2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2013 Teddy Hogeborn
15
# Copyright © 2008-2013 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
37
from future_builtins import *
39
from future_builtins import *
39
import SocketServer as socketserver
44
import SocketServer as socketserver
45
import gnutls.connection
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
52
import ConfigParser as configparser
65
import cPickle as pickle
70
import cPickle as pickle
66
73
import multiprocessing
74
82
import dbus.service
83
from gi.repository import GLib
77
84
from dbus.mainloop.glib import DBusGMainLoop
80
87
import xml.dom.minidom
90
# Try to find the value of SO_BINDTODEVICE:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
84
94
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
95
except AttributeError:
97
# This is where SO_BINDTODEVICE was up to and including Python
87
99
from IN import SO_BINDTODEVICE
88
100
except ImportError:
89
SO_BINDTODEVICE = None
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
113
SO_BINDTODEVICE = None
115
if sys.version_info.major == 2:
92
119
stored_state_file = "clients.pickle"
94
121
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
103
127
except (OSError, AttributeError):
104
129
def if_nametoindex(interface):
105
130
"Get an interface index the hard way, i.e. using fcntl()"
106
131
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
132
with contextlib.closing(socket.socket()) as s:
108
133
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
136
return interface_index
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
148
return types.FunctionType(func.__code__,
116
155
def initlogger(debug, level=logging.WARNING):
117
156
"""init logger and add loglevel"""
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
119
162
syslogger.setFormatter(logging.Formatter
120
163
('Mandos [%(process)d]: %(levelname)s:'
122
165
logger.addHandler(syslogger)
125
168
console = logging.StreamHandler()
126
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
179
236
.replace(b"\n", b"\\n")
180
237
.replace(b"\0", b"\\x00"))
183
240
def encrypt(self, data, password):
184
241
passphrase = self.password_encode(password)
185
with tempfile.NamedTemporaryFile(dir=self.tempdir
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
187
244
passfile.write(passphrase)
189
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
190
247
'--passphrase-file',
192
249
+ self.gnupgargs,
193
stdin = subprocess.PIPE,
194
stdout = subprocess.PIPE,
195
stderr = subprocess.PIPE)
196
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
197
254
if proc.returncode != 0:
198
255
raise PGPError(err)
199
256
return ciphertext
201
258
def decrypt(self, data, password):
202
259
passphrase = self.password_encode(password)
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
205
262
passfile.write(passphrase)
207
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
208
265
'--passphrase-file',
210
267
+ self.gnupgargs,
211
stdin = subprocess.PIPE,
212
stdout = subprocess.PIPE,
213
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
216
272
if proc.returncode != 0:
217
273
raise PGPError(err)
218
274
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
221
304
class AvahiError(Exception):
222
305
def __init__(self, value, *args, **kwargs):
223
306
self.value = value
224
super(AvahiError, self).__init__(value, *args, **kwargs)
225
def __unicode__(self):
226
return unicode(repr(self.value))
307
return super(AvahiError, self).__init__(value, *args,
228
311
class AvahiServiceError(AvahiError):
231
315
class AvahiGroupError(AvahiError):
235
319
class AvahiService(object):
236
320
"""An Avahi (Zeroconf) service.
239
323
interface: integer; avahi.IF_UNSPEC or an interface index.
240
324
Used to optionally bind to the specified interface.
383
489
follow_name_owner_changes=True),
384
490
avahi.DBUS_INTERFACE_SERVER)
385
491
self.server.connect_to_signal("StateChanged",
386
self.server_state_changed)
492
self.server_state_changed)
387
493
self.server_state_changed(self.server.GetState())
390
496
class AvahiServiceToSyslog(AvahiService):
497
def rename(self, *args, **kwargs):
392
498
"""Add the new name to the syslog messages"""
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({0}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
500
syslogger.setFormatter(logging.Formatter(
501
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
401
def timedelta_to_milliseconds(td):
402
"Convert a datetime.timedelta() to milliseconds"
403
return ((td.days * 24 * 60 * 60 * 1000)
404
+ (td.seconds * 1000)
405
+ (td.microseconds // 1000))
506
# Pretend that we have a GnuTLS module
507
class GnuTLS(object):
508
"""This isn't so much a class as it is a module-like namespace.
509
It is instantiated once, and simulates having a GnuTLS module."""
511
library = ctypes.util.find_library("gnutls")
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
516
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
538
E_NO_CERTIFICATE_FOUND = -49
543
KEYID_USE_SHA256 = 1 # gnutls/x509.h
544
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
547
class session_int(ctypes.Structure):
549
session_t = ctypes.POINTER(session_int)
551
class certificate_credentials_st(ctypes.Structure):
553
certificate_credentials_t = ctypes.POINTER(
554
certificate_credentials_st)
555
certificate_type_t = ctypes.c_int
557
class datum_t(ctypes.Structure):
558
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
('size', ctypes.c_uint)]
561
class openpgp_crt_int(ctypes.Structure):
563
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
565
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
566
credentials_type_t = ctypes.c_int
567
transport_ptr_t = ctypes.c_void_p
568
close_request_t = ctypes.c_int
571
class Error(Exception):
572
# We need to use the class name "GnuTLS" here, since this
573
# exception might be raised from within GnuTLS.__init__,
574
# which is called before the assignment to the "gnutls"
575
# global variable has happened.
576
def __init__(self, message=None, code=None, args=()):
577
# Default usage is by a message string, but if a return
578
# code is passed, convert it to a string with
581
if message is None and code is not None:
582
message = GnuTLS.strerror(code)
583
return super(GnuTLS.Error, self).__init__(
586
class CertificateSecurityError(Error):
590
class Credentials(object):
592
self._c_object = gnutls.certificate_credentials_t()
593
gnutls.certificate_allocate_credentials(
594
ctypes.byref(self._c_object))
595
self.type = gnutls.CRD_CERTIFICATE
598
gnutls.certificate_free_credentials(self._c_object)
600
class ClientSession(object):
601
def __init__(self, socket, credentials=None):
602
self._c_object = gnutls.session_t()
603
gnutls_flags = gnutls.CLIENT
604
if gnutls.check_version("3.5.6"):
605
gnutls_flags |= gnutls.NO_TICKETS
607
gnutls_flags |= gnutls.ENABLE_RAWPK
608
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
610
gnutls.set_default_priority(self._c_object)
611
gnutls.transport_set_ptr(self._c_object, socket.fileno())
612
gnutls.handshake_set_private_extensions(self._c_object,
615
if credentials is None:
616
credentials = gnutls.Credentials()
617
gnutls.credentials_set(self._c_object, credentials.type,
618
ctypes.cast(credentials._c_object,
620
self.credentials = credentials
623
gnutls.deinit(self._c_object)
626
return gnutls.handshake(self._c_object)
628
def send(self, data):
632
data_len -= gnutls.record_send(self._c_object,
637
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
639
# Error handling functions
640
def _error_code(result):
641
"""A function to raise exceptions on errors, suitable
642
for the 'restype' attribute on ctypes functions"""
645
if result == gnutls.E_NO_CERTIFICATE_FOUND:
646
raise gnutls.CertificateSecurityError(code=result)
647
raise gnutls.Error(code=result)
649
def _retry_on_error(result, func, arguments):
650
"""A function to retry on some errors, suitable
651
for the 'errcheck' attribute on ctypes functions"""
653
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
654
return _error_code(result)
655
result = func(*arguments)
