183
235
.replace(b"\n", b"\\n")
184
236
.replace(b"\0", b"\\x00"))
187
239
def encrypt(self, data, password):
188
240
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
191
243
passfile.write(passphrase)
193
proc = subprocess.Popen(['gpg', '--symmetric',
245
proc = subprocess.Popen([self.gpg, '--symmetric',
194
246
'--passphrase-file',
196
248
+ self.gnupgargs,
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
201
253
if proc.returncode != 0:
202
254
raise PGPError(err)
203
255
return ciphertext
205
257
def decrypt(self, data, password):
206
258
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
259
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
209
261
passfile.write(passphrase)
211
proc = subprocess.Popen(['gpg', '--decrypt',
263
proc = subprocess.Popen([self.gpg, '--decrypt',
212
264
'--passphrase-file',
214
266
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
220
271
if proc.returncode != 0:
221
272
raise PGPError(err)
222
273
return decrypted_plaintext
276
# Pretend that we have an Avahi module
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
225
303
class AvahiError(Exception):
226
304
def __init__(self, value, *args, **kwargs):
227
305
self.value = value
228
306
return super(AvahiError, self).__init__(value, *args,
231
310
class AvahiServiceError(AvahiError):
234
314
class AvahiGroupError(AvahiError):
238
318
class AvahiService(object):
239
319
"""An Avahi (Zeroconf) service.
242
322
interface: integer; avahi.IF_UNSPEC or an interface index.
243
323
Used to optionally bind to the specified interface.
400
496
def rename(self, *args, **kwargs):
401
497
"""Add the new name to the syslog messages"""
402
498
ret = AvahiService.rename(self, *args, **kwargs)
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
510
_library = ctypes.cdll.LoadLibrary(
511
ctypes.util.find_library("gnutls"))
512
_need_version = b"3.3.0"
515
# Need to use class name "GnuTLS" here, since this method is
516
# called before the assignment to the "gnutls" global variable
518
if GnuTLS.check_version(self._need_version) is None:
519
raise GnuTLS.Error("Needs GnuTLS {} or later"
520
.format(self._need_version))
522
# Unless otherwise indicated, the constants and types below are
523
# all from the gnutls/gnutls.h C header file.
533
E_NO_CERTIFICATE_FOUND = -49
534
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
537
class session_int(ctypes.Structure):
539
session_t = ctypes.POINTER(session_int)
541
class certificate_credentials_st(ctypes.Structure):
543
certificate_credentials_t = ctypes.POINTER(
544
certificate_credentials_st)
545
certificate_type_t = ctypes.c_int
547
class datum_t(ctypes.Structure):
548
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
549
('size', ctypes.c_uint)]
551
class openpgp_crt_int(ctypes.Structure):
553
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
554
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
555
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
556
credentials_type_t = ctypes.c_int
557
transport_ptr_t = ctypes.c_void_p
558
close_request_t = ctypes.c_int
561
class Error(Exception):
562
# We need to use the class name "GnuTLS" here, since this
563
# exception might be raised from within GnuTLS.__init__,
564
# which is called before the assignment to the "gnutls"
565
# global variable has happened.
566
def __init__(self, message=None, code=None, args=()):
567
# Default usage is by a message string, but if a return
568
# code is passed, convert it to a string with
571
if message is None and code is not None:
572
message = GnuTLS.strerror(code)
573
return super(GnuTLS.Error, self).__init__(
576
class CertificateSecurityError(Error):
580
class Credentials(object):
582
self._c_object = gnutls.certificate_credentials_t()
583
gnutls.certificate_allocate_credentials(
584
ctypes.byref(self._c_object))
585
self.type = gnutls.CRD_CERTIFICATE
588
gnutls.certificate_free_credentials(self._c_object)
590
class ClientSession(object):
591
def __init__(self, socket, credentials=None):
592
self._c_object = gnutls.session_t()
593
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
594
gnutls.set_default_priority(self._c_object)
595
gnutls.transport_set_ptr(self._c_object, socket.fileno())
596
gnutls.handshake_set_private_extensions(self._c_object,
599
if credentials is None:
600
credentials = gnutls.Credentials()
601
gnutls.credentials_set(self._c_object, credentials.type,
602
ctypes.cast(credentials._c_object,
604
self.credentials = credentials
607
gnutls.deinit(self._c_object)
610
return gnutls.handshake(self._c_object)
612
def send(self, data):
616
data_len -= gnutls.record_send(self._c_object,
621
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
623
# Error handling functions
624
def _error_code(result):
625
"""A function to raise exceptions on errors, suitable
626
for the 'restype' attribute on ctypes functions"""
629
if result == gnutls.E_NO_CERTIFICATE_FOUND:
630
raise gnutls.CertificateSecurityError(code=result)
631
raise gnutls.Error(code=result)
633
def _retry_on_error(result, func, arguments):
634
"""A function to retry on some errors, suitable
635
for the 'errcheck' attribute on ctypes functions"""
637
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
638
return _error_code(result)
639
result = func(*arguments)
642
# Unless otherwise indicated, the function declarations below are
643
# all from the gnutls/gnutls.h C header file.
646
priority_set_direct = _library.gnutls_priority_set_direct
647
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
648
ctypes.POINTER(ctypes.c_char_p)]
649
priority_set_direct.restype = _error_code
651
init = _library.gnutls_init
652
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
653
init.restype = _error_code
655
set_default_priority = _library.gnutls_set_default_priority
656
set_default_priority.argtypes = [session_t]
657
set_default_priority.restype = _error_code
659
record_send = _library.gnutls_record_send
660
record_send.argtypes = [session_t, ctypes.c_void_p,
662
record_send.restype = ctypes.c_ssize_t
663
record_send.errcheck = _retry_on_error
665
certificate_allocate_credentials = (
666
_library.gnutls_certificate_allocate_credentials)
667
certificate_allocate_credentials.argtypes = [
668
ctypes.POINTER(certificate_credentials_t)]
669
certificate_allocate_credentials.restype = _error_code
671
certificate_free_credentials = (
672
_library.gnutls_certificate_free_credentials)
673
certificate_free_credentials.argtypes = [
674
certificate_credentials_t]
675
certificate_free_credentials.restype = None
677
handshake_set_private_extensions = (
678
_library.gnutls_handshake_set_private_extensions)
679
handshake_set_private_extensions.argtypes = [session_t,
681
handshake_set_private_extensions.restype = None
683
credentials_set = _library.gnutls_credentials_set
684
credentials_set.argtypes = [session_t, credentials_type_t,
686
credentials_set.restype = _error_code
688
strerror = _library.gnutls_strerror
689
strerror.argtypes = [ctypes.c_int]
690
strerror.restype = ctypes.c_char_p
692
certificate_type_get = _library.gnutls_certificate_type_get
693
certificate_type_get.argtypes = [session_t]
694
certificate_type_get.restype = _error_code
696
certificate_get_peers = _library.gnutls_certificate_get_peers
697
certificate_get_peers.argtypes = [session_t,
698
ctypes.POINTER(ctypes.c_uint)]
699
certificate_get_peers.restype = ctypes.POINTER(datum_t)
701
global_set_log_level = _library.gnutls_global_set_log_level
702
global_set_log_level.argtypes = [ctypes.c_int]
703
global_set_log_level.restype = None
705
global_set_log_function = _library.gnutls_global_set_log_function
706
global_set_log_function.argtypes = [log_func]
707
global_set_log_function.restype = None
709
deinit = _library.gnutls_deinit
710
deinit.argtypes = [session_t]
711
deinit.restype = None
713
handshake = _library.gnutls_handshake
714
handshake.argtypes = [session_t]
715
handshake.restype = _error_code
716
handshake.errcheck = _retry_on_error
718
transport_set_ptr = _library.gnutls_transport_set_ptr
719
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
720
transport_set_ptr.restype = None
722
bye = _library.gnutls_bye
723
bye.argtypes = [session_t, close_request_t]
724
bye.restype = _error_code
725
bye.errcheck = _retry_on_error
727
check_version = _library.gnutls_check_version
728
check_version.argtypes = [ctypes.c_char_p]
729
check_version.restype = ctypes.c_char_p
731
# All the function declarations below are from gnutls/openpgp.h
733
openpgp_crt_init = _library.gnutls_openpgp_crt_init
734
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
735
openpgp_crt_init.restype = _error_code
737
openpgp_crt_import = _library.gnutls_openpgp_crt_import
738
openpgp_crt_import.argtypes = [openpgp_crt_t,
739
ctypes.POINTER(datum_t),
741
openpgp_crt_import.restype = _error_code
743
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
744
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
745
ctypes.POINTER(ctypes.c_uint)]
746
openpgp_crt_verify_self.restype = _error_code
748
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
749
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
750
openpgp_crt_deinit.restype = None
752
openpgp_crt_get_fingerprint = (
753
_library.gnutls_openpgp_crt_get_fingerprint)
754
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
758
openpgp_crt_get_fingerprint.restype = _error_code
760
# Remove non-public functions
761
del _error_code, _retry_on_error
762
# Create the global "gnutls" object, simulating a module
766
def call_pipe(connection, # : multiprocessing.Connection
767
func, *args, **kwargs):
768
"""This function is meant to be called by multiprocessing.Process
770
This function runs func(*args, **kwargs), and writes the resulting
771
return value on the provided multiprocessing.Connection.
