/mandos/release : revision 237.7.174

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

72

84

73

import dbus

85

74

import dbus.service

86

import gi

87

from gi.repository import GLib

75

import gobject

76

import avahi

88

77

from dbus.mainloop.glib import DBusGMainLoop

89

78

import ctypes

90

79

import ctypes.util

91

80

import xml.dom.minidom

92

81

import inspect

93

82

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

83

try:

122

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

85

except AttributeError:

124

86

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

87

from IN import SO_BINDTODEVICE

128

88

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.12"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.1"

147

92

stored_state_file = "clients.pickle"

148

93

149

94

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

152

98

153

99

try:

154

if_nametoindex = ctypes.cdll.LoadLibrary(

155

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

156

103

except (OSError, AttributeError):

157

158

104

def if_nametoindex(interface):

159

105

"Get an interface index the hard way, i.e. using fcntl()"

160

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

161

107

with contextlib.closing(socket.socket()) as s:

162

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

163

struct.pack(b"16s16x", interface))

164

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

165

113

return interface_index

166

114

167

115

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

116

def initlogger(debug, level=logging.WARNING):

185

117

"""init logger and add loglevel"""

186

187

global syslogger

188

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

118

191

119

syslogger.setFormatter(logging.Formatter

192

120

('Mandos [%(process)d]: %(levelname)s:'

193

121

' %(message)s'))

194

122

logger.addHandler(syslogger)

195

123

196

124

if debug:

197

125

console = logging.StreamHandler()

198

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

208

136

pass

209

137

210

138

211

class PGPEngine:

139

class PGPEngine(object):

212

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

214

141

def __init__(self):

215

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

143

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

144

'--home', self.tempdir,

229

145

'--force-mdc',

230

'--quiet']

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

146

'--quiet',

147

'--no-use-agent']

148

235

149

def __enter__(self):

236

150

return self

237

151

238

152

def __exit__(self, exc_type, exc_value, traceback):

239

153

self._cleanup()

240

154

return False

241

155

242

156

def __del__(self):

243

157

self._cleanup()

244

158

245

159

def _cleanup(self):

246

160

if self.tempdir is not None:

247

161

# Delete contents of tempdir

248

162

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

163

topdown = False):

250

164

for filename in files:

251

165

os.remove(os.path.join(root, filename))

252

166

for dirname in dirs:

254

168

# Remove tempdir

255

169

os.rmdir(self.tempdir)

256

170

self.tempdir = None

257

171

258

172

def password_encode(self, password):

259

173

# Passphrase can not be empty and can not contain newlines or

260

174

# NUL bytes. So we prefix it and hex encode it.

261

encoded = b"mandos" + binascii.hexlify(password)

262

if len(encoded) > 2048:

263

# GnuPG can't handle long passwords, so encode differently

264

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

265

.replace(b"\n", b"\\n")

266

.replace(b"\0", b"\\x00"))

267

return encoded

268

175

return b"mandos" + binascii.hexlify(password)

176

269

177

def encrypt(self, data, password):

270

178

passphrase = self.password_encode(password)

271

with tempfile.NamedTemporaryFile(

272

dir=self.tempdir) as passfile:

179

with tempfile.NamedTemporaryFile(dir=self.tempdir

180

) as passfile:

273

181

passfile.write(passphrase)

274

182

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

183

proc = subprocess.Popen(['gpg', '--symmetric',

276

184

'--passphrase-file',

277

185

passfile.name]

278

186

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

187

stdin = subprocess.PIPE,

188

stdout = subprocess.PIPE,

189

stderr = subprocess.PIPE)

190

ciphertext, err = proc.communicate(input = data)

283

191

if proc.returncode != 0:

284

192

raise PGPError(err)

285

193

return ciphertext

286

194

287

195

def decrypt(self, data, password):

288

196

passphrase = self.password_encode(password)

289

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

197

with tempfile.NamedTemporaryFile(dir = self.tempdir

198

) as passfile:

291

199

passfile.write(passphrase)

292

200

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

201

proc = subprocess.Popen(['gpg', '--decrypt',

294

202

'--passphrase-file',

295

203

passfile.name]

296

204

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

205

stdin = subprocess.PIPE,

206

stdout = subprocess.PIPE,

207

stderr = subprocess.PIPE)

208

decrypted_plaintext, err = proc.communicate(input

209

= data)

301

210

if proc.returncode != 0:

302

211

raise PGPError(err)

303

212

return decrypted_plaintext

304

213

305

214

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

215

class AvahiError(Exception):

333

216

def __init__(self, value, *args, **kwargs):

334

217

self.value = value

335

return super(AvahiError, self).__init__(value, *args,

336

**kwargs)

337

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

338

221

339

222

class AvahiServiceError(AvahiError):

340

223

pass

341

224

342

343

225

class AvahiGroupError(AvahiError):

344

226

pass

345

227

346

228

347

class AvahiService:

229

class AvahiService(object):

348

230

"""An Avahi (Zeroconf) service.

349

231

350

232

Attributes:

351

233

interface: integer; avahi.IF_UNSPEC or an interface index.

352

234

Used to optionally bind to the specified interface.

364

246

server: D-Bus Server

365

247

bus: dbus.SystemBus()

366

248

"""

367

368

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

249

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

379

254

self.interface = interface

380

255

self.name = name

381

256

self.type = servicetype

390

265

self.server = None

391

266

self.bus = bus

392

267

self.entry_group_state_changed_match = None

393

394

def rename(self, remove=True):

268

269

def rename(self):

395

270

"""Derived from the Avahi example code"""

396

271

if self.rename_count >= self.max_renames:

397

272

logger.critical("No suitable Zeroconf service name found"

398

273

" after %i retries, exiting.",

399

274

self.rename_count)

400

275

raise AvahiServiceError("Too many renames")

401

self.name = str(

402

self.server.GetAlternativeServiceName(self.name))

403

self.rename_count += 1

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

404

278

logger.info("Changing Zeroconf service name to %r ...",

405

279

self.name)

406

if remove:

407

self.remove()

280

self.remove()

408

281

try:

409

282

self.add()

410

283

except dbus.exceptions.DBusException as error:

411

if (error.get_dbus_name()

412

== "org.freedesktop.Avahi.CollisionError"):

413

logger.info("Local Zeroconf service name collision.")

414

return self.rename(remove=False)

415

else:

416

logger.critical("D-Bus Exception", exc_info=error)

417

self.cleanup()

418

os._exit(1)

419

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

287

self.rename_count += 1

288

420

289

def remove(self):

421

290

"""Derived from the Avahi example code"""

422

291

if self.entry_group_state_changed_match is not None:

424

293

self.entry_group_state_changed_match = None

425

294

if self.group is not None:

426

295

self.group.Reset()

427

296

428

297

def add(self):

429

298

"""Derived from the Avahi example code"""

430

299

self.remove()

447

316

dbus.UInt16(self.port),

448

317

avahi.string_array_to_txt_array(self.TXT))

449

318

self.group.Commit()

450

319

451

320

def entry_group_state_changed(self, state, error):

452

321

"""Derived from the Avahi example code"""

453

322

logger.debug("Avahi entry group state change: %i", state)

454

323

455

324

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

325

logger.debug("Zeroconf service established.")

457

326

elif state == avahi.ENTRY_GROUP_COLLISION:

459

328

self.rename()

460

329

elif state == avahi.ENTRY_GROUP_FAILURE:

461

330

logger.critical("Avahi: Error in group state changed %s",

462

str(error))

463

raise AvahiGroupError("State changed: {!s}".format(error))

464

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

334

465

335

def cleanup(self):

466

336

"""Derived from the Avahi example code"""

467

337

if self.group is not None:

472

342

pass

473

343

self.group = None

474

344

self.remove()

475

345

476

346

def server_state_changed(self, state, error=None):

477

347

"""Derived from the Avahi example code"""

478

348

logger.debug("Avahi server state change: %i", state)

479

bad_states = {

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

avahi.SERVER_REGISTERING: None,

482

avahi.SERVER_COLLISION: "Zeroconf server name collision",

483

avahi.SERVER_FAILURE: "Zeroconf server failure",

484

}

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

485

356

if state in bad_states:

486

357

if bad_states[state] is not None:

487

358

if error is None:

490

361

logger.error(bad_states[state] + ": %r", error)

491

362

self.cleanup()

492

363

elif state == avahi.SERVER_RUNNING:

493

try:

494

self.add()

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

logger.info("Local Zeroconf service name"

499

" collision.")

500

return self.rename(remove=False)

501

else:

502

logger.critical("D-Bus Exception", exc_info=error)

503

self.cleanup()

504

os._exit(1)

364

self.add()

505

365

else:

506

366

if error is None:

507

367

logger.debug("Unknown state: %r", state)

508

368

else:

509

369

logger.debug("Unknown state: %r: %r", state, error)

510

370

511

371

def activate(self):

512

372

"""Derived from the Avahi example code"""

513

373

if self.server is None:

517

377

follow_name_owner_changes=True),

518

378

avahi.DBUS_INTERFACE_SERVER)

519

379

self.server.connect_to_signal("StateChanged",

520

self.server_state_changed)

380

self.server_state_changed)

521

381

self.server_state_changed(self.server.GetState())

522

382

523

383

524

384

class AvahiServiceToSyslog(AvahiService):

525

def rename(self, *args, **kwargs):

385

def rename(self):

526

386

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

529

syslogger.setFormatter(logging.Formatter(

530

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

.format(self.name)))

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

532

392

return ret

533

393

534

394

535

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

538

539

library = ctypes.util.find_library("gnutls")

540

if library is None:

541

library = ctypes.util.find_library("gnutls-deb0")

542

_library = ctypes.cdll.LoadLibrary(library)

543

del library

544

545

# Unless otherwise indicated, the constants and types below are

546

# all from the gnutls/gnutls.h C header file.

547

548

# Constants

549

E_SUCCESS = 0

550

E_INTERRUPTED = -52

551

E_AGAIN = -28

552

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

CLIENT = 2

555

SHUT_RDWR = 0

556

CRD_CERTIFICATE = 1

557

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

565

# Types

566

class session_int(ctypes.Structure):

567

_fields_ = []

568

session_t = ctypes.POINTER(session_int)

569

570

class certificate_credentials_st(ctypes.Structure):

571

_fields_ = []

572

certificate_credentials_t = ctypes.POINTER(

573

certificate_credentials_st)

574

certificate_type_t = ctypes.c_int

575

576

class datum_t(ctypes.Structure):

577

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

578

('size', ctypes.c_uint)]

579

580

class openpgp_crt_int(ctypes.Structure):

581

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

credentials_type_t = ctypes.c_int

586

transport_ptr_t = ctypes.c_void_p

587

close_request_t = ctypes.c_int

588

589

# Exceptions

590

class Error(Exception):

591

def __init__(self, message=None, code=None, args=()):

592

# Default usage is by a message string, but if a return

593

# code is passed, convert it to a string with

594

# gnutls.strerror()

595

self.code = code

596

if message is None and code is not None:

597

message = gnutls.strerror(code)

598

return super(gnutls.Error, self).__init__(

599

message, *args)

600

601

class CertificateSecurityError(Error):

602

pass

603

604

# Classes

605

class Credentials:

606

def __init__(self):

607

self._c_object = gnutls.certificate_credentials_t()

608

gnutls.certificate_allocate_credentials(

609

ctypes.byref(self._c_object))

610

self.type = gnutls.CRD_CERTIFICATE

611

612

def __del__(self):

613

gnutls.certificate_free_credentials(self._c_object)

614

615

class ClientSession:

616

def __init__(self, socket, credentials=None):

617

self._c_object = gnutls.session_t()

618

gnutls_flags = gnutls.CLIENT

619

if gnutls.check_version(b"3.5.6"):

620

gnutls_flags |= gnutls.NO_TICKETS

621

if gnutls.has_rawpk:

622

gnutls_flags |= gnutls.ENABLE_RAWPK

623

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

624

del gnutls_flags

625

gnutls.set_default_priority(self._c_object)

626

gnutls.transport_set_ptr(self._c_object, socket.fileno())

627

gnutls.handshake_set_private_extensions(self._c_object,

628

True)

629

self.socket = socket

630

if credentials is None:

631

credentials = gnutls.Credentials()

632

gnutls.credentials_set(self._c_object, credentials.type,

633

ctypes.cast(credentials._c_object,

634

ctypes.c_void_p))

635

self.credentials = credentials

636

637

def __del__(self):

638

gnutls.deinit(self._c_object)

639

640

def handshake(self):

641

return gnutls.handshake(self._c_object)

642

643

def send(self, data):

644

data = bytes(data)

645

data_len = len(data)

646

while data_len > 0:

647

data_len -= gnutls.record_send(self._c_object,

648

data[-data_len:],

649

data_len)

650

651

def bye(self):

652

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

653

654

# Error handling functions

655

def _error_code(result):

656

"""A function to raise exceptions on errors, suitable

657

for the 'restype' attribute on ctypes functions"""

658

if result >= 0:

659

return result

660

if result == gnutls.E_NO_CERTIFICATE_FOUND:

661

raise gnutls.CertificateSecurityError(code=result)

662

raise gnutls.Error(code=result)

663

664

def _retry_on_error(result, func, arguments):

665

"""A function to retry on some errors, suitable

666

for the 'errcheck' attribute on ctypes functions"""

667

while result < 0:

668

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

669

return _error_code(result)

670

result = func(*arguments)

671

return result

672

673

# Unless otherwise indicated, the function declarations below are

674

# all from the gnutls/gnutls.h C header file.

675

676

# Functions

677

priority_set_direct = _library.gnutls_priority_set_direct

678

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

679

ctypes.POINTER(ctypes.c_char_p)]

680

priority_set_direct.restype = _error_code

681

682

init = _library.gnutls_init

683

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

684

init.restype = _error_code

685

686

set_default_priority = _library.gnutls_set_default_priority

687

set_default_priority.argtypes = [session_t]

688

set_default_priority.restype = _error_code

689

690

record_send = _library.gnutls_record_send

691

record_send.argtypes = [session_t, ctypes.c_void_p,

692

ctypes.c_size_t]

693

record_send.restype = ctypes.c_ssize_t

694

record_send.errcheck = _retry_on_error

695

696

certificate_allocate_credentials = (

697

_library.gnutls_certificate_allocate_credentials)

698

certificate_allocate_credentials.argtypes = [

699

ctypes.POINTER(certificate_credentials_t)]

700

certificate_allocate_credentials.restype = _error_code

701

702

certificate_free_credentials = (

703

_library.gnutls_certificate_free_credentials)

704

certificate_free_credentials.argtypes = [

705

certificate_credentials_t]

706

certificate_free_credentials.restype = None

707

708

handshake_set_private_extensions = (

709

_library.gnutls_handshake_set_private_extensions)

710

handshake_set_private_extensions.argtypes = [session_t,

711

ctypes.c_int]

712

handshake_set_private_extensions.restype = None

713

714

credentials_set = _library.gnutls_credentials_set

715

credentials_set.argtypes = [session_t, credentials_type_t,

716

ctypes.c_void_p]

717

credentials_set.restype = _error_code

718

719

strerror = _library.gnutls_strerror

720

strerror.argtypes = [ctypes.c_int]

721

strerror.restype = ctypes.c_char_p

722

723

certificate_type_get = _library.gnutls_certificate_type_get

724

certificate_type_get.argtypes = [session_t]

725

certificate_type_get.restype = _error_code

726

727

certificate_get_peers = _library.gnutls_certificate_get_peers

728

certificate_get_peers.argtypes = [session_t,

729

ctypes.POINTER(ctypes.c_uint)]

730

certificate_get_peers.restype = ctypes.POINTER(datum_t)

731

732

global_set_log_level = _library.gnutls_global_set_log_level

733

global_set_log_level.argtypes = [ctypes.c_int]

734

global_set_log_level.restype = None

735

736

global_set_log_function = _library.gnutls_global_set_log_function

737

global_set_log_function.argtypes = [log_func]

738

global_set_log_function.restype = None

739

740

deinit = _library.gnutls_deinit

741

deinit.argtypes = [session_t]

742

deinit.restype = None

743

744

handshake = _library.gnutls_handshake

745

handshake.argtypes = [session_t]

746

handshake.restype = _error_code

747

handshake.errcheck = _retry_on_error

748

749

transport_set_ptr = _library.gnutls_transport_set_ptr

750

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

751

transport_set_ptr.restype = None

752

753

bye = _library.gnutls_bye

754

bye.argtypes = [session_t, close_request_t]

755

bye.restype = _error_code

756

bye.errcheck = _retry_on_error

757

758

check_version = _library.gnutls_check_version

759

check_version.argtypes = [ctypes.c_char_p]

760

check_version.restype = ctypes.c_char_p

761

762

_need_version = b"3.3.0"

763

if check_version(_need_version) is None:

764

raise self.Error("Needs GnuTLS {} or later"

765

.format(_need_version))

766

767

_tls_rawpk_version = b"3.6.6"

768

has_rawpk = bool(check_version(_tls_rawpk_version))

769

770

if has_rawpk:

771

# Types

772

class pubkey_st(ctypes.Structure):

773

_fields = []

774

pubkey_t = ctypes.POINTER(pubkey_st)

775

776

x509_crt_fmt_t = ctypes.c_int

777

778

# All the function declarations below are from

779

# gnutls/abstract.h

780

pubkey_init = _library.gnutls_pubkey_init

781

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

782

pubkey_init.restype = _error_code

783

784

pubkey_import = _library.gnutls_pubkey_import

785

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

786

x509_crt_fmt_t]

787

pubkey_import.restype = _error_code

788

789

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

790

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

791

ctypes.POINTER(ctypes.c_ubyte),

792

ctypes.POINTER(ctypes.c_size_t)]

793

pubkey_get_key_id.restype = _error_code

794

795

pubkey_deinit = _library.gnutls_pubkey_deinit

796

pubkey_deinit.argtypes = [pubkey_t]

797

pubkey_deinit.restype = None

798

else:

799

# All the function declarations below are from

800

# gnutls/openpgp.h

801

802

openpgp_crt_init = _library.gnutls_openpgp_crt_init

803

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

804

openpgp_crt_init.restype = _error_code

805

806

openpgp_crt_import = _library.gnutls_openpgp_crt_import

807

openpgp_crt_import.argtypes = [openpgp_crt_t,

808

ctypes.POINTER(datum_t),

809

openpgp_crt_fmt_t]

810

openpgp_crt_import.restype = _error_code

811

812

openpgp_crt_verify_self = \

813

_library.gnutls_openpgp_crt_verify_self

814

openpgp_crt_verify_self.argtypes = [

815

openpgp_crt_t,

816

ctypes.c_uint,

817

ctypes.POINTER(ctypes.c_uint),

818

]

819

openpgp_crt_verify_self.restype = _error_code

820

821

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

822

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

823

openpgp_crt_deinit.restype = None

824

825

openpgp_crt_get_fingerprint = (

826

_library.gnutls_openpgp_crt_get_fingerprint)

827

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

828

ctypes.c_void_p,

829

ctypes.POINTER(

830

ctypes.c_size_t)]

831

openpgp_crt_get_fingerprint.restype = _error_code

832

833

if check_version(b"3.6.4"):

834

certificate_type_get2 = _library.gnutls_certificate_type_get2

835

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

836

certificate_type_get2.restype = _error_code

837

838

# Remove non-public functions

839

del _error_code, _retry_on_error

840

841

842

def call_pipe(connection, # : multiprocessing.Connection

843

func, *args, **kwargs):

844

"""This function is meant to be called by multiprocessing.Process

845

846

This function runs func(*args, **kwargs), and writes the resulting

847

return value on the provided multiprocessing.Connection.

848

"""

849

connection.send(func(*args, **kwargs))

850

connection.close()

851

852

853

class Client:

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

400

401

402

class Client(object):

854

403

"""A representation of a client host served by this server.

855

404

856

405

Attributes:

857

406

approved: bool(); 'None' if not yet approved/disapproved

858

407

approval_delay: datetime.timedelta(); Time to wait for approval

859

408

approval_duration: datetime.timedelta(); Duration of one approval

860

checker: multiprocessing.Process(); a running checker process used

861

to see if the client lives. 'None' if no process is

862

running.

863

checker_callback_tag: a GLib event source tag, or None

409

checker: subprocess.Popen(); a running checker process used

410

to see if the client lives.

411

'None' if no process is running.

412

checker_callback_tag: a gobject event source tag, or None

864

413

checker_command: string; External command which is run to check

865

414

if client lives. %() expansions are done at

866

415

runtime with vars(self) as dict, so that for

867

416

instance %(name)s can be used in the command.

868

checker_initiator_tag: a GLib event source tag, or None

417

checker_initiator_tag: a gobject event source tag, or None

869

418

created: datetime.datetime(); (UTC) object creation

870

419

client_structure: Object describing what attributes a client has

871

420

and is used for storing the client at exit

872

421

current_checker_command: string; current running checker_command

873

disable_initiator_tag: a GLib event source tag, or None

422

disable_initiator_tag: a gobject event source tag, or None

874

423

enabled: bool()

875

424

fingerprint: string (40 or 32 hexadecimal digits); used to

876

uniquely identify an OpenPGP client

877

key_id: string (64 hexadecimal digits); used to uniquely identify

878

a client using raw public keys

425

uniquely identify the client

879

426

host: string; available for use by the checker command

880

427

interval: datetime.timedelta(); How often to start a new checker

881

428

last_approval_request: datetime.datetime(); (UTC) or None

883

430

last_checker_status: integer between 0 and 255 reflecting exit

884

431

status of last checker. -1 reflects crashed

885

432

checker, -2 means no checker completed yet.

886

last_checker_signal: The signal which killed the last checker, if

887

last_checker_status is -1

888

433

last_enabled: datetime.datetime(); (UTC) or None

889

434

name: string; from the config file, used in log messages and

890

435

D-Bus identifiers

897

442

disabled, or None

898

443

server_settings: The server_settings dict from main()

899

444

"""

900

445

901

446

runtime_expansions = ("approval_delay", "approval_duration",

902

"created", "enabled", "expires", "key_id",

447

"created", "enabled", "expires",

903

448

"fingerprint", "host", "interval",

904

449

"last_approval_request", "last_checked_ok",

905

450

"last_enabled", "name", "timeout")

906

client_defaults = {

907

"timeout": "PT5M",

908

"extended_timeout": "PT15M",

909

"interval": "PT2M",

910

"checker": "fping -q -- %%(host)s",

911

"host": "",

912

"approval_delay": "PT0S",

913

"approval_duration": "PT1S",

914

"approved_by_default": "True",

915

"enabled": "True",

916

}

917

451

client_defaults = { "timeout": "PT5M",

452

"extended_timeout": "PT15M",

453

"interval": "PT2M",

454

"checker": "fping -q -- %%(host)s",

455

"host": "",

456

"approval_delay": "PT0S",

457

"approval_duration": "PT1S",

458

"approved_by_default": "True",

459

"enabled": "True",

460

}

461

462

def timeout_milliseconds(self):

463

"Return the 'timeout' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.timeout)

465

466

def extended_timeout_milliseconds(self):

467

"Return the 'extended_timeout' attribute in milliseconds"

468

return timedelta_to_milliseconds(self.extended_timeout)

469

470

def interval_milliseconds(self):

471

"Return the 'interval' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.interval)

473

474

def approval_delay_milliseconds(self):

475

return timedelta_to_milliseconds(self.approval_delay)

476

918

477

@staticmethod

919

478

def config_parser(config):

920

479

"""Construct a new dict of client settings of this form:

927

486

for client_name in config.sections():

928

487

section = dict(config.items(client_name))

929

488

client = settings[client_name] = {}

930

489

931

490

client["host"] = section["host"]

932

491

# Reformat values from string types to Python types

933

492

client["approved_by_default"] = config.getboolean(

934

493

client_name, "approved_by_default")

935

494

client["enabled"] = config.getboolean(client_name,

936

495

"enabled")

937

938

# Uppercase and remove spaces from key_id and fingerprint

939

# for later comparison purposes with return value from the

940

# key_id() and fingerprint() functions

941

client["key_id"] = (section.get("key_id", "").upper()

942

.replace(" ", ""))

496

943

497

client["fingerprint"] = (section["fingerprint"].upper()

944

498

.replace(" ", ""))

945

499

if "secret" in section:

946

client["secret"] = codecs.decode(section["secret"]

947

.encode("utf-8"),

948

"base64")

500

client["secret"] = section["secret"].decode("base64")

949

501

elif "secfile" in section:

950

502

with open(os.path.expanduser(os.path.expandvars

951

503

(section["secfile"])),

952

504

"rb") as secfile:

953

505

client["secret"] = secfile.read()

954

506

else:

955

raise TypeError("No secret or secfile for section {}"

507

raise TypeError("No secret or secfile for section {0}"

956

508

.format(section))

957

509

client["timeout"] = string_to_delta(section["timeout"])

958

510

client["extended_timeout"] = string_to_delta(

966

518

client["last_approval_request"] = None

967

519

client["last_checked_ok"] = None

968

520

client["last_checker_status"] = -2

969

521

970

522

return settings

971

972

def __init__(self, settings, name=None, server_settings=None):

523

524

def __init__(self, settings, name = None, server_settings=None):

973

525

self.name = name

974

526

if server_settings is None:

975

527

server_settings = {}

976

528

self.server_settings = server_settings

977

529

# adding all client settings

978

for setting, value in settings.items():

530

for setting, value in settings.iteritems():

979

531

setattr(self, setting, value)

980

532

981

533

if self.enabled:

982

534

if not hasattr(self, "last_enabled"):

983

535

self.last_enabled = datetime.datetime.utcnow()

987

539

else:

988

540

self.last_enabled = None

989

541

self.expires = None

990

542

991

543

logger.debug("Creating client %r", self.name)

992

logger.debug(" Key ID: %s", self.key_id)

544

# Uppercase and remove spaces from fingerprint for later

545

# comparison purposes with return value from the fingerprint()

546

# function

993

547

logger.debug(" Fingerprint: %s", self.fingerprint)

994

548

self.created = settings.get("created",

995

549

datetime.datetime.utcnow())

996

550

997

551

# attributes specific for this server instance

998

552

self.checker = None

999

553

self.checker_initiator_tag = None

1002

556

self.current_checker_command = None

1003

557

self.approved = None

1004

558

self.approvals_pending = 0

1005

self.changedstate = multiprocessing_manager.Condition(

1006

multiprocessing_manager.Lock())

1007

self.client_structure = [attr

1008

for attr in self.__dict__.keys()

559

self.changedstate = (multiprocessing_manager

560

.Condition(multiprocessing_manager

561

.Lock()))

562

self.client_structure = [attr for attr in

563

self.__dict__.iterkeys()

1009

564

if not attr.startswith("_")]

1010

565

self.client_structure.append("client_structure")

1011

1012

for name, t in inspect.getmembers(

1013

type(self), lambda obj: isinstance(obj, property)):

566

567

for name, t in inspect.getmembers(type(self),

568

lambda obj:

569

isinstance(obj,

570

property)):

1014

571

if not name.startswith("_"):

1015

572

self.client_structure.append(name)

1016

573

1017

574

# Send notice to process children that client state has changed

1018

575

def send_changedstate(self):

1019

576

with self.changedstate:

1020

577

self.changedstate.notify_all()

1021

578

1022

579

def enable(self):

1023

580

"""Start this client's checker and timeout hooks"""

1024

581

if getattr(self, "enabled", False):

1029

586

self.last_enabled = datetime.datetime.utcnow()

1030

587

self.init_checker()

1031

588

self.send_changedstate()

1032

589

1033

590

def disable(self, quiet=True):

1034

591

"""Disable this client."""

1035

592

if not getattr(self, "enabled", False):

1037

594

if not quiet:

1038

595

logger.info("Disabling client %s", self.name)

1039

596

if getattr(self, "disable_initiator_tag", None) is not None:

1040

GLib.source_remove(self.disable_initiator_tag)

597

gobject.source_remove(self.disable_initiator_tag)

1041

598

self.disable_initiator_tag = None

1042

599

self.expires = None

1043

600

if getattr(self, "checker_initiator_tag", None) is not None:

1044

GLib.source_remove(self.checker_initiator_tag)

601

gobject.source_remove(self.checker_initiator_tag)

1045

602

self.checker_initiator_tag = None

1046

603

self.stop_checker()

1047

604

self.enabled = False

1048

605

if not quiet:

1049

606

self.send_changedstate()

1050

# Do not run this again if called by a GLib.timeout_add

607

# Do not run this again if called by a gobject.timeout_add

1051

608

return False

1052

609

1053

610

def __del__(self):

1054

611

self.disable()

1055

612

1056

613

def init_checker(self):

1057

614

# Schedule a new checker to be started an 'interval' from now,

1058

615

# and every interval from then on.

1059

616

if self.checker_initiator_tag is not None:

1060

GLib.source_remove(self.checker_initiator_tag)

1061

self.checker_initiator_tag = GLib.timeout_add(

1062

random.randrange(int(self.interval.total_seconds() * 1000

1063

+ 1)),

1064

self.start_checker)

617

gobject.source_remove(self.checker_initiator_tag)

618

self.checker_initiator_tag = (gobject.timeout_add

619

(self.interval_milliseconds(),

620

self.start_checker))

1065

621

# Schedule a disable() when 'timeout' has passed

1066

622

if self.disable_initiator_tag is not None:

1067

GLib.source_remove(self.disable_initiator_tag)

1068

self.disable_initiator_tag = GLib.timeout_add(

1069

int(self.timeout.total_seconds() * 1000), self.disable)

623

gobject.source_remove(self.disable_initiator_tag)

624

self.disable_initiator_tag = (gobject.timeout_add

625

(self.timeout_milliseconds(),

626

self.disable))

1070

627

# Also start a new checker *right now*.

1071

628

self.start_checker()

1072

1073

def checker_callback(self, source, condition, connection,

1074

command):

629

630

def checker_callback(self, pid, condition, command):

1075

631

"""The checker has completed, so take appropriate actions."""

1076

# Read return code from connection (see call_pipe)

1077

returncode = connection.recv()

1078

connection.close()

1079

if self.checker is not None:

1080

self.checker.join()

1081

632

self.checker_callback_tag = None

1082

633

self.checker = None

1083

1084

if returncode >= 0:

1085

self.last_checker_status = returncode

1086

self.last_checker_signal = None

634

if os.WIFEXITED(condition):

635

self.last_checker_status = os.WEXITSTATUS(condition)

1087

636

if self.last_checker_status == 0:

1088

637

logger.info("Checker for %(name)s succeeded",

1089

638

vars(self))

1090

639

self.checked_ok()

1091

640

else:

1092

logger.info("Checker for %(name)s failed", vars(self))

641

logger.info("Checker for %(name)s failed",

642

vars(self))

1093

643

else:

1094

644

self.last_checker_status = -1

1095

self.last_checker_signal = -returncode

1096

645

logger.warning("Checker for %(name)s crashed?",

1097

646

vars(self))

1098

return False

1099

647

1100

648

def checked_ok(self):

1101

649

"""Assert that the client has been seen, alive and well."""

1102

650

self.last_checked_ok = datetime.datetime.utcnow()

1103

651

self.last_checker_status = 0

1104

self.last_checker_signal = None

1105

652

self.bump_timeout()

1106

653

1107

654

def bump_timeout(self, timeout=None):

1108

655

"""Bump up the timeout for this client."""

1109

656

if timeout is None:

1110

657

timeout = self.timeout

1111

658

if self.disable_initiator_tag is not None:

1112

GLib.source_remove(self.disable_initiator_tag)

659

gobject.source_remove(self.disable_initiator_tag)

1113

660

self.disable_initiator_tag = None

1114

661

if getattr(self, "enabled", False):

1115

self.disable_initiator_tag = GLib.timeout_add(

1116

int(timeout.total_seconds() * 1000), self.disable)

662

self.disable_initiator_tag = (gobject.timeout_add

663

(timedelta_to_milliseconds

664

(timeout), self.disable))

1117

665

self.expires = datetime.datetime.utcnow() + timeout

1118

666

1119

667

def need_approval(self):

1120

668

self.last_approval_request = datetime.datetime.utcnow()

1121

669

1122

670

def start_checker(self):

1123

671

"""Start a new checker subprocess if one is not running.

1124

672

1125

673

If a checker already exists, leave it running and do

1126

674

nothing."""

1127

675

# The reason for not killing a running checker is that if we

1132

680

# checkers alone, the checker would have to take more time

1133

681

# than 'timeout' for the client to be disabled, which is as it

1134

682

# should be.

1135

1136

if self.checker is not None and not self.checker.is_alive():

1137

logger.warning("Checker was not alive; joining")

1138

self.checker.join()

1139

self.checker = None

683

684

# If a checker exists, make sure it is not a zombie

685

try:

686

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

687

except (AttributeError, OSError) as error:

688

if (isinstance(error, OSError)

689

and error.errno != errno.ECHILD):

690

raise error

691

else:

692

if pid:

693

logger.warning("Checker was a zombie")

694

gobject.source_remove(self.checker_callback_tag)

695

self.checker_callback(pid, status,

696

self.current_checker_command)

1140

697

# Start a new checker if needed

1141

698

if self.checker is None:

1142

699

# Escape attributes for the shell

1143

escaped_attrs = {

1144

attr: shlex.quote(str(getattr(self, attr)))

1145

for attr in self.runtime_expansions}

700

escaped_attrs = dict(

701

(attr, re.escape(unicode(getattr(self, attr))))

702

for attr in

703

self.runtime_expansions)

1146

704

try:

1147

705

command = self.checker_command % escaped_attrs

1148

706

except TypeError as error:

1149

707

logger.error('Could not format string "%s"',

1150

self.checker_command,

708

self.checker_command, exc_info=error)

709

return True # Try again later

710

self.current_checker_command = command

711

try:

712

logger.info("Starting checker %r for %s",

713

command, self.name)

714

# We don't need to redirect stdout and stderr, since

715

# in normal mode, that is already done by daemon(),

716

# and in debug mode we don't want to. (Stdin is

717

# always replaced by /dev/null.)

718

# The exception is when not debugging but nevertheless

719

# running in the foreground; use the previously

720

# created wnull.

721

popen_args = {}

722

if (not self.server_settings["debug"]

723

and self.server_settings["foreground"]):

724

popen_args.update({"stdout": wnull,

725

"stderr": wnull })

726

self.checker = subprocess.Popen(command,

727

close_fds=True,

728

shell=True, cwd="/",

729

**popen_args)

730

except OSError as error:

731

logger.error("Failed to start subprocess",

1151

732

exc_info=error)

1152

return True # Try again later

1153

self.current_checker_command = command

1154

logger.info("Starting checker %r for %s", command,

1155

self.name)

1156

# We don't need to redirect stdout and stderr, since

1157

# in normal mode, that is already done by daemon(),

1158

# and in debug mode we don't want to. (Stdin is

1159

# always replaced by /dev/null.)

1160

# The exception is when not debugging but nevertheless

1161

# running in the foreground; use the previously

1162

# created wnull.

1163

popen_args = {"close_fds": True,

1164

"shell": True,

1165

"cwd": "/"}

1166

if (not self.server_settings["debug"]

1167

and self.server_settings["foreground"]):

1168

popen_args.update({"stdout": wnull,

1169

"stderr": wnull})

1170

pipe = multiprocessing.Pipe(duplex=False)

1171

self.checker = multiprocessing.Process(

1172

target=call_pipe,

1173

args=(pipe[1], subprocess.call, command),

1174

kwargs=popen_args)

1175

self.checker.start()

1176

self.checker_callback_tag = GLib.io_add_watch(

1177

GLib.IOChannel.unix_new(pipe[0].fileno()),

1178

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1179

self.checker_callback, pipe[0], command)

1180

# Re-run this periodically if run by GLib.timeout_add

733

return True

734

self.checker_callback_tag = (gobject.child_watch_add

735

(self.checker.pid,

736

self.checker_callback,

737

data=command))

738

# The checker may have completed before the gobject

739

# watch was added. Check for this.

740

try:

741

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

742

except OSError as error:

743

if error.errno == errno.ECHILD:

744

# This should never happen

745

logger.error("Child process vanished",

746

exc_info=error)

747

return True

748

raise

749

if pid:

750

gobject.source_remove(self.checker_callback_tag)

751

self.checker_callback(pid, status, command)

752

# Re-run this periodically if run by gobject.timeout_add

1181

753

return True

1182

754

1183

755

def stop_checker(self):

1184

756

"""Force the checker process, if any, to stop."""

1185

757

if self.checker_callback_tag:

1186

GLib.source_remove(self.checker_callback_tag)

758

gobject.source_remove(self.checker_callback_tag)

1187

759

self.checker_callback_tag = None

1188

760

if getattr(self, "checker", None) is None:

1189

761

return

1190

762

logger.debug("Stopping checker for %(name)s", vars(self))

1191

self.checker.terminate()

763

try:

764

self.checker.terminate()

765

#time.sleep(0.5)

766

#if self.checker.poll() is None:

767

# self.checker.kill()

768

except OSError as error:

769

if error.errno != errno.ESRCH: # No such process

770

raise

1192

771

self.checker = None

1193

772

1194

773

1195

def dbus_service_property(dbus_interface,

1196

signature="v",

1197

access="readwrite",

1198

byte_arrays=False):

774

def dbus_service_property(dbus_interface, signature="v",

775

access="readwrite", byte_arrays=False):

1199

776

"""Decorators for marking methods of a DBusObjectWithProperties to

1200

777

become properties on the D-Bus.

1201

778

1202

779

The decorated method will be called with no arguments by "Get"

1203

780

and with one argument by "Set".

1204

781

1205

782

The parameters, where they are supported, are the same as

1206

783

dbus.service.method, except there is only "signature", since the

1207

784

type from Get() and the type sent to Set() is the same.

1210

787

# "Set" method, so we fail early here:

1211

788

if byte_arrays and signature != "ay":

1212

789

raise ValueError("Byte arrays not supported for non-'ay'"

1213

" signature {!r}".format(signature))

1214

790

" signature {0!r}".format(signature))

1215

791

def decorator(func):

1216

792

func._dbus_is_property = True

1217

793

func._dbus_interface = dbus_interface

1220

796

func._dbus_name = func.__name__

1221

797

if func._dbus_name.endswith("_dbus_property"):

1222

798

func._dbus_name = func._dbus_name[:-14]

1223

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

799

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1224

800

return func

1225

1226

801

return decorator

1227

802

1228

803

1229

804

def dbus_interface_annotations(dbus_interface):

1230

805

"""Decorator for marking functions returning interface annotations

1231

806

1232

807

Usage:

1233

808

1234

809

@dbus_interface_annotations("org.example.Interface")

1235

810

def _foo(self): # Function name does not matter

1236

811

return {"org.freedesktop.DBus.Deprecated": "true",

1237

812

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1238

813

"false"}

1239

814

"""

1240

1241

815

def decorator(func):

1242

816

func._dbus_is_interface = True

1243

817

func._dbus_interface = dbus_interface

1244

818

func._dbus_name = dbus_interface

1245

819

return func

1246

1247

820

return decorator

1248

821

1249

822

1250

823

def dbus_annotations(annotations):

1251

824

"""Decorator to annotate D-Bus methods, signals or properties

1252

825

Usage:

1253

1254

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1255

"org.freedesktop.DBus.Property."

1256

"EmitsChangedSignal": "false"})

826

1257

827

@dbus_service_property("org.example.Interface", signature="b",

1258

828

access="r")

829

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

830

"org.freedesktop.DBus.Property."

831

"EmitsChangedSignal": "false"})

1259

832

def Property_dbus_property(self):

1260

833

return dbus.Boolean(False)

1261

1262

See also the DBusObjectWithAnnotations class.

1263

834

"""

1264

1265

835

def decorator(func):

1266

836

func._dbus_annotations = annotations

1267

837

return func

1268

1269

838

return decorator

1270

839

1271

840

1272

841

class DBusPropertyException(dbus.exceptions.DBusException):

1273

842

"""A base class for D-Bus property-related exceptions

1274

843

"""

1275

pass

844

def __unicode__(self):

845

return unicode(str(self))

1276

846

1277

847

1278

848

class DBusPropertyAccessException(DBusPropertyException):

1287

857

pass

1288

858

1289

859

1290

class DBusObjectWithAnnotations(dbus.service.Object):

1291

"""A D-Bus object with annotations.

1292

1293

Classes inheriting from this can use the dbus_annotations

1294

decorator to add annotations to methods or signals.

860

class DBusObjectWithProperties(dbus.service.Object):

861

"""A D-Bus object with properties.

862

863

Classes inheriting from this can use the dbus_service_property

864

decorator to expose methods as D-Bus properties. It exposes the

865

standard Get(), Set(), and GetAll() methods on the D-Bus.

1295

866

"""

1296

867

1297

868

@staticmethod

1298

869

def _is_dbus_thing(thing):

1299

870

"""Returns a function testing if an attribute is a D-Bus thing

1300

871

1301

872

If called like _is_dbus_thing("method") it returns a function

1302

873

suitable for use as predicate to inspect.getmembers().

1303

874

"""

1304

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

875

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1305

876

False)

1306

877

1307

878

def _get_all_dbus_things(self, thing):

1308

879

"""Returns a generator of (name, attribute) pairs

1309

880

"""

1310

return ((getattr(athing.__get__(self), "_dbus_name", name),

881

return ((getattr(athing.__get__(self), "_dbus_name",

882

name),

1311

883

athing.__get__(self))

1312

884

for cls in self.__class__.__mro__

1313

885

for name, athing in

1314

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1315

1316

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1317

out_signature="s",

1318

path_keyword='object_path',

1319

connection_keyword='connection')

1320

def Introspect(self, object_path, connection):

1321

"""Overloading of standard D-Bus method.

1322

1323

Inserts annotation tags on methods and signals.

1324

"""

1325

xmlstring = dbus.service.Object.Introspect(self, object_path,

1326

connection)

1327

try:

1328

document = xml.dom.minidom.parseString(xmlstring)

1329

1330

for if_tag in document.getElementsByTagName("interface"):

1331

# Add annotation tags

1332

for typ in ("method", "signal"):

1333

for tag in if_tag.getElementsByTagName(typ):

1334

annots = dict()

1335

for name, prop in (self.

1336

_get_all_dbus_things(typ)):

1337

if (name == tag.getAttribute("name")

1338

and prop._dbus_interface

1339

== if_tag.getAttribute("name")):

1340

annots.update(getattr(

1341

prop, "_dbus_annotations", {}))

1342

for name, value in annots.items():

1343

ann_tag = document.createElement(

1344

"annotation")

1345

ann_tag.setAttribute("name", name)

1346

ann_tag.setAttribute("value", value)

1347

tag.appendChild(ann_tag)

1348

# Add interface annotation tags

1349

for annotation, value in dict(

1350

itertools.chain.from_iterable(

1351

annotations().items()

1352

for name, annotations

1353

in self._get_all_dbus_things("interface")

1354

if name == if_tag.getAttribute("name")

1355

)).items():

1356

ann_tag = document.createElement("annotation")

1357

ann_tag.setAttribute("name", annotation)

1358

ann_tag.setAttribute("value", value)

1359

if_tag.appendChild(ann_tag)

1360

# Fix argument name for the Introspect method itself

1361

if (if_tag.getAttribute("name")

1362

== dbus.INTROSPECTABLE_IFACE):

1363

for cn in if_tag.getElementsByTagName("method"):

1364

if cn.getAttribute("name") == "Introspect":

1365

for arg in cn.getElementsByTagName("arg"):

1366

if (arg.getAttribute("direction")

1367

== "out"):

1368

arg.setAttribute("name",

1369

"xml_data")

1370

xmlstring = document.toxml("utf-8")

1371

document.unlink()

1372

except (AttributeError, xml.dom.DOMException,

1373

xml.parsers.expat.ExpatError) as error:

1374

logger.error("Failed to override Introspection method",

1375

exc_info=error)

1376

return xmlstring

1377

1378

1379

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1380

"""A D-Bus object with properties.

1381

1382

Classes inheriting from this can use the dbus_service_property

1383

decorator to expose methods as D-Bus properties. It exposes the

1384

standard Get(), Set(), and GetAll() methods on the D-Bus.

1385

"""

1386

886

inspect.getmembers(cls,

887

self._is_dbus_thing(thing)))

888

1387

889

def _get_dbus_property(self, interface_name, property_name):

1388

890

"""Returns a bound method if one exists which is a D-Bus

1389

891

property with the specified name and interface.

1390

892

"""

1391

for cls in self.__class__.__mro__:

1392

for name, value in inspect.getmembers(

1393

cls, self._is_dbus_thing("property")):

893

for cls in self.__class__.__mro__:

894

for name, value in (inspect.getmembers

895

(cls,

896

self._is_dbus_thing("property"))):

1394

897

if (value._dbus_name == property_name

1395

898

and value._dbus_interface == interface_name):

1396

899

return value.__get__(self)

1397

900

1398

901

# No such property

1399

raise DBusPropertyNotFound("{}:{}.{}".format(

1400

self.dbus_object_path, interface_name, property_name))

1401

1402

@classmethod

1403

def _get_all_interface_names(cls):

1404

"""Get a sequence of all interfaces supported by an object"""

1405

return (name for name in set(getattr(getattr(x, attr),

1406

"_dbus_interface", None)

1407

for x in (inspect.getmro(cls))

1408

for attr in dir(x))

1409

if name is not None)

1410

1411

@dbus.service.method(dbus.PROPERTIES_IFACE,

1412

in_signature="ss",

902

raise DBusPropertyNotFound(self.dbus_object_path + ":"

903

+ interface_name + "."

904

+ property_name)

905

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1413

907

out_signature="v")

1414

908

def Get(self, interface_name, property_name):

1415

909

"""Standard D-Bus property Get() method, see D-Bus standard.

1421

915

if not hasattr(value, "variant_level"):

1422

916

return value

1423

917

return type(value)(value, variant_level=value.variant_level+1)

1424

918

1425

919

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1426

920

def Set(self, interface_name, property_name, value):

1427

921

"""Standard D-Bus property Set() method, see D-Bus standard.

1433

927

# The byte_arrays option is not supported yet on

1434

928

# signatures other than "ay".

1435

929

if prop._dbus_signature != "ay":

1436

raise ValueError("Byte arrays not supported for non-"

1437

"'ay' signature {!r}"

1438

.format(prop._dbus_signature))

1439

value = dbus.ByteArray(bytes(value))

930

raise ValueError

931

value = dbus.ByteArray(b''.join(chr(byte)

932

for byte in value))

1440

933

prop(value)

1441

1442

@dbus.service.method(dbus.PROPERTIES_IFACE,

1443

in_signature="s",

934

935

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1444

936

out_signature="a{sv}")

1445

937

def GetAll(self, interface_name):

1446

938

"""Standard D-Bus property GetAll() method, see D-Bus

1447

939

standard.

1448

940

1449

941

Note: Will not include properties with access="write".

1450

942

"""

1451

943

properties = {}

1461

953

if not hasattr(value, "variant_level"):

1462

954

properties[name] = value

1463

955

continue

1464

properties[name] = type(value)(

1465

value, variant_level=value.variant_level + 1)

956

properties[name] = type(value)(value, variant_level=

957

value.variant_level+1)

1466

958

return dbus.Dictionary(properties, signature="sv")

1467

1468

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1469

def PropertiesChanged(self, interface_name, changed_properties,

1470

invalidated_properties):

1471

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1472

standard.

1473

"""

1474

pass

1475

959

1476

960

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1477

961

out_signature="s",

1478

962

path_keyword='object_path',

1479

963

connection_keyword='connection')

1480

964

def Introspect(self, object_path, connection):

1481

965

"""Overloading of standard D-Bus method.

1482

966

1483

967

Inserts property tags and interface annotation tags.

1484

968

"""

1485

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1486

object_path,

1487

connection)

969

xmlstring = dbus.service.Object.Introspect(self, object_path,

970

connection)

1488

971

try:

1489

972

document = xml.dom.minidom.parseString(xmlstring)

1490

1491

973

def make_tag(document, name, prop):

1492

974

e = document.createElement("property")

1493

975

e.setAttribute("name", name)

1494

976

e.setAttribute("type", prop._dbus_signature)

1495

977

e.setAttribute("access", prop._dbus_access)

1496

978

return e

1497

1498

979

for if_tag in document.getElementsByTagName("interface"):

1499

980

# Add property tags

1500

981

for tag in (make_tag(document, name, prop)

1503

984

if prop._dbus_interface

1504

985

== if_tag.getAttribute("name")):

1505

986

if_tag.appendChild(tag)

1506

# Add annotation tags for properties

1507

for tag in if_tag.getElementsByTagName("property"):

1508

annots = dict()

1509

for name, prop in self._get_all_dbus_things(

1510

"property"):

1511

if (name == tag.getAttribute("name")

1512

and prop._dbus_interface

1513

== if_tag.getAttribute("name")):

1514

annots.update(getattr(

1515

prop, "_dbus_annotations", {}))

1516

for name, value in annots.items():

1517

ann_tag = document.createElement(

1518

"annotation")

1519

ann_tag.setAttribute("name", name)

1520

ann_tag.setAttribute("value", value)

1521

tag.appendChild(ann_tag)

987

# Add annotation tags

988

for typ in ("method", "signal", "property"):

989

for tag in if_tag.getElementsByTagName(typ):

990

annots = dict()

991

for name, prop in (self.

992

_get_all_dbus_things(typ)):

993

if (name == tag.getAttribute("name")

994

and prop._dbus_interface

995

== if_tag.getAttribute("name")):

996

annots.update(getattr

997

(prop,

998

"_dbus_annotations",

999

{}))

1000

for name, value in annots.iteritems():

1001

ann_tag = document.createElement(

1002

"annotation")

1003

ann_tag.setAttribute("name", name)

1004

ann_tag.setAttribute("value", value)

1005

tag.appendChild(ann_tag)

1006

# Add interface annotation tags

1007

for annotation, value in dict(

1008

itertools.chain.from_iterable(

1009

annotations().iteritems()

1010

for name, annotations in

1011

self._get_all_dbus_things("interface")

1012

if name == if_tag.getAttribute("name")

1013

)).iteritems():

1014

ann_tag = document.createElement("annotation")

1015

ann_tag.setAttribute("name", annotation)

1016

ann_tag.setAttribute("value", value)

1017

if_tag.appendChild(ann_tag)

1522

1018

# Add the names to the return values for the

1523

1019

# "org.freedesktop.DBus.Properties" methods

1524

1020

if (if_tag.getAttribute("name")

1543

1039

return xmlstring

1544

1040

1545

1041

1546

try:

1547

dbus.OBJECT_MANAGER_IFACE

1548

except AttributeError:

1549

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1550

1551

1552

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1553

"""A D-Bus object with an ObjectManager.

1554

1555

Classes inheriting from this exposes the standard

1556

GetManagedObjects call and the InterfacesAdded and

1557

InterfacesRemoved signals on the standard

1558

"org.freedesktop.DBus.ObjectManager" interface.

1559

1560

Note: No signals are sent automatically; they must be sent

1561

manually.

1562

"""

1563

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1564

out_signature="a{oa{sa{sv}}}")

1565

def GetManagedObjects(self):

1566

"""This function must be overridden"""

1567

raise NotImplementedError()

1568

1569

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1570

signature="oa{sa{sv}}")

1571

def InterfacesAdded(self, object_path, interfaces_and_properties):

1572

pass

1573

1574

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1575

def InterfacesRemoved(self, object_path, interfaces):

1576

pass

1577

1578

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1579

out_signature="s",

1580

path_keyword='object_path',

1581

connection_keyword='connection')

1582

def Introspect(self, object_path, connection):

1583

"""Overloading of standard D-Bus method.

1584

1585

Override return argument name of GetManagedObjects to be

1586

"objpath_interfaces_and_properties"

1587

"""

1588

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1589

object_path,

1590

connection)

1591

try:

1592

document = xml.dom.minidom.parseString(xmlstring)

1593

1594

for if_tag in document.getElementsByTagName("interface"):

1595

# Fix argument name for the GetManagedObjects method

1596

if (if_tag.getAttribute("name")

1597

== dbus.OBJECT_MANAGER_IFACE):

1598

for cn in if_tag.getElementsByTagName("method"):

1599

if (cn.getAttribute("name")

1600

== "GetManagedObjects"):

1601

for arg in cn.getElementsByTagName("arg"):

1602

if (arg.getAttribute("direction")

1603

== "out"):

1604

arg.setAttribute(

1605

"name",

1606

"objpath_interfaces"

1607

"_and_properties")

1608

xmlstring = document.toxml("utf-8")

1609

document.unlink()

1610

except (AttributeError, xml.dom.DOMException,

1611

xml.parsers.expat.ExpatError) as error:

1612

logger.error("Failed to override Introspection method",

1613

exc_info=error)

1614

return xmlstring

1615

1616

1617

1042

def datetime_to_dbus(dt, variant_level=0):

1618

1043

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1619

1044

if dt is None:

1620

return dbus.String("", variant_level=variant_level)

1621

return dbus.String(dt.isoformat(), variant_level=variant_level)

1045

return dbus.String("", variant_level = variant_level)

1046

return dbus.String(dt.isoformat(),

1047

variant_level=variant_level)

1622

1048

1623

1049

1624

1050

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1626

1052

dbus.service.Object, it will add alternate D-Bus attributes with

1627

1053

interface names according to the "alt_interface_names" mapping.

1628

1054

Usage:

1629

1055

1630

1056

@alternate_dbus_interfaces({"org.example.Interface":

1631

1057

"net.example.AlternateInterface"})

1632

1058

class SampleDBusObject(dbus.service.Object):

1633

1059

@dbus.service.method("org.example.Interface")

1634

1060

def SampleDBusMethod():

1635

1061

pass

1636

1062

1637

1063

The above "SampleDBusMethod" on "SampleDBusObject" will be

1638

1064

reachable via two interfaces: "org.example.Interface" and

1639

1065

"net.example.AlternateInterface", the latter of which will have

1640

1066

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1641

1067

"true", unless "deprecate" is passed with a False value.

1642

1068

1643

1069

This works for methods and signals, and also for D-Bus properties

1644

1070

(from DBusObjectWithProperties) and interfaces (from the

1645

1071

dbus_interface_annotations decorator).

1646

1072

"""

1647

1648

1073

def wrapper(cls):

1649

1074

for orig_interface_name, alt_interface_name in (

1650

alt_interface_names.items()):

1075

alt_interface_names.iteritems()):

1651

1076

attr = {}

1652

1077

interface_names = set()

1653

1078

# Go though all attributes of the class

1655

1080

# Ignore non-D-Bus attributes, and D-Bus attributes

1656

1081

# with the wrong interface name

1657

1082

if (not hasattr(attribute, "_dbus_interface")

1658

or not attribute._dbus_interface.startswith(

1659

orig_interface_name)):

1083

or not attribute._dbus_interface

1084

.startswith(orig_interface_name)):

1660

1085

continue

1661

1086

# Create an alternate D-Bus interface name based on

1662

1087

# the current name

1663

alt_interface = attribute._dbus_interface.replace(

1664

orig_interface_name, alt_interface_name)

1088

alt_interface = (attribute._dbus_interface

1089

.replace(orig_interface_name,

1090

alt_interface_name))

1665

1091

interface_names.add(alt_interface)

1666

1092

# Is this a D-Bus signal?

1667

1093

if getattr(attribute, "_dbus_is_signal", False):

1668

1094

# Extract the original non-method undecorated

1669

1095

# function by black magic

1670

if sys.version_info.major == 2:

1671

nonmethod_func = (dict(

1096

nonmethod_func = (dict(

1672

1097

zip(attribute.func_code.co_freevars,

1673

attribute.__closure__))

1674

["func"].cell_contents)

1675

else:

1676

nonmethod_func = (dict(

1677

zip(attribute.__code__.co_freevars,

1678

attribute.__closure__))

1679

["func"].cell_contents)

1098

attribute.__closure__))["func"]

1099

.cell_contents)

1680

1100

# Create a new, but exactly alike, function

1681

1101

# object, and decorate it to be a new D-Bus signal

1682

1102

# with the alternate D-Bus interface name

1683

new_function = copy_function(nonmethod_func)

1684

new_function = (dbus.service.signal(

1685

alt_interface,

1686

attribute._dbus_signature)(new_function))

1103

new_function = (dbus.service.signal

1104

(alt_interface,

1105

attribute._dbus_signature)

1106

(types.FunctionType(

1107

nonmethod_func.func_code,

1108

nonmethod_func.func_globals,

1109

nonmethod_func.func_name,

1110

nonmethod_func.func_defaults,

1111

nonmethod_func.func_closure)))

1687

1112

# Copy annotations, if any

1688

1113

try:

1689

new_function._dbus_annotations = dict(

1690

attribute._dbus_annotations)

1114

new_function._dbus_annotations = (

1115

dict(attribute._dbus_annotations))

1691

1116

except AttributeError:

1692

1117

pass

1693

1694

1118

# Define a creator of a function to call both the

1695

1119

# original and alternate functions, so both the

1696

1120

# original and alternate signals gets sent when

1699

1123

"""This function is a scope container to pass

1700

1124

func1 and func2 to the "call_both" function

1701

1125

outside of its arguments"""

1702

1703

@functools.wraps(func2)

1704

1126

def call_both(*args, **kwargs):

1705

1127

"""This function will emit two D-Bus

1706

1128

signals by calling func1 and func2"""

1707

1129

func1(*args, **kwargs)

1708

1130

func2(*args, **kwargs)

1709

# Make wrapper function look like a D-Bus

1710

# signal

1711

for name, attr in inspect.getmembers(func2):

1712

if name.startswith("_dbus_"):

1713

setattr(call_both, name, attr)

1714

1715

1131

return call_both

1716

1132

# Create the "call_both" function and add it to

1717

1133

# the class

1722

1138

# object. Decorate it to be a new D-Bus method

1723

1139

# with the alternate D-Bus interface name. Add it

1724

1140

# to the class.

1725

attr[attrname] = (

1726

dbus.service.method(

1727

alt_interface,

1728

attribute._dbus_in_signature,

1729

attribute._dbus_out_signature)

1730

(copy_function(attribute)))

1141

attr[attrname] = (dbus.service.method

1142

(alt_interface,

1143

attribute._dbus_in_signature,

1144

attribute._dbus_out_signature)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1731

1151

# Copy annotations, if any

1732

1152

try:

1733

attr[attrname]._dbus_annotations = dict(

1734

attribute._dbus_annotations)

1153

attr[attrname]._dbus_annotations = (

1154

dict(attribute._dbus_annotations))

1735

1155

except AttributeError:

1736

1156

pass

1737

1157

# Is this a D-Bus property?

1740

1160

# object, and decorate it to be a new D-Bus

1741

1161

# property with the alternate D-Bus interface

1742

1162

# name. Add it to the class.

1743

attr[attrname] = (dbus_service_property(

1744

alt_interface, attribute._dbus_signature,

1745

attribute._dbus_access,

1746

attribute._dbus_get_args_options

1747

["byte_arrays"])

1748

(copy_function(attribute)))

1163

attr[attrname] = (dbus_service_property

1164

(alt_interface,

1165

attribute._dbus_signature,

1166

attribute._dbus_access,

1167

attribute

1168

._dbus_get_args_options

1169

["byte_arrays"])

1170

(types.FunctionType

1171

(attribute.func_code,

1172

attribute.func_globals,

1173

attribute.func_name,

1174

attribute.func_defaults,

1175

attribute.func_closure)))

1749

1176

# Copy annotations, if any

1750

1177

try:

1751

attr[attrname]._dbus_annotations = dict(

1752

attribute._dbus_annotations)

1178

attr[attrname]._dbus_annotations = (

1179

dict(attribute._dbus_annotations))

1753

1180

except AttributeError:

1754

1181

pass

1755

1182

# Is this a D-Bus interface?

1758

1185

# object. Decorate it to be a new D-Bus interface

1759

1186

# with the alternate D-Bus interface name. Add it

1760

1187

# to the class.

1761

attr[attrname] = (

1762

dbus_interface_annotations(alt_interface)

1763

(copy_function(attribute)))

1188

attr[attrname] = (dbus_interface_annotations

1189

(alt_interface)

1190

(types.FunctionType

1191

(attribute.func_code,

1192

attribute.func_globals,

1193

attribute.func_name,

1194

attribute.func_defaults,

1195

attribute.func_closure)))

1764

1196

if deprecate:

1765

1197

# Deprecate all alternate interfaces

1766

iname = "_AlternateDBusNames_interface_annotation{}"

1198

iname="_AlternateDBusNames_interface_annotation{0}"

1767

1199

for interface_name in interface_names:

1768

1769

1200

@dbus_interface_annotations(interface_name)

1770

1201

def func(self):

1771

return {"org.freedesktop.DBus.Deprecated":

1772

"true"}

1202

return { "org.freedesktop.DBus.Deprecated":

1203

"true" }

1773

1204

# Find an unused name

1774

1205

for aname in (iname.format(i)

1775

1206

for i in itertools.count()):

1779

1210

if interface_names:

1780

1211

# Replace the class with a new subclass of it with

1781

1212

# methods, signals, etc. as created above.

1782

if sys.version_info.major == 2:

1783

cls = type(b"{}Alternate".format(cls.__name__),

1784

(cls, ), attr)

1785

else:

1786

cls = type("{}Alternate".format(cls.__name__),

1787

(cls, ), attr)

1213

cls = type(b"{0}Alternate".format(cls.__name__),

1214

(cls,), attr)

1788

1215

return cls

1789

1790

1216

return wrapper

1791

1217

1792

1218

1793

1219

@alternate_dbus_interfaces({"se.recompile.Mandos":

1794

"se.bsnet.fukt.Mandos"})

1220

"se.bsnet.fukt.Mandos"})

1795

1221

class ClientDBus(Client, DBusObjectWithProperties):

1796

1222

"""A Client class using D-Bus

1797

1223

1798

1224

Attributes:

1799

1225

dbus_object_path: dbus.ObjectPath

1800

1226

bus: dbus.SystemBus()

1801

1227

"""

1802

1228

1803

1229

runtime_expansions = (Client.runtime_expansions

1804

+ ("dbus_object_path", ))

1805

1806

_interface = "se.recompile.Mandos.Client"

1807

1230

+ ("dbus_object_path",))

1231

1808

1232

# dbus.service.Object doesn't use super(), so we can't either.

1809

1810

def __init__(self, bus=None, *args, **kwargs):

1233

1234

def __init__(self, bus = None, *args, **kwargs):

1811

1235

self.bus = bus

1812

1236

Client.__init__(self, *args, **kwargs)

1813

1237

# Only now, when this client is initialized, can it show up on

1814

1238

# the D-Bus

1815

client_object_name = str(self.name).translate(

1239

client_object_name = unicode(self.name).translate(

1816

1240

{ord("."): ord("_"),

1817

1241

ord("-"): ord("_")})

1818

self.dbus_object_path = dbus.ObjectPath(

1819

"/clients/" + client_object_name)

1242

self.dbus_object_path = (dbus.ObjectPath

1243

("/clients/" + client_object_name))

1820

1244

DBusObjectWithProperties.__init__(self, self.bus,

1821

1245

self.dbus_object_path)

1822

1823

def notifychangeproperty(transform_func, dbus_name,

1824

type_func=lambda x: x,

1825

variant_level=1,

1826

invalidate_only=False,

1827

_interface=_interface):

1246

1247

def notifychangeproperty(transform_func,

1248

dbus_name, type_func=lambda x: x,

1249

variant_level=1):

1828

1250

""" Modify a variable so that it's a property which announces

1829

1251

its changes to DBus.

1830

1252

1831

1253

transform_fun: Function that takes a value and a variant_level

1832

1254

and transforms it to a D-Bus type.

1833

1255

dbus_name: D-Bus name of the variable

1835

1257

to the D-Bus. Default: no transform

1836

1258

variant_level: D-Bus variant level. Default: 1

1837

1259

"""

1838

attrname = "_{}".format(dbus_name)

1839

1260

attrname = "_{0}".format(dbus_name)

1840

1261

def setter(self, value):

1841

1262

if hasattr(self, "dbus_object_path"):

1842

1263

if (not hasattr(self, attrname) or

1843

1264

type_func(getattr(self, attrname, None))

1844

1265

!= type_func(value)):

1845

if invalidate_only:

1846

self.PropertiesChanged(

1847

_interface, dbus.Dictionary(),

1848

dbus.Array((dbus_name, )))

1849

else:

1850

dbus_value = transform_func(

1851

type_func(value),

1852

variant_level=variant_level)

1853

self.PropertyChanged(dbus.String(dbus_name),

1854

dbus_value)

1855

self.PropertiesChanged(

1856

_interface,

1857

dbus.Dictionary({dbus.String(dbus_name):

1858

dbus_value}),

1859

dbus.Array())

1266

dbus_value = transform_func(type_func(value),

1267

variant_level

1268

=variant_level)

1269

self.PropertyChanged(dbus.String(dbus_name),

1270

dbus_value)

1860

1271

setattr(self, attrname, value)

1861

1272

1862

1273

return property(lambda self: getattr(self, attrname), setter)

1863

1274

1864

1275

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1865

1276

approvals_pending = notifychangeproperty(dbus.Boolean,

1866

1277

"ApprovalPending",

1867

type_func=bool)

1278

type_func = bool)

1868

1279

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1869

1280

last_enabled = notifychangeproperty(datetime_to_dbus,

1870

1281

"LastEnabled")

1871

checker = notifychangeproperty(

1872

dbus.Boolean, "CheckerRunning",

1873

type_func=lambda checker: checker is not None)

1282

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1283

type_func = lambda checker:

1284

checker is not None)

1874

1285

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1875

1286

"LastCheckedOK")

1876

1287

last_checker_status = notifychangeproperty(dbus.Int16,

1879

1290

datetime_to_dbus, "LastApprovalRequest")

1880

1291

approved_by_default = notifychangeproperty(dbus.Boolean,

1881

1292

"ApprovedByDefault")

1882

approval_delay = notifychangeproperty(

1883

dbus.UInt64, "ApprovalDelay",

1884

type_func=lambda td: td.total_seconds() * 1000)

1293

approval_delay = notifychangeproperty(dbus.UInt64,

1294

"ApprovalDelay",

1295

type_func =

1296

timedelta_to_milliseconds)

1885

1297

approval_duration = notifychangeproperty(

1886

1298

dbus.UInt64, "ApprovalDuration",

1887

type_func=lambda td: td.total_seconds() * 1000)

1299

type_func = timedelta_to_milliseconds)

1888

1300

host = notifychangeproperty(dbus.String, "Host")

1889

timeout = notifychangeproperty(

1890

dbus.UInt64, "Timeout",

1891

type_func=lambda td: td.total_seconds() * 1000)

1301

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1302

type_func =

1303

timedelta_to_milliseconds)

1892

1304

extended_timeout = notifychangeproperty(

1893

1305

dbus.UInt64, "ExtendedTimeout",

1894

type_func=lambda td: td.total_seconds() * 1000)

1895

interval = notifychangeproperty(

1896

dbus.UInt64, "Interval",

1897

type_func=lambda td: td.total_seconds() * 1000)

1306

type_func = timedelta_to_milliseconds)

1307

interval = notifychangeproperty(dbus.UInt64,

1308

"Interval",

1309

type_func =

1310

timedelta_to_milliseconds)

1898

1311

checker_command = notifychangeproperty(dbus.String, "Checker")

1899

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1900

invalidate_only=True)

1901

1312

1902

1313

del notifychangeproperty

1903

1314

1904

1315

def __del__(self, *args, **kwargs):

1905

1316

try:

1906

1317

self.remove_from_connection()

1909

1320

if hasattr(DBusObjectWithProperties, "__del__"):

1910

1321

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1911

1322

Client.__del__(self, *args, **kwargs)

1912

1913

def checker_callback(self, source, condition,

1914

connection, command, *args, **kwargs):

1915

ret = Client.checker_callback(self, source, condition,

1916

connection, command, *args,

1917

**kwargs)

1918

exitstatus = self.last_checker_status

1919

if exitstatus >= 0:

1323

1324

def checker_callback(self, pid, condition, command,

1325

*args, **kwargs):

1326

self.checker_callback_tag = None

1327

self.checker = None

1328

if os.WIFEXITED(condition):

1329

exitstatus = os.WEXITSTATUS(condition)

1920

1330

# Emit D-Bus signal

1921

1331

self.CheckerCompleted(dbus.Int16(exitstatus),

1922

# This is specific to GNU libC

1923

dbus.Int64(exitstatus << 8),

1332

dbus.Int64(condition),

1924

1333

dbus.String(command))

1925

1334

else:

1926

1335

# Emit D-Bus signal

1927

1336

self.CheckerCompleted(dbus.Int16(-1),

1928

dbus.Int64(

1929

# This is specific to GNU libC

1930

(exitstatus << 8)

1931

| self.last_checker_signal),

1337

dbus.Int64(condition),

1932

1338

dbus.String(command))

1933

return ret

1934

1339

1340

return Client.checker_callback(self, pid, condition, command,

1341

*args, **kwargs)

1342

1935

1343

def start_checker(self, *args, **kwargs):

1936

old_checker_pid = getattr(self.checker, "pid", None)

1344

old_checker = self.checker

1345

if self.checker is not None:

1346

old_checker_pid = self.checker.pid

1347

else:

1348

old_checker_pid = None

1937

1349

r = Client.start_checker(self, *args, **kwargs)

1938

1350

# Only if new checker process was started

1939

1351

if (self.checker is not None

1941

1353

# Emit D-Bus signal

1942

1354

self.CheckerStarted(self.current_checker_command)

1943

1355

return r

1944

1356

1945

1357

def _reset_approved(self):

1946

1358

self.approved = None

1947

1359

return False

1948

1360

1949

1361

def approve(self, value=True):

1950

1362

self.approved = value

1951

GLib.timeout_add(int(self.approval_duration.total_seconds()

1952

* 1000), self._reset_approved)

1363

gobject.timeout_add(timedelta_to_milliseconds

1364

(self.approval_duration),

1365

self._reset_approved)

1953

1366

self.send_changedstate()

1954

1955

# D-Bus methods, signals & properties

1956

1957

# Interfaces

1958

1959

# Signals

1960

1367

1368

## D-Bus methods, signals & properties

1369

_interface = "se.recompile.Mandos.Client"

1370

1371

## Interfaces

1372

1373

@dbus_interface_annotations(_interface)

1374

def _foo(self):

1375

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1376

"false"}

1377

1378

## Signals

1379

1961

1380

# CheckerCompleted - signal

1962

1381

@dbus.service.signal(_interface, signature="nxs")

1963

1382

def CheckerCompleted(self, exitcode, waitstatus, command):

1964

1383

"D-Bus signal"

1965

1384

pass

1966

1385

1967

1386

# CheckerStarted - signal

1968

1387

@dbus.service.signal(_interface, signature="s")

1969

1388

def CheckerStarted(self, command):

1970

1389

"D-Bus signal"

1971

1390

pass

1972

1391

1973

1392

# PropertyChanged - signal

1974

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1975

1393

@dbus.service.signal(_interface, signature="sv")

1976

1394

def PropertyChanged(self, property, value):

1977

1395

"D-Bus signal"

1978

1396

pass

1979

1397

1980

1398

# GotSecret - signal

1981

1399

@dbus.service.signal(_interface)

1982

1400

def GotSecret(self):

1985

1403

server to mandos-client

1986

1404

"""

1987

1405

pass

1988

1406

1989

1407

# Rejected - signal

1990

1408

@dbus.service.signal(_interface, signature="s")

1991

1409

def Rejected(self, reason):

1992

1410

"D-Bus signal"

1993

1411

pass

1994

1412

1995

1413

# NeedApproval - signal

1996

1414

@dbus.service.signal(_interface, signature="tb")

1997

1415

def NeedApproval(self, timeout, default):

1998

1416

"D-Bus signal"

1999

1417

return self.need_approval()

2000

2001

# Methods

2002

1418

1419

## Methods

1420

2003

1421

# Approve - method

2004

1422

@dbus.service.method(_interface, in_signature="b")

2005

1423

def Approve(self, value):

2006

1424

self.approve(value)

2007

1425

2008

1426

# CheckedOK - method

2009

1427

@dbus.service.method(_interface)

2010

1428

def CheckedOK(self):

2011

1429

self.checked_ok()

2012

1430

2013

1431

# Enable - method

2014

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1432

@dbus.service.method(_interface)

2016

1433

def Enable(self):

2017

1434

"D-Bus method"

2018

1435

self.enable()

2019

1436

2020

1437

# StartChecker - method

2021

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2022

1438

@dbus.service.method(_interface)

2023

1439

def StartChecker(self):

2024

1440

"D-Bus method"

2025

1441

self.start_checker()

2026

1442

2027

1443

# Disable - method

2028

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2029

1444

@dbus.service.method(_interface)

2030

1445

def Disable(self):

2031

1446

"D-Bus method"

2032

1447

self.disable()

2033

1448

2034

1449

# StopChecker - method

2035

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2036

1450

@dbus.service.method(_interface)

2037

1451

def StopChecker(self):

2038

1452

self.stop_checker()

2039

2040

# Properties

2041

1453

1454

## Properties

1455

2042

1456

# ApprovalPending - property

2043

1457

@dbus_service_property(_interface, signature="b", access="read")

2044

1458

def ApprovalPending_dbus_property(self):

2045

1459

return dbus.Boolean(bool(self.approvals_pending))

2046

1460

2047

1461

# ApprovedByDefault - property

2048

@dbus_service_property(_interface,

2049

signature="b",

1462

@dbus_service_property(_interface, signature="b",

2050

1463

access="readwrite")

2051

1464

def ApprovedByDefault_dbus_property(self, value=None):

2052

1465

if value is None: # get

2053

1466

return dbus.Boolean(self.approved_by_default)

2054

1467

self.approved_by_default = bool(value)

2055

1468

2056

1469

# ApprovalDelay - property

2057

@dbus_service_property(_interface,

2058

signature="t",

1470

@dbus_service_property(_interface, signature="t",

2059

1471

access="readwrite")

2060

1472

def ApprovalDelay_dbus_property(self, value=None):

2061

1473

if value is None: # get

2062

return dbus.UInt64(self.approval_delay.total_seconds()

2063

* 1000)

1474

return dbus.UInt64(self.approval_delay_milliseconds())

2064

1475

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2065

1476

2066

1477

# ApprovalDuration - property

2067

@dbus_service_property(_interface,

2068

signature="t",

1478

@dbus_service_property(_interface, signature="t",

2069

1479

access="readwrite")

2070

1480

def ApprovalDuration_dbus_property(self, value=None):

2071

1481

if value is None: # get

2072

return dbus.UInt64(self.approval_duration.total_seconds()

2073

* 1000)

1482

return dbus.UInt64(timedelta_to_milliseconds(

1483

self.approval_duration))

2074

1484

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2075

1485

2076

1486

# Name - property

2077

@dbus_annotations(

2078

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2079

1487

@dbus_service_property(_interface, signature="s", access="read")

2080

1488

def Name_dbus_property(self):

2081

1489

return dbus.String(self.name)

2082

2083

# KeyID - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

@dbus_service_property(_interface, signature="s", access="read")

2087

def KeyID_dbus_property(self):

2088

return dbus.String(self.key_id)

2089

1490

2090

1491

# Fingerprint - property

2091

@dbus_annotations(

2092

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2093

1492

@dbus_service_property(_interface, signature="s", access="read")

2094

1493

def Fingerprint_dbus_property(self):

2095

1494

return dbus.String(self.fingerprint)

2096

1495

2097

1496

# Host - property

2098

@dbus_service_property(_interface,

2099

signature="s",

1497

@dbus_service_property(_interface, signature="s",

2100

1498

access="readwrite")

2101

1499

def Host_dbus_property(self, value=None):

2102

1500

if value is None: # get

2103

1501

return dbus.String(self.host)

2104

self.host = str(value)

2105

1502

self.host = unicode(value)

1503

2106

1504

# Created - property

2107

@dbus_annotations(

2108

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2109

1505

@dbus_service_property(_interface, signature="s", access="read")

2110

1506

def Created_dbus_property(self):

2111

1507

return datetime_to_dbus(self.created)

2112

1508

2113

1509

# LastEnabled - property

2114

1510

@dbus_service_property(_interface, signature="s", access="read")

2115

1511

def LastEnabled_dbus_property(self):

2116

1512

return datetime_to_dbus(self.last_enabled)

2117

1513

2118

1514

# Enabled - property

2119

@dbus_service_property(_interface,

2120

signature="b",

1515

@dbus_service_property(_interface, signature="b",

2121

1516

access="readwrite")

2122

1517

def Enabled_dbus_property(self, value=None):

2123

1518

if value is None: # get

2126

1521

self.enable()

2127

1522

else:

2128

1523

self.disable()

2129

1524

2130

1525

# LastCheckedOK - property

2131

@dbus_service_property(_interface,

2132

signature="s",

1526

@dbus_service_property(_interface, signature="s",

2133

1527

access="readwrite")

2134

1528

def LastCheckedOK_dbus_property(self, value=None):

2135

1529

if value is not None:

2136

1530

self.checked_ok()

2137

1531

return

2138

1532

return datetime_to_dbus(self.last_checked_ok)

2139

1533

2140

1534

# LastCheckerStatus - property

2141

@dbus_service_property(_interface, signature="n", access="read")

1535

@dbus_service_property(_interface, signature="n",

1536

access="read")

2142

1537

def LastCheckerStatus_dbus_property(self):

2143

1538

return dbus.Int16(self.last_checker_status)

2144

1539

2145

1540

# Expires - property

2146

1541

@dbus_service_property(_interface, signature="s", access="read")

2147

1542

def Expires_dbus_property(self):

2148

1543

return datetime_to_dbus(self.expires)

2149

1544

2150

1545

# LastApprovalRequest - property

2151

1546

@dbus_service_property(_interface, signature="s", access="read")

2152

1547

def LastApprovalRequest_dbus_property(self):

2153

1548

return datetime_to_dbus(self.last_approval_request)

2154

1549

2155

1550

# Timeout - property

2156

@dbus_service_property(_interface,

2157

signature="t",

1551

@dbus_service_property(_interface, signature="t",

2158

1552

access="readwrite")

2159

1553

def Timeout_dbus_property(self, value=None):

2160

1554

if value is None: # get

2161

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1555

return dbus.UInt64(self.timeout_milliseconds())

2162

1556

old_timeout = self.timeout

2163

1557

self.timeout = datetime.timedelta(0, 0, 0, value)

2164

1558

# Reschedule disabling

2172

1566

if (getattr(self, "disable_initiator_tag", None)

2173

1567

is None):

2174

1568

return

2175

GLib.source_remove(self.disable_initiator_tag)

2176

self.disable_initiator_tag = GLib.timeout_add(

2177

int((self.expires - now).total_seconds() * 1000),

2178

self.disable)

2179

1569

gobject.source_remove(self.disable_initiator_tag)

1570

self.disable_initiator_tag = (

1571

gobject.timeout_add(

1572

timedelta_to_milliseconds(self.expires - now),

1573

self.disable))

1574

2180

1575

# ExtendedTimeout - property

2181

@dbus_service_property(_interface,

2182

signature="t",

1576

@dbus_service_property(_interface, signature="t",

2183

1577

access="readwrite")

2184

1578

def ExtendedTimeout_dbus_property(self, value=None):

2185

1579

if value is None: # get

2186

return dbus.UInt64(self.extended_timeout.total_seconds()

2187

* 1000)

1580

return dbus.UInt64(self.extended_timeout_milliseconds())

2188

1581

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2189

1582

2190

1583

# Interval - property

2191

@dbus_service_property(_interface,

2192

signature="t",

1584

@dbus_service_property(_interface, signature="t",

2193

1585

access="readwrite")

2194

1586

def Interval_dbus_property(self, value=None):

2195

1587

if value is None: # get

2196

return dbus.UInt64(self.interval.total_seconds() * 1000)

1588

return dbus.UInt64(self.interval_milliseconds())

2197

1589

self.interval = datetime.timedelta(0, 0, 0, value)

2198

1590

if getattr(self, "checker_initiator_tag", None) is None:

2199

1591

return

2200

1592

if self.enabled:

2201

1593

# Reschedule checker run

2202

GLib.source_remove(self.checker_initiator_tag)

2203

self.checker_initiator_tag = GLib.timeout_add(

2204

value, self.start_checker)

2205

self.start_checker() # Start one now, too

2206

1594

gobject.source_remove(self.checker_initiator_tag)

1595

self.checker_initiator_tag = (gobject.timeout_add

1596

(value, self.start_checker))

1597

self.start_checker() # Start one now, too

1598

2207

1599

# Checker - property

2208

@dbus_service_property(_interface,

2209

signature="s",

1600

@dbus_service_property(_interface, signature="s",

2210

1601

access="readwrite")

2211

1602

def Checker_dbus_property(self, value=None):

2212

1603

if value is None: # get

2213

1604

return dbus.String(self.checker_command)

2214

self.checker_command = str(value)

2215

1605

self.checker_command = unicode(value)

1606

2216

1607

# CheckerRunning - property

2217

@dbus_service_property(_interface,

2218

signature="b",

1608

@dbus_service_property(_interface, signature="b",

2219

1609

access="readwrite")

2220

1610

def CheckerRunning_dbus_property(self, value=None):

2221

1611

if value is None: # get

2224

1614

self.start_checker()

2225

1615

else:

2226

1616

self.stop_checker()

2227

1617

2228

1618

# ObjectPath - property

2229

@dbus_annotations(

2230

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2231

"org.freedesktop.DBus.Deprecated": "true"})

2232

1619

@dbus_service_property(_interface, signature="o", access="read")

2233

1620

def ObjectPath_dbus_property(self):

2234

return self.dbus_object_path # is already a dbus.ObjectPath

2235

1621

return self.dbus_object_path # is already a dbus.ObjectPath

1622

2236

1623

# Secret = property

2237

@dbus_annotations(

2238

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2239

"invalidates"})

2240

@dbus_service_property(_interface,

2241

signature="ay",

2242

access="write",

2243

byte_arrays=True)

1624

@dbus_service_property(_interface, signature="ay",

1625

access="write", byte_arrays=True)

2244

1626

def Secret_dbus_property(self, value):

2245

self.secret = bytes(value)

2246

1627

self.secret = str(value)

1628

2247

1629

del _interface

2248

1630

2249

1631

2250

class ProxyClient:

2251

def __init__(self, child_pipe, key_id, fpr, address):

1632

class ProxyClient(object):

1633

def __init__(self, child_pipe, fpr, address):

2252

1634

self._pipe = child_pipe

2253

self._pipe.send(('init', key_id, fpr, address))

1635

self._pipe.send(('init', fpr, address))

2254

1636

if not self._pipe.recv():

2255

raise KeyError(key_id or fpr)

2256

1637

raise KeyError()

1638

2257

1639

def __getattribute__(self, name):

2258

1640

if name == '_pipe':

2259

1641

return super(ProxyClient, self).__getattribute__(name)

2262

1644

if data[0] == 'data':

2263

1645

return data[1]

2264

1646

if data[0] == 'function':

2265

2266

1647

def func(*args, **kwargs):

2267

1648

self._pipe.send(('funcall', name, args, kwargs))

2268

1649

return self._pipe.recv()[1]

2269

2270

1650

return func

2271

1651

2272

1652

def __setattr__(self, name, value):

2273

1653

if name == '_pipe':

2274

1654

return super(ProxyClient, self).__setattr__(name, value)

2277

1657

2278

1658

class ClientHandler(socketserver.BaseRequestHandler, object):

2279

1659

"""A class to handle client connections.

2280

1660

2281

1661

Instantiated once for each connection to handle it.

2282

1662

Note: This will run in its own forked process."""

2283

1663

2284

1664

def handle(self):

2285

1665

with contextlib.closing(self.server.child_pipe) as child_pipe:

2286

1666

logger.info("TCP connection from: %s",

2287

str(self.client_address))

1667

unicode(self.client_address))

2288

1668

logger.debug("Pipe FD: %d",

2289

1669

self.server.child_pipe.fileno())

2290

2291

session = gnutls.ClientSession(self.request)

2292

2293

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2294

# "+AES-256-CBC", "+SHA1",

2295

# "+COMP-NULL", "+CTYPE-OPENPGP",

2296

# "+DHE-DSS"))

1670

1671

session = (gnutls.connection

1672

.ClientSession(self.request,

1673

gnutls.connection

1674

.X509Credentials()))

1675

1676

# Note: gnutls.connection.X509Credentials is really a

1677

# generic GnuTLS certificate credentials object so long as

1678

# no X.509 keys are added to it. Therefore, we can use it

1679

# here despite using OpenPGP certificates.

1680

1681

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1682

# "+AES-256-CBC", "+SHA1",

1683

# "+COMP-NULL", "+CTYPE-OPENPGP",

1684

# "+DHE-DSS"))

2297

1685

# Use a fallback default, since this MUST be set.

2298

1686

priority = self.server.gnutls_priority

2299

1687

if priority is None:

2300

1688

priority = "NORMAL"

2301

gnutls.priority_set_direct(session._c_object,

2302

priority.encode("utf-8"),

2303

None)

2304

1689

(gnutls.library.functions

1690

.gnutls_priority_set_direct(session._c_object,

1691

priority, None))

1692

2305

1693

# Start communication using the Mandos protocol

2306

1694

# Get protocol number

2307

1695

line = self.request.makefile().readline()

2308

1696

logger.debug("Protocol version: %r", line)

2309

1697

try:

2310

1698

if int(line.strip().split()[0]) > 1:

2311

raise RuntimeError(line)

1699

raise RuntimeError

2312

1700

except (ValueError, IndexError, RuntimeError) as error:

2313

1701

logger.error("Unknown protocol version: %s", error)

2314

1702

return

2315

1703

2316

1704

# Start GnuTLS connection

2317

1705

try:

2318

1706

session.handshake()

2319

except gnutls.Error as error:

1707

except gnutls.errors.GNUTLSError as error:

2320

1708

logger.warning("Handshake failed: %s", error)

2321

1709

# Do not run session.bye() here: the session is not

2322

1710

# established. Just abandon the request.

2323

1711

return

2324

1712

logger.debug("Handshake succeeded")

2325

1713

2326

1714

approval_required = False

2327

1715

try:

2328

if gnutls.has_rawpk:

2329

fpr = b""

2330

try:

2331

key_id = self.key_id(

2332

self.peer_certificate(session))

2333

except (TypeError, gnutls.Error) as error:

2334

logger.warning("Bad certificate: %s", error)

2335

return

2336

logger.debug("Key ID: %s", key_id)

2337

2338

else:

2339

key_id = b""

2340

try:

2341

fpr = self.fingerprint(

2342

self.peer_certificate(session))

2343

except (TypeError, gnutls.Error) as error:

2344

logger.warning("Bad certificate: %s", error)

2345

return

2346

logger.debug("Fingerprint: %s", fpr)

2347

2348

try:

2349

client = ProxyClient(child_pipe, key_id, fpr,

1716

try:

1717

fpr = self.fingerprint(self.peer_certificate

1718

(session))

1719

except (TypeError,

1720

gnutls.errors.GNUTLSError) as error:

1721

logger.warning("Bad certificate: %s", error)

1722

return

1723

logger.debug("Fingerprint: %s", fpr)

1724

1725

try:

1726

client = ProxyClient(child_pipe, fpr,

2350

1727

self.client_address)

2351

1728

except KeyError:

2352

1729

return

2353

1730

2354

1731

if client.approval_delay:

2355

1732

delay = client.approval_delay

2356

1733

client.approvals_pending += 1

2357

1734

approval_required = True

2358

1735

2359

1736

while True:

2360

1737

if not client.enabled:

2361

1738

logger.info("Client %s is disabled",

2362

client.name)

1739

client.name)

2363

1740

if self.server.use_dbus:

2364

1741

# Emit D-Bus signal

2365

1742

client.Rejected("Disabled")

2366

1743

return

2367

1744

2368

1745

if client.approved or not client.approval_delay:

2369

# We are approved or approval is disabled

1746

#We are approved or approval is disabled

2370

1747

break

2371

1748

elif client.approved is None:

2372

1749

logger.info("Client %s needs approval",

2374

1751

if self.server.use_dbus:

2375

1752

# Emit D-Bus signal

2376

1753

client.NeedApproval(

2377

client.approval_delay.total_seconds()

2378

* 1000, client.approved_by_default)

1754

client.approval_delay_milliseconds(),

1755

client.approved_by_default)

2379

1756

else:

2380

1757

logger.warning("Client %s was not approved",

2381

1758

client.name)

2383

1760

# Emit D-Bus signal

2384

1761

client.Rejected("Denied")

2385

1762

return

2386

2387

# wait until timeout or approved

1763

1764

#wait until timeout or approved

2388

1765

time = datetime.datetime.now()

2389

1766

client.changedstate.acquire()

2390

client.changedstate.wait(delay.total_seconds())

1767

client.changedstate.wait(

1768

float(timedelta_to_milliseconds(delay)

1769

/ 1000))

2391

1770

client.changedstate.release()

2392

1771

time2 = datetime.datetime.now()

2393

1772

if (time2 - time) >= delay:

2403

1782

break

2404

1783

else:

2405

1784

delay -= time2 - time

2406

2407

try:

2408

session.send(client.secret)

2409

except gnutls.Error as error:

2410

logger.warning("gnutls send failed",

2411

exc_info=error)

2412

return

2413

1785

1786

sent_size = 0

1787

while sent_size < len(client.secret):

1788

try:

1789

sent = session.send(client.secret[sent_size:])

1790

except gnutls.errors.GNUTLSError as error:

1791

logger.warning("gnutls send failed",

1792

exc_info=error)

1793

return

1794

logger.debug("Sent: %d, remaining: %d",

1795

sent, len(client.secret)

1796

- (sent_size + sent))

1797

sent_size += sent

1798

2414

1799

logger.info("Sending secret to %s", client.name)

2415

1800

# bump the timeout using extended_timeout

2416

1801

client.bump_timeout(client.extended_timeout)

2417

1802

if self.server.use_dbus:

2418

1803

# Emit D-Bus signal

2419

1804

client.GotSecret()

2420

1805

2421

1806

finally:

2422

1807

if approval_required:

2423

1808

client.approvals_pending -= 1

2424

1809

try:

2425

1810

session.bye()

2426

except gnutls.Error as error:

1811

except gnutls.errors.GNUTLSError as error:

2427

1812

logger.warning("GnuTLS bye failed",

2428

1813

exc_info=error)

2429

1814

2430

1815

@staticmethod

2431

1816

def peer_certificate(session):

2432

"Return the peer's certificate as a bytestring"

2433

try:

2434

cert_type = gnutls.certificate_type_get2(session._c_object,

2435

gnutls.CTYPE_PEERS)

2436

except AttributeError:

2437

cert_type = gnutls.certificate_type_get(session._c_object)

2438

if gnutls.has_rawpk:

2439

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2440

else:

2441

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2442

# If not a valid certificate type...

2443

if cert_type not in valid_cert_types:

2444

logger.info("Cert type %r not in %r", cert_type,

2445

valid_cert_types)

2446

# ...return invalid data

2447

return b""

1817

"Return the peer's OpenPGP certificate as a bytestring"

1818

# If not an OpenPGP certificate...

1819

if (gnutls.library.functions

1820

.gnutls_certificate_type_get(session._c_object)

1821

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1822

# ...do the normal thing

1823

return session.peer_certificate

2448

1824

list_size = ctypes.c_uint(1)

2449

cert_list = (gnutls.certificate_get_peers

1825

cert_list = (gnutls.library.functions

1826

.gnutls_certificate_get_peers

2450

1827

(session._c_object, ctypes.byref(list_size)))

2451

1828

if not bool(cert_list) and list_size.value != 0:

2452

raise gnutls.Error("error getting peer certificate")

1829

raise gnutls.errors.GNUTLSError("error getting peer"

1830

" certificate")

2453

1831

if list_size.value == 0:

2454

1832

return None

2455

1833

cert = cert_list[0]

2456

1834

return ctypes.string_at(cert.data, cert.size)

2457

2458

@staticmethod

2459

def key_id(certificate):

2460

"Convert a certificate bytestring to a hexdigit key ID"

2461

# New GnuTLS "datum" with the public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(certificate),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(certificate)))

2466

# XXX all these need to be created in the gnutls "module"

2467

# New empty GnuTLS certificate

2468

pubkey = gnutls.pubkey_t()

2469

gnutls.pubkey_init(ctypes.byref(pubkey))

2470

# Import the raw public key into the certificate

2471

gnutls.pubkey_import(pubkey,

2472

ctypes.byref(datum),

2473

gnutls.X509_FMT_DER)

2474

# New buffer for the key ID

2475

buf = ctypes.create_string_buffer(32)

2476

buf_len = ctypes.c_size_t(len(buf))

2477

# Get the key ID from the raw public key into the buffer

2478

gnutls.pubkey_get_key_id(

2479

pubkey,

2480

gnutls.KEYID_USE_SHA256,

2481

ctypes.cast(ctypes.byref(buf),

2482

ctypes.POINTER(ctypes.c_ubyte)),

2483

ctypes.byref(buf_len))

2484

# Deinit the certificate

2485

gnutls.pubkey_deinit(pubkey)

2486

2487

# Convert the buffer to a Python bytestring

2488

key_id = ctypes.string_at(buf, buf_len.value)

2489

# Convert the bytestring to hexadecimal notation

2490

hex_key_id = binascii.hexlify(key_id).upper()

2491

return hex_key_id

2492

1835

2493

1836

@staticmethod

2494

1837

def fingerprint(openpgp):

2495

1838

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2496

1839

# New GnuTLS "datum" with the OpenPGP public key

2497

datum = gnutls.datum_t(

2498

ctypes.cast(ctypes.c_char_p(openpgp),

2499

ctypes.POINTER(ctypes.c_ubyte)),

2500

ctypes.c_uint(len(openpgp)))

1840

datum = (gnutls.library.types

1841

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1842

ctypes.POINTER

1843

(ctypes.c_ubyte)),

1844

ctypes.c_uint(len(openpgp))))

2501

1845

# New empty GnuTLS certificate

2502

crt = gnutls.openpgp_crt_t()

2503

gnutls.openpgp_crt_init(ctypes.byref(crt))

1846

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1847

(gnutls.library.functions

1848

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2504

1849

# Import the OpenPGP public key into the certificate

2505

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2506

gnutls.OPENPGP_FMT_RAW)

1850

(gnutls.library.functions

1851

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1852

gnutls.library.constants

1853

.GNUTLS_OPENPGP_FMT_RAW))

2507

1854

# Verify the self signature in the key

2508

1855

crtverify = ctypes.c_uint()

2509

gnutls.openpgp_crt_verify_self(crt, 0,

2510

ctypes.byref(crtverify))

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_verify_self(crt, 0,

1858

ctypes.byref(crtverify)))

2511

1859

if crtverify.value != 0:

2512

gnutls.openpgp_crt_deinit(crt)

2513

raise gnutls.CertificateSecurityError(code

2514

=crtverify.value)

1860

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1861

raise (gnutls.errors.CertificateSecurityError

1862

("Verify failed"))

2515

1863

# New buffer for the fingerprint

2516

1864

buf = ctypes.create_string_buffer(20)

2517

1865

buf_len = ctypes.c_size_t()

2518

1866

# Get the fingerprint from the certificate into the buffer

2519

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2520

ctypes.byref(buf_len))

1867

(gnutls.library.functions

1868

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1869

ctypes.byref(buf_len)))

2521

1870

# Deinit the certificate

2522

gnutls.openpgp_crt_deinit(crt)

1871

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2523

1872

# Convert the buffer to a Python bytestring

2524

1873

fpr = ctypes.string_at(buf, buf_len.value)

2525

1874

# Convert the bytestring to hexadecimal notation

2527

1876

return hex_fpr

2528

1877

2529

1878

2530

class MultiprocessingMixIn:

1879

class MultiprocessingMixIn(object):

2531

1880

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2532

2533

1881

def sub_process_main(self, request, address):

2534

1882

try:

2535

1883

self.finish_request(request, address)

2536

1884

except Exception:

2537

1885

self.handle_error(request, address)

2538

1886

self.close_request(request)

2539

1887

2540

1888

def process_request(self, request, address):

2541

1889

"""Start a new process to process the request."""

2542

proc = multiprocessing.Process(target=self.sub_process_main,

2543

args=(request, address))

1890

proc = multiprocessing.Process(target = self.sub_process_main,

1891

args = (request, address))

2544

1892

proc.start()

2545

1893

return proc

2546

1894

2547

1895

2548

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1896

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2549

1897

""" adds a pipe to the MixIn """

2550

2551

1898

def process_request(self, request, client_address):

2552

1899

"""Overrides and wraps the original process_request().

2553

1900

2554

1901

This function creates a new pipe in self.pipe

2555

1902

"""

2556

1903

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2557

1904

2558

1905

proc = MultiprocessingMixIn.process_request(self, request,

2559

1906

client_address)

2560

1907

self.child_pipe.close()

2561

1908

self.add_pipe(parent_pipe, proc)

2562

1909

2563

1910

def add_pipe(self, parent_pipe, proc):

2564

1911

"""Dummy function; override as necessary"""

2565

raise NotImplementedError()

1912

raise NotImplementedError

2566

1913

2567

1914

2568

1915

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2569

socketserver.TCPServer):

1916

socketserver.TCPServer, object):

2570

1917

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2571

1918

2572

1919

Attributes:

2573

1920

enabled: Boolean; whether this server is activated yet

2574

1921

interface: None or a network interface name (string)

2575

1922

use_ipv6: Boolean; to use IPv6 or not

2576

1923

"""

2577

2578

1924

def __init__(self, server_address, RequestHandlerClass,

2579

interface=None,

2580

use_ipv6=True,

2581

socketfd=None):

1925

interface=None, use_ipv6=True, socketfd=None):

2582

1926

"""If socketfd is set, use that file descriptor instead of

2583

1927

creating a new one with socket.socket().

2584

1928

"""

2590

1934

self.socketfd = socketfd

2591

1935

# Save the original socket.socket() function

2592

1936

self.socket_socket = socket.socket

2593

2594

1937

# To implement --socket, we monkey patch socket.socket.

2595

#

1938

#

2596

1939

# (When socketserver.TCPServer is a new-style class, we

2597

1940

# could make self.socket into a property instead of monkey

2598

1941

# patching socket.socket.)

2599

#

1942

#

2600

1943

# Create a one-time-only replacement for socket.socket()

2601

1944

@functools.wraps(socket.socket)

2602

1945

def socket_wrapper(*args, **kwargs):

2614

1957

# socket_wrapper(), if socketfd was set.

2615

1958

socketserver.TCPServer.__init__(self, server_address,

2616

1959

RequestHandlerClass)

2617

1960

2618

1961

def server_bind(self):

2619

1962

"""This overrides the normal server_bind() function

2620

1963

to bind to an interface if one was specified, and also NOT to

2621

1964

bind to an address or port if they were not specified."""

2622

global SO_BINDTODEVICE

2623

1965

if self.interface is not None:

2624

1966

if SO_BINDTODEVICE is None:

2625

# Fall back to a hard-coded value which seems to be

2626

# common enough.

2627

logger.warning("SO_BINDTODEVICE not found, trying 25")

2628

SO_BINDTODEVICE = 25

2629

try:

2630

self.socket.setsockopt(

2631

socket.SOL_SOCKET, SO_BINDTODEVICE,

2632

(self.interface + "\0").encode("utf-8"))

2633

except socket.error as error:

2634

if error.errno == errno.EPERM:

2635

logger.error("No permission to bind to"

2636

" interface %s", self.interface)

2637

elif error.errno == errno.ENOPROTOOPT:

2638

logger.error("SO_BINDTODEVICE not available;"

2639

" cannot bind to interface %s",

2640

self.interface)

2641

elif error.errno == errno.ENODEV:

2642

logger.error("Interface %s does not exist,"

2643

" cannot bind", self.interface)

2644

else:

2645

raise

1967

logger.error("SO_BINDTODEVICE does not exist;"

1968

" cannot bind to interface %s",

1969

self.interface)

1970

else:

1971

try:

1972

self.socket.setsockopt(socket.SOL_SOCKET,

1973

SO_BINDTODEVICE,

1974

str(self.interface + '\0'))

1975

except socket.error as error:

1976

if error.errno == errno.EPERM:

1977

logger.error("No permission to bind to"

1978

" interface %s", self.interface)

1979

elif error.errno == errno.ENOPROTOOPT:

1980

logger.error("SO_BINDTODEVICE not available;"

1981

" cannot bind to interface %s",

1982

self.interface)

1983

elif error.errno == errno.ENODEV:

1984

logger.error("Interface %s does not exist,"

1985

" cannot bind", self.interface)

1986

else:

1987

raise

2646

1988

# Only bind(2) the socket if we really need to.

2647

1989

if self.server_address[0] or self.server_address[1]:

2648

if self.server_address[1]:

2649

self.allow_reuse_address = True

2650

1990

if not self.server_address[0]:

2651

1991

if self.address_family == socket.AF_INET6:

2652

any_address = "::" # in6addr_any

1992

any_address = "::" # in6addr_any

2653

1993

else:

2654

any_address = "0.0.0.0" # INADDR_ANY

1994

any_address = "0.0.0.0" # INADDR_ANY

2655

1995

self.server_address = (any_address,

2656

1996

self.server_address[1])

2657

1997

elif not self.server_address[1]:

2658

self.server_address = (self.server_address[0], 0)

1998

self.server_address = (self.server_address[0],

1999

0)

2659

2000

# if self.interface:

2660

2001

# self.server_address = (self.server_address[0],

2661

2002

# 0, # port

2667

2008

2668

2009

class MandosServer(IPv6_TCPServer):

2669

2010

"""Mandos server.

2670

2011

2671

2012

Attributes:

2672

2013

clients: set of Client objects

2673

2014

gnutls_priority GnuTLS priority string

2674

2015

use_dbus: Boolean; to emit D-Bus signals or not

2675

2676

Assumes a GLib.MainLoop event loop.

2016

2017

Assumes a gobject.MainLoop event loop.

2677

2018

"""

2678

2679

2019

def __init__(self, server_address, RequestHandlerClass,

2680

interface=None,

2681

use_ipv6=True,

2682

clients=None,

2683

gnutls_priority=None,

2684

use_dbus=True,

2685

socketfd=None):

2020

interface=None, use_ipv6=True, clients=None,

2021

gnutls_priority=None, use_dbus=True, socketfd=None):

2686

2022

self.enabled = False

2687

2023

self.clients = clients

2688

2024

if self.clients is None:

2691

2027

self.gnutls_priority = gnutls_priority

2692

2028

IPv6_TCPServer.__init__(self, server_address,

2693

2029

RequestHandlerClass,

2694

interface=interface,

2695

use_ipv6=use_ipv6,

2696

socketfd=socketfd)

2697

2030

interface = interface,

2031

use_ipv6 = use_ipv6,

2032

socketfd = socketfd)

2698

2033

def server_activate(self):

2699

2034

if self.enabled:

2700

2035

return socketserver.TCPServer.server_activate(self)

2701

2036

2702

2037

def enable(self):

2703

2038

self.enabled = True

2704

2039

2705

2040

def add_pipe(self, parent_pipe, proc):

2706

2041

# Call "handle_ipc" for both data and EOF events

2707

GLib.io_add_watch(

2708

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2709

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2710

functools.partial(self.handle_ipc,

2711

parent_pipe=parent_pipe,

2712

proc=proc))

2713

2714

def handle_ipc(self, source, condition,

2715

parent_pipe=None,

2716

proc=None,

2717

client_object=None):

2042

gobject.io_add_watch(parent_pipe.fileno(),

2043

gobject.IO_IN | gobject.IO_HUP,

2044

functools.partial(self.handle_ipc,

2045

parent_pipe =

2046

parent_pipe,

2047

proc = proc))

2048

2049

def handle_ipc(self, source, condition, parent_pipe=None,

2050

proc = None, client_object=None):

2718

2051

# error, or the other end of multiprocessing.Pipe has closed

2719

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2052

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2720

2053

# Wait for other process to exit

2721

2054

proc.join()

2722

2055

return False

2723

2056

2724

2057

# Read a request from the child

2725

2058

request = parent_pipe.recv()

2726

2059

command = request[0]

2727

2060

2728

2061

if command == 'init':

2729

key_id = request[1].decode("ascii")

2730

fpr = request[2].decode("ascii")

2731

address = request[3]

2732

2733

for c in self.clients.values():

2734

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2735

"27AE41E4649B934CA495991B7852B855"):

2736

continue

2737

if key_id and c.key_id == key_id:

2738

client = c

2739

break

2740

if fpr and c.fingerprint == fpr:

2062

fpr = request[1]

2063

address = request[2]

2064

2065

for c in self.clients.itervalues():

2066

if c.fingerprint == fpr:

2741

2067

client = c

2742

2068

break

2743

2069

else:

2744

logger.info("Client not found for key ID: %s, address"

2745

": %s", key_id or fpr, address)

2070

logger.info("Client not found for fingerprint: %s, ad"

2071

"dress: %s", fpr, address)

2746

2072

if self.use_dbus:

2747

2073

# Emit D-Bus signal

2748

mandos_dbus_service.ClientNotFound(key_id or fpr,

2074

mandos_dbus_service.ClientNotFound(fpr,

2749

2075

address[0])

2750

2076

parent_pipe.send(False)

2751

2077

return False

2752

2753

GLib.io_add_watch(

2754

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2755

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2756

functools.partial(self.handle_ipc,

2757

parent_pipe=parent_pipe,

2758

proc=proc,

2759

client_object=client))

2078

2079

gobject.io_add_watch(parent_pipe.fileno(),

2080

gobject.IO_IN | gobject.IO_HUP,

2081

functools.partial(self.handle_ipc,

2082

parent_pipe =

2083

parent_pipe,

2084

proc = proc,

2085

client_object =

2086

client))

2760

2087

parent_pipe.send(True)

2761

2088

# remove the old hook in favor of the new above hook on

2762

2089

# same fileno

2765

2092

funcname = request[1]

2766

2093

args = request[2]

2767

2094

kwargs = request[3]

2768

2095

2769

2096

parent_pipe.send(('data', getattr(client_object,

2770

2097

funcname)(*args,

2771

**kwargs)))

2772

2098

**kwargs)))

2099

2773

2100

if command == 'getattr':

2774

2101

attrname = request[1]

2775

if isinstance(client_object.__getattribute__(attrname),

2776

collections.abc.Callable):

2777

parent_pipe.send(('function', ))

2102

if callable(client_object.__getattribute__(attrname)):

2103

parent_pipe.send(('function',))

2778

2104

else:

2779

parent_pipe.send((

2780

'data', client_object.__getattribute__(attrname)))

2781

2105

parent_pipe.send(('data', client_object

2106

.__getattribute__(attrname)))

2107

2782

2108

if command == 'setattr':

2783

2109

attrname = request[1]

2784

2110

value = request[2]

2785

2111

setattr(client_object, attrname, value)

2786

2112

2787

2113

return True

2788

2114

2789

2115

2790

2116

def rfc3339_duration_to_delta(duration):

2791

2117

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2792

2793

>>> timedelta = datetime.timedelta

2794

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2795

True

2796

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2797

True

2798

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2799

True

2800

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2801

True

2802

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2803

True

2804

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2805

True

2806

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2807

True

2808

>>> del timedelta

2118

2119

>>> rfc3339_duration_to_delta("P7D")

2120

datetime.timedelta(7)

2121

>>> rfc3339_duration_to_delta("PT60S")

2122

datetime.timedelta(0, 60)

2123

>>> rfc3339_duration_to_delta("PT60M")

2124

datetime.timedelta(0, 3600)

2125

>>> rfc3339_duration_to_delta("PT24H")

2126

datetime.timedelta(1)

2127

>>> rfc3339_duration_to_delta("P1W")

2128

datetime.timedelta(7)

2129

>>> rfc3339_duration_to_delta("PT5M30S")

2130

datetime.timedelta(0, 330)

2131

>>> rfc3339_duration_to_delta("P1DT3M20S")

2132

datetime.timedelta(1, 200)

2809

2133

"""

2810

2134

2811

2135

# Parsing an RFC 3339 duration with regular expressions is not

2812

2136

# possible - there would have to be multiple places for the same

2813

2137

# values, like seconds. The current code, while more esoteric, is

2814

2138

# cleaner without depending on a parsing library. If Python had a

2815

2139

# built-in library for parsing we would use it, but we'd like to

2816

2140

# avoid excessive use of external libraries.

2817

2141

2818

2142

# New type for defining tokens, syntax, and semantics all-in-one

2819

Token = collections.namedtuple("Token", (

2820

"regexp", # To match token; if "value" is not None, must have

2821

# a "group" containing digits

2822

"value", # datetime.timedelta or None

2823

"followers")) # Tokens valid after this token

2143

Token = collections.namedtuple("Token",

2144

("regexp", # To match token; if

2145

# "value" is not None,

2146

# must have a "group"

2147

# containing digits

2148

"value", # datetime.timedelta or

2149

# None

2150

"followers")) # Tokens valid after

2151

# this token

2824

2152

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2825

2153

# the "duration" ABNF definition in RFC 3339, Appendix A.

2826

2154

token_end = Token(re.compile(r"$"), None, frozenset())

2827

2155

token_second = Token(re.compile(r"(\d+)S"),

2828

2156

datetime.timedelta(seconds=1),

2829

frozenset((token_end, )))

2157

frozenset((token_end,)))

2830

2158

token_minute = Token(re.compile(r"(\d+)M"),

2831

2159

datetime.timedelta(minutes=1),

2832

2160

frozenset((token_second, token_end)))

2848

2176

frozenset((token_month, token_end)))

2849

2177

token_week = Token(re.compile(r"(\d+)W"),

2850

2178

datetime.timedelta(weeks=1),

2851

frozenset((token_end, )))

2179

frozenset((token_end,)))

2852

2180

token_duration = Token(re.compile(r"P"), None,

2853

2181

frozenset((token_year, token_month,

2854

2182

token_day, token_time,

2855

token_week)))

2856

# Define starting values:

2857

# Value so far

2858

value = datetime.timedelta()

2183

token_week))),

2184

# Define starting values

2185

value = datetime.timedelta() # Value so far

2859

2186

found_token = None

2860

# Following valid tokens

2861

followers = frozenset((token_duration, ))

2862

# String left to parse

2863

s = duration

2187

followers = frozenset(token_duration,) # Following valid tokens

2188

s = duration # String left to parse

2864

2189

# Loop until end token is found

2865

2190

while found_token is not token_end:

2866

2191

# Search for any currently valid tokens

2882

2207

break

2883

2208

else:

2884

2209

# No currently valid tokens were found

2885

raise ValueError("Invalid RFC 3339 duration: {!r}"

2886

.format(duration))

2210

raise ValueError("Invalid RFC 3339 duration")

2887

2211

# End token found

2888

2212

return value

2889

2213

2890

2214

2891

2215

def string_to_delta(interval):

2892

2216

"""Parse a string and return a datetime.timedelta

2893

2894

>>> string_to_delta('7d') == datetime.timedelta(7)

2895

True

2896

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2897

True

2898

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2899

True

2900

>>> string_to_delta('24h') == datetime.timedelta(1)

2901

True

2902

>>> string_to_delta('1w') == datetime.timedelta(7)

2903

True

2904

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2905

True

2217

2218

>>> string_to_delta('7d')

2219

datetime.timedelta(7)

2220

>>> string_to_delta('60s')

2221

datetime.timedelta(0, 60)

2222

>>> string_to_delta('60m')

2223

datetime.timedelta(0, 3600)

2224

>>> string_to_delta('24h')

2225

datetime.timedelta(1)

2226

>>> string_to_delta('1w')

2227

datetime.timedelta(7)

2228

>>> string_to_delta('5m 30s')

2229

datetime.timedelta(0, 330)

2906

2230

"""

2907

2231

2908

2232

try:

2909

2233

return rfc3339_duration_to_delta(interval)

2910

2234

except ValueError:

2911

2235

pass

2912

2236

2913

2237

timevalue = datetime.timedelta(0)

2914

2238

for s in interval.split():

2915

2239

try:

2916

suffix = s[-1]

2240

suffix = unicode(s[-1])

2917

2241

value = int(s[:-1])

2918

2242

if suffix == "d":

2919

2243

delta = datetime.timedelta(value)

2926

2250

elif suffix == "w":

2927

2251

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2928

2252

else:

2929

raise ValueError("Unknown suffix {!r}".format(suffix))

2930

except IndexError as e:

2253

raise ValueError("Unknown suffix {0!r}"

2254

.format(suffix))

2255

except (ValueError, IndexError) as e:

2931

2256

raise ValueError(*(e.args))

2932

2257

timevalue += delta

2933

2258

return timevalue

2934

2259

2935

2260

2936

def daemon(nochdir=False, noclose=False):

2261

def daemon(nochdir = False, noclose = False):

2937

2262

"""See daemon(3). Standard BSD Unix function.

2938

2263

2939

2264

This should really exist as os.daemon, but it doesn't (yet)."""

2940

2265

if os.fork():

2941

2266

sys.exit()

2949

2274

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2950

2275

if not stat.S_ISCHR(os.fstat(null).st_mode):

2951

2276

raise OSError(errno.ENODEV,

2952

"{} not a character device"

2277

"{0} not a character device"

2953

2278

.format(os.devnull))

2954

2279

os.dup2(null, sys.stdin.fileno())

2955

2280

os.dup2(null, sys.stdout.fileno())

2959

2284

2960

2285

2961

2286

def main():

2962

2287

2963

2288

##################################################################

2964

2289

# Parsing of options, both command line and config file

2965

2290

2966

2291

parser = argparse.ArgumentParser()

2967

2292

parser.add_argument("-v", "--version", action="version",

2968

version="%(prog)s {}".format(version),

2293

version = "%(prog)s {0}".format(version),

2969

2294

help="show version number and exit")

2970

2295

parser.add_argument("-i", "--interface", metavar="IF",

2971

2296

help="Bind to interface IF")

3004

2329

help="Directory to save/restore state in")

3005

2330

parser.add_argument("--foreground", action="store_true",

3006

2331

help="Run in foreground", default=None)

3007

parser.add_argument("--no-zeroconf", action="store_false",

3008

dest="zeroconf", help="Do not use Zeroconf",

3009

default=None)

3010

2332

3011

2333

options = parser.parse_args()

3012

2334

2335

if options.check:

2336

import doctest

2337

doctest.testmod()

2338

sys.exit()

2339

3013

2340

# Default values for config file for server-global settings

3014

if gnutls.has_rawpk:

3015

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3016

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3017

else:

3018

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3019

":+SIGN-DSA-SHA256")

3020

server_defaults = {"interface": "",

3021

"address": "",

3022

"port": "",

3023

"debug": "False",

3024

"priority": priority,

3025

"servicename": "Mandos",

3026

"use_dbus": "True",

3027

"use_ipv6": "True",

3028

"debuglevel": "",

3029

"restore": "True",

3030

"socket": "",

3031

"statedir": "/var/lib/mandos",

3032

"foreground": "False",

3033

"zeroconf": "True",

3034

}

3035

del priority

3036

2341

server_defaults = { "interface": "",

2342

"address": "",

2343

"port": "",

2344

"debug": "False",

2345

"priority":

2346

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",

2347

"servicename": "Mandos",

2348

"use_dbus": "True",

2349

"use_ipv6": "True",

2350

"debuglevel": "",

2351

"restore": "True",

2352

"socket": "",

2353

"statedir": "/var/lib/mandos",

2354

"foreground": "False",

2355

}

2356

3037

2357

# Parse config file for server-global settings

3038

server_config = configparser.ConfigParser(server_defaults)

2358

server_config = configparser.SafeConfigParser(server_defaults)

3039

2359

del server_defaults

3040

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3041

# Convert the ConfigParser object to a dict

2360

server_config.read(os.path.join(options.configdir,

2361

"mandos.conf"))

2362

# Convert the SafeConfigParser object to a dict

3042

2363

server_settings = server_config.defaults()

3043

2364

# Use the appropriate methods on the non-string config options

3044

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3045

"foreground", "zeroconf"):

2365

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3046

2366

server_settings[option] = server_config.getboolean("DEFAULT",

3047

2367

option)

3048

2368

if server_settings["port"]:

3058

2378

server_settings["socket"] = os.dup(server_settings

3059

2379

["socket"])

3060

2380

del server_config

3061

2381

3062

2382

# Override the settings from the config file with command line

3063

2383

# options, if set.

3064

2384

for option in ("interface", "address", "port", "debug",

3065

"priority", "servicename", "configdir", "use_dbus",

3066

"use_ipv6", "debuglevel", "restore", "statedir",

3067

"socket", "foreground", "zeroconf"):

2385

"priority", "servicename", "configdir",

2386

"use_dbus", "use_ipv6", "debuglevel", "restore",

2387

"statedir", "socket", "foreground"):

3068

2388

value = getattr(options, option)

3069

2389

if value is not None:

3070

2390

server_settings[option] = value

3071

2391

del options

3072

2392

# Force all strings to be unicode

3073

2393

for option in server_settings.keys():

3074

if isinstance(server_settings[option], bytes):

3075

server_settings[option] = (server_settings[option]

3076

.decode("utf-8"))

2394

if type(server_settings[option]) is str:

2395

server_settings[option] = unicode(server_settings[option])

3077

2396

# Force all boolean options to be boolean

3078

2397

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3079

"foreground", "zeroconf"):

2398

"foreground"):

3080

2399

server_settings[option] = bool(server_settings[option])

3081

2400

# Debug implies foreground

3082

2401

if server_settings["debug"]:

3083

2402

server_settings["foreground"] = True

3084

2403

# Now we have our good server settings in "server_settings"

3085

2404

3086

2405

##################################################################

3087

3088

if (not server_settings["zeroconf"]

3089

and not (server_settings["port"]

3090

or server_settings["socket"] != "")):

3091

parser.error("Needs port or socket to work without Zeroconf")

3092

2406

3093

2407

# For convenience

3094

2408

debug = server_settings["debug"]

3095

2409

debuglevel = server_settings["debuglevel"]

3098

2412

stored_state_path = os.path.join(server_settings["statedir"],

3099

2413

stored_state_file)

3100

2414

foreground = server_settings["foreground"]

3101

zeroconf = server_settings["zeroconf"]

3102

2415

3103

2416

if debug:

3104

2417

initlogger(debug, logging.DEBUG)

3105

2418

else:

3108

2421

else:

3109

2422

level = getattr(logging, debuglevel.upper())

3110

2423

initlogger(debug, level)

3111

2424

3112

2425

if server_settings["servicename"] != "Mandos":

3113

syslogger.setFormatter(

3114

logging.Formatter('Mandos ({}) [%(process)d]:'

3115

' %(levelname)s: %(message)s'.format(

3116

server_settings["servicename"])))

3117

2426

syslogger.setFormatter(logging.Formatter

2427

('Mandos ({0}) [%(process)d]:'

2428

' %(levelname)s: %(message)s'

2429

.format(server_settings

2430

["servicename"])))

2431

3118

2432

# Parse config file with clients

3119

client_config = configparser.ConfigParser(Client.client_defaults)

2433

client_config = configparser.SafeConfigParser(Client

2434

.client_defaults)

3120

2435

client_config.read(os.path.join(server_settings["configdir"],

3121

2436

"clients.conf"))

3122

2437

3123

2438

global mandos_dbus_service

3124

2439

mandos_dbus_service = None

3125

3126

socketfd = None

3127

if server_settings["socket"] != "":

3128

socketfd = server_settings["socket"]

3129

tcp_server = MandosServer(

3130

(server_settings["address"], server_settings["port"]),

3131

ClientHandler,

3132

interface=(server_settings["interface"] or None),

3133

use_ipv6=use_ipv6,

3134

gnutls_priority=server_settings["priority"],

3135

use_dbus=use_dbus,

3136

socketfd=socketfd)

2440

2441

tcp_server = MandosServer((server_settings["address"],

2442

server_settings["port"]),

2443

ClientHandler,

2444

interface=(server_settings["interface"]

2445

or None),

2446

use_ipv6=use_ipv6,

2447

gnutls_priority=

2448

server_settings["priority"],

2449

use_dbus=use_dbus,

2450

socketfd=(server_settings["socket"]

2451

or None))

3137

2452

if not foreground:

3138

2453

pidfilename = "/run/mandos.pid"

3139

if not os.path.isdir("/run/."):

3140

pidfilename = "/var/run/mandos.pid"

3141

2454

pidfile = None

3142

2455

try:

3143

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2456

pidfile = open(pidfilename, "w")

3144

2457

except IOError as e:

3145

2458

logger.error("Could not open file %r", pidfilename,

3146

2459

exc_info=e)

3147

3148

for name, group in (("_mandos", "_mandos"),

3149

("mandos", "mandos"),

3150

("nobody", "nogroup")):

2460

2461

for name in ("_mandos", "mandos", "nobody"):

3151

2462

try:

3152

2463

uid = pwd.getpwnam(name).pw_uid

3153

gid = pwd.getpwnam(group).pw_gid

2464

gid = pwd.getpwnam(name).pw_gid

3154

2465

break

3155

2466

except KeyError:

3156

2467

continue

3160

2471

try:

3161

2472

os.setgid(gid)

3162

2473

os.setuid(uid)

3163

if debug:

3164

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3165

gid))

3166

2474

except OSError as error:

3167

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3168

.format(uid, gid, os.strerror(error.errno)))

3169

2475

if error.errno != errno.EPERM:

3170

raise

3171

2476

raise error

2477

3172

2478

if debug:

3173

2479

# Enable all possible GnuTLS debugging

3174

2480

3175

2481

# "Use a log level over 10 to enable all debugging options."

3176

2482

# - GnuTLS manual

3177

gnutls.global_set_log_level(11)

3178

3179

@gnutls.log_func

2483

gnutls.library.functions.gnutls_global_set_log_level(11)

2484

2485

@gnutls.library.types.gnutls_log_func

3180

2486

def debug_gnutls(level, string):

3181

2487

logger.debug("GnuTLS: %s", string[:-1])

3182

3183

gnutls.global_set_log_function(debug_gnutls)

3184

2488

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2491

3185

2492

# Redirect stdin so all checkers get /dev/null

3186

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3187

2494

os.dup2(null, sys.stdin.fileno())

3188

2495

if null > 2:

3189

2496

os.close(null)

3190

2497

3191

2498

# Need to fork before connecting to D-Bus

3192

2499

if not foreground:

3193

2500

# Close all input and output, do double fork, etc.

3194

2501

daemon()

3195

3196

if gi.version_info < (3, 10, 2):

3197

# multiprocessing will use threads, so before we use GLib we

3198

# need to inform GLib that threads will be used.

3199

GLib.threads_init()

3200

2502

2503

# multiprocessing will use threads, so before we use gobject we

2504

# need to inform gobject that threads will be used.

2505

gobject.threads_init()

2506

3201

2507

global main_loop

3202

2508

# From the Avahi example code

3203

2509

DBusGMainLoop(set_as_default=True)

3204

main_loop = GLib.MainLoop()

2510

main_loop = gobject.MainLoop()

3205

2511

bus = dbus.SystemBus()

3206

2512

# End of Avahi example code

3207

2513

if use_dbus:

3208

2514

try:

3209

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

3210

bus,

3211

do_not_queue=True)

3212

old_bus_name = dbus.service.BusName(

3213

"se.bsnet.fukt.Mandos", bus,

3214

do_not_queue=True)

3215

except dbus.exceptions.DBusException as e:

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

3216

2521

logger.error("Disabling D-Bus:", exc_info=e)

3217

2522

use_dbus = False

3218

2523

server_settings["use_dbus"] = False

3219

2524

tcp_server.use_dbus = False

3220

if zeroconf:

3221

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3222

service = AvahiServiceToSyslog(

3223

name=server_settings["servicename"],

3224

servicetype="_mandos._tcp",

3225

protocol=protocol,

3226

bus=bus)

3227

if server_settings["interface"]:

3228

service.interface = if_nametoindex(

3229

server_settings["interface"].encode("utf-8"))

3230

2525

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2526

service = AvahiServiceToSyslog(name =

2527

server_settings["servicename"],

2528

servicetype = "_mandos._tcp",

2529

protocol = protocol, bus = bus)

2530

if server_settings["interface"]:

2531

service.interface = (if_nametoindex

2532

(str(server_settings["interface"])))

2533

3231

2534

global multiprocessing_manager

3232

2535

multiprocessing_manager = multiprocessing.Manager()

3233

2536

3234

2537

client_class = Client

3235

2538

if use_dbus:

3236

client_class = functools.partial(ClientDBus, bus=bus)

3237

2539

client_class = functools.partial(ClientDBus, bus = bus)

2540

3238

2541

client_settings = Client.config_parser(client_config)

3239

2542

old_client_settings = {}

3240

2543

clients_data = {}

3241

2544

3242

2545

# This is used to redirect stdout and stderr for checker processes

3243

2546

global wnull

3244

wnull = open(os.devnull, "w") # A writable /dev/null

2547

wnull = open(os.devnull, "w") # A writable /dev/null

3245

2548

# Only used if server is running in foreground but not in debug

3246

2549

# mode

3247

2550

if debug or not foreground:

3248

2551

wnull.close()

3249

2552

3250

2553

# Get client data and settings from last running state.

3251

2554

if server_settings["restore"]:

3252

2555

try:

3253

2556

with open(stored_state_path, "rb") as stored_state:

3254

if sys.version_info.major == 2:

3255

clients_data, old_client_settings = pickle.load(

3256

stored_state)

3257

else:

3258

bytes_clients_data, bytes_old_client_settings = (

3259

pickle.load(stored_state, encoding="bytes"))

3260

# Fix bytes to strings

3261

# clients_data

3262

# .keys()

3263

clients_data = {(key.decode("utf-8")

3264

if isinstance(key, bytes)

3265

else key): value

3266

for key, value in

3267

bytes_clients_data.items()}

3268

del bytes_clients_data

3269

for key in clients_data:

3270

value = {(k.decode("utf-8")

3271

if isinstance(k, bytes) else k): v

3272

for k, v in

3273

clients_data[key].items()}

3274

clients_data[key] = value

3275

# .client_structure

3276

value["client_structure"] = [

3277

(s.decode("utf-8")

3278

if isinstance(s, bytes)

3279

else s) for s in

3280

value["client_structure"]]

3281

# .name, .host, and .checker_command

3282

for k in ("name", "host", "checker_command"):

3283

if isinstance(value[k], bytes):

3284

value[k] = value[k].decode("utf-8")

3285

if "key_id" not in value:

3286

value["key_id"] = ""

3287

elif "fingerprint" not in value:

3288

value["fingerprint"] = ""

3289

# old_client_settings

3290

# .keys()

3291

old_client_settings = {

3292

(key.decode("utf-8")

3293

if isinstance(key, bytes)

3294

else key): value

3295

for key, value in

3296

bytes_old_client_settings.items()}

3297

del bytes_old_client_settings

3298

# .host and .checker_command

3299

for value in old_client_settings.values():

3300

for attribute in ("host", "checker_command"):

3301

if isinstance(value[attribute], bytes):

3302

value[attribute] = (value[attribute]

3303

.decode("utf-8"))

2557

clients_data, old_client_settings = (pickle.load

2558

(stored_state))

3304

2559

os.remove(stored_state_path)

3305

2560

except IOError as e:

3306

2561

if e.errno == errno.ENOENT:

3307

logger.warning("Could not load persistent state:"

3308

" {}".format(os.strerror(e.errno)))

2562

logger.warning("Could not load persistent state: {0}"

2563

.format(os.strerror(e.errno)))

3309

2564

else:

3310

2565

logger.critical("Could not load persistent state:",

3311

2566

exc_info=e)

3312

2567

raise

3313

2568

except EOFError as e:

3314

2569

logger.warning("Could not load persistent state: "

3315

"EOFError:",

3316

exc_info=e)

3317

2570

"EOFError:", exc_info=e)

2571

3318

2572

with PGPEngine() as pgp:

3319

for client_name, client in clients_data.items():

2573

for client_name, client in clients_data.iteritems():

3320

2574

# Skip removed clients

3321

2575

if client_name not in client_settings:

3322

2576

continue

3323

2577

3324

2578

# Decide which value to use after restoring saved state.

3325

2579

# We have three different values: Old config file,

3326

2580

# new config file, and saved state.

3331

2585

# For each value in new config, check if it

3332

2586

# differs from the old config value (Except for

3333

2587

# the "secret" attribute)

3334

if (name != "secret"

3335

and (value !=

3336

old_client_settings[client_name][name])):

2588

if (name != "secret" and

2589

value != old_client_settings[client_name]

2590

[name]):

3337

2591

client[name] = value

3338

2592

except KeyError:

3339

2593

pass

3340

2594

3341

2595

# Clients who has passed its expire date can still be

3342

# enabled if its last checker was successful. A Client

2596

# enabled if its last checker was successful. Clients

3343

2597

# whose checker succeeded before we stored its state is

3344

2598

# assumed to have successfully run all checkers during

3345

2599

# downtime.

3347

2601

if datetime.datetime.utcnow() >= client["expires"]:

3348

2602

if not client["last_checked_ok"]:

3349

2603

logger.warning(

3350

"disabling client {} - Client never "

3351

"performed a successful checker".format(

3352

client_name))

2604

"disabling client {0} - Client never "

2605

"performed a successful checker"

2606

.format(client_name))

3353

2607

client["enabled"] = False

3354

2608

elif client["last_checker_status"] != 0:

3355

2609

logger.warning(

3356

"disabling client {} - Client last"

3357

" checker failed with error code"

3358

" {}".format(

3359

client_name,

3360

client["last_checker_status"]))

2610

"disabling client {0} - Client "

2611

"last checker failed with error code {1}"

2612

.format(client_name,

2613

client["last_checker_status"]))

3361

2614

client["enabled"] = False

3362

2615

else:

3363

client["expires"] = (

3364

datetime.datetime.utcnow()

3365

+ client["timeout"])

2616

client["expires"] = (datetime.datetime

2617

.utcnow()

2618

+ client["timeout"])

3366

2619

logger.debug("Last checker succeeded,"

3367

" keeping {} enabled".format(

3368

client_name))

2620

" keeping {0} enabled"

2621

.format(client_name))

3369

2622

try:

3370

client["secret"] = pgp.decrypt(

3371

client["encrypted_secret"],

3372

client_settings[client_name]["secret"])

2623

client["secret"] = (

2624

pgp.decrypt(client["encrypted_secret"],

2625

client_settings[client_name]

2626

["secret"]))

3373

2627

except PGPError:

3374

2628

# If decryption fails, we use secret from new settings

3375

logger.debug("Failed to decrypt {} old secret".format(

3376

client_name))

3377

client["secret"] = (client_settings[client_name]

3378

["secret"])

3379

2629

logger.debug("Failed to decrypt {0} old secret"

2630

.format(client_name))

2631

client["secret"] = (

2632

client_settings[client_name]["secret"])

2633

3380

2634

# Add/remove clients based on new changes made to config

3381

2635

for client_name in (set(old_client_settings)

3382

2636

- set(client_settings)):

3384

2638

for client_name in (set(client_settings)

3385

2639

- set(old_client_settings)):

3386

2640

clients_data[client_name] = client_settings[client_name]

3387

2641

3388

2642

# Create all client objects

3389

for client_name, client in clients_data.items():

2643

for client_name, client in clients_data.iteritems():

3390

2644

tcp_server.clients[client_name] = client_class(

3391

name=client_name,

3392

settings=client,

3393

server_settings=server_settings)

3394

2645

name = client_name, settings = client,

2646

server_settings = server_settings)

2647

3395

2648

if not tcp_server.clients:

3396

2649

logger.warning("No clients defined")

3397

2650

3398

2651

if not foreground:

3399

2652

if pidfile is not None:

3400

pid = os.getpid()

3401

2653

try:

3402

2654

with pidfile:

3403

print(pid, file=pidfile)

2655

pid = os.getpid()

2656

pidfile.write(str(pid) + "\n".encode("utf-8"))

3404

2657

except IOError:

3405

2658

logger.error("Could not write to file %r with PID %d",

3406

2659

pidfilename, pid)

3407

2660

del pidfile

3408

2661

del pidfilename

3409

3410

for termsig in (signal.SIGHUP, signal.SIGTERM):

3411

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3412

lambda: main_loop.quit() and False)

3413

2662

2663

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2664

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2665

3414

2666

if use_dbus:

3415

3416

@alternate_dbus_interfaces(

3417

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3418

class MandosDBusService(DBusObjectWithObjectManager):

2667

@alternate_dbus_interfaces({"se.recompile.Mandos":

2668

"se.bsnet.fukt.Mandos"})

2669

class MandosDBusService(DBusObjectWithProperties):

3419

2670

"""A D-Bus proxy object"""

3420

3421

2671

def __init__(self):

3422

2672

dbus.service.Object.__init__(self, bus, "/")

3423

3424

2673

_interface = "se.recompile.Mandos"

3425

2674

2675

@dbus_interface_annotations(_interface)

2676

def _foo(self):

2677

return { "org.freedesktop.DBus.Property"

2678

".EmitsChangedSignal":

2679

"false"}

2680

3426

2681

@dbus.service.signal(_interface, signature="o")

3427

2682

def ClientAdded(self, objpath):

3428

2683

"D-Bus signal"

3429

2684

pass

3430

2685

3431

2686

@dbus.service.signal(_interface, signature="ss")

3432

def ClientNotFound(self, key_id, address):

2687

def ClientNotFound(self, fingerprint, address):

3433

2688

"D-Bus signal"

3434

2689

pass

3435

3436

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3437

"true"})

2690

3438

2691

@dbus.service.signal(_interface, signature="os")

3439

2692

def ClientRemoved(self, objpath, name):

3440

2693

"D-Bus signal"

3441

2694

pass

3442

3443

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3444

"true"})

2695

3445

2696

@dbus.service.method(_interface, out_signature="ao")

3446

2697

def GetAllClients(self):

3447

2698

"D-Bus method"

3448

return dbus.Array(c.dbus_object_path for c in

3449

tcp_server.clients.values())

3450

3451

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3452

"true"})

2699

return dbus.Array(c.dbus_object_path

2700

for c in

2701

tcp_server.clients.itervalues())

2702

3453

2703

@dbus.service.method(_interface,

3454

2704

out_signature="a{oa{sv}}")

3455

2705

def GetAllClientsWithProperties(self):

3456

2706

"D-Bus method"

3457

2707

return dbus.Dictionary(

3458

{c.dbus_object_path: c.GetAll(

3459

"se.recompile.Mandos.Client")

3460

for c in tcp_server.clients.values()},

2708

((c.dbus_object_path, c.GetAll(""))

2709

for c in tcp_server.clients.itervalues()),

3461

2710

signature="oa{sv}")

3462

2711

3463

2712

@dbus.service.method(_interface, in_signature="o")

3464

2713

def RemoveClient(self, object_path):

3465

2714

"D-Bus method"

3466

for c in tcp_server.clients.values():

2715

for c in tcp_server.clients.itervalues():

3467

2716

if c.dbus_object_path == object_path:

3468

2717

del tcp_server.clients[c.name]

3469

2718

c.remove_from_connection()

3470

# Don't signal the disabling

2719

# Don't signal anything except ClientRemoved

3471

2720

c.disable(quiet=True)

3472

# Emit D-Bus signal for removal

3473

self.client_removed_signal(c)

2721

# Emit D-Bus signal

2722

self.ClientRemoved(object_path, c.name)

3474

2723

return

3475

2724

raise KeyError(object_path)

3476

2725

3477

2726

del _interface

3478

3479

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3480

out_signature="a{oa{sa{sv}}}")

3481

def GetManagedObjects(self):

3482

"""D-Bus method"""

3483

return dbus.Dictionary(

3484

{client.dbus_object_path:

3485

dbus.Dictionary(

3486

{interface: client.GetAll(interface)

3487

for interface in

3488

client._get_all_interface_names()})

3489

for client in tcp_server.clients.values()})

3490

3491

def client_added_signal(self, client):

3492

"""Send the new standard signal and the old signal"""

3493

if use_dbus:

3494

# New standard signal

3495

self.InterfacesAdded(

3496

client.dbus_object_path,

3497

dbus.Dictionary(

3498

{interface: client.GetAll(interface)

3499

for interface in

3500

client._get_all_interface_names()}))

3501

# Old signal

3502

self.ClientAdded(client.dbus_object_path)

3503

3504

def client_removed_signal(self, client):

3505

"""Send the new standard signal and the old signal"""

3506

if use_dbus:

3507

# New standard signal

3508

self.InterfacesRemoved(

3509

client.dbus_object_path,

3510

client._get_all_interface_names())

3511

# Old signal

3512

self.ClientRemoved(client.dbus_object_path,

3513

client.name)

3514

2727

3515

2728

mandos_dbus_service = MandosDBusService()

3516

3517

# Save modules to variables to exempt the modules from being

3518

# unloaded before the function registered with atexit() is run.

3519

mp = multiprocessing

3520

wn = wnull

3521

2729

3522

2730

def cleanup():

3523

2731

"Cleanup function; run on exit"

3524

if zeroconf:

3525

service.cleanup()

3526

3527

mp.active_children()

3528

wn.close()

2732

service.cleanup()

2733

2734

multiprocessing.active_children()

2735

wnull.close()

3529

2736

if not (tcp_server.clients or client_settings):

3530

2737

return

3531

2738

3532

2739

# Store client before exiting. Secrets are encrypted with key

3533

2740

# based on what config file has. If config file is

3534

2741

# removed/edited, old secret will thus be unrecovable.

3535

2742

clients = {}

3536

2743

with PGPEngine() as pgp:

3537

for client in tcp_server.clients.values():

2744

for client in tcp_server.clients.itervalues():

3538

2745

key = client_settings[client.name]["secret"]

3539

2746

client.encrypted_secret = pgp.encrypt(client.secret,

3540

2747

key)

3541

2748

client_dict = {}

3542

2749

3543

2750

# A list of attributes that can not be pickled

3544

2751

# + secret.

3545

exclude = {"bus", "changedstate", "secret",

3546

"checker", "server_settings"}

3547

for name, typ in inspect.getmembers(dbus.service

3548

.Object):

2752

exclude = set(("bus", "changedstate", "secret",

2753

"checker", "server_settings"))

2754

for name, typ in (inspect.getmembers

2755

(dbus.service.Object)):

3549

2756

exclude.add(name)

3550

2757

3551

2758

client_dict["encrypted_secret"] = (client

3552

2759

.encrypted_secret)

3553

2760

for attr in client.client_structure:

3554

2761

if attr not in exclude:

3555

2762

client_dict[attr] = getattr(client, attr)

3556

2763

3557

2764

clients[client.name] = client_dict

3558

2765

del client_settings[client.name]["secret"]

3559

2766

3560

2767

try:

3561

with tempfile.NamedTemporaryFile(

3562

mode='wb',

3563

suffix=".pickle",

3564

prefix='clients-',

3565

dir=os.path.dirname(stored_state_path),

3566

delete=False) as stored_state:

3567

pickle.dump((clients, client_settings), stored_state,

3568

protocol=2)

3569

tempname = stored_state.name

2768

with (tempfile.NamedTemporaryFile

2769

(mode='wb', suffix=".pickle", prefix='clients-',

2770

dir=os.path.dirname(stored_state_path),

2771

delete=False)) as stored_state:

2772

pickle.dump((clients, client_settings), stored_state)

2773

tempname=stored_state.name

3570

2774

os.rename(tempname, stored_state_path)

3571

2775

except (IOError, OSError) as e:

3572

2776

if not debug:

3575

2779

except NameError:

3576

2780

pass

3577

2781

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3578

logger.warning("Could not save persistent state: {}"

2782

logger.warning("Could not save persistent state: {0}"

3579

2783

.format(os.strerror(e.errno)))

3580

2784

else:

3581

2785

logger.warning("Could not save persistent state:",

3582

2786

exc_info=e)

3583

raise

3584

2787

raise e

2788

3585

2789

# Delete all clients, and settings from config

3586

2790

while tcp_server.clients:

3587

2791

name, client = tcp_server.clients.popitem()

3588

2792

if use_dbus:

3589

2793

client.remove_from_connection()

3590

# Don't signal the disabling

2794

# Don't signal anything except ClientRemoved

3591

2795

client.disable(quiet=True)

3592

# Emit D-Bus signal for removal

3593

2796

if use_dbus:

3594

mandos_dbus_service.client_removed_signal(client)

2797

# Emit D-Bus signal

2798

mandos_dbus_service.ClientRemoved(client

2799

.dbus_object_path,

2800

client.name)

3595

2801

client_settings.clear()

3596

2802

3597

2803

atexit.register(cleanup)

3598

3599

for client in tcp_server.clients.values():

2804

2805

for client in tcp_server.clients.itervalues():

3600

2806

if use_dbus:

3601

# Emit D-Bus signal for adding

3602

mandos_dbus_service.client_added_signal(client)

2807

# Emit D-Bus signal

2808

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3603

2809

# Need to initiate checking of clients

3604

2810

if client.enabled:

3605

2811

client.init_checker()

3606

2812

3607

2813

tcp_server.enable()

3608

2814

tcp_server.server_activate()

3609

2815

3610

2816

# Find out what port we got

3611

if zeroconf:

3612

service.port = tcp_server.socket.getsockname()[1]

2817

service.port = tcp_server.socket.getsockname()[1]

3613

2818

if use_ipv6:

3614

2819

logger.info("Now listening on address %r, port %d,"

3615

2820

" flowinfo %d, scope_id %d",

3617

2822

else: # IPv4

3618

2823

logger.info("Now listening on address %r, port %d",

3619

2824

*tcp_server.socket.getsockname())

3620

3621

# service.interface = tcp_server.socket.getsockname()[3]

3622

2825

2826

#service.interface = tcp_server.socket.getsockname()[3]

2827

3623

2828

try:

3624

if zeroconf:

3625

# From the Avahi example code

3626

try:

3627

service.activate()

3628

except dbus.exceptions.DBusException as error:

3629

logger.critical("D-Bus Exception", exc_info=error)

3630

cleanup()

3631

sys.exit(1)

3632

# End of Avahi example code

3633

3634

GLib.io_add_watch(

3635

GLib.IOChannel.unix_new(tcp_server.fileno()),

3636

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3637

lambda *args, **kwargs: (tcp_server.handle_request

3638

(*args[2:], **kwargs) or True))

3639

2829

# From the Avahi example code

2830

try:

2831

service.activate()

2832

except dbus.exceptions.DBusException as error:

2833

logger.critical("D-Bus Exception", exc_info=error)

2834

cleanup()

2835

sys.exit(1)

2836

# End of Avahi example code

2837

2838

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2839

lambda *args, **kwargs:

2840

(tcp_server.handle_request

2841

(*args[2:], **kwargs) or True))

2842

3640

2843

logger.debug("Starting main loop")

3641

2844

main_loop.run()

3642

2845

except AvahiError as error:

3651

2854

# Must run before the D-Bus bus name gets deregistered

3652

2855

cleanup()

3653

2856

3654

3655

def should_only_run_tests():

3656

parser = argparse.ArgumentParser(add_help=False)

3657

parser.add_argument("--check", action='store_true')

3658

args, unknown_args = parser.parse_known_args()

3659

run_tests = args.check

3660

if run_tests:

3661

# Remove --check argument from sys.argv

3662

sys.argv[1:] = unknown_args

3663

return run_tests

3664

3665

# Add all tests from doctest strings

3666

def load_tests(loader, tests, none):

3667

import doctest

3668

tests.addTests(doctest.DocTestSuite())

3669

return tests

3670

3671

2857

if __name__ == '__main__':

3672

try:

3673

if should_only_run_tests():

3674

# Call using ./mandos --check [--verbose]

3675

unittest.main()

3676

else:

3677

main()

3678

finally:

3679

logging.shutdown()

2858

main()