658
# Unless otherwise indicated, the function declarations below are
659
# all from the gnutls/gnutls.h C header file.
662
priority_set_direct = _library.gnutls_priority_set_direct
663
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
664
ctypes.POINTER(ctypes.c_char_p)]
665
priority_set_direct.restype = _error_code
667
init = _library.gnutls_init
668
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
669
init.restype = _error_code
671
set_default_priority = _library.gnutls_set_default_priority
672
set_default_priority.argtypes = [session_t]
673
set_default_priority.restype = _error_code
675
record_send = _library.gnutls_record_send
676
record_send.argtypes = [session_t, ctypes.c_void_p,
678
record_send.restype = ctypes.c_ssize_t
679
record_send.errcheck = _retry_on_error
681
certificate_allocate_credentials = (
682
_library.gnutls_certificate_allocate_credentials)
683
certificate_allocate_credentials.argtypes = [
684
ctypes.POINTER(certificate_credentials_t)]
685
certificate_allocate_credentials.restype = _error_code
687
certificate_free_credentials = (
688
_library.gnutls_certificate_free_credentials)
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
691
certificate_free_credentials.restype = None
693
handshake_set_private_extensions = (
694
_library.gnutls_handshake_set_private_extensions)
695
handshake_set_private_extensions.argtypes = [session_t,
697
handshake_set_private_extensions.restype = None
699
credentials_set = _library.gnutls_credentials_set
700
credentials_set.argtypes = [session_t, credentials_type_t,
702
credentials_set.restype = _error_code
704
strerror = _library.gnutls_strerror
705
strerror.argtypes = [ctypes.c_int]
706
strerror.restype = ctypes.c_char_p
708
certificate_type_get = _library.gnutls_certificate_type_get
709
certificate_type_get.argtypes = [session_t]
710
certificate_type_get.restype = _error_code
712
certificate_get_peers = _library.gnutls_certificate_get_peers
713
certificate_get_peers.argtypes = [session_t,
714
ctypes.POINTER(ctypes.c_uint)]
715
certificate_get_peers.restype = ctypes.POINTER(datum_t)
717
global_set_log_level = _library.gnutls_global_set_log_level
718
global_set_log_level.argtypes = [ctypes.c_int]
719
global_set_log_level.restype = None
721
global_set_log_function = _library.gnutls_global_set_log_function
722
global_set_log_function.argtypes = [log_func]
723
global_set_log_function.restype = None
725
deinit = _library.gnutls_deinit
726
deinit.argtypes = [session_t]
727
deinit.restype = None
729
handshake = _library.gnutls_handshake
730
handshake.argtypes = [session_t]
731
handshake.restype = _error_code
732
handshake.errcheck = _retry_on_error
734
transport_set_ptr = _library.gnutls_transport_set_ptr
735
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
736
transport_set_ptr.restype = None
738
bye = _library.gnutls_bye
739
bye.argtypes = [session_t, close_request_t]
740
bye.restype = _error_code
741
bye.errcheck = _retry_on_error
743
check_version = _library.gnutls_check_version
744
check_version.argtypes = [ctypes.c_char_p]
745
check_version.restype = ctypes.c_char_p
747
has_rawpk = bool(check_version(_tls_rawpk_version))
751
class pubkey_st(ctypes.Structure):
753
pubkey_t = ctypes.POINTER(pubkey_st)
755
x509_crt_fmt_t = ctypes.c_int
757
# All the function declarations below are from gnutls/abstract.h
758
pubkey_init = _library.gnutls_pubkey_init
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
pubkey_init.restype = _error_code
762
pubkey_import = _library.gnutls_pubkey_import
763
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
765
pubkey_import.restype = _error_code
767
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
ctypes.POINTER(ctypes.c_ubyte),
770
ctypes.POINTER(ctypes.c_size_t)]
771
pubkey_get_key_id.restype = _error_code
773
pubkey_deinit = _library.gnutls_pubkey_deinit
774
pubkey_deinit.argtypes = [pubkey_t]
775
pubkey_deinit.restype = None
777
# All the function declarations below are from gnutls/openpgp.h
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
openpgp_crt_init.restype = _error_code
783
openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
openpgp_crt_import.argtypes = [openpgp_crt_t,
785
ctypes.POINTER(datum_t),
787
openpgp_crt_import.restype = _error_code
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
792
openpgp_crt_verify_self.restype = _error_code
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
openpgp_crt_deinit.restype = None
798
openpgp_crt_get_fingerprint = (
799
_library.gnutls_openpgp_crt_get_fingerprint)
800
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
804
openpgp_crt_get_fingerprint.restype = _error_code
806
if check_version("3.6.4"):
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
certificate_type_get2.restype = _error_code
811
# Remove non-public functions
812
del _error_code, _retry_on_error
813
# Create the global "gnutls" object, simulating a module
817
def call_pipe(connection, # : multiprocessing.Connection
818
func, *args, **kwargs):
819
"""This function is meant to be called by multiprocessing.Process
821
This function runs func(*args, **kwargs), and writes the resulting
822
return value on the provided multiprocessing.Connection.
824
connection.send(func(*args, **kwargs))
408
828
class Client(object):
409
829
"""A representation of a client host served by this server.
412
832
approved: bool(); 'None' if not yet approved/disapproved
413
833
approval_delay: datetime.timedelta(); Time to wait for approval
601
1013
logger.info("Disabling client %s", self.name)
602
1014
if getattr(self, "disable_initiator_tag", None) is not None:
603
gobject.source_remove(self.disable_initiator_tag)
1015
GLib.source_remove(self.disable_initiator_tag)
604
1016
self.disable_initiator_tag = None
605
1017
self.expires = None
606
1018
if getattr(self, "checker_initiator_tag", None) is not None:
607
gobject.source_remove(self.checker_initiator_tag)
1019
GLib.source_remove(self.checker_initiator_tag)
608
1020
self.checker_initiator_tag = None
609
1021
self.stop_checker()
610
1022
self.enabled = False
612
1024
self.send_changedstate()
613
# Do not run this again if called by a gobject.timeout_add
1025
# Do not run this again if called by a GLib.timeout_add
616
1028
def __del__(self):
619
1031
def init_checker(self):
620
1032
# Schedule a new checker to be started an 'interval' from now,
621
1033
# and every interval from then on.
622
1034
if self.checker_initiator_tag is not None:
623
gobject.source_remove(self.checker_initiator_tag)
624
self.checker_initiator_tag = (gobject.timeout_add
625
(self.interval_milliseconds(),
1035
GLib.source_remove(self.checker_initiator_tag)
1036
self.checker_initiator_tag = GLib.timeout_add(
1037
int(self.interval.total_seconds() * 1000),
627
1039
# Schedule a disable() when 'timeout' has passed
628
1040
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
self.disable_initiator_tag = (gobject.timeout_add
631
(self.timeout_milliseconds(),
1041
GLib.source_remove(self.disable_initiator_tag)
1042
self.disable_initiator_tag = GLib.timeout_add(
1043
int(self.timeout.total_seconds() * 1000), self.disable)
633
1044
# Also start a new checker *right now*.
634
1045
self.start_checker()
636
def checker_callback(self, pid, condition, command):
1047
def checker_callback(self, source, condition, connection,
637
1049
"""The checker has completed, so take appropriate actions."""
638
1050
self.checker_callback_tag = None
639
1051
self.checker = None
640
if os.WIFEXITED(condition):
641
self.last_checker_status = os.WEXITSTATUS(condition)
1052
# Read return code from connection (see call_pipe)
1053
returncode = connection.recv()
1057
self.last_checker_status = returncode
1058
self.last_checker_signal = None
642
1059
if self.last_checker_status == 0:
643
1060
logger.info("Checker for %(name)s succeeded",
645
1062
self.checked_ok()
647
logger.info("Checker for %(name)s failed",
1064
logger.info("Checker for %(name)s failed", vars(self))
650
1066
self.last_checker_status = -1
1067
self.last_checker_signal = -returncode
651
1068
logger.warning("Checker for %(name)s crashed?",
654
1072
def checked_ok(self):
655
1073
"""Assert that the client has been seen, alive and well."""
656
1074
self.last_checked_ok = datetime.datetime.utcnow()
657
1075
self.last_checker_status = 0
1076
self.last_checker_signal = None
658
1077
self.bump_timeout()
660
1079
def bump_timeout(self, timeout=None):
661
1080
"""Bump up the timeout for this client."""