773
connection.send(func(*args, **kwargs))
410
777
class Client(object):
411
778
"""A representation of a client host served by this server.
414
781
approved: bool(); 'None' if not yet approved/disapproved
415
782
approval_delay: datetime.timedelta(); Time to wait for approval
588
957
logger.info("Disabling client %s", self.name)
589
958
if getattr(self, "disable_initiator_tag", None) is not None:
590
gobject.source_remove(self.disable_initiator_tag)
959
GLib.source_remove(self.disable_initiator_tag)
591
960
self.disable_initiator_tag = None
592
961
self.expires = None
593
962
if getattr(self, "checker_initiator_tag", None) is not None:
594
gobject.source_remove(self.checker_initiator_tag)
963
GLib.source_remove(self.checker_initiator_tag)
595
964
self.checker_initiator_tag = None
596
965
self.stop_checker()
597
966
self.enabled = False
599
968
self.send_changedstate()
600
# Do not run this again if called by a gobject.timeout_add
969
# Do not run this again if called by a GLib.timeout_add
603
972
def __del__(self):
606
975
def init_checker(self):
607
976
# Schedule a new checker to be started an 'interval' from now,
608
977
# and every interval from then on.
609
978
if self.checker_initiator_tag is not None:
610
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
613
.total_seconds() * 1000),
979
GLib.source_remove(self.checker_initiator_tag)
980
self.checker_initiator_tag = GLib.timeout_add(
981
int(self.interval.total_seconds() * 1000),
615
983
# Schedule a disable() when 'timeout' has passed
616
984
if self.disable_initiator_tag is not None:
617
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
620
.total_seconds() * 1000),
985
GLib.source_remove(self.disable_initiator_tag)
986
self.disable_initiator_tag = GLib.timeout_add(
987
int(self.timeout.total_seconds() * 1000), self.disable)
622
988
# Also start a new checker *right now*.
623
989
self.start_checker()
625
def checker_callback(self, pid, condition, command):
991
def checker_callback(self, source, condition, connection,
626
993
"""The checker has completed, so take appropriate actions."""
627
994
self.checker_callback_tag = None
628
995
self.checker = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
996
# Read return code from connection (see call_pipe)
997
returncode = connection.recv()
1001
self.last_checker_status = returncode
1002
self.last_checker_signal = None
631
1003
if self.last_checker_status == 0:
632
1004
logger.info("Checker for %(name)s succeeded",
634
1006
self.checked_ok()
636
logger.info("Checker for %(name)s failed",
1008
logger.info("Checker for %(name)s failed", vars(self))
639
1010
self.last_checker_status = -1
1011
self.last_checker_signal = -returncode
640
1012
logger.warning("Checker for %(name)s crashed?",
643
1016
def checked_ok(self):
644
1017
"""Assert that the client has been seen, alive and well."""
645
1018
self.last_checked_ok = datetime.datetime.utcnow()
646
1019
self.last_checker_status = 0
1020
self.last_checker_signal = None
647
1021
self.bump_timeout()
649
1023
def bump_timeout(self, timeout=None):
650
1024
"""Bump up the timeout for this client."""
651
1025
if timeout is None:
652
1026
timeout = self.timeout
653
1027
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
1028
GLib.source_remove(self.disable_initiator_tag)
655
1029
self.disable_initiator_tag = None
656
1030
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(timeout.total_seconds() * 1000), self.disable)
660
1033
self.expires = datetime.datetime.utcnow() + timeout
662
1035
def need_approval(self):
663
1036
self.last_approval_request = datetime.datetime.utcnow()
665
1038
def start_checker(self):
666
1039
"""Start a new checker subprocess if one is not running.
668
1041
If a checker already exists, leave it running and do
670
1043
# The reason for not killing a running checker is that if we
675
1048
# checkers alone, the checker would have to take more time
676
1049
# than 'timeout' for the client to be disabled, which is as it
679
# If a checker exists, make sure it is not a zombie
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except AttributeError:
684
except OSError as error:
685
if error.errno != errno.ECHILD:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
1052
if self.checker is not None and not self.checker.is_alive():
1053
logger.warning("Checker was not alive; joining")
693
1056
# Start a new checker if needed
694
1057
if self.checker is None:
695
1058
# Escape attributes for the shell
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
1060
attr: re.escape(str(getattr(self, attr)))
1061
for attr in self.runtime_expansions}
700
1063
command = self.checker_command % escaped_attrs
701
1064
except TypeError as error:
702
1065
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
1066
self.checker_command,
1068
return True # Try again later
705
1069
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
# The exception is when not debugging but nevertheless
714
# running in the foreground; use the previously
717
if (not self.server_settings["debug"]
718
and self.server_settings["foreground"]):
719
popen_args.update({"stdout": wnull,
721
self.checker = subprocess.Popen(command,
725
except OSError as error:
726
logger.error("Failed to start subprocess",
729
self.checker_callback_tag = (gobject.child_watch_add
731
self.checker_callback,
733
# The checker may have completed before the gobject
734
# watch was added. Check for this.
736
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
737
except OSError as error:
738
if error.errno == errno.ECHILD:
739
# This should never happen
740
logger.error("Child process vanished",
745
gobject.source_remove(self.checker_callback_tag)
746
self.checker_callback(pid, status, command)
747
# Re-run this periodically if run by gobject.timeout_add
1070
logger.info("Starting checker %r for %s", command,
1072
# We don't need to redirect stdout and stderr, since
1073
# in normal mode, that is already done by daemon(),
1074
# and in debug mode we don't want to. (Stdin is
1075
# always replaced by /dev/null.)
1076
# The exception is when not debugging but nevertheless
1077
# running in the foreground; use the previously
1079
popen_args = {"close_fds": True,
1082
if (not self.server_settings["debug"]
1083
and self.server_settings["foreground"]):
1084
popen_args.update({"stdout": wnull,
1086
pipe = multiprocessing.Pipe(duplex=False)
1087
self.checker = multiprocessing.Process(
1089
args=(pipe[1], subprocess.call, command),
1091
self.checker.start()
1092
self.checker_callback_tag = GLib.io_add_watch(
1093
pipe[0].fileno(), GLib.IO_IN,
1094
self.checker_callback, pipe[0], command)
1095
# Re-run this periodically if run by GLib.timeout_add
750
1098
def stop_checker(self):
751
1099
"""Force the checker process, if any, to stop."""
752
1100
if self.checker_callback_tag:
753
gobject.source_remove(self.checker_callback_tag)
1101
GLib.source_remove(self.checker_callback_tag)
754
1102
self.checker_callback_tag = None
755
1103
if getattr(self, "checker", None) is None:
757
1105
logger.debug("Stopping checker for %(name)s", vars(self))
759
self.checker.terminate()
761
#if self.checker.poll() is None:
762
# self.checker.kill()
763
except OSError as error:
764
if error.errno != errno.ESRCH: # No such process
1106
self.checker.terminate()
766
1107
self.checker = None
769
def dbus_service_property(dbus_interface, signature="v",
770
access="readwrite", byte_arrays=False):
1110
def dbus_service_property(dbus_interface,
771
1114
"""Decorators for marking methods of a DBusObjectWithProperties to
772
1115
become properties on the D-Bus.
774
1117
The decorated method will be called with no arguments by "Get"
775
1118
and with one argument by "Set".
777
1120
The parameters, where they are supported, are the same as
778
1121
dbus.service.method, except there is only "signature", since the
779
1122
type from Get() and the type sent to Set() is the same.
853
class DBusObjectWithProperties(dbus.service.Object):
854
"""A D-Bus object with properties.
856
Classes inheriting from this can use the dbus_service_property
857
decorator to expose methods as D-Bus properties. It exposes the
858
standard Get(), Set(), and GetAll() methods on the D-Bus.
1205
class DBusObjectWithAnnotations(dbus.service.Object):
1206
"""A D-Bus object with annotations.
1208
Classes inheriting from this can use the dbus_annotations
1209
decorator to add annotations to methods or signals.
862
1213
def _is_dbus_thing(thing):
863
1214
"""Returns a function testing if an attribute is a D-Bus thing
865
1216
If called like _is_dbus_thing("method") it returns a function
866
1217
suitable for use as predicate to inspect.getmembers().
868
1219
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
871
1222
def _get_all_dbus_things(self, thing):
872
1223
"""Returns a generator of (name, attribute) pairs
874
return ((getattr(athing.__get__(self), "_dbus_name",
1225
return ((getattr(athing.__get__(self), "_dbus_name", name),
876
1226
athing.__get__(self))
877
1227
for cls in self.__class__.__mro__
878
1228
for name, athing in
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
1229
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1231
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1233
path_keyword='object_path',
1234
connection_keyword='connection')
1235
def Introspect(self, object_path, connection):
1236
"""Overloading of standard D-Bus method.
1238
Inserts annotation tags on methods and signals.
1240
xmlstring = dbus.service.Object.Introspect(self, object_path,
1243
document = xml.dom.minidom.parseString(xmlstring)
1245
for if_tag in document.getElementsByTagName("interface"):
1246
# Add annotation tags
1247
for typ in ("method", "signal"):
1248
for tag in if_tag.getElementsByTagName(typ):
1250
for name, prop in (self.
1251
_get_all_dbus_things(typ)):
1252
if (name == tag.getAttribute("name")
1253
and prop._dbus_interface
1254
== if_tag.getAttribute("name")):
1255
annots.update(getattr(
1256
prop, "_dbus_annotations", {}))
1257
for name, value in annots.items():
1258
ann_tag = document.createElement(
1260
ann_tag.setAttribute("name", name)
1261
ann_tag.setAttribute("value", value)
1262
tag.appendChild(ann_tag)
1263
# Add interface annotation tags
1264
for annotation, value in dict(
1265
itertools.chain.from_iterable(
1266
annotations().items()
1267
for name, annotations
1268
in self._get_all_dbus_things("interface")
1269
if name == if_tag.getAttribute("name")
1271
ann_tag = document.createElement("annotation")
1272
ann_tag.setAttribute("name", annotation)
1273
ann_tag.setAttribute("value", value)
1274
if_tag.appendChild(ann_tag)
1275
# Fix argument name for the Introspect method itself
1276
if (if_tag.getAttribute("name")
1277
== dbus.INTROSPECTABLE_IFACE):
1278
for cn in if_tag.getElementsByTagName("method"):
1279
if cn.getAttribute("name") == "Introspect":
1280
for arg in cn.getElementsByTagName("arg"):
1281
if (arg.getAttribute("direction")
1283
arg.setAttribute("name",
1285
xmlstring = document.toxml("utf-8")
1287
except (AttributeError, xml.dom.DOMException,
1288
xml.parsers.expat.ExpatError) as error:
1289
logger.error("Failed to override Introspection method",
1294
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1295
"""A D-Bus object with properties.
1297
Classes inheriting from this can use the dbus_service_property
1298
decorator to expose methods as D-Bus properties. It exposes the
1299
standard Get(), Set(), and GetAll() methods on the D-Bus.
882
1302
def _get_dbus_property(self, interface_name, property_name):
883
1303
"""Returns a bound method if one exists which is a D-Bus
884
1304
property with the specified name and interface.
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
889
self._is_dbus_thing("property"))):
1306
for cls in self.__class__.__mro__:
1307
for name, value in inspect.getmembers(
1308
cls, self._is_dbus_thing("property")):
890
1309
if (value._dbus_name == property_name
891
1310
and value._dbus_interface == interface_name):
892
1311
return value.__get__(self)
894
1313
# No such property
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1314
raise DBusPropertyNotFound("{}:{}.{}".format(
1315
self.dbus_object_path, interface_name, property_name))
1318
def _get_all_interface_names(cls):
1319
"""Get a sequence of all interfaces supported by an object"""
1320
return (name for name in set(getattr(getattr(x, attr),
1321
"_dbus_interface", None)
1322
for x in (inspect.getmro(cls))
1324
if name is not None)
1326
@dbus.service.method(dbus.PROPERTIES_IFACE,
900
1328
out_signature="v")
901
1329
def Get(self, interface_name, property_name):
902
1330
"""Standard D-Bus property Get() method, see D-Bus standard.
987
1419
if prop._dbus_interface
988
1420
== if_tag.getAttribute("name")):
989
1421
if_tag.appendChild(tag)
990
# Add annotation tags
991
for typ in ("method", "signal", "property"):
992
for tag in if_tag.getElementsByTagName(typ):
994
for name, prop in (self.
995
_get_all_dbus_things(typ)):
996
if (name == tag.getAttribute("name")
997
and prop._dbus_interface
998
== if_tag.getAttribute("name")):
999
annots.update(getattr
1001
"_dbus_annotations",
1003
for name, value in annots.items():
1004
ann_tag = document.createElement(
1006
ann_tag.setAttribute("name", name)
1007
ann_tag.setAttribute("value", value)
1008
tag.appendChild(ann_tag)
1009
# Add interface annotation tags
1010
for annotation, value in dict(
1011
itertools.chain.from_iterable(
1012
annotations().items()
1013
for name, annotations in
1014
self._get_all_dbus_things("interface")
1015
if name == if_tag.getAttribute("name")
1017
ann_tag = document.createElement("annotation")
1018
ann_tag.setAttribute("name", annotation)
1019
ann_tag.setAttribute("value", value)
1020
if_tag.appendChild(ann_tag)
1422
# Add annotation tags for properties
1423
for tag in if_tag.getElementsByTagName("property"):
1425
for name, prop in self._get_all_dbus_things(
1427
if (name == tag.getAttribute("name")
1428
and prop._dbus_interface
1429
== if_tag.getAttribute("name")):
1430
annots.update(getattr(
1431
prop, "_dbus_annotations", {}))
1432
for name, value in annots.items():
1433
ann_tag = document.createElement(
1435
ann_tag.setAttribute("name", name)
1436
ann_tag.setAttribute("value", value)
1437
tag.appendChild(ann_tag)
1021
1438
# Add the names to the return values for the
1022
1439
# "org.freedesktop.DBus.Properties" methods
1023
1440
if (if_tag.getAttribute("name")
1041
1458
exc_info=error)
1042
1459
return xmlstring
1462
dbus.OBJECT_MANAGER_IFACE
1463
except AttributeError:
1464
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1467
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1468
"""A D-Bus object with an ObjectManager.
1470
Classes inheriting from this exposes the standard
1471
GetManagedObjects call and the InterfacesAdded and
1472
InterfacesRemoved signals on the standard
1473
"org.freedesktop.DBus.ObjectManager" interface.
1475
Note: No signals are sent automatically; they must be sent
1478
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1479
out_signature="a{oa{sa{sv}}}")
1480
def GetManagedObjects(self):
1481
"""This function must be overridden"""
1482
raise NotImplementedError()
1484
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1485
signature="oa{sa{sv}}")
1486
def InterfacesAdded(self, object_path, interfaces_and_properties):
1489
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1490
def InterfacesRemoved(self, object_path, interfaces):
1493
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1495
path_keyword='object_path',
1496
connection_keyword='connection')
1497
def Introspect(self, object_path, connection):
1498
"""Overloading of standard D-Bus method.
1500
Override return argument name of GetManagedObjects to be
1501
"objpath_interfaces_and_properties"
1503
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1507
document = xml.dom.minidom.parseString(xmlstring)
1509
for if_tag in document.getElementsByTagName("interface"):
1510
# Fix argument name for the GetManagedObjects method
1511
if (if_tag.getAttribute("name")
1512
== dbus.OBJECT_MANAGER_IFACE):
1513
for cn in if_tag.getElementsByTagName("method"):
1514
if (cn.getAttribute("name")
1515
== "GetManagedObjects"):
1516
for arg in cn.getElementsByTagName("arg"):
1517
if (arg.getAttribute("direction")
1521
"objpath_interfaces"
1523
xmlstring = document.toxml("utf-8")
1525
except (AttributeError, xml.dom.DOMException,
1526
xml.parsers.expat.ExpatError) as error:
1527
logger.error("Failed to override Introspection method",
1045
1532
def datetime_to_dbus(dt, variant_level=0):
1046
1533
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1048
return dbus.String("", variant_level = variant_level)
1049
return dbus.String(dt.isoformat(),
1050
variant_level=variant_level)
1535
return dbus.String("", variant_level=variant_level)
1536
return dbus.String(dt.isoformat(), variant_level=variant_level)
1053
1539
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1083
1570
# Ignore non-D-Bus attributes, and D-Bus attributes
1084
1571
# with the wrong interface name
1085
1572
if (not hasattr(attribute, "_dbus_interface")
1086
or not attribute._dbus_interface
1087
.startswith(orig_interface_name)):
1573
or not attribute._dbus_interface.startswith(
1574
orig_interface_name)):
1089
1576
# Create an alternate D-Bus interface name based on
1090
1577
# the current name
1091
alt_interface = (attribute._dbus_interface
1092
.replace(orig_interface_name,
1093
alt_interface_name))
1578
alt_interface = attribute._dbus_interface.replace(
1579
orig_interface_name, alt_interface_name)
1094
1580
interface_names.add(alt_interface)
1095
1581
# Is this a D-Bus signal?
1096
1582
if getattr(attribute, "_dbus_is_signal", False):
1097
1583
# Extract the original non-method undecorated
1098
1584
# function by black magic
1099
nonmethod_func = (dict(
1585
if sys.version_info.major == 2:
1586
nonmethod_func = (dict(
1100
1587
zip(attribute.func_code.co_freevars,
1101
attribute.__closure__))["func"]
1588
attribute.__closure__))
1589
["func"].cell_contents)
1591
nonmethod_func = (dict(
1592
zip(attribute.__code__.co_freevars,
1593
attribute.__closure__))
1594
["func"].cell_contents)
1103
1595
# Create a new, but exactly alike, function
1104
1596
# object, and decorate it to be a new D-Bus signal
1105
1597
# with the alternate D-Bus interface name
1106
new_function = (dbus.service.signal
1108
attribute._dbus_signature)
1109
(types.FunctionType(
1110
nonmethod_func.func_code,
1111
nonmethod_func.func_globals,
1112
nonmethod_func.func_name,
1113
nonmethod_func.func_defaults,
1114
nonmethod_func.func_closure)))
1598
new_function = copy_function(nonmethod_func)
1599
new_function = (dbus.service.signal(
1601
attribute._dbus_signature)(new_function))
1115
1602
# Copy annotations, if any
1117
new_function._dbus_annotations = (
1118
dict(attribute._dbus_annotations))
1604
new_function._dbus_annotations = dict(
1605
attribute._dbus_annotations)
1119
1606
except AttributeError:
1121
1609
# Define a creator of a function to call both the
1122
1610
# original and alternate functions, so both the
1123
1611
# original and alternate signals gets sent when
1264
1751
variant_level: D-Bus variant level. Default: 1
1266
1753
attrname = "_{}".format(dbus_name)
1267
1755
def setter(self, value):
1268
1756
if hasattr(self, "dbus_object_path"):
1269
1757
if (not hasattr(self, attrname) or
1270
1758
type_func(getattr(self, attrname, None))
1271
1759
!= type_func(value)):
1272
1760
if invalidate_only:
1273
self.PropertiesChanged(_interface,
1761
self.PropertiesChanged(
1762
_interface, dbus.Dictionary(),
1763
dbus.Array((dbus_name, )))
1278
dbus_value = transform_func(type_func(value),
1765
dbus_value = transform_func(
1767
variant_level=variant_level)
1281
1768
self.PropertyChanged(dbus.String(dbus_name),
1283
self.PropertiesChanged(_interface,
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1770
self.PropertiesChanged(
1772
dbus.Dictionary({dbus.String(dbus_name):
1287
1775
setattr(self, attrname, value)
1289
1777
return property(lambda self: getattr(self, attrname), setter)
1291
1779
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1292
1780
approvals_pending = notifychangeproperty(dbus.Boolean,
1293
1781
"ApprovalPending",
1295
1783
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1296
1784
last_enabled = notifychangeproperty(datetime_to_dbus,
1298
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
type_func = lambda checker:
1300
checker is not None)
1786
checker = notifychangeproperty(
1787
dbus.Boolean, "CheckerRunning",
1788
type_func=lambda checker: checker is not None)
1301
1789
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1302
1790
"LastCheckedOK")
1303
1791
last_checker_status = notifychangeproperty(dbus.Int16,
1413
1900
server to mandos-client
1417
1904
# Rejected - signal
1418
1905
@dbus.service.signal(_interface, signature="s")
1419
1906
def Rejected(self, reason):
1423
1910
# NeedApproval - signal
1424
1911
@dbus.service.signal(_interface, signature="tb")
1425
1912
def NeedApproval(self, timeout, default):
1427
1914
return self.need_approval()
1431
1918
# Approve - method
1432
1919
@dbus.service.method(_interface, in_signature="b")
1433
1920
def Approve(self, value):
1434
1921
self.approve(value)
1436
1923
# CheckedOK - method
1437
1924
@dbus.service.method(_interface)
1438
1925
def CheckedOK(self):
1439
1926
self.checked_ok()
1441
1928
# Enable - method
1929
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1442
1930
@dbus.service.method(_interface)
1443
1931
def Enable(self):
1447
1935
# StartChecker - method
1936
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1448
1937
@dbus.service.method(_interface)
1449
1938
def StartChecker(self):
1451
1940
self.start_checker()
1453
1942
# Disable - method
1943
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1454
1944
@dbus.service.method(_interface)
1455
1945
def Disable(self):
1459
1949
# StopChecker - method
1950
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1460
1951
@dbus.service.method(_interface)
1461
1952
def StopChecker(self):
1462
1953
self.stop_checker()
1466
1957
# ApprovalPending - property
1467
1958
@dbus_service_property(_interface, signature="b", access="read")
1468
1959
def ApprovalPending_dbus_property(self):
1469
1960
return dbus.Boolean(bool(self.approvals_pending))
1471
1962
# ApprovedByDefault - property
1472
@dbus_service_property(_interface, signature="b",
1963
@dbus_service_property(_interface,
1473
1965
access="readwrite")
1474
1966
def ApprovedByDefault_dbus_property(self, value=None):
1475
1967
if value is None: # get
1476
1968
return dbus.Boolean(self.approved_by_default)
1477
1969
self.approved_by_default = bool(value)
1479
1971
# ApprovalDelay - property
1480
@dbus_service_property(_interface, signature="t",
1972
@dbus_service_property(_interface,
1481
1974
access="readwrite")
1482
1975
def ApprovalDelay_dbus_property(self, value=None):
1483
1976
if value is None: # get
1484
1977
return dbus.UInt64(self.approval_delay.total_seconds()
1486
1979
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1488
1981
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1982
@dbus_service_property(_interface,
1490
1984
access="readwrite")
1491
1985
def ApprovalDuration_dbus_property(self, value=None):
1492
1986
if value is None: # get
1493
1987
return dbus.UInt64(self.approval_duration.total_seconds()
1495
1989
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1497
1991
# Name - property
1993
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
1994
@dbus_service_property(_interface, signature="s", access="read")
1499
1995
def Name_dbus_property(self):
1500
1996
return dbus.String(self.name)
1502
1998
# Fingerprint - property
2000
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1503
2001
@dbus_service_property(_interface, signature="s", access="read")
1504
2002
def Fingerprint_dbus_property(self):
1505
2003
return dbus.String(self.fingerprint)
1507
2005
# Host - property
1508
@dbus_service_property(_interface, signature="s",
2006
@dbus_service_property(_interface,
1509
2008
access="readwrite")
1510
2009
def Host_dbus_property(self, value=None):
1511
2010
if value is None: # get
1512
2011
return dbus.String(self.host)
1513
2012
self.host = str(value)
1515
2014
# Created - property
2016
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1516
2017
@dbus_service_property(_interface, signature="s", access="read")
1517
2018
def Created_dbus_property(self):
1518
2019
return datetime_to_dbus(self.created)
1520
2021
# LastEnabled - property
1521
2022
@dbus_service_property(_interface, signature="s", access="read")
1522
2023
def LastEnabled_dbus_property(self):
1523
2024
return datetime_to_dbus(self.last_enabled)
1525
2026
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
2027
@dbus_service_property(_interface,
1527
2029
access="readwrite")
1528
2030
def Enabled_dbus_property(self, value=None):
1529
2031
if value is None: # get
1670
2186
class ClientHandler(socketserver.BaseRequestHandler, object):
1671
2187
"""A class to handle client connections.
1673
2189
Instantiated once for each connection to handle it.
1674
2190
Note: This will run in its own forked process."""
1676
2192
def handle(self):
1677
2193
with contextlib.closing(self.server.child_pipe) as child_pipe:
1678
2194
logger.info("TCP connection from: %s",
1679
2195
str(self.client_address))
1680
2196
logger.debug("Pipe FD: %d",
1681
2197
self.server.child_pipe.fileno())
1683
session = (gnutls.connection
1684
.ClientSession(self.request,
1686
.X509Credentials()))
1688
# Note: gnutls.connection.X509Credentials is really a
1689
# generic GnuTLS certificate credentials object so long as
1690
# no X.509 keys are added to it. Therefore, we can use it
1691
# here despite using OpenPGP certificates.
1693
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1694
# "+AES-256-CBC", "+SHA1",
1695
# "+COMP-NULL", "+CTYPE-OPENPGP",
2199
session = gnutls.ClientSession(self.request)
2201
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2202
# "+AES-256-CBC", "+SHA1",
2203
# "+COMP-NULL", "+CTYPE-OPENPGP",
1697
2205
# Use a fallback default, since this MUST be set.
1698
2206
priority = self.server.gnutls_priority
1699
2207
if priority is None:
1700
2208
priority = "NORMAL"
1701
(gnutls.library.functions
1702
.gnutls_priority_set_direct(session._c_object,
2209
gnutls.priority_set_direct(session._c_object,
2210
priority.encode("utf-8"),
1705
2213
# Start communication using the Mandos protocol
1706
2214
# Get protocol number
1707
2215
line = self.request.makefile().readline()
1794
2301
delay -= time2 - time
1797
while sent_size < len(client.secret):
1799
sent = session.send(client.secret[sent_size:])
1800
except gnutls.errors.GNUTLSError as error:
1801
logger.warning("gnutls send failed",
1804
logger.debug("Sent: %d, remaining: %d",
1805
sent, len(client.secret)
1806
- (sent_size + sent))
2304
session.send(client.secret)
2305
except gnutls.Error as error:
2306
logger.warning("gnutls send failed",
1809
2310
logger.info("Sending secret to %s", client.name)
1810
2311
# bump the timeout using extended_timeout
1811
2312
client.bump_timeout(client.extended_timeout)
1812
2313
if self.server.use_dbus:
1813
2314
# Emit D-Bus signal
1814
2315
client.GotSecret()
1817
2318
if approval_required:
1818
2319
client.approvals_pending -= 1
1821
except gnutls.errors.GNUTLSError as error:
2322
except gnutls.Error as error:
1822
2323
logger.warning("GnuTLS bye failed",
1823
2324
exc_info=error)
1826
2327
def peer_certificate(session):
1827
2328
"Return the peer's OpenPGP certificate as a bytestring"
1828
2329
# If not an OpenPGP certificate...
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
1831
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
# ...do the normal thing
1833
return session.peer_certificate
2330
if (gnutls.certificate_type_get(session._c_object)
2331
!= gnutls.CRT_OPENPGP):
2332
# ...return invalid data
1834
2334
list_size = ctypes.c_uint(1)
1835
cert_list = (gnutls.library.functions
1836
.gnutls_certificate_get_peers
2335
cert_list = (gnutls.certificate_get_peers
1837
2336
(session._c_object, ctypes.byref(list_size)))
1838
2337
if not bool(cert_list) and list_size.value != 0:
1839
raise gnutls.errors.GNUTLSError("error getting peer"
2338
raise gnutls.Error("error getting peer certificate")
1841
2339
if list_size.value == 0:
1843
2341
cert = cert_list[0]
1844
2342
return ctypes.string_at(cert.data, cert.size)
1847
2345
def fingerprint(openpgp):
1848
2346
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
2347
# New GnuTLS "datum" with the OpenPGP public key
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1854
ctypes.c_uint(len(openpgp))))
2348
datum = gnutls.datum_t(
2349
ctypes.cast(ctypes.c_char_p(openpgp),
2350
ctypes.POINTER(ctypes.c_ubyte)),
2351
ctypes.c_uint(len(openpgp)))
1855
2352
# New empty GnuTLS certificate
1856
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2353
crt = gnutls.openpgp_crt_t()
2354
gnutls.openpgp_crt_init(ctypes.byref(crt))
1859
2355
# Import the OpenPGP public key into the certificate
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
2356
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2357
gnutls.OPENPGP_FMT_RAW)
1864
2358
# Verify the self signature in the key
1865
2359
crtverify = ctypes.c_uint()
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
2360
gnutls.openpgp_crt_verify_self(crt, 0,
2361
ctypes.byref(crtverify))
1869
2362
if crtverify.value != 0:
1870
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
2363
gnutls.openpgp_crt_deinit(crt)
2364
raise gnutls.CertificateSecurityError("Verify failed")
1873
2365
# New buffer for the fingerprint
1874
2366
buf = ctypes.create_string_buffer(20)
1875
2367
buf_len = ctypes.c_size_t()
1876
2368
# Get the fingerprint from the certificate into the buffer
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
2369
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2370
ctypes.byref(buf_len))
1880
2371
# Deinit the certificate
1881
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2372
gnutls.openpgp_crt_deinit(crt)
1882
2373
# Convert the buffer to a Python bytestring
1883
2374
fpr = ctypes.string_at(buf, buf_len.value)
1884
2375
# Convert the bytestring to hexadecimal notation
1967
2464
# socket_wrapper(), if socketfd was set.
1968
2465
socketserver.TCPServer.__init__(self, server_address,
1969
2466
RequestHandlerClass)
1971
2468
def server_bind(self):
1972
2469
"""This overrides the normal server_bind() function
1973
2470
to bind to an interface if one was specified, and also NOT to
1974
2471
bind to an address or port if they were not specified."""
2472
global SO_BINDTODEVICE
1975
2473
if self.interface is not None:
1976
2474
if SO_BINDTODEVICE is None:
1977
logger.error("SO_BINDTODEVICE does not exist;"
1978
" cannot bind to interface %s",
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1984
(self.interface + "\0")
1986
except socket.error as error:
1987
if error.errno == errno.EPERM:
1988
logger.error("No permission to bind to"
1989
" interface %s", self.interface)
1990
elif error.errno == errno.ENOPROTOOPT:
1991
logger.error("SO_BINDTODEVICE not available;"
1992
" cannot bind to interface %s",
1994
elif error.errno == errno.ENODEV:
1995
logger.error("Interface %s does not exist,"
1996
" cannot bind", self.interface)
2475
# Fall back to a hard-coded value which seems to be
2477
logger.warning("SO_BINDTODEVICE not found, trying 25")
2478
SO_BINDTODEVICE = 25
2480
self.socket.setsockopt(
2481
socket.SOL_SOCKET, SO_BINDTODEVICE,
2482
(self.interface + "\0").encode("utf-8"))
2483
except socket.error as error:
2484
if error.errno == errno.EPERM:
2485
logger.error("No permission to bind to"
2486
" interface %s", self.interface)
2487
elif error.errno == errno.ENOPROTOOPT:
2488
logger.error("SO_BINDTODEVICE not available;"
2489
" cannot bind to interface %s",
2491
elif error.errno == errno.ENODEV:
2492
logger.error("Interface %s does not exist,"
2493
" cannot bind", self.interface)
1999
2496
# Only bind(2) the socket if we really need to.
2000
2497
if self.server_address[0] or self.server_address[1]:
2001
2498
if not self.server_address[0]:
2002
2499
if self.address_family == socket.AF_INET6:
2003
any_address = "::" # in6addr_any
2500
any_address = "::" # in6addr_any
2005
any_address = "0.0.0.0" # INADDR_ANY
2502
any_address = "0.0.0.0" # INADDR_ANY
2006
2503
self.server_address = (any_address,
2007
2504
self.server_address[1])
2008
2505
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2506
self.server_address = (self.server_address[0], 0)
2011
2507
# if self.interface:
2012
2508
# self.server_address = (self.server_address[0],
2142
2646
>>> rfc3339_duration_to_delta("P1DT3M20S")
2143
2647
datetime.timedelta(1, 200)
2146
2650
# Parsing an RFC 3339 duration with regular expressions is not
2147
2651
# possible - there would have to be multiple places for the same
2148
2652
# values, like seconds. The current code, while more esoteric, is
2149
2653
# cleaner without depending on a parsing library. If Python had a
2150
2654
# built-in library for parsing we would use it, but we'd like to
2151
2655
# avoid excessive use of external libraries.
2153
2657
# New type for defining tokens, syntax, and semantics all-in-one
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2159
"value", # datetime.timedelta or
2161
"followers")) # Tokens valid after
2658
Token = collections.namedtuple("Token", (
2659
"regexp", # To match token; if "value" is not None, must have
2660
# a "group" containing digits
2661
"value", # datetime.timedelta or None
2662
"followers")) # Tokens valid after this token
2163
2663
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2664
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2665
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2666
token_second = Token(re.compile(r"(\d+)S"),
2167
2667
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2668
frozenset((token_end, )))
2169
2669
token_minute = Token(re.compile(r"(\d+)M"),
2170
2670
datetime.timedelta(minutes=1),
2171
2671
frozenset((token_second, token_end)))
2444
2947
level = getattr(logging, debuglevel.upper())
2445
2948
initlogger(debug, level)
2447
2950
if server_settings["servicename"] != "Mandos":
2448
syslogger.setFormatter(logging.Formatter
2449
('Mandos ({}) [%(process)d]:'
2450
' %(levelname)s: %(message)s'
2451
.format(server_settings
2951
syslogger.setFormatter(
2952
logging.Formatter('Mandos ({}) [%(process)d]:'
2953
' %(levelname)s: %(message)s'.format(
2954
server_settings["servicename"])))
2454
2956
# Parse config file with clients
2455
2957
client_config = configparser.SafeConfigParser(Client
2456
2958
.client_defaults)
2457
2959
client_config.read(os.path.join(server_settings["configdir"],
2458
2960
"clients.conf"))
2460
2962
global mandos_dbus_service
2461
2963
mandos_dbus_service = None
2463
2965
socketfd = None
2464
2966
if server_settings["socket"] != "":
2465
2967
socketfd = server_settings["socket"]
2466
tcp_server = MandosServer((server_settings["address"],
2467
server_settings["port"]),
2469
interface=(server_settings["interface"]
2473
server_settings["priority"],
2968
tcp_server = MandosServer(
2969
(server_settings["address"], server_settings["port"]),
2971
interface=(server_settings["interface"] or None),
2973
gnutls_priority=server_settings["priority"],
2476
2976
if not foreground:
2477
2977
pidfilename = "/run/mandos.pid"
2478
2978
if not os.path.isdir("/run/."):
2479
2979
pidfilename = "/var/run/mandos.pid"
2482
pidfile = open(pidfilename, "w")
2982
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2483
2983
except IOError as e:
2484
2984
logger.error("Could not open file %r", pidfilename,
2487
for name in ("_mandos", "mandos", "nobody"):
2987
for name, group in (("_mandos", "_mandos"),
2988
("mandos", "mandos"),
2989
("nobody", "nogroup")):
2489
2991
uid = pwd.getpwnam(name).pw_uid
2490
gid = pwd.getpwnam(name).pw_gid
2992
gid = pwd.getpwnam(group).pw_gid
2492
2994
except KeyError:
3003
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2500
3005
except OSError as error:
3006
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3007
.format(uid, gid, os.strerror(error.errno)))
2501
3008
if error.errno != errno.EPERM:
2505
3012
# Enable all possible GnuTLS debugging
2507
3014
# "Use a log level over 10 to enable all debugging options."
2508
3015
# - GnuTLS manual
2509
gnutls.library.functions.gnutls_global_set_log_level(11)
2511
@gnutls.library.types.gnutls_log_func
3016
gnutls.global_set_log_level(11)
2512
3019
def debug_gnutls(level, string):
2513
3020
logger.debug("GnuTLS: %s", string[:-1])
2515
(gnutls.library.functions
2516
.gnutls_global_set_log_function(debug_gnutls))
3022
gnutls.global_set_log_function(debug_gnutls)
2518
3024
# Redirect stdin so all checkers get /dev/null
2519
3025
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2520
3026
os.dup2(null, sys.stdin.fileno())
2524
3030
# Need to fork before connecting to D-Bus
2525
3031
if not foreground:
2526
3032
# Close all input and output, do double fork, etc.
2529
# multiprocessing will use threads, so before we use gobject we
2530
# need to inform gobject that threads will be used.
2531
gobject.threads_init()
3035
# multiprocessing will use threads, so before we use GLib we need
3036
# to inform GLib that threads will be used.
2533
3039
global main_loop
2534
3040
# From the Avahi example code
2535
3041
DBusGMainLoop(set_as_default=True)
2536
main_loop = gobject.MainLoop()
3042
main_loop = GLib.MainLoop()
2537
3043
bus = dbus.SystemBus()
2538
3044
# End of Avahi example code
2541
3047
bus_name = dbus.service.BusName("se.recompile.Mandos",
2542
bus, do_not_queue=True)
2543
old_bus_name = (dbus.service.BusName
2544
("se.bsnet.fukt.Mandos", bus,
2546
except dbus.exceptions.NameExistsException as e:
3050
old_bus_name = dbus.service.BusName(
3051
"se.bsnet.fukt.Mandos", bus,
3053
except dbus.exceptions.DBusException as e:
2547
3054
logger.error("Disabling D-Bus:", exc_info=e)
2548
3055
use_dbus = False
2549
3056
server_settings["use_dbus"] = False
2550
3057
tcp_server.use_dbus = False
2552
3059
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2553
service = AvahiServiceToSyslog(name =
2554
server_settings["servicename"],
2555
servicetype = "_mandos._tcp",
2556
protocol = protocol, bus = bus)
3060
service = AvahiServiceToSyslog(
3061
name=server_settings["servicename"],
3062
servicetype="_mandos._tcp",
2557
3065
if server_settings["interface"]:
2558
service.interface = (if_nametoindex
2559
(server_settings["interface"]
3066
service.interface = if_nametoindex(
3067
server_settings["interface"].encode("utf-8"))
2562
3069
global multiprocessing_manager
2563
3070
multiprocessing_manager = multiprocessing.Manager()
2565
3072
client_class = Client
2567
client_class = functools.partial(ClientDBus, bus = bus)
3074
client_class = functools.partial(ClientDBus, bus=bus)
2569
3076
client_settings = Client.config_parser(client_config)
2570
3077
old_client_settings = {}
2571
3078
clients_data = {}
2573
3080
# This is used to redirect stdout and stderr for checker processes
2575
wnull = open(os.devnull, "w") # A writable /dev/null
3082
wnull = open(os.devnull, "w") # A writable /dev/null
2576
3083
# Only used if server is running in foreground but not in debug
2578
3085
if debug or not foreground:
2581
3088
# Get client data and settings from last running state.
2582
3089
if server_settings["restore"]:
2584
3091
with open(stored_state_path, "rb") as stored_state:
2585
clients_data, old_client_settings = (pickle.load
3092
if sys.version_info.major == 2:
3093
clients_data, old_client_settings = pickle.load(
3096
bytes_clients_data, bytes_old_client_settings = (
3097
pickle.load(stored_state, encoding="bytes"))
3098
# Fix bytes to strings
3101
clients_data = {(key.decode("utf-8")
3102
if isinstance(key, bytes)
3105
bytes_clients_data.items()}
3106
del bytes_clients_data
3107
for key in clients_data:
3108
value = {(k.decode("utf-8")
3109
if isinstance(k, bytes) else k): v
3111
clients_data[key].items()}
3112
clients_data[key] = value
3114
value["client_structure"] = [
3116
if isinstance(s, bytes)
3118
value["client_structure"]]
3120
for k in ("name", "host"):
3121
if isinstance(value[k], bytes):
3122
value[k] = value[k].decode("utf-8")
3123
# old_client_settings
3125
old_client_settings = {
3126
(key.decode("utf-8")
3127
if isinstance(key, bytes)
3130
bytes_old_client_settings.items()}
3131
del bytes_old_client_settings
3133
for value in old_client_settings.values():
3134
if isinstance(value["host"], bytes):
3135
value["host"] = (value["host"]
2587
3137
os.remove(stored_state_path)
2588
3138
except IOError as e:
2589
3139
if e.errno == errno.ENOENT:
2590
logger.warning("Could not load persistent state: {}"
2591
.format(os.strerror(e.errno)))
3140
logger.warning("Could not load persistent state:"
3141
" {}".format(os.strerror(e.errno)))
2593
3143
logger.critical("Could not load persistent state:",
2596
3146
except EOFError as e:
2597
3147
logger.warning("Could not load persistent state: "
2598
"EOFError:", exc_info=e)
2600
3151
with PGPEngine() as pgp:
2601
3152
for client_name, client in clients_data.items():
2602
3153
# Skip removed clients
2603
3154
if client_name not in client_settings:
2606
3157
# Decide which value to use after restoring saved state.
2607
3158
# We have three different values: Old config file,
2608
3159
# new config file, and saved state.
2666
3217
for client_name in (set(client_settings)
2667
3218
- set(old_client_settings)):
2668
3219
clients_data[client_name] = client_settings[client_name]
2670
3221
# Create all client objects
2671
3222
for client_name, client in clients_data.items():
2672
3223
tcp_server.clients[client_name] = client_class(
2673
name = client_name, settings = client,
2674
server_settings = server_settings)
3226
server_settings=server_settings)
2676
3228
if not tcp_server.clients:
2677
3229
logger.warning("No clients defined")
2679
3231
if not foreground:
2680
3232
if pidfile is not None:
2684
pidfile.write("{}\n".format(pid).encode("utf-8"))
3236
print(pid, file=pidfile)
2685
3237
except IOError:
2686
3238
logger.error("Could not write to file %r with PID %d",
2687
3239
pidfilename, pid)
2689
3241
del pidfilename
2691
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2692
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3243
for termsig in (signal.SIGHUP, signal.SIGTERM):
3244
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3245
lambda: main_loop.quit() and False)
2695
@alternate_dbus_interfaces({"se.recompile.Mandos":
2696
"se.bsnet.fukt.Mandos"})
2697
class MandosDBusService(DBusObjectWithProperties):
3249
@alternate_dbus_interfaces(
3250
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3251
class MandosDBusService(DBusObjectWithObjectManager):
2698
3252
"""A D-Bus proxy object"""
2699
3254
def __init__(self):
2700
3255
dbus.service.Object.__init__(self, bus, "/")
2701
3257
_interface = "se.recompile.Mandos"
2703
@dbus_interface_annotations(_interface)
2705
return { "org.freedesktop.DBus.Property"
2706
".EmitsChangedSignal":
2709
3259
@dbus.service.signal(_interface, signature="o")
2710
3260
def ClientAdded(self, objpath):
2714
3264
@dbus.service.signal(_interface, signature="ss")
2715
3265
def ClientNotFound(self, fingerprint, address):
3269
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2719
3271
@dbus.service.signal(_interface, signature="os")
2720
3272
def ClientRemoved(self, objpath, name):
3276
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2724
3278
@dbus.service.method(_interface, out_signature="ao")
2725
3279
def GetAllClients(self):
2727
return dbus.Array(c.dbus_object_path
2729
tcp_server.clients.itervalues())
3281
return dbus.Array(c.dbus_object_path for c in
3282
tcp_server.clients.values())
3284
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2731
3286
@dbus.service.method(_interface,
2732
3287
out_signature="a{oa{sv}}")
2733
3288
def GetAllClientsWithProperties(self):
2735
3290
return dbus.Dictionary(
2736
{ c.dbus_object_path: c.GetAll("")
2737
for c in tcp_server.clients.itervalues() },
3291
{c.dbus_object_path: c.GetAll(
3292
"se.recompile.Mandos.Client")
3293
for c in tcp_server.clients.values()},
2738
3294
signature="oa{sv}")
2740
3296
@dbus.service.method(_interface, in_signature="o")
2741
3297
def RemoveClient(self, object_path):
2743
for c in tcp_server.clients.itervalues():
3299
for c in tcp_server.clients.values():
2744
3300
if c.dbus_object_path == object_path:
2745
3301
del tcp_server.clients[c.name]
2746
3302
c.remove_from_connection()
2747
# Don't signal anything except ClientRemoved
3303
# Don't signal the disabling
2748
3304
c.disable(quiet=True)
2750
self.ClientRemoved(object_path, c.name)
3305
# Emit D-Bus signal for removal
3306
self.client_removed_signal(c)
2752
3308
raise KeyError(object_path)
3312
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3313
out_signature="a{oa{sa{sv}}}")
3314
def GetManagedObjects(self):
3316
return dbus.Dictionary(
3317
{client.dbus_object_path:
3319
{interface: client.GetAll(interface)
3321
client._get_all_interface_names()})
3322
for client in tcp_server.clients.values()})
3324
def client_added_signal(self, client):
3325
"""Send the new standard signal and the old signal"""
3327
# New standard signal
3328
self.InterfacesAdded(
3329
client.dbus_object_path,
3331
{interface: client.GetAll(interface)
3333
client._get_all_interface_names()}))
3335
self.ClientAdded(client.dbus_object_path)
3337
def client_removed_signal(self, client):
3338
"""Send the new standard signal and the old signal"""
3340
# New standard signal
3341
self.InterfacesRemoved(
3342
client.dbus_object_path,
3343
client._get_all_interface_names())
3345
self.ClientRemoved(client.dbus_object_path,
2756
3348
mandos_dbus_service = MandosDBusService()
3350
# Save modules to variables to exempt the modules from being
3351
# unloaded before the function registered with atexit() is run.
3352
mp = multiprocessing
2759
3356
"Cleanup function; run on exit"
2761
3358
service.cleanup()
2763
multiprocessing.active_children()
3360
mp.active_children()
2765
3362
if not (tcp_server.clients or client_settings):
2768
3365
# Store client before exiting. Secrets are encrypted with key
2769
3366
# based on what config file has. If config file is
2770
3367
# removed/edited, old secret will thus be unrecovable.
2772
3369
with PGPEngine() as pgp:
2773
for client in tcp_server.clients.itervalues():
3370
for client in tcp_server.clients.values():
2774
3371
key = client_settings[client.name]["secret"]
2775
3372
client.encrypted_secret = pgp.encrypt(client.secret,
2777
3374
client_dict = {}
2779
3376
# A list of attributes that can not be pickled
2781
exclude = { "bus", "changedstate", "secret",
2782
"checker", "server_settings" }
2783
for name, typ in (inspect.getmembers
2784
(dbus.service.Object)):
3378
exclude = {"bus", "changedstate", "secret",
3379
"checker", "server_settings"}
3380
for name, typ in inspect.getmembers(dbus.service
2785
3382
exclude.add(name)
2787
3384
client_dict["encrypted_secret"] = (client
2788
3385
.encrypted_secret)
2789
3386
for attr in client.client_structure:
2790
3387
if attr not in exclude:
2791
3388
client_dict[attr] = getattr(client, attr)
2793
3390
clients[client.name] = client_dict
2794
3391
del client_settings[client.name]["secret"]
2797
with (tempfile.NamedTemporaryFile
2798
(mode='wb', suffix=".pickle", prefix='clients-',
2799
dir=os.path.dirname(stored_state_path),
2800
delete=False)) as stored_state:
2801
pickle.dump((clients, client_settings), stored_state)
2802
tempname=stored_state.name
3394
with tempfile.NamedTemporaryFile(
3398
dir=os.path.dirname(stored_state_path),
3399
delete=False) as stored_state:
3400
pickle.dump((clients, client_settings), stored_state,
3402
tempname = stored_state.name
2803
3403
os.rename(tempname, stored_state_path)
2804
3404
except (IOError, OSError) as e: