/mandos/release : revision 237.7.195

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

72

81

73

import dbus

82

74

import dbus.service

83

from gi.repository import GLib

75

import gobject

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

86

79

import ctypes.util

87

80

import xml.dom.minidom

88

81

import inspect

89

82

90

# Try to find the value of SO_BINDTODEVICE:

91

83

try:

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

93

# newer, and it is also the most natural place for it:

94

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

95

85

except AttributeError:

96

86

try:

97

# This is where SO_BINDTODEVICE was up to and including Python

98

# 2.6, and also 3.2:

99

87

from IN import SO_BINDTODEVICE

100

88

except ImportError:

101

# In Python 2.7 it seems to have been removed entirely.

102

# Try running the C preprocessor:

103

try:

104

cc = subprocess.Popen(["cc", "--language=c", "-E",

105

"/dev/stdin"],

106

stdin=subprocess.PIPE,

107

stdout=subprocess.PIPE)

108

stdout = cc.communicate(

109

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

110

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

111

except (OSError, ValueError, IndexError):

112

# No value found

113

SO_BINDTODEVICE = None

114

115

if sys.version_info.major == 2:

116

str = unicode

117

118

version = "1.8.3"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.2"

119

92

stored_state_file = "clients.pickle"

120

93

121

94

logger = logging.getLogger()

122

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

123

98

124

99

try:

125

if_nametoindex = ctypes.cdll.LoadLibrary(

126

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

127

103

except (OSError, AttributeError):

128

129

104

def if_nametoindex(interface):

130

105

"Get an interface index the hard way, i.e. using fcntl()"

131

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

132

107

with contextlib.closing(socket.socket()) as s:

133

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

134

struct.pack(b"16s16x", interface))

135

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

136

113

return interface_index

137

114

138

115

139

def copy_function(func):

140

"""Make a copy of a function"""

141

if sys.version_info.major == 2:

142

return types.FunctionType(func.func_code,

143

func.func_globals,

144

func.func_name,

145

func.func_defaults,

146

func.func_closure)

147

else:

148

return types.FunctionType(func.__code__,

149

func.__globals__,

150

func.__name__,

151

func.__defaults__,

152

func.__closure__)

153

154

155

116

def initlogger(debug, level=logging.WARNING):

156

117

"""init logger and add loglevel"""

157

158

global syslogger

159

syslogger = (logging.handlers.SysLogHandler(

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

161

address="/dev/log"))

118

162

119

syslogger.setFormatter(logging.Formatter

163

120

('Mandos [%(process)d]: %(levelname)s:'

164

121

' %(message)s'))

165

122

logger.addHandler(syslogger)

166

123

167

124

if debug:

168

125

console = logging.StreamHandler()

169

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

181

138

182

139

class PGPEngine(object):

183

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

184

185

141

def __init__(self):

186

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

187

self.gpg = "gpg"

188

try:

189

output = subprocess.check_output(["gpgconf"])

190

for line in output.splitlines():

191

name, text, path = line.split(b":")

192

if name == "gpg":

193

self.gpg = path

194

break

195

except OSError as e:

196

if e.errno != errno.ENOENT:

197

raise

198

143

self.gnupgargs = ['--batch',

199

'--homedir', self.tempdir,

144

'--home', self.tempdir,

200

145

'--force-mdc',

201

'--quiet']

202

# Only GPG version 1 has the --no-use-agent option.

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

204

self.gnupgargs.append("--no-use-agent")

205

146

'--quiet',

147

'--no-use-agent']

148

206

149

def __enter__(self):

207

150

return self

208

151

209

152

def __exit__(self, exc_type, exc_value, traceback):

210

153

self._cleanup()

211

154

return False

212

155

213

156

def __del__(self):

214

157

self._cleanup()

215

158

216

159

def _cleanup(self):

217

160

if self.tempdir is not None:

218

161

# Delete contents of tempdir

219

162

for root, dirs, files in os.walk(self.tempdir,

220

topdown=False):

163

topdown = False):

221

164

for filename in files:

222

165

os.remove(os.path.join(root, filename))

223

166

for dirname in dirs:

225

168

# Remove tempdir

226

169

os.rmdir(self.tempdir)

227

170

self.tempdir = None

228

171

229

172

def password_encode(self, password):

230

173

# Passphrase can not be empty and can not contain newlines or

231

174

# NUL bytes. So we prefix it and hex encode it.

236

179

.replace(b"\n", b"\\n")

237

180

.replace(b"\0", b"\\x00"))

238

181

return encoded

239

182

240

183

def encrypt(self, data, password):

241

184

passphrase = self.password_encode(password)

242

with tempfile.NamedTemporaryFile(

243

dir=self.tempdir) as passfile:

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

244

187

passfile.write(passphrase)

245

188

passfile.flush()

246

proc = subprocess.Popen([self.gpg, '--symmetric',

189

proc = subprocess.Popen(['gpg', '--symmetric',

247

190

'--passphrase-file',

248

191

passfile.name]

249

192

+ self.gnupgargs,

250

stdin=subprocess.PIPE,

251

stdout=subprocess.PIPE,

252

stderr=subprocess.PIPE)

253

ciphertext, err = proc.communicate(input=data)

193

stdin = subprocess.PIPE,

194

stdout = subprocess.PIPE,

195

stderr = subprocess.PIPE)

196

ciphertext, err = proc.communicate(input = data)

254

197

if proc.returncode != 0:

255

198

raise PGPError(err)

256

199

return ciphertext

257

200

258

201

def decrypt(self, data, password):

259

202

passphrase = self.password_encode(password)

260

with tempfile.NamedTemporaryFile(

261

dir=self.tempdir) as passfile:

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

262

205

passfile.write(passphrase)

263

206

passfile.flush()

264

proc = subprocess.Popen([self.gpg, '--decrypt',

207

proc = subprocess.Popen(['gpg', '--decrypt',

265

208

'--passphrase-file',

266

209

passfile.name]

267

210

+ self.gnupgargs,

268

stdin=subprocess.PIPE,

269

stdout=subprocess.PIPE,

270

stderr=subprocess.PIPE)

271

decrypted_plaintext, err = proc.communicate(input=data)

211

stdin = subprocess.PIPE,

212

stdout = subprocess.PIPE,

213

stderr = subprocess.PIPE)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

272

216

if proc.returncode != 0:

273

217

raise PGPError(err)

274

218

return decrypted_plaintext

275

219

276

220

277

# Pretend that we have an Avahi module

278

class avahi(object):

279

"""This isn't so much a class as it is a module-like namespace."""

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

284

DBUS_NAME = "org.freedesktop.Avahi"

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

287

DBUS_PATH_SERVER = "/"

288

289

@staticmethod

290

def string_array_to_txt_array(t):

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

292

for s in t), signature="ay")

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

294

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

295

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

296

SERVER_INVALID = 0 # avahi-common/defs.h

297

SERVER_REGISTERING = 1 # avahi-common/defs.h

298

SERVER_RUNNING = 2 # avahi-common/defs.h

299

SERVER_COLLISION = 3 # avahi-common/defs.h

300

SERVER_FAILURE = 4 # avahi-common/defs.h

301

302

303

221

class AvahiError(Exception):

304

222

def __init__(self, value, *args, **kwargs):

305

223

self.value = value

306

return super(AvahiError, self).__init__(value, *args,

307

**kwargs)

308

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

309

227

310

228

class AvahiServiceError(AvahiError):

311

229

pass

312

230

313

314

231

class AvahiGroupError(AvahiError):

315

232

pass

316

233

317

234

318

235

class AvahiService(object):

319

236

"""An Avahi (Zeroconf) service.

320

237

321

238

Attributes:

322

239

interface: integer; avahi.IF_UNSPEC or an interface index.

323

240

Used to optionally bind to the specified interface.

335

252

server: D-Bus Server

336

253

bus: dbus.SystemBus()

337

254

"""

338

339

def __init__(self,

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

255

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

350

260

self.interface = interface

351

261

self.name = name

352

262

self.type = servicetype

361

271

self.server = None

362

272

self.bus = bus

363

273

self.entry_group_state_changed_match = None

364

365

def rename(self, remove=True):

274

275

def rename(self):

366

276

"""Derived from the Avahi example code"""

367

277

if self.rename_count >= self.max_renames:

368

278

logger.critical("No suitable Zeroconf service name found"

369

279

" after %i retries, exiting.",

370

280

self.rename_count)

371

281

raise AvahiServiceError("Too many renames")

372

self.name = str(

373

self.server.GetAlternativeServiceName(self.name))

374

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

375

284

logger.info("Changing Zeroconf service name to %r ...",

376

285

self.name)

377

if remove:

378

self.remove()

286

self.remove()

379

287

try:

380

288

self.add()

381

289

except dbus.exceptions.DBusException as error:

382

if (error.get_dbus_name()

383

== "org.freedesktop.Avahi.CollisionError"):

384

logger.info("Local Zeroconf service name collision.")

385

return self.rename(remove=False)

386

else:

387

logger.critical("D-Bus Exception", exc_info=error)

388

self.cleanup()

389

os._exit(1)

390

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

294

391

295

def remove(self):

392

296

"""Derived from the Avahi example code"""

393

297

if self.entry_group_state_changed_match is not None:

395

299

self.entry_group_state_changed_match = None

396

300

if self.group is not None:

397

301

self.group.Reset()

398

302

399

303

def add(self):

400

304

"""Derived from the Avahi example code"""

401

305

self.remove()

418

322

dbus.UInt16(self.port),

419

323

avahi.string_array_to_txt_array(self.TXT))

420

324

self.group.Commit()

421

325

422

326

def entry_group_state_changed(self, state, error):

423

327

"""Derived from the Avahi example code"""

424

328

logger.debug("Avahi entry group state change: %i", state)

425

329

426

330

if state == avahi.ENTRY_GROUP_ESTABLISHED:

427

331

logger.debug("Zeroconf service established.")

428

332

elif state == avahi.ENTRY_GROUP_COLLISION:

430

334

self.rename()

431

335

elif state == avahi.ENTRY_GROUP_FAILURE:

432

336

logger.critical("Avahi: Error in group state changed %s",

433

str(error))

434

raise AvahiGroupError("State changed: {!s}".format(error))

435

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

340

436

341

def cleanup(self):

437

342

"""Derived from the Avahi example code"""

438

343

if self.group is not None:

443

348

pass

444

349

self.group = None

445

350

self.remove()

446

351

447

352

def server_state_changed(self, state, error=None):

448

353

"""Derived from the Avahi example code"""

449

354

logger.debug("Avahi server state change: %i", state)

450

bad_states = {

451

avahi.SERVER_INVALID: "Zeroconf server invalid",

452

avahi.SERVER_REGISTERING: None,

453

avahi.SERVER_COLLISION: "Zeroconf server name collision",

454

avahi.SERVER_FAILURE: "Zeroconf server failure",

455

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

456

362

if state in bad_states:

457

363

if bad_states[state] is not None:

458

364

if error is None:

461

367

logger.error(bad_states[state] + ": %r", error)

462

368

self.cleanup()

463

369

elif state == avahi.SERVER_RUNNING:

464

try:

465

self.add()

466

except dbus.exceptions.DBusException as error:

467

if (error.get_dbus_name()

468

== "org.freedesktop.Avahi.CollisionError"):

469

logger.info("Local Zeroconf service name"

470

" collision.")

471

return self.rename(remove=False)

472

else:

473

logger.critical("D-Bus Exception", exc_info=error)

474

self.cleanup()

475

os._exit(1)

370

self.add()

476

371

else:

477

372

if error is None:

478

373

logger.debug("Unknown state: %r", state)

479

374

else:

480

375

logger.debug("Unknown state: %r: %r", state, error)

481

376

482

377

def activate(self):

483

378

"""Derived from the Avahi example code"""

484

379

if self.server is None:

488

383

follow_name_owner_changes=True),

489

384

avahi.DBUS_INTERFACE_SERVER)

490

385

self.server.connect_to_signal("StateChanged",

491

self.server_state_changed)

386

self.server_state_changed)

492

387

self.server_state_changed(self.server.GetState())

493

388

494

389

495

390

class AvahiServiceToSyslog(AvahiService):

496

def rename(self, *args, **kwargs):

391

def rename(self):

497

392

"""Add the new name to the syslog messages"""

498

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

499

syslogger.setFormatter(logging.Formatter(

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

501

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

502

398

return ret

503

399

504

400

505

# Pretend that we have a GnuTLS module

506

class gnutls(object):

507

"""This isn't so much a class as it is a module-like namespace."""

508

509

library = ctypes.util.find_library("gnutls")

510

if library is None:

511

library = ctypes.util.find_library("gnutls-deb0")

512

_library = ctypes.cdll.LoadLibrary(library)

513

del library

514

515

# Unless otherwise indicated, the constants and types below are

516

# all from the gnutls/gnutls.h C header file.

517

518

# Constants

519

E_SUCCESS = 0

520

E_INTERRUPTED = -52

521

E_AGAIN = -28

522

CRT_OPENPGP = 2

523

CRT_RAWPK = 3

524

CLIENT = 2

525

SHUT_RDWR = 0

526

CRD_CERTIFICATE = 1

527

E_NO_CERTIFICATE_FOUND = -49

528

X509_FMT_DER = 0

529

NO_TICKETS = 1<<10

530

ENABLE_RAWPK = 1<<18

531

CTYPE_PEERS = 3

532

KEYID_USE_SHA256 = 1 # gnutls/x509.h

533

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

534

535

# Types

536

class session_int(ctypes.Structure):

537

_fields_ = []

538

session_t = ctypes.POINTER(session_int)

539

540

class certificate_credentials_st(ctypes.Structure):

541

_fields_ = []

542

certificate_credentials_t = ctypes.POINTER(

543

certificate_credentials_st)

544

certificate_type_t = ctypes.c_int

545

546

class datum_t(ctypes.Structure):

547

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

548

('size', ctypes.c_uint)]

549

550

class openpgp_crt_int(ctypes.Structure):

551

_fields_ = []

552

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

553

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

554

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

555

credentials_type_t = ctypes.c_int

556

transport_ptr_t = ctypes.c_void_p

557

close_request_t = ctypes.c_int

558

559

# Exceptions

560

class Error(Exception):

561

def __init__(self, message=None, code=None, args=()):

562

# Default usage is by a message string, but if a return

563

# code is passed, convert it to a string with

564

# gnutls.strerror()

565

self.code = code

566

if message is None and code is not None:

567

message = gnutls.strerror(code)

568

return super(gnutls.Error, self).__init__(

569

message, *args)

570

571

class CertificateSecurityError(Error):

572

pass

573

574

# Classes

575

class Credentials(object):

576

def __init__(self):

577

self._c_object = gnutls.certificate_credentials_t()

578

gnutls.certificate_allocate_credentials(

579

ctypes.byref(self._c_object))

580

self.type = gnutls.CRD_CERTIFICATE

581

582

def __del__(self):

583

gnutls.certificate_free_credentials(self._c_object)

584

585

class ClientSession(object):

586

def __init__(self, socket, credentials=None):

587

self._c_object = gnutls.session_t()

588

gnutls_flags = gnutls.CLIENT

589

if gnutls.check_version("3.5.6"):

590

gnutls_flags |= gnutls.NO_TICKETS

591

if gnutls.has_rawpk:

592

gnutls_flags |= gnutls.ENABLE_RAWPK

593

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

594

del gnutls_flags

595

gnutls.set_default_priority(self._c_object)

596

gnutls.transport_set_ptr(self._c_object, socket.fileno())

597

gnutls.handshake_set_private_extensions(self._c_object,

598

True)

599

self.socket = socket

600

if credentials is None:

601

credentials = gnutls.Credentials()

602

gnutls.credentials_set(self._c_object, credentials.type,

603

ctypes.cast(credentials._c_object,

604

ctypes.c_void_p))

605

self.credentials = credentials

606

607

def __del__(self):

608

gnutls.deinit(self._c_object)

609

610

def handshake(self):

611

return gnutls.handshake(self._c_object)

612

613

def send(self, data):

614

data = bytes(data)

615

data_len = len(data)

616

while data_len > 0:

617

data_len -= gnutls.record_send(self._c_object,

618

data[-data_len:],

619

data_len)

620

621

def bye(self):

622

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

623

624

# Error handling functions

625

def _error_code(result):

626

"""A function to raise exceptions on errors, suitable

627

for the 'restype' attribute on ctypes functions"""

628

if result >= 0:

629

return result

630

if result == gnutls.E_NO_CERTIFICATE_FOUND:

631

raise gnutls.CertificateSecurityError(code=result)

632

raise gnutls.Error(code=result)

633

634

def _retry_on_error(result, func, arguments):

635

"""A function to retry on some errors, suitable

636

for the 'errcheck' attribute on ctypes functions"""

637

while result < 0:

638

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

639

return _error_code(result)

640

result = func(*arguments)

641

return result

642

643

# Unless otherwise indicated, the function declarations below are

644

# all from the gnutls/gnutls.h C header file.

645

646

# Functions

647

priority_set_direct = _library.gnutls_priority_set_direct

648

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

649

ctypes.POINTER(ctypes.c_char_p)]

650

priority_set_direct.restype = _error_code

651

652

init = _library.gnutls_init

653

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

654

init.restype = _error_code

655

656

set_default_priority = _library.gnutls_set_default_priority

657

set_default_priority.argtypes = [session_t]

658

set_default_priority.restype = _error_code

659

660

record_send = _library.gnutls_record_send

661

record_send.argtypes = [session_t, ctypes.c_void_p,

662

ctypes.c_size_t]

663

record_send.restype = ctypes.c_ssize_t

664

record_send.errcheck = _retry_on_error

665

666

certificate_allocate_credentials = (

667

_library.gnutls_certificate_allocate_credentials)

668

certificate_allocate_credentials.argtypes = [

669

ctypes.POINTER(certificate_credentials_t)]

670

certificate_allocate_credentials.restype = _error_code

671

672

certificate_free_credentials = (

673

_library.gnutls_certificate_free_credentials)

674

certificate_free_credentials.argtypes = [

675

certificate_credentials_t]

676

certificate_free_credentials.restype = None

677

678

handshake_set_private_extensions = (

679

_library.gnutls_handshake_set_private_extensions)

680

handshake_set_private_extensions.argtypes = [session_t,

681

ctypes.c_int]

682

handshake_set_private_extensions.restype = None

683

684

credentials_set = _library.gnutls_credentials_set

685

credentials_set.argtypes = [session_t, credentials_type_t,

686

ctypes.c_void_p]

687

credentials_set.restype = _error_code

688

689

strerror = _library.gnutls_strerror

690

strerror.argtypes = [ctypes.c_int]

691

strerror.restype = ctypes.c_char_p

692

693

certificate_type_get = _library.gnutls_certificate_type_get

694

certificate_type_get.argtypes = [session_t]

695

certificate_type_get.restype = _error_code

696

697

certificate_get_peers = _library.gnutls_certificate_get_peers

698

certificate_get_peers.argtypes = [session_t,

699

ctypes.POINTER(ctypes.c_uint)]

700

certificate_get_peers.restype = ctypes.POINTER(datum_t)

701

702

global_set_log_level = _library.gnutls_global_set_log_level

703

global_set_log_level.argtypes = [ctypes.c_int]

704

global_set_log_level.restype = None

705

706

global_set_log_function = _library.gnutls_global_set_log_function

707

global_set_log_function.argtypes = [log_func]

708

global_set_log_function.restype = None

709

710

deinit = _library.gnutls_deinit

711

deinit.argtypes = [session_t]

712

deinit.restype = None

713

714

handshake = _library.gnutls_handshake

715

handshake.argtypes = [session_t]

716

handshake.restype = _error_code

717

handshake.errcheck = _retry_on_error

718

719

transport_set_ptr = _library.gnutls_transport_set_ptr

720

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

721

transport_set_ptr.restype = None

722

723

bye = _library.gnutls_bye

724

bye.argtypes = [session_t, close_request_t]

725

bye.restype = _error_code

726

bye.errcheck = _retry_on_error

727

728

check_version = _library.gnutls_check_version

729

check_version.argtypes = [ctypes.c_char_p]

730

check_version.restype = ctypes.c_char_p

731

732

_need_version = b"3.3.0"

733

if check_version(_need_version) is None:

734

raise self.Error("Needs GnuTLS {} or later"

735

.format(_need_version))

736

737

_tls_rawpk_version = b"3.6.6"

738

has_rawpk = bool(check_version(_tls_rawpk_version))

739

740

if has_rawpk:

741

# Types

742

class pubkey_st(ctypes.Structure):

743

_fields = []

744

pubkey_t = ctypes.POINTER(pubkey_st)

745

746

x509_crt_fmt_t = ctypes.c_int

747

748

# All the function declarations below are from gnutls/abstract.h

749

pubkey_init = _library.gnutls_pubkey_init

750

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

751

pubkey_init.restype = _error_code

752

753

pubkey_import = _library.gnutls_pubkey_import

754

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

755

x509_crt_fmt_t]

756

pubkey_import.restype = _error_code

757

758

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

759

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

760

ctypes.POINTER(ctypes.c_ubyte),

761

ctypes.POINTER(ctypes.c_size_t)]

762

pubkey_get_key_id.restype = _error_code

763

764

pubkey_deinit = _library.gnutls_pubkey_deinit

765

pubkey_deinit.argtypes = [pubkey_t]

766

pubkey_deinit.restype = None

767

else:

768

# All the function declarations below are from gnutls/openpgp.h

769

770

openpgp_crt_init = _library.gnutls_openpgp_crt_init

771

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

772

openpgp_crt_init.restype = _error_code

773

774

openpgp_crt_import = _library.gnutls_openpgp_crt_import

775

openpgp_crt_import.argtypes = [openpgp_crt_t,

776

ctypes.POINTER(datum_t),

777

openpgp_crt_fmt_t]

778

openpgp_crt_import.restype = _error_code

779

780

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

781

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

782

ctypes.POINTER(ctypes.c_uint)]

783

openpgp_crt_verify_self.restype = _error_code

784

785

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

786

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

787

openpgp_crt_deinit.restype = None

788

789

openpgp_crt_get_fingerprint = (

790

_library.gnutls_openpgp_crt_get_fingerprint)

791

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

792

ctypes.c_void_p,

793

ctypes.POINTER(

794

ctypes.c_size_t)]

795

openpgp_crt_get_fingerprint.restype = _error_code

796

797

if check_version("3.6.4"):

798

certificate_type_get2 = _library.gnutls_certificate_type_get2

799

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

800

certificate_type_get2.restype = _error_code

801

802

# Remove non-public functions

803

del _error_code, _retry_on_error

804

805

806

def call_pipe(connection, # : multiprocessing.Connection

807

func, *args, **kwargs):

808

"""This function is meant to be called by multiprocessing.Process

809

810

This function runs func(*args, **kwargs), and writes the resulting

811

return value on the provided multiprocessing.Connection.

812

"""

813

connection.send(func(*args, **kwargs))

814

connection.close()

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

815

406

816

407

817

408

class Client(object):

818

409

"""A representation of a client host served by this server.

819

410

820

411

Attributes:

821

412

approved: bool(); 'None' if not yet approved/disapproved

822

413

approval_delay: datetime.timedelta(); Time to wait for approval

824

415

checker: subprocess.Popen(); a running checker process used

825

416

to see if the client lives.

826

417

'None' if no process is running.

827

checker_callback_tag: a GLib event source tag, or None

418

checker_callback_tag: a gobject event source tag, or None

828

419

checker_command: string; External command which is run to check

829

420

if client lives. %() expansions are done at

830

421

runtime with vars(self) as dict, so that for

831

422

instance %(name)s can be used in the command.

832

checker_initiator_tag: a GLib event source tag, or None

423

checker_initiator_tag: a gobject event source tag, or None

833

424

created: datetime.datetime(); (UTC) object creation

834

425

client_structure: Object describing what attributes a client has

835

426

and is used for storing the client at exit

836

427

current_checker_command: string; current running checker_command

837

disable_initiator_tag: a GLib event source tag, or None

428

disable_initiator_tag: a gobject event source tag, or None

838

429

enabled: bool()

839

430

fingerprint: string (40 or 32 hexadecimal digits); used to

840

uniquely identify an OpenPGP client

841

key_id: string (64 hexadecimal digits); used to uniquely identify

842

a client using raw public keys

431

uniquely identify the client

843

432

host: string; available for use by the checker command

844

433

interval: datetime.timedelta(); How often to start a new checker

845

434

last_approval_request: datetime.datetime(); (UTC) or None

847

436

last_checker_status: integer between 0 and 255 reflecting exit

848

437

status of last checker. -1 reflects crashed

849

438

checker, -2 means no checker completed yet.

850

last_checker_signal: The signal which killed the last checker, if

851

last_checker_status is -1

852

439

last_enabled: datetime.datetime(); (UTC) or None

853

440

name: string; from the config file, used in log messages and

854

441

D-Bus identifiers

861

448

disabled, or None

862

449

server_settings: The server_settings dict from main()

863

450

"""

864

451

865

452

runtime_expansions = ("approval_delay", "approval_duration",

866

"created", "enabled", "expires", "key_id",

453

"created", "enabled", "expires",

867

454

"fingerprint", "host", "interval",

868

455

"last_approval_request", "last_checked_ok",

869

456

"last_enabled", "name", "timeout")

870

client_defaults = {

871

"timeout": "PT5M",

872

"extended_timeout": "PT15M",

873

"interval": "PT2M",

874

"checker": "fping -q -- %%(host)s",

875

"host": "",

876

"approval_delay": "PT0S",

877

"approval_duration": "PT1S",

878

"approved_by_default": "True",

879

"enabled": "True",

880

}

881

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

482

882

483

@staticmethod

883

484

def config_parser(config):

884

485

"""Construct a new dict of client settings of this form:

891

492

for client_name in config.sections():

892

493

section = dict(config.items(client_name))

893

494

client = settings[client_name] = {}

894

495

895

496

client["host"] = section["host"]

896

497

# Reformat values from string types to Python types

897

498

client["approved_by_default"] = config.getboolean(

898

499

client_name, "approved_by_default")

899

500

client["enabled"] = config.getboolean(client_name,

900

501

"enabled")

901

902

# Uppercase and remove spaces from key_id and fingerprint

903

# for later comparison purposes with return value from the

904

# key_id() and fingerprint() functions

905

client["key_id"] = (section.get("key_id", "").upper()

906

.replace(" ", ""))

502

907

503

client["fingerprint"] = (section["fingerprint"].upper()

908

504

.replace(" ", ""))

909

505

if "secret" in section:

910

client["secret"] = codecs.decode(section["secret"]

911

.encode("utf-8"),

912

"base64")

506

client["secret"] = section["secret"].decode("base64")

913

507

elif "secfile" in section:

914

508

with open(os.path.expanduser(os.path.expandvars

915

509

(section["secfile"])),

916

510

"rb") as secfile:

917

511

client["secret"] = secfile.read()

918

512

else:

919

raise TypeError("No secret or secfile for section {}"

513

raise TypeError("No secret or secfile for section {0}"

920

514

.format(section))

921

515

client["timeout"] = string_to_delta(section["timeout"])

922

516

client["extended_timeout"] = string_to_delta(

930

524

client["last_approval_request"] = None

931

525

client["last_checked_ok"] = None

932

526

client["last_checker_status"] = -2

933

527

934

528

return settings

935

936

def __init__(self, settings, name=None, server_settings=None):

529

530

def __init__(self, settings, name = None, server_settings=None):

937

531

self.name = name

938

532

if server_settings is None:

939

533

server_settings = {}

940

534

self.server_settings = server_settings

941

535

# adding all client settings

942

for setting, value in settings.items():

536

for setting, value in settings.iteritems():

943

537

setattr(self, setting, value)

944

538

945

539

if self.enabled:

946

540

if not hasattr(self, "last_enabled"):

947

541

self.last_enabled = datetime.datetime.utcnow()

951

545

else:

952

546

self.last_enabled = None

953

547

self.expires = None

954

548

955

549

logger.debug("Creating client %r", self.name)

956

logger.debug(" Key ID: %s", self.key_id)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

957

553

logger.debug(" Fingerprint: %s", self.fingerprint)

958

554

self.created = settings.get("created",

959

555

datetime.datetime.utcnow())

960

556

961

557

# attributes specific for this server instance

962

558

self.checker = None

963

559

self.checker_initiator_tag = None

966

562

self.current_checker_command = None

967

563

self.approved = None

968

564

self.approvals_pending = 0

969

self.changedstate = multiprocessing_manager.Condition(

970

multiprocessing_manager.Lock())

971

self.client_structure = [attr

972

for attr in self.__dict__.keys()

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

973

570

if not attr.startswith("_")]

974

571

self.client_structure.append("client_structure")

975

976

for name, t in inspect.getmembers(

977

type(self), lambda obj: isinstance(obj, property)):

572

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

978

577

if not name.startswith("_"):

979

578

self.client_structure.append(name)

980

579

981

580

# Send notice to process children that client state has changed

982

581

def send_changedstate(self):

983

582

with self.changedstate:

984

583

self.changedstate.notify_all()

985

584

986

585

def enable(self):

987

586

"""Start this client's checker and timeout hooks"""

988

587

if getattr(self, "enabled", False):

993

592

self.last_enabled = datetime.datetime.utcnow()

994

593

self.init_checker()

995

594

self.send_changedstate()

996

595

997

596

def disable(self, quiet=True):

998

597

"""Disable this client."""

999

598

if not getattr(self, "enabled", False):

1001

600

if not quiet:

1002

601

logger.info("Disabling client %s", self.name)

1003

602

if getattr(self, "disable_initiator_tag", None) is not None:

1004

GLib.source_remove(self.disable_initiator_tag)

603

gobject.source_remove(self.disable_initiator_tag)

1005

604

self.disable_initiator_tag = None

1006

605

self.expires = None

1007

606

if getattr(self, "checker_initiator_tag", None) is not None:

1008

GLib.source_remove(self.checker_initiator_tag)

607

gobject.source_remove(self.checker_initiator_tag)

1009

608

self.checker_initiator_tag = None

1010

609

self.stop_checker()

1011

610

self.enabled = False

1012

611

if not quiet:

1013

612

self.send_changedstate()

1014

# Do not run this again if called by a GLib.timeout_add

613

# Do not run this again if called by a gobject.timeout_add

1015

614

return False

1016

615

1017

616

def __del__(self):

1018

617

self.disable()

1019

618

1020

619

def init_checker(self):

1021

620

# Schedule a new checker to be started an 'interval' from now,

1022

621

# and every interval from then on.

1023

622

if self.checker_initiator_tag is not None:

1024

GLib.source_remove(self.checker_initiator_tag)

1025

self.checker_initiator_tag = GLib.timeout_add(

1026

int(self.interval.total_seconds() * 1000),

1027

self.start_checker)

623

gobject.source_remove(self.checker_initiator_tag)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

1028

627

# Schedule a disable() when 'timeout' has passed

1029

628

if self.disable_initiator_tag is not None:

1030

GLib.source_remove(self.disable_initiator_tag)

1031

self.disable_initiator_tag = GLib.timeout_add(

1032

int(self.timeout.total_seconds() * 1000), self.disable)

629

gobject.source_remove(self.disable_initiator_tag)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

1033

633

# Also start a new checker *right now*.

1034

634

self.start_checker()

1035

1036

def checker_callback(self, source, condition, connection,

1037

command):

635

636

def checker_callback(self, pid, condition, command):

1038

637

"""The checker has completed, so take appropriate actions."""

1039

638

self.checker_callback_tag = None

1040

639

self.checker = None

1041

# Read return code from connection (see call_pipe)

1042

returncode = connection.recv()

1043

connection.close()

1044

1045

if returncode >= 0:

1046

self.last_checker_status = returncode

1047

self.last_checker_signal = None

640

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

1048

642

if self.last_checker_status == 0:

1049

643

logger.info("Checker for %(name)s succeeded",

1050

644

vars(self))

1051

645

self.checked_ok()

1052

646

else:

1053

logger.info("Checker for %(name)s failed", vars(self))

647

logger.info("Checker for %(name)s failed",

648

vars(self))

1054

649

else:

1055

650

self.last_checker_status = -1

1056

self.last_checker_signal = -returncode

1057

651

logger.warning("Checker for %(name)s crashed?",

1058

652

vars(self))

1059

return False

1060

653

1061

654

def checked_ok(self):

1062

655

"""Assert that the client has been seen, alive and well."""

1063

656

self.last_checked_ok = datetime.datetime.utcnow()

1064

657

self.last_checker_status = 0

1065

self.last_checker_signal = None

1066

658

self.bump_timeout()

1067

659

1068

660

def bump_timeout(self, timeout=None):

1069

661

"""Bump up the timeout for this client."""

1070

662

if timeout is None:

1071

663

timeout = self.timeout

1072

664

if self.disable_initiator_tag is not None:

1073

GLib.source_remove(self.disable_initiator_tag)

665

gobject.source_remove(self.disable_initiator_tag)

1074

666

self.disable_initiator_tag = None

1075

667

if getattr(self, "enabled", False):

1076

self.disable_initiator_tag = GLib.timeout_add(

1077

int(timeout.total_seconds() * 1000), self.disable)

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

1078

671

self.expires = datetime.datetime.utcnow() + timeout

1079

672

1080

673

def need_approval(self):

1081

674

self.last_approval_request = datetime.datetime.utcnow()

1082

675

1083

676

def start_checker(self):

1084

677

"""Start a new checker subprocess if one is not running.

1085

678

1086

679

If a checker already exists, leave it running and do

1087

680

nothing."""

1088

681

# The reason for not killing a running checker is that if we

1093

686

# checkers alone, the checker would have to take more time

1094

687

# than 'timeout' for the client to be disabled, which is as it

1095

688

# should be.

1096

1097

if self.checker is not None and not self.checker.is_alive():

1098

logger.warning("Checker was not alive; joining")

1099

self.checker.join()

1100

self.checker = None

689

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

1101

704

# Start a new checker if needed

1102

705

if self.checker is None:

1103

706

# Escape attributes for the shell

1104

escaped_attrs = {

1105

attr: re.escape(str(getattr(self, attr)))

1106

for attr in self.runtime_expansions}

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

1107

711

try:

1108

712

command = self.checker_command % escaped_attrs

1109

713

except TypeError as error:

1110

714

logger.error('Could not format string "%s"',

1111

self.checker_command,

715

self.checker_command, exc_info=error)

716

return True # Try again later

717

self.current_checker_command = command

718

try:

719

logger.info("Starting checker %r for %s",

720

command, self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True, cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

1112

739

exc_info=error)

1113

return True # Try again later

1114

self.current_checker_command = command

1115

logger.info("Starting checker %r for %s", command,

1116

self.name)

1117

# We don't need to redirect stdout and stderr, since

1118

# in normal mode, that is already done by daemon(),

1119

# and in debug mode we don't want to. (Stdin is

1120

# always replaced by /dev/null.)

1121

# The exception is when not debugging but nevertheless

1122

# running in the foreground; use the previously

1123

# created wnull.

1124

popen_args = {"close_fds": True,

1125

"shell": True,

1126

"cwd": "/"}

1127

if (not self.server_settings["debug"]

1128

and self.server_settings["foreground"]):

1129

popen_args.update({"stdout": wnull,

1130

"stderr": wnull})

1131

pipe = multiprocessing.Pipe(duplex=False)

1132

self.checker = multiprocessing.Process(

1133

target=call_pipe,

1134

args=(pipe[1], subprocess.call, command),

1135

kwargs=popen_args)

1136

self.checker.start()

1137

self.checker_callback_tag = GLib.io_add_watch(

1138

pipe[0].fileno(), GLib.IO_IN,

1139

self.checker_callback, pipe[0], command)

1140

# Re-run this periodically if run by GLib.timeout_add

740

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

745

# The checker may have completed before the gobject

746

# watch was added. Check for this.

747

try:

748

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

749

except OSError as error:

750

if error.errno == errno.ECHILD:

751

# This should never happen

752

logger.error("Child process vanished",

753

exc_info=error)

754

return True

755

raise

756

if pid:

757

gobject.source_remove(self.checker_callback_tag)

758

self.checker_callback(pid, status, command)

759

# Re-run this periodically if run by gobject.timeout_add

1141

760

return True

1142

761

1143

762

def stop_checker(self):

1144

763

"""Force the checker process, if any, to stop."""

1145

764

if self.checker_callback_tag:

1146

GLib.source_remove(self.checker_callback_tag)

765

gobject.source_remove(self.checker_callback_tag)

1147

766

self.checker_callback_tag = None

1148

767

if getattr(self, "checker", None) is None:

1149

768

return

1150

769

logger.debug("Stopping checker for %(name)s", vars(self))

1151

self.checker.terminate()

770

try:

771

self.checker.terminate()

772

#time.sleep(0.5)

773

#if self.checker.poll() is None:

774

# self.checker.kill()

775

except OSError as error:

776

if error.errno != errno.ESRCH: # No such process

777

raise

1152

778

self.checker = None

1153

779

1154

780

1155

def dbus_service_property(dbus_interface,

1156

signature="v",

1157

access="readwrite",

1158

byte_arrays=False):

781

def dbus_service_property(dbus_interface, signature="v",

782

access="readwrite", byte_arrays=False):

1159

783

"""Decorators for marking methods of a DBusObjectWithProperties to

1160

784

become properties on the D-Bus.

1161

785

1162

786

The decorated method will be called with no arguments by "Get"

1163

787

and with one argument by "Set".

1164

788

1165

789

The parameters, where they are supported, are the same as

1166

790

dbus.service.method, except there is only "signature", since the

1167

791

type from Get() and the type sent to Set() is the same.

1170

794

# "Set" method, so we fail early here:

1171

795

if byte_arrays and signature != "ay":

1172

796

raise ValueError("Byte arrays not supported for non-'ay'"

1173

" signature {!r}".format(signature))

1174

797

" signature {0!r}".format(signature))

1175

798

def decorator(func):

1176

799

func._dbus_is_property = True

1177

800

func._dbus_interface = dbus_interface

1180

803

func._dbus_name = func.__name__

1181

804

if func._dbus_name.endswith("_dbus_property"):

1182

805

func._dbus_name = func._dbus_name[:-14]

1183

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

806

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1184

807

return func

1185

1186

808

return decorator

1187

809

1188

810

1189

811

def dbus_interface_annotations(dbus_interface):

1190

812

"""Decorator for marking functions returning interface annotations

1191

813

1192

814

Usage:

1193

815

1194

816

@dbus_interface_annotations("org.example.Interface")

1195

817

def _foo(self): # Function name does not matter

1196

818

return {"org.freedesktop.DBus.Deprecated": "true",

1197

819

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1198

820

"false"}

1199

821

"""

1200

1201

822

def decorator(func):

1202

823

func._dbus_is_interface = True

1203

824

func._dbus_interface = dbus_interface

1204

825

func._dbus_name = dbus_interface

1205

826

return func

1206

1207

827

return decorator

1208

828

1209

829

1210

830

def dbus_annotations(annotations):

1211

831

"""Decorator to annotate D-Bus methods, signals or properties

1212

832

Usage:

1213

1214

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1215

"org.freedesktop.DBus.Property."

1216

"EmitsChangedSignal": "false"})

833

1217

834

@dbus_service_property("org.example.Interface", signature="b",

1218

835

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

1219

839

def Property_dbus_property(self):

1220

840

return dbus.Boolean(False)

1221

1222

See also the DBusObjectWithAnnotations class.

1223

841

"""

1224

1225

842

def decorator(func):

1226

843

func._dbus_annotations = annotations

1227

844

return func

1228

1229

845

return decorator

1230

846

1231

847

1232

848

class DBusPropertyException(dbus.exceptions.DBusException):

1233

849

"""A base class for D-Bus property-related exceptions

1234

850

"""

1235

pass

851

def __unicode__(self):

852

return unicode(str(self))

1236

853

1237

854

1238

855

class DBusPropertyAccessException(DBusPropertyException):

1247

864

pass

1248

865

1249

866

1250

class DBusObjectWithAnnotations(dbus.service.Object):

1251

"""A D-Bus object with annotations.

1252

1253

Classes inheriting from this can use the dbus_annotations

1254

decorator to add annotations to methods or signals.

867

class DBusObjectWithProperties(dbus.service.Object):

868

"""A D-Bus object with properties.

869

870

Classes inheriting from this can use the dbus_service_property

871

decorator to expose methods as D-Bus properties. It exposes the

872

standard Get(), Set(), and GetAll() methods on the D-Bus.

1255

873

"""

1256

874

1257

875

@staticmethod

1258

876

def _is_dbus_thing(thing):

1259

877

"""Returns a function testing if an attribute is a D-Bus thing

1260

878

1261

879

If called like _is_dbus_thing("method") it returns a function

1262

880

suitable for use as predicate to inspect.getmembers().

1263

881

"""

1264

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1265

883

False)

1266

884

1267

885

def _get_all_dbus_things(self, thing):

1268

886

"""Returns a generator of (name, attribute) pairs

1269

887

"""

1270

return ((getattr(athing.__get__(self), "_dbus_name", name),

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

1271

890

athing.__get__(self))

1272

891

for cls in self.__class__.__mro__

1273

892

for name, athing in

1274

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1275

1276

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1277

out_signature="s",

1278

path_keyword='object_path',

1279

connection_keyword='connection')

1280

def Introspect(self, object_path, connection):

1281

"""Overloading of standard D-Bus method.

1282

1283

Inserts annotation tags on methods and signals.

1284

"""

1285

xmlstring = dbus.service.Object.Introspect(self, object_path,

1286

connection)

1287

try:

1288

document = xml.dom.minidom.parseString(xmlstring)

1289

1290

for if_tag in document.getElementsByTagName("interface"):

1291

# Add annotation tags

1292

for typ in ("method", "signal"):

1293

for tag in if_tag.getElementsByTagName(typ):

1294

annots = dict()

1295

for name, prop in (self.

1296

_get_all_dbus_things(typ)):

1297

if (name == tag.getAttribute("name")

1298

and prop._dbus_interface

1299

== if_tag.getAttribute("name")):

1300

annots.update(getattr(

1301

prop, "_dbus_annotations", {}))

1302

for name, value in annots.items():

1303

ann_tag = document.createElement(

1304

"annotation")

1305

ann_tag.setAttribute("name", name)

1306

ann_tag.setAttribute("value", value)

1307

tag.appendChild(ann_tag)

1308

# Add interface annotation tags

1309

for annotation, value in dict(

1310

itertools.chain.from_iterable(

1311

annotations().items()

1312

for name, annotations

1313

in self._get_all_dbus_things("interface")

1314

if name == if_tag.getAttribute("name")

1315

)).items():

1316

ann_tag = document.createElement("annotation")

1317

ann_tag.setAttribute("name", annotation)

1318

ann_tag.setAttribute("value", value)

1319

if_tag.appendChild(ann_tag)

1320

# Fix argument name for the Introspect method itself

1321

if (if_tag.getAttribute("name")

1322

== dbus.INTROSPECTABLE_IFACE):

1323

for cn in if_tag.getElementsByTagName("method"):

1324

if cn.getAttribute("name") == "Introspect":

1325

for arg in cn.getElementsByTagName("arg"):

1326

if (arg.getAttribute("direction")

1327

== "out"):

1328

arg.setAttribute("name",

1329

"xml_data")

1330

xmlstring = document.toxml("utf-8")

1331

document.unlink()

1332

except (AttributeError, xml.dom.DOMException,

1333

xml.parsers.expat.ExpatError) as error:

1334

logger.error("Failed to override Introspection method",

1335

exc_info=error)

1336

return xmlstring

1337

1338

1339

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1340

"""A D-Bus object with properties.

1341

1342

Classes inheriting from this can use the dbus_service_property

1343

decorator to expose methods as D-Bus properties. It exposes the

1344

standard Get(), Set(), and GetAll() methods on the D-Bus.

1345

"""

1346

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

895

1347

896

def _get_dbus_property(self, interface_name, property_name):

1348

897

"""Returns a bound method if one exists which is a D-Bus

1349

898

property with the specified name and interface.

1350

899

"""

1351

for cls in self.__class__.__mro__:

1352

for name, value in inspect.getmembers(

1353

cls, self._is_dbus_thing("property")):

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

1354

904

if (value._dbus_name == property_name

1355

905

and value._dbus_interface == interface_name):

1356

906

return value.__get__(self)

1357

907

1358

908

# No such property

1359

raise DBusPropertyNotFound("{}:{}.{}".format(

1360

self.dbus_object_path, interface_name, property_name))

1361

1362

@classmethod

1363

def _get_all_interface_names(cls):

1364

"""Get a sequence of all interfaces supported by an object"""

1365

return (name for name in set(getattr(getattr(x, attr),

1366

"_dbus_interface", None)

1367

for x in (inspect.getmro(cls))

1368

for attr in dir(x))

1369

if name is not None)

1370

1371

@dbus.service.method(dbus.PROPERTIES_IFACE,

1372

in_signature="ss",

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

+ interface_name + "."

911

+ property_name)

912

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1373

914

out_signature="v")

1374

915

def Get(self, interface_name, property_name):

1375

916

"""Standard D-Bus property Get() method, see D-Bus standard.

1381

922

if not hasattr(value, "variant_level"):

1382

923

return value

1383

924

return type(value)(value, variant_level=value.variant_level+1)

1384

925

1385

926

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1386

927

def Set(self, interface_name, property_name, value):

1387

928

"""Standard D-Bus property Set() method, see D-Bus standard.

1393

934

# The byte_arrays option is not supported yet on

1394

935

# signatures other than "ay".

1395

936

if prop._dbus_signature != "ay":

1396

raise ValueError("Byte arrays not supported for non-"

1397

"'ay' signature {!r}"

1398

.format(prop._dbus_signature))

937

raise ValueError

1399

938

value = dbus.ByteArray(b''.join(chr(byte)

1400

939

for byte in value))

1401

940

prop(value)

1402

1403

@dbus.service.method(dbus.PROPERTIES_IFACE,

1404

in_signature="s",

941

942

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1405

943

out_signature="a{sv}")

1406

944

def GetAll(self, interface_name):

1407

945

"""Standard D-Bus property GetAll() method, see D-Bus

1408

946

standard.

1409

947

1410

948

Note: Will not include properties with access="write".

1411

949

"""

1412

950

properties = {}

1422

960

if not hasattr(value, "variant_level"):

1423

961

properties[name] = value

1424

962

continue

1425

properties[name] = type(value)(

1426

value, variant_level=value.variant_level + 1)

963

properties[name] = type(value)(value, variant_level=

964

value.variant_level+1)

1427

965

return dbus.Dictionary(properties, signature="sv")

1428

1429

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1430

def PropertiesChanged(self, interface_name, changed_properties,

1431

invalidated_properties):

1432

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1433

standard.

1434

"""

1435

pass

1436

966

1437

967

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1438

968

out_signature="s",

1439

969

path_keyword='object_path',

1440

970

connection_keyword='connection')

1441

971

def Introspect(self, object_path, connection):

1442

972

"""Overloading of standard D-Bus method.

1443

973

1444

974

Inserts property tags and interface annotation tags.

1445

975

"""

1446

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1447

object_path,

1448

connection)

976

xmlstring = dbus.service.Object.Introspect(self, object_path,

977

connection)

1449

978

try:

1450

979

document = xml.dom.minidom.parseString(xmlstring)

1451

1452

980

def make_tag(document, name, prop):

1453

981

e = document.createElement("property")

1454

982

e.setAttribute("name", name)

1455

983

e.setAttribute("type", prop._dbus_signature)

1456

984

e.setAttribute("access", prop._dbus_access)

1457

985

return e

1458

1459

986

for if_tag in document.getElementsByTagName("interface"):

1460

987

# Add property tags

1461

988

for tag in (make_tag(document, name, prop)

1464

991

if prop._dbus_interface

1465

992

== if_tag.getAttribute("name")):

1466

993

if_tag.appendChild(tag)

1467

# Add annotation tags for properties

1468

for tag in if_tag.getElementsByTagName("property"):

1469

annots = dict()

1470

for name, prop in self._get_all_dbus_things(

1471

"property"):

1472

if (name == tag.getAttribute("name")

1473

and prop._dbus_interface

1474

== if_tag.getAttribute("name")):

1475

annots.update(getattr(

1476

prop, "_dbus_annotations", {}))

1477

for name, value in annots.items():

1478

ann_tag = document.createElement(

1479

"annotation")

1480

ann_tag.setAttribute("name", name)

1481

ann_tag.setAttribute("value", value)

1482

tag.appendChild(ann_tag)

994

# Add annotation tags

995

for typ in ("method", "signal", "property"):

996

for tag in if_tag.getElementsByTagName(typ):

997

annots = dict()

998

for name, prop in (self.

999

_get_all_dbus_things(typ)):

1000

if (name == tag.getAttribute("name")

1001

and prop._dbus_interface

1002

== if_tag.getAttribute("name")):

1003

annots.update(getattr

1004

(prop,

1005

"_dbus_annotations",

1006

{}))

1007

for name, value in annots.iteritems():

1008

ann_tag = document.createElement(

1009

"annotation")

1010

ann_tag.setAttribute("name", name)

1011

ann_tag.setAttribute("value", value)

1012

tag.appendChild(ann_tag)

1013

# Add interface annotation tags

1014

for annotation, value in dict(

1015

itertools.chain.from_iterable(

1016

annotations().iteritems()

1017

for name, annotations in

1018

self._get_all_dbus_things("interface")

1019

if name == if_tag.getAttribute("name")

1020

)).iteritems():

1021

ann_tag = document.createElement("annotation")

1022

ann_tag.setAttribute("name", annotation)

1023

ann_tag.setAttribute("value", value)

1024

if_tag.appendChild(ann_tag)

1483

1025

# Add the names to the return values for the

1484

1026

# "org.freedesktop.DBus.Properties" methods

1485

1027

if (if_tag.getAttribute("name")

1504

1046

return xmlstring

1505

1047

1506

1048

1507

try:

1508

dbus.OBJECT_MANAGER_IFACE

1509

except AttributeError:

1510

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1511

1512

1513

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1514

"""A D-Bus object with an ObjectManager.

1515

1516

Classes inheriting from this exposes the standard

1517

GetManagedObjects call and the InterfacesAdded and

1518

InterfacesRemoved signals on the standard

1519

"org.freedesktop.DBus.ObjectManager" interface.

1520

1521

Note: No signals are sent automatically; they must be sent

1522

manually.

1523

"""

1524

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1525

out_signature="a{oa{sa{sv}}}")

1526

def GetManagedObjects(self):

1527

"""This function must be overridden"""

1528

raise NotImplementedError()

1529

1530

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1531

signature="oa{sa{sv}}")

1532

def InterfacesAdded(self, object_path, interfaces_and_properties):

1533

pass

1534

1535

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1536

def InterfacesRemoved(self, object_path, interfaces):

1537

pass

1538

1539

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1540

out_signature="s",

1541

path_keyword='object_path',

1542

connection_keyword='connection')

1543

def Introspect(self, object_path, connection):

1544

"""Overloading of standard D-Bus method.

1545

1546

Override return argument name of GetManagedObjects to be

1547

"objpath_interfaces_and_properties"

1548

"""

1549

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1550

object_path,

1551

connection)

1552

try:

1553

document = xml.dom.minidom.parseString(xmlstring)

1554

1555

for if_tag in document.getElementsByTagName("interface"):

1556

# Fix argument name for the GetManagedObjects method

1557

if (if_tag.getAttribute("name")

1558

== dbus.OBJECT_MANAGER_IFACE):

1559

for cn in if_tag.getElementsByTagName("method"):

1560

if (cn.getAttribute("name")

1561

== "GetManagedObjects"):

1562

for arg in cn.getElementsByTagName("arg"):

1563

if (arg.getAttribute("direction")

1564

== "out"):

1565

arg.setAttribute(

1566

"name",

1567

"objpath_interfaces"

1568

"_and_properties")

1569

xmlstring = document.toxml("utf-8")

1570

document.unlink()

1571

except (AttributeError, xml.dom.DOMException,

1572

xml.parsers.expat.ExpatError) as error:

1573

logger.error("Failed to override Introspection method",

1574

exc_info=error)

1575

return xmlstring

1576

1577

1578

1049

def datetime_to_dbus(dt, variant_level=0):

1579

1050

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1580

1051

if dt is None:

1581

return dbus.String("", variant_level=variant_level)

1582

return dbus.String(dt.isoformat(), variant_level=variant_level)

1052

return dbus.String("", variant_level = variant_level)

1053

return dbus.String(dt.isoformat(),

1054

variant_level=variant_level)

1583

1055

1584

1056

1585

1057

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1587

1059

dbus.service.Object, it will add alternate D-Bus attributes with

1588

1060

interface names according to the "alt_interface_names" mapping.

1589

1061

Usage:

1590

1062

1591

1063

@alternate_dbus_interfaces({"org.example.Interface":

1592

1064

"net.example.AlternateInterface"})

1593

1065

class SampleDBusObject(dbus.service.Object):

1594

1066

@dbus.service.method("org.example.Interface")

1595

1067

def SampleDBusMethod():

1596

1068

pass

1597

1069

1598

1070

The above "SampleDBusMethod" on "SampleDBusObject" will be

1599

1071

reachable via two interfaces: "org.example.Interface" and

1600

1072

"net.example.AlternateInterface", the latter of which will have

1601

1073

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1602

1074

"true", unless "deprecate" is passed with a False value.

1603

1075

1604

1076

This works for methods and signals, and also for D-Bus properties

1605

1077

(from DBusObjectWithProperties) and interfaces (from the

1606

1078

dbus_interface_annotations decorator).

1607

1079

"""

1608

1609

1080

def wrapper(cls):

1610

1081

for orig_interface_name, alt_interface_name in (

1611

alt_interface_names.items()):

1082

alt_interface_names.iteritems()):

1612

1083

attr = {}

1613

1084

interface_names = set()

1614

1085

# Go though all attributes of the class

1616

1087

# Ignore non-D-Bus attributes, and D-Bus attributes

1617

1088

# with the wrong interface name

1618

1089

if (not hasattr(attribute, "_dbus_interface")

1619

or not attribute._dbus_interface.startswith(

1620

orig_interface_name)):

1090

or not attribute._dbus_interface

1091

.startswith(orig_interface_name)):

1621

1092

continue

1622

1093

# Create an alternate D-Bus interface name based on

1623

1094

# the current name

1624

alt_interface = attribute._dbus_interface.replace(

1625

orig_interface_name, alt_interface_name)

1095

alt_interface = (attribute._dbus_interface

1096

.replace(orig_interface_name,

1097

alt_interface_name))

1626

1098

interface_names.add(alt_interface)

1627

1099

# Is this a D-Bus signal?

1628

1100

if getattr(attribute, "_dbus_is_signal", False):

1629

1101

# Extract the original non-method undecorated

1630

1102

# function by black magic

1631

if sys.version_info.major == 2:

1632

nonmethod_func = (dict(

1103

nonmethod_func = (dict(

1633

1104

zip(attribute.func_code.co_freevars,

1634

attribute.__closure__))

1635

["func"].cell_contents)

1636

else:

1637

nonmethod_func = (dict(

1638

zip(attribute.__code__.co_freevars,

1639

attribute.__closure__))

1640

["func"].cell_contents)

1105

attribute.__closure__))["func"]

1106

.cell_contents)

1641

1107

# Create a new, but exactly alike, function

1642

1108

# object, and decorate it to be a new D-Bus signal

1643

1109

# with the alternate D-Bus interface name

1644

new_function = copy_function(nonmethod_func)

1645

new_function = (dbus.service.signal(

1646

alt_interface,

1647

attribute._dbus_signature)(new_function))

1110

new_function = (dbus.service.signal

1111

(alt_interface,

1112

attribute._dbus_signature)

1113

(types.FunctionType(

1114

nonmethod_func.func_code,

1115

nonmethod_func.func_globals,

1116

nonmethod_func.func_name,

1117

nonmethod_func.func_defaults,

1118

nonmethod_func.func_closure)))

1648

1119

# Copy annotations, if any

1649

1120

try:

1650

new_function._dbus_annotations = dict(

1651

attribute._dbus_annotations)

1121

new_function._dbus_annotations = (

1122

dict(attribute._dbus_annotations))

1652

1123

except AttributeError:

1653

1124

pass

1654

1655

1125

# Define a creator of a function to call both the

1656

1126

# original and alternate functions, so both the

1657

1127

# original and alternate signals gets sent when

1660

1130

"""This function is a scope container to pass

1661

1131

func1 and func2 to the "call_both" function

1662

1132

outside of its arguments"""

1663

1664

@functools.wraps(func2)

1665

1133

def call_both(*args, **kwargs):

1666

1134

"""This function will emit two D-Bus

1667

1135

signals by calling func1 and func2"""

1668

1136

func1(*args, **kwargs)

1669

1137

func2(*args, **kwargs)

1670

# Make wrapper function look like a D-Bus

1671

# signal

1672

for name, attr in inspect.getmembers(func2):

1673

if name.startswith("_dbus_"):

1674

setattr(call_both, name, attr)

1675

1676

1138

return call_both

1677

1139

# Create the "call_both" function and add it to

1678

1140

# the class

1683

1145

# object. Decorate it to be a new D-Bus method

1684

1146

# with the alternate D-Bus interface name. Add it

1685

1147

# to the class.

1686

attr[attrname] = (

1687

dbus.service.method(

1688

alt_interface,

1689

attribute._dbus_in_signature,

1690

attribute._dbus_out_signature)

1691

(copy_function(attribute)))

1148

attr[attrname] = (dbus.service.method

1149

(alt_interface,

1150

attribute._dbus_in_signature,

1151

attribute._dbus_out_signature)

1152

(types.FunctionType

1153

(attribute.func_code,

1154

attribute.func_globals,

1155

attribute.func_name,

1156

attribute.func_defaults,

1157

attribute.func_closure)))

1692

1158

# Copy annotations, if any

1693

1159

try:

1694

attr[attrname]._dbus_annotations = dict(

1695

attribute._dbus_annotations)

1160

attr[attrname]._dbus_annotations = (

1161

dict(attribute._dbus_annotations))

1696

1162

except AttributeError:

1697

1163

pass

1698

1164

# Is this a D-Bus property?

1701

1167

# object, and decorate it to be a new D-Bus

1702

1168

# property with the alternate D-Bus interface

1703

1169

# name. Add it to the class.

1704

attr[attrname] = (dbus_service_property(

1705

alt_interface, attribute._dbus_signature,

1706

attribute._dbus_access,

1707

attribute._dbus_get_args_options

1708

["byte_arrays"])

1709

(copy_function(attribute)))

1170

attr[attrname] = (dbus_service_property

1171

(alt_interface,

1172

attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute

1175

._dbus_get_args_options

1176

["byte_arrays"])

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1710

1183

# Copy annotations, if any

1711

1184

try:

1712

attr[attrname]._dbus_annotations = dict(

1713

attribute._dbus_annotations)

1185

attr[attrname]._dbus_annotations = (

1186

dict(attribute._dbus_annotations))

1714

1187

except AttributeError:

1715

1188

pass

1716

1189

# Is this a D-Bus interface?

1719

1192

# object. Decorate it to be a new D-Bus interface

1720

1193

# with the alternate D-Bus interface name. Add it

1721

1194

# to the class.

1722

attr[attrname] = (

1723

dbus_interface_annotations(alt_interface)

1724

(copy_function(attribute)))

1195

attr[attrname] = (dbus_interface_annotations

1196

(alt_interface)

1197

(types.FunctionType

1198

(attribute.func_code,

1199

attribute.func_globals,

1200

attribute.func_name,

1201

attribute.func_defaults,

1202

attribute.func_closure)))

1725

1203

if deprecate:

1726

1204

# Deprecate all alternate interfaces

1727

iname = "_AlternateDBusNames_interface_annotation{}"

1205

iname="_AlternateDBusNames_interface_annotation{0}"

1728

1206

for interface_name in interface_names:

1729

1730

1207

@dbus_interface_annotations(interface_name)

1731

1208

def func(self):

1732

return {"org.freedesktop.DBus.Deprecated":

1733

"true"}

1209

return { "org.freedesktop.DBus.Deprecated":

1210

"true" }

1734

1211

# Find an unused name

1735

1212

for aname in (iname.format(i)

1736

1213

for i in itertools.count()):

1740

1217

if interface_names:

1741

1218

# Replace the class with a new subclass of it with

1742

1219

# methods, signals, etc. as created above.

1743

if sys.version_info.major == 2:

1744

cls = type(b"{}Alternate".format(cls.__name__),

1745

(cls, ), attr)

1746

else:

1747

cls = type("{}Alternate".format(cls.__name__),

1748

(cls, ), attr)

1220

cls = type(b"{0}Alternate".format(cls.__name__),

1221

(cls,), attr)

1749

1222

return cls

1750

1751

1223

return wrapper

1752

1224

1753

1225

1754

1226

@alternate_dbus_interfaces({"se.recompile.Mandos":

1755

"se.bsnet.fukt.Mandos"})

1227

"se.bsnet.fukt.Mandos"})

1756

1228

class ClientDBus(Client, DBusObjectWithProperties):

1757

1229

"""A Client class using D-Bus

1758

1230

1759

1231

Attributes:

1760

1232

dbus_object_path: dbus.ObjectPath

1761

1233

bus: dbus.SystemBus()

1762

1234

"""

1763

1235

1764

1236

runtime_expansions = (Client.runtime_expansions

1765

+ ("dbus_object_path", ))

1766

1767

_interface = "se.recompile.Mandos.Client"

1768

1237

+ ("dbus_object_path",))

1238

1769

1239

# dbus.service.Object doesn't use super(), so we can't either.

1770

1771

def __init__(self, bus=None, *args, **kwargs):

1240

1241

def __init__(self, bus = None, *args, **kwargs):

1772

1242

self.bus = bus

1773

1243

Client.__init__(self, *args, **kwargs)

1774

1244

# Only now, when this client is initialized, can it show up on

1775

1245

# the D-Bus

1776

client_object_name = str(self.name).translate(

1246

client_object_name = unicode(self.name).translate(

1777

1247

{ord("."): ord("_"),

1778

1248

ord("-"): ord("_")})

1779

self.dbus_object_path = dbus.ObjectPath(

1780

"/clients/" + client_object_name)

1249

self.dbus_object_path = (dbus.ObjectPath

1250

("/clients/" + client_object_name))

1781

1251

DBusObjectWithProperties.__init__(self, self.bus,

1782

1252

self.dbus_object_path)

1783

1784

def notifychangeproperty(transform_func, dbus_name,

1785

type_func=lambda x: x,

1786

variant_level=1,

1787

invalidate_only=False,

1788

_interface=_interface):

1253

1254

def notifychangeproperty(transform_func,

1255

dbus_name, type_func=lambda x: x,

1256

variant_level=1):

1789

1257

""" Modify a variable so that it's a property which announces

1790

1258

its changes to DBus.

1791

1259

1792

1260

transform_fun: Function that takes a value and a variant_level

1793

1261

and transforms it to a D-Bus type.

1794

1262

dbus_name: D-Bus name of the variable

1796

1264

to the D-Bus. Default: no transform

1797

1265

variant_level: D-Bus variant level. Default: 1

1798

1266

"""

1799

attrname = "_{}".format(dbus_name)

1800

1267

attrname = "_{0}".format(dbus_name)

1801

1268

def setter(self, value):

1802

1269

if hasattr(self, "dbus_object_path"):

1803

1270

if (not hasattr(self, attrname) or

1804

1271

type_func(getattr(self, attrname, None))

1805

1272

!= type_func(value)):

1806

if invalidate_only:

1807

self.PropertiesChanged(

1808

_interface, dbus.Dictionary(),

1809

dbus.Array((dbus_name, )))

1810

else:

1811

dbus_value = transform_func(

1812

type_func(value),

1813

variant_level=variant_level)

1814

self.PropertyChanged(dbus.String(dbus_name),

1815

dbus_value)

1816

self.PropertiesChanged(

1817

_interface,

1818

dbus.Dictionary({dbus.String(dbus_name):

1819

dbus_value}),

1820

dbus.Array())

1273

dbus_value = transform_func(type_func(value),

1274

variant_level

1275

=variant_level)

1276

self.PropertyChanged(dbus.String(dbus_name),

1277

dbus_value)

1821

1278

setattr(self, attrname, value)

1822

1279

1823

1280

return property(lambda self: getattr(self, attrname), setter)

1824

1281

1825

1282

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1826

1283

approvals_pending = notifychangeproperty(dbus.Boolean,

1827

1284

"ApprovalPending",

1828

type_func=bool)

1285

type_func = bool)

1829

1286

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1830

1287

last_enabled = notifychangeproperty(datetime_to_dbus,

1831

1288

"LastEnabled")

1832

checker = notifychangeproperty(

1833

dbus.Boolean, "CheckerRunning",

1834

type_func=lambda checker: checker is not None)

1289

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1290

type_func = lambda checker:

1291

checker is not None)

1835

1292

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1836

1293

"LastCheckedOK")

1837

1294

last_checker_status = notifychangeproperty(dbus.Int16,

1840

1297

datetime_to_dbus, "LastApprovalRequest")

1841

1298

approved_by_default = notifychangeproperty(dbus.Boolean,

1842

1299

"ApprovedByDefault")

1843

approval_delay = notifychangeproperty(

1844

dbus.UInt64, "ApprovalDelay",

1845

type_func=lambda td: td.total_seconds() * 1000)

1300

approval_delay = notifychangeproperty(dbus.UInt64,

1301

"ApprovalDelay",

1302

type_func =

1303

timedelta_to_milliseconds)

1846

1304

approval_duration = notifychangeproperty(

1847

1305

dbus.UInt64, "ApprovalDuration",

1848

type_func=lambda td: td.total_seconds() * 1000)

1306

type_func = timedelta_to_milliseconds)

1849

1307

host = notifychangeproperty(dbus.String, "Host")

1850

timeout = notifychangeproperty(

1851

dbus.UInt64, "Timeout",

1852

type_func=lambda td: td.total_seconds() * 1000)

1308

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1309

type_func =

1310

timedelta_to_milliseconds)

1853

1311

extended_timeout = notifychangeproperty(

1854

1312

dbus.UInt64, "ExtendedTimeout",

1855

type_func=lambda td: td.total_seconds() * 1000)

1856

interval = notifychangeproperty(

1857

dbus.UInt64, "Interval",

1858

type_func=lambda td: td.total_seconds() * 1000)

1313

type_func = timedelta_to_milliseconds)

1314

interval = notifychangeproperty(dbus.UInt64,

1315

"Interval",

1316

type_func =

1317

timedelta_to_milliseconds)

1859

1318

checker_command = notifychangeproperty(dbus.String, "Checker")

1860

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1861

invalidate_only=True)

1862

1319

1863

1320

del notifychangeproperty

1864

1321

1865

1322

def __del__(self, *args, **kwargs):

1866

1323

try:

1867

1324

self.remove_from_connection()

1870

1327

if hasattr(DBusObjectWithProperties, "__del__"):

1871

1328

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1872

1329

Client.__del__(self, *args, **kwargs)

1873

1874

def checker_callback(self, source, condition,

1875

connection, command, *args, **kwargs):

1876

ret = Client.checker_callback(self, source, condition,

1877

connection, command, *args,

1878

**kwargs)

1879

exitstatus = self.last_checker_status

1880

if exitstatus >= 0:

1330

1331

def checker_callback(self, pid, condition, command,

1332

*args, **kwargs):

1333

self.checker_callback_tag = None

1334

self.checker = None

1335

if os.WIFEXITED(condition):

1336

exitstatus = os.WEXITSTATUS(condition)

1881

1337

# Emit D-Bus signal

1882

1338

self.CheckerCompleted(dbus.Int16(exitstatus),

1883

# This is specific to GNU libC

1884

dbus.Int64(exitstatus << 8),

1339

dbus.Int64(condition),

1885

1340

dbus.String(command))

1886

1341

else:

1887

1342

# Emit D-Bus signal

1888

1343

self.CheckerCompleted(dbus.Int16(-1),

1889

dbus.Int64(

1890

# This is specific to GNU libC

1891

(exitstatus << 8)

1892

| self.last_checker_signal),

1344

dbus.Int64(condition),

1893

1345

dbus.String(command))

1894

return ret

1895

1346

1347

return Client.checker_callback(self, pid, condition, command,

1348

*args, **kwargs)

1349

1896

1350

def start_checker(self, *args, **kwargs):

1897

old_checker_pid = getattr(self.checker, "pid", None)

1351

old_checker = self.checker

1352

if self.checker is not None:

1353

old_checker_pid = self.checker.pid

1354

else:

1355

old_checker_pid = None

1898

1356

r = Client.start_checker(self, *args, **kwargs)

1899

1357

# Only if new checker process was started

1900

1358

if (self.checker is not None

1902

1360

# Emit D-Bus signal

1903

1361

self.CheckerStarted(self.current_checker_command)

1904

1362

return r

1905

1363

1906

1364

def _reset_approved(self):

1907

1365

self.approved = None

1908

1366

return False

1909

1367

1910

1368

def approve(self, value=True):

1911

1369

self.approved = value

1912

GLib.timeout_add(int(self.approval_duration.total_seconds()

1913

* 1000), self._reset_approved)

1370

gobject.timeout_add(timedelta_to_milliseconds

1371

(self.approval_duration),

1372

self._reset_approved)

1914

1373

self.send_changedstate()

1915

1916

# D-Bus methods, signals & properties

1917

1918

# Interfaces

1919

1920

# Signals

1921

1374

1375

## D-Bus methods, signals & properties

1376

_interface = "se.recompile.Mandos.Client"

1377

1378

## Interfaces

1379

1380

@dbus_interface_annotations(_interface)

1381

def _foo(self):

1382

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1383

"false"}

1384

1385

## Signals

1386

1922

1387

# CheckerCompleted - signal

1923

1388

@dbus.service.signal(_interface, signature="nxs")

1924

1389

def CheckerCompleted(self, exitcode, waitstatus, command):

1925

1390

"D-Bus signal"

1926

1391

pass

1927

1392

1928

1393

# CheckerStarted - signal

1929

1394

@dbus.service.signal(_interface, signature="s")

1930

1395

def CheckerStarted(self, command):

1931

1396

"D-Bus signal"

1932

1397

pass

1933

1398

1934

1399

# PropertyChanged - signal

1935

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1936

1400

@dbus.service.signal(_interface, signature="sv")

1937

1401

def PropertyChanged(self, property, value):

1938

1402

"D-Bus signal"

1939

1403

pass

1940

1404

1941

1405

# GotSecret - signal

1942

1406

@dbus.service.signal(_interface)

1943

1407

def GotSecret(self):

1946

1410

server to mandos-client

1947

1411

"""

1948

1412

pass

1949

1413

1950

1414

# Rejected - signal

1951

1415

@dbus.service.signal(_interface, signature="s")

1952

1416

def Rejected(self, reason):

1953

1417

"D-Bus signal"

1954

1418

pass

1955

1419

1956

1420

# NeedApproval - signal

1957

1421

@dbus.service.signal(_interface, signature="tb")

1958

1422

def NeedApproval(self, timeout, default):

1959

1423

"D-Bus signal"

1960

1424

return self.need_approval()

1961

1962

# Methods

1963

1425

1426

## Methods

1427

1964

1428

# Approve - method

1965

1429

@dbus.service.method(_interface, in_signature="b")

1966

1430

def Approve(self, value):

1967

1431

self.approve(value)

1968

1432

1969

1433

# CheckedOK - method

1970

1434

@dbus.service.method(_interface)

1971

1435

def CheckedOK(self):

1972

1436

self.checked_ok()

1973

1437

1974

1438

# Enable - method

1975

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1976

1439

@dbus.service.method(_interface)

1977

1440

def Enable(self):

1978

1441

"D-Bus method"

1979

1442

self.enable()

1980

1443

1981

1444

# StartChecker - method

1982

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1983

1445

@dbus.service.method(_interface)

1984

1446

def StartChecker(self):

1985

1447

"D-Bus method"

1986

1448

self.start_checker()

1987

1449

1988

1450

# Disable - method

1989

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1990

1451

@dbus.service.method(_interface)

1991

1452

def Disable(self):

1992

1453

"D-Bus method"

1993

1454

self.disable()

1994

1455

1995

1456

# StopChecker - method

1996

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1997

1457

@dbus.service.method(_interface)

1998

1458

def StopChecker(self):

1999

1459

self.stop_checker()

2000

2001

# Properties

2002

1460

1461

## Properties

1462

2003

1463

# ApprovalPending - property

2004

1464

@dbus_service_property(_interface, signature="b", access="read")

2005

1465

def ApprovalPending_dbus_property(self):

2006

1466

return dbus.Boolean(bool(self.approvals_pending))

2007

1467

2008

1468

# ApprovedByDefault - property

2009

@dbus_service_property(_interface,

2010

signature="b",

1469

@dbus_service_property(_interface, signature="b",

2011

1470

access="readwrite")

2012

1471

def ApprovedByDefault_dbus_property(self, value=None):

2013

1472

if value is None: # get

2014

1473

return dbus.Boolean(self.approved_by_default)

2015

1474

self.approved_by_default = bool(value)

2016

1475

2017

1476

# ApprovalDelay - property

2018

@dbus_service_property(_interface,

2019

signature="t",

1477

@dbus_service_property(_interface, signature="t",

2020

1478

access="readwrite")

2021

1479

def ApprovalDelay_dbus_property(self, value=None):

2022

1480

if value is None: # get

2023

return dbus.UInt64(self.approval_delay.total_seconds()

2024

* 1000)

1481

return dbus.UInt64(self.approval_delay_milliseconds())

2025

1482

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2026

1483

2027

1484

# ApprovalDuration - property

2028

@dbus_service_property(_interface,

2029

signature="t",

1485

@dbus_service_property(_interface, signature="t",

2030

1486

access="readwrite")

2031

1487

def ApprovalDuration_dbus_property(self, value=None):

2032

1488

if value is None: # get

2033

return dbus.UInt64(self.approval_duration.total_seconds()

2034

* 1000)

1489

return dbus.UInt64(timedelta_to_milliseconds(

1490

self.approval_duration))

2035

1491

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2036

1492

2037

1493

# Name - property

2038

@dbus_annotations(

2039

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2040

1494

@dbus_service_property(_interface, signature="s", access="read")

2041

1495

def Name_dbus_property(self):

2042

1496

return dbus.String(self.name)

2043

2044

# KeyID - property

2045

@dbus_annotations(

2046

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2047

@dbus_service_property(_interface, signature="s", access="read")

2048

def KeyID_dbus_property(self):

2049

return dbus.String(self.key_id)

2050

1497

2051

1498

# Fingerprint - property

2052

@dbus_annotations(

2053

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2054

1499

@dbus_service_property(_interface, signature="s", access="read")

2055

1500

def Fingerprint_dbus_property(self):

2056

1501

return dbus.String(self.fingerprint)

2057

1502

2058

1503

# Host - property

2059

@dbus_service_property(_interface,

2060

signature="s",

1504

@dbus_service_property(_interface, signature="s",

2061

1505

access="readwrite")

2062

1506

def Host_dbus_property(self, value=None):

2063

1507

if value is None: # get

2064

1508

return dbus.String(self.host)

2065

self.host = str(value)

2066

1509

self.host = unicode(value)

1510

2067

1511

# Created - property

2068

@dbus_annotations(

2069

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2070

1512

@dbus_service_property(_interface, signature="s", access="read")

2071

1513

def Created_dbus_property(self):

2072

1514

return datetime_to_dbus(self.created)

2073

1515

2074

1516

# LastEnabled - property

2075

1517

@dbus_service_property(_interface, signature="s", access="read")

2076

1518

def LastEnabled_dbus_property(self):

2077

1519

return datetime_to_dbus(self.last_enabled)

2078

1520

2079

1521

# Enabled - property

2080

@dbus_service_property(_interface,

2081

signature="b",

1522

@dbus_service_property(_interface, signature="b",

2082

1523

access="readwrite")

2083

1524

def Enabled_dbus_property(self, value=None):

2084

1525

if value is None: # get

2087

1528

self.enable()

2088

1529

else:

2089

1530

self.disable()

2090

1531

2091

1532

# LastCheckedOK - property

2092

@dbus_service_property(_interface,

2093

signature="s",

1533

@dbus_service_property(_interface, signature="s",

2094

1534

access="readwrite")

2095

1535

def LastCheckedOK_dbus_property(self, value=None):

2096

1536

if value is not None:

2097

1537

self.checked_ok()

2098

1538

return

2099

1539

return datetime_to_dbus(self.last_checked_ok)

2100

1540

2101

1541

# LastCheckerStatus - property

2102

@dbus_service_property(_interface, signature="n", access="read")

1542

@dbus_service_property(_interface, signature="n",

1543

access="read")

2103

1544

def LastCheckerStatus_dbus_property(self):

2104

1545

return dbus.Int16(self.last_checker_status)

2105

1546

2106

1547

# Expires - property

2107

1548

@dbus_service_property(_interface, signature="s", access="read")

2108

1549

def Expires_dbus_property(self):

2109

1550

return datetime_to_dbus(self.expires)

2110

1551

2111

1552

# LastApprovalRequest - property

2112

1553

@dbus_service_property(_interface, signature="s", access="read")

2113

1554

def LastApprovalRequest_dbus_property(self):

2114

1555

return datetime_to_dbus(self.last_approval_request)

2115

1556

2116

1557

# Timeout - property

2117

@dbus_service_property(_interface,

2118

signature="t",

1558

@dbus_service_property(_interface, signature="t",

2119

1559

access="readwrite")

2120

1560

def Timeout_dbus_property(self, value=None):

2121

1561

if value is None: # get

2122

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

return dbus.UInt64(self.timeout_milliseconds())

2123

1563

old_timeout = self.timeout

2124

1564

self.timeout = datetime.timedelta(0, 0, 0, value)

2125

1565

# Reschedule disabling

2133

1573

if (getattr(self, "disable_initiator_tag", None)

2134

1574

is None):

2135

1575

return

2136

GLib.source_remove(self.disable_initiator_tag)

2137

self.disable_initiator_tag = GLib.timeout_add(

2138

int((self.expires - now).total_seconds() * 1000),

2139

self.disable)

2140

1576

gobject.source_remove(self.disable_initiator_tag)

1577

self.disable_initiator_tag = (

1578

gobject.timeout_add(

1579

timedelta_to_milliseconds(self.expires - now),

1580

self.disable))

1581

2141

1582

# ExtendedTimeout - property

2142

@dbus_service_property(_interface,

2143

signature="t",

1583

@dbus_service_property(_interface, signature="t",

2144

1584

access="readwrite")

2145

1585

def ExtendedTimeout_dbus_property(self, value=None):

2146

1586

if value is None: # get

2147

return dbus.UInt64(self.extended_timeout.total_seconds()

2148

* 1000)

1587

return dbus.UInt64(self.extended_timeout_milliseconds())

2149

1588

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2150

1589

2151

1590

# Interval - property

2152

@dbus_service_property(_interface,

2153

signature="t",

1591

@dbus_service_property(_interface, signature="t",

2154

1592

access="readwrite")

2155

1593

def Interval_dbus_property(self, value=None):

2156

1594

if value is None: # get

2157

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

return dbus.UInt64(self.interval_milliseconds())

2158

1596

self.interval = datetime.timedelta(0, 0, 0, value)

2159

1597

if getattr(self, "checker_initiator_tag", None) is None:

2160

1598

return

2161

1599

if self.enabled:

2162

1600

# Reschedule checker run

2163

GLib.source_remove(self.checker_initiator_tag)

2164

self.checker_initiator_tag = GLib.timeout_add(

2165

value, self.start_checker)

2166

self.start_checker() # Start one now, too

2167

1601

gobject.source_remove(self.checker_initiator_tag)

1602

self.checker_initiator_tag = (gobject.timeout_add

1603

(value, self.start_checker))

1604

self.start_checker() # Start one now, too

1605

2168

1606

# Checker - property

2169

@dbus_service_property(_interface,

2170

signature="s",

1607

@dbus_service_property(_interface, signature="s",

2171

1608

access="readwrite")

2172

1609

def Checker_dbus_property(self, value=None):

2173

1610

if value is None: # get

2174

1611

return dbus.String(self.checker_command)

2175

self.checker_command = str(value)

2176

1612

self.checker_command = unicode(value)

1613

2177

1614

# CheckerRunning - property

2178

@dbus_service_property(_interface,

2179

signature="b",

1615

@dbus_service_property(_interface, signature="b",

2180

1616

access="readwrite")

2181

1617

def CheckerRunning_dbus_property(self, value=None):

2182

1618

if value is None: # get

2185

1621

self.start_checker()

2186

1622

else:

2187

1623

self.stop_checker()

2188

1624

2189

1625

# ObjectPath - property

2190

@dbus_annotations(

2191

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2192

"org.freedesktop.DBus.Deprecated": "true"})

2193

1626

@dbus_service_property(_interface, signature="o", access="read")

2194

1627

def ObjectPath_dbus_property(self):

2195

return self.dbus_object_path # is already a dbus.ObjectPath

2196

1628

return self.dbus_object_path # is already a dbus.ObjectPath

1629

2197

1630

# Secret = property

2198

@dbus_annotations(

2199

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2200

"invalidates"})

2201

@dbus_service_property(_interface,

2202

signature="ay",

2203

access="write",

2204

byte_arrays=True)

1631

@dbus_service_property(_interface, signature="ay",

1632

access="write", byte_arrays=True)

2205

1633

def Secret_dbus_property(self, value):

2206

self.secret = bytes(value)

2207

1634

self.secret = str(value)

1635

2208

1636

del _interface

2209

1637

2210

1638

2211

1639

class ProxyClient(object):

2212

def __init__(self, child_pipe, key_id, fpr, address):

1640

def __init__(self, child_pipe, fpr, address):

2213

1641

self._pipe = child_pipe

2214

self._pipe.send(('init', key_id, fpr, address))

1642

self._pipe.send(('init', fpr, address))

2215

1643

if not self._pipe.recv():

2216

raise KeyError(key_id or fpr)

2217

1644

raise KeyError()

1645

2218

1646

def __getattribute__(self, name):

2219

1647

if name == '_pipe':

2220

1648

return super(ProxyClient, self).__getattribute__(name)

2223

1651

if data[0] == 'data':

2224

1652

return data[1]

2225

1653

if data[0] == 'function':

2226

2227

1654

def func(*args, **kwargs):

2228

1655

self._pipe.send(('funcall', name, args, kwargs))

2229

1656

return self._pipe.recv()[1]

2230

2231

1657

return func

2232

1658

2233

1659

def __setattr__(self, name, value):

2234

1660

if name == '_pipe':

2235

1661

return super(ProxyClient, self).__setattr__(name, value)

2238

1664

2239

1665

class ClientHandler(socketserver.BaseRequestHandler, object):

2240

1666

"""A class to handle client connections.

2241

1667

2242

1668

Instantiated once for each connection to handle it.

2243

1669

Note: This will run in its own forked process."""

2244

1670

2245

1671

def handle(self):

2246

1672

with contextlib.closing(self.server.child_pipe) as child_pipe:

2247

1673

logger.info("TCP connection from: %s",

2248

str(self.client_address))

1674

unicode(self.client_address))

2249

1675

logger.debug("Pipe FD: %d",

2250

1676

self.server.child_pipe.fileno())

2251

2252

session = gnutls.ClientSession(self.request)

2253

2254

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2255

# "+AES-256-CBC", "+SHA1",

2256

# "+COMP-NULL", "+CTYPE-OPENPGP",

2257

# "+DHE-DSS"))

1677

1678

session = (gnutls.connection

1679

.ClientSession(self.request,

1680

gnutls.connection

1681

.X509Credentials()))

1682

1683

# Note: gnutls.connection.X509Credentials is really a

1684

# generic GnuTLS certificate credentials object so long as

1685

# no X.509 keys are added to it. Therefore, we can use it

1686

# here despite using OpenPGP certificates.

1687

1688

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1689

# "+AES-256-CBC", "+SHA1",

1690

# "+COMP-NULL", "+CTYPE-OPENPGP",

1691

# "+DHE-DSS"))

2258

1692

# Use a fallback default, since this MUST be set.

2259

1693

priority = self.server.gnutls_priority

2260

1694

if priority is None:

2261

1695

priority = "NORMAL"

2262

gnutls.priority_set_direct(session._c_object,

2263

priority.encode("utf-8"),

2264

None)

2265

1696

(gnutls.library.functions

1697

.gnutls_priority_set_direct(session._c_object,

1698

priority, None))

1699

2266

1700

# Start communication using the Mandos protocol

2267

1701

# Get protocol number

2268

1702

line = self.request.makefile().readline()

2273

1707

except (ValueError, IndexError, RuntimeError) as error:

2274

1708

logger.error("Unknown protocol version: %s", error)

2275

1709

return

2276

1710

2277

1711

# Start GnuTLS connection

2278

1712

try:

2279

1713

session.handshake()

2280

except gnutls.Error as error:

1714

except gnutls.errors.GNUTLSError as error:

2281

1715

logger.warning("Handshake failed: %s", error)

2282

1716

# Do not run session.bye() here: the session is not

2283

1717

# established. Just abandon the request.

2284

1718

return

2285

1719

logger.debug("Handshake succeeded")

2286

1720

2287

1721

approval_required = False

2288

1722

try:

2289

if gnutls.has_rawpk:

2290

fpr = ""

2291

try:

2292

key_id = self.key_id(

2293

self.peer_certificate(session))

2294

except (TypeError, gnutls.Error) as error:

2295

logger.warning("Bad certificate: %s", error)

2296

return

2297

logger.debug("Key ID: %s", key_id)

2298

2299

else:

2300

key_id = ""

2301

try:

2302

fpr = self.fingerprint(

2303

self.peer_certificate(session))

2304

except (TypeError, gnutls.Error) as error:

2305

logger.warning("Bad certificate: %s", error)

2306

return

2307

logger.debug("Fingerprint: %s", fpr)

2308

2309

try:

2310

client = ProxyClient(child_pipe, key_id, fpr,

1723

try:

1724

fpr = self.fingerprint(self.peer_certificate

1725

(session))

1726

except (TypeError,

1727

gnutls.errors.GNUTLSError) as error:

1728

logger.warning("Bad certificate: %s", error)

1729

return

1730

logger.debug("Fingerprint: %s", fpr)

1731

1732

try:

1733

client = ProxyClient(child_pipe, fpr,

2311

1734

self.client_address)

2312

1735

except KeyError:

2313

1736

return

2314

1737

2315

1738

if client.approval_delay:

2316

1739

delay = client.approval_delay

2317

1740

client.approvals_pending += 1

2318

1741

approval_required = True

2319

1742

2320

1743

while True:

2321

1744

if not client.enabled:

2322

1745

logger.info("Client %s is disabled",

2323

client.name)

1746

client.name)

2324

1747

if self.server.use_dbus:

2325

1748

# Emit D-Bus signal

2326

1749

client.Rejected("Disabled")

2327

1750

return

2328

1751

2329

1752

if client.approved or not client.approval_delay:

2330

# We are approved or approval is disabled

1753

#We are approved or approval is disabled

2331

1754

break

2332

1755

elif client.approved is None:

2333

1756

logger.info("Client %s needs approval",

2335

1758

if self.server.use_dbus:

2336

1759

# Emit D-Bus signal

2337

1760

client.NeedApproval(

2338

client.approval_delay.total_seconds()

2339

* 1000, client.approved_by_default)

1761

client.approval_delay_milliseconds(),

1762

client.approved_by_default)

2340

1763

else:

2341

1764

logger.warning("Client %s was not approved",

2342

1765

client.name)

2344

1767

# Emit D-Bus signal

2345

1768

client.Rejected("Denied")

2346

1769

return

2347

2348

# wait until timeout or approved

1770

1771

#wait until timeout or approved

2349

1772

time = datetime.datetime.now()

2350

1773

client.changedstate.acquire()

2351

client.changedstate.wait(delay.total_seconds())

1774

client.changedstate.wait(

1775

float(timedelta_to_milliseconds(delay)

1776

/ 1000))

2352

1777

client.changedstate.release()

2353

1778

time2 = datetime.datetime.now()

2354

1779

if (time2 - time) >= delay:

2364

1789

break

2365

1790

else:

2366

1791

delay -= time2 - time

2367

2368

try:

2369

session.send(client.secret)

2370

except gnutls.Error as error:

2371

logger.warning("gnutls send failed",

2372

exc_info=error)

2373

return

2374

1792

1793

sent_size = 0

1794

while sent_size < len(client.secret):

1795

try:

1796

sent = session.send(client.secret[sent_size:])

1797

except gnutls.errors.GNUTLSError as error:

1798

logger.warning("gnutls send failed",

1799

exc_info=error)

1800

return

1801

logger.debug("Sent: %d, remaining: %d",

1802

sent, len(client.secret)

1803

- (sent_size + sent))

1804

sent_size += sent

1805

2375

1806

logger.info("Sending secret to %s", client.name)

2376

1807

# bump the timeout using extended_timeout

2377

1808

client.bump_timeout(client.extended_timeout)

2378

1809

if self.server.use_dbus:

2379

1810

# Emit D-Bus signal

2380

1811

client.GotSecret()

2381

1812

2382

1813

finally:

2383

1814

if approval_required:

2384

1815

client.approvals_pending -= 1

2385

1816

try:

2386

1817

session.bye()

2387

except gnutls.Error as error:

1818

except gnutls.errors.GNUTLSError as error:

2388

1819

logger.warning("GnuTLS bye failed",

2389

1820

exc_info=error)

2390

1821

2391

1822

@staticmethod

2392

1823

def peer_certificate(session):

2393

"Return the peer's certificate as a bytestring"

2394

try:

2395

cert_type = gnutls.certificate_type_get2(session._c_object,

2396

gnutls.CTYPE_PEERS)

2397

except AttributeError:

2398

cert_type = gnutls.certificate_type_get(session._c_object)

2399

if gnutls.has_rawpk:

2400

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2401

else:

2402

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2403

# If not a valid certificate type...

2404

if cert_type not in valid_cert_types:

2405

logger.info("Cert type %r not in %r", cert_type,

2406

valid_cert_types)

2407

# ...return invalid data

2408

return b""

1824

"Return the peer's OpenPGP certificate as a bytestring"

1825

# If not an OpenPGP certificate...

1826

if (gnutls.library.functions

1827

.gnutls_certificate_type_get(session._c_object)

1828

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1829

# ...do the normal thing

1830

return session.peer_certificate

2409

1831

list_size = ctypes.c_uint(1)

2410

cert_list = (gnutls.certificate_get_peers

1832

cert_list = (gnutls.library.functions

1833

.gnutls_certificate_get_peers

2411

1834

(session._c_object, ctypes.byref(list_size)))

2412

1835

if not bool(cert_list) and list_size.value != 0:

2413

raise gnutls.Error("error getting peer certificate")

1836

raise gnutls.errors.GNUTLSError("error getting peer"

1837

" certificate")

2414

1838

if list_size.value == 0:

2415

1839

return None

2416

1840

cert = cert_list[0]

2417

1841

return ctypes.string_at(cert.data, cert.size)

2418

2419

@staticmethod

2420

def key_id(certificate):

2421

"Convert a certificate bytestring to a hexdigit key ID"

2422

# New GnuTLS "datum" with the public key

2423

datum = gnutls.datum_t(

2424

ctypes.cast(ctypes.c_char_p(certificate),

2425

ctypes.POINTER(ctypes.c_ubyte)),

2426

ctypes.c_uint(len(certificate)))

2427

# XXX all these need to be created in the gnutls "module"

2428

# New empty GnuTLS certificate

2429

pubkey = gnutls.pubkey_t()

2430

gnutls.pubkey_init(ctypes.byref(pubkey))

2431

# Import the raw public key into the certificate

2432

gnutls.pubkey_import(pubkey,

2433

ctypes.byref(datum),

2434

gnutls.X509_FMT_DER)

2435

# New buffer for the key ID

2436

buf = ctypes.create_string_buffer(32)

2437

buf_len = ctypes.c_size_t(len(buf))

2438

# Get the key ID from the raw public key into the buffer

2439

gnutls.pubkey_get_key_id(pubkey,

2440

gnutls.KEYID_USE_SHA256,

2441

ctypes.cast(ctypes.byref(buf),

2442

ctypes.POINTER(ctypes.c_ubyte)),

2443

ctypes.byref(buf_len))

2444

# Deinit the certificate

2445

gnutls.pubkey_deinit(pubkey)

2446

2447

# Convert the buffer to a Python bytestring

2448

key_id = ctypes.string_at(buf, buf_len.value)

2449

# Convert the bytestring to hexadecimal notation

2450

hex_key_id = binascii.hexlify(key_id).upper()

2451

return hex_key_id

2452

1842

2453

1843

@staticmethod

2454

1844

def fingerprint(openpgp):

2455

1845

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2456

1846

# New GnuTLS "datum" with the OpenPGP public key

2457

datum = gnutls.datum_t(

2458

ctypes.cast(ctypes.c_char_p(openpgp),

2459

ctypes.POINTER(ctypes.c_ubyte)),

2460

ctypes.c_uint(len(openpgp)))

1847

datum = (gnutls.library.types

1848

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1849

ctypes.POINTER

1850

(ctypes.c_ubyte)),

1851

ctypes.c_uint(len(openpgp))))

2461

1852

# New empty GnuTLS certificate

2462

crt = gnutls.openpgp_crt_t()

2463

gnutls.openpgp_crt_init(ctypes.byref(crt))

1853

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2464

1856

# Import the OpenPGP public key into the certificate

2465

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2466

gnutls.OPENPGP_FMT_RAW)

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1859

gnutls.library.constants

1860

.GNUTLS_OPENPGP_FMT_RAW))

2467

1861

# Verify the self signature in the key

2468

1862

crtverify = ctypes.c_uint()

2469

gnutls.openpgp_crt_verify_self(crt, 0,

2470

ctypes.byref(crtverify))

1863

(gnutls.library.functions

1864

.gnutls_openpgp_crt_verify_self(crt, 0,

1865

ctypes.byref(crtverify)))

2471

1866

if crtverify.value != 0:

2472

gnutls.openpgp_crt_deinit(crt)

2473

raise gnutls.CertificateSecurityError(code

2474

=crtverify.value)

1867

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1868

raise (gnutls.errors.CertificateSecurityError

1869

("Verify failed"))

2475

1870

# New buffer for the fingerprint

2476

1871

buf = ctypes.create_string_buffer(20)

2477

1872

buf_len = ctypes.c_size_t()

2478

1873

# Get the fingerprint from the certificate into the buffer

2479

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2480

ctypes.byref(buf_len))

1874

(gnutls.library.functions

1875

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1876

ctypes.byref(buf_len)))

2481

1877

# Deinit the certificate

2482

gnutls.openpgp_crt_deinit(crt)

1878

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2483

1879

# Convert the buffer to a Python bytestring

2484

1880

fpr = ctypes.string_at(buf, buf_len.value)

2485

1881

# Convert the bytestring to hexadecimal notation

2489

1885

2490

1886

class MultiprocessingMixIn(object):

2491

1887

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2492

2493

1888

def sub_process_main(self, request, address):

2494

1889

try:

2495

1890

self.finish_request(request, address)

2496

1891

except Exception:

2497

1892

self.handle_error(request, address)

2498

1893

self.close_request(request)

2499

1894

2500

1895

def process_request(self, request, address):

2501

1896

"""Start a new process to process the request."""

2502

proc = multiprocessing.Process(target=self.sub_process_main,

2503

args=(request, address))

1897

proc = multiprocessing.Process(target = self.sub_process_main,

1898

args = (request, address))

2504

1899

proc.start()

2505

1900

return proc

2506

1901

2507

1902

2508

1903

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2509

1904

""" adds a pipe to the MixIn """

2510

2511

1905

def process_request(self, request, client_address):

2512

1906

"""Overrides and wraps the original process_request().

2513

1907

2514

1908

This function creates a new pipe in self.pipe

2515

1909

"""

2516

1910

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2517

1911

2518

1912

proc = MultiprocessingMixIn.process_request(self, request,

2519

1913

client_address)

2520

1914

self.child_pipe.close()

2521

1915

self.add_pipe(parent_pipe, proc)

2522

1916

2523

1917

def add_pipe(self, parent_pipe, proc):

2524

1918

"""Dummy function; override as necessary"""

2525

1919

raise NotImplementedError()

2528

1922

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2529

1923

socketserver.TCPServer, object):

2530

1924

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2531

1925

2532

1926

Attributes:

2533

1927

enabled: Boolean; whether this server is activated yet

2534

1928

interface: None or a network interface name (string)

2535

1929

use_ipv6: Boolean; to use IPv6 or not

2536

1930

"""

2537

2538

1931

def __init__(self, server_address, RequestHandlerClass,

2539

interface=None,

2540

use_ipv6=True,

2541

socketfd=None):

1932

interface=None, use_ipv6=True, socketfd=None):

2542

1933

"""If socketfd is set, use that file descriptor instead of

2543

1934

creating a new one with socket.socket().

2544

1935

"""

2550

1941

self.socketfd = socketfd

2551

1942

# Save the original socket.socket() function

2552

1943

self.socket_socket = socket.socket

2553

2554

1944

# To implement --socket, we monkey patch socket.socket.

2555

#

1945

#

2556

1946

# (When socketserver.TCPServer is a new-style class, we

2557

1947

# could make self.socket into a property instead of monkey

2558

1948

# patching socket.socket.)

2559

#

1949

#

2560

1950

# Create a one-time-only replacement for socket.socket()

2561

1951

@functools.wraps(socket.socket)

2562

1952

def socket_wrapper(*args, **kwargs):

2574

1964

# socket_wrapper(), if socketfd was set.

2575

1965

socketserver.TCPServer.__init__(self, server_address,

2576

1966

RequestHandlerClass)

2577

1967

2578

1968

def server_bind(self):

2579

1969

"""This overrides the normal server_bind() function

2580

1970

to bind to an interface if one was specified, and also NOT to

2581

1971

bind to an address or port if they were not specified."""

2582

global SO_BINDTODEVICE

2583

1972

if self.interface is not None:

2584

1973

if SO_BINDTODEVICE is None:

2585

# Fall back to a hard-coded value which seems to be

2586

# common enough.

2587

logger.warning("SO_BINDTODEVICE not found, trying 25")

2588

SO_BINDTODEVICE = 25

2589

try:

2590

self.socket.setsockopt(

2591

socket.SOL_SOCKET, SO_BINDTODEVICE,

2592

(self.interface + "\0").encode("utf-8"))

2593

except socket.error as error:

2594

if error.errno == errno.EPERM:

2595

logger.error("No permission to bind to"

2596

" interface %s", self.interface)

2597

elif error.errno == errno.ENOPROTOOPT:

2598

logger.error("SO_BINDTODEVICE not available;"

2599

" cannot bind to interface %s",

2600

self.interface)

2601

elif error.errno == errno.ENODEV:

2602

logger.error("Interface %s does not exist,"

2603

" cannot bind", self.interface)

2604

else:

2605

raise

1974

logger.error("SO_BINDTODEVICE does not exist;"

1975

" cannot bind to interface %s",

1976

self.interface)

1977

else:

1978

try:

1979

self.socket.setsockopt(socket.SOL_SOCKET,

1980

SO_BINDTODEVICE,

1981

str(self.interface + '\0'))

1982

except socket.error as error:

1983

if error.errno == errno.EPERM:

1984

logger.error("No permission to bind to"

1985

" interface %s", self.interface)

1986

elif error.errno == errno.ENOPROTOOPT:

1987

logger.error("SO_BINDTODEVICE not available;"

1988

" cannot bind to interface %s",

1989

self.interface)

1990

elif error.errno == errno.ENODEV:

1991

logger.error("Interface %s does not exist,"

1992

" cannot bind", self.interface)

1993

else:

1994

raise

2606

1995

# Only bind(2) the socket if we really need to.

2607

1996

if self.server_address[0] or self.server_address[1]:

2608

1997

if not self.server_address[0]:

2609

1998

if self.address_family == socket.AF_INET6:

2610

any_address = "::" # in6addr_any

1999

any_address = "::" # in6addr_any

2611

2000

else:

2612

any_address = "0.0.0.0" # INADDR_ANY

2001

any_address = "0.0.0.0" # INADDR_ANY

2613

2002

self.server_address = (any_address,

2614

2003

self.server_address[1])

2615

2004

elif not self.server_address[1]:

2616

self.server_address = (self.server_address[0], 0)

2005

self.server_address = (self.server_address[0],

2006

0)

2617

2007

# if self.interface:

2618

2008

# self.server_address = (self.server_address[0],

2619

2009

# 0, # port

2625

2015

2626

2016

class MandosServer(IPv6_TCPServer):

2627

2017

"""Mandos server.

2628

2018

2629

2019

Attributes:

2630

2020

clients: set of Client objects

2631

2021

gnutls_priority GnuTLS priority string

2632

2022

use_dbus: Boolean; to emit D-Bus signals or not

2633

2634

Assumes a GLib.MainLoop event loop.

2023

2024

Assumes a gobject.MainLoop event loop.

2635

2025

"""

2636

2637

2026

def __init__(self, server_address, RequestHandlerClass,

2638

interface=None,

2639

use_ipv6=True,

2640

clients=None,

2641

gnutls_priority=None,

2642

use_dbus=True,

2643

socketfd=None):

2027

interface=None, use_ipv6=True, clients=None,

2028

gnutls_priority=None, use_dbus=True, socketfd=None):

2644

2029

self.enabled = False

2645

2030

self.clients = clients

2646

2031

if self.clients is None:

2649

2034

self.gnutls_priority = gnutls_priority

2650

2035

IPv6_TCPServer.__init__(self, server_address,

2651

2036

RequestHandlerClass,

2652

interface=interface,

2653

use_ipv6=use_ipv6,

2654

socketfd=socketfd)

2655

2037

interface = interface,

2038

use_ipv6 = use_ipv6,

2039

socketfd = socketfd)

2656

2040

def server_activate(self):

2657

2041

if self.enabled:

2658

2042

return socketserver.TCPServer.server_activate(self)

2659

2043

2660

2044

def enable(self):

2661

2045

self.enabled = True

2662

2046

2663

2047

def add_pipe(self, parent_pipe, proc):

2664

2048

# Call "handle_ipc" for both data and EOF events

2665

GLib.io_add_watch(

2666

parent_pipe.fileno(),

2667

GLib.IO_IN | GLib.IO_HUP,

2668

functools.partial(self.handle_ipc,

2669

parent_pipe=parent_pipe,

2670

proc=proc))

2671

2672

def handle_ipc(self, source, condition,

2673

parent_pipe=None,

2674

proc=None,

2675

client_object=None):

2049

gobject.io_add_watch(parent_pipe.fileno(),

2050

gobject.IO_IN | gobject.IO_HUP,

2051

functools.partial(self.handle_ipc,

2052

parent_pipe =

2053

parent_pipe,

2054

proc = proc))

2055

2056

def handle_ipc(self, source, condition, parent_pipe=None,

2057

proc = None, client_object=None):

2676

2058

# error, or the other end of multiprocessing.Pipe has closed

2677

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2059

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2678

2060

# Wait for other process to exit

2679

2061

proc.join()

2680

2062

return False

2681

2063

2682

2064

# Read a request from the child

2683

2065

request = parent_pipe.recv()

2684

2066

command = request[0]

2685

2067

2686

2068

if command == 'init':

2687

key_id = request[1].decode("ascii")

2688

fpr = request[2].decode("ascii")

2689

address = request[3]

2690

2691

for c in self.clients.values():

2692

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2693

continue

2694

if key_id and c.key_id == key_id:

2695

client = c

2696

break

2697

if fpr and c.fingerprint == fpr:

2069

fpr = request[1]

2070

address = request[2]

2071

2072

for c in self.clients.itervalues():

2073

if c.fingerprint == fpr:

2698

2074

client = c

2699

2075

break

2700

2076

else:

2701

logger.info("Client not found for key ID: %s, address"

2702

": %s", key_id or fpr, address)

2077

logger.info("Client not found for fingerprint: %s, ad"

2078

"dress: %s", fpr, address)

2703

2079

if self.use_dbus:

2704

2080

# Emit D-Bus signal

2705

mandos_dbus_service.ClientNotFound(key_id or fpr,

2081

mandos_dbus_service.ClientNotFound(fpr,

2706

2082

address[0])

2707

2083

parent_pipe.send(False)

2708

2084

return False

2709

2710

GLib.io_add_watch(

2711

parent_pipe.fileno(),

2712

GLib.IO_IN | GLib.IO_HUP,

2713

functools.partial(self.handle_ipc,

2714

parent_pipe=parent_pipe,

2715

proc=proc,

2716

client_object=client))

2085

2086

gobject.io_add_watch(parent_pipe.fileno(),

2087

gobject.IO_IN | gobject.IO_HUP,

2088

functools.partial(self.handle_ipc,

2089

parent_pipe =

2090

parent_pipe,

2091

proc = proc,

2092

client_object =

2093

client))

2717

2094

parent_pipe.send(True)

2718

2095

# remove the old hook in favor of the new above hook on

2719

2096

# same fileno

2722

2099

funcname = request[1]

2723

2100

args = request[2]

2724

2101

kwargs = request[3]

2725

2102

2726

2103

parent_pipe.send(('data', getattr(client_object,

2727

2104

funcname)(*args,

2728

**kwargs)))

2729

2105

**kwargs)))

2106

2730

2107

if command == 'getattr':

2731

2108

attrname = request[1]

2732

if isinstance(client_object.__getattribute__(attrname),

2733

collections.Callable):

2734

parent_pipe.send(('function', ))

2109

if callable(client_object.__getattribute__(attrname)):

2110

parent_pipe.send(('function',))

2735

2111

else:

2736

parent_pipe.send((

2737

'data', client_object.__getattribute__(attrname)))

2738

2112

parent_pipe.send(('data', client_object

2113

.__getattribute__(attrname)))

2114

2739

2115

if command == 'setattr':

2740

2116

attrname = request[1]

2741

2117

value = request[2]

2742

2118

setattr(client_object, attrname, value)

2743

2119

2744

2120

return True

2745

2121

2746

2122

2747

2123

def rfc3339_duration_to_delta(duration):

2748

2124

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2749

2125

2750

2126

>>> rfc3339_duration_to_delta("P7D")

2751

2127

datetime.timedelta(7)

2752

2128

>>> rfc3339_duration_to_delta("PT60S")

2762

2138

>>> rfc3339_duration_to_delta("P1DT3M20S")

2763

2139

datetime.timedelta(1, 200)

2764

2140

"""

2765

2141

2766

2142

# Parsing an RFC 3339 duration with regular expressions is not

2767

2143

# possible - there would have to be multiple places for the same

2768

2144

# values, like seconds. The current code, while more esoteric, is

2769

2145

# cleaner without depending on a parsing library. If Python had a

2770

2146

# built-in library for parsing we would use it, but we'd like to

2771

2147

# avoid excessive use of external libraries.

2772

2148

2773

2149

# New type for defining tokens, syntax, and semantics all-in-one

2774

Token = collections.namedtuple("Token", (

2775

"regexp", # To match token; if "value" is not None, must have

2776

# a "group" containing digits

2777

"value", # datetime.timedelta or None

2778

"followers")) # Tokens valid after this token

2150

Token = collections.namedtuple("Token",

2151

("regexp", # To match token; if

2152

# "value" is not None,

2153

# must have a "group"

2154

# containing digits

2155

"value", # datetime.timedelta or

2156

# None

2157

"followers")) # Tokens valid after

2158

# this token

2779

2159

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2780

2160

# the "duration" ABNF definition in RFC 3339, Appendix A.

2781

2161

token_end = Token(re.compile(r"$"), None, frozenset())

2782

2162

token_second = Token(re.compile(r"(\d+)S"),

2783

2163

datetime.timedelta(seconds=1),

2784

frozenset((token_end, )))

2164

frozenset((token_end,)))

2785

2165

token_minute = Token(re.compile(r"(\d+)M"),

2786

2166

datetime.timedelta(minutes=1),

2787

2167

frozenset((token_second, token_end)))

2803

2183

frozenset((token_month, token_end)))

2804

2184

token_week = Token(re.compile(r"(\d+)W"),

2805

2185

datetime.timedelta(weeks=1),

2806

frozenset((token_end, )))

2186

frozenset((token_end,)))

2807

2187

token_duration = Token(re.compile(r"P"), None,

2808

2188

frozenset((token_year, token_month,

2809

2189

token_day, token_time,

2810

token_week)))

2811

# Define starting values:

2812

# Value so far

2813

value = datetime.timedelta()

2190

token_week))),

2191

# Define starting values

2192

value = datetime.timedelta() # Value so far

2814

2193

found_token = None

2815

# Following valid tokens

2816

followers = frozenset((token_duration, ))

2817

# String left to parse

2818

s = duration

2194

followers = frozenset(token_duration,) # Following valid tokens

2195

s = duration # String left to parse

2819

2196

# Loop until end token is found

2820

2197

while found_token is not token_end:

2821

2198

# Search for any currently valid tokens

2837

2214

break

2838

2215

else:

2839

2216

# No currently valid tokens were found

2840

raise ValueError("Invalid RFC 3339 duration: {!r}"

2841

.format(duration))

2217

raise ValueError("Invalid RFC 3339 duration")

2842

2218

# End token found

2843

2219

return value

2844

2220

2845

2221

2846

2222

def string_to_delta(interval):

2847

2223

"""Parse a string and return a datetime.timedelta

2848

2224

2849

2225

>>> string_to_delta('7d')

2850

2226

datetime.timedelta(7)

2851

2227

>>> string_to_delta('60s')

2859

2235

>>> string_to_delta('5m 30s')

2860

2236

datetime.timedelta(0, 330)

2861

2237

"""

2862

2238

2863

2239

try:

2864

2240

return rfc3339_duration_to_delta(interval)

2865

2241

except ValueError:

2866

2242

pass

2867

2243

2868

2244

timevalue = datetime.timedelta(0)

2869

2245

for s in interval.split():

2870

2246

try:

2871

suffix = s[-1]

2247

suffix = unicode(s[-1])

2872

2248

value = int(s[:-1])

2873

2249

if suffix == "d":

2874

2250

delta = datetime.timedelta(value)

2881

2257

elif suffix == "w":

2882

2258

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2883

2259

else:

2884

raise ValueError("Unknown suffix {!r}".format(suffix))

2260

raise ValueError("Unknown suffix {0!r}"

2261

.format(suffix))

2885

2262

except IndexError as e:

2886

2263

raise ValueError(*(e.args))

2887

2264

timevalue += delta

2888

2265

return timevalue

2889

2266

2890

2267

2891

def daemon(nochdir=False, noclose=False):

2268

def daemon(nochdir = False, noclose = False):

2892

2269

"""See daemon(3). Standard BSD Unix function.

2893

2270

2894

2271

This should really exist as os.daemon, but it doesn't (yet)."""

2895

2272

if os.fork():

2896

2273

sys.exit()

2904

2281

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2905

2282

if not stat.S_ISCHR(os.fstat(null).st_mode):

2906

2283

raise OSError(errno.ENODEV,

2907

"{} not a character device"

2284

"{0} not a character device"

2908

2285

.format(os.devnull))

2909

2286

os.dup2(null, sys.stdin.fileno())

2910

2287

os.dup2(null, sys.stdout.fileno())

2914

2291

2915

2292

2916

2293

def main():

2917

2294

2918

2295

##################################################################

2919

2296

# Parsing of options, both command line and config file

2920

2297

2921

2298

parser = argparse.ArgumentParser()

2922

2299

parser.add_argument("-v", "--version", action="version",

2923

version="%(prog)s {}".format(version),

2300

version = "%(prog)s {0}".format(version),

2924

2301

help="show version number and exit")

2925

2302

parser.add_argument("-i", "--interface", metavar="IF",

2926

2303

help="Bind to interface IF")

2959

2336

help="Directory to save/restore state in")

2960

2337

parser.add_argument("--foreground", action="store_true",

2961

2338

help="Run in foreground", default=None)

2962

parser.add_argument("--no-zeroconf", action="store_false",

2963

dest="zeroconf", help="Do not use Zeroconf",

2964

default=None)

2965

2339

2966

2340

options = parser.parse_args()

2967

2341

2968

2342

if options.check:

2969

2343

import doctest

2970

fail_count, test_count = doctest.testmod()

2971

sys.exit(os.EX_OK if fail_count == 0 else 1)

2972

2344

doctest.testmod()

2345

sys.exit()

2346

2973

2347

# Default values for config file for server-global settings

2974

if gnutls.has_rawpk:

2975

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2976

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2977

else:

2978

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2979

":+SIGN-DSA-SHA256")

2980

server_defaults = {"interface": "",

2981

"address": "",

2982

"port": "",

2983

"debug": "False",

2984

"priority": priority,

2985

"servicename": "Mandos",

2986

"use_dbus": "True",

2987

"use_ipv6": "True",

2988

"debuglevel": "",

2989

"restore": "True",

2990

"socket": "",

2991

"statedir": "/var/lib/mandos",

2992

"foreground": "False",

2993

"zeroconf": "True",

2994

}

2995

del priority

2996

2348

server_defaults = { "interface": "",

2349

"address": "",

2350

"port": "",

2351

"debug": "False",

2352

"priority":

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2354

"servicename": "Mandos",

2355

"use_dbus": "True",

2356

"use_ipv6": "True",

2357

"debuglevel": "",

2358

"restore": "True",

2359

"socket": "",

2360

"statedir": "/var/lib/mandos",

2361

"foreground": "False",

2362

}

2363

2997

2364

# Parse config file for server-global settings

2998

2365

server_config = configparser.SafeConfigParser(server_defaults)

2999

2366

del server_defaults

3000

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2367

server_config.read(os.path.join(options.configdir,

2368

"mandos.conf"))

3001

2369

# Convert the SafeConfigParser object to a dict

3002

2370

server_settings = server_config.defaults()

3003

2371

# Use the appropriate methods on the non-string config options

3004

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3005

"foreground", "zeroconf"):

2372

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3006

2373

server_settings[option] = server_config.getboolean("DEFAULT",

3007

2374

option)

3008

2375

if server_settings["port"]:

3018

2385

server_settings["socket"] = os.dup(server_settings

3019

2386

["socket"])

3020

2387

del server_config

3021

2388

3022

2389

# Override the settings from the config file with command line

3023

2390

# options, if set.

3024

2391

for option in ("interface", "address", "port", "debug",

3025

"priority", "servicename", "configdir", "use_dbus",

3026

"use_ipv6", "debuglevel", "restore", "statedir",

3027

"socket", "foreground", "zeroconf"):

2392

"priority", "servicename", "configdir",

2393

"use_dbus", "use_ipv6", "debuglevel", "restore",

2394

"statedir", "socket", "foreground"):

3028

2395

value = getattr(options, option)

3029

2396

if value is not None:

3030

2397

server_settings[option] = value

3031

2398

del options

3032

2399

# Force all strings to be unicode

3033

2400

for option in server_settings.keys():

3034

if isinstance(server_settings[option], bytes):

3035

server_settings[option] = (server_settings[option]

3036

.decode("utf-8"))

2401

if type(server_settings[option]) is str:

2402

server_settings[option] = unicode(server_settings[option])

3037

2403

# Force all boolean options to be boolean

3038

2404

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3039

"foreground", "zeroconf"):

2405

"foreground"):

3040

2406

server_settings[option] = bool(server_settings[option])

3041

2407

# Debug implies foreground

3042

2408

if server_settings["debug"]:

3043

2409

server_settings["foreground"] = True

3044

2410

# Now we have our good server settings in "server_settings"

3045

2411

3046

2412

##################################################################

3047

3048

if (not server_settings["zeroconf"]

3049

and not (server_settings["port"]

3050

or server_settings["socket"] != "")):

3051

parser.error("Needs port or socket to work without Zeroconf")

3052

2413

3053

2414

# For convenience

3054

2415

debug = server_settings["debug"]

3055

2416

debuglevel = server_settings["debuglevel"]

3058

2419

stored_state_path = os.path.join(server_settings["statedir"],

3059

2420

stored_state_file)

3060

2421

foreground = server_settings["foreground"]

3061

zeroconf = server_settings["zeroconf"]

3062

2422

3063

2423

if debug:

3064

2424

initlogger(debug, logging.DEBUG)

3065

2425

else:

3068

2428

else:

3069

2429

level = getattr(logging, debuglevel.upper())

3070

2430

initlogger(debug, level)

3071

2431

3072

2432

if server_settings["servicename"] != "Mandos":

3073

syslogger.setFormatter(

3074

logging.Formatter('Mandos ({}) [%(process)d]:'

3075

' %(levelname)s: %(message)s'.format(

3076

server_settings["servicename"])))

3077

2433

syslogger.setFormatter(logging.Formatter

2434

('Mandos ({0}) [%(process)d]:'

2435

' %(levelname)s: %(message)s'

2436

.format(server_settings

2437

["servicename"])))

2438

3078

2439

# Parse config file with clients

3079

2440

client_config = configparser.SafeConfigParser(Client

3080

2441

.client_defaults)

3081

2442

client_config.read(os.path.join(server_settings["configdir"],

3082

2443

"clients.conf"))

3083

2444

3084

2445

global mandos_dbus_service

3085

2446

mandos_dbus_service = None

3086

3087

socketfd = None

3088

if server_settings["socket"] != "":

3089

socketfd = server_settings["socket"]

3090

tcp_server = MandosServer(

3091

(server_settings["address"], server_settings["port"]),

3092

ClientHandler,

3093

interface=(server_settings["interface"] or None),

3094

use_ipv6=use_ipv6,

3095

gnutls_priority=server_settings["priority"],

3096

use_dbus=use_dbus,

3097

socketfd=socketfd)

2447

2448

tcp_server = MandosServer((server_settings["address"],

2449

server_settings["port"]),

2450

ClientHandler,

2451

interface=(server_settings["interface"]

2452

or None),

2453

use_ipv6=use_ipv6,

2454

gnutls_priority=

2455

server_settings["priority"],

2456

use_dbus=use_dbus,

2457

socketfd=(server_settings["socket"]

2458

or None))

3098

2459

if not foreground:

3099

2460

pidfilename = "/run/mandos.pid"

3100

2461

if not os.path.isdir("/run/."):

3101

2462

pidfilename = "/var/run/mandos.pid"

3102

2463

pidfile = None

3103

2464

try:

3104

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2465

pidfile = open(pidfilename, "w")

3105

2466

except IOError as e:

3106

2467

logger.error("Could not open file %r", pidfilename,

3107

2468

exc_info=e)

3108

3109

for name, group in (("_mandos", "_mandos"),

3110

("mandos", "mandos"),

3111

("nobody", "nogroup")):

2469

2470

for name in ("_mandos", "mandos", "nobody"):

3112

2471

try:

3113

2472

uid = pwd.getpwnam(name).pw_uid

3114

gid = pwd.getpwnam(group).pw_gid

2473

gid = pwd.getpwnam(name).pw_gid

3115

2474

break

3116

2475

except KeyError:

3117

2476

continue

3121

2480

try:

3122

2481

os.setgid(gid)

3123

2482

os.setuid(uid)

3124

if debug:

3125

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3126

gid))

3127

2483

except OSError as error:

3128

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3129

.format(uid, gid, os.strerror(error.errno)))

3130

2484

if error.errno != errno.EPERM:

3131

2485

raise

3132

2486

3133

2487

if debug:

3134

2488

# Enable all possible GnuTLS debugging

3135

2489

3136

2490

# "Use a log level over 10 to enable all debugging options."

3137

2491

# - GnuTLS manual

3138

gnutls.global_set_log_level(11)

3139

3140

@gnutls.log_func

2492

gnutls.library.functions.gnutls_global_set_log_level(11)

2493

2494

@gnutls.library.types.gnutls_log_func

3141

2495

def debug_gnutls(level, string):

3142

2496

logger.debug("GnuTLS: %s", string[:-1])

3143

3144

gnutls.global_set_log_function(debug_gnutls)

3145

2497

2498

(gnutls.library.functions

2499

.gnutls_global_set_log_function(debug_gnutls))

2500

3146

2501

# Redirect stdin so all checkers get /dev/null

3147

2502

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3148

2503

os.dup2(null, sys.stdin.fileno())

3149

2504

if null > 2:

3150

2505

os.close(null)

3151

2506

3152

2507

# Need to fork before connecting to D-Bus

3153

2508

if not foreground:

3154

2509

# Close all input and output, do double fork, etc.

3155

2510

daemon()

3156

3157

# multiprocessing will use threads, so before we use GLib we need

3158

# to inform GLib that threads will be used.

3159

GLib.threads_init()

3160

2511

2512

# multiprocessing will use threads, so before we use gobject we

2513

# need to inform gobject that threads will be used.

2514

gobject.threads_init()

2515

3161

2516

global main_loop

3162

2517

# From the Avahi example code

3163

2518

DBusGMainLoop(set_as_default=True)

3164

main_loop = GLib.MainLoop()

2519

main_loop = gobject.MainLoop()

3165

2520

bus = dbus.SystemBus()

3166

2521

# End of Avahi example code

3167

2522

if use_dbus:

3168

2523

try:

3169

2524

bus_name = dbus.service.BusName("se.recompile.Mandos",

3170

bus,

3171

do_not_queue=True)

3172

old_bus_name = dbus.service.BusName(

3173

"se.bsnet.fukt.Mandos", bus,

3174

do_not_queue=True)

3175

except dbus.exceptions.DBusException as e:

2525

bus, do_not_queue=True)

2526

old_bus_name = (dbus.service.BusName

2527

("se.bsnet.fukt.Mandos", bus,

2528

do_not_queue=True))

2529

except dbus.exceptions.NameExistsException as e:

3176

2530

logger.error("Disabling D-Bus:", exc_info=e)

3177

2531

use_dbus = False

3178

2532

server_settings["use_dbus"] = False

3179

2533

tcp_server.use_dbus = False

3180

if zeroconf:

3181

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3182

service = AvahiServiceToSyslog(

3183

name=server_settings["servicename"],

3184

servicetype="_mandos._tcp",

3185

protocol=protocol,

3186

bus=bus)

3187

if server_settings["interface"]:

3188

service.interface = if_nametoindex(

3189

server_settings["interface"].encode("utf-8"))

3190

2534

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2535

service = AvahiServiceToSyslog(name =

2536

server_settings["servicename"],

2537

servicetype = "_mandos._tcp",

2538

protocol = protocol, bus = bus)

2539

if server_settings["interface"]:

2540

service.interface = (if_nametoindex

2541

(str(server_settings["interface"])))

2542

3191

2543

global multiprocessing_manager

3192

2544

multiprocessing_manager = multiprocessing.Manager()

3193

2545

3194

2546

client_class = Client

3195

2547

if use_dbus:

3196

client_class = functools.partial(ClientDBus, bus=bus)

3197

2548

client_class = functools.partial(ClientDBus, bus = bus)

2549

3198

2550

client_settings = Client.config_parser(client_config)

3199

2551

old_client_settings = {}

3200

2552

clients_data = {}

3201

2553

3202

2554

# This is used to redirect stdout and stderr for checker processes

3203

2555

global wnull

3204

wnull = open(os.devnull, "w") # A writable /dev/null

2556

wnull = open(os.devnull, "w") # A writable /dev/null

3205

2557

# Only used if server is running in foreground but not in debug

3206

2558

# mode

3207

2559

if debug or not foreground:

3208

2560

wnull.close()

3209

2561

3210

2562

# Get client data and settings from last running state.

3211

2563

if server_settings["restore"]:

3212

2564

try:

3213

2565

with open(stored_state_path, "rb") as stored_state:

3214

if sys.version_info.major == 2:

3215

clients_data, old_client_settings = pickle.load(

3216

stored_state)

3217

else:

3218

bytes_clients_data, bytes_old_client_settings = (

3219

pickle.load(stored_state, encoding="bytes"))

3220

# Fix bytes to strings

3221

# clients_data

3222

# .keys()

3223

clients_data = {(key.decode("utf-8")

3224

if isinstance(key, bytes)

3225

else key): value

3226

for key, value in

3227

bytes_clients_data.items()}

3228

del bytes_clients_data

3229

for key in clients_data:

3230

value = {(k.decode("utf-8")

3231

if isinstance(k, bytes) else k): v

3232

for k, v in

3233

clients_data[key].items()}

3234

clients_data[key] = value

3235

# .client_structure

3236

value["client_structure"] = [

3237

(s.decode("utf-8")

3238

if isinstance(s, bytes)

3239

else s) for s in

3240

value["client_structure"]]

3241

# .name & .host

3242

for k in ("name", "host"):

3243

if isinstance(value[k], bytes):

3244

value[k] = value[k].decode("utf-8")

3245

if not value.has_key("key_id"):

3246

value["key_id"] = ""

3247

elif not value.has_key("fingerprint"):

3248

value["fingerprint"] = ""

3249

# old_client_settings

3250

# .keys()

3251

old_client_settings = {

3252

(key.decode("utf-8")

3253

if isinstance(key, bytes)

3254

else key): value

3255

for key, value in

3256

bytes_old_client_settings.items()}

3257

del bytes_old_client_settings

3258

# .host

3259

for value in old_client_settings.values():

3260

if isinstance(value["host"], bytes):

3261

value["host"] = (value["host"]

3262

.decode("utf-8"))

2566

clients_data, old_client_settings = (pickle.load

2567

(stored_state))

3263

2568

os.remove(stored_state_path)

3264

2569

except IOError as e:

3265

2570

if e.errno == errno.ENOENT:

3266

logger.warning("Could not load persistent state:"

3267

" {}".format(os.strerror(e.errno)))

2571

logger.warning("Could not load persistent state: {0}"

2572

.format(os.strerror(e.errno)))

3268

2573

else:

3269

2574

logger.critical("Could not load persistent state:",

3270

2575

exc_info=e)

3271

2576

raise

3272

2577

except EOFError as e:

3273

2578

logger.warning("Could not load persistent state: "

3274

"EOFError:",

3275

exc_info=e)

3276

2579

"EOFError:", exc_info=e)

2580

3277

2581

with PGPEngine() as pgp:

3278

for client_name, client in clients_data.items():

2582

for client_name, client in clients_data.iteritems():

3279

2583

# Skip removed clients

3280

2584

if client_name not in client_settings:

3281

2585

continue

3282

2586

3283

2587

# Decide which value to use after restoring saved state.

3284

2588

# We have three different values: Old config file,

3285

2589

# new config file, and saved state.

3290

2594

# For each value in new config, check if it

3291

2595

# differs from the old config value (Except for

3292

2596

# the "secret" attribute)

3293

if (name != "secret"

3294

and (value !=

3295

old_client_settings[client_name][name])):

2597

if (name != "secret" and

2598

value != old_client_settings[client_name]

2599

[name]):

3296

2600

client[name] = value

3297

2601

except KeyError:

3298

2602

pass

3299

2603

3300

2604

# Clients who has passed its expire date can still be

3301

# enabled if its last checker was successful. A Client

2605

# enabled if its last checker was successful. Clients

3302

2606

# whose checker succeeded before we stored its state is

3303

2607

# assumed to have successfully run all checkers during

3304

2608

# downtime.

3306

2610

if datetime.datetime.utcnow() >= client["expires"]:

3307

2611

if not client["last_checked_ok"]:

3308

2612

logger.warning(

3309

"disabling client {} - Client never "

3310

"performed a successful checker".format(

3311

client_name))

2613

"disabling client {0} - Client never "

2614

"performed a successful checker"

2615

.format(client_name))

3312

2616

client["enabled"] = False

3313

2617

elif client["last_checker_status"] != 0:

3314

2618

logger.warning(

3315

"disabling client {} - Client last"

3316

" checker failed with error code"

3317

" {}".format(

3318

client_name,

3319

client["last_checker_status"]))

2619

"disabling client {0} - Client "

2620

"last checker failed with error code {1}"

2621

.format(client_name,

2622

client["last_checker_status"]))

3320

2623

client["enabled"] = False

3321

2624

else:

3322

client["expires"] = (

3323

datetime.datetime.utcnow()

3324

+ client["timeout"])

2625

client["expires"] = (datetime.datetime

2626

.utcnow()

2627

+ client["timeout"])

3325

2628

logger.debug("Last checker succeeded,"

3326

" keeping {} enabled".format(

3327

client_name))

2629

" keeping {0} enabled"

2630

.format(client_name))

3328

2631

try:

3329

client["secret"] = pgp.decrypt(

3330

client["encrypted_secret"],

3331

client_settings[client_name]["secret"])

2632

client["secret"] = (

2633

pgp.decrypt(client["encrypted_secret"],

2634

client_settings[client_name]

2635

["secret"]))

3332

2636

except PGPError:

3333

2637

# If decryption fails, we use secret from new settings

3334

logger.debug("Failed to decrypt {} old secret".format(

3335

client_name))

3336

client["secret"] = (client_settings[client_name]

3337

["secret"])

3338

2638

logger.debug("Failed to decrypt {0} old secret"

2639

.format(client_name))

2640

client["secret"] = (

2641

client_settings[client_name]["secret"])

2642

3339

2643

# Add/remove clients based on new changes made to config

3340

2644

for client_name in (set(old_client_settings)

3341

2645

- set(client_settings)):

3343

2647

for client_name in (set(client_settings)

3344

2648

- set(old_client_settings)):

3345

2649

clients_data[client_name] = client_settings[client_name]

3346

2650

3347

2651

# Create all client objects

3348

for client_name, client in clients_data.items():

2652

for client_name, client in clients_data.iteritems():

3349

2653

tcp_server.clients[client_name] = client_class(

3350

name=client_name,

3351

settings=client,

3352

server_settings=server_settings)

3353

2654

name = client_name, settings = client,

2655

server_settings = server_settings)

2656

3354

2657

if not tcp_server.clients:

3355

2658

logger.warning("No clients defined")

3356

2659

3357

2660

if not foreground:

3358

2661

if pidfile is not None:

3359

pid = os.getpid()

3360

2662

try:

3361

2663

with pidfile:

3362

print(pid, file=pidfile)

2664

pid = os.getpid()

2665

pidfile.write(str(pid) + "\n".encode("utf-8"))

3363

2666

except IOError:

3364

2667

logger.error("Could not write to file %r with PID %d",

3365

2668

pidfilename, pid)

3366

2669

del pidfile

3367

2670

del pidfilename

3368

3369

for termsig in (signal.SIGHUP, signal.SIGTERM):

3370

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3371

lambda: main_loop.quit() and False)

3372

2671

2672

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2674

3373

2675

if use_dbus:

3374

3375

@alternate_dbus_interfaces(

3376

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3377

class MandosDBusService(DBusObjectWithObjectManager):

2676

@alternate_dbus_interfaces({"se.recompile.Mandos":

2677

"se.bsnet.fukt.Mandos"})

2678

class MandosDBusService(DBusObjectWithProperties):

3378

2679

"""A D-Bus proxy object"""

3379

3380

2680

def __init__(self):

3381

2681

dbus.service.Object.__init__(self, bus, "/")

3382

3383

2682

_interface = "se.recompile.Mandos"

3384

2683

2684

@dbus_interface_annotations(_interface)

2685

def _foo(self):

2686

return { "org.freedesktop.DBus.Property"

2687

".EmitsChangedSignal":

2688

"false"}

2689

3385

2690

@dbus.service.signal(_interface, signature="o")

3386

2691

def ClientAdded(self, objpath):

3387

2692

"D-Bus signal"

3388

2693

pass

3389

2694

3390

2695

@dbus.service.signal(_interface, signature="ss")

3391

def ClientNotFound(self, key_id, address):

2696

def ClientNotFound(self, fingerprint, address):

3392

2697

"D-Bus signal"

3393

2698

pass

3394

3395

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3396

"true"})

2699

3397

2700

@dbus.service.signal(_interface, signature="os")

3398

2701

def ClientRemoved(self, objpath, name):

3399

2702

"D-Bus signal"

3400

2703

pass

3401

3402

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3403

"true"})

2704

3404

2705

@dbus.service.method(_interface, out_signature="ao")

3405

2706

def GetAllClients(self):

3406

2707

"D-Bus method"

3407

return dbus.Array(c.dbus_object_path for c in

3408

tcp_server.clients.values())

3409

3410

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3411

"true"})

2708

return dbus.Array(c.dbus_object_path

2709

for c in

2710

tcp_server.clients.itervalues())

2711

3412

2712

@dbus.service.method(_interface,

3413

2713

out_signature="a{oa{sv}}")

3414

2714

def GetAllClientsWithProperties(self):

3415

2715

"D-Bus method"

3416

2716

return dbus.Dictionary(

3417

{c.dbus_object_path: c.GetAll(

3418

"se.recompile.Mandos.Client")

3419

for c in tcp_server.clients.values()},

2717

((c.dbus_object_path, c.GetAll(""))

2718

for c in tcp_server.clients.itervalues()),

3420

2719

signature="oa{sv}")

3421

2720

3422

2721

@dbus.service.method(_interface, in_signature="o")

3423

2722

def RemoveClient(self, object_path):

3424

2723

"D-Bus method"

3425

for c in tcp_server.clients.values():

2724

for c in tcp_server.clients.itervalues():

3426

2725

if c.dbus_object_path == object_path:

3427

2726

del tcp_server.clients[c.name]

3428

2727

c.remove_from_connection()

3429

# Don't signal the disabling

2728

# Don't signal anything except ClientRemoved

3430

2729

c.disable(quiet=True)

3431

# Emit D-Bus signal for removal

3432

self.client_removed_signal(c)

2730

# Emit D-Bus signal

2731

self.ClientRemoved(object_path, c.name)

3433

2732

return

3434

2733

raise KeyError(object_path)

3435

2734

3436

2735

del _interface

3437

3438

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3439

out_signature="a{oa{sa{sv}}}")

3440

def GetManagedObjects(self):

3441

"""D-Bus method"""

3442

return dbus.Dictionary(

3443

{client.dbus_object_path:

3444

dbus.Dictionary(

3445

{interface: client.GetAll(interface)

3446

for interface in

3447

client._get_all_interface_names()})

3448

for client in tcp_server.clients.values()})

3449

3450

def client_added_signal(self, client):

3451

"""Send the new standard signal and the old signal"""

3452

if use_dbus:

3453

# New standard signal

3454

self.InterfacesAdded(

3455

client.dbus_object_path,

3456

dbus.Dictionary(

3457

{interface: client.GetAll(interface)

3458

for interface in

3459

client._get_all_interface_names()}))

3460

# Old signal

3461

self.ClientAdded(client.dbus_object_path)

3462

3463

def client_removed_signal(self, client):

3464

"""Send the new standard signal and the old signal"""

3465

if use_dbus:

3466

# New standard signal

3467

self.InterfacesRemoved(

3468

client.dbus_object_path,

3469

client._get_all_interface_names())

3470

# Old signal

3471

self.ClientRemoved(client.dbus_object_path,

3472

client.name)

3473

2736

3474

2737

mandos_dbus_service = MandosDBusService()

3475

3476

# Save modules to variables to exempt the modules from being

3477

# unloaded before the function registered with atexit() is run.

3478

mp = multiprocessing

3479

wn = wnull

3480

2738

3481

2739

def cleanup():

3482

2740

"Cleanup function; run on exit"

3483

if zeroconf:

3484

service.cleanup()

3485

3486

mp.active_children()

3487

wn.close()

2741

service.cleanup()

2742

2743

multiprocessing.active_children()

2744

wnull.close()

3488

2745

if not (tcp_server.clients or client_settings):

3489

2746

return

3490

2747

3491

2748

# Store client before exiting. Secrets are encrypted with key

3492

2749

# based on what config file has. If config file is

3493

2750

# removed/edited, old secret will thus be unrecovable.

3494

2751

clients = {}

3495

2752

with PGPEngine() as pgp:

3496

for client in tcp_server.clients.values():

2753

for client in tcp_server.clients.itervalues():

3497

2754

key = client_settings[client.name]["secret"]

3498

2755

client.encrypted_secret = pgp.encrypt(client.secret,

3499

2756

key)

3500

2757

client_dict = {}

3501

2758

3502

2759

# A list of attributes that can not be pickled

3503

2760

# + secret.

3504

exclude = {"bus", "changedstate", "secret",

3505

"checker", "server_settings"}

3506

for name, typ in inspect.getmembers(dbus.service

3507

.Object):

2761

exclude = set(("bus", "changedstate", "secret",

2762

"checker", "server_settings"))

2763

for name, typ in (inspect.getmembers

2764

(dbus.service.Object)):

3508

2765

exclude.add(name)

3509

2766

3510

2767

client_dict["encrypted_secret"] = (client

3511

2768

.encrypted_secret)

3512

2769

for attr in client.client_structure:

3513

2770

if attr not in exclude:

3514

2771

client_dict[attr] = getattr(client, attr)

3515

2772

3516

2773

clients[client.name] = client_dict

3517

2774

del client_settings[client.name]["secret"]

3518

2775

3519

2776

try:

3520

with tempfile.NamedTemporaryFile(

3521

mode='wb',

3522

suffix=".pickle",

3523

prefix='clients-',

3524

dir=os.path.dirname(stored_state_path),

3525

delete=False) as stored_state:

3526

pickle.dump((clients, client_settings), stored_state,

3527

protocol=2)

3528

tempname = stored_state.name

2777

with (tempfile.NamedTemporaryFile

2778

(mode='wb', suffix=".pickle", prefix='clients-',

2779

dir=os.path.dirname(stored_state_path),

2780

delete=False)) as stored_state:

2781

pickle.dump((clients, client_settings), stored_state)

2782

tempname=stored_state.name

3529

2783

os.rename(tempname, stored_state_path)

3530

2784

except (IOError, OSError) as e:

3531

2785

if not debug:

3534

2788

except NameError:

3535

2789

pass

3536

2790

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3537

logger.warning("Could not save persistent state: {}"

2791

logger.warning("Could not save persistent state: {0}"

3538

2792

.format(os.strerror(e.errno)))

3539

2793

else:

3540

2794

logger.warning("Could not save persistent state:",

3541

2795

exc_info=e)

3542

2796

raise

3543

2797

3544

2798

# Delete all clients, and settings from config

3545

2799

while tcp_server.clients:

3546

2800

name, client = tcp_server.clients.popitem()

3547

2801

if use_dbus:

3548

2802

client.remove_from_connection()

3549

# Don't signal the disabling

2803

# Don't signal anything except ClientRemoved

3550

2804

client.disable(quiet=True)

3551

# Emit D-Bus signal for removal

3552

2805

if use_dbus:

3553

mandos_dbus_service.client_removed_signal(client)

2806

# Emit D-Bus signal

2807

mandos_dbus_service.ClientRemoved(client

2808

.dbus_object_path,

2809

client.name)

3554

2810

client_settings.clear()

3555

2811

3556

2812

atexit.register(cleanup)

3557

3558

for client in tcp_server.clients.values():

2813

2814

for client in tcp_server.clients.itervalues():

3559

2815

if use_dbus:

3560

# Emit D-Bus signal for adding

3561

mandos_dbus_service.client_added_signal(client)

2816

# Emit D-Bus signal

2817

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3562

2818

# Need to initiate checking of clients

3563

2819

if client.enabled:

3564

2820

client.init_checker()

3565

2821

3566

2822

tcp_server.enable()

3567

2823

tcp_server.server_activate()

3568

2824

3569

2825

# Find out what port we got

3570

if zeroconf:

3571

service.port = tcp_server.socket.getsockname()[1]

2826

service.port = tcp_server.socket.getsockname()[1]

3572

2827

if use_ipv6:

3573

2828

logger.info("Now listening on address %r, port %d,"

3574

2829

" flowinfo %d, scope_id %d",

3576

2831

else: # IPv4

3577

2832

logger.info("Now listening on address %r, port %d",

3578

2833

*tcp_server.socket.getsockname())

3579

3580

# service.interface = tcp_server.socket.getsockname()[3]

3581

2834

2835

#service.interface = tcp_server.socket.getsockname()[3]

2836

3582

2837

try:

3583

if zeroconf:

3584

# From the Avahi example code

3585

try:

3586

service.activate()

3587

except dbus.exceptions.DBusException as error:

3588

logger.critical("D-Bus Exception", exc_info=error)

3589

cleanup()

3590

sys.exit(1)

3591

# End of Avahi example code

3592

3593

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3594

lambda *args, **kwargs:

3595

(tcp_server.handle_request

3596

(*args[2:], **kwargs) or True))

3597

2838

# From the Avahi example code

2839

try:

2840

service.activate()

2841

except dbus.exceptions.DBusException as error:

2842

logger.critical("D-Bus Exception", exc_info=error)

2843

cleanup()

2844

sys.exit(1)

2845

# End of Avahi example code

2846

2847

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2848

lambda *args, **kwargs:

2849

(tcp_server.handle_request

2850

(*args[2:], **kwargs) or True))

2851

3598

2852

logger.debug("Starting main loop")

3599

2853

main_loop.run()

3600

2854

except AvahiError as error:

3609

2863

# Must run before the D-Bus bus name gets deregistered

3610

2864

cleanup()

3611

2865

3612

3613

2866

if __name__ == '__main__':

3614

2867

main()