662
1081
if timeout is None:
663
1082
timeout = self.timeout
664
1083
if self.disable_initiator_tag is not None:
665
gobject.source_remove(self.disable_initiator_tag)
1084
GLib.source_remove(self.disable_initiator_tag)
666
1085
self.disable_initiator_tag = None
667
1086
if getattr(self, "enabled", False):
668
self.disable_initiator_tag = (gobject.timeout_add
669
(timedelta_to_milliseconds
670
(timeout), self.disable))
1087
self.disable_initiator_tag = GLib.timeout_add(
1088
int(timeout.total_seconds() * 1000), self.disable)
671
1089
self.expires = datetime.datetime.utcnow() + timeout
673
1091
def need_approval(self):
674
1092
self.last_approval_request = datetime.datetime.utcnow()
676
1094
def start_checker(self):
677
1095
"""Start a new checker subprocess if one is not running.
679
1097
If a checker already exists, leave it running and do
681
1099
# The reason for not killing a running checker is that if we
686
1104
# checkers alone, the checker would have to take more time
687
1105
# than 'timeout' for the client to be disabled, which is as it
690
# If a checker exists, make sure it is not a zombie
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except (AttributeError, OSError) as error:
694
if (isinstance(error, OSError)
695
and error.errno != errno.ECHILD):
699
logger.warning("Checker was a zombie")
700
gobject.source_remove(self.checker_callback_tag)
701
self.checker_callback(pid, status,
702
self.current_checker_command)
1108
if self.checker is not None and not self.checker.is_alive():
1109
logger.warning("Checker was not alive; joining")
703
1112
# Start a new checker if needed
704
1113
if self.checker is None:
705
1114
# Escape attributes for the shell
706
escaped_attrs = dict(
707
(attr, re.escape(unicode(getattr(self, attr))))
709
self.runtime_expansions)
1116
attr: re.escape(str(getattr(self, attr)))
1117
for attr in self.runtime_expansions}
711
1119
command = self.checker_command % escaped_attrs
712
1120
except TypeError as error:
713
1121
logger.error('Could not format string "%s"',
714
self.checker_command, exc_info=error)
715
return True # Try again later
1122
self.checker_command,
1124
return True # Try again later
716
1125
self.current_checker_command = command
718
logger.info("Starting checker %r for %s",
720
# We don't need to redirect stdout and stderr, since
721
# in normal mode, that is already done by daemon(),
722
# and in debug mode we don't want to. (Stdin is
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
732
self.checker = subprocess.Popen(command,
736
except OSError as error:
737
logger.error("Failed to start subprocess",
740
self.checker_callback_tag = (gobject.child_watch_add
742
self.checker_callback,
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1126
logger.info("Starting checker %r for %s", command,
1128
# We don't need to redirect stdout and stderr, since
1129
# in normal mode, that is already done by daemon(),
1130
# and in debug mode we don't want to. (Stdin is
1131
# always replaced by /dev/null.)
1132
# The exception is when not debugging but nevertheless
1133
# running in the foreground; use the previously
1135
popen_args = {"close_fds": True,
1138
if (not self.server_settings["debug"]
1139
and self.server_settings["foreground"]):
1140
popen_args.update({"stdout": wnull,
1142
pipe = multiprocessing.Pipe(duplex=False)
1143
self.checker = multiprocessing.Process(
1145
args=(pipe[1], subprocess.call, command),
1147
self.checker.start()
1148
self.checker_callback_tag = GLib.io_add_watch(
1149
pipe[0].fileno(), GLib.IO_IN,
1150
self.checker_callback, pipe[0], command)
1151
# Re-run this periodically if run by GLib.timeout_add
761
1154
def stop_checker(self):
762
1155
"""Force the checker process, if any, to stop."""
763
1156
if self.checker_callback_tag:
764
gobject.source_remove(self.checker_callback_tag)
1157
GLib.source_remove(self.checker_callback_tag)
765
1158
self.checker_callback_tag = None
766
1159
if getattr(self, "checker", None) is None:
768
1161
logger.debug("Stopping checker for %(name)s", vars(self))
770
self.checker.terminate()
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
1162
self.checker.terminate()
777
1163
self.checker = None
780
def dbus_service_property(dbus_interface, signature="v",
781
access="readwrite", byte_arrays=False):
1166
def dbus_service_property(dbus_interface,
782
1170
"""Decorators for marking methods of a DBusObjectWithProperties to
783
1171
become properties on the D-Bus.
785
1173
The decorated method will be called with no arguments by "Get"
786
1174
and with one argument by "Set".
788
1176
The parameters, where they are supported, are the same as
789
1177
dbus.service.method, except there is only "signature", since the
790
1178
type from Get() and the type sent to Set() is the same.
866
class DBusObjectWithProperties(dbus.service.Object):
867
"""A D-Bus object with properties.
869
Classes inheriting from this can use the dbus_service_property
870
decorator to expose methods as D-Bus properties. It exposes the
871
standard Get(), Set(), and GetAll() methods on the D-Bus.
1261
class DBusObjectWithAnnotations(dbus.service.Object):
1262
"""A D-Bus object with annotations.
1264
Classes inheriting from this can use the dbus_annotations
1265
decorator to add annotations to methods or signals.
875
1269
def _is_dbus_thing(thing):
876
1270
"""Returns a function testing if an attribute is a D-Bus thing
878
1272
If called like _is_dbus_thing("method") it returns a function
879
1273
suitable for use as predicate to inspect.getmembers().
881
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1275
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
884
1278
def _get_all_dbus_things(self, thing):
885
1279
"""Returns a generator of (name, attribute) pairs
887
return ((getattr(athing.__get__(self), "_dbus_name",
1281
return ((getattr(athing.__get__(self), "_dbus_name", name),
889
1282
athing.__get__(self))
890
1283
for cls in self.__class__.__mro__
891
1284
for name, athing in
892
inspect.getmembers(cls,
893
self._is_dbus_thing(thing)))
1285
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1287
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1289
path_keyword='object_path',
1290
connection_keyword='connection')
1291
def Introspect(self, object_path, connection):
1292
"""Overloading of standard D-Bus method.
1294
Inserts annotation tags on methods and signals.
1296
xmlstring = dbus.service.Object.Introspect(self, object_path,
1299
document = xml.dom.minidom.parseString(xmlstring)
1301
for if_tag in document.getElementsByTagName("interface"):
1302
# Add annotation tags
1303
for typ in ("method", "signal"):
1304
for tag in if_tag.getElementsByTagName(typ):
1306
for name, prop in (self.
1307
_get_all_dbus_things(typ)):
1308
if (name == tag.getAttribute("name")
1309
and prop._dbus_interface
1310
== if_tag.getAttribute("name")):
1311
annots.update(getattr(
1312
prop, "_dbus_annotations", {}))
1313
for name, value in annots.items():
1314
ann_tag = document.createElement(
1316
ann_tag.setAttribute("name", name)
1317
ann_tag.setAttribute("value", value)
1318
tag.appendChild(ann_tag)
1319
# Add interface annotation tags
1320
for annotation, value in dict(
1321
itertools.chain.from_iterable(
1322
annotations().items()
1323
for name, annotations
1324
in self._get_all_dbus_things("interface")
1325
if name == if_tag.getAttribute("name")
1327
ann_tag = document.createElement("annotation")
1328
ann_tag.setAttribute("name", annotation)
1329
ann_tag.setAttribute("value", value)
1330
if_tag.appendChild(ann_tag)
1331
# Fix argument name for the Introspect method itself
1332
if (if_tag.getAttribute("name")
1333
== dbus.INTROSPECTABLE_IFACE):
1334
for cn in if_tag.getElementsByTagName("method"):
1335
if cn.getAttribute("name") == "Introspect":
1336
for arg in cn.getElementsByTagName("arg"):
1337
if (arg.getAttribute("direction")
1339
arg.setAttribute("name",
1341
xmlstring = document.toxml("utf-8")
1343
except (AttributeError, xml.dom.DOMException,
1344
xml.parsers.expat.ExpatError) as error:
1345
logger.error("Failed to override Introspection method",
1350
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1351
"""A D-Bus object with properties.
