/mandos/release : revision 237.7.174

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

72

81

73

import dbus

82

74

import dbus.service

83

import gi

84

from gi.repository import GLib

75

import gobject

76

import avahi

85

77

from dbus.mainloop.glib import DBusGMainLoop

86

78

import ctypes

87

79

import ctypes.util

88

80

import xml.dom.minidom

89

81

import inspect

90

82

91

# Try to find the value of SO_BINDTODEVICE:

92

83

try:

93

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

94

# newer, and it is also the most natural place for it:

95

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

96

85

except AttributeError:

97

86

try:

98

# This is where SO_BINDTODEVICE was up to and including Python

99

# 2.6, and also 3.2:

100

87

from IN import SO_BINDTODEVICE

101

88

except ImportError:

102

# In Python 2.7 it seems to have been removed entirely.

103

# Try running the C preprocessor:

104

try:

105

cc = subprocess.Popen(["cc", "--language=c", "-E",

106

"/dev/stdin"],

107

stdin=subprocess.PIPE,

108

stdout=subprocess.PIPE)

109

stdout = cc.communicate(

110

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

111

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

112

except (OSError, ValueError, IndexError):

113

# No value found

114

SO_BINDTODEVICE = None

115

116

if sys.version_info.major == 2:

117

str = unicode

118

119

if sys.version_info < (3, 2):

120

configparser.Configparser = configparser.SafeConfigParser

121

122

version = "1.8.6"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.1"

123

92

stored_state_file = "clients.pickle"

124

93

125

94

logger = logging.getLogger()

126

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

127

98

128

99

try:

129

if_nametoindex = ctypes.cdll.LoadLibrary(

130

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

131

103

except (OSError, AttributeError):

132

133

104

def if_nametoindex(interface):

134

105

"Get an interface index the hard way, i.e. using fcntl()"

135

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

136

107

with contextlib.closing(socket.socket()) as s:

137

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

138

struct.pack(b"16s16x", interface))

139

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

140

113

return interface_index

141

114

142

115

143

def copy_function(func):

144

"""Make a copy of a function"""

145

if sys.version_info.major == 2:

146

return types.FunctionType(func.func_code,

147

func.func_globals,

148

func.func_name,

149

func.func_defaults,

150

func.func_closure)

151

else:

152

return types.FunctionType(func.__code__,

153

func.__globals__,

154

func.__name__,

155

func.__defaults__,

156

func.__closure__)

157

158

159

116

def initlogger(debug, level=logging.WARNING):

160

117

"""init logger and add loglevel"""

161

162

global syslogger

163

syslogger = (logging.handlers.SysLogHandler(

164

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

165

address="/dev/log"))

118

166

119

syslogger.setFormatter(logging.Formatter

167

120

('Mandos [%(process)d]: %(levelname)s:'

168

121

' %(message)s'))

169

122

logger.addHandler(syslogger)

170

123

171

124

if debug:

172

125

console = logging.StreamHandler()

173

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

185

138

186

139

class PGPEngine(object):

187

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

188

189

141

def __init__(self):

190

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

191

self.gpg = "gpg"

192

try:

193

output = subprocess.check_output(["gpgconf"])

194

for line in output.splitlines():

195

name, text, path = line.split(b":")

196

if name == "gpg":

197

self.gpg = path

198

break

199

except OSError as e:

200

if e.errno != errno.ENOENT:

201

raise

202

143

self.gnupgargs = ['--batch',

203

'--homedir', self.tempdir,

144

'--home', self.tempdir,

204

145

'--force-mdc',

205

'--quiet']

206

# Only GPG version 1 has the --no-use-agent option.

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

208

self.gnupgargs.append("--no-use-agent")

209

146

'--quiet',

147

'--no-use-agent']

148

210

149

def __enter__(self):

211

150

return self

212

151

213

152

def __exit__(self, exc_type, exc_value, traceback):

214

153

self._cleanup()

215

154

return False

216

155

217

156

def __del__(self):

218

157

self._cleanup()

219

158

220

159

def _cleanup(self):

221

160

if self.tempdir is not None:

222

161

# Delete contents of tempdir

223

162

for root, dirs, files in os.walk(self.tempdir,

224

topdown=False):

163

topdown = False):

225

164

for filename in files:

226

165

os.remove(os.path.join(root, filename))

227

166

for dirname in dirs:

229

168

# Remove tempdir

230

169

os.rmdir(self.tempdir)

231

170

self.tempdir = None

232

171

233

172

def password_encode(self, password):

234

173

# Passphrase can not be empty and can not contain newlines or

235

174

# NUL bytes. So we prefix it and hex encode it.

236

encoded = b"mandos" + binascii.hexlify(password)

237

if len(encoded) > 2048:

238

# GnuPG can't handle long passwords, so encode differently

239

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

240

.replace(b"\n", b"\\n")

241

.replace(b"\0", b"\\x00"))

242

return encoded

243

175

return b"mandos" + binascii.hexlify(password)

176

244

177

def encrypt(self, data, password):

245

178

passphrase = self.password_encode(password)

246

with tempfile.NamedTemporaryFile(

247

dir=self.tempdir) as passfile:

179

with tempfile.NamedTemporaryFile(dir=self.tempdir

180

) as passfile:

248

181

passfile.write(passphrase)

249

182

passfile.flush()

250

proc = subprocess.Popen([self.gpg, '--symmetric',

183

proc = subprocess.Popen(['gpg', '--symmetric',

251

184

'--passphrase-file',

252

185

passfile.name]

253

186

+ self.gnupgargs,

254

stdin=subprocess.PIPE,

255

stdout=subprocess.PIPE,

256

stderr=subprocess.PIPE)

257

ciphertext, err = proc.communicate(input=data)

187

stdin = subprocess.PIPE,

188

stdout = subprocess.PIPE,

189

stderr = subprocess.PIPE)

190

ciphertext, err = proc.communicate(input = data)

258

191

if proc.returncode != 0:

259

192

raise PGPError(err)

260

193

return ciphertext

261

194

262

195

def decrypt(self, data, password):

263

196

passphrase = self.password_encode(password)

264

with tempfile.NamedTemporaryFile(

265

dir=self.tempdir) as passfile:

197

with tempfile.NamedTemporaryFile(dir = self.tempdir

198

) as passfile:

266

199

passfile.write(passphrase)

267

200

passfile.flush()

268

proc = subprocess.Popen([self.gpg, '--decrypt',

201

proc = subprocess.Popen(['gpg', '--decrypt',

269

202

'--passphrase-file',

270

203

passfile.name]

271

204

+ self.gnupgargs,

272

stdin=subprocess.PIPE,

273

stdout=subprocess.PIPE,

274

stderr=subprocess.PIPE)

275

decrypted_plaintext, err = proc.communicate(input=data)

205

stdin = subprocess.PIPE,

206

stdout = subprocess.PIPE,

207

stderr = subprocess.PIPE)

208

decrypted_plaintext, err = proc.communicate(input

209

= data)

276

210

if proc.returncode != 0:

277

211

raise PGPError(err)

278

212

return decrypted_plaintext

279

213

280

214

281

# Pretend that we have an Avahi module

282

class avahi(object):

283

"""This isn't so much a class as it is a module-like namespace."""

284

IF_UNSPEC = -1 # avahi-common/address.h

285

PROTO_UNSPEC = -1 # avahi-common/address.h

286

PROTO_INET = 0 # avahi-common/address.h

287

PROTO_INET6 = 1 # avahi-common/address.h

288

DBUS_NAME = "org.freedesktop.Avahi"

289

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

290

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

291

DBUS_PATH_SERVER = "/"

292

293

@staticmethod

294

def string_array_to_txt_array(t):

295

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

296

for s in t), signature="ay")

297

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

298

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

299

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

300

SERVER_INVALID = 0 # avahi-common/defs.h

301

SERVER_REGISTERING = 1 # avahi-common/defs.h

302

SERVER_RUNNING = 2 # avahi-common/defs.h

303

SERVER_COLLISION = 3 # avahi-common/defs.h

304

SERVER_FAILURE = 4 # avahi-common/defs.h

305

306

307

215

class AvahiError(Exception):

308

216

def __init__(self, value, *args, **kwargs):

309

217

self.value = value

310

return super(AvahiError, self).__init__(value, *args,

311

**kwargs)

312

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

313

221

314

222

class AvahiServiceError(AvahiError):

315

223

pass

316

224

317

318

225

class AvahiGroupError(AvahiError):

319

226

pass

320

227

321

228

322

229

class AvahiService(object):

323

230

"""An Avahi (Zeroconf) service.

324

231

325

232

Attributes:

326

233

interface: integer; avahi.IF_UNSPEC or an interface index.

327

234

Used to optionally bind to the specified interface.

339

246

server: D-Bus Server

340

247

bus: dbus.SystemBus()

341

248

"""

342

343

def __init__(self,

344

interface=avahi.IF_UNSPEC,

345

name=None,

346

servicetype=None,

347

port=None,

348

TXT=None,

349

domain="",

350

host="",

351

max_renames=32768,

352

protocol=avahi.PROTO_UNSPEC,

353

bus=None):

249

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

354

254

self.interface = interface

355

255

self.name = name

356

256

self.type = servicetype

365

265

self.server = None

366

266

self.bus = bus

367

267

self.entry_group_state_changed_match = None

368

369

def rename(self, remove=True):

268

269

def rename(self):

370

270

"""Derived from the Avahi example code"""

371

271

if self.rename_count >= self.max_renames:

372

272

logger.critical("No suitable Zeroconf service name found"

373

273

" after %i retries, exiting.",

374

274

self.rename_count)

375

275

raise AvahiServiceError("Too many renames")

376

self.name = str(

377

self.server.GetAlternativeServiceName(self.name))

378

self.rename_count += 1

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

379

278

logger.info("Changing Zeroconf service name to %r ...",

380

279

self.name)

381

if remove:

382

self.remove()

280

self.remove()

383

281

try:

384

282

self.add()

385

283

except dbus.exceptions.DBusException as error:

386

if (error.get_dbus_name()

387

== "org.freedesktop.Avahi.CollisionError"):

388

logger.info("Local Zeroconf service name collision.")

389

return self.rename(remove=False)

390

else:

391

logger.critical("D-Bus Exception", exc_info=error)

392

self.cleanup()

393

os._exit(1)

394

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

287

self.rename_count += 1

288

395

289

def remove(self):

396

290

"""Derived from the Avahi example code"""

397

291

if self.entry_group_state_changed_match is not None:

399

293

self.entry_group_state_changed_match = None

400

294

if self.group is not None:

401

295

self.group.Reset()

402

296

403

297

def add(self):

404

298

"""Derived from the Avahi example code"""

405

299

self.remove()

422

316

dbus.UInt16(self.port),

423

317

avahi.string_array_to_txt_array(self.TXT))

424

318

self.group.Commit()

425

319

426

320

def entry_group_state_changed(self, state, error):

427

321

"""Derived from the Avahi example code"""

428

322

logger.debug("Avahi entry group state change: %i", state)

429

323

430

324

if state == avahi.ENTRY_GROUP_ESTABLISHED:

431

325

logger.debug("Zeroconf service established.")

432

326

elif state == avahi.ENTRY_GROUP_COLLISION:

434

328

self.rename()

435

329

elif state == avahi.ENTRY_GROUP_FAILURE:

436

330

logger.critical("Avahi: Error in group state changed %s",

437

str(error))

438

raise AvahiGroupError("State changed: {!s}".format(error))

439

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

334

440

335

def cleanup(self):

441

336

"""Derived from the Avahi example code"""

442

337

if self.group is not None:

447

342

pass

448

343

self.group = None

449

344

self.remove()

450

345

451

346

def server_state_changed(self, state, error=None):

452

347

"""Derived from the Avahi example code"""

453

348

logger.debug("Avahi server state change: %i", state)

454

bad_states = {

455

avahi.SERVER_INVALID: "Zeroconf server invalid",

456

avahi.SERVER_REGISTERING: None,

457

avahi.SERVER_COLLISION: "Zeroconf server name collision",

458

avahi.SERVER_FAILURE: "Zeroconf server failure",

459

}

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

460

356

if state in bad_states:

461

357

if bad_states[state] is not None:

462

358

if error is None:

465

361

logger.error(bad_states[state] + ": %r", error)

466

362

self.cleanup()

467

363

elif state == avahi.SERVER_RUNNING:

468

try:

469

self.add()

470

except dbus.exceptions.DBusException as error:

471

if (error.get_dbus_name()

472

== "org.freedesktop.Avahi.CollisionError"):

473

logger.info("Local Zeroconf service name"

474

" collision.")

475

return self.rename(remove=False)

476

else:

477

logger.critical("D-Bus Exception", exc_info=error)

478

self.cleanup()

479

os._exit(1)

364

self.add()

480

365

else:

481

366

if error is None:

482

367

logger.debug("Unknown state: %r", state)

483

368

else:

484

369

logger.debug("Unknown state: %r: %r", state, error)

485

370

486

371

def activate(self):

487

372

"""Derived from the Avahi example code"""

488

373

if self.server is None:

492

377

follow_name_owner_changes=True),

493

378

avahi.DBUS_INTERFACE_SERVER)

494

379

self.server.connect_to_signal("StateChanged",

495

self.server_state_changed)

380

self.server_state_changed)

496

381

self.server_state_changed(self.server.GetState())

497

382

498

383

499

384

class AvahiServiceToSyslog(AvahiService):

500

def rename(self, *args, **kwargs):

385

def rename(self):

501

386

"""Add the new name to the syslog messages"""

502

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

503

syslogger.setFormatter(logging.Formatter(

504

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

505

.format(self.name)))

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

506

392

return ret

507

393

508

394

509

# Pretend that we have a GnuTLS module

510

class gnutls(object):

511

"""This isn't so much a class as it is a module-like namespace."""

512

513

library = ctypes.util.find_library("gnutls")

514

if library is None:

515

library = ctypes.util.find_library("gnutls-deb0")

516

_library = ctypes.cdll.LoadLibrary(library)

517

del library

518

519

# Unless otherwise indicated, the constants and types below are

520

# all from the gnutls/gnutls.h C header file.

521

522

# Constants

523

E_SUCCESS = 0

524

E_INTERRUPTED = -52

525

E_AGAIN = -28

526

CRT_OPENPGP = 2

527

CRT_RAWPK = 3

528

CLIENT = 2

529

SHUT_RDWR = 0

530

CRD_CERTIFICATE = 1

531

E_NO_CERTIFICATE_FOUND = -49

532

X509_FMT_DER = 0

533

NO_TICKETS = 1<<10

534

ENABLE_RAWPK = 1<<18

535

CTYPE_PEERS = 3

536

KEYID_USE_SHA256 = 1 # gnutls/x509.h

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

538

539

# Types

540

class session_int(ctypes.Structure):

541

_fields_ = []

542

session_t = ctypes.POINTER(session_int)

543

544

class certificate_credentials_st(ctypes.Structure):

545

_fields_ = []

546

certificate_credentials_t = ctypes.POINTER(

547

certificate_credentials_st)

548

certificate_type_t = ctypes.c_int

549

550

class datum_t(ctypes.Structure):

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

553

554

class openpgp_crt_int(ctypes.Structure):

555

_fields_ = []

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

559

credentials_type_t = ctypes.c_int

560

transport_ptr_t = ctypes.c_void_p

561

close_request_t = ctypes.c_int

562

563

# Exceptions

564

class Error(Exception):

565

def __init__(self, message=None, code=None, args=()):

566

# Default usage is by a message string, but if a return

567

# code is passed, convert it to a string with

568

# gnutls.strerror()

569

self.code = code

570

if message is None and code is not None:

571

message = gnutls.strerror(code)

572

return super(gnutls.Error, self).__init__(

573

message, *args)

574

575

class CertificateSecurityError(Error):

576

pass

577

578

# Classes

579

class Credentials(object):

580

def __init__(self):

581

self._c_object = gnutls.certificate_credentials_t()

582

gnutls.certificate_allocate_credentials(

583

ctypes.byref(self._c_object))

584

self.type = gnutls.CRD_CERTIFICATE

585

586

def __del__(self):

587

gnutls.certificate_free_credentials(self._c_object)

588

589

class ClientSession(object):

590

def __init__(self, socket, credentials=None):

591

self._c_object = gnutls.session_t()

592

gnutls_flags = gnutls.CLIENT

593

if gnutls.check_version(b"3.5.6"):

594

gnutls_flags |= gnutls.NO_TICKETS

595

if gnutls.has_rawpk:

596

gnutls_flags |= gnutls.ENABLE_RAWPK

597

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

598

del gnutls_flags

599

gnutls.set_default_priority(self._c_object)

600

gnutls.transport_set_ptr(self._c_object, socket.fileno())

601

gnutls.handshake_set_private_extensions(self._c_object,

602

True)

603

self.socket = socket

604

if credentials is None:

605

credentials = gnutls.Credentials()

606

gnutls.credentials_set(self._c_object, credentials.type,

607

ctypes.cast(credentials._c_object,

608

ctypes.c_void_p))

609

self.credentials = credentials

610

611

def __del__(self):

612

gnutls.deinit(self._c_object)

613

614

def handshake(self):

615

return gnutls.handshake(self._c_object)

616

617

def send(self, data):

618

data = bytes(data)

619

data_len = len(data)

620

while data_len > 0:

621

data_len -= gnutls.record_send(self._c_object,

622

data[-data_len:],

623

data_len)

624

625

def bye(self):

626

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

627

628

# Error handling functions

629

def _error_code(result):

630

"""A function to raise exceptions on errors, suitable

631

for the 'restype' attribute on ctypes functions"""

632

if result >= 0:

633

return result

634

if result == gnutls.E_NO_CERTIFICATE_FOUND:

635

raise gnutls.CertificateSecurityError(code=result)

636

raise gnutls.Error(code=result)

637

638

def _retry_on_error(result, func, arguments):

639

"""A function to retry on some errors, suitable

640

for the 'errcheck' attribute on ctypes functions"""

641

while result < 0:

642

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

643

return _error_code(result)

644

result = func(*arguments)

645

return result

646

647

# Unless otherwise indicated, the function declarations below are

648

# all from the gnutls/gnutls.h C header file.

649

650

# Functions

651

priority_set_direct = _library.gnutls_priority_set_direct

652

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

653

ctypes.POINTER(ctypes.c_char_p)]

654

priority_set_direct.restype = _error_code

655

656

init = _library.gnutls_init

657

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

658

init.restype = _error_code

659

660

set_default_priority = _library.gnutls_set_default_priority

661

set_default_priority.argtypes = [session_t]

662

set_default_priority.restype = _error_code

663

664

record_send = _library.gnutls_record_send

665

record_send.argtypes = [session_t, ctypes.c_void_p,

666

ctypes.c_size_t]

667

record_send.restype = ctypes.c_ssize_t

668

record_send.errcheck = _retry_on_error

669

670

certificate_allocate_credentials = (

671

_library.gnutls_certificate_allocate_credentials)

672

certificate_allocate_credentials.argtypes = [

673

ctypes.POINTER(certificate_credentials_t)]

674

certificate_allocate_credentials.restype = _error_code

675

676

certificate_free_credentials = (

677

_library.gnutls_certificate_free_credentials)

678

certificate_free_credentials.argtypes = [

679

certificate_credentials_t]

680

certificate_free_credentials.restype = None

681

682

handshake_set_private_extensions = (

683

_library.gnutls_handshake_set_private_extensions)

684

handshake_set_private_extensions.argtypes = [session_t,

685

ctypes.c_int]

686

handshake_set_private_extensions.restype = None

687

688

credentials_set = _library.gnutls_credentials_set

689

credentials_set.argtypes = [session_t, credentials_type_t,

690

ctypes.c_void_p]

691

credentials_set.restype = _error_code

692

693

strerror = _library.gnutls_strerror

694

strerror.argtypes = [ctypes.c_int]

695

strerror.restype = ctypes.c_char_p

696

697

certificate_type_get = _library.gnutls_certificate_type_get

698

certificate_type_get.argtypes = [session_t]

699

certificate_type_get.restype = _error_code

700

701

certificate_get_peers = _library.gnutls_certificate_get_peers

702

certificate_get_peers.argtypes = [session_t,

703

ctypes.POINTER(ctypes.c_uint)]

704

certificate_get_peers.restype = ctypes.POINTER(datum_t)

705

706

global_set_log_level = _library.gnutls_global_set_log_level

707

global_set_log_level.argtypes = [ctypes.c_int]

708

global_set_log_level.restype = None

709

710

global_set_log_function = _library.gnutls_global_set_log_function

711

global_set_log_function.argtypes = [log_func]

712

global_set_log_function.restype = None

713

714

deinit = _library.gnutls_deinit

715

deinit.argtypes = [session_t]

716

deinit.restype = None

717

718

handshake = _library.gnutls_handshake

719

handshake.argtypes = [session_t]

720

handshake.restype = _error_code

721

handshake.errcheck = _retry_on_error

722

723

transport_set_ptr = _library.gnutls_transport_set_ptr

724

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

725

transport_set_ptr.restype = None

726

727

bye = _library.gnutls_bye

728

bye.argtypes = [session_t, close_request_t]

729

bye.restype = _error_code

730

bye.errcheck = _retry_on_error

731

732

check_version = _library.gnutls_check_version

733

check_version.argtypes = [ctypes.c_char_p]

734

check_version.restype = ctypes.c_char_p

735

736

_need_version = b"3.3.0"

737

if check_version(_need_version) is None:

738

raise self.Error("Needs GnuTLS {} or later"

739

.format(_need_version))

740

741

_tls_rawpk_version = b"3.6.6"

742

has_rawpk = bool(check_version(_tls_rawpk_version))

743

744

if has_rawpk:

745

# Types

746

class pubkey_st(ctypes.Structure):

747

_fields = []

748

pubkey_t = ctypes.POINTER(pubkey_st)

749

750

x509_crt_fmt_t = ctypes.c_int

751

752

# All the function declarations below are from gnutls/abstract.h

753

pubkey_init = _library.gnutls_pubkey_init

754

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

755

pubkey_init.restype = _error_code

756

757

pubkey_import = _library.gnutls_pubkey_import

758

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

759

x509_crt_fmt_t]

760

pubkey_import.restype = _error_code

761

762

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

763

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

764

ctypes.POINTER(ctypes.c_ubyte),

765

ctypes.POINTER(ctypes.c_size_t)]

766

pubkey_get_key_id.restype = _error_code

767

768

pubkey_deinit = _library.gnutls_pubkey_deinit

769

pubkey_deinit.argtypes = [pubkey_t]

770

pubkey_deinit.restype = None

771

else:

772

# All the function declarations below are from gnutls/openpgp.h

773

774

openpgp_crt_init = _library.gnutls_openpgp_crt_init

775

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

776

openpgp_crt_init.restype = _error_code

777

778

openpgp_crt_import = _library.gnutls_openpgp_crt_import

779

openpgp_crt_import.argtypes = [openpgp_crt_t,

780

ctypes.POINTER(datum_t),

781

openpgp_crt_fmt_t]

782

openpgp_crt_import.restype = _error_code

783

784

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

785

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

786

ctypes.POINTER(ctypes.c_uint)]

787

openpgp_crt_verify_self.restype = _error_code

788

789

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

790

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

791

openpgp_crt_deinit.restype = None

792

793

openpgp_crt_get_fingerprint = (

794

_library.gnutls_openpgp_crt_get_fingerprint)

795

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

796

ctypes.c_void_p,

797

ctypes.POINTER(

798

ctypes.c_size_t)]

799

openpgp_crt_get_fingerprint.restype = _error_code

800

801

if check_version(b"3.6.4"):

802

certificate_type_get2 = _library.gnutls_certificate_type_get2

803

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

804

certificate_type_get2.restype = _error_code

805

806

# Remove non-public functions

807

del _error_code, _retry_on_error

808

809

810

def call_pipe(connection, # : multiprocessing.Connection

811

func, *args, **kwargs):

812

"""This function is meant to be called by multiprocessing.Process

813

814

This function runs func(*args, **kwargs), and writes the resulting

815

return value on the provided multiprocessing.Connection.

816

"""

817

connection.send(func(*args, **kwargs))

818

connection.close()

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

819

400

820

401

821

402

class Client(object):

822

403

"""A representation of a client host served by this server.

823

404

824

405

Attributes:

825

406

approved: bool(); 'None' if not yet approved/disapproved

826

407

approval_delay: datetime.timedelta(); Time to wait for approval

827

408

approval_duration: datetime.timedelta(); Duration of one approval

828

checker: multiprocessing.Process(); a running checker process used

829

to see if the client lives. 'None' if no process is

830

running.

831

checker_callback_tag: a GLib event source tag, or None

409

checker: subprocess.Popen(); a running checker process used

410

to see if the client lives.

411

'None' if no process is running.

412

checker_callback_tag: a gobject event source tag, or None

832

413

checker_command: string; External command which is run to check

833

414

if client lives. %() expansions are done at

834

415

runtime with vars(self) as dict, so that for

835

416

instance %(name)s can be used in the command.

836

checker_initiator_tag: a GLib event source tag, or None

417

checker_initiator_tag: a gobject event source tag, or None

837

418

created: datetime.datetime(); (UTC) object creation

838

419

client_structure: Object describing what attributes a client has

839

420

and is used for storing the client at exit

840

421

current_checker_command: string; current running checker_command

841

disable_initiator_tag: a GLib event source tag, or None

422

disable_initiator_tag: a gobject event source tag, or None

842

423

enabled: bool()

843

424

fingerprint: string (40 or 32 hexadecimal digits); used to

844

uniquely identify an OpenPGP client

845

key_id: string (64 hexadecimal digits); used to uniquely identify

846

a client using raw public keys

425

uniquely identify the client

847

426

host: string; available for use by the checker command

848

427

interval: datetime.timedelta(); How often to start a new checker

849

428

last_approval_request: datetime.datetime(); (UTC) or None

851

430

last_checker_status: integer between 0 and 255 reflecting exit

852

431

status of last checker. -1 reflects crashed

853

432

checker, -2 means no checker completed yet.

854

last_checker_signal: The signal which killed the last checker, if

855

last_checker_status is -1

856

433

last_enabled: datetime.datetime(); (UTC) or None

857

434

name: string; from the config file, used in log messages and

858

435

D-Bus identifiers

865

442

disabled, or None

866

443

server_settings: The server_settings dict from main()

867

444

"""

868

445

869

446

runtime_expansions = ("approval_delay", "approval_duration",

870

"created", "enabled", "expires", "key_id",

447

"created", "enabled", "expires",

871

448

"fingerprint", "host", "interval",

872

449

"last_approval_request", "last_checked_ok",

873

450

"last_enabled", "name", "timeout")

874

client_defaults = {

875

"timeout": "PT5M",

876

"extended_timeout": "PT15M",

877

"interval": "PT2M",

878

"checker": "fping -q -- %%(host)s",

879

"host": "",

880

"approval_delay": "PT0S",

881

"approval_duration": "PT1S",

882

"approved_by_default": "True",

883

"enabled": "True",

884

}

885

451

client_defaults = { "timeout": "PT5M",

452

"extended_timeout": "PT15M",

453

"interval": "PT2M",

454

"checker": "fping -q -- %%(host)s",

455

"host": "",

456

"approval_delay": "PT0S",

457

"approval_duration": "PT1S",

458

"approved_by_default": "True",

459

"enabled": "True",

460

}

461

462

def timeout_milliseconds(self):

463

"Return the 'timeout' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.timeout)

465

466

def extended_timeout_milliseconds(self):

467

"Return the 'extended_timeout' attribute in milliseconds"

468

return timedelta_to_milliseconds(self.extended_timeout)

469

470

def interval_milliseconds(self):

471

"Return the 'interval' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.interval)

473

474

def approval_delay_milliseconds(self):

475

return timedelta_to_milliseconds(self.approval_delay)

476

886

477

@staticmethod

887

478

def config_parser(config):

888

479

"""Construct a new dict of client settings of this form:

895

486

for client_name in config.sections():

896

487

section = dict(config.items(client_name))

897

488

client = settings[client_name] = {}

898

489

899

490

client["host"] = section["host"]

900

491

# Reformat values from string types to Python types

901

492

client["approved_by_default"] = config.getboolean(

902

493

client_name, "approved_by_default")

903

494

client["enabled"] = config.getboolean(client_name,

904

495

"enabled")

905

906

# Uppercase and remove spaces from key_id and fingerprint

907

# for later comparison purposes with return value from the

908

# key_id() and fingerprint() functions

909

client["key_id"] = (section.get("key_id", "").upper()

910

.replace(" ", ""))

496

911

497

client["fingerprint"] = (section["fingerprint"].upper()

912

498

.replace(" ", ""))

913

499

if "secret" in section:

914

client["secret"] = codecs.decode(section["secret"]

915

.encode("utf-8"),

916

"base64")

500

client["secret"] = section["secret"].decode("base64")

917

501

elif "secfile" in section:

918

502

with open(os.path.expanduser(os.path.expandvars

919

503

(section["secfile"])),

920

504

"rb") as secfile:

921

505

client["secret"] = secfile.read()

922

506

else:

923

raise TypeError("No secret or secfile for section {}"

507

raise TypeError("No secret or secfile for section {0}"

924

508

.format(section))

925

509

client["timeout"] = string_to_delta(section["timeout"])

926

510

client["extended_timeout"] = string_to_delta(

934

518

client["last_approval_request"] = None

935

519

client["last_checked_ok"] = None

936

520

client["last_checker_status"] = -2

937

521

938

522

return settings

939

940

def __init__(self, settings, name=None, server_settings=None):

523

524

def __init__(self, settings, name = None, server_settings=None):

941

525

self.name = name

942

526

if server_settings is None:

943

527

server_settings = {}

944

528

self.server_settings = server_settings

945

529

# adding all client settings

946

for setting, value in settings.items():

530

for setting, value in settings.iteritems():

947

531

setattr(self, setting, value)

948

532

949

533

if self.enabled:

950

534

if not hasattr(self, "last_enabled"):

951

535

self.last_enabled = datetime.datetime.utcnow()

955

539

else:

956

540

self.last_enabled = None

957

541

self.expires = None

958

542

959

543

logger.debug("Creating client %r", self.name)

960

logger.debug(" Key ID: %s", self.key_id)

544

# Uppercase and remove spaces from fingerprint for later

545

# comparison purposes with return value from the fingerprint()

546

# function

961

547

logger.debug(" Fingerprint: %s", self.fingerprint)

962

548

self.created = settings.get("created",

963

549

datetime.datetime.utcnow())

964

550

965

551

# attributes specific for this server instance

966

552

self.checker = None

967

553

self.checker_initiator_tag = None

970

556

self.current_checker_command = None

971

557

self.approved = None

972

558

self.approvals_pending = 0

973

self.changedstate = multiprocessing_manager.Condition(

974

multiprocessing_manager.Lock())

975

self.client_structure = [attr

976

for attr in self.__dict__.keys()

559

self.changedstate = (multiprocessing_manager

560

.Condition(multiprocessing_manager

561

.Lock()))

562

self.client_structure = [attr for attr in

563

self.__dict__.iterkeys()

977

564

if not attr.startswith("_")]

978

565

self.client_structure.append("client_structure")

979

980

for name, t in inspect.getmembers(

981

type(self), lambda obj: isinstance(obj, property)):

566

567

for name, t in inspect.getmembers(type(self),

568

lambda obj:

569

isinstance(obj,

570

property)):

982

571

if not name.startswith("_"):

983

572

self.client_structure.append(name)

984

573

985

574

# Send notice to process children that client state has changed

986

575

def send_changedstate(self):

987

576

with self.changedstate:

988

577

self.changedstate.notify_all()

989

578

990

579

def enable(self):

991

580

"""Start this client's checker and timeout hooks"""

992

581

if getattr(self, "enabled", False):

997

586

self.last_enabled = datetime.datetime.utcnow()

998

587

self.init_checker()

999

588

self.send_changedstate()

1000

589

1001

590

def disable(self, quiet=True):

1002

591

"""Disable this client."""

1003

592

if not getattr(self, "enabled", False):

1005

594

if not quiet:

1006

595

logger.info("Disabling client %s", self.name)

1007

596

if getattr(self, "disable_initiator_tag", None) is not None:

1008

GLib.source_remove(self.disable_initiator_tag)

597

gobject.source_remove(self.disable_initiator_tag)

1009

598

self.disable_initiator_tag = None

1010

599

self.expires = None

1011

600

if getattr(self, "checker_initiator_tag", None) is not None:

1012

GLib.source_remove(self.checker_initiator_tag)

601

gobject.source_remove(self.checker_initiator_tag)

1013

602

self.checker_initiator_tag = None

1014

603

self.stop_checker()

1015

604

self.enabled = False

1016

605

if not quiet:

1017

606

self.send_changedstate()

1018

# Do not run this again if called by a GLib.timeout_add

607

# Do not run this again if called by a gobject.timeout_add

1019

608

return False

1020

609

1021

610

def __del__(self):

1022

611

self.disable()

1023

612

1024

613

def init_checker(self):

1025

614

# Schedule a new checker to be started an 'interval' from now,

1026

615

# and every interval from then on.

1027

616

if self.checker_initiator_tag is not None:

1028

GLib.source_remove(self.checker_initiator_tag)

1029

self.checker_initiator_tag = GLib.timeout_add(

1030

int(self.interval.total_seconds() * 1000),

1031

self.start_checker)

617

gobject.source_remove(self.checker_initiator_tag)

618

self.checker_initiator_tag = (gobject.timeout_add

619

(self.interval_milliseconds(),

620

self.start_checker))

1032

621

# Schedule a disable() when 'timeout' has passed

1033

622

if self.disable_initiator_tag is not None:

1034

GLib.source_remove(self.disable_initiator_tag)

1035

self.disable_initiator_tag = GLib.timeout_add(

1036

int(self.timeout.total_seconds() * 1000), self.disable)

623

gobject.source_remove(self.disable_initiator_tag)

624

self.disable_initiator_tag = (gobject.timeout_add

625

(self.timeout_milliseconds(),

626

self.disable))

1037

627

# Also start a new checker *right now*.

1038

628

self.start_checker()

1039

1040

def checker_callback(self, source, condition, connection,

1041

command):

629

630

def checker_callback(self, pid, condition, command):

1042

631

"""The checker has completed, so take appropriate actions."""

1043

# Read return code from connection (see call_pipe)

1044

returncode = connection.recv()

1045

connection.close()

1046

self.checker.join()

1047

632

self.checker_callback_tag = None

1048

633

self.checker = None

1049

1050

if returncode >= 0:

1051

self.last_checker_status = returncode

1052

self.last_checker_signal = None

634

if os.WIFEXITED(condition):

635

self.last_checker_status = os.WEXITSTATUS(condition)

1053

636

if self.last_checker_status == 0:

1054

637

logger.info("Checker for %(name)s succeeded",

1055

638

vars(self))

1056

639

self.checked_ok()

1057

640

else:

1058

logger.info("Checker for %(name)s failed", vars(self))

641

logger.info("Checker for %(name)s failed",

642

vars(self))

1059

643

else:

1060

644

self.last_checker_status = -1

1061

self.last_checker_signal = -returncode

1062

645

logger.warning("Checker for %(name)s crashed?",

1063

646

vars(self))

1064

return False

1065

647

1066

648

def checked_ok(self):

1067

649

"""Assert that the client has been seen, alive and well."""

1068

650

self.last_checked_ok = datetime.datetime.utcnow()

1069

651

self.last_checker_status = 0

1070

self.last_checker_signal = None

1071

652

self.bump_timeout()

1072

653

1073

654

def bump_timeout(self, timeout=None):

1074

655

"""Bump up the timeout for this client."""

1075

656

if timeout is None:

1076

657

timeout = self.timeout

1077

658

if self.disable_initiator_tag is not None:

1078

GLib.source_remove(self.disable_initiator_tag)

659

gobject.source_remove(self.disable_initiator_tag)

1079

660

self.disable_initiator_tag = None

1080

661

if getattr(self, "enabled", False):

1081

self.disable_initiator_tag = GLib.timeout_add(

1082

int(timeout.total_seconds() * 1000), self.disable)

662

self.disable_initiator_tag = (gobject.timeout_add

663

(timedelta_to_milliseconds

664

(timeout), self.disable))

1083

665

self.expires = datetime.datetime.utcnow() + timeout

1084

666

1085

667

def need_approval(self):

1086

668

self.last_approval_request = datetime.datetime.utcnow()

1087

669

1088

670

def start_checker(self):

1089

671

"""Start a new checker subprocess if one is not running.

1090

672

1091

673

If a checker already exists, leave it running and do

1092

674

nothing."""

1093

675

# The reason for not killing a running checker is that if we

1098

680

# checkers alone, the checker would have to take more time

1099

681

# than 'timeout' for the client to be disabled, which is as it

1100

682

# should be.

1101

1102

if self.checker is not None and not self.checker.is_alive():

1103

logger.warning("Checker was not alive; joining")

1104

self.checker.join()

1105

self.checker = None

683

684

# If a checker exists, make sure it is not a zombie

685

try:

686

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

687

except (AttributeError, OSError) as error:

688

if (isinstance(error, OSError)

689

and error.errno != errno.ECHILD):

690

raise error

691

else:

692

if pid:

693

logger.warning("Checker was a zombie")

694

gobject.source_remove(self.checker_callback_tag)

695

self.checker_callback(pid, status,

696

self.current_checker_command)

1106

697

# Start a new checker if needed

1107

698

if self.checker is None:

1108

699

# Escape attributes for the shell

1109

escaped_attrs = {

1110

attr: re.escape(str(getattr(self, attr)))

1111

for attr in self.runtime_expansions}

700

escaped_attrs = dict(

701

(attr, re.escape(unicode(getattr(self, attr))))

702

for attr in

703

self.runtime_expansions)

1112

704

try:

1113

705

command = self.checker_command % escaped_attrs

1114

706

except TypeError as error:

1115

707

logger.error('Could not format string "%s"',

1116

self.checker_command,

708

self.checker_command, exc_info=error)

709

return True # Try again later

710

self.current_checker_command = command

711

try:

712

logger.info("Starting checker %r for %s",

713

command, self.name)

714

# We don't need to redirect stdout and stderr, since

715

# in normal mode, that is already done by daemon(),

716

# and in debug mode we don't want to. (Stdin is

717

# always replaced by /dev/null.)

718

# The exception is when not debugging but nevertheless

719

# running in the foreground; use the previously

720

# created wnull.

721

popen_args = {}

722

if (not self.server_settings["debug"]

723

and self.server_settings["foreground"]):

724

popen_args.update({"stdout": wnull,

725

"stderr": wnull })

726

self.checker = subprocess.Popen(command,

727

close_fds=True,

728

shell=True, cwd="/",

729

**popen_args)

730

except OSError as error:

731

logger.error("Failed to start subprocess",

1117

732

exc_info=error)

1118

return True # Try again later

1119

self.current_checker_command = command

1120

logger.info("Starting checker %r for %s", command,

1121

self.name)

1122

# We don't need to redirect stdout and stderr, since

1123

# in normal mode, that is already done by daemon(),

1124

# and in debug mode we don't want to. (Stdin is

1125

# always replaced by /dev/null.)

1126

# The exception is when not debugging but nevertheless

1127

# running in the foreground; use the previously

1128

# created wnull.

1129

popen_args = {"close_fds": True,

1130

"shell": True,

1131

"cwd": "/"}

1132

if (not self.server_settings["debug"]

1133

and self.server_settings["foreground"]):

1134

popen_args.update({"stdout": wnull,

1135

"stderr": wnull})

1136

pipe = multiprocessing.Pipe(duplex=False)

1137

self.checker = multiprocessing.Process(

1138

target=call_pipe,

1139

args=(pipe[1], subprocess.call, command),

1140

kwargs=popen_args)

1141

self.checker.start()

1142

self.checker_callback_tag = GLib.io_add_watch(

1143

pipe[0].fileno(), GLib.IO_IN,

1144

self.checker_callback, pipe[0], command)

1145

# Re-run this periodically if run by GLib.timeout_add

733

return True

734

self.checker_callback_tag = (gobject.child_watch_add

735

(self.checker.pid,

736

self.checker_callback,

737

data=command))

738

# The checker may have completed before the gobject

739

# watch was added. Check for this.

740

try:

741

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

742

except OSError as error:

743

if error.errno == errno.ECHILD:

744

# This should never happen

745

logger.error("Child process vanished",

746

exc_info=error)

747

return True

748

raise

749

if pid:

750

gobject.source_remove(self.checker_callback_tag)

751

self.checker_callback(pid, status, command)

752

# Re-run this periodically if run by gobject.timeout_add

1146

753

return True

1147

754

1148

755

def stop_checker(self):

1149

756

"""Force the checker process, if any, to stop."""

1150

757

if self.checker_callback_tag:

1151

GLib.source_remove(self.checker_callback_tag)

758

gobject.source_remove(self.checker_callback_tag)

1152

759

self.checker_callback_tag = None

1153

760

if getattr(self, "checker", None) is None:

1154

761

return

1155

762

logger.debug("Stopping checker for %(name)s", vars(self))

1156

self.checker.terminate()

763

try:

764

self.checker.terminate()

765

#time.sleep(0.5)

766

#if self.checker.poll() is None:

767

# self.checker.kill()

768

except OSError as error:

769

if error.errno != errno.ESRCH: # No such process

770

raise

1157

771

self.checker = None

1158

772

1159

773

1160

def dbus_service_property(dbus_interface,

1161

signature="v",

1162

access="readwrite",

1163

byte_arrays=False):

774

def dbus_service_property(dbus_interface, signature="v",

775

access="readwrite", byte_arrays=False):

1164

776

"""Decorators for marking methods of a DBusObjectWithProperties to

1165

777

become properties on the D-Bus.

1166

778

1167

779

The decorated method will be called with no arguments by "Get"

1168

780

and with one argument by "Set".

1169

781

1170

782

The parameters, where they are supported, are the same as

1171

783

dbus.service.method, except there is only "signature", since the

1172

784

type from Get() and the type sent to Set() is the same.

1175

787

# "Set" method, so we fail early here:

1176

788

if byte_arrays and signature != "ay":

1177

789

raise ValueError("Byte arrays not supported for non-'ay'"

1178

" signature {!r}".format(signature))

1179

790

" signature {0!r}".format(signature))

1180

791

def decorator(func):

1181

792

func._dbus_is_property = True

1182

793

func._dbus_interface = dbus_interface

1185

796

func._dbus_name = func.__name__

1186

797

if func._dbus_name.endswith("_dbus_property"):

1187

798

func._dbus_name = func._dbus_name[:-14]

1188

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

799

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1189

800

return func

1190

1191

801

return decorator

1192

802

1193

803

1194

804

def dbus_interface_annotations(dbus_interface):

1195

805

"""Decorator for marking functions returning interface annotations

1196

806

1197

807

Usage:

1198

808

1199

809

@dbus_interface_annotations("org.example.Interface")

1200

810

def _foo(self): # Function name does not matter

1201

811

return {"org.freedesktop.DBus.Deprecated": "true",

1202

812

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1203

813

"false"}

1204

814

"""

1205

1206

815

def decorator(func):

1207

816

func._dbus_is_interface = True

1208

817

func._dbus_interface = dbus_interface

1209

818

func._dbus_name = dbus_interface

1210

819

return func

1211

1212

820

return decorator

1213

821

1214

822

1215

823

def dbus_annotations(annotations):

1216

824

"""Decorator to annotate D-Bus methods, signals or properties

1217

825

Usage:

1218

1219

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1220

"org.freedesktop.DBus.Property."

1221

"EmitsChangedSignal": "false"})

826

1222

827

@dbus_service_property("org.example.Interface", signature="b",

1223

828

access="r")

829

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

830

"org.freedesktop.DBus.Property."

831

"EmitsChangedSignal": "false"})

1224

832

def Property_dbus_property(self):

1225

833

return dbus.Boolean(False)

1226

1227

See also the DBusObjectWithAnnotations class.

1228

834

"""

1229

1230

835

def decorator(func):

1231

836

func._dbus_annotations = annotations

1232

837

return func

1233

1234

838

return decorator

1235

839

1236

840

1237

841

class DBusPropertyException(dbus.exceptions.DBusException):

1238

842

"""A base class for D-Bus property-related exceptions

1239

843

"""

1240

pass

844

def __unicode__(self):

845

return unicode(str(self))

1241

846

1242

847

1243

848

class DBusPropertyAccessException(DBusPropertyException):

1252

857

pass

1253

858

1254

859

1255

class DBusObjectWithAnnotations(dbus.service.Object):

1256

"""A D-Bus object with annotations.

1257

1258

Classes inheriting from this can use the dbus_annotations

1259

decorator to add annotations to methods or signals.

860

class DBusObjectWithProperties(dbus.service.Object):

861

"""A D-Bus object with properties.

862

863

Classes inheriting from this can use the dbus_service_property

864

decorator to expose methods as D-Bus properties. It exposes the

865

standard Get(), Set(), and GetAll() methods on the D-Bus.

1260

866

"""

1261

867

1262

868

@staticmethod

1263

869

def _is_dbus_thing(thing):

1264

870

"""Returns a function testing if an attribute is a D-Bus thing

1265

871

1266

872

If called like _is_dbus_thing("method") it returns a function

1267

873

suitable for use as predicate to inspect.getmembers().

1268

874

"""

1269

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

875

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1270

876

False)

1271

877

1272

878

def _get_all_dbus_things(self, thing):

1273

879

"""Returns a generator of (name, attribute) pairs

1274

880

"""

1275

return ((getattr(athing.__get__(self), "_dbus_name", name),

881

return ((getattr(athing.__get__(self), "_dbus_name",

882

name),

1276

883

athing.__get__(self))

1277

884

for cls in self.__class__.__mro__

1278

885

for name, athing in

1279

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1280

1281

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1282

out_signature="s",

1283

path_keyword='object_path',

1284

connection_keyword='connection')

1285

def Introspect(self, object_path, connection):

1286

"""Overloading of standard D-Bus method.

1287

1288

Inserts annotation tags on methods and signals.

1289

"""

1290

xmlstring = dbus.service.Object.Introspect(self, object_path,

1291

connection)

1292

try:

1293

document = xml.dom.minidom.parseString(xmlstring)

1294

1295

for if_tag in document.getElementsByTagName("interface"):

1296

# Add annotation tags

1297

for typ in ("method", "signal"):

1298

for tag in if_tag.getElementsByTagName(typ):

1299

annots = dict()

1300

for name, prop in (self.

1301

_get_all_dbus_things(typ)):

1302

if (name == tag.getAttribute("name")

1303

and prop._dbus_interface

1304

== if_tag.getAttribute("name")):

1305

annots.update(getattr(

1306

prop, "_dbus_annotations", {}))

1307

for name, value in annots.items():

1308

ann_tag = document.createElement(

1309

"annotation")

1310

ann_tag.setAttribute("name", name)

1311

ann_tag.setAttribute("value", value)

1312

tag.appendChild(ann_tag)

1313

# Add interface annotation tags

1314

for annotation, value in dict(

1315

itertools.chain.from_iterable(

1316

annotations().items()

1317

for name, annotations

1318

in self._get_all_dbus_things("interface")

1319

if name == if_tag.getAttribute("name")

1320

)).items():

1321

ann_tag = document.createElement("annotation")

1322

ann_tag.setAttribute("name", annotation)

1323

ann_tag.setAttribute("value", value)

1324

if_tag.appendChild(ann_tag)

1325

# Fix argument name for the Introspect method itself

1326

if (if_tag.getAttribute("name")

1327

== dbus.INTROSPECTABLE_IFACE):

1328

for cn in if_tag.getElementsByTagName("method"):

1329

if cn.getAttribute("name") == "Introspect":

1330

for arg in cn.getElementsByTagName("arg"):

1331

if (arg.getAttribute("direction")

1332

== "out"):

1333

arg.setAttribute("name",

1334

"xml_data")

1335

xmlstring = document.toxml("utf-8")

1336

document.unlink()

1337

except (AttributeError, xml.dom.DOMException,

1338

xml.parsers.expat.ExpatError) as error:

1339

logger.error("Failed to override Introspection method",

1340

exc_info=error)

1341

return xmlstring

1342

1343

1344

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1345

"""A D-Bus object with properties.

1346

1347

Classes inheriting from this can use the dbus_service_property

1348

decorator to expose methods as D-Bus properties. It exposes the

1349

standard Get(), Set(), and GetAll() methods on the D-Bus.

1350

"""

1351

886

inspect.getmembers(cls,

887

self._is_dbus_thing(thing)))

888

1352

889

def _get_dbus_property(self, interface_name, property_name):

1353

890

"""Returns a bound method if one exists which is a D-Bus

1354

891

property with the specified name and interface.

1355

892

"""

1356

for cls in self.__class__.__mro__:

1357

for name, value in inspect.getmembers(

1358

cls, self._is_dbus_thing("property")):

893

for cls in self.__class__.__mro__:

894

for name, value in (inspect.getmembers

895

(cls,

896

self._is_dbus_thing("property"))):

1359

897

if (value._dbus_name == property_name

1360

898

and value._dbus_interface == interface_name):

1361

899

return value.__get__(self)

1362

900

1363

901

# No such property

1364

raise DBusPropertyNotFound("{}:{}.{}".format(

1365

self.dbus_object_path, interface_name, property_name))

1366

1367

@classmethod

1368

def _get_all_interface_names(cls):

1369

"""Get a sequence of all interfaces supported by an object"""

1370

return (name for name in set(getattr(getattr(x, attr),

1371

"_dbus_interface", None)

1372

for x in (inspect.getmro(cls))

1373

for attr in dir(x))

1374

if name is not None)

1375

1376

@dbus.service.method(dbus.PROPERTIES_IFACE,

1377

in_signature="ss",

902

raise DBusPropertyNotFound(self.dbus_object_path + ":"

903

+ interface_name + "."

904

+ property_name)

905

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1378

907

out_signature="v")

1379

908

def Get(self, interface_name, property_name):

1380

909

"""Standard D-Bus property Get() method, see D-Bus standard.

1386

915

if not hasattr(value, "variant_level"):

1387

916

return value

1388

917

return type(value)(value, variant_level=value.variant_level+1)

1389

918

1390

919

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1391

920

def Set(self, interface_name, property_name, value):

1392

921

"""Standard D-Bus property Set() method, see D-Bus standard.

1398

927

# The byte_arrays option is not supported yet on

1399

928

# signatures other than "ay".

1400

929

if prop._dbus_signature != "ay":

1401

raise ValueError("Byte arrays not supported for non-"

1402

"'ay' signature {!r}"

1403

.format(prop._dbus_signature))

930

raise ValueError

1404

931

value = dbus.ByteArray(b''.join(chr(byte)

1405

932

for byte in value))

1406

933

prop(value)

1407

1408

@dbus.service.method(dbus.PROPERTIES_IFACE,

1409

in_signature="s",

934

935

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1410

936

out_signature="a{sv}")

1411

937

def GetAll(self, interface_name):

1412

938

"""Standard D-Bus property GetAll() method, see D-Bus

1413

939

standard.

1414

940

1415

941

Note: Will not include properties with access="write".

1416

942

"""

1417

943

properties = {}

1427

953

if not hasattr(value, "variant_level"):

1428

954

properties[name] = value

1429

955

continue

1430

properties[name] = type(value)(

1431

value, variant_level=value.variant_level + 1)

956

properties[name] = type(value)(value, variant_level=

957

value.variant_level+1)

1432

958

return dbus.Dictionary(properties, signature="sv")

1433

1434

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1435

def PropertiesChanged(self, interface_name, changed_properties,

1436

invalidated_properties):

1437

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1438

standard.

1439

"""

1440

pass

1441

959

1442

960

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1443

961

out_signature="s",

1444

962

path_keyword='object_path',

1445

963

connection_keyword='connection')

1446

964

def Introspect(self, object_path, connection):

1447

965

"""Overloading of standard D-Bus method.

1448

966

1449

967

Inserts property tags and interface annotation tags.

1450

968

"""

1451

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1452

object_path,

1453

connection)

969

xmlstring = dbus.service.Object.Introspect(self, object_path,

970

connection)

1454

971

try:

1455

972

document = xml.dom.minidom.parseString(xmlstring)

1456

1457

973

def make_tag(document, name, prop):

1458

974

e = document.createElement("property")

1459

975

e.setAttribute("name", name)

1460

976

e.setAttribute("type", prop._dbus_signature)

1461

977

e.setAttribute("access", prop._dbus_access)

1462

978

return e

1463

1464

979

for if_tag in document.getElementsByTagName("interface"):

1465

980

# Add property tags

1466

981

for tag in (make_tag(document, name, prop)

1469

984

if prop._dbus_interface

1470

985

== if_tag.getAttribute("name")):

1471

986

if_tag.appendChild(tag)

1472

# Add annotation tags for properties

1473

for tag in if_tag.getElementsByTagName("property"):

1474

annots = dict()

1475

for name, prop in self._get_all_dbus_things(

1476

"property"):

1477

if (name == tag.getAttribute("name")

1478

and prop._dbus_interface

1479

== if_tag.getAttribute("name")):

1480

annots.update(getattr(

1481

prop, "_dbus_annotations", {}))

1482

for name, value in annots.items():

1483

ann_tag = document.createElement(

1484

"annotation")

1485

ann_tag.setAttribute("name", name)

1486

ann_tag.setAttribute("value", value)

1487

tag.appendChild(ann_tag)

987

# Add annotation tags

988

for typ in ("method", "signal", "property"):

989

for tag in if_tag.getElementsByTagName(typ):

990

annots = dict()

991

for name, prop in (self.

992

_get_all_dbus_things(typ)):

993

if (name == tag.getAttribute("name")

994

and prop._dbus_interface

995

== if_tag.getAttribute("name")):

996

annots.update(getattr

997

(prop,

998

"_dbus_annotations",

999

{}))

1000

for name, value in annots.iteritems():

1001

ann_tag = document.createElement(

1002

"annotation")

1003

ann_tag.setAttribute("name", name)

1004

ann_tag.setAttribute("value", value)

1005

tag.appendChild(ann_tag)

1006

# Add interface annotation tags

1007

for annotation, value in dict(

1008

itertools.chain.from_iterable(

1009

annotations().iteritems()

1010

for name, annotations in

1011

self._get_all_dbus_things("interface")

1012

if name == if_tag.getAttribute("name")

1013

)).iteritems():

1014

ann_tag = document.createElement("annotation")

1015

ann_tag.setAttribute("name", annotation)

1016

ann_tag.setAttribute("value", value)

1017

if_tag.appendChild(ann_tag)

1488

1018

# Add the names to the return values for the

1489

1019

# "org.freedesktop.DBus.Properties" methods

1490

1020

if (if_tag.getAttribute("name")

1509

1039

return xmlstring

1510

1040

1511

1041

1512

try:

1513

dbus.OBJECT_MANAGER_IFACE

1514

except AttributeError:

1515

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1516

1517

1518

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1519

"""A D-Bus object with an ObjectManager.

1520

1521

Classes inheriting from this exposes the standard

1522

GetManagedObjects call and the InterfacesAdded and

1523

InterfacesRemoved signals on the standard

1524

"org.freedesktop.DBus.ObjectManager" interface.

1525

1526

Note: No signals are sent automatically; they must be sent

1527

manually.

1528

"""

1529

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1530

out_signature="a{oa{sa{sv}}}")

1531

def GetManagedObjects(self):

1532

"""This function must be overridden"""

1533

raise NotImplementedError()

1534

1535

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1536

signature="oa{sa{sv}}")

1537

def InterfacesAdded(self, object_path, interfaces_and_properties):

1538

pass

1539

1540

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1541

def InterfacesRemoved(self, object_path, interfaces):

1542

pass

1543

1544

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1545

out_signature="s",

1546

path_keyword='object_path',

1547

connection_keyword='connection')

1548

def Introspect(self, object_path, connection):

1549

"""Overloading of standard D-Bus method.

1550

1551

Override return argument name of GetManagedObjects to be

1552

"objpath_interfaces_and_properties"

1553

"""

1554

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1555

object_path,

1556

connection)

1557

try:

1558

document = xml.dom.minidom.parseString(xmlstring)

1559

1560

for if_tag in document.getElementsByTagName("interface"):

1561

# Fix argument name for the GetManagedObjects method

1562

if (if_tag.getAttribute("name")

1563

== dbus.OBJECT_MANAGER_IFACE):

1564

for cn in if_tag.getElementsByTagName("method"):

1565

if (cn.getAttribute("name")

1566

== "GetManagedObjects"):

1567

for arg in cn.getElementsByTagName("arg"):

1568

if (arg.getAttribute("direction")

1569

== "out"):

1570

arg.setAttribute(

1571

"name",

1572

"objpath_interfaces"

1573

"_and_properties")

1574

xmlstring = document.toxml("utf-8")

1575

document.unlink()

1576

except (AttributeError, xml.dom.DOMException,

1577

xml.parsers.expat.ExpatError) as error:

1578

logger.error("Failed to override Introspection method",

1579

exc_info=error)

1580

return xmlstring

1581

1582

1583

1042

def datetime_to_dbus(dt, variant_level=0):

1584

1043

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1585

1044

if dt is None:

1586

return dbus.String("", variant_level=variant_level)

1587

return dbus.String(dt.isoformat(), variant_level=variant_level)

1045

return dbus.String("", variant_level = variant_level)

1046

return dbus.String(dt.isoformat(),

1047

variant_level=variant_level)

1588

1048

1589

1049

1590

1050

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1592

1052

dbus.service.Object, it will add alternate D-Bus attributes with

1593

1053

interface names according to the "alt_interface_names" mapping.

1594

1054

Usage:

1595

1055

1596

1056

@alternate_dbus_interfaces({"org.example.Interface":

1597

1057

"net.example.AlternateInterface"})

1598

1058

class SampleDBusObject(dbus.service.Object):

1599

1059

@dbus.service.method("org.example.Interface")

1600

1060

def SampleDBusMethod():

1601

1061

pass

1602

1062

1603

1063

The above "SampleDBusMethod" on "SampleDBusObject" will be

1604

1064

reachable via two interfaces: "org.example.Interface" and

1605

1065

"net.example.AlternateInterface", the latter of which will have

1606

1066

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1607

1067

"true", unless "deprecate" is passed with a False value.

1608

1068

1609

1069

This works for methods and signals, and also for D-Bus properties

1610

1070

(from DBusObjectWithProperties) and interfaces (from the

1611

1071

dbus_interface_annotations decorator).

1612

1072

"""

1613

1614

1073

def wrapper(cls):

1615

1074

for orig_interface_name, alt_interface_name in (

1616

alt_interface_names.items()):

1075

alt_interface_names.iteritems()):

1617

1076

attr = {}

1618

1077

interface_names = set()

1619

1078

# Go though all attributes of the class

1621

1080

# Ignore non-D-Bus attributes, and D-Bus attributes

1622

1081

# with the wrong interface name

1623

1082

if (not hasattr(attribute, "_dbus_interface")

1624

or not attribute._dbus_interface.startswith(

1625

orig_interface_name)):

1083

or not attribute._dbus_interface

1084

.startswith(orig_interface_name)):

1626

1085

continue

1627

1086

# Create an alternate D-Bus interface name based on

1628

1087

# the current name

1629

alt_interface = attribute._dbus_interface.replace(

1630

orig_interface_name, alt_interface_name)

1088

alt_interface = (attribute._dbus_interface

1089

.replace(orig_interface_name,

1090

alt_interface_name))

1631

1091

interface_names.add(alt_interface)

1632

1092

# Is this a D-Bus signal?

1633

1093

if getattr(attribute, "_dbus_is_signal", False):

1634

1094

# Extract the original non-method undecorated

1635

1095

# function by black magic

1636

if sys.version_info.major == 2:

1637

nonmethod_func = (dict(

1096

nonmethod_func = (dict(

1638

1097

zip(attribute.func_code.co_freevars,

1639

attribute.__closure__))

1640

["func"].cell_contents)

1641

else:

1642

nonmethod_func = (dict(

1643

zip(attribute.__code__.co_freevars,

1644

attribute.__closure__))

1645

["func"].cell_contents)

1098

attribute.__closure__))["func"]

1099

.cell_contents)

1646

1100

# Create a new, but exactly alike, function

1647

1101

# object, and decorate it to be a new D-Bus signal

1648

1102

# with the alternate D-Bus interface name

1649

new_function = copy_function(nonmethod_func)

1650

new_function = (dbus.service.signal(

1651

alt_interface,

1652

attribute._dbus_signature)(new_function))

1103

new_function = (dbus.service.signal

1104

(alt_interface,

1105

attribute._dbus_signature)

1106

(types.FunctionType(

1107

nonmethod_func.func_code,

1108

nonmethod_func.func_globals,

1109

nonmethod_func.func_name,

1110

nonmethod_func.func_defaults,

1111

nonmethod_func.func_closure)))

1653

1112

# Copy annotations, if any

1654

1113

try:

1655

new_function._dbus_annotations = dict(

1656

attribute._dbus_annotations)

1114

new_function._dbus_annotations = (

1115

dict(attribute._dbus_annotations))

1657

1116

except AttributeError:

1658

1117

pass

1659

1660

1118

# Define a creator of a function to call both the

1661

1119

# original and alternate functions, so both the

1662

1120

# original and alternate signals gets sent when

1665

1123

"""This function is a scope container to pass

1666

1124

func1 and func2 to the "call_both" function

1667

1125

outside of its arguments"""

1668

1669

@functools.wraps(func2)

1670

1126

def call_both(*args, **kwargs):

1671

1127

"""This function will emit two D-Bus

1672

1128

signals by calling func1 and func2"""

1673

1129

func1(*args, **kwargs)

1674

1130

func2(*args, **kwargs)

1675

# Make wrapper function look like a D-Bus

1676

# signal

1677

for name, attr in inspect.getmembers(func2):

1678

if name.startswith("_dbus_"):

1679

setattr(call_both, name, attr)

1680

1681

1131

return call_both

1682

1132

# Create the "call_both" function and add it to

1683

1133

# the class

1688

1138

# object. Decorate it to be a new D-Bus method

1689

1139

# with the alternate D-Bus interface name. Add it

1690

1140

# to the class.

1691

attr[attrname] = (

1692

dbus.service.method(

1693

alt_interface,

1694

attribute._dbus_in_signature,

1695

attribute._dbus_out_signature)

1696

(copy_function(attribute)))

1141

attr[attrname] = (dbus.service.method

1142

(alt_interface,

1143

attribute._dbus_in_signature,

1144

attribute._dbus_out_signature)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1697

1151

# Copy annotations, if any

1698

1152

try:

1699

attr[attrname]._dbus_annotations = dict(

1700

attribute._dbus_annotations)

1153

attr[attrname]._dbus_annotations = (

1154

dict(attribute._dbus_annotations))

1701

1155

except AttributeError:

1702

1156

pass

1703

1157

# Is this a D-Bus property?

1706

1160

# object, and decorate it to be a new D-Bus

1707

1161

# property with the alternate D-Bus interface

1708

1162

# name. Add it to the class.

1709

attr[attrname] = (dbus_service_property(

1710

alt_interface, attribute._dbus_signature,

1711

attribute._dbus_access,

1712

attribute._dbus_get_args_options

1713

["byte_arrays"])

1714

(copy_function(attribute)))

1163

attr[attrname] = (dbus_service_property

1164

(alt_interface,

1165

attribute._dbus_signature,

1166

attribute._dbus_access,

1167

attribute

1168

._dbus_get_args_options

1169

["byte_arrays"])

1170

(types.FunctionType

1171

(attribute.func_code,

1172

attribute.func_globals,

1173

attribute.func_name,

1174

attribute.func_defaults,

1175

attribute.func_closure)))

1715

1176

# Copy annotations, if any

1716

1177

try:

1717

attr[attrname]._dbus_annotations = dict(

1718

attribute._dbus_annotations)

1178

attr[attrname]._dbus_annotations = (

1179

dict(attribute._dbus_annotations))

1719

1180

except AttributeError:

1720

1181

pass

1721

1182

# Is this a D-Bus interface?

1724

1185

# object. Decorate it to be a new D-Bus interface

1725

1186

# with the alternate D-Bus interface name. Add it

1726

1187

# to the class.

1727

attr[attrname] = (

1728

dbus_interface_annotations(alt_interface)

1729

(copy_function(attribute)))

1188

attr[attrname] = (dbus_interface_annotations

1189

(alt_interface)

1190

(types.FunctionType

1191

(attribute.func_code,

1192

attribute.func_globals,

1193

attribute.func_name,

1194

attribute.func_defaults,

1195

attribute.func_closure)))

1730

1196

if deprecate:

1731

1197

# Deprecate all alternate interfaces

1732

iname = "_AlternateDBusNames_interface_annotation{}"

1198

iname="_AlternateDBusNames_interface_annotation{0}"

1733

1199

for interface_name in interface_names:

1734

1735

1200

@dbus_interface_annotations(interface_name)

1736

1201

def func(self):

1737

return {"org.freedesktop.DBus.Deprecated":

1738

"true"}

1202

return { "org.freedesktop.DBus.Deprecated":

1203

"true" }

1739

1204

# Find an unused name

1740

1205

for aname in (iname.format(i)

1741

1206

for i in itertools.count()):

1745

1210

if interface_names:

1746

1211

# Replace the class with a new subclass of it with

1747

1212

# methods, signals, etc. as created above.

1748

if sys.version_info.major == 2:

1749

cls = type(b"{}Alternate".format(cls.__name__),

1750

(cls, ), attr)

1751

else:

1752

cls = type("{}Alternate".format(cls.__name__),

1753

(cls, ), attr)

1213

cls = type(b"{0}Alternate".format(cls.__name__),

1214

(cls,), attr)

1754

1215

return cls

1755

1756

1216

return wrapper

1757

1217

1758

1218

1759

1219

@alternate_dbus_interfaces({"se.recompile.Mandos":

1760

"se.bsnet.fukt.Mandos"})

1220

"se.bsnet.fukt.Mandos"})

1761

1221

class ClientDBus(Client, DBusObjectWithProperties):

1762

1222

"""A Client class using D-Bus

1763

1223

1764

1224

Attributes:

1765

1225

dbus_object_path: dbus.ObjectPath

1766

1226

bus: dbus.SystemBus()

1767

1227

"""

1768

1228

1769

1229

runtime_expansions = (Client.runtime_expansions

1770

+ ("dbus_object_path", ))

1771

1772

_interface = "se.recompile.Mandos.Client"

1773

1230

+ ("dbus_object_path",))

1231

1774

1232

# dbus.service.Object doesn't use super(), so we can't either.

1775

1776

def __init__(self, bus=None, *args, **kwargs):

1233

1234

def __init__(self, bus = None, *args, **kwargs):

1777

1235

self.bus = bus

1778

1236

Client.__init__(self, *args, **kwargs)

1779

1237

# Only now, when this client is initialized, can it show up on

1780

1238

# the D-Bus

1781

client_object_name = str(self.name).translate(

1239

client_object_name = unicode(self.name).translate(

1782

1240

{ord("."): ord("_"),

1783

1241

ord("-"): ord("_")})

1784

self.dbus_object_path = dbus.ObjectPath(

1785

"/clients/" + client_object_name)

1242

self.dbus_object_path = (dbus.ObjectPath

1243

("/clients/" + client_object_name))

1786

1244

DBusObjectWithProperties.__init__(self, self.bus,

1787

1245

self.dbus_object_path)

1788

1789

def notifychangeproperty(transform_func, dbus_name,

1790

type_func=lambda x: x,

1791

variant_level=1,

1792

invalidate_only=False,

1793

_interface=_interface):

1246

1247

def notifychangeproperty(transform_func,

1248

dbus_name, type_func=lambda x: x,

1249

variant_level=1):

1794

1250

""" Modify a variable so that it's a property which announces

1795

1251

its changes to DBus.

1796

1252

1797

1253

transform_fun: Function that takes a value and a variant_level

1798

1254

and transforms it to a D-Bus type.

1799

1255

dbus_name: D-Bus name of the variable

1801

1257

to the D-Bus. Default: no transform

1802

1258

variant_level: D-Bus variant level. Default: 1

1803

1259

"""

1804

attrname = "_{}".format(dbus_name)

1805

1260

attrname = "_{0}".format(dbus_name)

1806

1261

def setter(self, value):

1807

1262

if hasattr(self, "dbus_object_path"):

1808

1263

if (not hasattr(self, attrname) or

1809

1264

type_func(getattr(self, attrname, None))

1810

1265

!= type_func(value)):

1811

if invalidate_only:

1812

self.PropertiesChanged(

1813

_interface, dbus.Dictionary(),

1814

dbus.Array((dbus_name, )))

1815

else:

1816

dbus_value = transform_func(

1817

type_func(value),

1818

variant_level=variant_level)

1819

self.PropertyChanged(dbus.String(dbus_name),

1820

dbus_value)

1821

self.PropertiesChanged(

1822

_interface,

1823

dbus.Dictionary({dbus.String(dbus_name):

1824

dbus_value}),

1825

dbus.Array())

1266

dbus_value = transform_func(type_func(value),

1267

variant_level

1268

=variant_level)

1269

self.PropertyChanged(dbus.String(dbus_name),

1270

dbus_value)

1826

1271

setattr(self, attrname, value)

1827

1272

1828

1273

return property(lambda self: getattr(self, attrname), setter)

1829

1274

1830

1275

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1831

1276

approvals_pending = notifychangeproperty(dbus.Boolean,

1832

1277

"ApprovalPending",

1833

type_func=bool)

1278

type_func = bool)

1834

1279

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1835

1280

last_enabled = notifychangeproperty(datetime_to_dbus,

1836

1281

"LastEnabled")

1837

checker = notifychangeproperty(

1838

dbus.Boolean, "CheckerRunning",

1839

type_func=lambda checker: checker is not None)

1282

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1283

type_func = lambda checker:

1284

checker is not None)

1840

1285

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1841

1286

"LastCheckedOK")

1842

1287

last_checker_status = notifychangeproperty(dbus.Int16,

1845

1290

datetime_to_dbus, "LastApprovalRequest")

1846

1291

approved_by_default = notifychangeproperty(dbus.Boolean,

1847

1292

"ApprovedByDefault")

1848

approval_delay = notifychangeproperty(

1849

dbus.UInt64, "ApprovalDelay",

1850

type_func=lambda td: td.total_seconds() * 1000)

1293

approval_delay = notifychangeproperty(dbus.UInt64,

1294

"ApprovalDelay",

1295

type_func =

1296

timedelta_to_milliseconds)

1851

1297

approval_duration = notifychangeproperty(

1852

1298

dbus.UInt64, "ApprovalDuration",

1853

type_func=lambda td: td.total_seconds() * 1000)

1299

type_func = timedelta_to_milliseconds)

1854

1300

host = notifychangeproperty(dbus.String, "Host")

1855

timeout = notifychangeproperty(

1856

dbus.UInt64, "Timeout",

1857

type_func=lambda td: td.total_seconds() * 1000)

1301

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1302

type_func =

1303

timedelta_to_milliseconds)

1858

1304

extended_timeout = notifychangeproperty(

1859

1305

dbus.UInt64, "ExtendedTimeout",

1860

type_func=lambda td: td.total_seconds() * 1000)

1861

interval = notifychangeproperty(

1862

dbus.UInt64, "Interval",

1863

type_func=lambda td: td.total_seconds() * 1000)

1306

type_func = timedelta_to_milliseconds)

1307

interval = notifychangeproperty(dbus.UInt64,

1308

"Interval",

1309

type_func =

1310

timedelta_to_milliseconds)

1864

1311

checker_command = notifychangeproperty(dbus.String, "Checker")

1865

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1866

invalidate_only=True)

1867

1312

1868

1313

del notifychangeproperty

1869

1314

1870

1315

def __del__(self, *args, **kwargs):

1871

1316

try:

1872

1317

self.remove_from_connection()

1875

1320

if hasattr(DBusObjectWithProperties, "__del__"):

1876

1321

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1877

1322

Client.__del__(self, *args, **kwargs)

1878

1879

def checker_callback(self, source, condition,

1880

connection, command, *args, **kwargs):

1881

ret = Client.checker_callback(self, source, condition,

1882

connection, command, *args,

1883

**kwargs)

1884

exitstatus = self.last_checker_status

1885

if exitstatus >= 0:

1323

1324

def checker_callback(self, pid, condition, command,

1325

*args, **kwargs):

1326

self.checker_callback_tag = None

1327

self.checker = None

1328

if os.WIFEXITED(condition):

1329

exitstatus = os.WEXITSTATUS(condition)

1886

1330

# Emit D-Bus signal

1887

1331

self.CheckerCompleted(dbus.Int16(exitstatus),

1888

# This is specific to GNU libC

1889

dbus.Int64(exitstatus << 8),

1332

dbus.Int64(condition),

1890

1333

dbus.String(command))

1891

1334

else:

1892

1335

# Emit D-Bus signal

1893

1336

self.CheckerCompleted(dbus.Int16(-1),

1894

dbus.Int64(

1895

# This is specific to GNU libC

1896

(exitstatus << 8)

1897

| self.last_checker_signal),

1337

dbus.Int64(condition),

1898

1338

dbus.String(command))

1899

return ret

1900

1339

1340

return Client.checker_callback(self, pid, condition, command,

1341

*args, **kwargs)

1342

1901

1343

def start_checker(self, *args, **kwargs):

1902

old_checker_pid = getattr(self.checker, "pid", None)

1344

old_checker = self.checker

1345

if self.checker is not None:

1346

old_checker_pid = self.checker.pid

1347

else:

1348

old_checker_pid = None

1903

1349

r = Client.start_checker(self, *args, **kwargs)

1904

1350

# Only if new checker process was started

1905

1351

if (self.checker is not None

1907

1353

# Emit D-Bus signal

1908

1354

self.CheckerStarted(self.current_checker_command)

1909

1355

return r

1910

1356

1911

1357

def _reset_approved(self):

1912

1358

self.approved = None

1913

1359

return False

1914

1360

1915

1361

def approve(self, value=True):

1916

1362

self.approved = value

1917

GLib.timeout_add(int(self.approval_duration.total_seconds()

1918

* 1000), self._reset_approved)

1363

gobject.timeout_add(timedelta_to_milliseconds

1364

(self.approval_duration),

1365

self._reset_approved)

1919

1366

self.send_changedstate()

1920

1921

# D-Bus methods, signals & properties

1922

1923

# Interfaces

1924

1925

# Signals

1926

1367

1368

## D-Bus methods, signals & properties

1369

_interface = "se.recompile.Mandos.Client"

1370

1371

## Interfaces

1372

1373

@dbus_interface_annotations(_interface)

1374

def _foo(self):

1375

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1376

"false"}

1377

1378

## Signals

1379

1927

1380

# CheckerCompleted - signal

1928

1381

@dbus.service.signal(_interface, signature="nxs")

1929

1382

def CheckerCompleted(self, exitcode, waitstatus, command):

1930

1383

"D-Bus signal"

1931

1384

pass

1932

1385

1933

1386

# CheckerStarted - signal

1934

1387

@dbus.service.signal(_interface, signature="s")

1935

1388

def CheckerStarted(self, command):

1936

1389

"D-Bus signal"

1937

1390

pass

1938

1391

1939

1392

# PropertyChanged - signal

1940

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1941

1393

@dbus.service.signal(_interface, signature="sv")

1942

1394

def PropertyChanged(self, property, value):

1943

1395

"D-Bus signal"

1944

1396

pass

1945

1397

1946

1398

# GotSecret - signal

1947

1399

@dbus.service.signal(_interface)

1948

1400

def GotSecret(self):

1951

1403

server to mandos-client

1952

1404

"""

1953

1405

pass

1954

1406

1955

1407

# Rejected - signal

1956

1408

@dbus.service.signal(_interface, signature="s")

1957

1409

def Rejected(self, reason):

1958

1410

"D-Bus signal"

1959

1411

pass

1960

1412

1961

1413

# NeedApproval - signal

1962

1414

@dbus.service.signal(_interface, signature="tb")

1963

1415

def NeedApproval(self, timeout, default):

1964

1416

"D-Bus signal"

1965

1417

return self.need_approval()

1966

1967

# Methods

1968

1418

1419

## Methods

1420

1969

1421

# Approve - method

1970

1422

@dbus.service.method(_interface, in_signature="b")

1971

1423

def Approve(self, value):

1972

1424

self.approve(value)

1973

1425

1974

1426

# CheckedOK - method

1975

1427

@dbus.service.method(_interface)

1976

1428

def CheckedOK(self):

1977

1429

self.checked_ok()

1978

1430

1979

1431

# Enable - method

1980

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1981

1432

@dbus.service.method(_interface)

1982

1433

def Enable(self):

1983

1434

"D-Bus method"

1984

1435

self.enable()

1985

1436

1986

1437

# StartChecker - method

1987

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1988

1438

@dbus.service.method(_interface)

1989

1439

def StartChecker(self):

1990

1440

"D-Bus method"

1991

1441

self.start_checker()

1992

1442

1993

1443

# Disable - method

1994

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1995

1444

@dbus.service.method(_interface)

1996

1445

def Disable(self):

1997

1446

"D-Bus method"

1998

1447

self.disable()

1999

1448

2000

1449

# StopChecker - method

2001

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2002

1450

@dbus.service.method(_interface)

2003

1451

def StopChecker(self):

2004

1452

self.stop_checker()

2005

2006

# Properties

2007

1453

1454

## Properties

1455

2008

1456

# ApprovalPending - property

2009

1457

@dbus_service_property(_interface, signature="b", access="read")

2010

1458

def ApprovalPending_dbus_property(self):

2011

1459

return dbus.Boolean(bool(self.approvals_pending))

2012

1460

2013

1461

# ApprovedByDefault - property

2014

@dbus_service_property(_interface,

2015

signature="b",

1462

@dbus_service_property(_interface, signature="b",

2016

1463

access="readwrite")

2017

1464

def ApprovedByDefault_dbus_property(self, value=None):

2018

1465

if value is None: # get

2019

1466

return dbus.Boolean(self.approved_by_default)

2020

1467

self.approved_by_default = bool(value)

2021

1468

2022

1469

# ApprovalDelay - property

2023

@dbus_service_property(_interface,

2024

signature="t",

1470

@dbus_service_property(_interface, signature="t",

2025

1471

access="readwrite")

2026

1472

def ApprovalDelay_dbus_property(self, value=None):

2027

1473

if value is None: # get

2028

return dbus.UInt64(self.approval_delay.total_seconds()

2029

* 1000)

1474

return dbus.UInt64(self.approval_delay_milliseconds())

2030

1475

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2031

1476

2032

1477

# ApprovalDuration - property

2033

@dbus_service_property(_interface,

2034

signature="t",

1478

@dbus_service_property(_interface, signature="t",

2035

1479

access="readwrite")

2036

1480

def ApprovalDuration_dbus_property(self, value=None):

2037

1481

if value is None: # get

2038

return dbus.UInt64(self.approval_duration.total_seconds()

2039

* 1000)

1482

return dbus.UInt64(timedelta_to_milliseconds(

1483

self.approval_duration))

2040

1484

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2041

1485

2042

1486

# Name - property

2043

@dbus_annotations(

2044

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2045

1487

@dbus_service_property(_interface, signature="s", access="read")

2046

1488

def Name_dbus_property(self):

2047

1489

return dbus.String(self.name)

2048

2049

# KeyID - property

2050

@dbus_annotations(

2051

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2052

@dbus_service_property(_interface, signature="s", access="read")

2053

def KeyID_dbus_property(self):

2054

return dbus.String(self.key_id)

2055

1490

2056

1491

# Fingerprint - property

2057

@dbus_annotations(

2058

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2059

1492

@dbus_service_property(_interface, signature="s", access="read")

2060

1493

def Fingerprint_dbus_property(self):

2061

1494

return dbus.String(self.fingerprint)

2062

1495

2063

1496

# Host - property

2064

@dbus_service_property(_interface,

2065

signature="s",

1497

@dbus_service_property(_interface, signature="s",

2066

1498

access="readwrite")

2067

1499

def Host_dbus_property(self, value=None):

2068

1500

if value is None: # get

2069

1501

return dbus.String(self.host)

2070

self.host = str(value)

2071

1502

self.host = unicode(value)

1503

2072

1504

# Created - property

2073

@dbus_annotations(

2074

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2075

1505

@dbus_service_property(_interface, signature="s", access="read")

2076

1506

def Created_dbus_property(self):

2077

1507

return datetime_to_dbus(self.created)

2078

1508

2079

1509

# LastEnabled - property

2080

1510

@dbus_service_property(_interface, signature="s", access="read")

2081

1511

def LastEnabled_dbus_property(self):

2082

1512

return datetime_to_dbus(self.last_enabled)

2083

1513

2084

1514

# Enabled - property

2085

@dbus_service_property(_interface,

2086

signature="b",

1515

@dbus_service_property(_interface, signature="b",

2087

1516

access="readwrite")

2088

1517

def Enabled_dbus_property(self, value=None):

2089

1518

if value is None: # get

2092

1521

self.enable()

2093

1522

else:

2094

1523

self.disable()

2095

1524

2096

1525

# LastCheckedOK - property

2097

@dbus_service_property(_interface,

2098

signature="s",

1526

@dbus_service_property(_interface, signature="s",

2099

1527

access="readwrite")

2100

1528

def LastCheckedOK_dbus_property(self, value=None):

2101

1529

if value is not None:

2102

1530

self.checked_ok()

2103

1531

return

2104

1532

return datetime_to_dbus(self.last_checked_ok)

2105

1533

2106

1534

# LastCheckerStatus - property

2107

@dbus_service_property(_interface, signature="n", access="read")

1535

@dbus_service_property(_interface, signature="n",

1536

access="read")

2108

1537

def LastCheckerStatus_dbus_property(self):

2109

1538

return dbus.Int16(self.last_checker_status)

2110

1539

2111

1540

# Expires - property

2112

1541

@dbus_service_property(_interface, signature="s", access="read")

2113

1542

def Expires_dbus_property(self):

2114

1543

return datetime_to_dbus(self.expires)

2115

1544

2116

1545

# LastApprovalRequest - property

2117

1546

@dbus_service_property(_interface, signature="s", access="read")

2118

1547

def LastApprovalRequest_dbus_property(self):

2119

1548

return datetime_to_dbus(self.last_approval_request)

2120

1549

2121

1550

# Timeout - property

2122

@dbus_service_property(_interface,

2123

signature="t",

1551

@dbus_service_property(_interface, signature="t",

2124

1552

access="readwrite")

2125

1553

def Timeout_dbus_property(self, value=None):

2126

1554

if value is None: # get

2127

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1555

return dbus.UInt64(self.timeout_milliseconds())

2128

1556

old_timeout = self.timeout

2129

1557

self.timeout = datetime.timedelta(0, 0, 0, value)

2130

1558

# Reschedule disabling

2138

1566

if (getattr(self, "disable_initiator_tag", None)

2139

1567

is None):

2140

1568

return

2141

GLib.source_remove(self.disable_initiator_tag)

2142

self.disable_initiator_tag = GLib.timeout_add(

2143

int((self.expires - now).total_seconds() * 1000),

2144

self.disable)

2145

1569

gobject.source_remove(self.disable_initiator_tag)

1570

self.disable_initiator_tag = (

1571

gobject.timeout_add(

1572

timedelta_to_milliseconds(self.expires - now),

1573

self.disable))

1574

2146

1575

# ExtendedTimeout - property

2147

@dbus_service_property(_interface,

2148

signature="t",

1576

@dbus_service_property(_interface, signature="t",

2149

1577

access="readwrite")

2150

1578

def ExtendedTimeout_dbus_property(self, value=None):

2151

1579

if value is None: # get

2152

return dbus.UInt64(self.extended_timeout.total_seconds()

2153

* 1000)

1580

return dbus.UInt64(self.extended_timeout_milliseconds())

2154

1581

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2155

1582

2156

1583

# Interval - property

2157

@dbus_service_property(_interface,

2158

signature="t",

1584

@dbus_service_property(_interface, signature="t",

2159

1585

access="readwrite")

2160

1586

def Interval_dbus_property(self, value=None):

2161

1587

if value is None: # get

2162

return dbus.UInt64(self.interval.total_seconds() * 1000)

1588

return dbus.UInt64(self.interval_milliseconds())

2163

1589

self.interval = datetime.timedelta(0, 0, 0, value)

2164

1590

if getattr(self, "checker_initiator_tag", None) is None:

2165

1591

return

2166

1592

if self.enabled:

2167

1593

# Reschedule checker run

2168

GLib.source_remove(self.checker_initiator_tag)

2169

self.checker_initiator_tag = GLib.timeout_add(

2170

value, self.start_checker)

2171

self.start_checker() # Start one now, too

2172

1594

gobject.source_remove(self.checker_initiator_tag)

1595

self.checker_initiator_tag = (gobject.timeout_add

1596

(value, self.start_checker))

1597

self.start_checker() # Start one now, too

1598

2173

1599

# Checker - property

2174

@dbus_service_property(_interface,

2175

signature="s",

1600

@dbus_service_property(_interface, signature="s",

2176

1601

access="readwrite")

2177

1602

def Checker_dbus_property(self, value=None):

2178

1603

if value is None: # get

2179

1604

return dbus.String(self.checker_command)

2180

self.checker_command = str(value)

2181

1605

self.checker_command = unicode(value)

1606

2182

1607

# CheckerRunning - property

2183

@dbus_service_property(_interface,

2184

signature="b",

1608

@dbus_service_property(_interface, signature="b",

2185

1609

access="readwrite")

2186

1610

def CheckerRunning_dbus_property(self, value=None):

2187

1611

if value is None: # get

2190

1614

self.start_checker()

2191

1615

else:

2192

1616

self.stop_checker()

2193

1617

2194

1618

# ObjectPath - property

2195

@dbus_annotations(

2196

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2197

"org.freedesktop.DBus.Deprecated": "true"})

2198

1619

@dbus_service_property(_interface, signature="o", access="read")

2199

1620

def ObjectPath_dbus_property(self):

2200

return self.dbus_object_path # is already a dbus.ObjectPath

2201

1621

return self.dbus_object_path # is already a dbus.ObjectPath

1622

2202

1623

# Secret = property

2203

@dbus_annotations(

2204

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2205

"invalidates"})

2206

@dbus_service_property(_interface,

2207

signature="ay",

2208

access="write",

2209

byte_arrays=True)

1624

@dbus_service_property(_interface, signature="ay",

1625

access="write", byte_arrays=True)

2210

1626

def Secret_dbus_property(self, value):

2211

self.secret = bytes(value)

2212

1627

self.secret = str(value)

1628

2213

1629

del _interface

2214

1630

2215

1631

2216

1632

class ProxyClient(object):

2217

def __init__(self, child_pipe, key_id, fpr, address):

1633

def __init__(self, child_pipe, fpr, address):

2218

1634

self._pipe = child_pipe

2219

self._pipe.send(('init', key_id, fpr, address))

1635

self._pipe.send(('init', fpr, address))

2220

1636

if not self._pipe.recv():

2221

raise KeyError(key_id or fpr)

2222

1637

raise KeyError()

1638

2223

1639

def __getattribute__(self, name):

2224

1640

if name == '_pipe':

2225

1641

return super(ProxyClient, self).__getattribute__(name)

2228

1644

if data[0] == 'data':

2229

1645

return data[1]

2230

1646

if data[0] == 'function':

2231

2232

1647

def func(*args, **kwargs):

2233

1648

self._pipe.send(('funcall', name, args, kwargs))

2234

1649

return self._pipe.recv()[1]

2235

2236

1650

return func

2237

1651

2238

1652

def __setattr__(self, name, value):

2239

1653

if name == '_pipe':

2240

1654

return super(ProxyClient, self).__setattr__(name, value)

2243

1657

2244

1658

class ClientHandler(socketserver.BaseRequestHandler, object):

2245

1659

"""A class to handle client connections.

2246

1660

2247

1661

Instantiated once for each connection to handle it.

2248

1662

Note: This will run in its own forked process."""

2249

1663

2250

1664

def handle(self):

2251

1665

with contextlib.closing(self.server.child_pipe) as child_pipe:

2252

1666

logger.info("TCP connection from: %s",

2253

str(self.client_address))

1667

unicode(self.client_address))

2254

1668

logger.debug("Pipe FD: %d",

2255

1669

self.server.child_pipe.fileno())

2256

2257

session = gnutls.ClientSession(self.request)

2258

2259

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2260

# "+AES-256-CBC", "+SHA1",

2261

# "+COMP-NULL", "+CTYPE-OPENPGP",

2262

# "+DHE-DSS"))

1670

1671

session = (gnutls.connection

1672

.ClientSession(self.request,

1673

gnutls.connection

1674

.X509Credentials()))

1675

1676

# Note: gnutls.connection.X509Credentials is really a

1677

# generic GnuTLS certificate credentials object so long as

1678

# no X.509 keys are added to it. Therefore, we can use it

1679

# here despite using OpenPGP certificates.

1680

1681

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1682

# "+AES-256-CBC", "+SHA1",

1683

# "+COMP-NULL", "+CTYPE-OPENPGP",

1684

# "+DHE-DSS"))

2263

1685

# Use a fallback default, since this MUST be set.

2264

1686

priority = self.server.gnutls_priority

2265

1687

if priority is None:

2266

1688

priority = "NORMAL"

2267

gnutls.priority_set_direct(session._c_object,

2268

priority.encode("utf-8"),

2269

None)

2270

1689

(gnutls.library.functions

1690

.gnutls_priority_set_direct(session._c_object,

1691

priority, None))

1692

2271

1693

# Start communication using the Mandos protocol

2272

1694

# Get protocol number

2273

1695

line = self.request.makefile().readline()

2274

1696

logger.debug("Protocol version: %r", line)

2275

1697

try:

2276

1698

if int(line.strip().split()[0]) > 1:

2277

raise RuntimeError(line)

1699

raise RuntimeError

2278

1700

except (ValueError, IndexError, RuntimeError) as error:

2279

1701

logger.error("Unknown protocol version: %s", error)

2280

1702

return

2281

1703

2282

1704

# Start GnuTLS connection

2283

1705

try:

2284

1706

session.handshake()

2285

except gnutls.Error as error:

1707

except gnutls.errors.GNUTLSError as error:

2286

1708

logger.warning("Handshake failed: %s", error)

2287

1709

# Do not run session.bye() here: the session is not

2288

1710

# established. Just abandon the request.

2289

1711

return

2290

1712

logger.debug("Handshake succeeded")

2291

1713

2292

1714

approval_required = False

2293

1715

try:

2294

if gnutls.has_rawpk:

2295

fpr = b""

2296

try:

2297

key_id = self.key_id(

2298

self.peer_certificate(session))

2299

except (TypeError, gnutls.Error) as error:

2300

logger.warning("Bad certificate: %s", error)

2301

return

2302

logger.debug("Key ID: %s", key_id)

2303

2304

else:

2305

key_id = b""

2306

try:

2307

fpr = self.fingerprint(

2308

self.peer_certificate(session))

2309

except (TypeError, gnutls.Error) as error:

2310

logger.warning("Bad certificate: %s", error)

2311

return

2312

logger.debug("Fingerprint: %s", fpr)

2313

2314

try:

2315

client = ProxyClient(child_pipe, key_id, fpr,

1716

try:

1717

fpr = self.fingerprint(self.peer_certificate

1718

(session))

1719

except (TypeError,

1720

gnutls.errors.GNUTLSError) as error:

1721

logger.warning("Bad certificate: %s", error)

1722

return

1723

logger.debug("Fingerprint: %s", fpr)

1724

1725

try:

1726

client = ProxyClient(child_pipe, fpr,

2316

1727

self.client_address)

2317

1728

except KeyError:

2318

1729

return

2319

1730

2320

1731

if client.approval_delay:

2321

1732

delay = client.approval_delay

2322

1733

client.approvals_pending += 1

2323

1734

approval_required = True

2324

1735

2325

1736

while True:

2326

1737

if not client.enabled:

2327

1738

logger.info("Client %s is disabled",

2328

client.name)

1739

client.name)

2329

1740

if self.server.use_dbus:

2330

1741

# Emit D-Bus signal

2331

1742

client.Rejected("Disabled")

2332

1743

return

2333

1744

2334

1745

if client.approved or not client.approval_delay:

2335

# We are approved or approval is disabled

1746

#We are approved or approval is disabled

2336

1747

break

2337

1748

elif client.approved is None:

2338

1749

logger.info("Client %s needs approval",

2340

1751

if self.server.use_dbus:

2341

1752

# Emit D-Bus signal

2342

1753

client.NeedApproval(

2343

client.approval_delay.total_seconds()

2344

* 1000, client.approved_by_default)

1754

client.approval_delay_milliseconds(),

1755

client.approved_by_default)

2345

1756

else:

2346

1757

logger.warning("Client %s was not approved",

2347

1758

client.name)

2349

1760

# Emit D-Bus signal

2350

1761

client.Rejected("Denied")

2351

1762

return

2352

2353

# wait until timeout or approved

1763

1764

#wait until timeout or approved

2354

1765

time = datetime.datetime.now()

2355

1766

client.changedstate.acquire()

2356

client.changedstate.wait(delay.total_seconds())

1767

client.changedstate.wait(

1768

float(timedelta_to_milliseconds(delay)

1769

/ 1000))

2357

1770

client.changedstate.release()

2358

1771

time2 = datetime.datetime.now()

2359

1772

if (time2 - time) >= delay:

2369

1782

break

2370

1783

else:

2371

1784

delay -= time2 - time

2372

2373

try:

2374

session.send(client.secret)

2375

except gnutls.Error as error:

2376

logger.warning("gnutls send failed",

2377

exc_info=error)

2378

return

2379

1785

1786

sent_size = 0

1787

while sent_size < len(client.secret):

1788

try:

1789

sent = session.send(client.secret[sent_size:])

1790

except gnutls.errors.GNUTLSError as error:

1791

logger.warning("gnutls send failed",

1792

exc_info=error)

1793

return

1794

logger.debug("Sent: %d, remaining: %d",

1795

sent, len(client.secret)

1796

- (sent_size + sent))

1797

sent_size += sent

1798

2380

1799

logger.info("Sending secret to %s", client.name)

2381

1800

# bump the timeout using extended_timeout

2382

1801

client.bump_timeout(client.extended_timeout)

2383

1802

if self.server.use_dbus:

2384

1803

# Emit D-Bus signal

2385

1804

client.GotSecret()

2386

1805

2387

1806

finally:

2388

1807

if approval_required:

2389

1808

client.approvals_pending -= 1

2390

1809

try:

2391

1810

session.bye()

2392

except gnutls.Error as error:

1811

except gnutls.errors.GNUTLSError as error:

2393

1812

logger.warning("GnuTLS bye failed",

2394

1813

exc_info=error)

2395

1814

2396

1815

@staticmethod

2397

1816

def peer_certificate(session):

2398

"Return the peer's certificate as a bytestring"

2399

try:

2400

cert_type = gnutls.certificate_type_get2(session._c_object,

2401

gnutls.CTYPE_PEERS)

2402

except AttributeError:

2403

cert_type = gnutls.certificate_type_get(session._c_object)

2404

if gnutls.has_rawpk:

2405

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2406

else:

2407

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2408

# If not a valid certificate type...

2409

if cert_type not in valid_cert_types:

2410

logger.info("Cert type %r not in %r", cert_type,

2411

valid_cert_types)

2412

# ...return invalid data

2413

return b""

1817

"Return the peer's OpenPGP certificate as a bytestring"

1818

# If not an OpenPGP certificate...

1819

if (gnutls.library.functions

1820

.gnutls_certificate_type_get(session._c_object)

1821

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1822

# ...do the normal thing

1823

return session.peer_certificate

2414

1824

list_size = ctypes.c_uint(1)

2415

cert_list = (gnutls.certificate_get_peers

1825

cert_list = (gnutls.library.functions

1826

.gnutls_certificate_get_peers

2416

1827

(session._c_object, ctypes.byref(list_size)))

2417

1828

if not bool(cert_list) and list_size.value != 0:

2418

raise gnutls.Error("error getting peer certificate")

1829

raise gnutls.errors.GNUTLSError("error getting peer"

1830

" certificate")

2419

1831

if list_size.value == 0:

2420

1832

return None

2421

1833

cert = cert_list[0]

2422

1834

return ctypes.string_at(cert.data, cert.size)

2423

2424

@staticmethod

2425

def key_id(certificate):

2426

"Convert a certificate bytestring to a hexdigit key ID"

2427

# New GnuTLS "datum" with the public key

2428

datum = gnutls.datum_t(

2429

ctypes.cast(ctypes.c_char_p(certificate),

2430

ctypes.POINTER(ctypes.c_ubyte)),

2431

ctypes.c_uint(len(certificate)))

2432

# XXX all these need to be created in the gnutls "module"

2433

# New empty GnuTLS certificate

2434

pubkey = gnutls.pubkey_t()

2435

gnutls.pubkey_init(ctypes.byref(pubkey))

2436

# Import the raw public key into the certificate

2437

gnutls.pubkey_import(pubkey,

2438

ctypes.byref(datum),

2439

gnutls.X509_FMT_DER)

2440

# New buffer for the key ID

2441

buf = ctypes.create_string_buffer(32)

2442

buf_len = ctypes.c_size_t(len(buf))

2443

# Get the key ID from the raw public key into the buffer

2444

gnutls.pubkey_get_key_id(pubkey,

2445

gnutls.KEYID_USE_SHA256,

2446

ctypes.cast(ctypes.byref(buf),

2447

ctypes.POINTER(ctypes.c_ubyte)),

2448

ctypes.byref(buf_len))

2449

# Deinit the certificate

2450

gnutls.pubkey_deinit(pubkey)

2451

2452

# Convert the buffer to a Python bytestring

2453

key_id = ctypes.string_at(buf, buf_len.value)

2454

# Convert the bytestring to hexadecimal notation

2455

hex_key_id = binascii.hexlify(key_id).upper()

2456

return hex_key_id

2457

1835

2458

1836

@staticmethod

2459

1837

def fingerprint(openpgp):

2460

1838

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2461

1839

# New GnuTLS "datum" with the OpenPGP public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(openpgp),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(openpgp)))

1840

datum = (gnutls.library.types

1841

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1842

ctypes.POINTER

1843

(ctypes.c_ubyte)),

1844

ctypes.c_uint(len(openpgp))))

2466

1845

# New empty GnuTLS certificate

2467

crt = gnutls.openpgp_crt_t()

2468

gnutls.openpgp_crt_init(ctypes.byref(crt))

1846

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1847

(gnutls.library.functions

1848

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2469

1849

# Import the OpenPGP public key into the certificate

2470

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2471

gnutls.OPENPGP_FMT_RAW)

1850

(gnutls.library.functions

1851

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1852

gnutls.library.constants

1853

.GNUTLS_OPENPGP_FMT_RAW))

2472

1854

# Verify the self signature in the key

2473

1855

crtverify = ctypes.c_uint()

2474

gnutls.openpgp_crt_verify_self(crt, 0,

2475

ctypes.byref(crtverify))

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_verify_self(crt, 0,

1858

ctypes.byref(crtverify)))

2476

1859

if crtverify.value != 0:

2477

gnutls.openpgp_crt_deinit(crt)

2478

raise gnutls.CertificateSecurityError(code

2479

=crtverify.value)

1860

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1861

raise (gnutls.errors.CertificateSecurityError

1862

("Verify failed"))

2480

1863

# New buffer for the fingerprint

2481

1864

buf = ctypes.create_string_buffer(20)

2482

1865

buf_len = ctypes.c_size_t()

2483

1866

# Get the fingerprint from the certificate into the buffer

2484

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2485

ctypes.byref(buf_len))

1867

(gnutls.library.functions

1868

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1869

ctypes.byref(buf_len)))

2486

1870

# Deinit the certificate

2487

gnutls.openpgp_crt_deinit(crt)

1871

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2488

1872

# Convert the buffer to a Python bytestring

2489

1873

fpr = ctypes.string_at(buf, buf_len.value)

2490

1874

# Convert the bytestring to hexadecimal notation

2494

1878

2495

1879

class MultiprocessingMixIn(object):

2496

1880

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2497

2498

1881

def sub_process_main(self, request, address):

2499

1882

try:

2500

1883

self.finish_request(request, address)

2501

1884

except Exception:

2502

1885

self.handle_error(request, address)

2503

1886

self.close_request(request)

2504

1887

2505

1888

def process_request(self, request, address):

2506

1889

"""Start a new process to process the request."""

2507

proc = multiprocessing.Process(target=self.sub_process_main,

2508

args=(request, address))

1890

proc = multiprocessing.Process(target = self.sub_process_main,

1891

args = (request, address))

2509

1892

proc.start()

2510

1893

return proc

2511

1894

2512

1895

2513

1896

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2514

1897

""" adds a pipe to the MixIn """

2515

2516

1898

def process_request(self, request, client_address):

2517

1899

"""Overrides and wraps the original process_request().

2518

1900

2519

1901

This function creates a new pipe in self.pipe

2520

1902

"""

2521

1903

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2522

1904

2523

1905

proc = MultiprocessingMixIn.process_request(self, request,

2524

1906

client_address)

2525

1907

self.child_pipe.close()

2526

1908

self.add_pipe(parent_pipe, proc)

2527

1909

2528

1910

def add_pipe(self, parent_pipe, proc):

2529

1911

"""Dummy function; override as necessary"""

2530

raise NotImplementedError()

1912

raise NotImplementedError

2531

1913

2532

1914

2533

1915

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2534

1916

socketserver.TCPServer, object):

2535

1917

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2536

1918

2537

1919

Attributes:

2538

1920

enabled: Boolean; whether this server is activated yet

2539

1921

interface: None or a network interface name (string)

2540

1922

use_ipv6: Boolean; to use IPv6 or not

2541

1923

"""

2542

2543

1924

def __init__(self, server_address, RequestHandlerClass,

2544

interface=None,

2545

use_ipv6=True,

2546

socketfd=None):

1925

interface=None, use_ipv6=True, socketfd=None):

2547

1926

"""If socketfd is set, use that file descriptor instead of

2548

1927

creating a new one with socket.socket().

2549

1928

"""

2555

1934

self.socketfd = socketfd

2556

1935

# Save the original socket.socket() function

2557

1936

self.socket_socket = socket.socket

2558

2559

1937

# To implement --socket, we monkey patch socket.socket.

2560

#

1938

#

2561

1939

# (When socketserver.TCPServer is a new-style class, we

2562

1940

# could make self.socket into a property instead of monkey

2563

1941

# patching socket.socket.)

2564

#

1942

#

2565

1943

# Create a one-time-only replacement for socket.socket()

2566

1944

@functools.wraps(socket.socket)

2567

1945

def socket_wrapper(*args, **kwargs):

2579

1957

# socket_wrapper(), if socketfd was set.

2580

1958

socketserver.TCPServer.__init__(self, server_address,

2581

1959

RequestHandlerClass)

2582

1960

2583

1961

def server_bind(self):

2584

1962

"""This overrides the normal server_bind() function

2585

1963

to bind to an interface if one was specified, and also NOT to

2586

1964

bind to an address or port if they were not specified."""

2587

global SO_BINDTODEVICE

2588

1965

if self.interface is not None:

2589

1966

if SO_BINDTODEVICE is None:

2590

# Fall back to a hard-coded value which seems to be

2591

# common enough.

2592

logger.warning("SO_BINDTODEVICE not found, trying 25")

2593

SO_BINDTODEVICE = 25

2594

try:

2595

self.socket.setsockopt(

2596

socket.SOL_SOCKET, SO_BINDTODEVICE,

2597

(self.interface + "\0").encode("utf-8"))

2598

except socket.error as error:

2599

if error.errno == errno.EPERM:

2600

logger.error("No permission to bind to"

2601

" interface %s", self.interface)

2602

elif error.errno == errno.ENOPROTOOPT:

2603

logger.error("SO_BINDTODEVICE not available;"

2604

" cannot bind to interface %s",

2605

self.interface)

2606

elif error.errno == errno.ENODEV:

2607

logger.error("Interface %s does not exist,"

2608

" cannot bind", self.interface)

2609

else:

2610

raise

1967

logger.error("SO_BINDTODEVICE does not exist;"

1968

" cannot bind to interface %s",

1969

self.interface)

1970

else:

1971

try:

1972

self.socket.setsockopt(socket.SOL_SOCKET,

1973

SO_BINDTODEVICE,

1974

str(self.interface + '\0'))

1975

except socket.error as error:

1976

if error.errno == errno.EPERM:

1977

logger.error("No permission to bind to"

1978

" interface %s", self.interface)

1979

elif error.errno == errno.ENOPROTOOPT:

1980

logger.error("SO_BINDTODEVICE not available;"

1981

" cannot bind to interface %s",

1982

self.interface)

1983

elif error.errno == errno.ENODEV:

1984

logger.error("Interface %s does not exist,"

1985

" cannot bind", self.interface)

1986

else:

1987

raise

2611

1988

# Only bind(2) the socket if we really need to.

2612

1989

if self.server_address[0] or self.server_address[1]:

2613

if self.server_address[1]:

2614

self.allow_reuse_address = True

2615

1990

if not self.server_address[0]:

2616

1991

if self.address_family == socket.AF_INET6:

2617

any_address = "::" # in6addr_any

1992

any_address = "::" # in6addr_any

2618

1993

else:

2619

any_address = "0.0.0.0" # INADDR_ANY

1994

any_address = "0.0.0.0" # INADDR_ANY

2620

1995

self.server_address = (any_address,

2621

1996

self.server_address[1])

2622

1997

elif not self.server_address[1]:

2623

self.server_address = (self.server_address[0], 0)

1998

self.server_address = (self.server_address[0],

1999

0)

2624

2000

# if self.interface:

2625

2001

# self.server_address = (self.server_address[0],

2626

2002

# 0, # port

2632

2008

2633

2009

class MandosServer(IPv6_TCPServer):

2634

2010

"""Mandos server.

2635

2011

2636

2012

Attributes:

2637

2013

clients: set of Client objects

2638

2014

gnutls_priority GnuTLS priority string

2639

2015

use_dbus: Boolean; to emit D-Bus signals or not

2640

2641

Assumes a GLib.MainLoop event loop.

2016

2017

Assumes a gobject.MainLoop event loop.

2642

2018

"""

2643

2644

2019

def __init__(self, server_address, RequestHandlerClass,

2645

interface=None,

2646

use_ipv6=True,

2647

clients=None,

2648

gnutls_priority=None,

2649

use_dbus=True,

2650

socketfd=None):

2020

interface=None, use_ipv6=True, clients=None,

2021

gnutls_priority=None, use_dbus=True, socketfd=None):

2651

2022

self.enabled = False

2652

2023

self.clients = clients

2653

2024

if self.clients is None:

2656

2027

self.gnutls_priority = gnutls_priority

2657

2028

IPv6_TCPServer.__init__(self, server_address,

2658

2029

RequestHandlerClass,

2659

interface=interface,

2660

use_ipv6=use_ipv6,

2661

socketfd=socketfd)

2662

2030

interface = interface,

2031

use_ipv6 = use_ipv6,

2032

socketfd = socketfd)

2663

2033

def server_activate(self):

2664

2034

if self.enabled:

2665

2035

return socketserver.TCPServer.server_activate(self)

2666

2036

2667

2037

def enable(self):

2668

2038

self.enabled = True

2669

2039

2670

2040

def add_pipe(self, parent_pipe, proc):

2671

2041

# Call "handle_ipc" for both data and EOF events

2672

GLib.io_add_watch(

2673

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2675

functools.partial(self.handle_ipc,

2676

parent_pipe=parent_pipe,

2677

proc=proc))

2678

2679

def handle_ipc(self, source, condition,

2680

parent_pipe=None,

2681

proc=None,

2682

client_object=None):

2042

gobject.io_add_watch(parent_pipe.fileno(),

2043

gobject.IO_IN | gobject.IO_HUP,

2044

functools.partial(self.handle_ipc,

2045

parent_pipe =

2046

parent_pipe,

2047

proc = proc))

2048

2049

def handle_ipc(self, source, condition, parent_pipe=None,

2050

proc = None, client_object=None):

2683

2051

# error, or the other end of multiprocessing.Pipe has closed

2684

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2052

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2685

2053

# Wait for other process to exit

2686

2054

proc.join()

2687

2055

return False

2688

2056

2689

2057

# Read a request from the child

2690

2058

request = parent_pipe.recv()

2691

2059

command = request[0]

2692

2060

2693

2061

if command == 'init':

2694

key_id = request[1].decode("ascii")

2695

fpr = request[2].decode("ascii")

2696

address = request[3]

2697

2698

for c in self.clients.values():

2699

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2700

continue

2701

if key_id and c.key_id == key_id:

2702

client = c

2703

break

2704

if fpr and c.fingerprint == fpr:

2062

fpr = request[1]

2063

address = request[2]

2064

2065

for c in self.clients.itervalues():

2066

if c.fingerprint == fpr:

2705

2067

client = c

2706

2068

break

2707

2069

else:

2708

logger.info("Client not found for key ID: %s, address"

2709

": %s", key_id or fpr, address)

2070

logger.info("Client not found for fingerprint: %s, ad"

2071

"dress: %s", fpr, address)

2710

2072

if self.use_dbus:

2711

2073

# Emit D-Bus signal

2712

mandos_dbus_service.ClientNotFound(key_id or fpr,

2074

mandos_dbus_service.ClientNotFound(fpr,

2713

2075

address[0])

2714

2076

parent_pipe.send(False)

2715

2077

return False

2716

2717

GLib.io_add_watch(

2718

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2720

functools.partial(self.handle_ipc,

2721

parent_pipe=parent_pipe,

2722

proc=proc,

2723

client_object=client))

2078

2079

gobject.io_add_watch(parent_pipe.fileno(),

2080

gobject.IO_IN | gobject.IO_HUP,

2081

functools.partial(self.handle_ipc,

2082

parent_pipe =

2083

parent_pipe,

2084

proc = proc,

2085

client_object =

2086

client))

2724

2087

parent_pipe.send(True)

2725

2088

# remove the old hook in favor of the new above hook on

2726

2089

# same fileno

2729

2092

funcname = request[1]

2730

2093

args = request[2]

2731

2094

kwargs = request[3]

2732

2095

2733

2096

parent_pipe.send(('data', getattr(client_object,

2734

2097

funcname)(*args,

2735

**kwargs)))

2736

2098

**kwargs)))

2099

2737

2100

if command == 'getattr':

2738

2101

attrname = request[1]

2739

if isinstance(client_object.__getattribute__(attrname),

2740

collections.Callable):

2741

parent_pipe.send(('function', ))

2102

if callable(client_object.__getattribute__(attrname)):

2103

parent_pipe.send(('function',))

2742

2104

else:

2743

parent_pipe.send((

2744

'data', client_object.__getattribute__(attrname)))

2745

2105

parent_pipe.send(('data', client_object

2106

.__getattribute__(attrname)))

2107

2746

2108

if command == 'setattr':

2747

2109

attrname = request[1]

2748

2110

value = request[2]

2749

2111

setattr(client_object, attrname, value)

2750

2112

2751

2113

return True

2752

2114

2753

2115

2754

2116

def rfc3339_duration_to_delta(duration):

2755

2117

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2756

2118

2757

2119

>>> rfc3339_duration_to_delta("P7D")

2758

2120

datetime.timedelta(7)

2759

2121

>>> rfc3339_duration_to_delta("PT60S")

2769

2131

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

2132

datetime.timedelta(1, 200)

2771

2133

"""

2772

2134

2773

2135

# Parsing an RFC 3339 duration with regular expressions is not

2774

2136

# possible - there would have to be multiple places for the same

2775

2137

# values, like seconds. The current code, while more esoteric, is

2776

2138

# cleaner without depending on a parsing library. If Python had a

2777

2139

# built-in library for parsing we would use it, but we'd like to

2778

2140

# avoid excessive use of external libraries.

2779

2141

2780

2142

# New type for defining tokens, syntax, and semantics all-in-one

2781

Token = collections.namedtuple("Token", (

2782

"regexp", # To match token; if "value" is not None, must have

2783

# a "group" containing digits

2784

"value", # datetime.timedelta or None

2785

"followers")) # Tokens valid after this token

2143

Token = collections.namedtuple("Token",

2144

("regexp", # To match token; if

2145

# "value" is not None,

2146

# must have a "group"

2147

# containing digits

2148

"value", # datetime.timedelta or

2149

# None

2150

"followers")) # Tokens valid after

2151

# this token

2786

2152

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2787

2153

# the "duration" ABNF definition in RFC 3339, Appendix A.

2788

2154

token_end = Token(re.compile(r"$"), None, frozenset())

2789

2155

token_second = Token(re.compile(r"(\d+)S"),

2790

2156

datetime.timedelta(seconds=1),

2791

frozenset((token_end, )))

2157

frozenset((token_end,)))

2792

2158

token_minute = Token(re.compile(r"(\d+)M"),

2793

2159

datetime.timedelta(minutes=1),

2794

2160

frozenset((token_second, token_end)))

2810

2176

frozenset((token_month, token_end)))

2811

2177

token_week = Token(re.compile(r"(\d+)W"),

2812

2178

datetime.timedelta(weeks=1),

2813

frozenset((token_end, )))

2179

frozenset((token_end,)))

2814

2180

token_duration = Token(re.compile(r"P"), None,

2815

2181

frozenset((token_year, token_month,

2816

2182

token_day, token_time,

2817

token_week)))

2818

# Define starting values:

2819

# Value so far

2820

value = datetime.timedelta()

2183

token_week))),

2184

# Define starting values

2185

value = datetime.timedelta() # Value so far

2821

2186

found_token = None

2822

# Following valid tokens

2823

followers = frozenset((token_duration, ))

2824

# String left to parse

2825

s = duration

2187

followers = frozenset(token_duration,) # Following valid tokens

2188

s = duration # String left to parse

2826

2189

# Loop until end token is found

2827

2190

while found_token is not token_end:

2828

2191

# Search for any currently valid tokens

2844

2207

break

2845

2208

else:

2846

2209

# No currently valid tokens were found

2847

raise ValueError("Invalid RFC 3339 duration: {!r}"

2848

.format(duration))

2210

raise ValueError("Invalid RFC 3339 duration")

2849

2211

# End token found

2850

2212

return value

2851

2213

2852

2214

2853

2215

def string_to_delta(interval):

2854

2216

"""Parse a string and return a datetime.timedelta

2855

2217

2856

2218

>>> string_to_delta('7d')

2857

2219

datetime.timedelta(7)

2858

2220

>>> string_to_delta('60s')

2866

2228

>>> string_to_delta('5m 30s')

2867

2229

datetime.timedelta(0, 330)

2868

2230

"""

2869

2231

2870

2232

try:

2871

2233

return rfc3339_duration_to_delta(interval)

2872

2234

except ValueError:

2873

2235

pass

2874

2236

2875

2237

timevalue = datetime.timedelta(0)

2876

2238

for s in interval.split():

2877

2239

try:

2878

suffix = s[-1]

2240

suffix = unicode(s[-1])

2879

2241

value = int(s[:-1])

2880

2242

if suffix == "d":

2881

2243

delta = datetime.timedelta(value)

2888

2250

elif suffix == "w":

2889

2251

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2890

2252

else:

2891

raise ValueError("Unknown suffix {!r}".format(suffix))

2892

except IndexError as e:

2253

raise ValueError("Unknown suffix {0!r}"

2254

.format(suffix))

2255

except (ValueError, IndexError) as e:

2893

2256

raise ValueError(*(e.args))

2894

2257

timevalue += delta

2895

2258

return timevalue

2896

2259

2897

2260

2898

def daemon(nochdir=False, noclose=False):

2261

def daemon(nochdir = False, noclose = False):

2899

2262

"""See daemon(3). Standard BSD Unix function.

2900

2263

2901

2264

This should really exist as os.daemon, but it doesn't (yet)."""

2902

2265

if os.fork():

2903

2266

sys.exit()

2911

2274

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2912

2275

if not stat.S_ISCHR(os.fstat(null).st_mode):

2913

2276

raise OSError(errno.ENODEV,

2914

"{} not a character device"

2277

"{0} not a character device"

2915

2278

.format(os.devnull))

2916

2279

os.dup2(null, sys.stdin.fileno())

2917

2280

os.dup2(null, sys.stdout.fileno())

2921

2284

2922

2285

2923

2286

def main():

2924

2287

2925

2288

##################################################################

2926

2289

# Parsing of options, both command line and config file

2927

2290

2928

2291

parser = argparse.ArgumentParser()

2929

2292

parser.add_argument("-v", "--version", action="version",

2930

version="%(prog)s {}".format(version),

2293

version = "%(prog)s {0}".format(version),

2931

2294

help="show version number and exit")

2932

2295

parser.add_argument("-i", "--interface", metavar="IF",

2933

2296

help="Bind to interface IF")

2966

2329

help="Directory to save/restore state in")

2967

2330

parser.add_argument("--foreground", action="store_true",

2968

2331

help="Run in foreground", default=None)

2969

parser.add_argument("--no-zeroconf", action="store_false",

2970

dest="zeroconf", help="Do not use Zeroconf",

2971

default=None)

2972

2332

2973

2333

options = parser.parse_args()

2974

2334

2975

2335

if options.check:

2976

2336

import doctest

2977

fail_count, test_count = doctest.testmod()

2978

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

2337

doctest.testmod()

2338

sys.exit()

2339

2980

2340

# Default values for config file for server-global settings

2981

if gnutls.has_rawpk:

2982

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2983

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2984

else:

2985

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2986

":+SIGN-DSA-SHA256")

2987

server_defaults = {"interface": "",

2988

"address": "",

2989

"port": "",

2990

"debug": "False",

2991

"priority": priority,

2992

"servicename": "Mandos",

2993

"use_dbus": "True",

2994

"use_ipv6": "True",

2995

"debuglevel": "",

2996

"restore": "True",

2997

"socket": "",

2998

"statedir": "/var/lib/mandos",

2999

"foreground": "False",

3000

"zeroconf": "True",

3001

}

3002

del priority

3003

2341

server_defaults = { "interface": "",

2342

"address": "",

2343

"port": "",

2344

"debug": "False",

2345

"priority":

2346

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",

2347

"servicename": "Mandos",

2348

"use_dbus": "True",

2349

"use_ipv6": "True",

2350

"debuglevel": "",

2351

"restore": "True",

2352

"socket": "",

2353

"statedir": "/var/lib/mandos",

2354

"foreground": "False",

2355

}

2356

3004

2357

# Parse config file for server-global settings

3005

server_config = configparser.ConfigParser(server_defaults)

2358

server_config = configparser.SafeConfigParser(server_defaults)

3006

2359

del server_defaults

3007

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3008

# Convert the ConfigParser object to a dict

2360

server_config.read(os.path.join(options.configdir,

2361

"mandos.conf"))

2362

# Convert the SafeConfigParser object to a dict

3009

2363

server_settings = server_config.defaults()

3010

2364

# Use the appropriate methods on the non-string config options

3011

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3012

"foreground", "zeroconf"):

2365

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3013

2366

server_settings[option] = server_config.getboolean("DEFAULT",

3014

2367

option)

3015

2368

if server_settings["port"]:

3025

2378

server_settings["socket"] = os.dup(server_settings

3026

2379

["socket"])

3027

2380

del server_config

3028

2381

3029

2382

# Override the settings from the config file with command line

3030

2383

# options, if set.

3031

2384

for option in ("interface", "address", "port", "debug",

3032

"priority", "servicename", "configdir", "use_dbus",

3033

"use_ipv6", "debuglevel", "restore", "statedir",

3034

"socket", "foreground", "zeroconf"):

2385

"priority", "servicename", "configdir",

2386

"use_dbus", "use_ipv6", "debuglevel", "restore",

2387

"statedir", "socket", "foreground"):

3035

2388

value = getattr(options, option)

3036

2389

if value is not None:

3037

2390

server_settings[option] = value

3038

2391

del options

3039

2392

# Force all strings to be unicode

3040

2393

for option in server_settings.keys():

3041

if isinstance(server_settings[option], bytes):

3042

server_settings[option] = (server_settings[option]

3043

.decode("utf-8"))

2394

if type(server_settings[option]) is str:

2395

server_settings[option] = unicode(server_settings[option])

3044

2396

# Force all boolean options to be boolean

3045

2397

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3046

"foreground", "zeroconf"):

2398

"foreground"):

3047

2399

server_settings[option] = bool(server_settings[option])

3048

2400

# Debug implies foreground

3049

2401

if server_settings["debug"]:

3050

2402

server_settings["foreground"] = True

3051

2403

# Now we have our good server settings in "server_settings"

3052

2404

3053

2405

##################################################################

3054

3055

if (not server_settings["zeroconf"]

3056

and not (server_settings["port"]

3057

or server_settings["socket"] != "")):

3058

parser.error("Needs port or socket to work without Zeroconf")

3059

2406

3060

2407

# For convenience

3061

2408

debug = server_settings["debug"]

3062

2409

debuglevel = server_settings["debuglevel"]

3065

2412

stored_state_path = os.path.join(server_settings["statedir"],

3066

2413

stored_state_file)

3067

2414

foreground = server_settings["foreground"]

3068

zeroconf = server_settings["zeroconf"]

3069

2415

3070

2416

if debug:

3071

2417

initlogger(debug, logging.DEBUG)

3072

2418

else:

3075

2421

else:

3076

2422

level = getattr(logging, debuglevel.upper())

3077

2423

initlogger(debug, level)

3078

2424

3079

2425

if server_settings["servicename"] != "Mandos":

3080

syslogger.setFormatter(

3081

logging.Formatter('Mandos ({}) [%(process)d]:'

3082

' %(levelname)s: %(message)s'.format(

3083

server_settings["servicename"])))

3084

2426

syslogger.setFormatter(logging.Formatter

2427

('Mandos ({0}) [%(process)d]:'

2428

' %(levelname)s: %(message)s'

2429

.format(server_settings

2430

["servicename"])))

2431

3085

2432

# Parse config file with clients

3086

client_config = configparser.ConfigParser(Client.client_defaults)

2433

client_config = configparser.SafeConfigParser(Client

2434

.client_defaults)

3087

2435

client_config.read(os.path.join(server_settings["configdir"],

3088

2436

"clients.conf"))

3089

2437

3090

2438

global mandos_dbus_service

3091

2439

mandos_dbus_service = None

3092

3093

socketfd = None

3094

if server_settings["socket"] != "":

3095

socketfd = server_settings["socket"]

3096

tcp_server = MandosServer(

3097

(server_settings["address"], server_settings["port"]),

3098

ClientHandler,

3099

interface=(server_settings["interface"] or None),

3100

use_ipv6=use_ipv6,

3101

gnutls_priority=server_settings["priority"],

3102

use_dbus=use_dbus,

3103

socketfd=socketfd)

2440

2441

tcp_server = MandosServer((server_settings["address"],

2442

server_settings["port"]),

2443

ClientHandler,

2444

interface=(server_settings["interface"]

2445

or None),

2446

use_ipv6=use_ipv6,

2447

gnutls_priority=

2448

server_settings["priority"],

2449

use_dbus=use_dbus,

2450

socketfd=(server_settings["socket"]

2451

or None))

3104

2452

if not foreground:

3105

2453

pidfilename = "/run/mandos.pid"

3106

if not os.path.isdir("/run/."):

3107

pidfilename = "/var/run/mandos.pid"

3108

2454

pidfile = None

3109

2455

try:

3110

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2456

pidfile = open(pidfilename, "w")

3111

2457

except IOError as e:

3112

2458

logger.error("Could not open file %r", pidfilename,

3113

2459

exc_info=e)

3114

3115

for name, group in (("_mandos", "_mandos"),

3116

("mandos", "mandos"),

3117

("nobody", "nogroup")):

2460

2461

for name in ("_mandos", "mandos", "nobody"):

3118

2462

try:

3119

2463

uid = pwd.getpwnam(name).pw_uid

3120

gid = pwd.getpwnam(group).pw_gid

2464

gid = pwd.getpwnam(name).pw_gid

3121

2465

break

3122

2466

except KeyError:

3123

2467

continue

3127

2471

try:

3128

2472

os.setgid(gid)

3129

2473

os.setuid(uid)

3130

if debug:

3131

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3132

gid))

3133

2474

except OSError as error:

3134

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3135

.format(uid, gid, os.strerror(error.errno)))

3136

2475

if error.errno != errno.EPERM:

3137

raise

3138

2476

raise error

2477

3139

2478

if debug:

3140

2479

# Enable all possible GnuTLS debugging

3141

2480

3142

2481

# "Use a log level over 10 to enable all debugging options."

3143

2482

# - GnuTLS manual

3144

gnutls.global_set_log_level(11)

3145

3146

@gnutls.log_func

2483

gnutls.library.functions.gnutls_global_set_log_level(11)

2484

2485

@gnutls.library.types.gnutls_log_func

3147

2486

def debug_gnutls(level, string):

3148

2487

logger.debug("GnuTLS: %s", string[:-1])

3149

3150

gnutls.global_set_log_function(debug_gnutls)

3151

2488

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2491

3152

2492

# Redirect stdin so all checkers get /dev/null

3153

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3154

2494

os.dup2(null, sys.stdin.fileno())

3155

2495

if null > 2:

3156

2496

os.close(null)

3157

2497

3158

2498

# Need to fork before connecting to D-Bus

3159

2499

if not foreground:

3160

2500

# Close all input and output, do double fork, etc.

3161

2501

daemon()

3162

3163

if gi.version_info < (3, 10, 2):

3164

# multiprocessing will use threads, so before we use GLib we

3165

# need to inform GLib that threads will be used.

3166

GLib.threads_init()

3167

2502

2503

# multiprocessing will use threads, so before we use gobject we

2504

# need to inform gobject that threads will be used.

2505

gobject.threads_init()

2506

3168

2507

global main_loop

3169

2508

# From the Avahi example code

3170

2509

DBusGMainLoop(set_as_default=True)

3171

main_loop = GLib.MainLoop()

2510

main_loop = gobject.MainLoop()

3172

2511

bus = dbus.SystemBus()

3173

2512

# End of Avahi example code

3174

2513

if use_dbus:

3175

2514

try:

3176

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

3177

bus,

3178

do_not_queue=True)

3179

old_bus_name = dbus.service.BusName(

3180

"se.bsnet.fukt.Mandos", bus,

3181

do_not_queue=True)

3182

except dbus.exceptions.DBusException as e:

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

3183

2521

logger.error("Disabling D-Bus:", exc_info=e)

3184

2522

use_dbus = False

3185

2523

server_settings["use_dbus"] = False

3186

2524

tcp_server.use_dbus = False

3187

if zeroconf:

3188

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3189

service = AvahiServiceToSyslog(

3190

name=server_settings["servicename"],

3191

servicetype="_mandos._tcp",

3192

protocol=protocol,

3193

bus=bus)

3194

if server_settings["interface"]:

3195

service.interface = if_nametoindex(

3196

server_settings["interface"].encode("utf-8"))

3197

2525

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2526

service = AvahiServiceToSyslog(name =

2527

server_settings["servicename"],

2528

servicetype = "_mandos._tcp",

2529

protocol = protocol, bus = bus)

2530

if server_settings["interface"]:

2531

service.interface = (if_nametoindex

2532

(str(server_settings["interface"])))

2533

3198

2534

global multiprocessing_manager

3199

2535

multiprocessing_manager = multiprocessing.Manager()

3200

2536

3201

2537

client_class = Client

3202

2538

if use_dbus:

3203

client_class = functools.partial(ClientDBus, bus=bus)

3204

2539

client_class = functools.partial(ClientDBus, bus = bus)

2540

3205

2541

client_settings = Client.config_parser(client_config)

3206

2542

old_client_settings = {}

3207

2543

clients_data = {}

3208

2544

3209

2545

# This is used to redirect stdout and stderr for checker processes

3210

2546

global wnull

3211

wnull = open(os.devnull, "w") # A writable /dev/null

2547

wnull = open(os.devnull, "w") # A writable /dev/null

3212

2548

# Only used if server is running in foreground but not in debug

3213

2549

# mode

3214

2550

if debug or not foreground:

3215

2551

wnull.close()

3216

2552

3217

2553

# Get client data and settings from last running state.

3218

2554

if server_settings["restore"]:

3219

2555

try:

3220

2556

with open(stored_state_path, "rb") as stored_state:

3221

if sys.version_info.major == 2:

3222

clients_data, old_client_settings = pickle.load(

3223

stored_state)

3224

else:

3225

bytes_clients_data, bytes_old_client_settings = (

3226

pickle.load(stored_state, encoding="bytes"))

3227

# Fix bytes to strings

3228

# clients_data

3229

# .keys()

3230

clients_data = {(key.decode("utf-8")

3231

if isinstance(key, bytes)

3232

else key): value

3233

for key, value in

3234

bytes_clients_data.items()}

3235

del bytes_clients_data

3236

for key in clients_data:

3237

value = {(k.decode("utf-8")

3238

if isinstance(k, bytes) else k): v

3239

for k, v in

3240

clients_data[key].items()}

3241

clients_data[key] = value

3242

# .client_structure

3243

value["client_structure"] = [

3244

(s.decode("utf-8")

3245

if isinstance(s, bytes)

3246

else s) for s in

3247

value["client_structure"]]

3248

# .name & .host

3249

for k in ("name", "host"):

3250

if isinstance(value[k], bytes):

3251

value[k] = value[k].decode("utf-8")

3252

if "key_id" not in value:

3253

value["key_id"] = ""

3254

elif "fingerprint" not in value:

3255

value["fingerprint"] = ""

3256

# old_client_settings

3257

# .keys()

3258

old_client_settings = {

3259

(key.decode("utf-8")

3260

if isinstance(key, bytes)

3261

else key): value

3262

for key, value in

3263

bytes_old_client_settings.items()}

3264

del bytes_old_client_settings

3265

# .host

3266

for value in old_client_settings.values():

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

2557

clients_data, old_client_settings = (pickle.load

2558

(stored_state))

3270

2559

os.remove(stored_state_path)

3271

2560

except IOError as e:

3272

2561

if e.errno == errno.ENOENT:

3273

logger.warning("Could not load persistent state:"

3274

" {}".format(os.strerror(e.errno)))

2562

logger.warning("Could not load persistent state: {0}"

2563

.format(os.strerror(e.errno)))

3275

2564

else:

3276

2565

logger.critical("Could not load persistent state:",

3277

2566

exc_info=e)

3278

2567

raise

3279

2568

except EOFError as e:

3280

2569

logger.warning("Could not load persistent state: "

3281

"EOFError:",

3282

exc_info=e)

3283

2570

"EOFError:", exc_info=e)

2571

3284

2572

with PGPEngine() as pgp:

3285

for client_name, client in clients_data.items():

2573

for client_name, client in clients_data.iteritems():

3286

2574

# Skip removed clients

3287

2575

if client_name not in client_settings:

3288

2576

continue

3289

2577

3290

2578

# Decide which value to use after restoring saved state.

3291

2579

# We have three different values: Old config file,

3292

2580

# new config file, and saved state.

3297

2585

# For each value in new config, check if it

3298

2586

# differs from the old config value (Except for

3299

2587

# the "secret" attribute)

3300

if (name != "secret"

3301

and (value !=

3302

old_client_settings[client_name][name])):

2588

if (name != "secret" and

2589

value != old_client_settings[client_name]

2590

[name]):

3303

2591

client[name] = value

3304

2592

except KeyError:

3305

2593

pass

3306

2594

3307

2595

# Clients who has passed its expire date can still be

3308

# enabled if its last checker was successful. A Client

2596

# enabled if its last checker was successful. Clients

3309

2597

# whose checker succeeded before we stored its state is

3310

2598

# assumed to have successfully run all checkers during

3311

2599

# downtime.

3313

2601

if datetime.datetime.utcnow() >= client["expires"]:

3314

2602

if not client["last_checked_ok"]:

3315

2603

logger.warning(

3316

"disabling client {} - Client never "

3317

"performed a successful checker".format(

3318

client_name))

2604

"disabling client {0} - Client never "

2605

"performed a successful checker"

2606

.format(client_name))

3319

2607

client["enabled"] = False

3320

2608

elif client["last_checker_status"] != 0:

3321

2609

logger.warning(

3322

"disabling client {} - Client last"

3323

" checker failed with error code"

3324

" {}".format(

3325

client_name,

3326

client["last_checker_status"]))

2610

"disabling client {0} - Client "

2611

"last checker failed with error code {1}"

2612

.format(client_name,

2613

client["last_checker_status"]))

3327

2614

client["enabled"] = False

3328

2615

else:

3329

client["expires"] = (

3330

datetime.datetime.utcnow()

3331

+ client["timeout"])

2616

client["expires"] = (datetime.datetime

2617

.utcnow()

2618

+ client["timeout"])

3332

2619

logger.debug("Last checker succeeded,"

3333

" keeping {} enabled".format(

3334

client_name))

2620

" keeping {0} enabled"

2621

.format(client_name))

3335

2622

try:

3336

client["secret"] = pgp.decrypt(

3337

client["encrypted_secret"],

3338

client_settings[client_name]["secret"])

2623

client["secret"] = (

2624

pgp.decrypt(client["encrypted_secret"],

2625

client_settings[client_name]

2626

["secret"]))

3339

2627

except PGPError:

3340

2628

# If decryption fails, we use secret from new settings

3341

logger.debug("Failed to decrypt {} old secret".format(

3342

client_name))

3343

client["secret"] = (client_settings[client_name]

3344

["secret"])

3345

2629

logger.debug("Failed to decrypt {0} old secret"

2630

.format(client_name))

2631

client["secret"] = (

2632

client_settings[client_name]["secret"])

2633

3346

2634

# Add/remove clients based on new changes made to config

3347

2635

for client_name in (set(old_client_settings)

3348

2636

- set(client_settings)):

3350

2638

for client_name in (set(client_settings)

3351

2639

- set(old_client_settings)):

3352

2640

clients_data[client_name] = client_settings[client_name]

3353

2641

3354

2642

# Create all client objects

3355

for client_name, client in clients_data.items():

2643

for client_name, client in clients_data.iteritems():

3356

2644

tcp_server.clients[client_name] = client_class(

3357

name=client_name,

3358

settings=client,

3359

server_settings=server_settings)

3360

2645

name = client_name, settings = client,

2646

server_settings = server_settings)

2647

3361

2648

if not tcp_server.clients:

3362

2649

logger.warning("No clients defined")

3363

2650

3364

2651

if not foreground:

3365

2652

if pidfile is not None:

3366

pid = os.getpid()

3367

2653

try:

3368

2654

with pidfile:

3369

print(pid, file=pidfile)

2655

pid = os.getpid()

2656

pidfile.write(str(pid) + "\n".encode("utf-8"))

3370

2657

except IOError:

3371

2658

logger.error("Could not write to file %r with PID %d",

3372

2659

pidfilename, pid)

3373

2660

del pidfile

3374

2661

del pidfilename

3375

3376

for termsig in (signal.SIGHUP, signal.SIGTERM):

3377

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3378

lambda: main_loop.quit() and False)

3379

2662

2663

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2664

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2665

3380

2666

if use_dbus:

3381

3382

@alternate_dbus_interfaces(

3383

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3384

class MandosDBusService(DBusObjectWithObjectManager):

2667

@alternate_dbus_interfaces({"se.recompile.Mandos":

2668

"se.bsnet.fukt.Mandos"})

2669

class MandosDBusService(DBusObjectWithProperties):

3385

2670

"""A D-Bus proxy object"""

3386

3387

2671

def __init__(self):

3388

2672

dbus.service.Object.__init__(self, bus, "/")

3389

3390

2673

_interface = "se.recompile.Mandos"

3391

2674

2675

@dbus_interface_annotations(_interface)

2676

def _foo(self):

2677

return { "org.freedesktop.DBus.Property"

2678

".EmitsChangedSignal":

2679

"false"}

2680

3392

2681

@dbus.service.signal(_interface, signature="o")

3393

2682

def ClientAdded(self, objpath):

3394

2683

"D-Bus signal"

3395

2684

pass

3396

2685

3397

2686

@dbus.service.signal(_interface, signature="ss")

3398

def ClientNotFound(self, key_id, address):

2687

def ClientNotFound(self, fingerprint, address):

3399

2688

"D-Bus signal"

3400

2689

pass

3401

3402

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3403

"true"})

2690

3404

2691

@dbus.service.signal(_interface, signature="os")

3405

2692

def ClientRemoved(self, objpath, name):

3406

2693

"D-Bus signal"

3407

2694

pass

3408

3409

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3410

"true"})

2695

3411

2696

@dbus.service.method(_interface, out_signature="ao")

3412

2697

def GetAllClients(self):

3413

2698

"D-Bus method"

3414

return dbus.Array(c.dbus_object_path for c in

3415

tcp_server.clients.values())

3416

3417

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3418

"true"})

2699

return dbus.Array(c.dbus_object_path

2700

for c in

2701

tcp_server.clients.itervalues())

2702

3419

2703

@dbus.service.method(_interface,

3420

2704

out_signature="a{oa{sv}}")

3421

2705

def GetAllClientsWithProperties(self):

3422

2706

"D-Bus method"

3423

2707

return dbus.Dictionary(

3424

{c.dbus_object_path: c.GetAll(

3425

"se.recompile.Mandos.Client")

3426

for c in tcp_server.clients.values()},

2708

((c.dbus_object_path, c.GetAll(""))

2709

for c in tcp_server.clients.itervalues()),

3427

2710

signature="oa{sv}")

3428

2711

3429

2712

@dbus.service.method(_interface, in_signature="o")

3430

2713

def RemoveClient(self, object_path):

3431

2714

"D-Bus method"

3432

for c in tcp_server.clients.values():

2715

for c in tcp_server.clients.itervalues():

3433

2716

if c.dbus_object_path == object_path:

3434

2717

del tcp_server.clients[c.name]

3435

2718

c.remove_from_connection()

3436

# Don't signal the disabling

2719

# Don't signal anything except ClientRemoved

3437

2720

c.disable(quiet=True)

3438

# Emit D-Bus signal for removal

3439

self.client_removed_signal(c)

2721

# Emit D-Bus signal

2722

self.ClientRemoved(object_path, c.name)

3440

2723

return

3441

2724

raise KeyError(object_path)

3442

2725

3443

2726

del _interface

3444

3445

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3446

out_signature="a{oa{sa{sv}}}")

3447

def GetManagedObjects(self):

3448

"""D-Bus method"""

3449

return dbus.Dictionary(

3450

{client.dbus_object_path:

3451

dbus.Dictionary(

3452

{interface: client.GetAll(interface)

3453

for interface in

3454

client._get_all_interface_names()})

3455

for client in tcp_server.clients.values()})

3456

3457

def client_added_signal(self, client):

3458

"""Send the new standard signal and the old signal"""

3459

if use_dbus:

3460

# New standard signal

3461

self.InterfacesAdded(

3462

client.dbus_object_path,

3463

dbus.Dictionary(

3464

{interface: client.GetAll(interface)

3465

for interface in

3466

client._get_all_interface_names()}))

3467

# Old signal

3468

self.ClientAdded(client.dbus_object_path)

3469

3470

def client_removed_signal(self, client):

3471

"""Send the new standard signal and the old signal"""

3472

if use_dbus:

3473

# New standard signal

3474

self.InterfacesRemoved(

3475

client.dbus_object_path,

3476

client._get_all_interface_names())

3477

# Old signal

3478

self.ClientRemoved(client.dbus_object_path,

3479

client.name)

3480

2727

3481

2728

mandos_dbus_service = MandosDBusService()

3482

3483

# Save modules to variables to exempt the modules from being

3484

# unloaded before the function registered with atexit() is run.

3485

mp = multiprocessing

3486

wn = wnull

3487

2729

3488

2730

def cleanup():

3489

2731

"Cleanup function; run on exit"

3490

if zeroconf:

3491

service.cleanup()

3492

3493

mp.active_children()

3494

wn.close()

2732

service.cleanup()

2733

2734

multiprocessing.active_children()

2735

wnull.close()

3495

2736

if not (tcp_server.clients or client_settings):

3496

2737

return

3497

2738

3498

2739

# Store client before exiting. Secrets are encrypted with key

3499

2740

# based on what config file has. If config file is

3500

2741

# removed/edited, old secret will thus be unrecovable.

3501

2742

clients = {}

3502

2743

with PGPEngine() as pgp:

3503

for client in tcp_server.clients.values():

2744

for client in tcp_server.clients.itervalues():

3504

2745

key = client_settings[client.name]["secret"]

3505

2746

client.encrypted_secret = pgp.encrypt(client.secret,

3506

2747

key)

3507

2748

client_dict = {}

3508

2749

3509

2750

# A list of attributes that can not be pickled

3510

2751

# + secret.

3511

exclude = {"bus", "changedstate", "secret",

3512

"checker", "server_settings"}

3513

for name, typ in inspect.getmembers(dbus.service

3514

.Object):

2752

exclude = set(("bus", "changedstate", "secret",

2753

"checker", "server_settings"))

2754

for name, typ in (inspect.getmembers

2755

(dbus.service.Object)):

3515

2756

exclude.add(name)

3516

2757

3517

2758

client_dict["encrypted_secret"] = (client

3518

2759

.encrypted_secret)

3519

2760

for attr in client.client_structure:

3520

2761

if attr not in exclude:

3521

2762

client_dict[attr] = getattr(client, attr)

3522

2763

3523

2764

clients[client.name] = client_dict

3524

2765

del client_settings[client.name]["secret"]

3525

2766

3526

2767

try:

3527

with tempfile.NamedTemporaryFile(

3528

mode='wb',

3529

suffix=".pickle",

3530

prefix='clients-',

3531

dir=os.path.dirname(stored_state_path),

3532

delete=False) as stored_state:

3533

pickle.dump((clients, client_settings), stored_state,

3534

protocol=2)

3535

tempname = stored_state.name

2768

with (tempfile.NamedTemporaryFile

2769

(mode='wb', suffix=".pickle", prefix='clients-',

2770

dir=os.path.dirname(stored_state_path),

2771

delete=False)) as stored_state:

2772

pickle.dump((clients, client_settings), stored_state)

2773

tempname=stored_state.name

3536

2774

os.rename(tempname, stored_state_path)

3537

2775

except (IOError, OSError) as e:

3538

2776

if not debug:

3541

2779

except NameError:

3542

2780

pass

3543

2781

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3544

logger.warning("Could not save persistent state: {}"

2782

logger.warning("Could not save persistent state: {0}"

3545

2783

.format(os.strerror(e.errno)))

3546

2784

else:

3547

2785

logger.warning("Could not save persistent state:",

3548

2786

exc_info=e)

3549

raise

3550

2787

raise e

2788

3551

2789

# Delete all clients, and settings from config

3552

2790

while tcp_server.clients:

3553

2791

name, client = tcp_server.clients.popitem()

3554

2792

if use_dbus:

3555

2793

client.remove_from_connection()

3556

# Don't signal the disabling

2794

# Don't signal anything except ClientRemoved

3557

2795

client.disable(quiet=True)

3558

# Emit D-Bus signal for removal

3559

2796

if use_dbus:

3560

mandos_dbus_service.client_removed_signal(client)

2797

# Emit D-Bus signal

2798

mandos_dbus_service.ClientRemoved(client

2799

.dbus_object_path,

2800

client.name)

3561

2801

client_settings.clear()

3562

2802

3563

2803

atexit.register(cleanup)

3564

3565

for client in tcp_server.clients.values():

2804

2805

for client in tcp_server.clients.itervalues():

3566

2806

if use_dbus:

3567

# Emit D-Bus signal for adding

3568

mandos_dbus_service.client_added_signal(client)

2807

# Emit D-Bus signal

2808

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3569

2809

# Need to initiate checking of clients

3570

2810

if client.enabled:

3571

2811

client.init_checker()

3572

2812

3573

2813

tcp_server.enable()

3574

2814

tcp_server.server_activate()

3575

2815

3576

2816

# Find out what port we got

3577

if zeroconf:

3578

service.port = tcp_server.socket.getsockname()[1]

2817

service.port = tcp_server.socket.getsockname()[1]

3579

2818

if use_ipv6:

3580

2819

logger.info("Now listening on address %r, port %d,"

3581

2820

" flowinfo %d, scope_id %d",

3583

2822

else: # IPv4

3584

2823

logger.info("Now listening on address %r, port %d",

3585

2824

*tcp_server.socket.getsockname())

3586

3587

# service.interface = tcp_server.socket.getsockname()[3]

3588

2825

2826

#service.interface = tcp_server.socket.getsockname()[3]

2827

3589

2828

try:

3590

if zeroconf:

3591

# From the Avahi example code

3592

try:

3593

service.activate()

3594

except dbus.exceptions.DBusException as error:

3595

logger.critical("D-Bus Exception", exc_info=error)

3596

cleanup()

3597

sys.exit(1)

3598

# End of Avahi example code

3599

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3604

2829

# From the Avahi example code

2830

try:

2831

service.activate()

2832

except dbus.exceptions.DBusException as error:

2833

logger.critical("D-Bus Exception", exc_info=error)

2834

cleanup()

2835

sys.exit(1)

2836

# End of Avahi example code

2837

2838

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2839

lambda *args, **kwargs:

2840

(tcp_server.handle_request

2841

(*args[2:], **kwargs) or True))

2842

3605

2843

logger.debug("Starting main loop")

3606

2844

main_loop.run()

3607

2845

except AvahiError as error:

3616

2854

# Must run before the D-Bus bus name gets deregistered

3617

2855

cleanup()

3618

2856

3619

3620

2857

if __name__ == '__main__':

3621

2858

main()