2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
14
# Copyright © 2008-2016 Teddy Hogeborn
15
15
# Copyright © 2008-2016 Björn Påhlsson
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
246
246
'--passphrase-file',
248
248
+ self.gnupgargs,
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
249
stdin = subprocess.PIPE,
250
stdout = subprocess.PIPE,
251
stderr = subprocess.PIPE)
252
ciphertext, err = proc.communicate(input = data)
253
253
if proc.returncode != 0:
254
254
raise PGPError(err)
255
255
return ciphertext
257
257
def decrypt(self, data, password):
258
258
passphrase = self.password_encode(password)
259
259
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
260
dir = self.tempdir) as passfile:
261
261
passfile.write(passphrase)
263
263
proc = subprocess.Popen([self.gpg, '--decrypt',
264
264
'--passphrase-file',
266
266
+ self.gnupgargs,
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
267
stdin = subprocess.PIPE,
268
stdout = subprocess.PIPE,
269
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
271
271
if proc.returncode != 0:
272
272
raise PGPError(err)
273
273
return decrypted_plaintext
276
275
# Pretend that we have an Avahi module
277
276
class Avahi(object):
278
277
"""This isn't so much a class as it is a module-like namespace.
279
278
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
284
283
DBUS_NAME = "org.freedesktop.Avahi"
285
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
286
DBUS_PATH_SERVER = "/"
289
287
def string_array_to_txt_array(self, t):
290
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
289
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
303
300
class AvahiError(Exception):
304
301
def __init__(self, value, *args, **kwargs):
305
302
self.value = value
501
498
.format(self.name)))
505
501
# Pretend that we have a GnuTLS module
506
502
class GnuTLS(object):
507
503
"""This isn't so much a class as it is a module-like namespace.
508
504
It is instantiated once, and simulates having a GnuTLS module."""
510
library = ctypes.util.find_library("gnutls")
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
515
508
_need_version = b"3.3.0"
517
509
def __init__(self):
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
524
517
# Unless otherwise indicated, the constants and types below are
525
518
# all from the gnutls/gnutls.h C header file.
529
522
E_INTERRUPTED = -52
534
527
CRD_CERTIFICATE = 1
535
528
E_NO_CERTIFICATE_FOUND = -49
536
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
539
532
class session_int(ctypes.Structure):
541
534
session_t = ctypes.POINTER(session_int)
543
535
class certificate_credentials_st(ctypes.Structure):
545
537
certificate_credentials_t = ctypes.POINTER(
546
538
certificate_credentials_st)
547
539
certificate_type_t = ctypes.c_int
549
540
class datum_t(ctypes.Structure):
550
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
542
('size', ctypes.c_uint)]
553
543
class openpgp_crt_int(ctypes.Structure):
555
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
548
credentials_type_t = ctypes.c_int
559
549
transport_ptr_t = ctypes.c_void_p
560
550
close_request_t = ctypes.c_int
563
553
class Error(Exception):
564
554
# We need to use the class name "GnuTLS" here, since this
565
555
# exception might be raised from within GnuTLS.__init__,
566
556
# which is called before the assignment to the "gnutls"
567
557
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
558
def __init__(self, message = None, code = None, args=()):
569
559
# Default usage is by a message string, but if a return
570
560
# code is passed, convert it to a string with
571
561
# gnutls.strerror()
640
630
return _error_code(result)
641
631
result = func(*arguments)
644
634
# Unless otherwise indicated, the function declarations below are
645
635
# all from the gnutls/gnutls.h C header file.
648
638
priority_set_direct = _library.gnutls_priority_set_direct
649
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
640
ctypes.POINTER(ctypes.c_char_p)]
651
641
priority_set_direct.restype = _error_code
653
643
init = _library.gnutls_init
654
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
645
init.restype = _error_code
657
647
set_default_priority = _library.gnutls_set_default_priority
658
648
set_default_priority.argtypes = [session_t]
659
649
set_default_priority.restype = _error_code
661
651
record_send = _library.gnutls_record_send
662
652
record_send.argtypes = [session_t, ctypes.c_void_p,
664
654
record_send.restype = ctypes.c_ssize_t
665
655
record_send.errcheck = _retry_on_error
667
657
certificate_allocate_credentials = (
668
658
_library.gnutls_certificate_allocate_credentials)
669
659
certificate_allocate_credentials.argtypes = [
670
660
ctypes.POINTER(certificate_credentials_t)]
671
661
certificate_allocate_credentials.restype = _error_code
673
663
certificate_free_credentials = (
674
664
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
677
666
certificate_free_credentials.restype = None
679
668
handshake_set_private_extensions = (
680
669
_library.gnutls_handshake_set_private_extensions)
681
670
handshake_set_private_extensions.argtypes = [session_t,
683
672
handshake_set_private_extensions.restype = None
685
674
credentials_set = _library.gnutls_credentials_set
686
675
credentials_set.argtypes = [session_t, credentials_type_t,
688
677
credentials_set.restype = _error_code
690
679
strerror = _library.gnutls_strerror
691
680
strerror.argtypes = [ctypes.c_int]
692
681
strerror.restype = ctypes.c_char_p
694
683
certificate_type_get = _library.gnutls_certificate_type_get
695
684
certificate_type_get.argtypes = [session_t]
696
685
certificate_type_get.restype = _error_code
698
687
certificate_get_peers = _library.gnutls_certificate_get_peers
699
688
certificate_get_peers.argtypes = [session_t,
700
689
ctypes.POINTER(ctypes.c_uint)]
701
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
692
global_set_log_level = _library.gnutls_global_set_log_level
704
693
global_set_log_level.argtypes = [ctypes.c_int]
705
694
global_set_log_level.restype = None
707
696
global_set_log_function = _library.gnutls_global_set_log_function
708
697
global_set_log_function.argtypes = [log_func]
709
698
global_set_log_function.restype = None
711
700
deinit = _library.gnutls_deinit
712
701
deinit.argtypes = [session_t]
713
702
deinit.restype = None
715
704
handshake = _library.gnutls_handshake
716
705
handshake.argtypes = [session_t]
717
706
handshake.restype = _error_code
718
707
handshake.errcheck = _retry_on_error
720
709
transport_set_ptr = _library.gnutls_transport_set_ptr
721
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
711
transport_set_ptr.restype = None
724
713
bye = _library.gnutls_bye
725
714
bye.argtypes = [session_t, close_request_t]
726
715
bye.restype = _error_code
727
716
bye.errcheck = _retry_on_error
729
718
check_version = _library.gnutls_check_version
730
719
check_version.argtypes = [ctypes.c_char_p]
731
720
check_version.restype = ctypes.c_char_p
733
722
# All the function declarations below are from gnutls/openpgp.h
735
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
726
openpgp_crt_init.restype = _error_code
739
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
730
ctypes.POINTER(datum_t),
742
731
openpgp_crt_fmt_t]
743
732
openpgp_crt_import.restype = _error_code
745
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
736
ctypes.POINTER(ctypes.c_uint)]
748
737
openpgp_crt_verify_self.restype = _error_code
750
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
741
openpgp_crt_deinit.restype = None
754
743
openpgp_crt_get_fingerprint = (
755
744
_library.gnutls_openpgp_crt_get_fingerprint)
756
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
1078
1065
# The exception is when not debugging but nevertheless
1079
1066
# running in the foreground; use the previously
1080
1067
# created wnull.
1081
popen_args = {"close_fds": True,
1068
popen_args = { "close_fds": True,
1084
1071
if (not self.server_settings["debug"]
1085
1072
and self.server_settings["foreground"]):
1086
1073
popen_args.update({"stdout": wnull,
1088
pipe = multiprocessing.Pipe(duplex=False)
1075
pipe = multiprocessing.Pipe(duplex = False)
1089
1076
self.checker = multiprocessing.Process(
1091
args=(pipe[1], subprocess.call, command),
1078
args = (pipe[1], subprocess.call, command),
1079
kwargs = popen_args)
1093
1080
self.checker.start()
1094
1081
self.checker_callback_tag = GLib.io_add_watch(
1095
1082
pipe[0].fileno(), GLib.IO_IN,
1096
1083
self.checker_callback, pipe[0], command)
1097
1084
# Re-run this periodically if run by GLib.timeout_add
1100
1087
def stop_checker(self):
1101
1088
"""Force the checker process, if any, to stop."""
1102
1089
if self.checker_callback_tag:
1137
1124
func._dbus_name = func.__name__
1138
1125
if func._dbus_name.endswith("_dbus_property"):
1139
1126
func._dbus_name = func._dbus_name[:-14]
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1127
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1143
1130
return decorator
1146
1133
def dbus_interface_annotations(dbus_interface):
1147
1134
"""Decorator for marking functions returning interface annotations
1151
1138
@dbus_interface_annotations("org.example.Interface")
1152
1139
def _foo(self): # Function name does not matter
1153
1140
return {"org.freedesktop.DBus.Deprecated": "true",
1154
1141
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1158
1145
def decorator(func):
1159
1146
func._dbus_is_interface = True
1160
1147
func._dbus_interface = dbus_interface
1161
1148
func._dbus_name = dbus_interface
1164
1151
return decorator
1167
1154
def dbus_annotations(annotations):
1168
1155
"""Decorator to annotate D-Bus methods, signals or properties
1171
1158
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1172
1159
"org.freedesktop.DBus.Property."
1173
1160
"EmitsChangedSignal": "false"})
1229
1216
for cls in self.__class__.__mro__
1230
1217
for name, athing in
1231
1218
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
1220
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1221
out_signature = "s",
1222
path_keyword = 'object_path',
1223
connection_keyword = 'connection')
1237
1224
def Introspect(self, object_path, connection):
1238
1225
"""Overloading of standard D-Bus method.
1240
1227
Inserts annotation tags on methods and signals.
1242
1229
xmlstring = dbus.service.Object.Introspect(self, object_path,
1245
1232
document = xml.dom.minidom.parseString(xmlstring)
1247
1234
for if_tag in document.getElementsByTagName("interface"):
1248
1235
# Add annotation tags
1249
1236
for typ in ("method", "signal"):
1460
1447
exc_info=error)
1461
1448
return xmlstring
1465
1451
dbus.OBJECT_MANAGER_IFACE
1466
1452
except AttributeError:
1467
1453
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1470
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
1456
"""A D-Bus object with an ObjectManager.
1473
1458
Classes inheriting from this exposes the standard
1474
1459
GetManagedObjects call and the InterfacesAdded and
1475
1460
InterfacesRemoved signals on the standard
1476
1461
"org.freedesktop.DBus.ObjectManager" interface.
1478
1463
Note: No signals are sent automatically; they must be sent
1481
1466
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1467
out_signature = "a{oa{sa{sv}}}")
1483
1468
def GetManagedObjects(self):
1484
1469
"""This function must be overridden"""
1485
1470
raise NotImplementedError()
1487
1472
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1473
signature = "oa{sa{sv}}")
1489
1474
def InterfacesAdded(self, object_path, interfaces_and_properties):
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1493
1478
def InterfacesRemoved(self, object_path, interfaces):
1496
1481
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1500
1485
def Introspect(self, object_path, connection):
1501
1486
"""Overloading of standard D-Bus method.
1503
1488
Override return argument name of GetManagedObjects to be
1504
1489
"objpath_interfaces_and_properties"
1544
1528
dbus.service.Object, it will add alternate D-Bus attributes with
1545
1529
interface names according to the "alt_interface_names" mapping.
1548
1532
@alternate_dbus_interfaces({"org.example.Interface":
1549
1533
"net.example.AlternateInterface"})
1550
1534
class SampleDBusObject(dbus.service.Object):
1551
1535
@dbus.service.method("org.example.Interface")
1552
1536
def SampleDBusMethod():
1555
1539
The above "SampleDBusMethod" on "SampleDBusObject" will be
1556
1540
reachable via two interfaces: "org.example.Interface" and
1557
1541
"net.example.AlternateInterface", the latter of which will have
1558
1542
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1559
1543
"true", unless "deprecate" is passed with a False value.
1561
1545
This works for methods and signals, and also for D-Bus properties
1562
1546
(from DBusObjectWithProperties) and interfaces (from the
1563
1547
dbus_interface_annotations decorator).
1566
1550
def wrapper(cls):
1567
1551
for orig_interface_name, alt_interface_name in (
1568
1552
alt_interface_names.items()):
1712
1694
"se.bsnet.fukt.Mandos"})
1713
1695
class ClientDBus(Client, DBusObjectWithProperties):
1714
1696
"""A Client class using D-Bus
1717
1699
dbus_object_path: dbus.ObjectPath
1718
1700
bus: dbus.SystemBus()
1721
1703
runtime_expansions = (Client.runtime_expansions
1722
1704
+ ("dbus_object_path", ))
1724
1706
_interface = "se.recompile.Mandos.Client"
1726
1708
# dbus.service.Object doesn't use super(), so we can't either.
1728
def __init__(self, bus=None, *args, **kwargs):
1710
def __init__(self, bus = None, *args, **kwargs):
1730
1712
Client.__init__(self, *args, **kwargs)
1731
1713
# Only now, when this client is initialized, can it show up on
1768
1750
dbus_value = transform_func(
1769
1751
type_func(value),
1770
variant_level=variant_level)
1752
variant_level = variant_level)
1771
1753
self.PropertyChanged(dbus.String(dbus_name),
1773
1755
self.PropertiesChanged(
1775
dbus.Dictionary({dbus.String(dbus_name):
1757
dbus.Dictionary({ dbus.String(dbus_name):
1778
1760
setattr(self, attrname, value)
1780
1762
return property(lambda self: getattr(self, attrname), setter)
1782
1764
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1783
1765
approvals_pending = notifychangeproperty(dbus.Boolean,
1784
1766
"ApprovalPending",
1786
1768
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1787
1769
last_enabled = notifychangeproperty(datetime_to_dbus,
1789
1771
checker = notifychangeproperty(
1790
1772
dbus.Boolean, "CheckerRunning",
1791
type_func=lambda checker: checker is not None)
1773
type_func = lambda checker: checker is not None)
1792
1774
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1793
1775
"LastCheckedOK")
1794
1776
last_checker_status = notifychangeproperty(dbus.Int16,
1799
1781
"ApprovedByDefault")
1800
1782
approval_delay = notifychangeproperty(
1801
1783
dbus.UInt64, "ApprovalDelay",
1802
type_func=lambda td: td.total_seconds() * 1000)
1784
type_func = lambda td: td.total_seconds() * 1000)
1803
1785
approval_duration = notifychangeproperty(
1804
1786
dbus.UInt64, "ApprovalDuration",
1805
type_func=lambda td: td.total_seconds() * 1000)
1787
type_func = lambda td: td.total_seconds() * 1000)
1806
1788
host = notifychangeproperty(dbus.String, "Host")
1807
1789
timeout = notifychangeproperty(
1808
1790
dbus.UInt64, "Timeout",
1809
type_func=lambda td: td.total_seconds() * 1000)
1791
type_func = lambda td: td.total_seconds() * 1000)
1810
1792
extended_timeout = notifychangeproperty(
1811
1793
dbus.UInt64, "ExtendedTimeout",
1812
type_func=lambda td: td.total_seconds() * 1000)
1794
type_func = lambda td: td.total_seconds() * 1000)
1813
1795
interval = notifychangeproperty(
1814
1796
dbus.UInt64, "Interval",
1815
type_func=lambda td: td.total_seconds() * 1000)
1797
type_func = lambda td: td.total_seconds() * 1000)
1816
1798
checker_command = notifychangeproperty(dbus.String, "Checker")
1817
1799
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1818
1800
invalidate_only=True)
1820
1802
del notifychangeproperty
1822
1804
def __del__(self, *args, **kwargs):
1824
1806
self.remove_from_connection()
1859
1841
# Emit D-Bus signal
1860
1842
self.CheckerStarted(self.current_checker_command)
1863
1845
def _reset_approved(self):
1864
1846
self.approved = None
1867
1849
def approve(self, value=True):
1868
1850
self.approved = value
1869
1851
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
1852
* 1000), self._reset_approved)
1871
1853
self.send_changedstate()
1873
# D-Bus methods, signals & properties
1855
## D-Bus methods, signals & properties
1879
1861
# CheckerCompleted - signal
1880
1862
@dbus.service.signal(_interface, signature="nxs")
1881
1863
def CheckerCompleted(self, exitcode, waitstatus, command):
1885
1867
# CheckerStarted - signal
1886
1868
@dbus.service.signal(_interface, signature="s")
1887
1869
def CheckerStarted(self, command):
1891
1873
# PropertyChanged - signal
1892
1874
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1893
1875
@dbus.service.signal(_interface, signature="sv")
1894
1876
def PropertyChanged(self, property, value):
1898
1880
# GotSecret - signal
1899
1881
@dbus.service.signal(_interface)
1900
1882
def GotSecret(self):
1903
1885
server to mandos-client
1907
1889
# Rejected - signal
1908
1890
@dbus.service.signal(_interface, signature="s")
1909
1891
def Rejected(self, reason):
1913
1895
# NeedApproval - signal
1914
1896
@dbus.service.signal(_interface, signature="tb")
1915
1897
def NeedApproval(self, timeout, default):
1917
1899
return self.need_approval()
1921
1903
# Approve - method
1922
1904
@dbus.service.method(_interface, in_signature="b")
1923
1905
def Approve(self, value):
1924
1906
self.approve(value)
1926
1908
# CheckedOK - method
1927
1909
@dbus.service.method(_interface)
1928
1910
def CheckedOK(self):
1929
1911
self.checked_ok()
1931
1913
# Enable - method
1932
1914
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1933
1915
@dbus.service.method(_interface)
1934
1916
def Enable(self):
1938
1920
# StartChecker - method
1939
1921
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1940
1922
@dbus.service.method(_interface)
1941
1923
def StartChecker(self):
1943
1925
self.start_checker()
1945
1927
# Disable - method
1946
1928
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1947
1929
@dbus.service.method(_interface)
1948
1930
def Disable(self):
1952
1934
# StopChecker - method
1953
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1954
1936
@dbus.service.method(_interface)
1955
1937
def StopChecker(self):
1956
1938
self.stop_checker()
1960
1942
# ApprovalPending - property
1961
1943
@dbus_service_property(_interface, signature="b", access="read")
1962
1944
def ApprovalPending_dbus_property(self):
1963
1945
return dbus.Boolean(bool(self.approvals_pending))
1965
1947
# ApprovedByDefault - property
1966
1948
@dbus_service_property(_interface,
2047
2029
self.checked_ok()
2049
2031
return datetime_to_dbus(self.last_checked_ok)
2051
2033
# LastCheckerStatus - property
2052
2034
@dbus_service_property(_interface, signature="n", access="read")
2053
2035
def LastCheckerStatus_dbus_property(self):
2054
2036
return dbus.Int16(self.last_checker_status)
2056
2038
# Expires - property
2057
2039
@dbus_service_property(_interface, signature="s", access="read")
2058
2040
def Expires_dbus_property(self):
2059
2041
return datetime_to_dbus(self.expires)
2061
2043
# LastApprovalRequest - property
2062
2044
@dbus_service_property(_interface, signature="s", access="read")
2063
2045
def LastApprovalRequest_dbus_property(self):
2064
2046
return datetime_to_dbus(self.last_approval_request)
2066
2048
# Timeout - property
2067
2049
@dbus_service_property(_interface,
2189
2171
class ClientHandler(socketserver.BaseRequestHandler, object):
2190
2172
"""A class to handle client connections.
2192
2174
Instantiated once for each connection to handle it.
2193
2175
Note: This will run in its own forked process."""
2195
2177
def handle(self):
2196
2178
with contextlib.closing(self.server.child_pipe) as child_pipe:
2197
2179
logger.info("TCP connection from: %s",
2198
2180
str(self.client_address))
2199
2181
logger.debug("Pipe FD: %d",
2200
2182
self.server.child_pipe.fileno())
2202
2184
session = gnutls.ClientSession(self.request)
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2186
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
# "+AES-256-CBC", "+SHA1",
2188
# "+COMP-NULL", "+CTYPE-OPENPGP",
2208
2190
# Use a fallback default, since this MUST be set.
2209
2191
priority = self.server.gnutls_priority
2210
2192
if priority is None:
2383
2365
class MultiprocessingMixIn(object):
2384
2366
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2386
2368
def sub_process_main(self, request, address):
2388
2370
self.finish_request(request, address)
2389
2371
except Exception:
2390
2372
self.handle_error(request, address)
2391
2373
self.close_request(request)
2393
2375
def process_request(self, request, address):
2394
2376
"""Start a new process to process the request."""
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
2377
proc = multiprocessing.Process(target = self.sub_process_main,
2378
args = (request, address))
2401
2383
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2402
2384
""" adds a pipe to the MixIn """
2404
2386
def process_request(self, request, client_address):
2405
2387
"""Overrides and wraps the original process_request().
2407
2389
This function creates a new pipe in self.pipe
2409
2391
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2411
2393
proc = MultiprocessingMixIn.process_request(self, request,
2412
2394
client_address)
2413
2395
self.child_pipe.close()
2414
2396
self.add_pipe(parent_pipe, proc)
2416
2398
def add_pipe(self, parent_pipe, proc):
2417
2399
"""Dummy function; override as necessary"""
2418
2400
raise NotImplementedError()
2542
2523
self.gnutls_priority = gnutls_priority
2543
2524
IPv6_TCPServer.__init__(self, server_address,
2544
2525
RequestHandlerClass,
2545
interface=interface,
2526
interface = interface,
2527
use_ipv6 = use_ipv6,
2528
socketfd = socketfd)
2549
2530
def server_activate(self):
2550
2531
if self.enabled:
2551
2532
return socketserver.TCPServer.server_activate(self)
2553
2534
def enable(self):
2554
2535
self.enabled = True
2556
2537
def add_pipe(self, parent_pipe, proc):
2557
2538
# Call "handle_ipc" for both data and EOF events
2558
2539
GLib.io_add_watch(
2559
2540
parent_pipe.fileno(),
2560
2541
GLib.IO_IN | GLib.IO_HUP,
2561
2542
functools.partial(self.handle_ipc,
2562
parent_pipe=parent_pipe,
2543
parent_pipe = parent_pipe,
2565
2546
def handle_ipc(self, source, condition,
2566
2547
parent_pipe=None,
2568
2549
client_object=None):
2569
2550
# error, or the other end of multiprocessing.Pipe has closed
2570
2551
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2571
2552
# Wait for other process to exit
2575
2556
# Read a request from the child
2576
2557
request = parent_pipe.recv()
2577
2558
command = request[0]
2579
2560
if command == 'init':
2580
2561
fpr = request[1]
2581
2562
address = request[2]
2583
2564
for c in self.clients.values():
2584
2565
if c.fingerprint == fpr:
2649
2630
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
2631
datetime.timedelta(1, 200)
2653
2634
# Parsing an RFC 3339 duration with regular expressions is not
2654
2635
# possible - there would have to be multiple places for the same
2655
2636
# values, like seconds. The current code, while more esoteric, is
2656
2637
# cleaner without depending on a parsing library. If Python had a
2657
2638
# built-in library for parsing we would use it, but we'd like to
2658
2639
# avoid excessive use of external libraries.
2660
2641
# New type for defining tokens, syntax, and semantics all-in-one
2661
2642
Token = collections.namedtuple("Token", (
2662
2643
"regexp", # To match token; if "value" is not None, must have
2849
2827
parser.add_argument("--no-zeroconf", action="store_false",
2850
2828
dest="zeroconf", help="Do not use Zeroconf",
2853
2831
options = parser.parse_args()
2855
2833
if options.check:
2857
2835
fail_count, test_count = doctest.testmod()
2858
2836
sys.exit(os.EX_OK if fail_count == 0 else 1)
2860
2838
# Default values for config file for server-global settings
2861
server_defaults = {"interface": "",
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
2839
server_defaults = { "interface": "",
2844
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2845
":+SIGN-DSA-SHA256",
2846
"servicename": "Mandos",
2852
"statedir": "/var/lib/mandos",
2853
"foreground": "False",
2879
2857
# Parse config file for server-global settings
2880
2858
server_config = configparser.SafeConfigParser(server_defaults)
2881
2859
del server_defaults
3011
2988
.format(uid, gid, os.strerror(error.errno)))
3012
2989
if error.errno != errno.EPERM:
3016
2993
# Enable all possible GnuTLS debugging
3018
2995
# "Use a log level over 10 to enable all debugging options."
3019
2996
# - GnuTLS manual
3020
2997
gnutls.global_set_log_level(11)
3022
2999
@gnutls.log_func
3023
3000
def debug_gnutls(level, string):
3024
3001
logger.debug("GnuTLS: %s", string[:-1])
3026
3003
gnutls.global_set_log_function(debug_gnutls)
3028
3005
# Redirect stdin so all checkers get /dev/null
3029
3006
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3030
3007
os.dup2(null, sys.stdin.fileno())
3034
3011
# Need to fork before connecting to D-Bus
3035
3012
if not foreground:
3036
3013
# Close all input and output, do double fork, etc.
3039
3016
# multiprocessing will use threads, so before we use GLib we need
3040
3017
# to inform GLib that threads will be used.
3041
3018
GLib.threads_init()
3043
3020
global main_loop
3044
3021
# From the Avahi example code
3045
3022
DBusGMainLoop(set_as_default=True)
3063
3040
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3064
3041
service = AvahiServiceToSyslog(
3065
name=server_settings["servicename"],
3066
servicetype="_mandos._tcp",
3042
name = server_settings["servicename"],
3043
servicetype = "_mandos._tcp",
3044
protocol = protocol,
3069
3046
if server_settings["interface"]:
3070
3047
service.interface = if_nametoindex(
3071
3048
server_settings["interface"].encode("utf-8"))
3073
3050
global multiprocessing_manager
3074
3051
multiprocessing_manager = multiprocessing.Manager()
3076
3053
client_class = Client
3078
client_class = functools.partial(ClientDBus, bus=bus)
3055
client_class = functools.partial(ClientDBus, bus = bus)
3080
3057
client_settings = Client.config_parser(client_config)
3081
3058
old_client_settings = {}
3082
3059
clients_data = {}
3084
3061
# This is used to redirect stdout and stderr for checker processes
3086
wnull = open(os.devnull, "w") # A writable /dev/null
3063
wnull = open(os.devnull, "w") # A writable /dev/null
3087
3064
# Only used if server is running in foreground but not in debug
3089
3066
if debug or not foreground:
3092
3069
# Get client data and settings from last running state.
3093
3070
if server_settings["restore"]:
3095
3072
with open(stored_state_path, "rb") as stored_state:
3096
if sys.version_info.major == 2:
3073
if sys.version_info.major == 2:
3097
3074
clients_data, old_client_settings = pickle.load(
3100
3077
bytes_clients_data, bytes_old_client_settings = (
3101
pickle.load(stored_state, encoding="bytes"))
3102
# Fix bytes to strings
3078
pickle.load(stored_state, encoding = "bytes"))
3079
### Fix bytes to strings
3105
clients_data = {(key.decode("utf-8")
3106
if isinstance(key, bytes)
3109
bytes_clients_data.items()}
3082
clients_data = { (key.decode("utf-8")
3083
if isinstance(key, bytes)
3086
bytes_clients_data.items() }
3110
3087
del bytes_clients_data
3111
3088
for key in clients_data:
3112
value = {(k.decode("utf-8")
3113
if isinstance(k, bytes) else k): v
3115
clients_data[key].items()}
3089
value = { (k.decode("utf-8")
3090
if isinstance(k, bytes) else k): v
3092
clients_data[key].items() }
3116
3093
clients_data[key] = value
3117
3094
# .client_structure
3118
3095
value["client_structure"] = [
3119
3096
(s.decode("utf-8")
3120
3097
if isinstance(s, bytes)
3121
3098
else s) for s in
3122
value["client_structure"]]
3099
value["client_structure"] ]
3123
3100
# .name & .host
3124
3101
for k in ("name", "host"):
3125
3102
if isinstance(value[k], bytes):
3126
3103
value[k] = value[k].decode("utf-8")
3127
# old_client_settings
3104
## old_client_settings
3129
3106
old_client_settings = {
3130
3107
(key.decode("utf-8")
3131
3108
if isinstance(key, bytes)
3132
3109
else key): value
3133
3110
for key, value in
3134
bytes_old_client_settings.items()}
3111
bytes_old_client_settings.items() }
3135
3112
del bytes_old_client_settings
3137
3114
for value in old_client_settings.values():
3243
3220
pidfilename, pid)
3245
3222
del pidfilename
3247
3224
for termsig in (signal.SIGHUP, signal.SIGTERM):
3248
3225
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3249
3226
lambda: main_loop.quit() and False)
3253
3230
@alternate_dbus_interfaces(
3254
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3231
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3255
3232
class MandosDBusService(DBusObjectWithObjectManager):
3256
3233
"""A D-Bus proxy object"""
3258
3235
def __init__(self):
3259
3236
dbus.service.Object.__init__(self, bus, "/")
3261
3238
_interface = "se.recompile.Mandos"
3263
3240
@dbus.service.signal(_interface, signature="o")
3264
3241
def ClientAdded(self, objpath):
3268
3245
@dbus.service.signal(_interface, signature="ss")
3269
3246
def ClientNotFound(self, fingerprint, address):
3273
3250
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3275
3252
@dbus.service.signal(_interface, signature="os")
3276
3253
def ClientRemoved(self, objpath, name):
3280
3257
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3282
3259
@dbus.service.method(_interface, out_signature="ao")
3310
3287
self.client_removed_signal(c)
3312
3289
raise KeyError(object_path)
3316
3293
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3317
out_signature="a{oa{sa{sv}}}")
3294
out_signature = "a{oa{sa{sv}}}")
3318
3295
def GetManagedObjects(self):
3319
3296
"""D-Bus method"""
3320
3297
return dbus.Dictionary(
3321
{client.dbus_object_path:
3323
{interface: client.GetAll(interface)
3325
client._get_all_interface_names()})
3326
for client in tcp_server.clients.values()})
3298
{ client.dbus_object_path:
3300
{ interface: client.GetAll(interface)
3302
client._get_all_interface_names()})
3303
for client in tcp_server.clients.values()})
3328
3305
def client_added_signal(self, client):
3329
3306
"""Send the new standard signal and the old signal"""
3376
3352
client.encrypted_secret = pgp.encrypt(client.secret,
3378
3354
client_dict = {}
3380
3356
# A list of attributes that can not be pickled
3382
exclude = {"bus", "changedstate", "secret",
3383
"checker", "server_settings"}
3358
exclude = { "bus", "changedstate", "secret",
3359
"checker", "server_settings" }
3384
3360
for name, typ in inspect.getmembers(dbus.service
3386
3362
exclude.add(name)
3388
3364
client_dict["encrypted_secret"] = (client
3389
3365
.encrypted_secret)
3390
3366
for attr in client.client_structure:
3391
3367
if attr not in exclude:
3392
3368
client_dict[attr] = getattr(client, attr)
3394
3370
clients[client.name] = client_dict
3395
3371
del client_settings[client.name]["secret"]
3398
3374
with tempfile.NamedTemporaryFile(