1353
Classes inheriting from this can use the dbus_service_property
1354
decorator to expose methods as D-Bus properties. It exposes the
1355
standard Get(), Set(), and GetAll() methods on the D-Bus.
895
1358
def _get_dbus_property(self, interface_name, property_name):
896
1359
"""Returns a bound method if one exists which is a D-Bus
897
1360
property with the specified name and interface.
899
for cls in self.__class__.__mro__:
900
for name, value in (inspect.getmembers
902
self._is_dbus_thing("property"))):
1362
for cls in self.__class__.__mro__:
1363
for name, value in inspect.getmembers(
1364
cls, self._is_dbus_thing("property")):
903
1365
if (value._dbus_name == property_name
904
1366
and value._dbus_interface == interface_name):
905
1367
return value.__get__(self)
907
1369
# No such property
908
raise DBusPropertyNotFound(self.dbus_object_path + ":"
909
+ interface_name + "."
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1370
raise DBusPropertyNotFound("{}:{}.{}".format(
1371
self.dbus_object_path, interface_name, property_name))
1374
def _get_all_interface_names(cls):
1375
"""Get a sequence of all interfaces supported by an object"""
1376
return (name for name in set(getattr(getattr(x, attr),
1377
"_dbus_interface", None)
1378
for x in (inspect.getmro(cls))
1380
if name is not None)
1382
@dbus.service.method(dbus.PROPERTIES_IFACE,
913
1384
out_signature="v")
914
1385
def Get(self, interface_name, property_name):
915
1386
"""Standard D-Bus property Get() method, see D-Bus standard.
1045
1515
return xmlstring
1519
dbus.OBJECT_MANAGER_IFACE
1520
except AttributeError:
1521
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1524
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1525
"""A D-Bus object with an ObjectManager.
1527
Classes inheriting from this exposes the standard
1528
GetManagedObjects call and the InterfacesAdded and
1529
InterfacesRemoved signals on the standard
1530
"org.freedesktop.DBus.ObjectManager" interface.
1532
Note: No signals are sent automatically; they must be sent
1535
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1536
out_signature="a{oa{sa{sv}}}")
1537
def GetManagedObjects(self):
1538
"""This function must be overridden"""
1539
raise NotImplementedError()
1541
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1542
signature="oa{sa{sv}}")
1543
def InterfacesAdded(self, object_path, interfaces_and_properties):
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1547
def InterfacesRemoved(self, object_path, interfaces):
1550
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1554
def Introspect(self, object_path, connection):
1555
"""Overloading of standard D-Bus method.
1557
Override return argument name of GetManagedObjects to be
1558
"objpath_interfaces_and_properties"
1560
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1564
document = xml.dom.minidom.parseString(xmlstring)
1566
for if_tag in document.getElementsByTagName("interface"):
1567
# Fix argument name for the GetManagedObjects method
1568
if (if_tag.getAttribute("name")
1569
== dbus.OBJECT_MANAGER_IFACE):
1570
for cn in if_tag.getElementsByTagName("method"):
1571
if (cn.getAttribute("name")
1572
== "GetManagedObjects"):
1573
for arg in cn.getElementsByTagName("arg"):
1574
if (arg.getAttribute("direction")
1578
"objpath_interfaces"
1580
xmlstring = document.toxml("utf-8")
1582
except (AttributeError, xml.dom.DOMException,
1583
xml.parsers.expat.ExpatError) as error:
1584
logger.error("Failed to override Introspection method",
1048
1589
def datetime_to_dbus(dt, variant_level=0):
1049
1590
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1051
return dbus.String("", variant_level = variant_level)
1052
return dbus.String(dt.isoformat(),
1053
variant_level=variant_level)
1592
return dbus.String("", variant_level=variant_level)
1593
return dbus.String(dt.isoformat(), variant_level=variant_level)
1056
1596
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1086
1627
# Ignore non-D-Bus attributes, and D-Bus attributes
1087
1628
# with the wrong interface name
1088
1629
if (not hasattr(attribute, "_dbus_interface")
1089
or not attribute._dbus_interface
1090
.startswith(orig_interface_name)):
1630
or not attribute._dbus_interface.startswith(
1631
orig_interface_name)):
1092
1633
# Create an alternate D-Bus interface name based on
1093
1634
# the current name
1094
alt_interface = (attribute._dbus_interface
1095
.replace(orig_interface_name,
1096
alt_interface_name))
1635
alt_interface = attribute._dbus_interface.replace(
1636
orig_interface_name, alt_interface_name)
1097
1637
interface_names.add(alt_interface)
1098
1638
# Is this a D-Bus signal?
1099
1639
if getattr(attribute, "_dbus_is_signal", False):
1100
1640
# Extract the original non-method undecorated
1101
1641
# function by black magic
1102
nonmethod_func = (dict(
1642
if sys.version_info.major == 2:
1643
nonmethod_func = (dict(
1103
1644
zip(attribute.func_code.co_freevars,
1104
attribute.__closure__))["func"]
1645
attribute.__closure__))
1646
["func"].cell_contents)
1648
nonmethod_func = (dict(
1649
zip(attribute.__code__.co_freevars,
1650
attribute.__closure__))
1651
["func"].cell_contents)
1106
1652
# Create a new, but exactly alike, function
1107
1653
# object, and decorate it to be a new D-Bus signal
1108
1654
# with the alternate D-Bus interface name
1109
new_function = (dbus.service.signal
1111
attribute._dbus_signature)
1112
(types.FunctionType(
1113
nonmethod_func.func_code,
1114
nonmethod_func.func_globals,
1115
nonmethod_func.func_name,
1116
nonmethod_func.func_defaults,
1117
nonmethod_func.func_closure)))
1655
new_function = copy_function(nonmethod_func)
1656
new_function = (dbus.service.signal(
1658
attribute._dbus_signature)(new_function))
1118
1659
# Copy annotations, if any
1120
new_function._dbus_annotations = (
1121
dict(attribute._dbus_annotations))
1661
new_function._dbus_annotations = dict(
1662
attribute._dbus_annotations)
1122
1663
except AttributeError:
1124
1666
# Define a creator of a function to call both the
1125
1667
# original and alternate functions, so both the
1126
1668
# original and alternate signals gets sent when
1409
1957
server to mandos-client
1413
1961
# Rejected - signal
1414
1962
@dbus.service.signal(_interface, signature="s")
1415
1963
def Rejected(self, reason):
1419
1967
# NeedApproval - signal
1420
1968
@dbus.service.signal(_interface, signature="tb")
1421
1969
def NeedApproval(self, timeout, default):
1423
1971
return self.need_approval()
1427
1975
# Approve - method
1428
1976
@dbus.service.method(_interface, in_signature="b")
1429
1977
def Approve(self, value):
1430
1978
self.approve(value)
1432
1980
# CheckedOK - method
1433
1981
@dbus.service.method(_interface)
1434
1982
def CheckedOK(self):
1435
1983
self.checked_ok()
1437
1985
# Enable - method
1986
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1438
1987
@dbus.service.method(_interface)
1439
1988
def Enable(self):
1443
1992
# StartChecker - method
1993
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
1994
@dbus.service.method(_interface)
1445
1995
def StartChecker(self):
1447
1997
self.start_checker()
1449
1999
# Disable - method
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
2001
@dbus.service.method(_interface)
1451
2002
def Disable(self):
1455
2006
# StopChecker - method
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1456
2008
@dbus.service.method(_interface)
1457
2009
def StopChecker(self):
1458
2010
self.stop_checker()
1462
2014
# ApprovalPending - property
1463
2015
@dbus_service_property(_interface, signature="b", access="read")
1464
2016
def ApprovalPending_dbus_property(self):
1465
2017
return dbus.Boolean(bool(self.approvals_pending))
1467
2019
# ApprovedByDefault - property
1468
@dbus_service_property(_interface, signature="b",
2020
@dbus_service_property(_interface,
1469
2022
access="readwrite")
1470
2023
def ApprovedByDefault_dbus_property(self, value=None):
1471
2024
if value is None: # get
1472
2025
return dbus.Boolean(self.approved_by_default)
1473
2026
self.approved_by_default = bool(value)
1475
2028
# ApprovalDelay - property
1476
@dbus_service_property(_interface, signature="t",
2029
@dbus_service_property(_interface,
1477
2031
access="readwrite")
1478
2032
def ApprovalDelay_dbus_property(self, value=None):
1479
2033
if value is None: # get
1480
return dbus.UInt64(self.approval_delay_milliseconds())
2034
return dbus.UInt64(self.approval_delay.total_seconds()
1481
2036
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1483
2038
# ApprovalDuration - property
1484
@dbus_service_property(_interface, signature="t",
2039
@dbus_service_property(_interface,
1485
2041
access="readwrite")
1486
2042
def ApprovalDuration_dbus_property(self, value=None):
1487
2043
if value is None: # get
1488
return dbus.UInt64(timedelta_to_milliseconds(
1489
self.approval_duration))
2044
return dbus.UInt64(self.approval_duration.total_seconds()
1490
2046
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1492
2048
# Name - property
2050
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1493
2051
@dbus_service_property(_interface, signature="s", access="read")
1494
2052
def Name_dbus_property(self):
1495
2053
return dbus.String(self.name)
2057
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2058
@dbus_service_property(_interface, signature="s", access="read")
2059
def KeyID_dbus_property(self):
2060
return dbus.String(self.key_id)
1497
2062
# Fingerprint - property
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
2065
@dbus_service_property(_interface, signature="s", access="read")
1499
2066
def Fingerprint_dbus_property(self):
1500
2067
return dbus.String(self.fingerprint)
1502
2069
# Host - property
1503
@dbus_service_property(_interface, signature="s",
2070
@dbus_service_property(_interface,
1504
2072
access="readwrite")
1505
2073
def Host_dbus_property(self, value=None):
1506
2074
if value is None: # get
1507
2075
return dbus.String(self.host)
1508
self.host = unicode(value)
2076
self.host = str(value)
1510
2078
# Created - property
2080
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1511
2081
@dbus_service_property(_interface, signature="s", access="read")
1512
2082
def Created_dbus_property(self):
1513
2083
return datetime_to_dbus(self.created)
1515
2085
# LastEnabled - property
1516
2086
@dbus_service_property(_interface, signature="s", access="read")
1517
2087
def LastEnabled_dbus_property(self):
1518
2088
return datetime_to_dbus(self.last_enabled)
1520
2090
# Enabled - property
1521
@dbus_service_property(_interface, signature="b",
2091
@dbus_service_property(_interface,
1522
2093
access="readwrite")
1523
2094
def Enabled_dbus_property(self, value=None):
1524
2095
if value is None: # get
1572
2144
if (getattr(self, "disable_initiator_tag", None)
1575
gobject.source_remove(self.disable_initiator_tag)
1576
self.disable_initiator_tag = (
1577
gobject.timeout_add(
1578
timedelta_to_milliseconds(self.expires - now),
2147
GLib.source_remove(self.disable_initiator_tag)
2148
self.disable_initiator_tag = GLib.timeout_add(
2149
int((self.expires - now).total_seconds() * 1000),
1581
2152
# ExtendedTimeout - property
1582
@dbus_service_property(_interface, signature="t",
2153
@dbus_service_property(_interface,
1583
2155
access="readwrite")
1584
2156
def ExtendedTimeout_dbus_property(self, value=None):
1585
2157
if value is None: # get
1586
return dbus.UInt64(self.extended_timeout_milliseconds())
2158
return dbus.UInt64(self.extended_timeout.total_seconds()
1587
2160
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1589
2162
# Interval - property
1590
@dbus_service_property(_interface, signature="t",
2163
@dbus_service_property(_interface,
1591
2165
access="readwrite")
1592
2166
def Interval_dbus_property(self, value=None):
1593
2167
if value is None: # get
1594
return dbus.UInt64(self.interval_milliseconds())
2168
return dbus.UInt64(self.interval.total_seconds() * 1000)
1595
2169
self.interval = datetime.timedelta(0, 0, 0, value)
1596
2170
if getattr(self, "checker_initiator_tag", None) is None:
1598
2172
if self.enabled:
1599
2173
# Reschedule checker run
1600
gobject.source_remove(self.checker_initiator_tag)
1601
self.checker_initiator_tag = (gobject.timeout_add
1602
(value, self.start_checker))
1603
self.start_checker() # Start one now, too
2174
GLib.source_remove(self.checker_initiator_tag)
2175
self.checker_initiator_tag = GLib.timeout_add(
2176
value, self.start_checker)
2177
self.start_checker() # Start one now, too
1605
2179
# Checker - property
1606
@dbus_service_property(_interface, signature="s",
2180
@dbus_service_property(_interface,
1607
2182
access="readwrite")
1608
2183
def Checker_dbus_property(self, value=None):
1609
2184
if value is None: # get
1610
2185
return dbus.String(self.checker_command)
1611
self.checker_command = unicode(value)
2186
self.checker_command = str(value)
1613
2188
# CheckerRunning - property
1614
@dbus_service_property(_interface, signature="b",
2189
@dbus_service_property(_interface,
1615
2191
access="readwrite")
1616
2192
def CheckerRunning_dbus_property(self, value=None):
1617
2193
if value is None: # get
1664
2250
class ClientHandler(socketserver.BaseRequestHandler, object):
1665
2251
"""A class to handle client connections.
1667
2253
Instantiated once for each connection to handle it.
1668
2254
Note: This will run in its own forked process."""
1670
2256
def handle(self):
1671
2257
with contextlib.closing(self.server.child_pipe) as child_pipe:
1672
2258
logger.info("TCP connection from: %s",
1673
unicode(self.client_address))
2259
str(self.client_address))
1674
2260
logger.debug("Pipe FD: %d",
1675
2261
self.server.child_pipe.fileno())
1677
session = (gnutls.connection
1678
.ClientSession(self.request,
1680
.X509Credentials()))
1682
# Note: gnutls.connection.X509Credentials is really a
1683
# generic GnuTLS certificate credentials object so long as
1684
# no X.509 keys are added to it. Therefore, we can use it
1685
# here despite using OpenPGP certificates.
1687
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1688
# "+AES-256-CBC", "+SHA1",
1689
# "+COMP-NULL", "+CTYPE-OPENPGP",
2263
session = gnutls.ClientSession(self.request)
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
# "+AES-256-CBC", "+SHA1",
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
1691
2269
# Use a fallback default, since this MUST be set.
1692
2270
priority = self.server.gnutls_priority
1693
2271
if priority is None:
1694
2272
priority = "NORMAL"
1695
(gnutls.library.functions
1696
.gnutls_priority_set_direct(session._c_object,
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
1699
2277
# Start communication using the Mandos protocol
1700
2278
# Get protocol number
1701
2279
line = self.request.makefile().readline()
1702
2280
logger.debug("Protocol version: %r", line)
1704
2282
if int(line.strip().split()[0]) > 1:
2283
raise RuntimeError(line)
1706
2284
except (ValueError, IndexError, RuntimeError) as error:
1707
2285
logger.error("Unknown protocol version: %s", error)
1710
2288
# Start GnuTLS connection
1712
2290
session.handshake()
1713
except gnutls.errors.GNUTLSError as error:
2291
except gnutls.Error as error:
1714
2292
logger.warning("Handshake failed: %s", error)
1715
2293
# Do not run session.bye() here: the session is not
1716
2294
# established. Just abandon the request.
1718
2296
logger.debug("Handshake succeeded")
1720
2298
approval_required = False
1723
fpr = self.fingerprint(self.peer_certificate
1726
gnutls.errors.GNUTLSError) as error:
1727
logger.warning("Bad certificate: %s", error)
1729
logger.debug("Fingerprint: %s", fpr)
1732
client = ProxyClient(child_pipe, fpr,
2300
if gnutls.has_rawpk:
2303
key_id = self.key_id(
2304
self.peer_certificate(session))
2305
except (TypeError, gnutls.Error) as error:
2306
logger.warning("Bad certificate: %s", error)
2308
logger.debug("Key ID: %s", key_id)
2313
fpr = self.fingerprint(
2314
self.peer_certificate(session))
2315
except (TypeError, gnutls.Error) as error:
2316
logger.warning("Bad certificate: %s", error)
2318
logger.debug("Fingerprint: %s", fpr)
2321
client = ProxyClient(child_pipe, key_id, fpr,
1733
2322
self.client_address)
1734
2323
except KeyError:
1737
2326
if client.approval_delay:
1738
2327
delay = client.approval_delay
1739
2328
client.approvals_pending += 1
1740
2329
approval_required = True
1743
2332
if not client.enabled:
1744
2333
logger.info("Client %s is disabled",
1746
2335
if self.server.use_dbus:
1747
2336
# Emit D-Bus signal
1748
2337
client.Rejected("Disabled")
1751
2340
if client.approved or not client.approval_delay:
1752
#We are approved or approval is disabled
2341
# We are approved or approval is disabled
1754
2343
elif client.approved is None:
1755
2344
logger.info("Client %s needs approval",
1790
2377
delay -= time2 - time
1793
while sent_size < len(client.secret):
1795
sent = session.send(client.secret[sent_size:])
1796
except gnutls.errors.GNUTLSError as error:
1797
logger.warning("gnutls send failed",
1800
logger.debug("Sent: %d, remaining: %d",
1801
sent, len(client.secret)
1802
- (sent_size + sent))
2380
session.send(client.secret)
2381
except gnutls.Error as error:
2382
logger.warning("gnutls send failed",
1805
2386
logger.info("Sending secret to %s", client.name)
1806
2387
# bump the timeout using extended_timeout
1807
2388
client.bump_timeout(client.extended_timeout)
1808
2389
if self.server.use_dbus:
1809
2390
# Emit D-Bus signal
1810
2391
client.GotSecret()
1813
2394
if approval_required:
1814
2395
client.approvals_pending -= 1
1817
except gnutls.errors.GNUTLSError as error:
2398
except gnutls.Error as error:
1818
2399
logger.warning("GnuTLS bye failed",
1819
2400
exc_info=error)
1822
2403
def peer_certificate(session):
1823
"Return the peer's OpenPGP certificate as a bytestring"
1824
# If not an OpenPGP certificate...
1825
if (gnutls.library.functions
1826
.gnutls_certificate_type_get(session._c_object)
1827
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1828
# ...do the normal thing
1829
return session.peer_certificate
2404
"Return the peer's certificate as a bytestring"
2406
cert_type = gnutls.certificate_type_get2(session._c_object,
2408
except AttributeError:
2409
cert_type = gnutls.certificate_type_get(session._c_object)
2410
if gnutls.has_rawpk:
2411
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2413
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2414
# If not a valid certificate type...
2415
if cert_type not in valid_cert_types:
2416
logger.info("Cert type %r not in %r", cert_type,
2418
# ...return invalid data
1830
2420
list_size = ctypes.c_uint(1)
1831
cert_list = (gnutls.library.functions
1832
.gnutls_certificate_get_peers
2421
cert_list = (gnutls.certificate_get_peers
1833
2422
(session._c_object, ctypes.byref(list_size)))
1834
2423
if not bool(cert_list) and list_size.value != 0:
1835
raise gnutls.errors.GNUTLSError("error getting peer"
2424
raise gnutls.Error("error getting peer certificate")
1837
2425
if list_size.value == 0:
1839
2427
cert = cert_list[0]
1840
2428
return ctypes.string_at(cert.data, cert.size)
2431
def key_id(certificate):
2432
"Convert a certificate bytestring to a hexdigit key ID"
2433
# New GnuTLS "datum" with the public key
2434
datum = gnutls.datum_t(
2435
ctypes.cast(ctypes.c_char_p(certificate),
2436
ctypes.POINTER(ctypes.c_ubyte)),
2437
ctypes.c_uint(len(certificate)))
2438
# XXX all these need to be created in the gnutls "module"
2439
# New empty GnuTLS certificate
2440
pubkey = gnutls.pubkey_t()
2441
gnutls.pubkey_init(ctypes.byref(pubkey))
2442
# Import the raw public key into the certificate
2443
gnutls.pubkey_import(pubkey,
2444
ctypes.byref(datum),
2445
gnutls.X509_FMT_DER)
2446
# New buffer for the key ID
2447
buf = ctypes.create_string_buffer(32)
2448
buf_len = ctypes.c_size_t(len(buf))
2449
# Get the key ID from the raw public key into the buffer
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2455
# Deinit the certificate
2456
gnutls.pubkey_deinit(pubkey)
2458
# Convert the buffer to a Python bytestring
2459
key_id = ctypes.string_at(buf, buf_len.value)
2460
# Convert the bytestring to hexadecimal notation
2461
hex_key_id = binascii.hexlify(key_id).upper()
1843
2465
def fingerprint(openpgp):
1844
2466
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1845
2467
# New GnuTLS "datum" with the OpenPGP public key
1846
datum = (gnutls.library.types
1847
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1850
ctypes.c_uint(len(openpgp))))
2468
datum = gnutls.datum_t(
2469
ctypes.cast(ctypes.c_char_p(openpgp),
2470
ctypes.POINTER(ctypes.c_ubyte)),
2471
ctypes.c_uint(len(openpgp)))
1851
2472
# New empty GnuTLS certificate
1852
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1853
(gnutls.library.functions
1854
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2473
crt = gnutls.openpgp_crt_t()
2474
gnutls.openpgp_crt_init(ctypes.byref(crt))
1855
2475
# Import the OpenPGP public key into the certificate
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1858
gnutls.library.constants
1859
.GNUTLS_OPENPGP_FMT_RAW))
2476
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2477
gnutls.OPENPGP_FMT_RAW)
1860
2478
# Verify the self signature in the key
1861
2479
crtverify = ctypes.c_uint()
1862
(gnutls.library.functions
1863
.gnutls_openpgp_crt_verify_self(crt, 0,
1864
ctypes.byref(crtverify)))
2480
gnutls.openpgp_crt_verify_self(crt, 0,
2481
ctypes.byref(crtverify))
1865
2482
if crtverify.value != 0:
1866
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1867
raise (gnutls.errors.CertificateSecurityError
2483
gnutls.openpgp_crt_deinit(crt)
2484
raise gnutls.CertificateSecurityError(code
1869
2486
# New buffer for the fingerprint
1870
2487
buf = ctypes.create_string_buffer(20)
1871
2488
buf_len = ctypes.c_size_t()
1872
2489
# Get the fingerprint from the certificate into the buffer
1873
(gnutls.library.functions
1874
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1875
ctypes.byref(buf_len)))
2490
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2491
ctypes.byref(buf_len))
1876
2492
# Deinit the certificate
1877
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2493
gnutls.openpgp_crt_deinit(crt)
1878
2494
# Convert the buffer to a Python bytestring
1879
2495
fpr = ctypes.string_at(buf, buf_len.value)
1880
2496
# Convert the bytestring to hexadecimal notation
1963
2585
# socket_wrapper(), if socketfd was set.
1964
2586
socketserver.TCPServer.__init__(self, server_address,
1965
2587
RequestHandlerClass)
1967
2589
def server_bind(self):
1968
2590
"""This overrides the normal server_bind() function
1969
2591
to bind to an interface if one was specified, and also NOT to
1970
2592
bind to an address or port if they were not specified."""
2593
global SO_BINDTODEVICE
1971
2594
if self.interface is not None:
1972
2595
if SO_BINDTODEVICE is None:
1973
logger.error("SO_BINDTODEVICE does not exist;"
1974
" cannot bind to interface %s",
1978
self.socket.setsockopt(socket.SOL_SOCKET,
1980
str(self.interface + '\0'))
1981
except socket.error as error:
1982
if error.errno == errno.EPERM:
1983
logger.error("No permission to bind to"
1984
" interface %s", self.interface)
1985
elif error.errno == errno.ENOPROTOOPT:
1986
logger.error("SO_BINDTODEVICE not available;"
1987
" cannot bind to interface %s",
1989
elif error.errno == errno.ENODEV:
1990
logger.error("Interface %s does not exist,"
1991
" cannot bind", self.interface)
2596
# Fall back to a hard-coded value which seems to be
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
SO_BINDTODEVICE = 25
2601
self.socket.setsockopt(
2602
socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
(self.interface + "\0").encode("utf-8"))
2604
except socket.error as error:
2605
if error.errno == errno.EPERM:
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2608
elif error.errno == errno.ENOPROTOOPT:
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2612
elif error.errno == errno.ENODEV:
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
1994
2617
# Only bind(2) the socket if we really need to.
1995
2618
if self.server_address[0] or self.server_address[1]:
1996
2619
if not self.server_address[0]:
1997
2620
if self.address_family == socket.AF_INET6:
1998
any_address = "::" # in6addr_any
2621
any_address = "::" # in6addr_any
2000
any_address = "0.0.0.0" # INADDR_ANY
2623
any_address = "0.0.0.0" # INADDR_ANY
2001
2624
self.server_address = (any_address,
2002
2625
self.server_address[1])
2003
2626
elif not self.server_address[1]:
2004
self.server_address = (self.server_address[0],
2627
self.server_address = (self.server_address[0], 0)
2006
2628
# if self.interface:
2007
2629
# self.server_address = (self.server_address[0],
2033
2660
self.gnutls_priority = gnutls_priority
2034
2661
IPv6_TCPServer.__init__(self, server_address,
2035
2662
RequestHandlerClass,
2036
interface = interface,
2037
use_ipv6 = use_ipv6,
2038
socketfd = socketfd)
2663
interface=interface,
2039
2667
def server_activate(self):
2040
2668
if self.enabled:
2041
2669
return socketserver.TCPServer.server_activate(self)
2043
2671
def enable(self):
2044
2672
self.enabled = True
2046
2674
def add_pipe(self, parent_pipe, proc):
2047
2675
# Call "handle_ipc" for both data and EOF events
2048
gobject.io_add_watch(parent_pipe.fileno(),
2049
gobject.IO_IN | gobject.IO_HUP,
2050
functools.partial(self.handle_ipc,
2055
def handle_ipc(self, source, condition, parent_pipe=None,
2056
proc = None, client_object=None):
2677
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2679
functools.partial(self.handle_ipc,
2680
parent_pipe=parent_pipe,
2683
def handle_ipc(self, source, condition,
2686
client_object=None):
2057
2687
# error, or the other end of multiprocessing.Pipe has closed
2058
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2059
2689
# Wait for other process to exit
2063
2693
# Read a request from the child
2064
2694
request = parent_pipe.recv()
2065
2695
command = request[0]
2067
2697
if command == 'init':
2069
address = request[2]
2071
for c in self.clients.itervalues():
2072
if c.fingerprint == fpr:
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2702
for c in self.clients.values():
2703
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2705
if key_id and c.key_id == key_id:
2708
if fpr and c.fingerprint == fpr:
2076
logger.info("Client not found for fingerprint: %s, ad"
2077
"dress: %s", fpr, address)
2712
logger.info("Client not found for key ID: %s, address"
2713
": %s", key_id or fpr, address)
2078
2714
if self.use_dbus:
2079
2715
# Emit D-Bus signal
2080
mandos_dbus_service.ClientNotFound(fpr,
2716
mandos_dbus_service.ClientNotFound(key_id or fpr,
2082
2718
parent_pipe.send(False)
2085
gobject.io_add_watch(parent_pipe.fileno(),
2086
gobject.IO_IN | gobject.IO_HUP,
2087
functools.partial(self.handle_ipc,
2722
parent_pipe.fileno(),
2723
GLib.IO_IN | GLib.IO_HUP,
2724
functools.partial(self.handle_ipc,
2725
parent_pipe=parent_pipe,
2727
client_object=client))
2093
2728
parent_pipe.send(True)
2094
2729
# remove the old hook in favor of the new above hook on
3136
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2482
3138
except OSError as error:
3139
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3140
.format(uid, gid, os.strerror(error.errno)))
2483
3141
if error.errno != errno.EPERM:
2487
3145
# Enable all possible GnuTLS debugging
2489
3147
# "Use a log level over 10 to enable all debugging options."
2490
3148
# - GnuTLS manual
2491
gnutls.library.functions.gnutls_global_set_log_level(11)
2493
@gnutls.library.types.gnutls_log_func
3149
gnutls.global_set_log_level(11)
2494
3152
def debug_gnutls(level, string):
2495
3153
logger.debug("GnuTLS: %s", string[:-1])
2497
(gnutls.library.functions
2498
.gnutls_global_set_log_function(debug_gnutls))
3155
gnutls.global_set_log_function(debug_gnutls)
2500
3157
# Redirect stdin so all checkers get /dev/null
2501
3158
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2502
3159
os.dup2(null, sys.stdin.fileno())
2506
3163
# Need to fork before connecting to D-Bus
2507
3164
if not foreground:
2508
3165
# Close all input and output, do double fork, etc.
2511
# multiprocessing will use threads, so before we use gobject we
2512
# need to inform gobject that threads will be used.
2513
gobject.threads_init()
3168
# multiprocessing will use threads, so before we use GLib we need
3169
# to inform GLib that threads will be used.
2515
3172
global main_loop
2516
3173
# From the Avahi example code
2517
3174
DBusGMainLoop(set_as_default=True)
2518
main_loop = gobject.MainLoop()
3175
main_loop = GLib.MainLoop()
2519
3176
bus = dbus.SystemBus()
2520
3177
# End of Avahi example code
2523
3180
bus_name = dbus.service.BusName("se.recompile.Mandos",
2524
bus, do_not_queue=True)
2525
old_bus_name = (dbus.service.BusName
2526
("se.bsnet.fukt.Mandos", bus,
2528
except dbus.exceptions.NameExistsException as e:
3183
old_bus_name = dbus.service.BusName(
3184
"se.bsnet.fukt.Mandos", bus,
3186
except dbus.exceptions.DBusException as e:
2529
3187
logger.error("Disabling D-Bus:", exc_info=e)
2530
3188
use_dbus = False
2531
3189
server_settings["use_dbus"] = False
2532
3190
tcp_server.use_dbus = False
2533
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2534
service = AvahiServiceToSyslog(name =
2535
server_settings["servicename"],
2536
servicetype = "_mandos._tcp",
2537
protocol = protocol, bus = bus)
2538
if server_settings["interface"]:
2539
service.interface = (if_nametoindex
2540
(str(server_settings["interface"])))
3192
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
3198
if server_settings["interface"]:
3199
service.interface = if_nametoindex(
3200
server_settings["interface"].encode("utf-8"))
2542
3202
global multiprocessing_manager
2543
3203
multiprocessing_manager = multiprocessing.Manager()
2545
3205
client_class = Client
2547
client_class = functools.partial(ClientDBus, bus = bus)
3207
client_class = functools.partial(ClientDBus, bus=bus)
2549
3209
client_settings = Client.config_parser(client_config)
2550
3210
old_client_settings = {}
2551
3211
clients_data = {}
2553
3213
# This is used to redirect stdout and stderr for checker processes
2555
wnull = open(os.devnull, "w") # A writable /dev/null
3215
wnull = open(os.devnull, "w") # A writable /dev/null
2556
3216
# Only used if server is running in foreground but not in debug
2558
3218
if debug or not foreground:
2561
3221
# Get client data and settings from last running state.
2562
3222
if server_settings["restore"]:
2564
3224
with open(stored_state_path, "rb") as stored_state:
2565
clients_data, old_client_settings = (pickle.load
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3245
clients_data[key] = value
3247
value["client_structure"] = [
3249
if isinstance(s, bytes)
3251
value["client_structure"]]
3253
for k in ("name", "host"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if not value.has_key("key_id"):
3257
value["key_id"] = ""
3258
elif not value.has_key("fingerprint"):
3259
value["fingerprint"] = ""
3260
# old_client_settings
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3270
for value in old_client_settings.values():
3271
if isinstance(value["host"], bytes):
3272
value["host"] = (value["host"]
2567
3274
os.remove(stored_state_path)
2568
3275
except IOError as e:
2569
3276
if e.errno == errno.ENOENT:
2570
logger.warning("Could not load persistent state: {0}"
2571
.format(os.strerror(e.errno)))
3277
logger.warning("Could not load persistent state:"
3278
" {}".format(os.strerror(e.errno)))
2573
3280
logger.critical("Could not load persistent state:",
2576
3283
except EOFError as e:
2577
3284
logger.warning("Could not load persistent state: "
2578
"EOFError:", exc_info=e)
2580
3288
with PGPEngine() as pgp:
2581
for client_name, client in clients_data.iteritems():
3289
for client_name, client in clients_data.items():
2582
3290
# Skip removed clients
2583
3291
if client_name not in client_settings:
2586
3294
# Decide which value to use after restoring saved state.
2587
3295
# We have three different values: Old config file,
2588
3296
# new config file, and saved state.
2646
3354
for client_name in (set(client_settings)
2647
3355
- set(old_client_settings)):
2648
3356
clients_data[client_name] = client_settings[client_name]
2650
3358
# Create all client objects
2651
for client_name, client in clients_data.iteritems():
3359
for client_name, client in clients_data.items():
2652
3360
tcp_server.clients[client_name] = client_class(
2653
name = client_name, settings = client,
2654
server_settings = server_settings)
3363
server_settings=server_settings)
2656
3365
if not tcp_server.clients:
2657
3366
logger.warning("No clients defined")
2659
3368
if not foreground:
2660
3369
if pidfile is not None:
2664
pidfile.write(str(pid) + "\n".encode("utf-8"))
3373
print(pid, file=pidfile)
2665
3374
except IOError:
2666
3375
logger.error("Could not write to file %r with PID %d",
2667
3376
pidfilename, pid)
2669
3378
del pidfilename
2671
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2672
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3380
for termsig in (signal.SIGHUP, signal.SIGTERM):
3381
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3382
lambda: main_loop.quit() and False)
2675
@alternate_dbus_interfaces({"se.recompile.Mandos":
2676
"se.bsnet.fukt.Mandos"})
2677
class MandosDBusService(DBusObjectWithProperties):
3386
@alternate_dbus_interfaces(
3387
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3388
class MandosDBusService(DBusObjectWithObjectManager):
2678
3389
"""A D-Bus proxy object"""
2679
3391
def __init__(self):
2680
3392
dbus.service.Object.__init__(self, bus, "/")
2681
3394
_interface = "se.recompile.Mandos"
2683
@dbus_interface_annotations(_interface)
2685
return { "org.freedesktop.DBus.Property"
2686
".EmitsChangedSignal":
2689
3396
@dbus.service.signal(_interface, signature="o")
2690
3397
def ClientAdded(self, objpath):
2694
3401
@dbus.service.signal(_interface, signature="ss")
2695
def ClientNotFound(self, fingerprint, address):
3402
def ClientNotFound(self, key_id, address):
3406
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2699
3408
@dbus.service.signal(_interface, signature="os")
2700
3409
def ClientRemoved(self, objpath, name):
3413
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2704
3415
@dbus.service.method(_interface, out_signature="ao")
2705
3416
def GetAllClients(self):
2707
return dbus.Array(c.dbus_object_path
2709
tcp_server.clients.itervalues())
3418
return dbus.Array(c.dbus_object_path for c in
3419
tcp_server.clients.values())
3421
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2711
3423
@dbus.service.method(_interface,
2712
3424
out_signature="a{oa{sv}}")
2713
3425
def GetAllClientsWithProperties(self):
2715
3427
return dbus.Dictionary(
2716
((c.dbus_object_path, c.GetAll(""))
2717
for c in tcp_server.clients.itervalues()),
3428
{c.dbus_object_path: c.GetAll(
3429
"se.recompile.Mandos.Client")
3430
for c in tcp_server.clients.values()},
2718
3431
signature="oa{sv}")
2720
3433
@dbus.service.method(_interface, in_signature="o")
2721
3434
def RemoveClient(self, object_path):
2723
for c in tcp_server.clients.itervalues():
3436
for c in tcp_server.clients.values():
2724
3437
if c.dbus_object_path == object_path:
2725
3438
del tcp_server.clients[c.name]
2726
3439
c.remove_from_connection()
2727
# Don't signal anything except ClientRemoved
3440
# Don't signal the disabling
2728
3441
c.disable(quiet=True)
2730
self.ClientRemoved(object_path, c.name)
3442
# Emit D-Bus signal for removal
3443
self.client_removed_signal(c)
2732
3445
raise KeyError(object_path)
3449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3450
out_signature="a{oa{sa{sv}}}")
3451
def GetManagedObjects(self):
3453
return dbus.Dictionary(
3454
{client.dbus_object_path:
3456
{interface: client.GetAll(interface)
3458
client._get_all_interface_names()})
3459
for client in tcp_server.clients.values()})
3461
def client_added_signal(self, client):
3462
"""Send the new standard signal and the old signal"""
3464
# New standard signal
3465
self.InterfacesAdded(
3466
client.dbus_object_path,
3468
{interface: client.GetAll(interface)
3470
client._get_all_interface_names()}))
3472
self.ClientAdded(client.dbus_object_path)
3474
def client_removed_signal(self, client):
3475
"""Send the new standard signal and the old signal"""
3477
# New standard signal
3478
self.InterfacesRemoved(
3479
client.dbus_object_path,
3480
client._get_all_interface_names())
3482
self.ClientRemoved(client.dbus_object_path,
2736
3485
mandos_dbus_service = MandosDBusService()
3487
# Save modules to variables to exempt the modules from being
3488
# unloaded before the function registered with atexit() is run.
3489
mp = multiprocessing
2739
3493
"Cleanup function; run on exit"
2742
multiprocessing.active_children()
3497
mp.active_children()
2744
3499
if not (tcp_server.clients or client_settings):
2747
3502
# Store client before exiting. Secrets are encrypted with key
2748
3503
# based on what config file has. If config file is
2749
3504
# removed/edited, old secret will thus be unrecovable.
2751
3506
with PGPEngine() as pgp:
2752
for client in tcp_server.clients.itervalues():
3507
for client in tcp_server.clients.values():
2753
3508
key = client_settings[client.name]["secret"]
2754
3509
client.encrypted_secret = pgp.encrypt(client.secret,
2756
3511
client_dict = {}
2758
3513
# A list of attributes that can not be pickled
2760
exclude = set(("bus", "changedstate", "secret",
2761
"checker", "server_settings"))
2762
for name, typ in (inspect.getmembers
2763
(dbus.service.Object)):
3515
exclude = {"bus", "changedstate", "secret",
3516
"checker", "server_settings"}
3517
for name, typ in inspect.getmembers(dbus.service
2764
3519
exclude.add(name)
2766
3521
client_dict["encrypted_secret"] = (client
2767
3522
.encrypted_secret)
2768
3523
for attr in client.client_structure:
2769
3524
if attr not in exclude:
2770
3525
client_dict[attr] = getattr(client, attr)
2772
3527
clients[client.name] = client_dict
2773
3528
del client_settings[client.name]["secret"]
2776
with (tempfile.NamedTemporaryFile
2777
(mode='wb', suffix=".pickle", prefix='clients-',
2778
dir=os.path.dirname(stored_state_path),
2779
delete=False)) as stored_state:
2780
pickle.dump((clients, client_settings), stored_state)
2781
tempname=stored_state.name
3531
with tempfile.NamedTemporaryFile(
3535
dir=os.path.dirname(stored_state_path),
3536
delete=False) as stored_state:
3537
pickle.dump((clients, client_settings), stored_state,
3539
tempname = stored_state.name
2782
3540
os.rename(tempname, stored_state_path)
2783
3541
except (IOError, OSError) as e: