _retry_on_error

737

# Create the global "gnutls" object, simulating a module

738

gnutls = GnuTLS()

739

740

def call_pipe(connection, # : multiprocessing.Connection

741

func, *args, **kwargs):

742

"""This function is meant to be called by multiprocessing.Process

743

744

This function runs func(*args, **kwargs), and writes the resulting

745

return value on the provided multiprocessing.Connection.

746

"""

747

connection.send(func(*args, **kwargs))

748

connection.close()

414

749

415

750

class Client(object):

416

751

"""A representation of a client host served by this server.

422

757

checker: subprocess.Popen(); a running checker process used

423

758

to see if the client lives.

424

759

'None' if no process is running.

425

checker_callback_tag: a gobject event source tag, or None

760

checker_callback_tag: a GObject event source tag, or None

426

761

checker_command: string; External command which is run to check

427

762

if client lives. %() expansions are done at

428

763

runtime with vars(self) as dict, so that for

429

764

instance %(name)s can be used in the command.

430

checker_initiator_tag: a gobject event source tag, or None

765

checker_initiator_tag: a GObject event source tag, or None

431

766

created: datetime.datetime(); (UTC) object creation

432

767

client_structure: Object describing what attributes a client has

433

768

and is used for storing the client at exit

434

769

current_checker_command: string; current running checker_command

435

disable_initiator_tag: a gobject event source tag, or None

770

disable_initiator_tag: a GObject event source tag, or None

436

771

enabled: bool()

437

772

fingerprint: string (40 or 32 hexadecimal digits); used to

438

773

uniquely identify the client

443

778

last_checker_status: integer between 0 and 255 reflecting exit

444

779

status of last checker. -1 reflects crashed

445

780

checker, -2 means no checker completed yet.

781

last_checker_signal: The signal which killed the last checker, if

782

last_checker_status is -1

446

783

last_enabled: datetime.datetime(); (UTC) or None

447

784

name: string; from the config file, used in log messages and

448

785

D-Bus identifiers

499

836

client["fingerprint"] = (section["fingerprint"].upper()

500

837

.replace(" ", ""))

501

838

if "secret" in section:

502

client["secret"] = section["secret"].decode("base64")

839

client["secret"] = codecs.decode(section["secret"]

840

.encode("utf-8"),

841

"base64")

503

842

elif "secfile" in section:

504

843

with open(os.path.expanduser(os.path.expandvars

505

844

(section["secfile"])),

558

897

self.changedstate = multiprocessing_manager.Condition(

559

898

multiprocessing_manager.Lock())

560

899

self.client_structure = [attr

561

for attr in self.__dict__.iterkeys()

900

for attr in self.__dict__.keys()

562

901

if not attr.startswith("_")]

563

902

self.client_structure.append("client_structure")

564

903

590

929

if not quiet:

591

930

logger.info("Disabling client %s", self.name)

592

931

if getattr(self, "disable_initiator_tag", None) is not None:

593

gobject.source_remove(self.disable_initiator_tag)

932

GObject.source_remove(self.disable_initiator_tag)

594

933

self.disable_initiator_tag = None

595

934

self.expires = None

596

935

if getattr(self, "checker_initiator_tag", None) is not None:

597

gobject.source_remove(self.checker_initiator_tag)

936

GObject.source_remove(self.checker_initiator_tag)

598

937

self.checker_initiator_tag = None

599

938

self.stop_checker()

600

939

self.enabled = False

601

940

if not quiet:

602

941

self.send_changedstate()

603

# Do not run this again if called by a gobject.timeout_add

942

# Do not run this again if called by a GObject.timeout_add

604

943

return False

605

944

606

945

def __del__(self):

610

949

# Schedule a new checker to be started an 'interval' from now,

611

950

# and every interval from then on.

612

951

if self.checker_initiator_tag is not None:

613

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = gobject.timeout_add(

952

GObject.source_remove(self.checker_initiator_tag)

953

self.checker_initiator_tag = GObject.timeout_add(

615

954

int(self.interval.total_seconds() * 1000),

616

955

self.start_checker)

617

956

# Schedule a disable() when 'timeout' has passed

618

957

if self.disable_initiator_tag is not None:

619

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = gobject.timeout_add(

958

GObject.source_remove(self.disable_initiator_tag)

959

self.disable_initiator_tag = GObject.timeout_add(

621

960

int(self.timeout.total_seconds() * 1000), self.disable)

622

961

# Also start a new checker *right now*.

623

962

self.start_checker()

624

963

625

def checker_callback(self, pid, condition, command):

964

def checker_callback(self, source, condition, connection,

965

command):

626

966

"""The checker has completed, so take appropriate actions."""

627

967

self.checker_callback_tag = None

628

968

self.checker = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

969

# Read return code from connection (see call_pipe)

970

returncode = connection.recv()

971

connection.close()

972

973

if returncode >= 0:

974

self.last_checker_status = returncode

975

self.last_checker_signal = None

631

976

if self.last_checker_status == 0:

632

977

logger.info("Checker for %(name)s succeeded",

633

978

vars(self))

636

981

logger.info("Checker for %(name)s failed", vars(self))

637

982

else:

638

983

self.last_checker_status = -1

984

self.last_checker_signal = -returncode

639

985

logger.warning("Checker for %(name)s crashed?",

640

986

vars(self))

987

return False

641

988

642

989

def checked_ok(self):

643

990

"""Assert that the client has been seen, alive and well."""

644

991

self.last_checked_ok = datetime.datetime.utcnow()

645

992

self.last_checker_status = 0

993

self.last_checker_signal = None

646

994

self.bump_timeout()

647

995

648

996

def bump_timeout(self, timeout=None):

650

998

if timeout is None:

651

999

timeout = self.timeout

652

1000

if self.disable_initiator_tag is not None:

653

gobject.source_remove(self.disable_initiator_tag)

1001

GObject.source_remove(self.disable_initiator_tag)

654

1002

self.disable_initiator_tag = None

655

1003

if getattr(self, "enabled", False):

656

self.disable_initiator_tag = gobject.timeout_add(

1004

self.disable_initiator_tag = GObject.timeout_add(

657

1005

int(timeout.total_seconds() * 1000), self.disable)

658

1006

self.expires = datetime.datetime.utcnow() + timeout

659

1007

674

1022

# than 'timeout' for the client to be disabled, which is as it

675

1023

# should be.

676

1024

677

# If a checker exists, make sure it is not a zombie

678

try:

679

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

680

except AttributeError:

681

pass

682

except OSError as error:

683

if error.errno != errno.ECHILD:

684

raise

685

else:

686

if pid:

687

logger.warning("Checker was a zombie")

688

gobject.source_remove(self.checker_callback_tag)

689

self.checker_callback(pid, status,

690

self.current_checker_command)

1025

if self.checker is not None and not self.checker.is_alive():

1026

logger.warning("Checker was not alive; joining")

1027

self.checker.join()

1028

self.checker = None

691

1029

# Start a new checker if needed

692

1030

if self.checker is None:

693

1031

# Escape attributes for the shell

702

1040

exc_info=error)

703

1041

return True # Try again later

704

1042

self.current_checker_command = command

705

try:

706

logger.info("Starting checker %r for %s", command,

707

self.name)

708

# We don't need to redirect stdout and stderr, since

709

# in normal mode, that is already done by daemon(),

710

# and in debug mode we don't want to. (Stdin is

711

# always replaced by /dev/null.)

712

# The exception is when not debugging but nevertheless

713

# running in the foreground; use the previously

714

# created wnull.

715

popen_args = {}

716

if (not self.server_settings["debug"]

717

and self.server_settings["foreground"]):

718

popen_args.update({"stdout": wnull,

719

"stderr": wnull })

720

self.checker = subprocess.Popen(command,

721

close_fds=True,

722

shell=True,

723

cwd="/",

724

**popen_args)

725

except OSError as error:

726

logger.error("Failed to start subprocess",

727

exc_info=error)

728

return True

729

self.checker_callback_tag = gobject.child_watch_add(

730

self.checker.pid, self.checker_callback, data=command)

731

# The checker may have completed before the gobject

732

# watch was added. Check for this.

733

try:

734

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

735

except OSError as error:

736

if error.errno == errno.ECHILD:

737

# This should never happen

738

logger.error("Child process vanished",

739

exc_info=error)

740

return True

741

raise

742

if pid:

743

gobject.source_remove(self.checker_callback_tag)

744

self.checker_callback(pid, status, command)

745

# Re-run this periodically if run by gobject.timeout_add

1043

logger.info("Starting checker %r for %s", command,

1044

self.name)

1045

# We don't need to redirect stdout and stderr, since

1046

# in normal mode, that is already done by daemon(),

1047

# and in debug mode we don't want to. (Stdin is

1048

# always replaced by /dev/null.)

1049

# The exception is when not debugging but nevertheless

1050

# running in the foreground; use the previously

1051

# created wnull.

1052

popen_args = { "close_fds": True,

1053

"shell": True,

1054

"cwd": "/" }

1055

if (not self.server_settings["debug"]

1056

and self.server_settings["foreground"]):

1057

popen_args.update({"stdout": wnull,

1058

"stderr": wnull })

1059

pipe = multiprocessing.Pipe(duplex = False)

1060

self.checker = multiprocessing.Process(

1061

target = call_pipe,

1062

args = (pipe[1], subprocess.call, command),

1063

kwargs = popen_args)

1064

self.checker.start()

1065

self.checker_callback_tag = GObject.io_add_watch(

1066

pipe[0].fileno(), GObject.IO_IN,

1067

self.checker_callback, pipe[0], command)

1068

# Re-run this periodically if run by GObject.timeout_add

746

1069

return True

747

1070

748

1071

def stop_checker(self):

749

1072

"""Force the checker process, if any, to stop."""

750

1073

if self.checker_callback_tag:

751

gobject.source_remove(self.checker_callback_tag)

1074

GObject.source_remove(self.checker_callback_tag)

752

1075

self.checker_callback_tag = None

753

1076

if getattr(self, "checker", None) is None:

754

1077

return

755

1078

logger.debug("Stopping checker for %(name)s", vars(self))

756

try:

757

self.checker.terminate()

758

#time.sleep(0.5)

759

#if self.checker.poll() is None:

760

# self.checker.kill()

761

except OSError as error:

762

if error.errno != errno.ESRCH: # No such process

763

raise

1079

self.checker.terminate()

764

1080

self.checker = None

765

1081

766

1082

830

1146

access="r")

831

1147

def Property_dbus_property(self):

832

1148

return dbus.Boolean(False)

1149

1150

See also the DBusObjectWithAnnotations class.

833

1151

"""

834

1152

835

1153

def decorator(func):

857

1175

pass

858

1176

859

1177

860

class DBusObjectWithProperties(dbus.service.Object):

861

"""A D-Bus object with properties.

1178

class DBusObjectWithAnnotations(dbus.service.Object):

1179

"""A D-Bus object with annotations.

862

1180

863

Classes inheriting from this can use the dbus_service_property

864

decorator to expose methods as D-Bus properties. It exposes the

865

standard Get(), Set(), and GetAll() methods on the D-Bus.

1181

Classes inheriting from this can use the dbus_annotations

1182

decorator to add annotations to methods or signals.

866

1183

"""

867

1184

868

1185

@staticmethod

884

1201

for name, athing in

885

1202

inspect.getmembers(cls, self._is_dbus_thing(thing)))

886

1203

1204

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1205

out_signature = "s",

1206

path_keyword = 'object_path',

1207

connection_keyword = 'connection')

1208

def Introspect(self, object_path, connection):

1209

"""Overloading of standard D-Bus method.

1210

1211

Inserts annotation tags on methods and signals.

1212

"""

1213

xmlstring = dbus.service.Object.Introspect(self, object_path,

1214

connection)

1215

try:

1216

document = xml.dom.minidom.parseString(xmlstring)

1217

1218

for if_tag in document.getElementsByTagName("interface"):

1219

# Add annotation tags

1220

for typ in ("method", "signal"):

1221

for tag in if_tag.getElementsByTagName(typ):

1222

annots = dict()

1223

for name, prop in (self.

1224

_get_all_dbus_things(typ)):

1225

if (name == tag.getAttribute("name")

1226

and prop._dbus_interface

1227

== if_tag.getAttribute("name")):

1228

annots.update(getattr(

1229

prop, "_dbus_annotations", {}))

1230

for name, value in annots.items():

1231

ann_tag = document.createElement(

1232

"annotation")

1233

ann_tag.setAttribute("name", name)

1234

ann_tag.setAttribute("value", value)

1235

tag.appendChild(ann_tag)

1236

# Add interface annotation tags

1237

for annotation, value in dict(

1238

itertools.chain.from_iterable(

1239

annotations().items()

1240

for name, annotations

1241

in self._get_all_dbus_things("interface")

1242

if name == if_tag.getAttribute("name")

1243

)).items():

1244

ann_tag = document.createElement("annotation")

1245

ann_tag.setAttribute("name", annotation)

1246

ann_tag.setAttribute("value", value)

1247

if_tag.appendChild(ann_tag)

1248

# Fix argument name for the Introspect method itself

1249

if (if_tag.getAttribute("name")

1250

== dbus.INTROSPECTABLE_IFACE):

1251

for cn in if_tag.getElementsByTagName("method"):

1252

if cn.getAttribute("name") == "Introspect":

1253

for arg in cn.getElementsByTagName("arg"):

1254

if (arg.getAttribute("direction")

1255

== "out"):

1256

arg.setAttribute("name",

1257

"xml_data")

1258

xmlstring = document.toxml("utf-8")

1259

document.unlink()

1260

except (AttributeError, xml.dom.DOMException,

1261

xml.parsers.expat.ExpatError) as error:

1262

logger.error("Failed to override Introspection method",

1263

exc_info=error)

1264

return xmlstring

1265

1266

1267

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1268

"""A D-Bus object with properties.

1269

1270

Classes inheriting from this can use the dbus_service_property

1271

decorator to expose methods as D-Bus properties. It exposes the

1272

standard Get(), Set(), and GetAll() methods on the D-Bus.

1273

"""

1274

887

1275

def _get_dbus_property(self, interface_name, property_name):

888

1276

"""Returns a bound method if one exists which is a D-Bus

889

1277

property with the specified name and interface.

899

1287

raise DBusPropertyNotFound("{}:{}.{}".format(

900

1288

self.dbus_object_path, interface_name, property_name))

901

1289

1290

@classmethod

1291

def _get_all_interface_names(cls):

1292

"""Get a sequence of all interfaces supported by an object"""

1293

return (name for name in set(getattr(getattr(x, attr),

1294

"_dbus_interface", None)

1295

for x in (inspect.getmro(cls))

1296

for attr in dir(x))

1297

if name is not None)

1298

902

1299

@dbus.service.method(dbus.PROPERTIES_IFACE,

903

1300

in_signature="ss",

904

1301

out_signature="v")

974

1371

975

1372

Inserts property tags and interface annotation tags.

976

1373

"""

977

xmlstring = dbus.service.Object.Introspect(self, object_path,

978

connection)

1374

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1375

object_path,

1376

connection)

979

1377

try:

980

1378

document = xml.dom.minidom.parseString(xmlstring)

981

1379

994

1392

if prop._dbus_interface

995

1393

== if_tag.getAttribute("name")):

996

1394

if_tag.appendChild(tag)

997

# Add annotation tags

998

for typ in ("method", "signal", "property"):

999

for tag in if_tag.getElementsByTagName(typ):

1000

annots = dict()

1001

for name, prop in (self.

1002

_get_all_dbus_things(typ)):

1003

if (name == tag.getAttribute("name")

1004

and prop._dbus_interface

1005

== if_tag.getAttribute("name")):

1006

annots.update(getattr(

1007

prop, "_dbus_annotations", {}))

1008

for name, value in annots.items():

1009

ann_tag = document.createElement(

1010

"annotation")

1011

ann_tag.setAttribute("name", name)

1012

ann_tag.setAttribute("value", value)

1013

tag.appendChild(ann_tag)

1014

# Add interface annotation tags

1015

for annotation, value in dict(

1016

itertools.chain.from_iterable(

1017

annotations().items()

1018

for name, annotations

1019

in self._get_all_dbus_things("interface")

1020

if name == if_tag.getAttribute("name")

1021

)).items():

1022

ann_tag = document.createElement("annotation")

1023

ann_tag.setAttribute("name", annotation)

1024

ann_tag.setAttribute("value", value)

1025

if_tag.appendChild(ann_tag)

1395

# Add annotation tags for properties

1396

for tag in if_tag.getElementsByTagName("property"):

1397

annots = dict()

1398

for name, prop in self._get_all_dbus_things(

1399

"property"):

1400

if (name == tag.getAttribute("name")

1401

and prop._dbus_interface

1402

== if_tag.getAttribute("name")):

1403

annots.update(getattr(

1404

prop, "_dbus_annotations", {}))

1405

for name, value in annots.items():

1406

ann_tag = document.createElement(

1407

"annotation")

1408

ann_tag.setAttribute("name", name)

1409

ann_tag.setAttribute("value", value)

1410

tag.appendChild(ann_tag)

1026

1411

# Add the names to the return values for the

1027

1412

# "org.freedesktop.DBus.Properties" methods

1028

1413

if (if_tag.getAttribute("name")

1046

1431

exc_info=error)

1047

1432

return xmlstring

1048

1433

1434

try:

1435

dbus.OBJECT_MANAGER_IFACE

1436

except AttributeError:

1437

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1438

1439

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1440

"""A D-Bus object with an ObjectManager.

1441

1442

Classes inheriting from this exposes the standard

1443

GetManagedObjects call and the InterfacesAdded and

1444

InterfacesRemoved signals on the standard

1445

"org.freedesktop.DBus.ObjectManager" interface.

1446

1447

Note: No signals are sent automatically; they must be sent

1448

manually.

1449

"""

1450

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1451

out_signature = "a{oa{sa{sv}}}")

1452

def GetManagedObjects(self):

1453

"""This function must be overridden"""

1454

raise NotImplementedError()

1455

1456

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1457

signature = "oa{sa{sv}}")

1458

def InterfacesAdded(self, object_path, interfaces_and_properties):

1459

pass

1460

1461

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1462

def InterfacesRemoved(self, object_path, interfaces):

1463

pass

1464

1465

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1466

out_signature = "s",

1467

path_keyword = 'object_path',

1468

connection_keyword = 'connection')

1469

def Introspect(self, object_path, connection):

1470

"""Overloading of standard D-Bus method.

1471

1472

Override return argument name of GetManagedObjects to be

1473

"objpath_interfaces_and_properties"

1474

"""

1475

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1476

object_path,

1477

connection)

1478

try:

1479

document = xml.dom.minidom.parseString(xmlstring)

1480

1481

for if_tag in document.getElementsByTagName("interface"):

1482

# Fix argument name for the GetManagedObjects method

1483

if (if_tag.getAttribute("name")

1484

== dbus.OBJECT_MANAGER_IFACE):

1485

for cn in if_tag.getElementsByTagName("method"):

1486

if (cn.getAttribute("name")

1487

== "GetManagedObjects"):

1488

for arg in cn.getElementsByTagName("arg"):

1489

if (arg.getAttribute("direction")

1490

== "out"):

1491

arg.setAttribute(

1492

"name",

1493

"objpath_interfaces"

1494

"_and_properties")

1495

xmlstring = document.toxml("utf-8")

1496

document.unlink()

1497

except (AttributeError, xml.dom.DOMException,

1498

xml.parsers.expat.ExpatError) as error:

1499

logger.error("Failed to override Introspection method",

1500

exc_info = error)

1501

return xmlstring

1049

1502

1050

1503

def datetime_to_dbus(dt, variant_level=0):

1051

1504

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1100

1553

if getattr(attribute, "_dbus_is_signal", False):

1101

1554

# Extract the original non-method undecorated

1102

1555

# function by black magic

1103

nonmethod_func = (dict(

1104

zip(attribute.func_code.co_freevars,

1105

attribute.__closure__))

1106

["func"].cell_contents)

1556

if sys.version_info.major == 2:

1557

nonmethod_func = (dict(

1558

zip(attribute.func_code.co_freevars,

1559

attribute.__closure__))

1560

["func"].cell_contents)

1561

else:

1562

nonmethod_func = (dict(

1563

zip(attribute.__code__.co_freevars,

1564

attribute.__closure__))

1565

["func"].cell_contents)

1107

1566

# Create a new, but exactly alike, function

1108

1567

# object, and decorate it to be a new D-Bus signal

1109

1568

# with the alternate D-Bus interface name

1569

new_function = copy_function(nonmethod_func)

1110

1570

new_function = (dbus.service.signal(

1111

alt_interface, attribute._dbus_signature)

1112

(types.FunctionType(

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1571

alt_interface,

1572

attribute._dbus_signature)(new_function))

1118

1573

# Copy annotations, if any

1119

1574

try:

1120

1575

new_function._dbus_annotations = dict(

1130

1585

func1 and func2 to the "call_both" function

1131

1586

outside of its arguments"""

1132

1587

1588

@functools.wraps(func2)

1133

1589

def call_both(*args, **kwargs):

1134

1590

"""This function will emit two D-Bus

1135

1591

signals by calling func1 and func2"""

1136

1592

func1(*args, **kwargs)

1137

1593

func2(*args, **kwargs)

1594

# Make wrapper function look like a D-Bus signal

1595

for name, attr in inspect.getmembers(func2):

1596

if name.startswith("_dbus_"):

1597

setattr(call_both, name, attr)

1138

1598

1139

1599

return call_both

1140

1600

# Create the "call_both" function and add it to

1151

1611

alt_interface,

1152

1612

attribute._dbus_in_signature,

1153

1613

attribute._dbus_out_signature)

1154

(types.FunctionType(attribute.func_code,

1155

attribute.func_globals,

1156

attribute.func_name,

1157

attribute.func_defaults,

1158

attribute.func_closure)))

1614

(copy_function(attribute)))

1159

1615

# Copy annotations, if any

1160

1616

try:

1161

1617

attr[attrname]._dbus_annotations = dict(

1173

1629

attribute._dbus_access,

1174

1630

attribute._dbus_get_args_options

1175

1631

["byte_arrays"])

1176

(types.FunctionType(

1177

attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1632

(copy_function(attribute)))

1182

1633

# Copy annotations, if any

1183

1634

try:

1184

1635

attr[attrname]._dbus_annotations = dict(

1193

1644

# to the class.

1194

1645

attr[attrname] = (

1195

1646

dbus_interface_annotations(alt_interface)

1196

(types.FunctionType(attribute.func_code,

1197

attribute.func_globals,

1198

attribute.func_name,

1199

attribute.func_defaults,

1200

attribute.func_closure)))

1647

(copy_function(attribute)))

1201

1648

if deprecate:

1202

1649

# Deprecate all alternate interfaces

1203

1650

iname="_AlternateDBusNames_interface_annotation{}"

1216

1663

if interface_names:

1217

1664

# Replace the class with a new subclass of it with

1218

1665

# methods, signals, etc. as created above.

1219

cls = type(b"{}Alternate".format(cls.__name__),

1220

(cls, ), attr)

1666

if sys.version_info.major == 2:

1667

cls = type(b"{}Alternate".format(cls.__name__),

1668

(cls, ), attr)

1669

else:

1670

cls = type("{}Alternate".format(cls.__name__),

1671

(cls, ), attr)

1221

1672

return cls

1222

1673

1223

1674

return wrapper

1343

1794

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1344

1795

Client.__del__(self, *args, **kwargs)

1345

1796

1346

def checker_callback(self, pid, condition, command,

1347

*args, **kwargs):

1348

self.checker_callback_tag = None

1349

self.checker = None

1350

if os.WIFEXITED(condition):

1351

exitstatus = os.WEXITSTATUS(condition)

1797

def checker_callback(self, source, condition,

1798

connection, command, *args, **kwargs):

1799

ret = Client.checker_callback(self, source, condition,

1800

connection, command, *args,

1801

**kwargs)

1802

exitstatus = self.last_checker_status

1803

if exitstatus >= 0:

1352

1804

# Emit D-Bus signal

1353

1805

self.CheckerCompleted(dbus.Int16(exitstatus),

1354

dbus.Int64(condition),

1806

# This is specific to GNU libC

1807

dbus.Int64(exitstatus << 8),

1355

1808

dbus.String(command))

1356

1809

else:

1357

1810

# Emit D-Bus signal

1358

1811

self.CheckerCompleted(dbus.Int16(-1),

1359

dbus.Int64(condition),

1812

dbus.Int64(

1813

# This is specific to GNU libC

1814

(exitstatus << 8)

1815

| self.last_checker_signal),

1360

1816

dbus.String(command))

1361

1362

return Client.checker_callback(self, pid, condition, command,

1363

*args, **kwargs)

1817

return ret

1364

1818

1365

1819

def start_checker(self, *args, **kwargs):

1366

1820

old_checker_pid = getattr(self.checker, "pid", None)

1378

1832

1379

1833

def approve(self, value=True):

1380

1834

self.approved = value

1381

gobject.timeout_add(int(self.approval_duration.total_seconds()

1835

GObject.timeout_add(int(self.approval_duration.total_seconds()

1382

1836

* 1000), self._reset_approved)

1383

1837

self.send_changedstate()

1384

1838

1441

1895

self.checked_ok()

1442

1896

1443

1897

# Enable - method

1898

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1444

1899

@dbus.service.method(_interface)

1445

1900

def Enable(self):

1446

1901

"D-Bus method"

1447

1902

self.enable()

1448

1903

1449

1904

# StartChecker - method

1905

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1450

1906

@dbus.service.method(_interface)

1451

1907

def StartChecker(self):

1452

1908

"D-Bus method"

1453

1909

self.start_checker()

1454

1910

1455

1911

# Disable - method

1912

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1456

1913

@dbus.service.method(_interface)

1457

1914

def Disable(self):

1458

1915

"D-Bus method"

1459

1916

self.disable()

1460

1917

1461

1918

# StopChecker - method

1919

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1462

1920

@dbus.service.method(_interface)

1463

1921

def StopChecker(self):

1464

1922

self.stop_checker()

1500

1958

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1501

1959

1502

1960

# Name - property

1961

@dbus_annotations(

1962

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1503

1963

@dbus_service_property(_interface, signature="s", access="read")

1504

1964

def Name_dbus_property(self):

1505

1965

return dbus.String(self.name)

1506

1966

1507

1967

# Fingerprint - property

1968

@dbus_annotations(

1969

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1508

1970

@dbus_service_property(_interface, signature="s", access="read")

1509

1971

def Fingerprint_dbus_property(self):

1510

1972

return dbus.String(self.fingerprint)

1519

1981

self.host = str(value)

1520

1982

1521

1983

# Created - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1522

1986

@dbus_service_property(_interface, signature="s", access="read")

1523

1987

def Created_dbus_property(self):

1524

1988

return datetime_to_dbus(self.created)

1585

2049

if (getattr(self, "disable_initiator_tag", None)

1586

2050

is None):

1587

2051

return

1588

gobject.source_remove(self.disable_initiator_tag)

1589

self.disable_initiator_tag = gobject.timeout_add(

2052

GObject.source_remove(self.disable_initiator_tag)

2053

self.disable_initiator_tag = GObject.timeout_add(

1590

2054

int((self.expires - now).total_seconds() * 1000),

1591

2055

self.disable)

1592

2056

1612

2076

return

1613

2077

if self.enabled:

1614

2078

# Reschedule checker run

1615

gobject.source_remove(self.checker_initiator_tag)

1616

self.checker_initiator_tag = gobject.timeout_add(

2079

GObject.source_remove(self.checker_initiator_tag)

2080

self.checker_initiator_tag = GObject.timeout_add(

1617

2081

value, self.start_checker)

1618

2082

self.start_checker() # Start one now, too

1619

2083

1639

2103

self.stop_checker()

1640

2104

1641

2105

# ObjectPath - property

2106

@dbus_annotations(

2107

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2108

"org.freedesktop.DBus.Deprecated": "true"})

1642

2109

@dbus_service_property(_interface, signature="o", access="read")

1643

2110

def ObjectPath_dbus_property(self):

1644

2111

return self.dbus_object_path # is already a dbus.ObjectPath

1645

2112

1646

2113

# Secret = property

2114

@dbus_annotations(

2115

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2116

"invalidates"})

1647

2117

@dbus_service_property(_interface,

1648

2118

signature="ay",

1649

2119

access="write",

1659

2129

self._pipe = child_pipe

1660

2130

self._pipe.send(('init', fpr, address))

1661

2131

if not self._pipe.recv():

1662

raise KeyError()

2132

raise KeyError(fpr)

1663

2133

1664

2134

def __getattribute__(self, name):

1665

2135

if name == '_pipe':

1695

2165

logger.debug("Pipe FD: %d",

1696

2166

self.server.child_pipe.fileno())

1697

2167

1698

session = gnutls.connection.ClientSession(

1699

self.request, gnutls.connection .X509Credentials())

1700

1701

# Note: gnutls.connection.X509Credentials is really a

1702

# generic GnuTLS certificate credentials object so long as

1703

# no X.509 keys are added to it. Therefore, we can use it

1704

# here despite using OpenPGP certificates.

2168

session = gnutls.ClientSession(self.request)

1705

2169

1706

2170

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1707

2171

# "+AES-256-CBC", "+SHA1",

1711

2175

priority = self.server.gnutls_priority

1712

2176

if priority is None:

1713

2177

priority = "NORMAL"

1714

gnutls.library.functions.gnutls_priority_set_direct(

1715

session._c_object, priority, None)

2178

gnutls.priority_set_direct(session._c_object, priority,

2179

None)

1716

2180

1717

2181

# Start communication using the Mandos protocol

1718

2182

# Get protocol number

1728

2192

# Start GnuTLS connection

1729

2193

try:

1730

2194

session.handshake()

1731

except gnutls.errors.GNUTLSError as error:

2195

except gnutls.Error as error:

1732

2196

logger.warning("Handshake failed: %s", error)

1733

2197

# Do not run session.bye() here: the session is not

1734

2198

# established. Just abandon the request.

1740

2204

try:

1741

2205

fpr = self.fingerprint(

1742

2206

self.peer_certificate(session))

1743

except (TypeError,

1744

gnutls.errors.GNUTLSError) as error:

2207

except (TypeError, gnutls.Error) as error:

1745

2208

logger.warning("Bad certificate: %s", error)

1746

2209

return

1747

2210

logger.debug("Fingerprint: %s", fpr)

1805

2268

else:

1806

2269

delay -= time2 - time

1807

2270

1808

sent_size = 0

1809

while sent_size < len(client.secret):

1810

try:

1811

sent = session.send(client.secret[sent_size:])

1812

except gnutls.errors.GNUTLSError as error:

1813

logger.warning("gnutls send failed",

1814

exc_info=error)

1815

return

1816

logger.debug("Sent: %d, remaining: %d", sent,

1817

len(client.secret) - (sent_size

1818

+ sent))

1819

sent_size += sent

2271

try:

2272

session.send(client.secret)

2273

except gnutls.Error as error:

2274

logger.warning("gnutls send failed",

2275

exc_info = error)

2276

return

1820

2277

1821

2278

logger.info("Sending secret to %s", client.name)

1822

2279

# bump the timeout using extended_timeout

1830

2287

client.approvals_pending -= 1

1831

2288

try:

1832

2289

session.bye()

1833

except gnutls.errors.GNUTLSError as error:

2290

except gnutls.Error as error:

1834

2291

logger.warning("GnuTLS bye failed",

1835

2292

exc_info=error)

1836

2293

1838

2295

def peer_certificate(session):

1839

2296

"Return the peer's OpenPGP certificate as a bytestring"

1840

2297

# If not an OpenPGP certificate...

1841

if (gnutls.library.functions.gnutls_certificate_type_get(

1842

session._c_object)

1843

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1844

# ...do the normal thing

1845

return session.peer_certificate

2298

if (gnutls.certificate_type_get(session._c_object)

2299

!= gnutls.CRT_OPENPGP):

2300

# ...return invalid data

2301

return b""

1846

2302

list_size = ctypes.c_uint(1)

1847

cert_list = (gnutls.library.functions

1848

.gnutls_certificate_get_peers

2303

cert_list = (gnutls.certificate_get_peers

1849

2304

(session._c_object, ctypes.byref(list_size)))

1850

2305

if not bool(cert_list) and list_size.value != 0:

1851

raise gnutls.errors.GNUTLSError("error getting peer"

1852

" certificate")

2306

raise gnutls.Error("error getting peer certificate")

1853

2307

if list_size.value == 0:

1854

2308

return None

1855

2309

cert = cert_list[0]

1859

2313

def fingerprint(openpgp):

1860

2314

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1861

2315

# New GnuTLS "datum" with the OpenPGP public key

1862

datum = gnutls.library.types.gnutls_datum_t(

2316

datum = gnutls.datum_t(

1863

2317

ctypes.cast(ctypes.c_char_p(openpgp),

1864

2318

ctypes.POINTER(ctypes.c_ubyte)),

1865

2319

ctypes.c_uint(len(openpgp)))

1866

2320

# New empty GnuTLS certificate

1867

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1868

gnutls.library.functions.gnutls_openpgp_crt_init(

1869

ctypes.byref(crt))

2321

crt = gnutls.openpgp_crt_t()

2322

gnutls.openpgp_crt_init(ctypes.byref(crt))

1870

2323

# Import the OpenPGP public key into the certificate

1871

gnutls.library.functions.gnutls_openpgp_crt_import(

1872

crt, ctypes.byref(datum),

1873

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2324

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2325

gnutls.OPENPGP_FMT_RAW)

1874

2326

# Verify the self signature in the key

1875

2327

crtverify = ctypes.c_uint()

1876

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1877

crt, 0, ctypes.byref(crtverify))

2328

gnutls.openpgp_crt_verify_self(crt, 0,

2329

ctypes.byref(crtverify))

1878

2330

if crtverify.value != 0:

1879

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1880

raise gnutls.errors.CertificateSecurityError(

1881

"Verify failed")

2331

gnutls.openpgp_crt_deinit(crt)

2332

raise gnutls.CertificateSecurityError("Verify failed")

1882

2333

# New buffer for the fingerprint

1883

2334

buf = ctypes.create_string_buffer(20)

1884

2335

buf_len = ctypes.c_size_t()

1885

2336

# Get the fingerprint from the certificate into the buffer

1886

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1887

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2337

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2338

ctypes.byref(buf_len))

1888

2339

# Deinit the certificate

1889

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2340

gnutls.openpgp_crt_deinit(crt)

1890

2341

# Convert the buffer to a Python bytestring

1891

2342

fpr = ctypes.string_at(buf, buf_len.value)

1892

2343

# Convert the bytestring to hexadecimal notation

2036

2487

gnutls_priority GnuTLS priority string

2037

2488

use_dbus: Boolean; to emit D-Bus signals or not

2038

2489

2039

Assumes a gobject.MainLoop event loop.

2490

Assumes a GObject.MainLoop event loop.

2040

2491

"""

2041

2492

2042

2493

def __init__(self, server_address, RequestHandlerClass,

2067

2518

2068

2519

def add_pipe(self, parent_pipe, proc):

2069

2520

# Call "handle_ipc" for both data and EOF events

2070

gobject.io_add_watch(

2521

GObject.io_add_watch(

2071

2522

parent_pipe.fileno(),

2072

gobject.IO_IN | gobject.IO_HUP,

2523

GObject.IO_IN | GObject.IO_HUP,

2073

2524

functools.partial(self.handle_ipc,

2074

2525

parent_pipe = parent_pipe,

2075

2526

proc = proc))

2079

2530

proc = None,

2080

2531

client_object=None):

2081

2532

# error, or the other end of multiprocessing.Pipe has closed

2082

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2533

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2083

2534

# Wait for other process to exit

2084

2535

proc.join()

2085

2536

return False

2092

2543

fpr = request[1]

2093

2544

address = request[2]

2094

2545

2095

for c in self.clients.itervalues():

2546

for c in self.clients.values():

2096

2547

if c.fingerprint == fpr:

2097

2548

client = c

2098

2549

break

2106

2557

parent_pipe.send(False)

2107

2558

return False

2108

2559

2109

gobject.io_add_watch(

2560

GObject.io_add_watch(

2110

2561

parent_pipe.fileno(),

2111

gobject.IO_IN | gobject.IO_HUP,

2562

GObject.IO_IN | GObject.IO_HUP,

2112

2563

functools.partial(self.handle_ipc,

2113

2564

parent_pipe = parent_pipe,

2114

2565

proc = proc,

2128

2579

2129

2580

if command == 'getattr':

2130

2581

attrname = request[1]

2131

if callable(client_object.__getattribute__(attrname)):

2582

if isinstance(client_object.__getattribute__(attrname),

2583

collections.Callable):

2132

2584

parent_pipe.send(('function', ))

2133

2585

else:

2134

2586

parent_pipe.send((

2169

2621

# avoid excessive use of external libraries.

2170

2622

2171

2623

# New type for defining tokens, syntax, and semantics all-in-one

2172

Token = collections.namedtuple("Token",

2173

("regexp", # To match token; if

2174

# "value" is not None,

2175

# must have a "group"

2176

# containing digits

2177

"value", # datetime.timedelta or

2178

# None

2179

"followers")) # Tokens valid after

2180

# this token

2181

2624

Token = collections.namedtuple("Token", (

2182

2625

"regexp", # To match token; if "value" is not None, must have

2183

2626

# a "group" containing digits

2218

2661

# Define starting values

2219

2662

value = datetime.timedelta() # Value so far

2220

2663

found_token = None

2221

followers = frozenset((token_duration,)) # Following valid tokens

2664

followers = frozenset((token_duration, )) # Following valid tokens

2222

2665

s = duration # String left to parse

2223

2666

# Loop until end token is found

2224

2667

while found_token is not token_end:

2241

2684

break

2242

2685

else:

2243

2686

# No currently valid tokens were found

2244

raise ValueError("Invalid RFC 3339 duration")

2687

raise ValueError("Invalid RFC 3339 duration: {!r}"

2688

.format(duration))

2245

2689

# End token found

2246

2690

return value

2247

2691

2380

2824

"debug": "False",

2381

2825

"priority":

2382

2826

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2383

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2827

":+SIGN-DSA-SHA256",

2384

2828

"servicename": "Mandos",

2385

2829

"use_dbus": "True",

2386

2830

"use_ipv6": "True",

2498

2942

pidfilename = "/var/run/mandos.pid"

2499

2943

pidfile = None

2500

2944

try:

2501

pidfile = open(pidfilename, "w")

2945

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2502

2946

except IOError as e:

2503

2947

logger.error("Could not open file %r", pidfilename,

2504

2948

exc_info=e)

2505

2949

2506

for name in ("_mandos", "mandos", "nobody"):

2950

for name, group in (("_mandos", "_mandos"),

2951

("mandos", "mandos"),

2952

("nobody", "nogroup")):

2507

2953

try:

2508

2954

uid = pwd.getpwnam(name).pw_uid

2509

gid = pwd.getpwnam(name).pw_gid

2955

gid = pwd.getpwnam(group).pw_gid

2510

2956

break

2511

2957

except KeyError:

2512

2958

continue

2516

2962

try:

2517

2963

os.setgid(gid)

2518

2964

os.setuid(uid)

2965

if debug:

2966

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2967

gid))

2519

2968

except OSError as error:

2969

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2970

.format(uid, gid, os.strerror(error.errno)))

2520

2971

if error.errno != errno.EPERM:

2521

2972

raise

2522

2973

2525

2976

2526

2977

# "Use a log level over 10 to enable all debugging options."

2527

2978

# - GnuTLS manual

2528

gnutls.library.functions.gnutls_global_set_log_level(11)

2979

gnutls.global_set_log_level(11)

2529

2980

2530

@gnutls.library.types.gnutls_log_func

2981

@gnutls.log_func

2531

2982

def debug_gnutls(level, string):

2532

2983

logger.debug("GnuTLS: %s", string[:-1])

2533

2984

2534

gnutls.library.functions.gnutls_global_set_log_function(

2535

debug_gnutls)

2985

gnutls.global_set_log_function(debug_gnutls)

2536

2986

2537

2987

# Redirect stdin so all checkers get /dev/null

2538

2988

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2545

2995

# Close all input and output, do double fork, etc.

2546

2996

daemon()

2547

2997

2548

# multiprocessing will use threads, so before we use gobject we

2549

# need to inform gobject that threads will be used.

2550

gobject.threads_init()

2998

# multiprocessing will use threads, so before we use GObject we

2999

# need to inform GObject that threads will be used.

3000

GObject.threads_init()

2551

3001

2552

3002

global main_loop

2553

3003

# From the Avahi example code

2554

3004

DBusGMainLoop(set_as_default=True)

2555

main_loop = gobject.MainLoop()

3005

main_loop = GObject.MainLoop()

2556

3006

bus = dbus.SystemBus()

2557

3007

# End of Avahi example code

2558

3008

if use_dbus:

2563

3013

old_bus_name = dbus.service.BusName(

2564

3014

"se.bsnet.fukt.Mandos", bus,

2565

3015

do_not_queue=True)

2566

except dbus.exceptions.NameExistsException as e:

3016

except dbus.exceptions.DBusException as e:

2567

3017

logger.error("Disabling D-Bus:", exc_info=e)

2568

3018

use_dbus = False

2569

3019

server_settings["use_dbus"] = False

2602

3052

if server_settings["restore"]:

2603

3053

try:

2604

3054

with open(stored_state_path, "rb") as stored_state:

2605

clients_data, old_client_settings = pickle.load(

2606

stored_state)

3055

if sys.version_info.major == 2:

3056

clients_data, old_client_settings = pickle.load(

3057

stored_state)

3058

else:

3059

bytes_clients_data, bytes_old_client_settings = (

3060

pickle.load(stored_state, encoding = "bytes"))

3061

### Fix bytes to strings

3062

## clients_data

3063

# .keys()

3064

clients_data = { (key.decode("utf-8")

3065

if isinstance(key, bytes)

3066

else key): value

3067

for key, value in

3068

bytes_clients_data.items() }

3069

del bytes_clients_data

3070

for key in clients_data:

3071

value = { (k.decode("utf-8")

3072

if isinstance(k, bytes) else k): v

3073

for k, v in

3074

clients_data[key].items() }

3075

clients_data[key] = value

3076

# .client_structure

3077

value["client_structure"] = [

3078

(s.decode("utf-8")

3079

if isinstance(s, bytes)

3080

else s) for s in

3081

value["client_structure"] ]

3082

# .name & .host

3083

for k in ("name", "host"):

3084

if isinstance(value[k], bytes):

3085

value[k] = value[k].decode("utf-8")

3086

## old_client_settings

3087

# .keys()

3088

old_client_settings = {

3089

(key.decode("utf-8")

3090

if isinstance(key, bytes)

3091

else key): value

3092

for key, value in

3093

bytes_old_client_settings.items() }

3094

del bytes_old_client_settings

3095

# .host

3096

for value in old_client_settings.values():

3097

if isinstance(value["host"], bytes):

3098

value["host"] = (value["host"]

3099

.decode("utf-8"))

2607

3100

os.remove(stored_state_path)

2608

3101

except IOError as e:

2609

3102

if e.errno == errno.ENOENT:

2642

3135

pass

2643

3136

2644

3137

# Clients who has passed its expire date can still be

2645

# enabled if its last checker was successful. Clients

3138

# enabled if its last checker was successful. A Client

2646

3139

# whose checker succeeded before we stored its state is

2647

3140

# assumed to have successfully run all checkers during

2648

3141

# downtime.

2700

3193

2701

3194

if not foreground:

2702

3195

if pidfile is not None:

3196

pid = os.getpid()

2703

3197

try:

2704

3198

with pidfile:

2705

pid = os.getpid()

2706

pidfile.write("{}\n".format(pid).encode("utf-8"))

3199

print(pid, file=pidfile)

2707

3200

except IOError:

2708

3201

logger.error("Could not write to file %r with PID %d",

2709

3202

pidfilename, pid)

2717

3210

2718

3211

@alternate_dbus_interfaces(

2719

3212

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2720

class MandosDBusService(DBusObjectWithProperties):

3213

class MandosDBusService(DBusObjectWithObjectManager):

2721

3214

"""A D-Bus proxy object"""

2722

3215

2723

3216

def __init__(self):

2725

3218

2726

3219

_interface = "se.recompile.Mandos"

2727

3220

2728

@dbus_interface_annotations(_interface)

2729

def _foo(self):

2730

return {

2731

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2732

"false" }

2733

2734

3221

@dbus.service.signal(_interface, signature="o")

2735

3222

def ClientAdded(self, objpath):

2736

3223

"D-Bus signal"

2741

3228

"D-Bus signal"

2742

3229

pass

2743

3230

3231

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3232

"true"})

2744

3233

@dbus.service.signal(_interface, signature="os")

2745

3234

def ClientRemoved(self, objpath, name):

2746

3235

"D-Bus signal"

2747

3236

pass

2748

3237

3238

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3239

"true"})

2749

3240

@dbus.service.method(_interface, out_signature="ao")

2750

3241

def GetAllClients(self):

2751

3242

"D-Bus method"

2752

3243

return dbus.Array(c.dbus_object_path for c in

2753

tcp_server.clients.itervalues())

3244

tcp_server.clients.values())

2754

3245

3246

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3247

"true"})

2755

3248

@dbus.service.method(_interface,

2756

3249

out_signature="a{oa{sv}}")

2757

3250

def GetAllClientsWithProperties(self):

2758

3251

"D-Bus method"

2759

3252

return dbus.Dictionary(

2760

{ c.dbus_object_path: c.GetAll("")

2761

for c in tcp_server.clients.itervalues() },

3253

{ c.dbus_object_path: c.GetAll(

3254

"se.recompile.Mandos.Client")

3255

for c in tcp_server.clients.values() },

2762

3256

signature="oa{sv}")

2763

3257

2764

3258

@dbus.service.method(_interface, in_signature="o")

2765

3259

def RemoveClient(self, object_path):

2766

3260

"D-Bus method"

2767

for c in tcp_server.clients.itervalues():

3261

for c in tcp_server.clients.values():

2768

3262

if c.dbus_object_path == object_path:

2769

3263

del tcp_server.clients[c.name]

2770

3264

c.remove_from_connection()

2771

# Don't signal anything except ClientRemoved

3265

# Don't signal the disabling

2772

3266

c.disable(quiet=True)

2773

# Emit D-Bus signal

2774

self.ClientRemoved(object_path, c.name)

3267

# Emit D-Bus signal for removal

3268

self.client_removed_signal(c)

2775

3269

return

2776

3270

raise KeyError(object_path)

2777

3271

2778

3272

del _interface

3273

3274

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3275

out_signature = "a{oa{sa{sv}}}")

3276

def GetManagedObjects(self):

3277

"""D-Bus method"""

3278

return dbus.Dictionary(

3279

{ client.dbus_object_path:

3280

dbus.Dictionary(

3281

{ interface: client.GetAll(interface)

3282

for interface in

3283

client._get_all_interface_names()})

3284

for client in tcp_server.clients.values()})

3285

3286

def client_added_signal(self, client):

3287

"""Send the new standard signal and the old signal"""

3288

if use_dbus:

3289

# New standard signal

3290

self.InterfacesAdded(

3291

client.dbus_object_path,

3292

dbus.Dictionary(

3293

{ interface: client.GetAll(interface)

3294

for interface in

3295

client._get_all_interface_names()}))

3296

# Old signal

3297

self.ClientAdded(client.dbus_object_path)

3298

3299

def client_removed_signal(self, client):

3300

"""Send the new standard signal and the old signal"""

3301

if use_dbus:

3302

# New standard signal

3303

self.InterfacesRemoved(

3304

client.dbus_object_path,

3305

client._get_all_interface_names())

3306

# Old signal

3307

self.ClientRemoved(client.dbus_object_path,

3308

client.name)

2779

3309

2780

3310

mandos_dbus_service = MandosDBusService()

2781

3311

2794

3324

# removed/edited, old secret will thus be unrecovable.

2795

3325

clients = {}

2796

3326

with PGPEngine() as pgp:

2797

for client in tcp_server.clients.itervalues():

3327

for client in tcp_server.clients.values():

2798

3328

key = client_settings[client.name]["secret"]

2799

3329

client.encrypted_secret = pgp.encrypt(client.secret,

2800

3330

key)

2824

3354

prefix='clients-',

2825

3355

dir=os.path.dirname(stored_state_path),

2826

3356

delete=False) as stored_state:

2827

pickle.dump((clients, client_settings), stored_state)

3357

pickle.dump((clients, client_settings), stored_state,

3358

protocol = 2)

2828

3359

tempname = stored_state.name

2829

3360

os.rename(tempname, stored_state_path)

2830

3361

except (IOError, OSError) as e:

2846

3377

name, client = tcp_server.clients.popitem()

2847

3378

if use_dbus:

2848

3379

client.remove_from_connection()

2849

# Don't signal anything except ClientRemoved

3380

# Don't signal the disabling

2850

3381

client.disable(quiet=True)

3382

# Emit D-Bus signal for removal

2851

3383

if use_dbus:

2852

# Emit D-Bus signal

2853

mandos_dbus_service.ClientRemoved(

2854

client.dbus_object_path, client.name)

3384

mandos_dbus_service.client_removed_signal(client)

2855

3385

client_settings.clear()

2856

3386

2857

3387

atexit.register(cleanup)

2858

3388

2859

for client in tcp_server.clients.itervalues():

3389

for client in tcp_server.clients.values():

2860

3390

if use_dbus:

2861

# Emit D-Bus signal

2862

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3391

# Emit D-Bus signal for adding

3392

mandos_dbus_service.client_added_signal(client)

2863

3393

# Need to initiate checking of clients

2864

3394

if client.enabled:

2865

3395

client.init_checker()

2891

3421

sys.exit(1)

2892

3422

# End of Avahi example code

2893

3423

2894

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3424

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2895

3425

lambda *args, **kwargs:

2896

3426

(tcp_server.handle_request

2897

3427

(*args[2:], **kwargs) or True))