183
235
.replace(b"\n", b"\\n")
184
236
.replace(b"\0", b"\\x00"))
187
239
def encrypt(self, data, password):
188
240
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
191
243
passfile.write(passphrase)
193
proc = subprocess.Popen(['gpg', '--symmetric',
245
proc = subprocess.Popen([self.gpg, '--symmetric',
194
246
'--passphrase-file',
196
248
+ self.gnupgargs,
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
201
253
if proc.returncode != 0:
202
254
raise PGPError(err)
203
255
return ciphertext
205
257
def decrypt(self, data, password):
206
258
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
259
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
209
261
passfile.write(passphrase)
211
proc = subprocess.Popen(['gpg', '--decrypt',
263
proc = subprocess.Popen([self.gpg, '--decrypt',
212
264
'--passphrase-file',
214
266
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
220
271
if proc.returncode != 0:
221
272
raise PGPError(err)
222
273
return decrypted_plaintext
276
# Pretend that we have an Avahi module
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
225
303
class AvahiError(Exception):
226
304
def __init__(self, value, *args, **kwargs):
227
305
self.value = value
228
306
return super(AvahiError, self).__init__(value, *args,
231
310
class AvahiServiceError(AvahiError):
234
314
class AvahiGroupError(AvahiError):
238
318
class AvahiService(object):
239
319
"""An Avahi (Zeroconf) service.
242
322
interface: integer; avahi.IF_UNSPEC or an interface index.
243
323
Used to optionally bind to the specified interface.
386
488
follow_name_owner_changes=True),
387
489
avahi.DBUS_INTERFACE_SERVER)
388
490
self.server.connect_to_signal("StateChanged",
389
self.server_state_changed)
491
self.server_state_changed)
390
492
self.server_state_changed(self.server.GetState())
393
495
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
395
497
"""Add the new name to the syslog messages"""
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
498
ret = AvahiService.rename(self, *args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
510
_library = ctypes.cdll.LoadLibrary(
511
ctypes.util.find_library("gnutls"))
512
_need_version = b"3.3.0"
515
# Need to use class name "GnuTLS" here, since this method is
516
# called before the assignment to the "gnutls" global variable
518
if GnuTLS.check_version(self._need_version) is None:
519
raise GnuTLS.Error("Needs GnuTLS {} or later"
520
.format(self._need_version))
522
# Unless otherwise indicated, the constants and types below are
523
# all from the gnutls/gnutls.h C header file.
533
E_NO_CERTIFICATE_FOUND = -49
534
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
537
class session_int(ctypes.Structure):
539
session_t = ctypes.POINTER(session_int)
541
class certificate_credentials_st(ctypes.Structure):
543
certificate_credentials_t = ctypes.POINTER(
544
certificate_credentials_st)
545
certificate_type_t = ctypes.c_int
547
class datum_t(ctypes.Structure):
548
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
549
('size', ctypes.c_uint)]
551
class openpgp_crt_int(ctypes.Structure):
553
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
554
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
555
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
556
credentials_type_t = ctypes.c_int
557
transport_ptr_t = ctypes.c_void_p
558
close_request_t = ctypes.c_int
561
class Error(Exception):
562
# We need to use the class name "GnuTLS" here, since this
563
# exception might be raised from within GnuTLS.__init__,
564
# which is called before the assignment to the "gnutls"
565
# global variable has happened.
566
def __init__(self, message=None, code=None, args=()):
567
# Default usage is by a message string, but if a return
568
# code is passed, convert it to a string with
571
if message is None and code is not None:
572
message = GnuTLS.strerror(code)
573
return super(GnuTLS.Error, self).__init__(
576
class CertificateSecurityError(Error):
580
class Credentials(object):
582
self._c_object = gnutls.certificate_credentials_t()
583
gnutls.certificate_allocate_credentials(
584
ctypes.byref(self._c_object))
585
self.type = gnutls.CRD_CERTIFICATE
588
gnutls.certificate_free_credentials(self._c_object)
590
class ClientSession(object):
591
def __init__(self, socket, credentials=None):
592
self._c_object = gnutls.session_t()
593
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
594
gnutls.set_default_priority(self._c_object)
595
gnutls.transport_set_ptr(self._c_object, socket.fileno())
596
gnutls.handshake_set_private_extensions(self._c_object,
599
if credentials is None:
600
credentials = gnutls.Credentials()
601
gnutls.credentials_set(self._c_object, credentials.type,
602
ctypes.cast(credentials._c_object,
604
self.credentials = credentials
607
gnutls.deinit(self._c_object)
610
return gnutls.handshake(self._c_object)
612
def send(self, data):
616
data_len -= gnutls.record_send(self._c_object,
621
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
623
# Error handling functions
624
def _error_code(result):
625
"""A function to raise exceptions on errors, suitable
626
for the 'restype' attribute on ctypes functions"""
629
if result == gnutls.E_NO_CERTIFICATE_FOUND:
630
raise gnutls.CertificateSecurityError(code=result)
631
raise gnutls.Error(code=result)
633
def _retry_on_error(result, func, arguments):
634
"""A function to retry on some errors, suitable
635
for the 'errcheck' attribute on ctypes functions"""
637
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
638
return _error_code(result)
639
result = func(*arguments)
642
# Unless otherwise indicated, the function declarations below are
643
# all from the gnutls/gnutls.h C header file.
646
priority_set_direct = _library.gnutls_priority_set_direct
647
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
648
ctypes.POINTER(ctypes.c_char_p)]
649
priority_set_direct.restype = _error_code
651
init = _library.gnutls_init
652
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
653
init.restype = _error_code
655
set_default_priority = _library.gnutls_set_default_priority
656
set_default_priority.argtypes = [session_t]
657
set_default_priority.restype = _error_code
659
record_send = _library.gnutls_record_send
660
record_send.argtypes = [session_t, ctypes.c_void_p,
662
record_send.restype = ctypes.c_ssize_t
663
record_send.errcheck = _retry_on_error
665
certificate_allocate_credentials = (
666
_library.gnutls_certificate_allocate_credentials)
667
certificate_allocate_credentials.argtypes = [
668
ctypes.POINTER(certificate_credentials_t)]
669
certificate_allocate_credentials.restype = _error_code
671
certificate_free_credentials = (
672
_library.gnutls_certificate_free_credentials)
673
certificate_free_credentials.argtypes = [
674
certificate_credentials_t]
675
certificate_free_credentials.restype = None
677
handshake_set_private_extensions = (
678
_library.gnutls_handshake_set_private_extensions)
679
handshake_set_private_extensions.argtypes = [session_t,
681
handshake_set_private_extensions.restype = None
683
credentials_set = _library.gnutls_credentials_set
684
credentials_set.argtypes = [session_t, credentials_type_t,
686
credentials_set.restype = _error_code
688
strerror = _library.gnutls_strerror
689
strerror.argtypes = [ctypes.c_int]
690
strerror.restype = ctypes.c_char_p
692
certificate_type_get = _library.gnutls_certificate_type_get
693
certificate_type_get.argtypes = [session_t]
694
certificate_type_get.restype = _error_code
696
certificate_get_peers = _library.gnutls_certificate_get_peers
697
certificate_get_peers.argtypes = [session_t,
698
ctypes.POINTER(ctypes.c_uint)]
699
certificate_get_peers.restype = ctypes.POINTER(datum_t)
701
global_set_log_level = _library.gnutls_global_set_log_level
702
global_set_log_level.argtypes = [ctypes.c_int]
703
global_set_log_level.restype = None
705
global_set_log_function = _library.gnutls_global_set_log_function
706
global_set_log_function.argtypes = [log_func]
707
global_set_log_function.restype = None
709
deinit = _library.gnutls_deinit
710
deinit.argtypes = [session_t]
711
deinit.restype = None
713
handshake = _library.gnutls_handshake
714
handshake.argtypes = [session_t]
715
handshake.restype = _error_code
716
handshake.errcheck = _retry_on_error
718
transport_set_ptr = _library.gnutls_transport_set_ptr
719
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
720
transport_set_ptr.restype = None
722
bye = _library.gnutls_bye
723
bye.argtypes = [session_t, close_request_t]
724
bye.restype = _error_code
725
bye.errcheck = _retry_on_error
727
check_version = _library.gnutls_check_version
728
check_version.argtypes = [ctypes.c_char_p]
729
check_version.restype = ctypes.c_char_p
731
# All the function declarations below are from gnutls/openpgp.h
733
openpgp_crt_init = _library.gnutls_openpgp_crt_init
734
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
735
openpgp_crt_init.restype = _error_code
737
openpgp_crt_import = _library.gnutls_openpgp_crt_import
738
openpgp_crt_import.argtypes = [openpgp_crt_t,
739
ctypes.POINTER(datum_t),
741
openpgp_crt_import.restype = _error_code
743
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
744
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
745
ctypes.POINTER(ctypes.c_uint)]
746
openpgp_crt_verify_self.restype = _error_code
748
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
749
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
750
openpgp_crt_deinit.restype = None
752
openpgp_crt_get_fingerprint = (
753
_library.gnutls_openpgp_crt_get_fingerprint)
754
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
758
openpgp_crt_get_fingerprint.restype = _error_code
760
# Remove non-public functions
761
del _error_code, _retry_on_error
762
# Create the global "gnutls" object, simulating a module
766
def call_pipe(connection, # : multiprocessing.Connection
767
func, *args, **kwargs):
768
"""This function is meant to be called by multiprocessing.Process
770
This function runs func(*args, **kwargs), and writes the resulting
771
return value on the provided multiprocessing.Connection.
773
connection.send(func(*args, **kwargs))
404
777
class Client(object):
405
778
"""A representation of a client host served by this server.
408
781
approved: bool(); 'None' if not yet approved/disapproved
409
782
approval_delay: datetime.timedelta(); Time to wait for approval
582
957
logger.info("Disabling client %s", self.name)
583
958
if getattr(self, "disable_initiator_tag", None) is not None:
584
gobject.source_remove(self.disable_initiator_tag)
959
GLib.source_remove(self.disable_initiator_tag)
585
960
self.disable_initiator_tag = None
586
961
self.expires = None
587
962
if getattr(self, "checker_initiator_tag", None) is not None:
588
gobject.source_remove(self.checker_initiator_tag)
963
GLib.source_remove(self.checker_initiator_tag)
589
964
self.checker_initiator_tag = None
590
965
self.stop_checker()
591
966
self.enabled = False
593
968
self.send_changedstate()
594
# Do not run this again if called by a gobject.timeout_add
969
# Do not run this again if called by a GLib.timeout_add
597
972
def __del__(self):
600
975
def init_checker(self):
601
976
# Schedule a new checker to be started an 'interval' from now,
602
977
# and every interval from then on.
603
978
if self.checker_initiator_tag is not None:
604
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
607
.total_seconds() * 1000),
979
GLib.source_remove(self.checker_initiator_tag)
980
self.checker_initiator_tag = GLib.timeout_add(
981
int(self.interval.total_seconds() * 1000),
609
983
# Schedule a disable() when 'timeout' has passed
610
984
if self.disable_initiator_tag is not None:
611
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
614
.total_seconds() * 1000),
985
GLib.source_remove(self.disable_initiator_tag)
986
self.disable_initiator_tag = GLib.timeout_add(
987
int(self.timeout.total_seconds() * 1000), self.disable)
616
988
# Also start a new checker *right now*.
617
989
self.start_checker()
619
def checker_callback(self, pid, condition, command):
991
def checker_callback(self, source, condition, connection,
620
993
"""The checker has completed, so take appropriate actions."""
621
994
self.checker_callback_tag = None
622
995
self.checker = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
996
# Read return code from connection (see call_pipe)
997
returncode = connection.recv()
1001
self.last_checker_status = returncode
1002
self.last_checker_signal = None
625
1003
if self.last_checker_status == 0:
626
1004
logger.info("Checker for %(name)s succeeded",
628
1006
self.checked_ok()
630
logger.info("Checker for %(name)s failed",
1008
logger.info("Checker for %(name)s failed", vars(self))
633
1010
self.last_checker_status = -1
1011
self.last_checker_signal = -returncode
634
1012
logger.warning("Checker for %(name)s crashed?",
637
1016
def checked_ok(self):
638
1017
"""Assert that the client has been seen, alive and well."""
639
1018
self.last_checked_ok = datetime.datetime.utcnow()
640
1019
self.last_checker_status = 0
1020
self.last_checker_signal = None
641
1021
self.bump_timeout()
643
1023
def bump_timeout(self, timeout=None):
644
1024
"""Bump up the timeout for this client."""
645
1025
if timeout is None:
646
1026
timeout = self.timeout
647
1027
if self.disable_initiator_tag is not None:
648
gobject.source_remove(self.disable_initiator_tag)
1028
GLib.source_remove(self.disable_initiator_tag)
649
1029
self.disable_initiator_tag = None
650
1030
if getattr(self, "enabled", False):
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(timeout.total_seconds() * 1000), self.disable)
654
1033
self.expires = datetime.datetime.utcnow() + timeout
656
1035
def need_approval(self):
657
1036
self.last_approval_request = datetime.datetime.utcnow()
659
1038
def start_checker(self):
660
1039
"""Start a new checker subprocess if one is not running.
662
1041
If a checker already exists, leave it running and do
664
1043
# The reason for not killing a running checker is that if we
669
1048
# checkers alone, the checker would have to take more time
670
1049
# than 'timeout' for the client to be disabled, which is as it
673
# If a checker exists, make sure it is not a zombie
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
678
except OSError as error:
679
if error.errno != errno.ECHILD:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
1052
if self.checker is not None and not self.checker.is_alive():
1053
logger.warning("Checker was not alive; joining")
687
1056
# Start a new checker if needed
688
1057
if self.checker is None:
689
1058
# Escape attributes for the shell
690
escaped_attrs = { attr:
691
re.escape(str(getattr(self, attr)))
692
for attr in self.runtime_expansions }
1060
attr: re.escape(str(getattr(self, attr)))
1061
for attr in self.runtime_expansions}
694
1063
command = self.checker_command % escaped_attrs
695
1064
except TypeError as error:
696
1065
logger.error('Could not format string "%s"',
697
self.checker_command, exc_info=error)
698
return True # Try again later
1066
self.checker_command,
1068
return True # Try again later
699
1069
self.current_checker_command = command
701
logger.info("Starting checker %r for %s",
703
# We don't need to redirect stdout and stderr, since
704
# in normal mode, that is already done by daemon(),
705
# and in debug mode we don't want to. (Stdin is
706
# always replaced by /dev/null.)
707
# The exception is when not debugging but nevertheless
708
# running in the foreground; use the previously
711
if (not self.server_settings["debug"]
712
and self.server_settings["foreground"]):
713
popen_args.update({"stdout": wnull,
715
self.checker = subprocess.Popen(command,
719
except OSError as error:
720
logger.error("Failed to start subprocess",
723
self.checker_callback_tag = (gobject.child_watch_add
725
self.checker_callback,
727
# The checker may have completed before the gobject
728
# watch was added. Check for this.
730
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
731
except OSError as error:
732
if error.errno == errno.ECHILD:
733
# This should never happen
734
logger.error("Child process vanished",
739
gobject.source_remove(self.checker_callback_tag)
740
self.checker_callback(pid, status, command)
741
# Re-run this periodically if run by gobject.timeout_add
1070
logger.info("Starting checker %r for %s", command,
1072
# We don't need to redirect stdout and stderr, since
1073
# in normal mode, that is already done by daemon(),
1074
# and in debug mode we don't want to. (Stdin is
1075
# always replaced by /dev/null.)
1076
# The exception is when not debugging but nevertheless
1077
# running in the foreground; use the previously
1079
popen_args = {"close_fds": True,
1082
if (not self.server_settings["debug"]
1083
and self.server_settings["foreground"]):
1084
popen_args.update({"stdout": wnull,
1086
pipe = multiprocessing.Pipe(duplex=False)
1087
self.checker = multiprocessing.Process(
1089
args=(pipe[1], subprocess.call, command),
1091
self.checker.start()
1092
self.checker_callback_tag = GLib.io_add_watch(
1093
pipe[0].fileno(), GLib.IO_IN,
1094
self.checker_callback, pipe[0], command)
1095
# Re-run this periodically if run by GLib.timeout_add
744
1098
def stop_checker(self):
745
1099
"""Force the checker process, if any, to stop."""
746
1100
if self.checker_callback_tag:
747
gobject.source_remove(self.checker_callback_tag)
1101
GLib.source_remove(self.checker_callback_tag)
748
1102
self.checker_callback_tag = None
749
1103
if getattr(self, "checker", None) is None:
751
1105
logger.debug("Stopping checker for %(name)s", vars(self))
753
self.checker.terminate()
755
#if self.checker.poll() is None:
756
# self.checker.kill()
757
except OSError as error:
758
if error.errno != errno.ESRCH: # No such process
1106
self.checker.terminate()
760
1107
self.checker = None
763
def dbus_service_property(dbus_interface, signature="v",
764
access="readwrite", byte_arrays=False):
1110
def dbus_service_property(dbus_interface,
765
1114
"""Decorators for marking methods of a DBusObjectWithProperties to
766
1115
become properties on the D-Bus.
768
1117
The decorated method will be called with no arguments by "Get"
769
1118
and with one argument by "Set".
771
1120
The parameters, where they are supported, are the same as
772
1121
dbus.service.method, except there is only "signature", since the
773
1122
type from Get() and the type sent to Set() is the same.
847
class DBusObjectWithProperties(dbus.service.Object):
848
"""A D-Bus object with properties.
850
Classes inheriting from this can use the dbus_service_property
851
decorator to expose methods as D-Bus properties. It exposes the
852
standard Get(), Set(), and GetAll() methods on the D-Bus.
1205
class DBusObjectWithAnnotations(dbus.service.Object):
1206
"""A D-Bus object with annotations.
1208
Classes inheriting from this can use the dbus_annotations
1209
decorator to add annotations to methods or signals.
856
1213
def _is_dbus_thing(thing):
857
1214
"""Returns a function testing if an attribute is a D-Bus thing
859
1216
If called like _is_dbus_thing("method") it returns a function
860
1217
suitable for use as predicate to inspect.getmembers().
862
1219
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
865
1222
def _get_all_dbus_things(self, thing):
866
1223
"""Returns a generator of (name, attribute) pairs
868
return ((getattr(athing.__get__(self), "_dbus_name",
1225
return ((getattr(athing.__get__(self), "_dbus_name", name),
870
1226
athing.__get__(self))
871
1227
for cls in self.__class__.__mro__
872
1228
for name, athing in
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
1229
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1231
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1233
path_keyword='object_path',
1234
connection_keyword='connection')
1235
def Introspect(self, object_path, connection):
1236
"""Overloading of standard D-Bus method.
1238
Inserts annotation tags on methods and signals.
1240
xmlstring = dbus.service.Object.Introspect(self, object_path,
1243
document = xml.dom.minidom.parseString(xmlstring)
1245
for if_tag in document.getElementsByTagName("interface"):
1246
# Add annotation tags
1247
for typ in ("method", "signal"):
1248
for tag in if_tag.getElementsByTagName(typ):
1250
for name, prop in (self.
1251
_get_all_dbus_things(typ)):
1252
if (name == tag.getAttribute("name")
1253
and prop._dbus_interface
1254
== if_tag.getAttribute("name")):
1255
annots.update(getattr(
1256
prop, "_dbus_annotations", {}))
1257
for name, value in annots.items():
1258
ann_tag = document.createElement(
1260
ann_tag.setAttribute("name", name)
1261
ann_tag.setAttribute("value", value)
1262
tag.appendChild(ann_tag)
1263
# Add interface annotation tags
1264
for annotation, value in dict(
1265
itertools.chain.from_iterable(
1266
annotations().items()
1267
for name, annotations
1268
in self._get_all_dbus_things("interface")
1269
if name == if_tag.getAttribute("name")
1271
ann_tag = document.createElement("annotation")
1272
ann_tag.setAttribute("name", annotation)
1273
ann_tag.setAttribute("value", value)
1274
if_tag.appendChild(ann_tag)
1275
# Fix argument name for the Introspect method itself
1276
if (if_tag.getAttribute("name")
1277
== dbus.INTROSPECTABLE_IFACE):
1278
for cn in if_tag.getElementsByTagName("method"):
1279
if cn.getAttribute("name") == "Introspect":
1280
for arg in cn.getElementsByTagName("arg"):
1281
if (arg.getAttribute("direction")
1283
arg.setAttribute("name",
1285
xmlstring = document.toxml("utf-8")
1287
except (AttributeError, xml.dom.DOMException,
1288
xml.parsers.expat.ExpatError) as error:
1289
logger.error("Failed to override Introspection method",
1294
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1295
"""A D-Bus object with properties.
1297
Classes inheriting from this can use the dbus_service_property
1298
decorator to expose methods as D-Bus properties. It exposes the
1299
standard Get(), Set(), and GetAll() methods on the D-Bus.
876
1302
def _get_dbus_property(self, interface_name, property_name):
877
1303
"""Returns a bound method if one exists which is a D-Bus
878
1304
property with the specified name and interface.
880
for cls in self.__class__.__mro__:
881
for name, value in (inspect.getmembers
883
self._is_dbus_thing("property"))):
1306
for cls in self.__class__.__mro__:
1307
for name, value in inspect.getmembers(
1308
cls, self._is_dbus_thing("property")):
884
1309
if (value._dbus_name == property_name
885
1310
and value._dbus_interface == interface_name):
886
1311
return value.__get__(self)
888
1313
# No such property
889
raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
+ interface_name + "."
893
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1314
raise DBusPropertyNotFound("{}:{}.{}".format(
1315
self.dbus_object_path, interface_name, property_name))
1318
def _get_all_interface_names(cls):
1319
"""Get a sequence of all interfaces supported by an object"""
1320
return (name for name in set(getattr(getattr(x, attr),
1321
"_dbus_interface", None)
1322
for x in (inspect.getmro(cls))
1324
if name is not None)
1326
@dbus.service.method(dbus.PROPERTIES_IFACE,
894
1328
out_signature="v")
895
1329
def Get(self, interface_name, property_name):
896
1330
"""Standard D-Bus property Get() method, see D-Bus standard.
1035
1458
exc_info=error)
1036
1459
return xmlstring
1462
dbus.OBJECT_MANAGER_IFACE
1463
except AttributeError:
1464
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1467
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1468
"""A D-Bus object with an ObjectManager.
1470
Classes inheriting from this exposes the standard
1471
GetManagedObjects call and the InterfacesAdded and
1472
InterfacesRemoved signals on the standard
1473
"org.freedesktop.DBus.ObjectManager" interface.
1475
Note: No signals are sent automatically; they must be sent
1478
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1479
out_signature="a{oa{sa{sv}}}")
1480
def GetManagedObjects(self):
1481
"""This function must be overridden"""
1482
raise NotImplementedError()
1484
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1485
signature="oa{sa{sv}}")
1486
def InterfacesAdded(self, object_path, interfaces_and_properties):
1489
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1490
def InterfacesRemoved(self, object_path, interfaces):
1493
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1495
path_keyword='object_path',
1496
connection_keyword='connection')
1497
def Introspect(self, object_path, connection):
1498
"""Overloading of standard D-Bus method.
1500
Override return argument name of GetManagedObjects to be
1501
"objpath_interfaces_and_properties"
1503
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1507
document = xml.dom.minidom.parseString(xmlstring)
1509
for if_tag in document.getElementsByTagName("interface"):
1510
# Fix argument name for the GetManagedObjects method
1511
if (if_tag.getAttribute("name")
1512
== dbus.OBJECT_MANAGER_IFACE):
1513
for cn in if_tag.getElementsByTagName("method"):
1514
if (cn.getAttribute("name")
1515
== "GetManagedObjects"):
1516
for arg in cn.getElementsByTagName("arg"):
1517
if (arg.getAttribute("direction")
1521
"objpath_interfaces"
1523
xmlstring = document.toxml("utf-8")
1525
except (AttributeError, xml.dom.DOMException,
1526
xml.parsers.expat.ExpatError) as error:
1527
logger.error("Failed to override Introspection method",
1039
1532
def datetime_to_dbus(dt, variant_level=0):
1040
1533
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1042
return dbus.String("", variant_level = variant_level)
1043
return dbus.String(dt.isoformat(),
1044
variant_level=variant_level)
1535
return dbus.String("", variant_level=variant_level)
1536
return dbus.String(dt.isoformat(), variant_level=variant_level)
1047
1539
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1077
1570
# Ignore non-D-Bus attributes, and D-Bus attributes
1078
1571
# with the wrong interface name
1079
1572
if (not hasattr(attribute, "_dbus_interface")
1080
or not attribute._dbus_interface
1081
.startswith(orig_interface_name)):
1573
or not attribute._dbus_interface.startswith(
1574
orig_interface_name)):
1083
1576
# Create an alternate D-Bus interface name based on
1084
1577
# the current name
1085
alt_interface = (attribute._dbus_interface
1086
.replace(orig_interface_name,
1087
alt_interface_name))
1578
alt_interface = attribute._dbus_interface.replace(
1579
orig_interface_name, alt_interface_name)
1088
1580
interface_names.add(alt_interface)
1089
1581
# Is this a D-Bus signal?
1090
1582
if getattr(attribute, "_dbus_is_signal", False):
1091
1583
# Extract the original non-method undecorated
1092
1584
# function by black magic
1093
nonmethod_func = (dict(
1585
if sys.version_info.major == 2:
1586
nonmethod_func = (dict(
1094
1587
zip(attribute.func_code.co_freevars,
1095
attribute.__closure__))["func"]
1588
attribute.__closure__))
1589
["func"].cell_contents)
1591
nonmethod_func = (dict(
1592
zip(attribute.__code__.co_freevars,
1593
attribute.__closure__))
1594
["func"].cell_contents)
1097
1595
# Create a new, but exactly alike, function
1098
1596
# object, and decorate it to be a new D-Bus signal
1099
1597
# with the alternate D-Bus interface name
1100
new_function = (dbus.service.signal
1102
attribute._dbus_signature)
1103
(types.FunctionType(
1104
nonmethod_func.func_code,
1105
nonmethod_func.func_globals,
1106
nonmethod_func.func_name,
1107
nonmethod_func.func_defaults,
1108
nonmethod_func.func_closure)))
1598
new_function = copy_function(nonmethod_func)
1599
new_function = (dbus.service.signal(
1601
attribute._dbus_signature)(new_function))
1109
1602
# Copy annotations, if any
1111
new_function._dbus_annotations = (
1112
dict(attribute._dbus_annotations))
1604
new_function._dbus_annotations = dict(
1605
attribute._dbus_annotations)
1113
1606
except AttributeError:
1115
1609
# Define a creator of a function to call both the
1116
1610
# original and alternate functions, so both the
1117
1611
# original and alternate signals gets sent when
1258
1751
variant_level: D-Bus variant level. Default: 1
1260
1753
attrname = "_{}".format(dbus_name)
1261
1755
def setter(self, value):
1262
1756
if hasattr(self, "dbus_object_path"):
1263
1757
if (not hasattr(self, attrname) or
1264
1758
type_func(getattr(self, attrname, None))
1265
1759
!= type_func(value)):
1266
1760
if invalidate_only:
1267
self.PropertiesChanged(_interface,
1761
self.PropertiesChanged(
1762
_interface, dbus.Dictionary(),
1763
dbus.Array((dbus_name, )))
1272
dbus_value = transform_func(type_func(value),
1765
dbus_value = transform_func(
1767
variant_level=variant_level)
1275
1768
self.PropertyChanged(dbus.String(dbus_name),
1277
self.PropertiesChanged(_interface,
1279
dbus.String(dbus_name):
1280
dbus_value }), dbus.Array())
1770
self.PropertiesChanged(
1772
dbus.Dictionary({dbus.String(dbus_name):
1281
1775
setattr(self, attrname, value)
1283
1777
return property(lambda self: getattr(self, attrname), setter)
1285
1779
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1286
1780
approvals_pending = notifychangeproperty(dbus.Boolean,
1287
1781
"ApprovalPending",
1289
1783
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1290
1784
last_enabled = notifychangeproperty(datetime_to_dbus,
1292
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1293
type_func = lambda checker:
1294
checker is not None)
1786
checker = notifychangeproperty(
1787
dbus.Boolean, "CheckerRunning",
1788
type_func=lambda checker: checker is not None)
1295
1789
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1296
1790
"LastCheckedOK")
1297
1791
last_checker_status = notifychangeproperty(dbus.Int16,
1407
1900
server to mandos-client
1411
1904
# Rejected - signal
1412
1905
@dbus.service.signal(_interface, signature="s")
1413
1906
def Rejected(self, reason):
1417
1910
# NeedApproval - signal
1418
1911
@dbus.service.signal(_interface, signature="tb")
1419
1912
def NeedApproval(self, timeout, default):
1421
1914
return self.need_approval()
1425
1918
# Approve - method
1426
1919
@dbus.service.method(_interface, in_signature="b")
1427
1920
def Approve(self, value):
1428
1921
self.approve(value)
1430
1923
# CheckedOK - method
1431
1924
@dbus.service.method(_interface)
1432
1925
def CheckedOK(self):
1433
1926
self.checked_ok()
1435
1928
# Enable - method
1929
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1436
1930
@dbus.service.method(_interface)
1437
1931
def Enable(self):
1441
1935
# StartChecker - method
1936
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1442
1937
@dbus.service.method(_interface)
1443
1938
def StartChecker(self):
1445
1940
self.start_checker()
1447
1942
# Disable - method
1943
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1448
1944
@dbus.service.method(_interface)
1449
1945
def Disable(self):
1453
1949
# StopChecker - method
1950
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1454
1951
@dbus.service.method(_interface)
1455
1952
def StopChecker(self):
1456
1953
self.stop_checker()
1460
1957
# ApprovalPending - property
1461
1958
@dbus_service_property(_interface, signature="b", access="read")
1462
1959
def ApprovalPending_dbus_property(self):
1463
1960
return dbus.Boolean(bool(self.approvals_pending))
1465
1962
# ApprovedByDefault - property
1466
@dbus_service_property(_interface, signature="b",
1963
@dbus_service_property(_interface,
1467
1965
access="readwrite")
1468
1966
def ApprovedByDefault_dbus_property(self, value=None):
1469
1967
if value is None: # get
1470
1968
return dbus.Boolean(self.approved_by_default)
1471
1969
self.approved_by_default = bool(value)
1473
1971
# ApprovalDelay - property
1474
@dbus_service_property(_interface, signature="t",
1972
@dbus_service_property(_interface,
1475
1974
access="readwrite")
1476
1975
def ApprovalDelay_dbus_property(self, value=None):
1477
1976
if value is None: # get
1478
1977
return dbus.UInt64(self.approval_delay.total_seconds()
1480
1979
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1482
1981
# ApprovalDuration - property
1483
@dbus_service_property(_interface, signature="t",
1982
@dbus_service_property(_interface,
1484
1984
access="readwrite")
1485
1985
def ApprovalDuration_dbus_property(self, value=None):
1486
1986
if value is None: # get
1487
1987
return dbus.UInt64(self.approval_duration.total_seconds()
1489
1989
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1491
1991
# Name - property
1993
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1492
1994
@dbus_service_property(_interface, signature="s", access="read")
1493
1995
def Name_dbus_property(self):
1494
1996
return dbus.String(self.name)
1496
1998
# Fingerprint - property
2000
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1497
2001
@dbus_service_property(_interface, signature="s", access="read")
1498
2002
def Fingerprint_dbus_property(self):
1499
2003
return dbus.String(self.fingerprint)
1501
2005
# Host - property
1502
@dbus_service_property(_interface, signature="s",
2006
@dbus_service_property(_interface,
1503
2008
access="readwrite")
1504
2009
def Host_dbus_property(self, value=None):
1505
2010
if value is None: # get
1506
2011
return dbus.String(self.host)
1507
2012
self.host = str(value)
1509
2014
# Created - property
2016
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1510
2017
@dbus_service_property(_interface, signature="s", access="read")
1511
2018
def Created_dbus_property(self):
1512
2019
return datetime_to_dbus(self.created)
1514
2021
# LastEnabled - property
1515
2022
@dbus_service_property(_interface, signature="s", access="read")
1516
2023
def LastEnabled_dbus_property(self):
1517
2024
return datetime_to_dbus(self.last_enabled)
1519
2026
# Enabled - property
1520
@dbus_service_property(_interface, signature="b",
2027
@dbus_service_property(_interface,
1521
2029
access="readwrite")
1522
2030
def Enabled_dbus_property(self, value=None):
1523
2031
if value is None: # get
1664
2186
class ClientHandler(socketserver.BaseRequestHandler, object):
1665
2187
"""A class to handle client connections.
1667
2189
Instantiated once for each connection to handle it.
1668
2190
Note: This will run in its own forked process."""
1670
2192
def handle(self):
1671
2193
with contextlib.closing(self.server.child_pipe) as child_pipe:
1672
2194
logger.info("TCP connection from: %s",
1673
2195
str(self.client_address))
1674
2196
logger.debug("Pipe FD: %d",
1675
2197
self.server.child_pipe.fileno())
1677
session = (gnutls.connection
1678
.ClientSession(self.request,
1680
.X509Credentials()))
1682
# Note: gnutls.connection.X509Credentials is really a
1683
# generic GnuTLS certificate credentials object so long as
1684
# no X.509 keys are added to it. Therefore, we can use it
1685
# here despite using OpenPGP certificates.
1687
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1688
# "+AES-256-CBC", "+SHA1",
1689
# "+COMP-NULL", "+CTYPE-OPENPGP",
2199
session = gnutls.ClientSession(self.request)
2201
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2202
# "+AES-256-CBC", "+SHA1",
2203
# "+COMP-NULL", "+CTYPE-OPENPGP",
1691
2205
# Use a fallback default, since this MUST be set.
1692
2206
priority = self.server.gnutls_priority
1693
2207
if priority is None:
1694
2208
priority = "NORMAL"
1695
(gnutls.library.functions
1696
.gnutls_priority_set_direct(session._c_object,
2209
gnutls.priority_set_direct(session._c_object,
2210
priority.encode("utf-8"),
1699
2213
# Start communication using the Mandos protocol
1700
2214
# Get protocol number
1701
2215
line = self.request.makefile().readline()
1788
2301
delay -= time2 - time
1791
while sent_size < len(client.secret):
1793
sent = session.send(client.secret[sent_size:])
1794
except gnutls.errors.GNUTLSError as error:
1795
logger.warning("gnutls send failed",
1798
logger.debug("Sent: %d, remaining: %d",
1799
sent, len(client.secret)
1800
- (sent_size + sent))
2304
session.send(client.secret)
2305
except gnutls.Error as error:
2306
logger.warning("gnutls send failed",
1803
2310
logger.info("Sending secret to %s", client.name)
1804
2311
# bump the timeout using extended_timeout
1805
2312
client.bump_timeout(client.extended_timeout)
1806
2313
if self.server.use_dbus:
1807
2314
# Emit D-Bus signal
1808
2315
client.GotSecret()
1811
2318
if approval_required:
1812
2319
client.approvals_pending -= 1
1815
except gnutls.errors.GNUTLSError as error:
2322
except gnutls.Error as error:
1816
2323
logger.warning("GnuTLS bye failed",
1817
2324
exc_info=error)
1820
2327
def peer_certificate(session):
1821
2328
"Return the peer's OpenPGP certificate as a bytestring"
1822
2329
# If not an OpenPGP certificate...
1823
if (gnutls.library.functions
1824
.gnutls_certificate_type_get(session._c_object)
1825
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1826
# ...do the normal thing
1827
return session.peer_certificate
2330
if (gnutls.certificate_type_get(session._c_object)
2331
!= gnutls.CRT_OPENPGP):
2332
# ...return invalid data
1828
2334
list_size = ctypes.c_uint(1)
1829
cert_list = (gnutls.library.functions
1830
.gnutls_certificate_get_peers
2335
cert_list = (gnutls.certificate_get_peers
1831
2336
(session._c_object, ctypes.byref(list_size)))
1832
2337
if not bool(cert_list) and list_size.value != 0:
1833
raise gnutls.errors.GNUTLSError("error getting peer"
2338
raise gnutls.Error("error getting peer certificate")
1835
2339
if list_size.value == 0:
1837
2341
cert = cert_list[0]
1838
2342
return ctypes.string_at(cert.data, cert.size)
1841
2345
def fingerprint(openpgp):
1842
2346
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1843
2347
# New GnuTLS "datum" with the OpenPGP public key
1844
datum = (gnutls.library.types
1845
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1848
ctypes.c_uint(len(openpgp))))
2348
datum = gnutls.datum_t(
2349
ctypes.cast(ctypes.c_char_p(openpgp),
2350
ctypes.POINTER(ctypes.c_ubyte)),
2351
ctypes.c_uint(len(openpgp)))
1849
2352
# New empty GnuTLS certificate
1850
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1851
(gnutls.library.functions
1852
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2353
crt = gnutls.openpgp_crt_t()
2354
gnutls.openpgp_crt_init(ctypes.byref(crt))
1853
2355
# Import the OpenPGP public key into the certificate
1854
(gnutls.library.functions
1855
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1856
gnutls.library.constants
1857
.GNUTLS_OPENPGP_FMT_RAW))
2356
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2357
gnutls.OPENPGP_FMT_RAW)
1858
2358
# Verify the self signature in the key
1859
2359
crtverify = ctypes.c_uint()
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_verify_self(crt, 0,
1862
ctypes.byref(crtverify)))
2360
gnutls.openpgp_crt_verify_self(crt, 0,
2361
ctypes.byref(crtverify))
1863
2362
if crtverify.value != 0:
1864
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1865
raise (gnutls.errors.CertificateSecurityError
2363
gnutls.openpgp_crt_deinit(crt)
2364
raise gnutls.CertificateSecurityError("Verify failed")
1867
2365
# New buffer for the fingerprint
1868
2366
buf = ctypes.create_string_buffer(20)
1869
2367
buf_len = ctypes.c_size_t()
1870
2368
# Get the fingerprint from the certificate into the buffer
1871
(gnutls.library.functions
1872
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1873
ctypes.byref(buf_len)))
2369
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2370
ctypes.byref(buf_len))
1874
2371
# Deinit the certificate
1875
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2372
gnutls.openpgp_crt_deinit(crt)
1876
2373
# Convert the buffer to a Python bytestring
1877
2374
fpr = ctypes.string_at(buf, buf_len.value)
1878
2375
# Convert the bytestring to hexadecimal notation
1961
2464
# socket_wrapper(), if socketfd was set.
1962
2465
socketserver.TCPServer.__init__(self, server_address,
1963
2466
RequestHandlerClass)
1965
2468
def server_bind(self):
1966
2469
"""This overrides the normal server_bind() function
1967
2470
to bind to an interface if one was specified, and also NOT to
1968
2471
bind to an address or port if they were not specified."""
2472
global SO_BINDTODEVICE
1969
2473
if self.interface is not None:
1970
2474
if SO_BINDTODEVICE is None:
1971
logger.error("SO_BINDTODEVICE does not exist;"
1972
" cannot bind to interface %s",
1976
self.socket.setsockopt(socket.SOL_SOCKET,
1978
(self.interface + "\0")
1980
except socket.error as error:
1981
if error.errno == errno.EPERM:
1982
logger.error("No permission to bind to"
1983
" interface %s", self.interface)
1984
elif error.errno == errno.ENOPROTOOPT:
1985
logger.error("SO_BINDTODEVICE not available;"
1986
" cannot bind to interface %s",
1988
elif error.errno == errno.ENODEV:
1989
logger.error("Interface %s does not exist,"
1990
" cannot bind", self.interface)
2475
# Fall back to a hard-coded value which seems to be
2477
logger.warning("SO_BINDTODEVICE not found, trying 25")
2478
SO_BINDTODEVICE = 25
2480
self.socket.setsockopt(
2481
socket.SOL_SOCKET, SO_BINDTODEVICE,
2482
(self.interface + "\0").encode("utf-8"))
2483
except socket.error as error:
2484
if error.errno == errno.EPERM:
2485
logger.error("No permission to bind to"
2486
" interface %s", self.interface)
2487
elif error.errno == errno.ENOPROTOOPT:
2488
logger.error("SO_BINDTODEVICE not available;"
2489
" cannot bind to interface %s",
2491
elif error.errno == errno.ENODEV:
2492
logger.error("Interface %s does not exist,"
2493
" cannot bind", self.interface)
1993
2496
# Only bind(2) the socket if we really need to.
1994
2497
if self.server_address[0] or self.server_address[1]:
1995
2498
if not self.server_address[0]:
1996
2499
if self.address_family == socket.AF_INET6:
1997
any_address = "::" # in6addr_any
2500
any_address = "::" # in6addr_any
1999
any_address = "0.0.0.0" # INADDR_ANY
2502
any_address = "0.0.0.0" # INADDR_ANY
2000
2503
self.server_address = (any_address,
2001
2504
self.server_address[1])
2002
2505
elif not self.server_address[1]:
2003
self.server_address = (self.server_address[0],
2506
self.server_address = (self.server_address[0], 0)
2005
2507
# if self.interface:
2006
2508
# self.server_address = (self.server_address[0],
2438
2947
level = getattr(logging, debuglevel.upper())
2439
2948
initlogger(debug, level)
2441
2950
if server_settings["servicename"] != "Mandos":
2442
syslogger.setFormatter(logging.Formatter
2443
('Mandos ({}) [%(process)d]:'
2444
' %(levelname)s: %(message)s'
2445
.format(server_settings
2951
syslogger.setFormatter(
2952
logging.Formatter('Mandos ({}) [%(process)d]:'
2953
' %(levelname)s: %(message)s'.format(
2954
server_settings["servicename"])))
2448
2956
# Parse config file with clients
2449
2957
client_config = configparser.SafeConfigParser(Client
2450
2958
.client_defaults)
2451
2959
client_config.read(os.path.join(server_settings["configdir"],
2452
2960
"clients.conf"))
2454
2962
global mandos_dbus_service
2455
2963
mandos_dbus_service = None
2457
2965
socketfd = None
2458
2966
if server_settings["socket"] != "":
2459
2967
socketfd = server_settings["socket"]
2460
tcp_server = MandosServer((server_settings["address"],
2461
server_settings["port"]),
2463
interface=(server_settings["interface"]
2467
server_settings["priority"],
2968
tcp_server = MandosServer(
2969
(server_settings["address"], server_settings["port"]),
2971
interface=(server_settings["interface"] or None),
2973
gnutls_priority=server_settings["priority"],
2470
2976
if not foreground:
2471
2977
pidfilename = "/run/mandos.pid"
2472
2978
if not os.path.isdir("/run/."):
2473
2979
pidfilename = "/var/run/mandos.pid"
2476
pidfile = open(pidfilename, "w")
2982
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2477
2983
except IOError as e:
2478
2984
logger.error("Could not open file %r", pidfilename,
2481
for name in ("_mandos", "mandos", "nobody"):
2987
for name, group in (("_mandos", "_mandos"),
2988
("mandos", "mandos"),
2989
("nobody", "nogroup")):
2483
2991
uid = pwd.getpwnam(name).pw_uid
2484
gid = pwd.getpwnam(name).pw_gid
2992
gid = pwd.getpwnam(group).pw_gid
2486
2994
except KeyError:
3003
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2494
3005
except OSError as error:
3006
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3007
.format(uid, gid, os.strerror(error.errno)))
2495
3008
if error.errno != errno.EPERM:
2499
3012
# Enable all possible GnuTLS debugging
2501
3014
# "Use a log level over 10 to enable all debugging options."
2502
3015
# - GnuTLS manual
2503
gnutls.library.functions.gnutls_global_set_log_level(11)
2505
@gnutls.library.types.gnutls_log_func
3016
gnutls.global_set_log_level(11)
2506
3019
def debug_gnutls(level, string):
2507
3020
logger.debug("GnuTLS: %s", string[:-1])
2509
(gnutls.library.functions
2510
.gnutls_global_set_log_function(debug_gnutls))
3022
gnutls.global_set_log_function(debug_gnutls)
2512
3024
# Redirect stdin so all checkers get /dev/null
2513
3025
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2514
3026
os.dup2(null, sys.stdin.fileno())
2518
3030
# Need to fork before connecting to D-Bus
2519
3031
if not foreground:
2520
3032
# Close all input and output, do double fork, etc.
2523
# multiprocessing will use threads, so before we use gobject we
2524
# need to inform gobject that threads will be used.
2525
gobject.threads_init()
3035
# multiprocessing will use threads, so before we use GLib we need
3036
# to inform GLib that threads will be used.
2527
3039
global main_loop
2528
3040
# From the Avahi example code
2529
3041
DBusGMainLoop(set_as_default=True)
2530
main_loop = gobject.MainLoop()
3042
main_loop = GLib.MainLoop()
2531
3043
bus = dbus.SystemBus()
2532
3044
# End of Avahi example code
2535
3047
bus_name = dbus.service.BusName("se.recompile.Mandos",
2536
bus, do_not_queue=True)
2537
old_bus_name = (dbus.service.BusName
2538
("se.bsnet.fukt.Mandos", bus,
2540
except dbus.exceptions.NameExistsException as e:
3050
old_bus_name = dbus.service.BusName(
3051
"se.bsnet.fukt.Mandos", bus,
3053
except dbus.exceptions.DBusException as e:
2541
3054
logger.error("Disabling D-Bus:", exc_info=e)
2542
3055
use_dbus = False
2543
3056
server_settings["use_dbus"] = False
2544
3057
tcp_server.use_dbus = False
2546
3059
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2547
service = AvahiServiceToSyslog(name =
2548
server_settings["servicename"],
2549
servicetype = "_mandos._tcp",
2550
protocol = protocol, bus = bus)
3060
service = AvahiServiceToSyslog(
3061
name=server_settings["servicename"],
3062
servicetype="_mandos._tcp",
2551
3065
if server_settings["interface"]:
2552
service.interface = (if_nametoindex
2553
(server_settings["interface"]
3066
service.interface = if_nametoindex(
3067
server_settings["interface"].encode("utf-8"))
2556
3069
global multiprocessing_manager
2557
3070
multiprocessing_manager = multiprocessing.Manager()
2559
3072
client_class = Client
2561
client_class = functools.partial(ClientDBus, bus = bus)
3074
client_class = functools.partial(ClientDBus, bus=bus)
2563
3076
client_settings = Client.config_parser(client_config)
2564
3077
old_client_settings = {}
2565
3078
clients_data = {}
2567
3080
# This is used to redirect stdout and stderr for checker processes
2569
wnull = open(os.devnull, "w") # A writable /dev/null
3082
wnull = open(os.devnull, "w") # A writable /dev/null
2570
3083
# Only used if server is running in foreground but not in debug
2572
3085
if debug or not foreground:
2575
3088
# Get client data and settings from last running state.
2576
3089
if server_settings["restore"]:
2578
3091
with open(stored_state_path, "rb") as stored_state:
2579
clients_data, old_client_settings = (pickle.load
3092
if sys.version_info.major == 2:
3093
clients_data, old_client_settings = pickle.load(
3096
bytes_clients_data, bytes_old_client_settings = (
3097
pickle.load(stored_state, encoding="bytes"))
3098
# Fix bytes to strings
3101
clients_data = {(key.decode("utf-8")
3102
if isinstance(key, bytes)
3105
bytes_clients_data.items()}
3106
del bytes_clients_data
3107
for key in clients_data:
3108
value = {(k.decode("utf-8")
3109
if isinstance(k, bytes) else k): v
3111
clients_data[key].items()}
3112
clients_data[key] = value
3114
value["client_structure"] = [
3116
if isinstance(s, bytes)
3118
value["client_structure"]]
3120
for k in ("name", "host"):
3121
if isinstance(value[k], bytes):
3122
value[k] = value[k].decode("utf-8")
3123
# old_client_settings
3125
old_client_settings = {
3126
(key.decode("utf-8")
3127
if isinstance(key, bytes)
3130
bytes_old_client_settings.items()}
3131
del bytes_old_client_settings
3133
for value in old_client_settings.values():
3134
if isinstance(value["host"], bytes):
3135
value["host"] = (value["host"]
2581
3137
os.remove(stored_state_path)
2582
3138
except IOError as e:
2583
3139
if e.errno == errno.ENOENT:
2584
logger.warning("Could not load persistent state: {}"
2585
.format(os.strerror(e.errno)))
3140
logger.warning("Could not load persistent state:"
3141
" {}".format(os.strerror(e.errno)))
2587
3143
logger.critical("Could not load persistent state:",
2590
3146
except EOFError as e:
2591
3147
logger.warning("Could not load persistent state: "
2592
"EOFError:", exc_info=e)
2594
3151
with PGPEngine() as pgp:
2595
3152
for client_name, client in clients_data.items():
2596
3153
# Skip removed clients
2597
3154
if client_name not in client_settings:
2600
3157
# Decide which value to use after restoring saved state.
2601
3158
# We have three different values: Old config file,
2602
3159
# new config file, and saved state.
2660
3217
for client_name in (set(client_settings)
2661
3218
- set(old_client_settings)):
2662
3219
clients_data[client_name] = client_settings[client_name]
2664
3221
# Create all client objects
2665
3222
for client_name, client in clients_data.items():
2666
3223
tcp_server.clients[client_name] = client_class(
2667
name = client_name, settings = client,
2668
server_settings = server_settings)
3226
server_settings=server_settings)
2670
3228
if not tcp_server.clients:
2671
3229
logger.warning("No clients defined")
2673
3231
if not foreground:
2674
3232
if pidfile is not None:
2678
pidfile.write("{}\n".format(pid).encode("utf-8"))
3236
print(pid, file=pidfile)
2679
3237
except IOError:
2680
3238
logger.error("Could not write to file %r with PID %d",
2681
3239
pidfilename, pid)
2683
3241
del pidfilename
2685
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2686
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3243
for termsig in (signal.SIGHUP, signal.SIGTERM):
3244
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3245
lambda: main_loop.quit() and False)
2689
@alternate_dbus_interfaces({"se.recompile.Mandos":
2690
"se.bsnet.fukt.Mandos"})
2691
class MandosDBusService(DBusObjectWithProperties):
3249
@alternate_dbus_interfaces(
3250
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3251
class MandosDBusService(DBusObjectWithObjectManager):
2692
3252
"""A D-Bus proxy object"""
2693
3254
def __init__(self):
2694
3255
dbus.service.Object.__init__(self, bus, "/")
2695
3257
_interface = "se.recompile.Mandos"
2697
@dbus_interface_annotations(_interface)
2699
return { "org.freedesktop.DBus.Property"
2700
".EmitsChangedSignal":
2703
3259
@dbus.service.signal(_interface, signature="o")
2704
3260
def ClientAdded(self, objpath):
2708
3264
@dbus.service.signal(_interface, signature="ss")
2709
3265
def ClientNotFound(self, fingerprint, address):
3269
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2713
3271
@dbus.service.signal(_interface, signature="os")
2714
3272
def ClientRemoved(self, objpath, name):
3276
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2718
3278
@dbus.service.method(_interface, out_signature="ao")
2719
3279
def GetAllClients(self):
2721
return dbus.Array(c.dbus_object_path
2723
tcp_server.clients.itervalues())
3281
return dbus.Array(c.dbus_object_path for c in
3282
tcp_server.clients.values())
3284
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2725
3286
@dbus.service.method(_interface,
2726
3287
out_signature="a{oa{sv}}")
2727
3288
def GetAllClientsWithProperties(self):
2729
3290
return dbus.Dictionary(
2730
{ c.dbus_object_path: c.GetAll("")
2731
for c in tcp_server.clients.itervalues() },
3291
{c.dbus_object_path: c.GetAll(
3292
"se.recompile.Mandos.Client")
3293
for c in tcp_server.clients.values()},
2732
3294
signature="oa{sv}")
2734
3296
@dbus.service.method(_interface, in_signature="o")
2735
3297
def RemoveClient(self, object_path):
2737
for c in tcp_server.clients.itervalues():
3299
for c in tcp_server.clients.values():
2738
3300
if c.dbus_object_path == object_path:
2739
3301
del tcp_server.clients[c.name]
2740
3302
c.remove_from_connection()
2741
# Don't signal anything except ClientRemoved
3303
# Don't signal the disabling
2742
3304
c.disable(quiet=True)
2744
self.ClientRemoved(object_path, c.name)
3305
# Emit D-Bus signal for removal
3306
self.client_removed_signal(c)
2746
3308
raise KeyError(object_path)
3312
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3313
out_signature="a{oa{sa{sv}}}")
3314
def GetManagedObjects(self):
3316
return dbus.Dictionary(
3317
{client.dbus_object_path:
3319
{interface: client.GetAll(interface)
3321
client._get_all_interface_names()})
3322
for client in tcp_server.clients.values()})
3324
def client_added_signal(self, client):
3325
"""Send the new standard signal and the old signal"""
3327
# New standard signal
3328
self.InterfacesAdded(
3329
client.dbus_object_path,
3331
{interface: client.GetAll(interface)
3333
client._get_all_interface_names()}))
3335
self.ClientAdded(client.dbus_object_path)
3337
def client_removed_signal(self, client):
3338
"""Send the new standard signal and the old signal"""
3340
# New standard signal
3341
self.InterfacesRemoved(
3342
client.dbus_object_path,
3343
client._get_all_interface_names())
3345
self.ClientRemoved(client.dbus_object_path,
2750
3348
mandos_dbus_service = MandosDBusService()
3350
# Save modules to variables to exempt the modules from being
3351
# unloaded before the function registered with atexit() is run.
3352
mp = multiprocessing
2753
3356
"Cleanup function; run on exit"
2755
3358
service.cleanup()
2757
multiprocessing.active_children()
3360
mp.active_children()
2759
3362
if not (tcp_server.clients or client_settings):
2762
3365
# Store client before exiting. Secrets are encrypted with key
2763
3366
# based on what config file has. If config file is
2764
3367
# removed/edited, old secret will thus be unrecovable.
2766
3369
with PGPEngine() as pgp:
2767
for client in tcp_server.clients.itervalues():
3370
for client in tcp_server.clients.values():
2768
3371
key = client_settings[client.name]["secret"]
2769
3372
client.encrypted_secret = pgp.encrypt(client.secret,
2771
3374
client_dict = {}
2773
3376
# A list of attributes that can not be pickled
2775
exclude = { "bus", "changedstate", "secret",
2776
"checker", "server_settings" }
2777
for name, typ in (inspect.getmembers
2778
(dbus.service.Object)):
3378
exclude = {"bus", "changedstate", "secret",
3379
"checker", "server_settings"}
3380
for name, typ in inspect.getmembers(dbus.service
2779
3382
exclude.add(name)
2781
3384
client_dict["encrypted_secret"] = (client
2782
3385
.encrypted_secret)
2783
3386
for attr in client.client_structure:
2784
3387
if attr not in exclude:
2785
3388
client_dict[attr] = getattr(client, attr)
2787
3390
clients[client.name] = client_dict
2788
3391
del client_settings[client.name]["secret"]
2791
with (tempfile.NamedTemporaryFile
2792
(mode='wb', suffix=".pickle", prefix='clients-',
2793
dir=os.path.dirname(stored_state_path),
2794
delete=False)) as stored_state:
2795
pickle.dump((clients, client_settings), stored_state)
2796
tempname=stored_state.name
3394
with tempfile.NamedTemporaryFile(
3398
dir=os.path.dirname(stored_state_path),
3399
delete=False) as stored_state:
3400
pickle.dump((clients, client_settings), stored_state,
3402
tempname = stored_state.name
2797
3403
os.rename(tempname, stored_state_path)
2798
3404
except (IOError, OSError) as e: