/mandos/release : revision 237.7.127

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

import collections

79

import codecs

80

71

81

72

import dbus

82

73

import dbus.service

83

from gi.repository import GLib

74

import gobject

75

import avahi

84

76

from dbus.mainloop.glib import DBusGMainLoop

85

77

import ctypes

86

78

import ctypes.util

87

79

import xml.dom.minidom

88

80

import inspect

81

import GnuPGInterface

89

82

90

# Try to find the value of SO_BINDTODEVICE:

91

83

try:

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

93

# newer, and it is also the most natural place for it:

94

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

95

85

except AttributeError:

96

86

try:

97

# This is where SO_BINDTODEVICE was up to and including Python

98

# 2.6, and also 3.2:

99

87

from IN import SO_BINDTODEVICE

100

88

except ImportError:

101

# In Python 2.7 it seems to have been removed entirely.

102

# Try running the C preprocessor:

103

try:

104

cc = subprocess.Popen(["cc", "--language=c", "-E",

105

"/dev/stdin"],

106

stdin=subprocess.PIPE,

107

stdout=subprocess.PIPE)

108

stdout = cc.communicate(

109

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

110

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

111

except (OSError, ValueError, IndexError):

112

# No value found

113

SO_BINDTODEVICE = None

114

115

if sys.version_info.major == 2:

116

str = unicode

117

118

version = "1.7.19"

89

SO_BINDTODEVICE = None

90

91

version = "1.5.3"

119

92

stored_state_file = "clients.pickle"

120

93

121

94

logger = logging.getLogger()

122

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

123

98

124

99

try:

125

if_nametoindex = ctypes.cdll.LoadLibrary(

126

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

127

103

except (OSError, AttributeError):

128

129

104

def if_nametoindex(interface):

130

105

"Get an interface index the hard way, i.e. using fcntl()"

131

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

132

107

with contextlib.closing(socket.socket()) as s:

133

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

134

struct.pack(b"16s16x", interface))

135

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

136

113

return interface_index

137

114

138

115

139

def copy_function(func):

140

"""Make a copy of a function"""

141

if sys.version_info.major == 2:

142

return types.FunctionType(func.func_code,

143

func.func_globals,

144

func.func_name,

145

func.func_defaults,

146

func.func_closure)

147

else:

148

return types.FunctionType(func.__code__,

149

func.__globals__,

150

func.__name__,

151

func.__defaults__,

152

func.__closure__)

153

154

155

116

def initlogger(debug, level=logging.WARNING):

156

117

"""init logger and add loglevel"""

157

158

global syslogger

159

syslogger = (logging.handlers.SysLogHandler(

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

161

address="/dev/log"))

118

162

119

syslogger.setFormatter(logging.Formatter

163

120

('Mandos [%(process)d]: %(levelname)s:'

164

121

' %(message)s'))

165

122

logger.addHandler(syslogger)

166

123

167

124

if debug:

168

125

console = logging.StreamHandler()

169

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

181

138

182

139

class PGPEngine(object):

183

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

184

185

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

186

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

187

self.gpg = "gpg"

188

try:

189

output = subprocess.check_output(["gpgconf"])

190

for line in output.splitlines():

191

name, text, path = line.split(b":")

192

if name == "gpg":

193

self.gpg = path

194

break

195

except OSError as e:

196

if e.errno != errno.ENOENT:

197

raise

198

self.gnupgargs = ['--batch',

199

'--homedir', self.tempdir,

200

'--force-mdc',

201

'--quiet']

202

# Only GPG version 1 has the --no-use-agent option.

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

204

self.gnupgargs.append("--no-use-agent")

205

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

206

151

def __enter__(self):

207

152

return self

208

209

def __exit__(self, exc_type, exc_value, traceback):

153

154

def __exit__ (self, exc_type, exc_value, traceback):

210

155

self._cleanup()

211

156

return False

212

157

213

158

def __del__(self):

214

159

self._cleanup()

215

160

216

161

def _cleanup(self):

217

162

if self.tempdir is not None:

218

163

# Delete contents of tempdir

219

164

for root, dirs, files in os.walk(self.tempdir,

220

topdown=False):

165

topdown = False):

221

166

for filename in files:

222

167

os.remove(os.path.join(root, filename))

223

168

for dirname in dirs:

225

170

# Remove tempdir

226

171

os.rmdir(self.tempdir)

227

172

self.tempdir = None

228

173

229

174

def password_encode(self, password):

230

175

# Passphrase can not be empty and can not contain newlines or

231

176

# NUL bytes. So we prefix it and hex encode it.

232

encoded = b"mandos" + binascii.hexlify(password)

233

if len(encoded) > 2048:

234

# GnuPG can't handle long passwords, so encode differently

235

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

236

.replace(b"\n", b"\\n")

237

.replace(b"\0", b"\\x00"))

238

return encoded

239

177

return b"mandos" + binascii.hexlify(password)

178

240

179

def encrypt(self, data, password):

241

passphrase = self.password_encode(password)

242

with tempfile.NamedTemporaryFile(

243

dir=self.tempdir) as passfile:

244

passfile.write(passphrase)

245

passfile.flush()

246

proc = subprocess.Popen([self.gpg, '--symmetric',

247

'--passphrase-file',

248

passfile.name]

249

+ self.gnupgargs,

250

stdin=subprocess.PIPE,

251

stdout=subprocess.PIPE,

252

stderr=subprocess.PIPE)

253

ciphertext, err = proc.communicate(input=data)

254

if proc.returncode != 0:

255

raise PGPError(err)

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

256

194

return ciphertext

257

195

258

196

def decrypt(self, data, password):

259

passphrase = self.password_encode(password)

260

with tempfile.NamedTemporaryFile(

261

dir=self.tempdir) as passfile:

262

passfile.write(passphrase)

263

passfile.flush()

264

proc = subprocess.Popen([self.gpg, '--decrypt',

265

'--passphrase-file',

266

passfile.name]

267

+ self.gnupgargs,

268

stdin=subprocess.PIPE,

269

stdout=subprocess.PIPE,

270

stderr=subprocess.PIPE)

271

decrypted_plaintext, err = proc.communicate(input=data)

272

if proc.returncode != 0:

273

raise PGPError(err)

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

274

211

return decrypted_plaintext

275

212

276

213

277

# Pretend that we have an Avahi module

278

class Avahi(object):

279

"""This isn't so much a class as it is a module-like namespace.

280

It is instantiated once, and simulates having an Avahi module."""

281

IF_UNSPEC = -1 # avahi-common/address.h

282

PROTO_UNSPEC = -1 # avahi-common/address.h

283

PROTO_INET = 0 # avahi-common/address.h

284

PROTO_INET6 = 1 # avahi-common/address.h

285

DBUS_NAME = "org.freedesktop.Avahi"

286

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

287

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

288

DBUS_PATH_SERVER = "/"

289

290

def string_array_to_txt_array(self, t):

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

292

for s in t), signature="ay")

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

294

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

295

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

296

SERVER_INVALID = 0 # avahi-common/defs.h

297

SERVER_REGISTERING = 1 # avahi-common/defs.h

298

SERVER_RUNNING = 2 # avahi-common/defs.h

299

SERVER_COLLISION = 3 # avahi-common/defs.h

300

SERVER_FAILURE = 4 # avahi-common/defs.h

301

avahi = Avahi()

302

303

304

214

class AvahiError(Exception):

305

215

def __init__(self, value, *args, **kwargs):

306

216

self.value = value

307

return super(AvahiError, self).__init__(value, *args,

308

**kwargs)

309

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

310

220

311

221

class AvahiServiceError(AvahiError):

312

222

pass

313

223

314

315

224

class AvahiGroupError(AvahiError):

316

225

pass

317

226

318

227

319

228

class AvahiService(object):

320

229

"""An Avahi (Zeroconf) service.

321

230

322

231

Attributes:

323

232

interface: integer; avahi.IF_UNSPEC or an interface index.

324

233

Used to optionally bind to the specified interface.

325

234

name: string; Example: 'Mandos'

326

235

type: string; Example: '_mandos._tcp'.

327

See <https://www.iana.org/assignments/service-names-port-numbers>

236

See <http://www.dns-sd.org/ServiceTypes.html>

328

237

port: integer; what port to announce

329

238

TXT: list of strings; TXT record for the service

330

239

domain: string; Domain to publish on, default to .local if empty.

336

245

server: D-Bus Server

337

246

bus: dbus.SystemBus()

338

247

"""

339

340

def __init__(self,

341

interface=avahi.IF_UNSPEC,

342

name=None,

343

servicetype=None,

344

port=None,

345

TXT=None,

346

domain="",

347

host="",

348

max_renames=32768,

349

protocol=avahi.PROTO_UNSPEC,

350

bus=None):

248

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

servicetype = None, port = None, TXT = None,

251

domain = "", host = "", max_renames = 32768,

252

protocol = avahi.PROTO_UNSPEC, bus = None):

351

253

self.interface = interface

352

254

self.name = name

353

255

self.type = servicetype

362

264

self.server = None

363

265

self.bus = bus

364

266

self.entry_group_state_changed_match = None

365

366

def rename(self, remove=True):

267

268

def rename(self):

367

269

"""Derived from the Avahi example code"""

368

270

if self.rename_count >= self.max_renames:

369

271

logger.critical("No suitable Zeroconf service name found"

370

272

" after %i retries, exiting.",

371

273

self.rename_count)

372

274

raise AvahiServiceError("Too many renames")

373

self.name = str(

374

self.server.GetAlternativeServiceName(self.name))

375

self.rename_count += 1

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

376

277

logger.info("Changing Zeroconf service name to %r ...",

377

278

self.name)

378

if remove:

379

self.remove()

279

self.remove()

380

280

try:

381

281

self.add()

382

282

except dbus.exceptions.DBusException as error:

383

if (error.get_dbus_name()

384

== "org.freedesktop.Avahi.CollisionError"):

385

logger.info("Local Zeroconf service name collision.")

386

return self.rename(remove=False)

387

else:

388

logger.critical("D-Bus Exception", exc_info=error)

389

self.cleanup()

390

os._exit(1)

391

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

286

self.rename_count += 1

287

392

288

def remove(self):

393

289

"""Derived from the Avahi example code"""

394

290

if self.entry_group_state_changed_match is not None:

396

292

self.entry_group_state_changed_match = None

397

293

if self.group is not None:

398

294

self.group.Reset()

399

295

400

296

def add(self):

401

297

"""Derived from the Avahi example code"""

402

298

self.remove()

419

315

dbus.UInt16(self.port),

420

316

avahi.string_array_to_txt_array(self.TXT))

421

317

self.group.Commit()

422

318

423

319

def entry_group_state_changed(self, state, error):

424

320

"""Derived from the Avahi example code"""

425

321

logger.debug("Avahi entry group state change: %i", state)

426

322

427

323

if state == avahi.ENTRY_GROUP_ESTABLISHED:

428

324

logger.debug("Zeroconf service established.")

429

325

elif state == avahi.ENTRY_GROUP_COLLISION:

431

327

self.rename()

432

328

elif state == avahi.ENTRY_GROUP_FAILURE:

433

329

logger.critical("Avahi: Error in group state changed %s",

434

str(error))

435

raise AvahiGroupError("State changed: {!s}".format(error))

436

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

437

334

def cleanup(self):

438

335

"""Derived from the Avahi example code"""

439

336

if self.group is not None:

444

341

pass

445

342

self.group = None

446

343

self.remove()

447

344

448

345

def server_state_changed(self, state, error=None):

449

346

"""Derived from the Avahi example code"""

450

347

logger.debug("Avahi server state change: %i", state)

451

bad_states = {

452

avahi.SERVER_INVALID: "Zeroconf server invalid",

453

avahi.SERVER_REGISTERING: None,

454

avahi.SERVER_COLLISION: "Zeroconf server name collision",

455

avahi.SERVER_FAILURE: "Zeroconf server failure",

456

}

348

bad_states = { avahi.SERVER_INVALID:

349

"Zeroconf server invalid",

350

avahi.SERVER_REGISTERING: None,

351

avahi.SERVER_COLLISION:

352

"Zeroconf server name collision",

353

avahi.SERVER_FAILURE:

354

"Zeroconf server failure" }

457

355

if state in bad_states:

458

356

if bad_states[state] is not None:

459

357

if error is None:

462

360

logger.error(bad_states[state] + ": %r", error)

463

361

self.cleanup()

464

362

elif state == avahi.SERVER_RUNNING:

465

try:

466

self.add()

467

except dbus.exceptions.DBusException as error:

468

if (error.get_dbus_name()

469

== "org.freedesktop.Avahi.CollisionError"):

470

logger.info("Local Zeroconf service name"

471

" collision.")

472

return self.rename(remove=False)

473

else:

474

logger.critical("D-Bus Exception", exc_info=error)

475

self.cleanup()

476

os._exit(1)

363

self.add()

477

364

else:

478

365

if error is None:

479

366

logger.debug("Unknown state: %r", state)

480

367

else:

481

368

logger.debug("Unknown state: %r: %r", state, error)

482

369

483

370

def activate(self):

484

371

"""Derived from the Avahi example code"""

485

372

if self.server is None:

489

376

follow_name_owner_changes=True),

490

377

avahi.DBUS_INTERFACE_SERVER)

491

378

self.server.connect_to_signal("StateChanged",

492

self.server_state_changed)

379

self.server_state_changed)

493

380

self.server_state_changed(self.server.GetState())

494

381

495

496

382

class AvahiServiceToSyslog(AvahiService):

497

def rename(self, *args, **kwargs):

383

def rename(self):

498

384

"""Add the new name to the syslog messages"""

499

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

500

syslogger.setFormatter(logging.Formatter(

501

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

502

.format(self.name)))

385

ret = AvahiService.rename(self)

386

syslogger.setFormatter(logging.Formatter

387

('Mandos ({0}) [%(process)d]:'

388

' %(levelname)s: %(message)s'

389

.format(self.name)))

503

390

return ret

504

391

505

506

# Pretend that we have a GnuTLS module

507

class GnuTLS(object):

508

"""This isn't so much a class as it is a module-like namespace.

509

It is instantiated once, and simulates having a GnuTLS module."""

510

511

library = ctypes.util.find_library("gnutls")

512

if library is None:

513

library = ctypes.util.find_library("gnutls-deb0")

514

_library = ctypes.cdll.LoadLibrary(library)

515

del library

516

_need_version = b"3.3.0"

517

518

def __init__(self):

519

# Need to use "self" here, since this method is called before

520

# the assignment to the "gnutls" global variable happens.

521

if self.check_version(self._need_version) is None:

522

raise self.Error("Needs GnuTLS {} or later"

523

.format(self._need_version))

524

525

# Unless otherwise indicated, the constants and types below are

526

# all from the gnutls/gnutls.h C header file.

527

528

# Constants

529

E_SUCCESS = 0

530

E_INTERRUPTED = -52

531

E_AGAIN = -28

532

CRT_OPENPGP = 2

533

CLIENT = 2

534

SHUT_RDWR = 0

535

CRD_CERTIFICATE = 1

536

E_NO_CERTIFICATE_FOUND = -49

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

538

539

# Types

540

class session_int(ctypes.Structure):

541

_fields_ = []

542

session_t = ctypes.POINTER(session_int)

543

544

class certificate_credentials_st(ctypes.Structure):

545

_fields_ = []

546

certificate_credentials_t = ctypes.POINTER(

547

certificate_credentials_st)

548

certificate_type_t = ctypes.c_int

549

550

class datum_t(ctypes.Structure):

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

553

554

class openpgp_crt_int(ctypes.Structure):

555

_fields_ = []

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

559

credentials_type_t = ctypes.c_int

560

transport_ptr_t = ctypes.c_void_p

561

close_request_t = ctypes.c_int

562

563

# Exceptions

564

class Error(Exception):

565

# We need to use the class name "GnuTLS" here, since this

566

# exception might be raised from within GnuTLS.__init__,

567

# which is called before the assignment to the "gnutls"

568

# global variable has happened.

569

def __init__(self, message=None, code=None, args=()):

570

# Default usage is by a message string, but if a return

571

# code is passed, convert it to a string with

572

# gnutls.strerror()

573

self.code = code

574

if message is None and code is not None:

575

message = GnuTLS.strerror(code)

576

return super(GnuTLS.Error, self).__init__(

577

message, *args)

578

579

class CertificateSecurityError(Error):

580

pass

581

582

# Classes

583

class Credentials(object):

584

def __init__(self):

585

self._c_object = gnutls.certificate_credentials_t()

586

gnutls.certificate_allocate_credentials(

587

ctypes.byref(self._c_object))

588

self.type = gnutls.CRD_CERTIFICATE

589

590

def __del__(self):

591

gnutls.certificate_free_credentials(self._c_object)

592

593

class ClientSession(object):

594

def __init__(self, socket, credentials=None):

595

self._c_object = gnutls.session_t()

596

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

597

gnutls.set_default_priority(self._c_object)

598

gnutls.transport_set_ptr(self._c_object, socket.fileno())

599

gnutls.handshake_set_private_extensions(self._c_object,

600

True)

601

self.socket = socket

602

if credentials is None:

603

credentials = gnutls.Credentials()

604

gnutls.credentials_set(self._c_object, credentials.type,

605

ctypes.cast(credentials._c_object,

606

ctypes.c_void_p))

607

self.credentials = credentials

608

609

def __del__(self):

610

gnutls.deinit(self._c_object)

611

612

def handshake(self):

613

return gnutls.handshake(self._c_object)

614

615

def send(self, data):

616

data = bytes(data)

617

data_len = len(data)

618

while data_len > 0:

619

data_len -= gnutls.record_send(self._c_object,

620

data[-data_len:],

621

data_len)

622

623

def bye(self):

624

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

625

626

# Error handling functions

627

def _error_code(result):

628

"""A function to raise exceptions on errors, suitable

629

for the 'restype' attribute on ctypes functions"""

630

if result >= 0:

631

return result

632

if result == gnutls.E_NO_CERTIFICATE_FOUND:

633

raise gnutls.CertificateSecurityError(code=result)

634

raise gnutls.Error(code=result)

635

636

def _retry_on_error(result, func, arguments):

637

"""A function to retry on some errors, suitable

638

for the 'errcheck' attribute on ctypes functions"""

639

while result < 0:

640

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

641

return _error_code(result)

642

result = func(*arguments)

643

return result

644

645

# Unless otherwise indicated, the function declarations below are

646

# all from the gnutls/gnutls.h C header file.

647

648

# Functions

649

priority_set_direct = _library.gnutls_priority_set_direct

650

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

651

ctypes.POINTER(ctypes.c_char_p)]

652

priority_set_direct.restype = _error_code

653

654

init = _library.gnutls_init

655

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

656

init.restype = _error_code

657

658

set_default_priority = _library.gnutls_set_default_priority

659

set_default_priority.argtypes = [session_t]

660

set_default_priority.restype = _error_code

661

662

record_send = _library.gnutls_record_send

663

record_send.argtypes = [session_t, ctypes.c_void_p,

664

ctypes.c_size_t]

665

record_send.restype = ctypes.c_ssize_t

666

record_send.errcheck = _retry_on_error

667

668

certificate_allocate_credentials = (

669

_library.gnutls_certificate_allocate_credentials)

670

certificate_allocate_credentials.argtypes = [

671

ctypes.POINTER(certificate_credentials_t)]

672

certificate_allocate_credentials.restype = _error_code

673

674

certificate_free_credentials = (

675

_library.gnutls_certificate_free_credentials)

676

certificate_free_credentials.argtypes = [

677

certificate_credentials_t]

678

certificate_free_credentials.restype = None

679

680

handshake_set_private_extensions = (

681

_library.gnutls_handshake_set_private_extensions)

682

handshake_set_private_extensions.argtypes = [session_t,

683

ctypes.c_int]

684

handshake_set_private_extensions.restype = None

685

686

credentials_set = _library.gnutls_credentials_set

687

credentials_set.argtypes = [session_t, credentials_type_t,

688

ctypes.c_void_p]

689

credentials_set.restype = _error_code

690

691

strerror = _library.gnutls_strerror

692

strerror.argtypes = [ctypes.c_int]

693

strerror.restype = ctypes.c_char_p

694

695

certificate_type_get = _library.gnutls_certificate_type_get

696

certificate_type_get.argtypes = [session_t]

697

certificate_type_get.restype = _error_code

698

699

certificate_get_peers = _library.gnutls_certificate_get_peers

700

certificate_get_peers.argtypes = [session_t,

701

ctypes.POINTER(ctypes.c_uint)]

702

certificate_get_peers.restype = ctypes.POINTER(datum_t)

703

704

global_set_log_level = _library.gnutls_global_set_log_level

705

global_set_log_level.argtypes = [ctypes.c_int]

706

global_set_log_level.restype = None

707

708

global_set_log_function = _library.gnutls_global_set_log_function

709

global_set_log_function.argtypes = [log_func]

710

global_set_log_function.restype = None

711

712

deinit = _library.gnutls_deinit

713

deinit.argtypes = [session_t]

714

deinit.restype = None

715

716

handshake = _library.gnutls_handshake

717

handshake.argtypes = [session_t]

718

handshake.restype = _error_code

719

handshake.errcheck = _retry_on_error

720

721

transport_set_ptr = _library.gnutls_transport_set_ptr

722

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

723

transport_set_ptr.restype = None

724

725

bye = _library.gnutls_bye

726

bye.argtypes = [session_t, close_request_t]

727

bye.restype = _error_code

728

bye.errcheck = _retry_on_error

729

730

check_version = _library.gnutls_check_version

731

check_version.argtypes = [ctypes.c_char_p]

732

check_version.restype = ctypes.c_char_p

733

734

# All the function declarations below are from gnutls/openpgp.h

735

736

openpgp_crt_init = _library.gnutls_openpgp_crt_init

737

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

738

openpgp_crt_init.restype = _error_code

739

740

openpgp_crt_import = _library.gnutls_openpgp_crt_import

741

openpgp_crt_import.argtypes = [openpgp_crt_t,

742

ctypes.POINTER(datum_t),

743

openpgp_crt_fmt_t]

744

openpgp_crt_import.restype = _error_code

745

746

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

747

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

748

ctypes.POINTER(ctypes.c_uint)]

749

openpgp_crt_verify_self.restype = _error_code

750

751

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

752

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

753

openpgp_crt_deinit.restype = None

754

755

openpgp_crt_get_fingerprint = (

756

_library.gnutls_openpgp_crt_get_fingerprint)

757

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

758

ctypes.c_void_p,

759

ctypes.POINTER(

760

ctypes.c_size_t)]

761

openpgp_crt_get_fingerprint.restype = _error_code

762

763

# Remove non-public functions

764

del _error_code, _retry_on_error

765

# Create the global "gnutls" object, simulating a module

766

gnutls = GnuTLS()

767

768

769

def call_pipe(connection, # : multiprocessing.Connection

770

func, *args, **kwargs):

771

"""This function is meant to be called by multiprocessing.Process

772

773

This function runs func(*args, **kwargs), and writes the resulting

774

return value on the provided multiprocessing.Connection.

775

"""

776

connection.send(func(*args, **kwargs))

777

connection.close()

778

392

def timedelta_to_milliseconds(td):

393

"Convert a datetime.timedelta() to milliseconds"

394

return ((td.days * 24 * 60 * 60 * 1000)

395

+ (td.seconds * 1000)

396

+ (td.microseconds // 1000))

779

397

780

398

class Client(object):

781

399

"""A representation of a client host served by this server.

782

400

783

401

Attributes:

784

402

approved: bool(); 'None' if not yet approved/disapproved

785

403

approval_delay: datetime.timedelta(); Time to wait for approval

787

405

checker: subprocess.Popen(); a running checker process used

788

406

to see if the client lives.

789

407

'None' if no process is running.

790

checker_callback_tag: a GLib event source tag, or None

408

checker_callback_tag: a gobject event source tag, or None

791

409

checker_command: string; External command which is run to check

792

410

if client lives. %() expansions are done at

793

411

runtime with vars(self) as dict, so that for

794

412

instance %(name)s can be used in the command.

795

checker_initiator_tag: a GLib event source tag, or None

413

checker_initiator_tag: a gobject event source tag, or None

796

414

created: datetime.datetime(); (UTC) object creation

797

415

client_structure: Object describing what attributes a client has

798

416

and is used for storing the client at exit

799

417

current_checker_command: string; current running checker_command

800

disable_initiator_tag: a GLib event source tag, or None

418

disable_initiator_tag: a gobject event source tag, or None

801

419

enabled: bool()

802

420

fingerprint: string (40 or 32 hexadecimal digits); used to

803

421

uniquely identify the client

808

426

last_checker_status: integer between 0 and 255 reflecting exit

809

427

status of last checker. -1 reflects crashed

810

428

checker, -2 means no checker completed yet.

811

last_checker_signal: The signal which killed the last checker, if

812

last_checker_status is -1

813

429

last_enabled: datetime.datetime(); (UTC) or None

814

430

name: string; from the config file, used in log messages and

815

431

D-Bus identifiers

820

436

runtime_expansions: Allowed attributes for runtime expansion.

821

437

expires: datetime.datetime(); time (UTC) when a client will be

822

438

disabled, or None

823

server_settings: The server_settings dict from main()

824

439

"""

825

440

826

441

runtime_expansions = ("approval_delay", "approval_duration",

827

"created", "enabled", "expires",

828

"fingerprint", "host", "interval",

829

"last_approval_request", "last_checked_ok",

442

"created", "enabled", "fingerprint",

443

"host", "interval", "last_checked_ok",

830

444

"last_enabled", "name", "timeout")

831

client_defaults = {

832

"timeout": "PT5M",

833

"extended_timeout": "PT15M",

834

"interval": "PT2M",

835

"checker": "fping -q -- %%(host)s",

836

"host": "",

837

"approval_delay": "PT0S",

838

"approval_duration": "PT1S",

839

"approved_by_default": "True",

840

"enabled": "True",

841

}

842

445

client_defaults = { "timeout": "5m",

446

"extended_timeout": "15m",

447

"interval": "2m",

448

"checker": "fping -q -- %%(host)s",

449

"host": "",

450

"approval_delay": "0s",

451

"approval_duration": "1s",

452

"approved_by_default": "True",

453

"enabled": "True",

454

}

455

456

def timeout_milliseconds(self):

457

"Return the 'timeout' attribute in milliseconds"

458

return timedelta_to_milliseconds(self.timeout)

459

460

def extended_timeout_milliseconds(self):

461

"Return the 'extended_timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.extended_timeout)

463

464

def interval_milliseconds(self):

465

"Return the 'interval' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.interval)

467

468

def approval_delay_milliseconds(self):

469

return timedelta_to_milliseconds(self.approval_delay)

470

843

471

@staticmethod

844

472

def config_parser(config):

845

473

"""Construct a new dict of client settings of this form:

852

480

for client_name in config.sections():

853

481

section = dict(config.items(client_name))

854

482

client = settings[client_name] = {}

855

483

856

484

client["host"] = section["host"]

857

485

# Reformat values from string types to Python types

858

486

client["approved_by_default"] = config.getboolean(

859

487

client_name, "approved_by_default")

860

488

client["enabled"] = config.getboolean(client_name,

861

489

"enabled")

862

863

# Uppercase and remove spaces from fingerprint for later

864

# comparison purposes with return value from the

865

# fingerprint() function

490

866

491

client["fingerprint"] = (section["fingerprint"].upper()

867

492

.replace(" ", ""))

868

493

if "secret" in section:

869

client["secret"] = codecs.decode(section["secret"]

870

.encode("utf-8"),

871

"base64")

494

client["secret"] = section["secret"].decode("base64")

872

495

elif "secfile" in section:

873

496

with open(os.path.expanduser(os.path.expandvars

874

497

(section["secfile"])),

875

498

"rb") as secfile:

876

499

client["secret"] = secfile.read()

877

500

else:

878

raise TypeError("No secret or secfile for section {}"

501

raise TypeError("No secret or secfile for section {0}"

879

502

.format(section))

880

503

client["timeout"] = string_to_delta(section["timeout"])

881

504

client["extended_timeout"] = string_to_delta(

889

512

client["last_approval_request"] = None

890

513

client["last_checked_ok"] = None

891

514

client["last_checker_status"] = -2

892

515

893

516

return settings

894

895

def __init__(self, settings, name=None, server_settings=None):

517

518

def __init__(self, settings, name = None):

896

519

self.name = name

897

if server_settings is None:

898

server_settings = {}

899

self.server_settings = server_settings

900

520

# adding all client settings

901

for setting, value in settings.items():

521

for setting, value in settings.iteritems():

902

522

setattr(self, setting, value)

903

523

904

524

if self.enabled:

905

525

if not hasattr(self, "last_enabled"):

906

526

self.last_enabled = datetime.datetime.utcnow()

910

530

else:

911

531

self.last_enabled = None

912

532

self.expires = None

913

533

914

534

logger.debug("Creating client %r", self.name)

535

# Uppercase and remove spaces from fingerprint for later

536

# comparison purposes with return value from the fingerprint()

537

# function

915

538

logger.debug(" Fingerprint: %s", self.fingerprint)

916

539

self.created = settings.get("created",

917

540

datetime.datetime.utcnow())

918

541

919

542

# attributes specific for this server instance

920

543

self.checker = None

921

544

self.checker_initiator_tag = None

924

547

self.current_checker_command = None

925

548

self.approved = None

926

549

self.approvals_pending = 0

927

self.changedstate = multiprocessing_manager.Condition(

928

multiprocessing_manager.Lock())

929

self.client_structure = [attr

930

for attr in self.__dict__.keys()

550

self.changedstate = (multiprocessing_manager

551

.Condition(multiprocessing_manager

552

.Lock()))

553

self.client_structure = [attr for attr in

554

self.__dict__.iterkeys()

931

555

if not attr.startswith("_")]

932

556

self.client_structure.append("client_structure")

933

934

for name, t in inspect.getmembers(

935

type(self), lambda obj: isinstance(obj, property)):

557

558

for name, t in inspect.getmembers(type(self),

559

lambda obj:

560

isinstance(obj,

561

property)):

936

562

if not name.startswith("_"):

937

563

self.client_structure.append(name)

938

564

939

565

# Send notice to process children that client state has changed

940

566

def send_changedstate(self):

941

567

with self.changedstate:

942

568

self.changedstate.notify_all()

943

569

944

570

def enable(self):

945

571

"""Start this client's checker and timeout hooks"""

946

572

if getattr(self, "enabled", False):

947

573

# Already enabled

948

574

return

575

self.send_changedstate()

949

576

self.expires = datetime.datetime.utcnow() + self.timeout

950

577

self.enabled = True

951

578

self.last_enabled = datetime.datetime.utcnow()

952

579

self.init_checker()

953

self.send_changedstate()

954

580

955

581

def disable(self, quiet=True):

956

582

"""Disable this client."""

957

583

if not getattr(self, "enabled", False):

958

584

return False

959

585

if not quiet:

586

self.send_changedstate()

587

if not quiet:

960

588

logger.info("Disabling client %s", self.name)

961

if getattr(self, "disable_initiator_tag", None) is not None:

962

GLib.source_remove(self.disable_initiator_tag)

589

if getattr(self, "disable_initiator_tag", False):

590

gobject.source_remove(self.disable_initiator_tag)

963

591

self.disable_initiator_tag = None

964

592

self.expires = None

965

if getattr(self, "checker_initiator_tag", None) is not None:

966

GLib.source_remove(self.checker_initiator_tag)

593

if getattr(self, "checker_initiator_tag", False):

594

gobject.source_remove(self.checker_initiator_tag)

967

595

self.checker_initiator_tag = None

968

596

self.stop_checker()

969

597

self.enabled = False

970

if not quiet:

971

self.send_changedstate()

972

# Do not run this again if called by a GLib.timeout_add

598

# Do not run this again if called by a gobject.timeout_add

973

599

return False

974

600

975

601

def __del__(self):

976

602

self.disable()

977

603

978

604

def init_checker(self):

979

605

# Schedule a new checker to be started an 'interval' from now,

980

606

# and every interval from then on.

981

if self.checker_initiator_tag is not None:

982

GLib.source_remove(self.checker_initiator_tag)

983

self.checker_initiator_tag = GLib.timeout_add(

984

int(self.interval.total_seconds() * 1000),

985

self.start_checker)

607

self.checker_initiator_tag = (gobject.timeout_add

608

(self.interval_milliseconds(),

609

self.start_checker))

986

610

# Schedule a disable() when 'timeout' has passed

987

if self.disable_initiator_tag is not None:

988

GLib.source_remove(self.disable_initiator_tag)

989

self.disable_initiator_tag = GLib.timeout_add(

990

int(self.timeout.total_seconds() * 1000), self.disable)

611

self.disable_initiator_tag = (gobject.timeout_add

612

(self.timeout_milliseconds(),

613

self.disable))

991

614

# Also start a new checker *right now*.

992

615

self.start_checker()

993

994

def checker_callback(self, source, condition, connection,

995

command):

616

617

def checker_callback(self, pid, condition, command):

996

618

"""The checker has completed, so take appropriate actions."""

997

619

self.checker_callback_tag = None

998

620

self.checker = None

999

# Read return code from connection (see call_pipe)

1000

returncode = connection.recv()

1001

connection.close()

1002

1003

if returncode >= 0:

1004

self.last_checker_status = returncode

1005

self.last_checker_signal = None

621

if os.WIFEXITED(condition):

622

self.last_checker_status = os.WEXITSTATUS(condition)

1006

623

if self.last_checker_status == 0:

1007

624

logger.info("Checker for %(name)s succeeded",

1008

625

vars(self))

1009

626

self.checked_ok()

1010

627

else:

1011

logger.info("Checker for %(name)s failed", vars(self))

628

logger.info("Checker for %(name)s failed",

629

vars(self))

1012

630

else:

1013

631

self.last_checker_status = -1

1014

self.last_checker_signal = -returncode

1015

632

logger.warning("Checker for %(name)s crashed?",

1016

633

vars(self))

1017

return False

1018

634

1019

635

def checked_ok(self):

1020

636

"""Assert that the client has been seen, alive and well."""

1021

637

self.last_checked_ok = datetime.datetime.utcnow()

1022

638

self.last_checker_status = 0

1023

self.last_checker_signal = None

1024

639

self.bump_timeout()

1025

640

1026

641

def bump_timeout(self, timeout=None):

1027

642

"""Bump up the timeout for this client."""

1028

643

if timeout is None:

1029

644

timeout = self.timeout

1030

645

if self.disable_initiator_tag is not None:

1031

GLib.source_remove(self.disable_initiator_tag)

1032

self.disable_initiator_tag = None

646

gobject.source_remove(self.disable_initiator_tag)

1033

647

if getattr(self, "enabled", False):

1034

self.disable_initiator_tag = GLib.timeout_add(

1035

int(timeout.total_seconds() * 1000), self.disable)

648

self.disable_initiator_tag = (gobject.timeout_add

649

(timedelta_to_milliseconds

650

(timeout), self.disable))

1036

651

self.expires = datetime.datetime.utcnow() + timeout

1037

652

1038

653

def need_approval(self):

1039

654

self.last_approval_request = datetime.datetime.utcnow()

1040

655

1041

656

def start_checker(self):

1042

657

"""Start a new checker subprocess if one is not running.

1043

658

1044

659

If a checker already exists, leave it running and do

1045

660

nothing."""

1046

661

# The reason for not killing a running checker is that if we

1051

666

# checkers alone, the checker would have to take more time

1052

667

# than 'timeout' for the client to be disabled, which is as it

1053

668

# should be.

1054

1055

if self.checker is not None and not self.checker.is_alive():

1056

logger.warning("Checker was not alive; joining")

1057

self.checker.join()

1058

self.checker = None

669

670

# If a checker exists, make sure it is not a zombie

671

try:

672

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

673

except (AttributeError, OSError) as error:

674

if (isinstance(error, OSError)

675

and error.errno != errno.ECHILD):

676

raise error

677

else:

678

if pid:

679

logger.warning("Checker was a zombie")

680

gobject.source_remove(self.checker_callback_tag)

681

self.checker_callback(pid, status,

682

self.current_checker_command)

1059

683

# Start a new checker if needed

1060

684

if self.checker is None:

1061

# Escape attributes for the shell

1062

escaped_attrs = {

1063

attr: re.escape(str(getattr(self, attr)))

1064

for attr in self.runtime_expansions}

1065

try:

1066

command = self.checker_command % escaped_attrs

1067

except TypeError as error:

1068

logger.error('Could not format string "%s"',

1069

self.checker_command,

685

try:

686

# In case checker_command has exactly one % operator

687

command = self.checker_command % self.host

688

except TypeError:

689

# Escape attributes for the shell

690

escaped_attrs = dict(

691

(attr,

692

re.escape(unicode(str(getattr(self, attr, "")),

693

errors=

694

'replace')))

695

for attr in

696

self.runtime_expansions)

697

698

try:

699

command = self.checker_command % escaped_attrs

700

except TypeError as error:

701

logger.error('Could not format string "%s"',

702

self.checker_command, exc_info=error)

703

return True # Try again later

704

self.current_checker_command = command

705

try:

706

logger.info("Starting checker %r for %s",

707

command, self.name)

708

# We don't need to redirect stdout and stderr, since

709

# in normal mode, that is already done by daemon(),

710

# and in debug mode we don't want to. (Stdin is

711

# always replaced by /dev/null.)

712

self.checker = subprocess.Popen(command,

713

close_fds=True,

714

shell=True, cwd="/")

715

self.checker_callback_tag = (gobject.child_watch_add

716

(self.checker.pid,

717

self.checker_callback,

718

data=command))

719

# The checker may have completed before the gobject

720

# watch was added. Check for this.

721

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

722

if pid:

723

gobject.source_remove(self.checker_callback_tag)

724

self.checker_callback(pid, status, command)

725

except OSError as error:

726

logger.error("Failed to start subprocess",

1070

727

exc_info=error)

1071

return True # Try again later

1072

self.current_checker_command = command

1073

logger.info("Starting checker %r for %s", command,

1074

self.name)

1075

# We don't need to redirect stdout and stderr, since

1076

# in normal mode, that is already done by daemon(),

1077

# and in debug mode we don't want to. (Stdin is

1078

# always replaced by /dev/null.)

1079

# The exception is when not debugging but nevertheless

1080

# running in the foreground; use the previously

1081

# created wnull.

1082

popen_args = {"close_fds": True,

1083

"shell": True,

1084

"cwd": "/"}

1085

if (not self.server_settings["debug"]

1086

and self.server_settings["foreground"]):

1087

popen_args.update({"stdout": wnull,

1088

"stderr": wnull})

1089

pipe = multiprocessing.Pipe(duplex=False)

1090

self.checker = multiprocessing.Process(

1091

target=call_pipe,

1092

args=(pipe[1], subprocess.call, command),

1093

kwargs=popen_args)

1094

self.checker.start()

1095

self.checker_callback_tag = GLib.io_add_watch(

1096

pipe[0].fileno(), GLib.IO_IN,

1097

self.checker_callback, pipe[0], command)

1098

# Re-run this periodically if run by GLib.timeout_add

728

# Re-run this periodically if run by gobject.timeout_add

1099

729

return True

1100

730

1101

731

def stop_checker(self):

1102

732

"""Force the checker process, if any, to stop."""

1103

733

if self.checker_callback_tag:

1104

GLib.source_remove(self.checker_callback_tag)

734

gobject.source_remove(self.checker_callback_tag)

1105

735

self.checker_callback_tag = None

1106

736

if getattr(self, "checker", None) is None:

1107

737

return

1108

738

logger.debug("Stopping checker for %(name)s", vars(self))

1109

self.checker.terminate()

739

try:

740

self.checker.terminate()

741

#time.sleep(0.5)

742

#if self.checker.poll() is None:

743

# self.checker.kill()

744

except OSError as error:

745

if error.errno != errno.ESRCH: # No such process

746

raise

1110

747

self.checker = None

1111

748

1112

749

1113

def dbus_service_property(dbus_interface,

1114

signature="v",

1115

access="readwrite",

1116

byte_arrays=False):

750

def dbus_service_property(dbus_interface, signature="v",

751

access="readwrite", byte_arrays=False):

1117

752

"""Decorators for marking methods of a DBusObjectWithProperties to

1118

753

become properties on the D-Bus.

1119

754

1120

755

The decorated method will be called with no arguments by "Get"

1121

756

and with one argument by "Set".

1122

757

1123

758

The parameters, where they are supported, are the same as

1124

759

dbus.service.method, except there is only "signature", since the

1125

760

type from Get() and the type sent to Set() is the same.

1128

763

# "Set" method, so we fail early here:

1129

764

if byte_arrays and signature != "ay":

1130

765

raise ValueError("Byte arrays not supported for non-'ay'"

1131

" signature {!r}".format(signature))

1132

766

" signature {0!r}".format(signature))

1133

767

def decorator(func):

1134

768

func._dbus_is_property = True

1135

769

func._dbus_interface = dbus_interface

1138

772

func._dbus_name = func.__name__

1139

773

if func._dbus_name.endswith("_dbus_property"):

1140

774

func._dbus_name = func._dbus_name[:-14]

1141

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

775

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1142

776

return func

1143

1144

777

return decorator

1145

778

1146

779

1147

780

def dbus_interface_annotations(dbus_interface):

1148

781

"""Decorator for marking functions returning interface annotations

1149

782

1150

783

Usage:

1151

784

1152

785

@dbus_interface_annotations("org.example.Interface")

1153

786

def _foo(self): # Function name does not matter

1154

787

return {"org.freedesktop.DBus.Deprecated": "true",

1155

788

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1156

789

"false"}

1157

790

"""

1158

1159

791

def decorator(func):

1160

792

func._dbus_is_interface = True

1161

793

func._dbus_interface = dbus_interface

1162

794

func._dbus_name = dbus_interface

1163

795

return func

1164

1165

796

return decorator

1166

797

1167

798

1168

799

def dbus_annotations(annotations):

1169

800

"""Decorator to annotate D-Bus methods, signals or properties

1170

801

Usage:

1171

1172

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1173

"org.freedesktop.DBus.Property."

1174

"EmitsChangedSignal": "false"})

802

1175

803

@dbus_service_property("org.example.Interface", signature="b",

1176

804

access="r")

805

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

806

"org.freedesktop.DBus.Property."

807

"EmitsChangedSignal": "false"})

1177

808

def Property_dbus_property(self):

1178

809

return dbus.Boolean(False)

1179

1180

See also the DBusObjectWithAnnotations class.

1181

810

"""

1182

1183

811

def decorator(func):

1184

812

func._dbus_annotations = annotations

1185

813

return func

1186

1187

814

return decorator

1188

815

1189

816

1190

817

class DBusPropertyException(dbus.exceptions.DBusException):

1191

818

"""A base class for D-Bus property-related exceptions

1192

819

"""

1193

pass

820

def __unicode__(self):

821

return unicode(str(self))

1194

822

1195

823

1196

824

class DBusPropertyAccessException(DBusPropertyException):

1205

833

pass

1206

834

1207

835

1208

class DBusObjectWithAnnotations(dbus.service.Object):

1209

"""A D-Bus object with annotations.

1210

1211

Classes inheriting from this can use the dbus_annotations

1212

decorator to add annotations to methods or signals.

836

class DBusObjectWithProperties(dbus.service.Object):

837

"""A D-Bus object with properties.

838

839

Classes inheriting from this can use the dbus_service_property

840

decorator to expose methods as D-Bus properties. It exposes the

841

standard Get(), Set(), and GetAll() methods on the D-Bus.

1213

842

"""

1214

843

1215

844

@staticmethod

1216

845

def _is_dbus_thing(thing):

1217

846

"""Returns a function testing if an attribute is a D-Bus thing

1218

847

1219

848

If called like _is_dbus_thing("method") it returns a function

1220

849

suitable for use as predicate to inspect.getmembers().

1221

850

"""

1222

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

851

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1223

852

False)

1224

853

1225

854

def _get_all_dbus_things(self, thing):

1226

855

"""Returns a generator of (name, attribute) pairs

1227

856

"""

1228

return ((getattr(athing.__get__(self), "_dbus_name", name),

857

return ((getattr(athing.__get__(self), "_dbus_name",

858

name),

1229

859

athing.__get__(self))

1230

860

for cls in self.__class__.__mro__

1231

861

for name, athing in

1232

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1233

1234

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1235

out_signature="s",

1236

path_keyword='object_path',

1237

connection_keyword='connection')

1238

def Introspect(self, object_path, connection):

1239

"""Overloading of standard D-Bus method.

1240

1241

Inserts annotation tags on methods and signals.

1242

"""

1243

xmlstring = dbus.service.Object.Introspect(self, object_path,

1244

connection)

1245

try:

1246

document = xml.dom.minidom.parseString(xmlstring)

1247

1248

for if_tag in document.getElementsByTagName("interface"):

1249

# Add annotation tags

1250

for typ in ("method", "signal"):

1251

for tag in if_tag.getElementsByTagName(typ):

1252

annots = dict()

1253

for name, prop in (self.

1254

_get_all_dbus_things(typ)):

1255

if (name == tag.getAttribute("name")

1256

and prop._dbus_interface

1257

== if_tag.getAttribute("name")):

1258

annots.update(getattr(

1259

prop, "_dbus_annotations", {}))

1260

for name, value in annots.items():

1261

ann_tag = document.createElement(

1262

"annotation")

1263

ann_tag.setAttribute("name", name)

1264

ann_tag.setAttribute("value", value)

1265

tag.appendChild(ann_tag)

1266

# Add interface annotation tags

1267

for annotation, value in dict(

1268

itertools.chain.from_iterable(

1269

annotations().items()

1270

for name, annotations

1271

in self._get_all_dbus_things("interface")

1272

if name == if_tag.getAttribute("name")

1273

)).items():

1274

ann_tag = document.createElement("annotation")

1275

ann_tag.setAttribute("name", annotation)

1276

ann_tag.setAttribute("value", value)

1277

if_tag.appendChild(ann_tag)

1278

# Fix argument name for the Introspect method itself

1279

if (if_tag.getAttribute("name")

1280

== dbus.INTROSPECTABLE_IFACE):

1281

for cn in if_tag.getElementsByTagName("method"):

1282

if cn.getAttribute("name") == "Introspect":

1283

for arg in cn.getElementsByTagName("arg"):

1284

if (arg.getAttribute("direction")

1285

== "out"):

1286

arg.setAttribute("name",

1287

"xml_data")

1288

xmlstring = document.toxml("utf-8")

1289

document.unlink()

1290

except (AttributeError, xml.dom.DOMException,

1291

xml.parsers.expat.ExpatError) as error:

1292

logger.error("Failed to override Introspection method",

1293

exc_info=error)

1294

return xmlstring

1295

1296

1297

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1298

"""A D-Bus object with properties.

1299

1300

Classes inheriting from this can use the dbus_service_property

1301

decorator to expose methods as D-Bus properties. It exposes the

1302

standard Get(), Set(), and GetAll() methods on the D-Bus.

1303

"""

1304

862

inspect.getmembers(cls,

863

self._is_dbus_thing(thing)))

864

1305

865

def _get_dbus_property(self, interface_name, property_name):

1306

866

"""Returns a bound method if one exists which is a D-Bus

1307

867

property with the specified name and interface.

1308

868

"""

1309

for cls in self.__class__.__mro__:

1310

for name, value in inspect.getmembers(

1311

cls, self._is_dbus_thing("property")):

869

for cls in self.__class__.__mro__:

870

for name, value in (inspect.getmembers

871

(cls,

872

self._is_dbus_thing("property"))):

1312

873

if (value._dbus_name == property_name

1313

874

and value._dbus_interface == interface_name):

1314

875

return value.__get__(self)

1315

876

1316

877

# No such property

1317

raise DBusPropertyNotFound("{}:{}.{}".format(

1318

self.dbus_object_path, interface_name, property_name))

1319

1320

@classmethod

1321

def _get_all_interface_names(cls):

1322

"""Get a sequence of all interfaces supported by an object"""

1323

return (name for name in set(getattr(getattr(x, attr),

1324

"_dbus_interface", None)

1325

for x in (inspect.getmro(cls))

1326

for attr in dir(x))

1327

if name is not None)

1328

1329

@dbus.service.method(dbus.PROPERTIES_IFACE,

1330

in_signature="ss",

878

raise DBusPropertyNotFound(self.dbus_object_path + ":"

879

+ interface_name + "."

880

+ property_name)

881

882

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1331

883

out_signature="v")

1332

884

def Get(self, interface_name, property_name):

1333

885

"""Standard D-Bus property Get() method, see D-Bus standard.

1339

891

if not hasattr(value, "variant_level"):

1340

892

return value

1341

893

return type(value)(value, variant_level=value.variant_level+1)

1342

894

1343

895

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1344

896

def Set(self, interface_name, property_name, value):

1345

897

"""Standard D-Bus property Set() method, see D-Bus standard.

1351

903

# The byte_arrays option is not supported yet on

1352

904

# signatures other than "ay".

1353

905

if prop._dbus_signature != "ay":

1354

raise ValueError("Byte arrays not supported for non-"

1355

"'ay' signature {!r}"

1356

.format(prop._dbus_signature))

906

raise ValueError

1357

907

value = dbus.ByteArray(b''.join(chr(byte)

1358

908

for byte in value))

1359

909

prop(value)

1360

1361

@dbus.service.method(dbus.PROPERTIES_IFACE,

1362

in_signature="s",

910

911

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1363

912

out_signature="a{sv}")

1364

913

def GetAll(self, interface_name):

1365

914

"""Standard D-Bus property GetAll() method, see D-Bus

1366

915

standard.

1367

916

1368

917

Note: Will not include properties with access="write".

1369

918

"""

1370

919

properties = {}

1380

929

if not hasattr(value, "variant_level"):

1381

930

properties[name] = value

1382

931

continue

1383

properties[name] = type(value)(

1384

value, variant_level=value.variant_level + 1)

932

properties[name] = type(value)(value, variant_level=

933

value.variant_level+1)

1385

934

return dbus.Dictionary(properties, signature="sv")

1386

1387

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1388

def PropertiesChanged(self, interface_name, changed_properties,

1389

invalidated_properties):

1390

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1391

standard.

1392

"""

1393

pass

1394

935

1395

936

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1396

937

out_signature="s",

1397

938

path_keyword='object_path',

1398

939

connection_keyword='connection')

1399

940

def Introspect(self, object_path, connection):

1400

941

"""Overloading of standard D-Bus method.

1401

942

1402

943

Inserts property tags and interface annotation tags.

1403

944

"""

1404

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1405

object_path,

1406

connection)

945

xmlstring = dbus.service.Object.Introspect(self, object_path,

946

connection)

1407

947

try:

1408

948

document = xml.dom.minidom.parseString(xmlstring)

1409

1410

949

def make_tag(document, name, prop):

1411

950

e = document.createElement("property")

1412

951

e.setAttribute("name", name)

1413

952

e.setAttribute("type", prop._dbus_signature)

1414

953

e.setAttribute("access", prop._dbus_access)

1415

954

return e

1416

1417

955

for if_tag in document.getElementsByTagName("interface"):

1418

956

# Add property tags

1419

957

for tag in (make_tag(document, name, prop)

1422

960

if prop._dbus_interface

1423

961

== if_tag.getAttribute("name")):

1424

962

if_tag.appendChild(tag)

1425

# Add annotation tags for properties

1426

for tag in if_tag.getElementsByTagName("property"):

1427

annots = dict()

1428

for name, prop in self._get_all_dbus_things(

1429

"property"):

1430

if (name == tag.getAttribute("name")

1431

and prop._dbus_interface

1432

== if_tag.getAttribute("name")):

1433

annots.update(getattr(

1434

prop, "_dbus_annotations", {}))

1435

for name, value in annots.items():

1436

ann_tag = document.createElement(

1437

"annotation")

1438

ann_tag.setAttribute("name", name)

1439

ann_tag.setAttribute("value", value)

1440

tag.appendChild(ann_tag)

963

# Add annotation tags

964

for typ in ("method", "signal", "property"):

965

for tag in if_tag.getElementsByTagName(typ):

966

annots = dict()

967

for name, prop in (self.

968

_get_all_dbus_things(typ)):

969

if (name == tag.getAttribute("name")

970

and prop._dbus_interface

971

== if_tag.getAttribute("name")):

972

annots.update(getattr

973

(prop,

974

"_dbus_annotations",

975

{}))

976

for name, value in annots.iteritems():

977

ann_tag = document.createElement(

978

"annotation")

979

ann_tag.setAttribute("name", name)

980

ann_tag.setAttribute("value", value)

981

tag.appendChild(ann_tag)

982

# Add interface annotation tags

983

for annotation, value in dict(

984

itertools.chain.from_iterable(

985

annotations().iteritems()

986

for name, annotations in

987

self._get_all_dbus_things("interface")

988

if name == if_tag.getAttribute("name")

989

)).iteritems():

990

ann_tag = document.createElement("annotation")

991

ann_tag.setAttribute("name", annotation)

992

ann_tag.setAttribute("value", value)

993

if_tag.appendChild(ann_tag)

1441

994

# Add the names to the return values for the

1442

995

# "org.freedesktop.DBus.Properties" methods

1443

996

if (if_tag.getAttribute("name")

1462

1015

return xmlstring

1463

1016

1464

1017

1465

try:

1466

dbus.OBJECT_MANAGER_IFACE

1467

except AttributeError:

1468

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1469

1470

1471

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1472

"""A D-Bus object with an ObjectManager.

1473

1474

Classes inheriting from this exposes the standard

1475

GetManagedObjects call and the InterfacesAdded and

1476

InterfacesRemoved signals on the standard

1477

"org.freedesktop.DBus.ObjectManager" interface.

1478

1479

Note: No signals are sent automatically; they must be sent

1480

manually.

1481

"""

1482

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1483

out_signature="a{oa{sa{sv}}}")

1484

def GetManagedObjects(self):

1485

"""This function must be overridden"""

1486

raise NotImplementedError()

1487

1488

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1489

signature="oa{sa{sv}}")

1490

def InterfacesAdded(self, object_path, interfaces_and_properties):

1491

pass

1492

1493

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1494

def InterfacesRemoved(self, object_path, interfaces):

1495

pass

1496

1497

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1498

out_signature="s",

1499

path_keyword='object_path',

1500

connection_keyword='connection')

1501

def Introspect(self, object_path, connection):

1502

"""Overloading of standard D-Bus method.

1503

1504

Override return argument name of GetManagedObjects to be

1505

"objpath_interfaces_and_properties"

1506

"""

1507

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1508

object_path,

1509

connection)

1510

try:

1511

document = xml.dom.minidom.parseString(xmlstring)

1512

1513

for if_tag in document.getElementsByTagName("interface"):

1514

# Fix argument name for the GetManagedObjects method

1515

if (if_tag.getAttribute("name")

1516

== dbus.OBJECT_MANAGER_IFACE):

1517

for cn in if_tag.getElementsByTagName("method"):

1518

if (cn.getAttribute("name")

1519

== "GetManagedObjects"):

1520

for arg in cn.getElementsByTagName("arg"):

1521

if (arg.getAttribute("direction")

1522

== "out"):

1523

arg.setAttribute(

1524

"name",

1525

"objpath_interfaces"

1526

"_and_properties")

1527

xmlstring = document.toxml("utf-8")

1528

document.unlink()

1529

except (AttributeError, xml.dom.DOMException,

1530

xml.parsers.expat.ExpatError) as error:

1531

logger.error("Failed to override Introspection method",

1532

exc_info=error)

1533

return xmlstring

1534

1535

1536

def datetime_to_dbus(dt, variant_level=0):

1018

def datetime_to_dbus (dt, variant_level=0):

1537

1019

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1538

1020

if dt is None:

1539

return dbus.String("", variant_level=variant_level)

1540

return dbus.String(dt.isoformat(), variant_level=variant_level)

1021

return dbus.String("", variant_level = variant_level)

1022

return dbus.String(dt.isoformat(),

1023

variant_level=variant_level)

1541

1024

1542

1025

1543

1026

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1545

1028

dbus.service.Object, it will add alternate D-Bus attributes with

1546

1029

interface names according to the "alt_interface_names" mapping.

1547

1030

Usage:

1548

1549

@alternate_dbus_interfaces({"org.example.Interface":

1550

"net.example.AlternateInterface"})

1031

1032

@alternate_dbus_names({"org.example.Interface":

1033

"net.example.AlternateInterface"})

1551

1034

class SampleDBusObject(dbus.service.Object):

1552

1035

@dbus.service.method("org.example.Interface")

1553

1036

def SampleDBusMethod():

1554

1037

pass

1555

1038

1556

1039

The above "SampleDBusMethod" on "SampleDBusObject" will be

1557

1040

reachable via two interfaces: "org.example.Interface" and

1558

1041

"net.example.AlternateInterface", the latter of which will have

1559

1042

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1560

1043

"true", unless "deprecate" is passed with a False value.

1561

1044

1562

1045

This works for methods and signals, and also for D-Bus properties

1563

1046

(from DBusObjectWithProperties) and interfaces (from the

1564

1047

dbus_interface_annotations decorator).

1565

1048

"""

1566

1567

1049

def wrapper(cls):

1568

1050

for orig_interface_name, alt_interface_name in (

1569

alt_interface_names.items()):

1051

alt_interface_names.iteritems()):

1570

1052

attr = {}

1571

1053

interface_names = set()

1572

1054

# Go though all attributes of the class

1574

1056

# Ignore non-D-Bus attributes, and D-Bus attributes

1575

1057

# with the wrong interface name

1576

1058

if (not hasattr(attribute, "_dbus_interface")

1577

or not attribute._dbus_interface.startswith(

1578

orig_interface_name)):

1059

or not attribute._dbus_interface

1060

.startswith(orig_interface_name)):

1579

1061

continue

1580

1062

# Create an alternate D-Bus interface name based on

1581

1063

# the current name

1582

alt_interface = attribute._dbus_interface.replace(

1583

orig_interface_name, alt_interface_name)

1064

alt_interface = (attribute._dbus_interface

1065

.replace(orig_interface_name,

1066

alt_interface_name))

1584

1067

interface_names.add(alt_interface)

1585

1068

# Is this a D-Bus signal?

1586

1069

if getattr(attribute, "_dbus_is_signal", False):

1587

# Extract the original non-method undecorated

1588

# function by black magic

1589

if sys.version_info.major == 2:

1590

nonmethod_func = (dict(

1070

# Extract the original non-method function by

1071

# black magic

1072

nonmethod_func = (dict(

1591

1073

zip(attribute.func_code.co_freevars,

1592

attribute.__closure__))

1593

["func"].cell_contents)

1594

else:

1595

nonmethod_func = (dict(

1596

zip(attribute.__code__.co_freevars,

1597

attribute.__closure__))

1598

["func"].cell_contents)

1074

attribute.__closure__))["func"]

1075

.cell_contents)

1599

1076

# Create a new, but exactly alike, function

1600

1077

# object, and decorate it to be a new D-Bus signal

1601

1078

# with the alternate D-Bus interface name

1602

new_function = copy_function(nonmethod_func)

1603

new_function = (dbus.service.signal(

1604

alt_interface,

1605

attribute._dbus_signature)(new_function))

1079

new_function = (dbus.service.signal

1080

(alt_interface,

1081

attribute._dbus_signature)

1082

(types.FunctionType(

1083

nonmethod_func.func_code,

1084

nonmethod_func.func_globals,

1085

nonmethod_func.func_name,

1086

nonmethod_func.func_defaults,

1087

nonmethod_func.func_closure)))

1606

1088

# Copy annotations, if any

1607

1089

try:

1608

new_function._dbus_annotations = dict(

1609

attribute._dbus_annotations)

1090

new_function._dbus_annotations = (

1091

dict(attribute._dbus_annotations))

1610

1092

except AttributeError:

1611

1093

pass

1612

1613

1094

# Define a creator of a function to call both the

1614

1095

# original and alternate functions, so both the

1615

1096

# original and alternate signals gets sent when

1618

1099

"""This function is a scope container to pass

1619

1100

func1 and func2 to the "call_both" function

1620

1101

outside of its arguments"""

1621

1622

@functools.wraps(func2)

1623

1102

def call_both(*args, **kwargs):

1624

1103

"""This function will emit two D-Bus

1625

1104

signals by calling func1 and func2"""

1626

1105

func1(*args, **kwargs)

1627

1106

func2(*args, **kwargs)

1628

# Make wrapper function look like a D-Bus

1629

# signal

1630

for name, attr in inspect.getmembers(func2):

1631

if name.startswith("_dbus_"):

1632

setattr(call_both, name, attr)

1633

1634

1107

return call_both

1635

1108

# Create the "call_both" function and add it to

1636

1109

# the class

1641

1114

# object. Decorate it to be a new D-Bus method

1642

1115

# with the alternate D-Bus interface name. Add it

1643

1116

# to the class.

1644

attr[attrname] = (

1645

dbus.service.method(

1646

alt_interface,

1647

attribute._dbus_in_signature,

1648

attribute._dbus_out_signature)

1649

(copy_function(attribute)))

1117

attr[attrname] = (dbus.service.method

1118

(alt_interface,

1119

attribute._dbus_in_signature,

1120

attribute._dbus_out_signature)

1121

(types.FunctionType

1122

(attribute.func_code,

1123

attribute.func_globals,

1124

attribute.func_name,

1125

attribute.func_defaults,

1126

attribute.func_closure)))

1650

1127

# Copy annotations, if any

1651

1128

try:

1652

attr[attrname]._dbus_annotations = dict(

1653

attribute._dbus_annotations)

1129

attr[attrname]._dbus_annotations = (

1130

dict(attribute._dbus_annotations))

1654

1131

except AttributeError:

1655

1132

pass

1656

1133

# Is this a D-Bus property?

1659

1136

# object, and decorate it to be a new D-Bus

1660

1137

# property with the alternate D-Bus interface

1661

1138

# name. Add it to the class.

1662

attr[attrname] = (dbus_service_property(

1663

alt_interface, attribute._dbus_signature,

1664

attribute._dbus_access,

1665

attribute._dbus_get_args_options

1666

["byte_arrays"])

1667

(copy_function(attribute)))

1139

attr[attrname] = (dbus_service_property

1140

(alt_interface,

1141

attribute._dbus_signature,

1142

attribute._dbus_access,

1143

attribute

1144

._dbus_get_args_options

1145

["byte_arrays"])

1146

(types.FunctionType

1147

(attribute.func_code,

1148

attribute.func_globals,

1149

attribute.func_name,

1150

attribute.func_defaults,

1151

attribute.func_closure)))

1668

1152

# Copy annotations, if any

1669

1153

try:

1670

attr[attrname]._dbus_annotations = dict(

1671

attribute._dbus_annotations)

1154

attr[attrname]._dbus_annotations = (

1155

dict(attribute._dbus_annotations))

1672

1156

except AttributeError:

1673

1157

pass

1674

1158

# Is this a D-Bus interface?

1677

1161

# object. Decorate it to be a new D-Bus interface

1678

1162

# with the alternate D-Bus interface name. Add it

1679

1163

# to the class.

1680

attr[attrname] = (

1681

dbus_interface_annotations(alt_interface)

1682

(copy_function(attribute)))

1164

attr[attrname] = (dbus_interface_annotations

1165

(alt_interface)

1166

(types.FunctionType

1167

(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1683

1172

if deprecate:

1684

1173

# Deprecate all alternate interfaces

1685

iname = "_AlternateDBusNames_interface_annotation{}"

1174

iname="_AlternateDBusNames_interface_annotation{0}"

1686

1175

for interface_name in interface_names:

1687

1688

1176

@dbus_interface_annotations(interface_name)

1689

1177

def func(self):

1690

return {"org.freedesktop.DBus.Deprecated":

1691

"true"}

1178

return { "org.freedesktop.DBus.Deprecated":

1179

"true" }

1692

1180

# Find an unused name

1693

1181

for aname in (iname.format(i)

1694

1182

for i in itertools.count()):

1698

1186

if interface_names:

1699

1187

# Replace the class with a new subclass of it with

1700

1188

# methods, signals, etc. as created above.

1701

if sys.version_info.major == 2:

1702

cls = type(b"{}Alternate".format(cls.__name__),

1703

(cls, ), attr)

1704

else:

1705

cls = type("{}Alternate".format(cls.__name__),

1706

(cls, ), attr)

1189

cls = type(b"{0}Alternate".format(cls.__name__),

1190

(cls,), attr)

1707

1191

return cls

1708

1709

1192

return wrapper

1710

1193

1711

1194

1712

1195

@alternate_dbus_interfaces({"se.recompile.Mandos":

1713

"se.bsnet.fukt.Mandos"})

1196

"se.bsnet.fukt.Mandos"})

1714

1197

class ClientDBus(Client, DBusObjectWithProperties):

1715

1198

"""A Client class using D-Bus

1716

1199

1717

1200

Attributes:

1718

1201

dbus_object_path: dbus.ObjectPath

1719

1202

bus: dbus.SystemBus()

1720

1203

"""

1721

1204

1722

1205

runtime_expansions = (Client.runtime_expansions

1723

+ ("dbus_object_path", ))

1724

1725

_interface = "se.recompile.Mandos.Client"

1726

1206

+ ("dbus_object_path",))

1207

1727

1208

# dbus.service.Object doesn't use super(), so we can't either.

1728

1729

def __init__(self, bus=None, *args, **kwargs):

1209

1210

def __init__(self, bus = None, *args, **kwargs):

1730

1211

self.bus = bus

1731

1212

Client.__init__(self, *args, **kwargs)

1732

1213

# Only now, when this client is initialized, can it show up on

1733

1214

# the D-Bus

1734

client_object_name = str(self.name).translate(

1215

client_object_name = unicode(self.name).translate(

1735

1216

{ord("."): ord("_"),

1736

1217

ord("-"): ord("_")})

1737

self.dbus_object_path = dbus.ObjectPath(

1738

"/clients/" + client_object_name)

1218

self.dbus_object_path = (dbus.ObjectPath

1219

("/clients/" + client_object_name))

1739

1220

DBusObjectWithProperties.__init__(self, self.bus,

1740

1221

self.dbus_object_path)

1741

1742

def notifychangeproperty(transform_func, dbus_name,

1743

type_func=lambda x: x,

1744

variant_level=1,

1745

invalidate_only=False,

1746

_interface=_interface):

1222

1223

def notifychangeproperty(transform_func,

1224

dbus_name, type_func=lambda x: x,

1225

variant_level=1):

1747

1226

""" Modify a variable so that it's a property which announces

1748

1227

its changes to DBus.

1749

1228

1750

1229

transform_fun: Function that takes a value and a variant_level

1751

1230

and transforms it to a D-Bus type.

1752

1231

dbus_name: D-Bus name of the variable

1754

1233

to the D-Bus. Default: no transform

1755

1234

variant_level: D-Bus variant level. Default: 1

1756

1235

"""

1757

attrname = "_{}".format(dbus_name)

1758

1236

attrname = "_{0}".format(dbus_name)

1759

1237

def setter(self, value):

1760

1238

if hasattr(self, "dbus_object_path"):

1761

1239

if (not hasattr(self, attrname) or

1762

1240

type_func(getattr(self, attrname, None))

1763

1241

!= type_func(value)):

1764

if invalidate_only:

1765

self.PropertiesChanged(

1766

_interface, dbus.Dictionary(),

1767

dbus.Array((dbus_name, )))

1768

else:

1769

dbus_value = transform_func(

1770

type_func(value),

1771

variant_level=variant_level)

1772

self.PropertyChanged(dbus.String(dbus_name),

1773

dbus_value)

1774

self.PropertiesChanged(

1775

_interface,

1776

dbus.Dictionary({dbus.String(dbus_name):

1777

dbus_value}),

1778

dbus.Array())

1242

dbus_value = transform_func(type_func(value),

1243

variant_level

1244

=variant_level)

1245

self.PropertyChanged(dbus.String(dbus_name),

1246

dbus_value)

1779

1247

setattr(self, attrname, value)

1780

1248

1781

1249

return property(lambda self: getattr(self, attrname), setter)

1782

1250

1783

1251

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1784

1252

approvals_pending = notifychangeproperty(dbus.Boolean,

1785

1253

"ApprovalPending",

1786

type_func=bool)

1254

type_func = bool)

1787

1255

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1788

1256

last_enabled = notifychangeproperty(datetime_to_dbus,

1789

1257

"LastEnabled")

1790

checker = notifychangeproperty(

1791

dbus.Boolean, "CheckerRunning",

1792

type_func=lambda checker: checker is not None)

1258

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1259

type_func = lambda checker:

1260

checker is not None)

1793

1261

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1794

1262

"LastCheckedOK")

1795

1263

last_checker_status = notifychangeproperty(dbus.Int16,

1798

1266

datetime_to_dbus, "LastApprovalRequest")

1799

1267

approved_by_default = notifychangeproperty(dbus.Boolean,

1800

1268

"ApprovedByDefault")

1801

approval_delay = notifychangeproperty(

1802

dbus.UInt64, "ApprovalDelay",

1803

type_func=lambda td: td.total_seconds() * 1000)

1269

approval_delay = notifychangeproperty(dbus.UInt64,

1270

"ApprovalDelay",

1271

type_func =

1272

timedelta_to_milliseconds)

1804

1273

approval_duration = notifychangeproperty(

1805

1274

dbus.UInt64, "ApprovalDuration",

1806

type_func=lambda td: td.total_seconds() * 1000)

1275

type_func = timedelta_to_milliseconds)

1807

1276

host = notifychangeproperty(dbus.String, "Host")

1808

timeout = notifychangeproperty(

1809

dbus.UInt64, "Timeout",

1810

type_func=lambda td: td.total_seconds() * 1000)

1277

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1278

type_func =

1279

timedelta_to_milliseconds)

1811

1280

extended_timeout = notifychangeproperty(

1812

1281

dbus.UInt64, "ExtendedTimeout",

1813

type_func=lambda td: td.total_seconds() * 1000)

1814

interval = notifychangeproperty(

1815

dbus.UInt64, "Interval",

1816

type_func=lambda td: td.total_seconds() * 1000)

1282

type_func = timedelta_to_milliseconds)

1283

interval = notifychangeproperty(dbus.UInt64,

1284

"Interval",

1285

type_func =

1286

timedelta_to_milliseconds)

1817

1287

checker_command = notifychangeproperty(dbus.String, "Checker")

1818

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1819

invalidate_only=True)

1820

1288

1821

1289

del notifychangeproperty

1822

1290

1823

1291

def __del__(self, *args, **kwargs):

1824

1292

try:

1825

1293

self.remove_from_connection()

1828

1296

if hasattr(DBusObjectWithProperties, "__del__"):

1829

1297

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1830

1298

Client.__del__(self, *args, **kwargs)

1831

1832

def checker_callback(self, source, condition,

1833

connection, command, *args, **kwargs):

1834

ret = Client.checker_callback(self, source, condition,

1835

connection, command, *args,

1836

**kwargs)

1837

exitstatus = self.last_checker_status

1838

if exitstatus >= 0:

1299

1300

def checker_callback(self, pid, condition, command,

1301

*args, **kwargs):

1302

self.checker_callback_tag = None

1303

self.checker = None

1304

if os.WIFEXITED(condition):

1305

exitstatus = os.WEXITSTATUS(condition)

1839

1306

# Emit D-Bus signal

1840

1307

self.CheckerCompleted(dbus.Int16(exitstatus),

1841

# This is specific to GNU libC

1842

dbus.Int64(exitstatus << 8),

1308

dbus.Int64(condition),

1843

1309

dbus.String(command))

1844

1310

else:

1845

1311

# Emit D-Bus signal

1846

1312

self.CheckerCompleted(dbus.Int16(-1),

1847

dbus.Int64(

1848

# This is specific to GNU libC

1849

(exitstatus << 8)

1850

| self.last_checker_signal),

1313

dbus.Int64(condition),

1851

1314

dbus.String(command))

1852

return ret

1853

1315

1316

return Client.checker_callback(self, pid, condition, command,

1317

*args, **kwargs)

1318

1854

1319

def start_checker(self, *args, **kwargs):

1855

old_checker_pid = getattr(self.checker, "pid", None)

1320

old_checker = self.checker

1321

if self.checker is not None:

1322

old_checker_pid = self.checker.pid

1323

else:

1324

old_checker_pid = None

1856

1325

r = Client.start_checker(self, *args, **kwargs)

1857

1326

# Only if new checker process was started

1858

1327

if (self.checker is not None

1860

1329

# Emit D-Bus signal

1861

1330

self.CheckerStarted(self.current_checker_command)

1862

1331

return r

1863

1332

1864

1333

def _reset_approved(self):

1865

1334

self.approved = None

1866

1335

return False

1867

1336

1868

1337

def approve(self, value=True):

1338

self.send_changedstate()

1869

1339

self.approved = value

1870

GLib.timeout_add(int(self.approval_duration.total_seconds()

1871

* 1000), self._reset_approved)

1872

self.send_changedstate()

1873

1874

# D-Bus methods, signals & properties

1875

1876

# Interfaces

1877

1878

# Signals

1879

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

1343

1344

## D-Bus methods, signals & properties

1345

_interface = "se.recompile.Mandos.Client"

1346

1347

## Interfaces

1348

1349

@dbus_interface_annotations(_interface)

1350

def _foo(self):

1351

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1352

"false"}

1353

1354

## Signals

1355

1880

1356

# CheckerCompleted - signal

1881

1357

@dbus.service.signal(_interface, signature="nxs")

1882

1358

def CheckerCompleted(self, exitcode, waitstatus, command):

1883

1359

"D-Bus signal"

1884

1360

pass

1885

1361

1886

1362

# CheckerStarted - signal

1887

1363

@dbus.service.signal(_interface, signature="s")

1888

1364

def CheckerStarted(self, command):

1889

1365

"D-Bus signal"

1890

1366

pass

1891

1367

1892

1368

# PropertyChanged - signal

1893

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1894

1369

@dbus.service.signal(_interface, signature="sv")

1895

1370

def PropertyChanged(self, property, value):

1896

1371

"D-Bus signal"

1897

1372

pass

1898

1373

1899

1374

# GotSecret - signal

1900

1375

@dbus.service.signal(_interface)

1901

1376

def GotSecret(self):

1904

1379

server to mandos-client

1905

1380

"""

1906

1381

pass

1907

1382

1908

1383

# Rejected - signal

1909

1384

@dbus.service.signal(_interface, signature="s")

1910

1385

def Rejected(self, reason):

1911

1386

"D-Bus signal"

1912

1387

pass

1913

1388

1914

1389

# NeedApproval - signal

1915

1390

@dbus.service.signal(_interface, signature="tb")

1916

1391

def NeedApproval(self, timeout, default):

1917

1392

"D-Bus signal"

1918

1393

return self.need_approval()

1919

1920

# Methods

1921

1394

1395

## Methods

1396

1922

1397

# Approve - method

1923

1398

@dbus.service.method(_interface, in_signature="b")

1924

1399

def Approve(self, value):

1925

1400

self.approve(value)

1926

1401

1927

1402

# CheckedOK - method

1928

1403

@dbus.service.method(_interface)

1929

1404

def CheckedOK(self):

1930

1405

self.checked_ok()

1931

1406

1932

1407

# Enable - method

1933

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1934

1408

@dbus.service.method(_interface)

1935

1409

def Enable(self):

1936

1410

"D-Bus method"

1937

1411

self.enable()

1938

1412

1939

1413

# StartChecker - method

1940

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1941

1414

@dbus.service.method(_interface)

1942

1415

def StartChecker(self):

1943

1416

"D-Bus method"

1944

1417

self.start_checker()

1945

1418

1946

1419

# Disable - method

1947

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1948

1420

@dbus.service.method(_interface)

1949

1421

def Disable(self):

1950

1422

"D-Bus method"

1951

1423

self.disable()

1952

1424

1953

1425

# StopChecker - method

1954

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1955

1426

@dbus.service.method(_interface)

1956

1427

def StopChecker(self):

1957

1428

self.stop_checker()

1958

1959

# Properties

1960

1429

1430

## Properties

1431

1961

1432

# ApprovalPending - property

1962

1433

@dbus_service_property(_interface, signature="b", access="read")

1963

1434

def ApprovalPending_dbus_property(self):

1964

1435

return dbus.Boolean(bool(self.approvals_pending))

1965

1436

1966

1437

# ApprovedByDefault - property

1967

@dbus_service_property(_interface,

1968

signature="b",

1438

@dbus_service_property(_interface, signature="b",

1969

1439

access="readwrite")

1970

1440

def ApprovedByDefault_dbus_property(self, value=None):

1971

1441

if value is None: # get

1972

1442

return dbus.Boolean(self.approved_by_default)

1973

1443

self.approved_by_default = bool(value)

1974

1444

1975

1445

# ApprovalDelay - property

1976

@dbus_service_property(_interface,

1977

signature="t",

1446

@dbus_service_property(_interface, signature="t",

1978

1447

access="readwrite")

1979

1448

def ApprovalDelay_dbus_property(self, value=None):

1980

1449

if value is None: # get

1981

return dbus.UInt64(self.approval_delay.total_seconds()

1982

* 1000)

1450

return dbus.UInt64(self.approval_delay_milliseconds())

1983

1451

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1984

1452

1985

1453

# ApprovalDuration - property

1986

@dbus_service_property(_interface,

1987

signature="t",

1454

@dbus_service_property(_interface, signature="t",

1988

1455

access="readwrite")

1989

1456

def ApprovalDuration_dbus_property(self, value=None):

1990

1457

if value is None: # get

1991

return dbus.UInt64(self.approval_duration.total_seconds()

1992

* 1000)

1458

return dbus.UInt64(timedelta_to_milliseconds(

1459

self.approval_duration))

1993

1460

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1994

1461

1995

1462

# Name - property

1996

@dbus_annotations(

1997

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1998

1463

@dbus_service_property(_interface, signature="s", access="read")

1999

1464

def Name_dbus_property(self):

2000

1465

return dbus.String(self.name)

2001

1466

2002

1467

# Fingerprint - property

2003

@dbus_annotations(

2004

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2005

1468

@dbus_service_property(_interface, signature="s", access="read")

2006

1469

def Fingerprint_dbus_property(self):

2007

1470

return dbus.String(self.fingerprint)

2008

1471

2009

1472

# Host - property

2010

@dbus_service_property(_interface,

2011

signature="s",

1473

@dbus_service_property(_interface, signature="s",

2012

1474

access="readwrite")

2013

1475

def Host_dbus_property(self, value=None):

2014

1476

if value is None: # get

2015

1477

return dbus.String(self.host)

2016

self.host = str(value)

2017

1478

self.host = unicode(value)

1479

2018

1480

# Created - property

2019

@dbus_annotations(

2020

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2021

1481

@dbus_service_property(_interface, signature="s", access="read")

2022

1482

def Created_dbus_property(self):

2023

1483

return datetime_to_dbus(self.created)

2024

1484

2025

1485

# LastEnabled - property

2026

1486

@dbus_service_property(_interface, signature="s", access="read")

2027

1487

def LastEnabled_dbus_property(self):

2028

1488

return datetime_to_dbus(self.last_enabled)

2029

1489

2030

1490

# Enabled - property

2031

@dbus_service_property(_interface,

2032

signature="b",

1491

@dbus_service_property(_interface, signature="b",

2033

1492

access="readwrite")

2034

1493

def Enabled_dbus_property(self, value=None):

2035

1494

if value is None: # get

2038

1497

self.enable()

2039

1498

else:

2040

1499

self.disable()

2041

1500

2042

1501

# LastCheckedOK - property

2043

@dbus_service_property(_interface,

2044

signature="s",

1502

@dbus_service_property(_interface, signature="s",

2045

1503

access="readwrite")

2046

1504

def LastCheckedOK_dbus_property(self, value=None):

2047

1505

if value is not None:

2048

1506

self.checked_ok()

2049

1507

return

2050

1508

return datetime_to_dbus(self.last_checked_ok)

2051

1509

2052

1510

# LastCheckerStatus - property

2053

@dbus_service_property(_interface, signature="n", access="read")

1511

@dbus_service_property(_interface, signature="n",

1512

access="read")

2054

1513

def LastCheckerStatus_dbus_property(self):

2055

1514

return dbus.Int16(self.last_checker_status)

2056

1515

2057

1516

# Expires - property

2058

1517

@dbus_service_property(_interface, signature="s", access="read")

2059

1518

def Expires_dbus_property(self):

2060

1519

return datetime_to_dbus(self.expires)

2061

1520

2062

1521

# LastApprovalRequest - property

2063

1522

@dbus_service_property(_interface, signature="s", access="read")

2064

1523

def LastApprovalRequest_dbus_property(self):

2065

1524

return datetime_to_dbus(self.last_approval_request)

2066

1525

2067

1526

# Timeout - property

2068

@dbus_service_property(_interface,

2069

signature="t",

1527

@dbus_service_property(_interface, signature="t",

2070

1528

access="readwrite")

2071

1529

def Timeout_dbus_property(self, value=None):

2072

1530

if value is None: # get

2073

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2074

old_timeout = self.timeout

1531

return dbus.UInt64(self.timeout_milliseconds())

2075

1532

self.timeout = datetime.timedelta(0, 0, 0, value)

2076

# Reschedule disabling

1533

# Reschedule timeout

2077

1534

if self.enabled:

2078

1535

now = datetime.datetime.utcnow()

2079

self.expires += self.timeout - old_timeout

2080

if self.expires <= now:

1536

time_to_die = timedelta_to_milliseconds(

1537

(self.last_checked_ok + self.timeout) - now)

1538

if time_to_die <= 0:

2081

1539

# The timeout has passed

2082

1540

self.disable()

2083

1541

else:

1542

self.expires = (now +

1543

datetime.timedelta(milliseconds =

1544

time_to_die))

2084

1545

if (getattr(self, "disable_initiator_tag", None)

2085

1546

is None):

2086

1547

return

2087

GLib.source_remove(self.disable_initiator_tag)

2088

self.disable_initiator_tag = GLib.timeout_add(

2089

int((self.expires - now).total_seconds() * 1000),

2090

self.disable)

2091

1548

gobject.source_remove(self.disable_initiator_tag)

1549

self.disable_initiator_tag = (gobject.timeout_add

1550

(time_to_die,

1551

self.disable))

1552

2092

1553

# ExtendedTimeout - property

2093

@dbus_service_property(_interface,

2094

signature="t",

1554

@dbus_service_property(_interface, signature="t",

2095

1555

access="readwrite")

2096

1556

def ExtendedTimeout_dbus_property(self, value=None):

2097

1557

if value is None: # get

2098

return dbus.UInt64(self.extended_timeout.total_seconds()

2099

* 1000)

1558

return dbus.UInt64(self.extended_timeout_milliseconds())

2100

1559

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2101

1560

2102

1561

# Interval - property

2103

@dbus_service_property(_interface,

2104

signature="t",

1562

@dbus_service_property(_interface, signature="t",

2105

1563

access="readwrite")

2106

1564

def Interval_dbus_property(self, value=None):

2107

1565

if value is None: # get

2108

return dbus.UInt64(self.interval.total_seconds() * 1000)

1566

return dbus.UInt64(self.interval_milliseconds())

2109

1567

self.interval = datetime.timedelta(0, 0, 0, value)

2110

1568

if getattr(self, "checker_initiator_tag", None) is None:

2111

1569

return

2112

1570

if self.enabled:

2113

1571

# Reschedule checker run

2114

GLib.source_remove(self.checker_initiator_tag)

2115

self.checker_initiator_tag = GLib.timeout_add(

2116

value, self.start_checker)

2117

self.start_checker() # Start one now, too

2118

1572

gobject.source_remove(self.checker_initiator_tag)

1573

self.checker_initiator_tag = (gobject.timeout_add

1574

(value, self.start_checker))

1575

self.start_checker() # Start one now, too

1576

2119

1577

# Checker - property

2120

@dbus_service_property(_interface,

2121

signature="s",

1578

@dbus_service_property(_interface, signature="s",

2122

1579

access="readwrite")

2123

1580

def Checker_dbus_property(self, value=None):

2124

1581

if value is None: # get

2125

1582

return dbus.String(self.checker_command)

2126

self.checker_command = str(value)

2127

1583

self.checker_command = unicode(value)

1584

2128

1585

# CheckerRunning - property

2129

@dbus_service_property(_interface,

2130

signature="b",

1586

@dbus_service_property(_interface, signature="b",

2131

1587

access="readwrite")

2132

1588

def CheckerRunning_dbus_property(self, value=None):

2133

1589

if value is None: # get

2136

1592

self.start_checker()

2137

1593

else:

2138

1594

self.stop_checker()

2139

1595

2140

1596

# ObjectPath - property

2141

@dbus_annotations(

2142

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2143

"org.freedesktop.DBus.Deprecated": "true"})

2144

1597

@dbus_service_property(_interface, signature="o", access="read")

2145

1598

def ObjectPath_dbus_property(self):

2146

return self.dbus_object_path # is already a dbus.ObjectPath

2147

1599

return self.dbus_object_path # is already a dbus.ObjectPath

1600

2148

1601

# Secret = property

2149

@dbus_annotations(

2150

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2151

"invalidates"})

2152

@dbus_service_property(_interface,

2153

signature="ay",

2154

access="write",

2155

byte_arrays=True)

1602

@dbus_service_property(_interface, signature="ay",

1603

access="write", byte_arrays=True)

2156

1604

def Secret_dbus_property(self, value):

2157

self.secret = bytes(value)

2158

1605

self.secret = str(value)

1606

2159

1607

del _interface

2160

1608

2161

1609

2164

1612

self._pipe = child_pipe

2165

1613

self._pipe.send(('init', fpr, address))

2166

1614

if not self._pipe.recv():

2167

raise KeyError(fpr)

2168

1615

raise KeyError()

1616

2169

1617

def __getattribute__(self, name):

2170

1618

if name == '_pipe':

2171

1619

return super(ProxyClient, self).__getattribute__(name)

2174

1622

if data[0] == 'data':

2175

1623

return data[1]

2176

1624

if data[0] == 'function':

2177

2178

1625

def func(*args, **kwargs):

2179

1626

self._pipe.send(('funcall', name, args, kwargs))

2180

1627

return self._pipe.recv()[1]

2181

2182

1628

return func

2183

1629

2184

1630

def __setattr__(self, name, value):

2185

1631

if name == '_pipe':

2186

1632

return super(ProxyClient, self).__setattr__(name, value)

2189

1635

2190

1636

class ClientHandler(socketserver.BaseRequestHandler, object):

2191

1637

"""A class to handle client connections.

2192

1638

2193

1639

Instantiated once for each connection to handle it.

2194

1640

Note: This will run in its own forked process."""

2195

1641

2196

1642

def handle(self):

2197

1643

with contextlib.closing(self.server.child_pipe) as child_pipe:

2198

1644

logger.info("TCP connection from: %s",

2199

str(self.client_address))

1645

unicode(self.client_address))

2200

1646

logger.debug("Pipe FD: %d",

2201

1647

self.server.child_pipe.fileno())

2202

2203

session = gnutls.ClientSession(self.request)

2204

2205

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2206

# "+AES-256-CBC", "+SHA1",

2207

# "+COMP-NULL", "+CTYPE-OPENPGP",

2208

# "+DHE-DSS"))

1648

1649

session = (gnutls.connection

1650

.ClientSession(self.request,

1651

gnutls.connection

1652

.X509Credentials()))

1653

1654

# Note: gnutls.connection.X509Credentials is really a

1655

# generic GnuTLS certificate credentials object so long as

1656

# no X.509 keys are added to it. Therefore, we can use it

1657

# here despite using OpenPGP certificates.

1658

1659

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1660

# "+AES-256-CBC", "+SHA1",

1661

# "+COMP-NULL", "+CTYPE-OPENPGP",

1662

# "+DHE-DSS"))

2209

1663

# Use a fallback default, since this MUST be set.

2210

1664

priority = self.server.gnutls_priority

2211

1665

if priority is None:

2212

1666

priority = "NORMAL"

2213

gnutls.priority_set_direct(session._c_object,

2214

priority.encode("utf-8"),

2215

None)

2216

1667

(gnutls.library.functions

1668

.gnutls_priority_set_direct(session._c_object,

1669

priority, None))

1670

2217

1671

# Start communication using the Mandos protocol

2218

1672

# Get protocol number

2219

1673

line = self.request.makefile().readline()

2220

1674

logger.debug("Protocol version: %r", line)

2221

1675

try:

2222

1676

if int(line.strip().split()[0]) > 1:

2223

raise RuntimeError(line)

1677

raise RuntimeError

2224

1678

except (ValueError, IndexError, RuntimeError) as error:

2225

1679

logger.error("Unknown protocol version: %s", error)

2226

1680

return

2227

1681

2228

1682

# Start GnuTLS connection

2229

1683

try:

2230

1684

session.handshake()

2231

except gnutls.Error as error:

1685

except gnutls.errors.GNUTLSError as error:

2232

1686

logger.warning("Handshake failed: %s", error)

2233

1687

# Do not run session.bye() here: the session is not

2234

1688

# established. Just abandon the request.

2235

1689

return

2236

1690

logger.debug("Handshake succeeded")

2237

1691

2238

1692

approval_required = False

2239

1693

try:

2240

1694

try:

2241

fpr = self.fingerprint(

2242

self.peer_certificate(session))

2243

except (TypeError, gnutls.Error) as error:

1695

fpr = self.fingerprint(self.peer_certificate

1696

(session))

1697

except (TypeError,

1698

gnutls.errors.GNUTLSError) as error:

2244

1699

logger.warning("Bad certificate: %s", error)

2245

1700

return

2246

1701

logger.debug("Fingerprint: %s", fpr)

2247

1702

2248

1703

try:

2249

1704

client = ProxyClient(child_pipe, fpr,

2250

1705

self.client_address)

2251

1706

except KeyError:

2252

1707

return

2253

1708

2254

1709

if client.approval_delay:

2255

1710

delay = client.approval_delay

2256

1711

client.approvals_pending += 1

2257

1712

approval_required = True

2258

1713

2259

1714

while True:

2260

1715

if not client.enabled:

2261

1716

logger.info("Client %s is disabled",

2262

client.name)

1717

client.name)

2263

1718

if self.server.use_dbus:

2264

1719

# Emit D-Bus signal

2265

1720

client.Rejected("Disabled")

2266

1721

return

2267

1722

2268

1723

if client.approved or not client.approval_delay:

2269

# We are approved or approval is disabled

1724

#We are approved or approval is disabled

2270

1725

break

2271

1726

elif client.approved is None:

2272

1727

logger.info("Client %s needs approval",

2274

1729

if self.server.use_dbus:

2275

1730

# Emit D-Bus signal

2276

1731

client.NeedApproval(

2277

client.approval_delay.total_seconds()

2278

* 1000, client.approved_by_default)

1732

client.approval_delay_milliseconds(),

1733

client.approved_by_default)

2279

1734

else:

2280

1735

logger.warning("Client %s was not approved",

2281

1736

client.name)

2283

1738

# Emit D-Bus signal

2284

1739

client.Rejected("Denied")

2285

1740

return

2286

2287

# wait until timeout or approved

1741

1742

#wait until timeout or approved

2288

1743

time = datetime.datetime.now()

2289

1744

client.changedstate.acquire()

2290

client.changedstate.wait(delay.total_seconds())

1745

(client.changedstate.wait

1746

(float(client.timedelta_to_milliseconds(delay)

1747

/ 1000)))

2291

1748

client.changedstate.release()

2292

1749

time2 = datetime.datetime.now()

2293

1750

if (time2 - time) >= delay:

2303

1760

break

2304

1761

else:

2305

1762

delay -= time2 - time

2306

2307

try:

2308

session.send(client.secret)

2309

except gnutls.Error as error:

2310

logger.warning("gnutls send failed",

2311

exc_info=error)

2312

return

2313

1763

1764

sent_size = 0

1765

while sent_size < len(client.secret):

1766

try:

1767

sent = session.send(client.secret[sent_size:])

1768

except gnutls.errors.GNUTLSError as error:

1769

logger.warning("gnutls send failed",

1770

exc_info=error)

1771

return

1772

logger.debug("Sent: %d, remaining: %d",

1773

sent, len(client.secret)

1774

- (sent_size + sent))

1775

sent_size += sent

1776

2314

1777

logger.info("Sending secret to %s", client.name)

2315

1778

# bump the timeout using extended_timeout

2316

1779

client.bump_timeout(client.extended_timeout)

2317

1780

if self.server.use_dbus:

2318

1781

# Emit D-Bus signal

2319

1782

client.GotSecret()

2320

1783

2321

1784

finally:

2322

1785

if approval_required:

2323

1786

client.approvals_pending -= 1

2324

1787

try:

2325

1788

session.bye()

2326

except gnutls.Error as error:

1789

except gnutls.errors.GNUTLSError as error:

2327

1790

logger.warning("GnuTLS bye failed",

2328

1791

exc_info=error)

2329

1792

2330

1793

@staticmethod

2331

1794

def peer_certificate(session):

2332

1795

"Return the peer's OpenPGP certificate as a bytestring"

2333

1796

# If not an OpenPGP certificate...

2334

if (gnutls.certificate_type_get(session._c_object)

2335

!= gnutls.CRT_OPENPGP):

2336

# ...return invalid data

2337

return b""

1797

if (gnutls.library.functions

1798

.gnutls_certificate_type_get(session._c_object)

1799

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1800

# ...do the normal thing

1801

return session.peer_certificate

2338

1802

list_size = ctypes.c_uint(1)

2339

cert_list = (gnutls.certificate_get_peers

1803

cert_list = (gnutls.library.functions

1804

.gnutls_certificate_get_peers

2340

1805

(session._c_object, ctypes.byref(list_size)))

2341

1806

if not bool(cert_list) and list_size.value != 0:

2342

raise gnutls.Error("error getting peer certificate")

1807

raise gnutls.errors.GNUTLSError("error getting peer"

1808

" certificate")

2343

1809

if list_size.value == 0:

2344

1810

return None

2345

1811

cert = cert_list[0]

2346

1812

return ctypes.string_at(cert.data, cert.size)

2347

1813

2348

1814

@staticmethod

2349

1815

def fingerprint(openpgp):

2350

1816

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2351

1817

# New GnuTLS "datum" with the OpenPGP public key

2352

datum = gnutls.datum_t(

2353

ctypes.cast(ctypes.c_char_p(openpgp),

2354

ctypes.POINTER(ctypes.c_ubyte)),

2355

ctypes.c_uint(len(openpgp)))

1818

datum = (gnutls.library.types

1819

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1820

ctypes.POINTER

1821

(ctypes.c_ubyte)),

1822

ctypes.c_uint(len(openpgp))))

2356

1823

# New empty GnuTLS certificate

2357

crt = gnutls.openpgp_crt_t()

2358

gnutls.openpgp_crt_init(ctypes.byref(crt))

1824

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1825

(gnutls.library.functions

1826

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2359

1827

# Import the OpenPGP public key into the certificate

2360

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2361

gnutls.OPENPGP_FMT_RAW)

1828

(gnutls.library.functions

1829

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1830

gnutls.library.constants

1831

.GNUTLS_OPENPGP_FMT_RAW))

2362

1832

# Verify the self signature in the key

2363

1833

crtverify = ctypes.c_uint()

2364

gnutls.openpgp_crt_verify_self(crt, 0,

2365

ctypes.byref(crtverify))

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_verify_self(crt, 0,

1836

ctypes.byref(crtverify)))

2366

1837

if crtverify.value != 0:

2367

gnutls.openpgp_crt_deinit(crt)

2368

raise gnutls.CertificateSecurityError(code

2369

=crtverify.value)

1838

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1839

raise (gnutls.errors.CertificateSecurityError

1840

("Verify failed"))

2370

1841

# New buffer for the fingerprint

2371

1842

buf = ctypes.create_string_buffer(20)

2372

1843

buf_len = ctypes.c_size_t()

2373

1844

# Get the fingerprint from the certificate into the buffer

2374

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2375

ctypes.byref(buf_len))

1845

(gnutls.library.functions

1846

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1847

ctypes.byref(buf_len)))

2376

1848

# Deinit the certificate

2377

gnutls.openpgp_crt_deinit(crt)

1849

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2378

1850

# Convert the buffer to a Python bytestring

2379

1851

fpr = ctypes.string_at(buf, buf_len.value)

2380

1852

# Convert the bytestring to hexadecimal notation

2384

1856

2385

1857

class MultiprocessingMixIn(object):

2386

1858

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2387

2388

1859

def sub_process_main(self, request, address):

2389

1860

try:

2390

1861

self.finish_request(request, address)

2391

1862

except Exception:

2392

1863

self.handle_error(request, address)

2393

1864

self.close_request(request)

2394

1865

2395

1866

def process_request(self, request, address):

2396

1867

"""Start a new process to process the request."""

2397

proc = multiprocessing.Process(target=self.sub_process_main,

2398

args=(request, address))

1868

proc = multiprocessing.Process(target = self.sub_process_main,

1869

args = (request, address))

2399

1870

proc.start()

2400

1871

return proc

2401

1872

2402

1873

2403

1874

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2404

1875

""" adds a pipe to the MixIn """

2405

2406

1876

def process_request(self, request, client_address):

2407

1877

"""Overrides and wraps the original process_request().

2408

1878

2409

1879

This function creates a new pipe in self.pipe

2410

1880

"""

2411

1881

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2412

1882

2413

1883

proc = MultiprocessingMixIn.process_request(self, request,

2414

1884

client_address)

2415

1885

self.child_pipe.close()

2416

1886

self.add_pipe(parent_pipe, proc)

2417

1887

2418

1888

def add_pipe(self, parent_pipe, proc):

2419

1889

"""Dummy function; override as necessary"""

2420

raise NotImplementedError()

1890

raise NotImplementedError

2421

1891

2422

1892

2423

1893

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2424

1894

socketserver.TCPServer, object):

2425

1895

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2426

1896

2427

1897

Attributes:

2428

1898

enabled: Boolean; whether this server is activated yet

2429

1899

interface: None or a network interface name (string)

2430

1900

use_ipv6: Boolean; to use IPv6 or not

2431

1901

"""

2432

2433

1902

def __init__(self, server_address, RequestHandlerClass,

2434

interface=None,

2435

use_ipv6=True,

2436

socketfd=None):

2437

"""If socketfd is set, use that file descriptor instead of

2438

creating a new one with socket.socket().

2439

"""

1903

interface=None, use_ipv6=True):

2440

1904

self.interface = interface

2441

1905

if use_ipv6:

2442

1906

self.address_family = socket.AF_INET6

2443

if socketfd is not None:

2444

# Save the file descriptor

2445

self.socketfd = socketfd

2446

# Save the original socket.socket() function

2447

self.socket_socket = socket.socket

2448

2449

# To implement --socket, we monkey patch socket.socket.

2450

#

2451

# (When socketserver.TCPServer is a new-style class, we

2452

# could make self.socket into a property instead of monkey

2453

# patching socket.socket.)

2454

#

2455

# Create a one-time-only replacement for socket.socket()

2456

@functools.wraps(socket.socket)

2457

def socket_wrapper(*args, **kwargs):

2458

# Restore original function so subsequent calls are

2459

# not affected.

2460

socket.socket = self.socket_socket

2461

del self.socket_socket

2462

# This time only, return a new socket object from the

2463

# saved file descriptor.

2464

return socket.fromfd(self.socketfd, *args, **kwargs)

2465

# Replace socket.socket() function with wrapper

2466

socket.socket = socket_wrapper

2467

# The socketserver.TCPServer.__init__ will call

2468

# socket.socket(), which might be our replacement,

2469

# socket_wrapper(), if socketfd was set.

2470

1907

socketserver.TCPServer.__init__(self, server_address,

2471

1908

RequestHandlerClass)

2472

2473

1909

def server_bind(self):

2474

1910

"""This overrides the normal server_bind() function

2475

1911

to bind to an interface if one was specified, and also NOT to

2476

1912

bind to an address or port if they were not specified."""

2477

global SO_BINDTODEVICE

2478

1913

if self.interface is not None:

2479

1914

if SO_BINDTODEVICE is None:

2480

# Fall back to a hard-coded value which seems to be

2481

# common enough.

2482

logger.warning("SO_BINDTODEVICE not found, trying 25")

2483

SO_BINDTODEVICE = 25

2484

try:

2485

self.socket.setsockopt(

2486

socket.SOL_SOCKET, SO_BINDTODEVICE,

2487

(self.interface + "\0").encode("utf-8"))

2488

except socket.error as error:

2489

if error.errno == errno.EPERM:

2490

logger.error("No permission to bind to"

2491

" interface %s", self.interface)

2492

elif error.errno == errno.ENOPROTOOPT:

2493

logger.error("SO_BINDTODEVICE not available;"

2494

" cannot bind to interface %s",

2495

self.interface)

2496

elif error.errno == errno.ENODEV:

2497

logger.error("Interface %s does not exist,"

2498

" cannot bind", self.interface)

2499

else:

2500

raise

1915

logger.error("SO_BINDTODEVICE does not exist;"

1916

" cannot bind to interface %s",

1917

self.interface)

1918

else:

1919

try:

1920

self.socket.setsockopt(socket.SOL_SOCKET,

1921

SO_BINDTODEVICE,

1922

str(self.interface

1923

+ '\0'))

1924

except socket.error as error:

1925

if error[0] == errno.EPERM:

1926

logger.error("No permission to"

1927

" bind to interface %s",

1928

self.interface)

1929

elif error[0] == errno.ENOPROTOOPT:

1930

logger.error("SO_BINDTODEVICE not available;"

1931

" cannot bind to interface %s",

1932

self.interface)

1933

else:

1934

raise

2501

1935

# Only bind(2) the socket if we really need to.

2502

1936

if self.server_address[0] or self.server_address[1]:

2503

1937

if not self.server_address[0]:

2504

1938

if self.address_family == socket.AF_INET6:

2505

any_address = "::" # in6addr_any

1939

any_address = "::" # in6addr_any

2506

1940

else:

2507

any_address = "0.0.0.0" # INADDR_ANY

1941

any_address = socket.INADDR_ANY

2508

1942

self.server_address = (any_address,

2509

1943

self.server_address[1])

2510

1944

elif not self.server_address[1]:

2511

self.server_address = (self.server_address[0], 0)

1945

self.server_address = (self.server_address[0],

1946

0)

2512

1947

# if self.interface:

2513

1948

# self.server_address = (self.server_address[0],

2514

1949

# 0, # port

2520

1955

2521

1956

class MandosServer(IPv6_TCPServer):

2522

1957

"""Mandos server.

2523

1958

2524

1959

Attributes:

2525

1960

clients: set of Client objects

2526

1961

gnutls_priority GnuTLS priority string

2527

1962

use_dbus: Boolean; to emit D-Bus signals or not

2528

2529

Assumes a GLib.MainLoop event loop.

1963

1964

Assumes a gobject.MainLoop event loop.

2530

1965

"""

2531

2532

1966

def __init__(self, server_address, RequestHandlerClass,

2533

interface=None,

2534

use_ipv6=True,

2535

clients=None,

2536

gnutls_priority=None,

2537

use_dbus=True,

2538

socketfd=None):

1967

interface=None, use_ipv6=True, clients=None,

1968

gnutls_priority=None, use_dbus=True):

2539

1969

self.enabled = False

2540

1970

self.clients = clients

2541

1971

if self.clients is None:

2544

1974

self.gnutls_priority = gnutls_priority

2545

1975

IPv6_TCPServer.__init__(self, server_address,

2546

1976

RequestHandlerClass,

2547

interface=interface,

2548

use_ipv6=use_ipv6,

2549

socketfd=socketfd)

2550

1977

interface = interface,

1978

use_ipv6 = use_ipv6)

2551

1979

def server_activate(self):

2552

1980

if self.enabled:

2553

1981

return socketserver.TCPServer.server_activate(self)

2554

1982

2555

1983

def enable(self):

2556

1984

self.enabled = True

2557

1985

2558

1986

def add_pipe(self, parent_pipe, proc):

2559

1987

# Call "handle_ipc" for both data and EOF events

2560

GLib.io_add_watch(

2561

parent_pipe.fileno(),

2562

GLib.IO_IN | GLib.IO_HUP,

2563

functools.partial(self.handle_ipc,

2564

parent_pipe=parent_pipe,

2565

proc=proc))

2566

2567

def handle_ipc(self, source, condition,

2568

parent_pipe=None,

2569

proc=None,

2570

client_object=None):

1988

gobject.io_add_watch(parent_pipe.fileno(),

1989

gobject.IO_IN | gobject.IO_HUP,

1990

functools.partial(self.handle_ipc,

1991

parent_pipe =

1992

parent_pipe,

1993

proc = proc))

1994

1995

def handle_ipc(self, source, condition, parent_pipe=None,

1996

proc = None, client_object=None):

2571

1997

# error, or the other end of multiprocessing.Pipe has closed

2572

if condition & (GLib.IO_ERR | GLib.IO_HUP):

1998

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2573

1999

# Wait for other process to exit

2574

2000

proc.join()

2575

2001

return False

2576

2002

2577

2003

# Read a request from the child

2578

2004

request = parent_pipe.recv()

2579

2005

command = request[0]

2580

2006

2581

2007

if command == 'init':

2582

fpr = request[1].decode("ascii")

2008

fpr = request[1]

2583

2009

address = request[2]

2584

2585

for c in self.clients.values():

2010

2011

for c in self.clients.itervalues():

2586

2012

if c.fingerprint == fpr:

2587

2013

client = c

2588

2014

break

2595

2021

address[0])

2596

2022

parent_pipe.send(False)

2597

2023

return False

2598

2599

GLib.io_add_watch(

2600

parent_pipe.fileno(),

2601

GLib.IO_IN | GLib.IO_HUP,

2602

functools.partial(self.handle_ipc,

2603

parent_pipe=parent_pipe,

2604

proc=proc,

2605

client_object=client))

2024

2025

gobject.io_add_watch(parent_pipe.fileno(),

2026

gobject.IO_IN | gobject.IO_HUP,

2027

functools.partial(self.handle_ipc,

2028

parent_pipe =

2029

parent_pipe,

2030

proc = proc,

2031

client_object =

2032

client))

2606

2033

parent_pipe.send(True)

2607

2034

# remove the old hook in favor of the new above hook on

2608

2035

# same fileno

2611

2038

funcname = request[1]

2612

2039

args = request[2]

2613

2040

kwargs = request[3]

2614

2041

2615

2042

parent_pipe.send(('data', getattr(client_object,

2616

2043

funcname)(*args,

2617

**kwargs)))

2618

2044

**kwargs)))

2045

2619

2046

if command == 'getattr':

2620

2047

attrname = request[1]

2621

if isinstance(client_object.__getattribute__(attrname),

2622

collections.Callable):

2623

parent_pipe.send(('function', ))

2048

if callable(client_object.__getattribute__(attrname)):

2049

parent_pipe.send(('function',))

2624

2050

else:

2625

parent_pipe.send((

2626

'data', client_object.__getattribute__(attrname)))

2627

2051

parent_pipe.send(('data', client_object

2052

.__getattribute__(attrname)))

2053

2628

2054

if command == 'setattr':

2629

2055

attrname = request[1]

2630

2056

value = request[2]

2631

2057

setattr(client_object, attrname, value)

2632

2058

2633

2059

return True

2634

2060

2635

2061

2636

def rfc3339_duration_to_delta(duration):

2637

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2638

2639

>>> rfc3339_duration_to_delta("P7D")

2640

datetime.timedelta(7)

2641

>>> rfc3339_duration_to_delta("PT60S")

2642

datetime.timedelta(0, 60)

2643

>>> rfc3339_duration_to_delta("PT60M")

2644

datetime.timedelta(0, 3600)

2645

>>> rfc3339_duration_to_delta("PT24H")

2646

datetime.timedelta(1)

2647

>>> rfc3339_duration_to_delta("P1W")

2648

datetime.timedelta(7)

2649

>>> rfc3339_duration_to_delta("PT5M30S")

2650

datetime.timedelta(0, 330)

2651

>>> rfc3339_duration_to_delta("P1DT3M20S")

2652

datetime.timedelta(1, 200)

2653

"""

2654

2655

# Parsing an RFC 3339 duration with regular expressions is not

2656

# possible - there would have to be multiple places for the same

2657

# values, like seconds. The current code, while more esoteric, is

2658

# cleaner without depending on a parsing library. If Python had a

2659

# built-in library for parsing we would use it, but we'd like to

2660

# avoid excessive use of external libraries.

2661

2662

# New type for defining tokens, syntax, and semantics all-in-one

2663

Token = collections.namedtuple("Token", (

2664

"regexp", # To match token; if "value" is not None, must have

2665

# a "group" containing digits

2666

"value", # datetime.timedelta or None

2667

"followers")) # Tokens valid after this token

2668

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2669

# the "duration" ABNF definition in RFC 3339, Appendix A.

2670

token_end = Token(re.compile(r"$"), None, frozenset())

2671

token_second = Token(re.compile(r"(\d+)S"),

2672

datetime.timedelta(seconds=1),

2673

frozenset((token_end, )))

2674

token_minute = Token(re.compile(r"(\d+)M"),

2675

datetime.timedelta(minutes=1),

2676

frozenset((token_second, token_end)))

2677

token_hour = Token(re.compile(r"(\d+)H"),

2678

datetime.timedelta(hours=1),

2679

frozenset((token_minute, token_end)))

2680

token_time = Token(re.compile(r"T"),

2681

None,

2682

frozenset((token_hour, token_minute,

2683

token_second)))

2684

token_day = Token(re.compile(r"(\d+)D"),

2685

datetime.timedelta(days=1),

2686

frozenset((token_time, token_end)))

2687

token_month = Token(re.compile(r"(\d+)M"),

2688

datetime.timedelta(weeks=4),

2689

frozenset((token_day, token_end)))

2690

token_year = Token(re.compile(r"(\d+)Y"),

2691

datetime.timedelta(weeks=52),

2692

frozenset((token_month, token_end)))

2693

token_week = Token(re.compile(r"(\d+)W"),

2694

datetime.timedelta(weeks=1),

2695

frozenset((token_end, )))

2696

token_duration = Token(re.compile(r"P"), None,

2697

frozenset((token_year, token_month,

2698

token_day, token_time,

2699

token_week)))

2700

# Define starting values:

2701

# Value so far

2702

value = datetime.timedelta()

2703

found_token = None

2704

# Following valid tokens

2705

followers = frozenset((token_duration, ))

2706

# String left to parse

2707

s = duration

2708

# Loop until end token is found

2709

while found_token is not token_end:

2710

# Search for any currently valid tokens

2711

for token in followers:

2712

match = token.regexp.match(s)

2713

if match is not None:

2714

# Token found

2715

if token.value is not None:

2716

# Value found, parse digits

2717

factor = int(match.group(1), 10)

2718

# Add to value so far

2719

value += factor * token.value

2720

# Strip token from string

2721

s = token.regexp.sub("", s, 1)

2722

# Go to found token

2723

found_token = token

2724

# Set valid next tokens

2725

followers = found_token.followers

2726

break

2727

else:

2728

# No currently valid tokens were found

2729

raise ValueError("Invalid RFC 3339 duration: {!r}"

2730

.format(duration))

2731

# End token found

2732

return value

2733

2734

2735

2062

def string_to_delta(interval):

2736

2063

"""Parse a string and return a datetime.timedelta

2737

2064

2738

2065

>>> string_to_delta('7d')

2739

2066

datetime.timedelta(7)

2740

2067

>>> string_to_delta('60s')

2748

2075

>>> string_to_delta('5m 30s')

2749

2076

datetime.timedelta(0, 330)

2750

2077

"""

2751

2752

try:

2753

return rfc3339_duration_to_delta(interval)

2754

except ValueError:

2755

pass

2756

2757

2078

timevalue = datetime.timedelta(0)

2758

2079

for s in interval.split():

2759

2080

try:

2760

suffix = s[-1]

2081

suffix = unicode(s[-1])

2761

2082

value = int(s[:-1])

2762

2083

if suffix == "d":

2763

2084

delta = datetime.timedelta(value)

2770

2091

elif suffix == "w":

2771

2092

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2772

2093

else:

2773

raise ValueError("Unknown suffix {!r}".format(suffix))

2774

except IndexError as e:

2094

raise ValueError("Unknown suffix {0!r}"

2095

.format(suffix))

2096

except (ValueError, IndexError) as e:

2775

2097

raise ValueError(*(e.args))

2776

2098

timevalue += delta

2777

2099

return timevalue

2778

2100

2779

2101

2780

def daemon(nochdir=False, noclose=False):

2102

def daemon(nochdir = False, noclose = False):

2781

2103

"""See daemon(3). Standard BSD Unix function.

2782

2104

2783

2105

This should really exist as os.daemon, but it doesn't (yet)."""

2784

2106

if os.fork():

2785

2107

sys.exit()

2793

2115

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2794

2116

if not stat.S_ISCHR(os.fstat(null).st_mode):

2795

2117

raise OSError(errno.ENODEV,

2796

"{} not a character device"

2118

"{0} not a character device"

2797

2119

.format(os.devnull))

2798

2120

os.dup2(null, sys.stdin.fileno())

2799

2121

os.dup2(null, sys.stdout.fileno())

2803

2125

2804

2126

2805

2127

def main():

2806

2128

2807

2129

##################################################################

2808

2130

# Parsing of options, both command line and config file

2809

2131

2810

2132

parser = argparse.ArgumentParser()

2811

2133

parser.add_argument("-v", "--version", action="version",

2812

version="%(prog)s {}".format(version),

2134

version = "%(prog)s {0}".format(version),

2813

2135

help="show version number and exit")

2814

2136

parser.add_argument("-i", "--interface", metavar="IF",

2815

2137

help="Bind to interface IF")

2821

2143

help="Run self-test")

2822

2144

parser.add_argument("--debug", action="store_true",

2823

2145

help="Debug mode; run in foreground and log"

2824

" to terminal", default=None)

2146

" to terminal")

2825

2147

parser.add_argument("--debuglevel", metavar="LEVEL",

2826

2148

help="Debug level for stdout output")

2827

2149

parser.add_argument("--priority", help="GnuTLS"

2834

2156

" files")

2835

2157

parser.add_argument("--no-dbus", action="store_false",

2836

2158

dest="use_dbus", help="Do not provide D-Bus"

2837

" system bus interface", default=None)

2159

" system bus interface")

2838

2160

parser.add_argument("--no-ipv6", action="store_false",

2839

dest="use_ipv6", help="Do not use IPv6",

2840

default=None)

2161

dest="use_ipv6", help="Do not use IPv6")

2841

2162

parser.add_argument("--no-restore", action="store_false",

2842

2163

dest="restore", help="Do not restore stored"

2843

" state", default=None)

2844

parser.add_argument("--socket", type=int,

2845

help="Specify a file descriptor to a network"

2846

" socket to use instead of creating one")

2164

" state")

2847

2165

parser.add_argument("--statedir", metavar="DIR",

2848

2166

help="Directory to save/restore state in")

2849

parser.add_argument("--foreground", action="store_true",

2850

help="Run in foreground", default=None)

2851

parser.add_argument("--no-zeroconf", action="store_false",

2852

dest="zeroconf", help="Do not use Zeroconf",

2853

default=None)

2854

2167

2855

2168

options = parser.parse_args()

2856

2169

2857

2170

if options.check:

2858

2171

import doctest

2859

fail_count, test_count = doctest.testmod()

2860

sys.exit(os.EX_OK if fail_count == 0 else 1)

2861

2172

doctest.testmod()

2173

sys.exit()

2174

2862

2175

# Default values for config file for server-global settings

2863

server_defaults = {"interface": "",

2864

"address": "",

2865

"port": "",

2866

"debug": "False",

2867

"priority":

2868

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2869

":+SIGN-DSA-SHA256",

2870

"servicename": "Mandos",

2871

"use_dbus": "True",

2872

"use_ipv6": "True",

2873

"debuglevel": "",

2874

"restore": "True",

2875

"socket": "",

2876

"statedir": "/var/lib/mandos",

2877

"foreground": "False",

2878

"zeroconf": "True",

2879

}

2880

2176

server_defaults = { "interface": "",

2177

"address": "",

2178

"port": "",

2179

"debug": "False",

2180

"priority":

2181

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2182

"servicename": "Mandos",

2183

"use_dbus": "True",

2184

"use_ipv6": "True",

2185

"debuglevel": "",

2186

"restore": "True",

2187

"statedir": "/var/lib/mandos"

2188

}

2189

2881

2190

# Parse config file for server-global settings

2882

2191

server_config = configparser.SafeConfigParser(server_defaults)

2883

2192

del server_defaults

2884

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2193

server_config.read(os.path.join(options.configdir,

2194

"mandos.conf"))

2885

2195

# Convert the SafeConfigParser object to a dict

2886

2196

server_settings = server_config.defaults()

2887

2197

# Use the appropriate methods on the non-string config options

2888

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2889

"foreground", "zeroconf"):

2198

for option in ("debug", "use_dbus", "use_ipv6"):

2890

2199

server_settings[option] = server_config.getboolean("DEFAULT",

2891

2200

option)

2892

2201

if server_settings["port"]:

2893

2202

server_settings["port"] = server_config.getint("DEFAULT",

2894

2203

"port")

2895

if server_settings["socket"]:

2896

server_settings["socket"] = server_config.getint("DEFAULT",

2897

"socket")

2898

# Later, stdin will, and stdout and stderr might, be dup'ed

2899

# over with an opened os.devnull. But we don't want this to

2900

# happen with a supplied network socket.

2901

if 0 <= server_settings["socket"] <= 2:

2902

server_settings["socket"] = os.dup(server_settings

2903

["socket"])

2904

2204

del server_config

2905

2205

2906

2206

# Override the settings from the config file with command line

2907

2207

# options, if set.

2908

2208

for option in ("interface", "address", "port", "debug",

2909

"priority", "servicename", "configdir", "use_dbus",

2910

"use_ipv6", "debuglevel", "restore", "statedir",

2911

"socket", "foreground", "zeroconf"):

2209

"priority", "servicename", "configdir",

2210

"use_dbus", "use_ipv6", "debuglevel", "restore",

2211

"statedir"):

2912

2212

value = getattr(options, option)

2913

2213

if value is not None:

2914

2214

server_settings[option] = value

2915

2215

del options

2916

2216

# Force all strings to be unicode

2917

2217

for option in server_settings.keys():

2918

if isinstance(server_settings[option], bytes):

2919

server_settings[option] = (server_settings[option]

2920

.decode("utf-8"))

2921

# Force all boolean options to be boolean

2922

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2923

"foreground", "zeroconf"):

2924

server_settings[option] = bool(server_settings[option])

2925

# Debug implies foreground

2926

if server_settings["debug"]:

2927

server_settings["foreground"] = True

2218

if type(server_settings[option]) is str:

2219

server_settings[option] = unicode(server_settings[option])

2928

2220

# Now we have our good server settings in "server_settings"

2929

2221

2930

2222

##################################################################

2931

2932

if (not server_settings["zeroconf"]

2933

and not (server_settings["port"]

2934

or server_settings["socket"] != "")):

2935

parser.error("Needs port or socket to work without Zeroconf")

2936

2223

2937

2224

# For convenience

2938

2225

debug = server_settings["debug"]

2939

2226

debuglevel = server_settings["debuglevel"]

2941

2228

use_ipv6 = server_settings["use_ipv6"]

2942

2229

stored_state_path = os.path.join(server_settings["statedir"],

2943

2230

stored_state_file)

2944

foreground = server_settings["foreground"]

2945

zeroconf = server_settings["zeroconf"]

2946

2231

2947

2232

if debug:

2948

2233

initlogger(debug, logging.DEBUG)

2949

2234

else:

2952

2237

else:

2953

2238

level = getattr(logging, debuglevel.upper())

2954

2239

initlogger(debug, level)

2955

2240

2956

2241

if server_settings["servicename"] != "Mandos":

2957

syslogger.setFormatter(

2958

logging.Formatter('Mandos ({}) [%(process)d]:'

2959

' %(levelname)s: %(message)s'.format(

2960

server_settings["servicename"])))

2961

2242

syslogger.setFormatter(logging.Formatter

2243

('Mandos ({0}) [%(process)d]:'

2244

' %(levelname)s: %(message)s'

2245

.format(server_settings

2246

["servicename"])))

2247

2962

2248

# Parse config file with clients

2963

2249

client_config = configparser.SafeConfigParser(Client

2964

2250

.client_defaults)

2965

2251

client_config.read(os.path.join(server_settings["configdir"],

2966

2252

"clients.conf"))

2967

2253

2968

2254

global mandos_dbus_service

2969

2255

mandos_dbus_service = None

2970

2971

socketfd = None

2972

if server_settings["socket"] != "":

2973

socketfd = server_settings["socket"]

2974

tcp_server = MandosServer(

2975

(server_settings["address"], server_settings["port"]),

2976

ClientHandler,

2977

interface=(server_settings["interface"] or None),

2978

use_ipv6=use_ipv6,

2979

gnutls_priority=server_settings["priority"],

2980

use_dbus=use_dbus,

2981

socketfd=socketfd)

2982

if not foreground:

2983

pidfilename = "/run/mandos.pid"

2984

if not os.path.isdir("/run/."):

2985

pidfilename = "/var/run/mandos.pid"

2986

pidfile = None

2256

2257

tcp_server = MandosServer((server_settings["address"],

2258

server_settings["port"]),

2259

ClientHandler,

2260

interface=(server_settings["interface"]

2261

or None),

2262

use_ipv6=use_ipv6,

2263

gnutls_priority=

2264

server_settings["priority"],

2265

use_dbus=use_dbus)

2266

if not debug:

2267

pidfilename = "/var/run/mandos.pid"

2987

2268

try:

2988

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2269

pidfile = open(pidfilename, "w")

2989

2270

except IOError as e:

2990

2271

logger.error("Could not open file %r", pidfilename,

2991

2272

exc_info=e)

2992

2993

for name, group in (("_mandos", "_mandos"),

2994

("mandos", "mandos"),

2995

("nobody", "nogroup")):

2273

2274

for name in ("_mandos", "mandos", "nobody"):

2996

2275

try:

2997

2276

uid = pwd.getpwnam(name).pw_uid

2998

gid = pwd.getpwnam(group).pw_gid

2277

gid = pwd.getpwnam(name).pw_gid

2999

2278

break

3000

2279

except KeyError:

3001

2280

continue

3005

2284

try:

3006

2285

os.setgid(gid)

3007

2286

os.setuid(uid)

3008

if debug:

3009

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3010

gid))

3011

2287

except OSError as error:

3012

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3013

.format(uid, gid, os.strerror(error.errno)))

3014

if error.errno != errno.EPERM:

3015

raise

3016

2288

if error[0] != errno.EPERM:

2289

raise error

2290

3017

2291

if debug:

3018

2292

# Enable all possible GnuTLS debugging

3019

2293

3020

2294

# "Use a log level over 10 to enable all debugging options."

3021

2295

# - GnuTLS manual

3022

gnutls.global_set_log_level(11)

3023

3024

@gnutls.log_func

2296

gnutls.library.functions.gnutls_global_set_log_level(11)

2297

2298

@gnutls.library.types.gnutls_log_func

3025

2299

def debug_gnutls(level, string):

3026

2300

logger.debug("GnuTLS: %s", string[:-1])

3027

3028

gnutls.global_set_log_function(debug_gnutls)

3029

2301

2302

(gnutls.library.functions

2303

.gnutls_global_set_log_function(debug_gnutls))

2304

3030

2305

# Redirect stdin so all checkers get /dev/null

3031

2306

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3032

2307

os.dup2(null, sys.stdin.fileno())

3033

2308

if null > 2:

3034

2309

os.close(null)

3035

2310

3036

2311

# Need to fork before connecting to D-Bus

3037

if not foreground:

2312

if not debug:

3038

2313

# Close all input and output, do double fork, etc.

3039

2314

daemon()

3040

3041

# multiprocessing will use threads, so before we use GLib we need

3042

# to inform GLib that threads will be used.

3043

GLib.threads_init()

3044

2315

2316

gobject.threads_init()

2317

3045

2318

global main_loop

3046

2319

# From the Avahi example code

3047

2320

DBusGMainLoop(set_as_default=True)

3048

main_loop = GLib.MainLoop()

2321

main_loop = gobject.MainLoop()

3049

2322

bus = dbus.SystemBus()

3050

2323

# End of Avahi example code

3051

2324

if use_dbus:

3052

2325

try:

3053

2326

bus_name = dbus.service.BusName("se.recompile.Mandos",

3054

bus,

3055

do_not_queue=True)

3056

old_bus_name = dbus.service.BusName(

3057

"se.bsnet.fukt.Mandos", bus,

3058

do_not_queue=True)

3059

except dbus.exceptions.DBusException as e:

2327

bus, do_not_queue=True)

2328

old_bus_name = (dbus.service.BusName

2329

("se.bsnet.fukt.Mandos", bus,

2330

do_not_queue=True))

2331

except dbus.exceptions.NameExistsException as e:

3060

2332

logger.error("Disabling D-Bus:", exc_info=e)

3061

2333

use_dbus = False

3062

2334

server_settings["use_dbus"] = False

3063

2335

tcp_server.use_dbus = False

3064

if zeroconf:

3065

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3066

service = AvahiServiceToSyslog(

3067

name=server_settings["servicename"],

3068

servicetype="_mandos._tcp",

3069

protocol=protocol,

3070

bus=bus)

3071

if server_settings["interface"]:

3072

service.interface = if_nametoindex(

3073

server_settings["interface"].encode("utf-8"))

3074

2336

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2337

service = AvahiServiceToSyslog(name =

2338

server_settings["servicename"],

2339

servicetype = "_mandos._tcp",

2340

protocol = protocol, bus = bus)

2341

if server_settings["interface"]:

2342

service.interface = (if_nametoindex

2343

(str(server_settings["interface"])))

2344

3075

2345

global multiprocessing_manager

3076

2346

multiprocessing_manager = multiprocessing.Manager()

3077

2347

3078

2348

client_class = Client

3079

2349

if use_dbus:

3080

client_class = functools.partial(ClientDBus, bus=bus)

3081

2350

client_class = functools.partial(ClientDBus, bus = bus)

2351

3082

2352

client_settings = Client.config_parser(client_config)

3083

2353

old_client_settings = {}

3084

2354

clients_data = {}

3085

3086

# This is used to redirect stdout and stderr for checker processes

3087

global wnull

3088

wnull = open(os.devnull, "w") # A writable /dev/null

3089

# Only used if server is running in foreground but not in debug

3090

# mode

3091

if debug or not foreground:

3092

wnull.close()

3093

2355

3094

2356

# Get client data and settings from last running state.

3095

2357

if server_settings["restore"]:

3096

2358

try:

3097

2359

with open(stored_state_path, "rb") as stored_state:

3098

if sys.version_info.major == 2:

3099

clients_data, old_client_settings = pickle.load(

3100

stored_state)

3101

else:

3102

bytes_clients_data, bytes_old_client_settings = (

3103

pickle.load(stored_state, encoding="bytes"))

3104

# Fix bytes to strings

3105

# clients_data

3106

# .keys()

3107

clients_data = {(key.decode("utf-8")

3108

if isinstance(key, bytes)

3109

else key): value

3110

for key, value in

3111

bytes_clients_data.items()}

3112

del bytes_clients_data

3113

for key in clients_data:

3114

value = {(k.decode("utf-8")

3115

if isinstance(k, bytes) else k): v

3116

for k, v in

3117

clients_data[key].items()}

3118

clients_data[key] = value

3119

# .client_structure

3120

value["client_structure"] = [

3121

(s.decode("utf-8")

3122

if isinstance(s, bytes)

3123

else s) for s in

3124

value["client_structure"]]

3125

# .name & .host

3126

for k in ("name", "host"):

3127

if isinstance(value[k], bytes):

3128

value[k] = value[k].decode("utf-8")

3129

# old_client_settings

3130

# .keys()

3131

old_client_settings = {

3132

(key.decode("utf-8")

3133

if isinstance(key, bytes)

3134

else key): value

3135

for key, value in

3136

bytes_old_client_settings.items()}

3137

del bytes_old_client_settings

3138

# .host

3139

for value in old_client_settings.values():

3140

if isinstance(value["host"], bytes):

3141

value["host"] = (value["host"]

3142

.decode("utf-8"))

2360

clients_data, old_client_settings = (pickle.load

2361

(stored_state))

3143

2362

os.remove(stored_state_path)

3144

2363

except IOError as e:

3145

2364

if e.errno == errno.ENOENT:

3146

logger.warning("Could not load persistent state:"

3147

" {}".format(os.strerror(e.errno)))

2365

logger.warning("Could not load persistent state: {0}"

2366

.format(os.strerror(e.errno)))

3148

2367

else:

3149

2368

logger.critical("Could not load persistent state:",

3150

2369

exc_info=e)

3151

2370

raise

3152

2371

except EOFError as e:

3153

2372

logger.warning("Could not load persistent state: "

3154

"EOFError:",

3155

exc_info=e)

3156

2373

"EOFError:", exc_info=e)

2374

3157

2375

with PGPEngine() as pgp:

3158

for client_name, client in clients_data.items():

3159

# Skip removed clients

3160

if client_name not in client_settings:

3161

continue

3162

2376

for client_name, client in clients_data.iteritems():

3163

2377

# Decide which value to use after restoring saved state.

3164

2378

# We have three different values: Old config file,

3165

2379

# new config file, and saved state.

3170

2384

# For each value in new config, check if it

3171

2385

# differs from the old config value (Except for

3172

2386

# the "secret" attribute)

3173

if (name != "secret"

3174

and (value !=

3175

old_client_settings[client_name][name])):

2387

if (name != "secret" and

2388

value != old_client_settings[client_name]

2389

[name]):

3176

2390

client[name] = value

3177

2391

except KeyError:

3178

2392

pass

3179

2393

3180

2394

# Clients who has passed its expire date can still be

3181

# enabled if its last checker was successful. A Client

2395

# enabled if its last checker was successful. Clients

3182

2396

# whose checker succeeded before we stored its state is

3183

2397

# assumed to have successfully run all checkers during

3184

2398

# downtime.

3186

2400

if datetime.datetime.utcnow() >= client["expires"]:

3187

2401

if not client["last_checked_ok"]:

3188

2402

logger.warning(

3189

"disabling client {} - Client never "

3190

"performed a successful checker".format(

3191

client_name))

2403

"disabling client {0} - Client never "

2404

"performed a successful checker"

2405

.format(client_name))

3192

2406

client["enabled"] = False

3193

2407

elif client["last_checker_status"] != 0:

3194

2408

logger.warning(

3195

"disabling client {} - Client last"

3196

" checker failed with error code"

3197

" {}".format(

3198

client_name,

3199

client["last_checker_status"]))

2409

"disabling client {0} - Client "

2410

"last checker failed with error code {1}"

2411

.format(client_name,

2412

client["last_checker_status"]))

3200

2413

client["enabled"] = False

3201

2414

else:

3202

client["expires"] = (

3203

datetime.datetime.utcnow()

3204

+ client["timeout"])

2415

client["expires"] = (datetime.datetime

2416

.utcnow()

2417

+ client["timeout"])

3205

2418

logger.debug("Last checker succeeded,"

3206

" keeping {} enabled".format(

3207

client_name))

2419

" keeping {0} enabled"

2420

.format(client_name))

3208

2421

try:

3209

client["secret"] = pgp.decrypt(

3210

client["encrypted_secret"],

3211

client_settings[client_name]["secret"])

2422

client["secret"] = (

2423

pgp.decrypt(client["encrypted_secret"],

2424

client_settings[client_name]

2425

["secret"]))

3212

2426

except PGPError:

3213

2427

# If decryption fails, we use secret from new settings

3214

logger.debug("Failed to decrypt {} old secret".format(

3215

client_name))

3216

client["secret"] = (client_settings[client_name]

3217

["secret"])

3218

2428

logger.debug("Failed to decrypt {0} old secret"

2429

.format(client_name))

2430

client["secret"] = (

2431

client_settings[client_name]["secret"])

2432

3219

2433

# Add/remove clients based on new changes made to config

3220

2434

for client_name in (set(old_client_settings)

3221

2435

- set(client_settings)):

3223

2437

for client_name in (set(client_settings)

3224

2438

- set(old_client_settings)):

3225

2439

clients_data[client_name] = client_settings[client_name]

3226

2440

3227

2441

# Create all client objects

3228

for client_name, client in clients_data.items():

2442

for client_name, client in clients_data.iteritems():

3229

2443

tcp_server.clients[client_name] = client_class(

3230

name=client_name,

3231

settings=client,

3232

server_settings=server_settings)

3233

2444

name = client_name, settings = client)

2445

3234

2446

if not tcp_server.clients:

3235

2447

logger.warning("No clients defined")

3236

3237

if not foreground:

3238

if pidfile is not None:

3239

pid = os.getpid()

3240

try:

3241

with pidfile:

3242

print(pid, file=pidfile)

3243

except IOError:

3244

logger.error("Could not write to file %r with PID %d",

3245

pidfilename, pid)

3246

del pidfile

2448

2449

if not debug:

2450

try:

2451

with pidfile:

2452

pid = os.getpid()

2453

pidfile.write(str(pid) + "\n".encode("utf-8"))

2454

del pidfile

2455

except IOError:

2456

logger.error("Could not write to file %r with PID %d",

2457

pidfilename, pid)

2458

except NameError:

2459

# "pidfile" was never created

2460

pass

3247

2461

del pidfilename

3248

3249

for termsig in (signal.SIGHUP, signal.SIGTERM):

3250

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3251

lambda: main_loop.quit() and False)

3252

2462

signal.signal(signal.SIGINT, signal.SIG_IGN)

2463

2464

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2465

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2466

3253

2467

if use_dbus:

3254

3255

@alternate_dbus_interfaces(

3256

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3257

class MandosDBusService(DBusObjectWithObjectManager):

2468

@alternate_dbus_interfaces({"se.recompile.Mandos":

2469

"se.bsnet.fukt.Mandos"})

2470

class MandosDBusService(DBusObjectWithProperties):

3258

2471

"""A D-Bus proxy object"""

3259

3260

2472

def __init__(self):

3261

2473

dbus.service.Object.__init__(self, bus, "/")

3262

3263

2474

_interface = "se.recompile.Mandos"

3264

2475

2476

@dbus_interface_annotations(_interface)

2477

def _foo(self):

2478

return { "org.freedesktop.DBus.Property"

2479

".EmitsChangedSignal":

2480

"false"}

2481

3265

2482

@dbus.service.signal(_interface, signature="o")

3266

2483

def ClientAdded(self, objpath):

3267

2484

"D-Bus signal"

3268

2485

pass

3269

2486

3270

2487

@dbus.service.signal(_interface, signature="ss")

3271

2488

def ClientNotFound(self, fingerprint, address):

3272

2489

"D-Bus signal"

3273

2490

pass

3274

3275

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3276

"true"})

2491

3277

2492

@dbus.service.signal(_interface, signature="os")

3278

2493

def ClientRemoved(self, objpath, name):

3279

2494

"D-Bus signal"

3280

2495

pass

3281

3282

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3283

"true"})

2496

3284

2497

@dbus.service.method(_interface, out_signature="ao")

3285

2498

def GetAllClients(self):

3286

2499

"D-Bus method"

3287

return dbus.Array(c.dbus_object_path for c in

3288

tcp_server.clients.values())

3289

3290

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3291

"true"})

2500

return dbus.Array(c.dbus_object_path

2501

for c in

2502

tcp_server.clients.itervalues())

2503

3292

2504

@dbus.service.method(_interface,

3293

2505

out_signature="a{oa{sv}}")

3294

2506

def GetAllClientsWithProperties(self):

3295

2507

"D-Bus method"

3296

2508

return dbus.Dictionary(

3297

{c.dbus_object_path: c.GetAll(

3298

"se.recompile.Mandos.Client")

3299

for c in tcp_server.clients.values()},

2509

((c.dbus_object_path, c.GetAll(""))

2510

for c in tcp_server.clients.itervalues()),

3300

2511

signature="oa{sv}")

3301

2512

3302

2513

@dbus.service.method(_interface, in_signature="o")

3303

2514

def RemoveClient(self, object_path):

3304

2515

"D-Bus method"

3305

for c in tcp_server.clients.values():

2516

for c in tcp_server.clients.itervalues():

3306

2517

if c.dbus_object_path == object_path:

3307

2518

del tcp_server.clients[c.name]

3308

2519

c.remove_from_connection()

3309

# Don't signal the disabling

2520

# Don't signal anything except ClientRemoved

3310

2521

c.disable(quiet=True)

3311

# Emit D-Bus signal for removal

3312

self.client_removed_signal(c)

2522

# Emit D-Bus signal

2523

self.ClientRemoved(object_path, c.name)

3313

2524

return

3314

2525

raise KeyError(object_path)

3315

2526

3316

2527

del _interface

3317

3318

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3319

out_signature="a{oa{sa{sv}}}")

3320

def GetManagedObjects(self):

3321

"""D-Bus method"""

3322

return dbus.Dictionary(

3323

{client.dbus_object_path:

3324

dbus.Dictionary(

3325

{interface: client.GetAll(interface)

3326

for interface in

3327

client._get_all_interface_names()})

3328

for client in tcp_server.clients.values()})

3329

3330

def client_added_signal(self, client):

3331

"""Send the new standard signal and the old signal"""

3332

if use_dbus:

3333

# New standard signal

3334

self.InterfacesAdded(

3335

client.dbus_object_path,

3336

dbus.Dictionary(

3337

{interface: client.GetAll(interface)

3338

for interface in

3339

client._get_all_interface_names()}))

3340

# Old signal

3341

self.ClientAdded(client.dbus_object_path)

3342

3343

def client_removed_signal(self, client):

3344

"""Send the new standard signal and the old signal"""

3345

if use_dbus:

3346

# New standard signal

3347

self.InterfacesRemoved(

3348

client.dbus_object_path,

3349

client._get_all_interface_names())

3350

# Old signal

3351

self.ClientRemoved(client.dbus_object_path,

3352

client.name)

3353

2528

3354

2529

mandos_dbus_service = MandosDBusService()

3355

3356

# Save modules to variables to exempt the modules from being

3357

# unloaded before the function registered with atexit() is run.

3358

mp = multiprocessing

3359

wn = wnull

3360

2530

3361

2531

def cleanup():

3362

2532

"Cleanup function; run on exit"

3363

if zeroconf:

3364

service.cleanup()

3365

3366

mp.active_children()

3367

wn.close()

2533

service.cleanup()

2534

2535

multiprocessing.active_children()

3368

2536

if not (tcp_server.clients or client_settings):

3369

2537

return

3370

2538

3371

2539

# Store client before exiting. Secrets are encrypted with key

3372

2540

# based on what config file has. If config file is

3373

2541

# removed/edited, old secret will thus be unrecovable.

3374

2542

clients = {}

3375

2543

with PGPEngine() as pgp:

3376

for client in tcp_server.clients.values():

2544

for client in tcp_server.clients.itervalues():

3377

2545

key = client_settings[client.name]["secret"]

3378

2546

client.encrypted_secret = pgp.encrypt(client.secret,

3379

2547

key)

3380

2548

client_dict = {}

3381

2549

3382

2550

# A list of attributes that can not be pickled

3383

2551

# + secret.

3384

exclude = {"bus", "changedstate", "secret",

3385

"checker", "server_settings"}

3386

for name, typ in inspect.getmembers(dbus.service

3387

.Object):

2552

exclude = set(("bus", "changedstate", "secret",

2553

"checker"))

2554

for name, typ in (inspect.getmembers

2555

(dbus.service.Object)):

3388

2556

exclude.add(name)

3389

2557

3390

2558

client_dict["encrypted_secret"] = (client

3391

2559

.encrypted_secret)

3392

2560

for attr in client.client_structure:

3393

2561

if attr not in exclude:

3394

2562

client_dict[attr] = getattr(client, attr)

3395

2563

3396

2564

clients[client.name] = client_dict

3397

2565

del client_settings[client.name]["secret"]

3398

2566

3399

2567

try:

3400

with tempfile.NamedTemporaryFile(

3401

mode='wb',

3402

suffix=".pickle",

3403

prefix='clients-',

3404

dir=os.path.dirname(stored_state_path),

3405

delete=False) as stored_state:

3406

pickle.dump((clients, client_settings), stored_state,

3407

protocol=2)

3408

tempname = stored_state.name

2568

with (tempfile.NamedTemporaryFile

2569

(mode='wb', suffix=".pickle", prefix='clients-',

2570

dir=os.path.dirname(stored_state_path),

2571

delete=False)) as stored_state:

2572

pickle.dump((clients, client_settings), stored_state)

2573

tempname=stored_state.name

3409

2574

os.rename(tempname, stored_state_path)

3410

2575

except (IOError, OSError) as e:

3411

2576

if not debug:

3414

2579

except NameError:

3415

2580

pass

3416

2581

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3417

logger.warning("Could not save persistent state: {}"

2582

logger.warning("Could not save persistent state: {0}"

3418

2583

.format(os.strerror(e.errno)))

3419

2584

else:

3420

2585

logger.warning("Could not save persistent state:",

3421

2586

exc_info=e)

3422

raise

3423

2587

raise e

2588

3424

2589

# Delete all clients, and settings from config

3425

2590

while tcp_server.clients:

3426

2591

name, client = tcp_server.clients.popitem()

3427

2592

if use_dbus:

3428

2593

client.remove_from_connection()

3429

# Don't signal the disabling

2594

# Don't signal anything except ClientRemoved

3430

2595

client.disable(quiet=True)

3431

# Emit D-Bus signal for removal

3432

2596

if use_dbus:

3433

mandos_dbus_service.client_removed_signal(client)

2597

# Emit D-Bus signal

2598

mandos_dbus_service.ClientRemoved(client

2599

.dbus_object_path,

2600

client.name)

3434

2601

client_settings.clear()

3435

2602

3436

2603

atexit.register(cleanup)

3437

3438

for client in tcp_server.clients.values():

2604

2605

for client in tcp_server.clients.itervalues():

3439

2606

if use_dbus:

3440

# Emit D-Bus signal for adding

3441

mandos_dbus_service.client_added_signal(client)

2607

# Emit D-Bus signal

2608

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3442

2609

# Need to initiate checking of clients

3443

2610

if client.enabled:

3444

2611

client.init_checker()

3445

2612

3446

2613

tcp_server.enable()

3447

2614

tcp_server.server_activate()

3448

2615

3449

2616

# Find out what port we got

3450

if zeroconf:

3451

service.port = tcp_server.socket.getsockname()[1]

2617

service.port = tcp_server.socket.getsockname()[1]

3452

2618

if use_ipv6:

3453

2619

logger.info("Now listening on address %r, port %d,"

3454

2620

" flowinfo %d, scope_id %d",

3456

2622

else: # IPv4

3457

2623

logger.info("Now listening on address %r, port %d",

3458

2624

*tcp_server.socket.getsockname())

3459

3460

# service.interface = tcp_server.socket.getsockname()[3]

3461

2625

2626

#service.interface = tcp_server.socket.getsockname()[3]

2627

3462

2628

try:

3463

if zeroconf:

3464

# From the Avahi example code

3465

try:

3466

service.activate()

3467

except dbus.exceptions.DBusException as error:

3468

logger.critical("D-Bus Exception", exc_info=error)

3469

cleanup()

3470

sys.exit(1)

3471

# End of Avahi example code

3472

3473

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3474

lambda *args, **kwargs:

3475

(tcp_server.handle_request

3476

(*args[2:], **kwargs) or True))

3477

2629

# From the Avahi example code

2630

try:

2631

service.activate()

2632

except dbus.exceptions.DBusException as error:

2633

logger.critical("D-Bus Exception", exc_info=error)

2634

cleanup()

2635

sys.exit(1)

2636

# End of Avahi example code

2637

2638

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2639

lambda *args, **kwargs:

2640

(tcp_server.handle_request

2641

(*args[2:], **kwargs) or True))

2642

3478

2643

logger.debug("Starting main loop")

3479

2644

main_loop.run()

3480

2645

except AvahiError as error:

3489

2654

# Must run before the D-Bus bus name gets deregistered

3490

2655

cleanup()

3491

2656

3492

3493

2657

if __name__ == '__main__':

3494

2658

main()