/mandos/release : revision 237.7.203

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

72

81

73

import dbus

82

74

import dbus.service

83

from gi.repository import GLib

75

import gobject

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

86

79

import ctypes.util

87

80

import xml.dom.minidom

88

81

import inspect

89

82

90

# Try to find the value of SO_BINDTODEVICE:

91

83

try:

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

93

# newer, and it is also the most natural place for it:

94

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

95

85

except AttributeError:

96

86

try:

97

# This is where SO_BINDTODEVICE was up to and including Python

98

# 2.6, and also 3.2:

99

87

from IN import SO_BINDTODEVICE

100

88

except ImportError:

101

# In Python 2.7 it seems to have been removed entirely.

102

# Try running the C preprocessor:

103

try:

104

cc = subprocess.Popen(["cc", "--language=c", "-E",

105

"/dev/stdin"],

106

stdin=subprocess.PIPE,

107

stdout=subprocess.PIPE)

108

stdout = cc.communicate(

109

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

110

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

111

except (OSError, ValueError, IndexError):

112

# No value found

113

SO_BINDTODEVICE = None

114

115

if sys.version_info.major == 2:

116

str = unicode

117

118

version = "1.8.5"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.3"

119

92

stored_state_file = "clients.pickle"

120

93

121

94

logger = logging.getLogger()

122

95

syslogger = None

123

96

124

97

try:

125

if_nametoindex = ctypes.cdll.LoadLibrary(

126

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

127

101

except (OSError, AttributeError):

128

129

102

def if_nametoindex(interface):

130

103

"Get an interface index the hard way, i.e. using fcntl()"

131

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

132

105

with contextlib.closing(socket.socket()) as s:

133

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

134

struct.pack(b"16s16x", interface))

135

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

136

111

return interface_index

137

112

138

113

139

def copy_function(func):

140

"""Make a copy of a function"""

141

if sys.version_info.major == 2:

142

return types.FunctionType(func.func_code,

143

func.func_globals,

144

func.func_name,

145

func.func_defaults,

146

func.func_closure)

147

else:

148

return types.FunctionType(func.__code__,

149

func.__globals__,

150

func.__name__,

151

func.__defaults__,

152

func.__closure__)

153

154

155

114

def initlogger(debug, level=logging.WARNING):

156

115

"""init logger and add loglevel"""

157

158

global syslogger

159

syslogger = (logging.handlers.SysLogHandler(

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

161

address="/dev/log"))

116

117

syslogger = (logging.handlers.SysLogHandler

118

(facility =

119

logging.handlers.SysLogHandler.LOG_DAEMON,

120

address = str("/dev/log")))

162

121

syslogger.setFormatter(logging.Formatter

163

122

('Mandos [%(process)d]: %(levelname)s:'

164

123

' %(message)s'))

165

124

logger.addHandler(syslogger)

166

125

167

126

if debug:

168

127

console = logging.StreamHandler()

169

128

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

181

140

182

141

class PGPEngine(object):

183

142

"""A simple class for OpenPGP symmetric encryption & decryption"""

184

185

143

def __init__(self):

186

144

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

187

self.gpg = "gpg"

188

try:

189

output = subprocess.check_output(["gpgconf"])

190

for line in output.splitlines():

191

name, text, path = line.split(b":")

192

if name == "gpg":

193

self.gpg = path

194

break

195

except OSError as e:

196

if e.errno != errno.ENOENT:

197

raise

198

145

self.gnupgargs = ['--batch',

199

'--homedir', self.tempdir,

146

'--home', self.tempdir,

200

147

'--force-mdc',

201

'--quiet']

202

# Only GPG version 1 has the --no-use-agent option.

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

204

self.gnupgargs.append("--no-use-agent")

205

148

'--quiet',

149

'--no-use-agent']

150

206

151

def __enter__(self):

207

152

return self

208

153

209

154

def __exit__(self, exc_type, exc_value, traceback):

210

155

self._cleanup()

211

156

return False

212

157

213

158

def __del__(self):

214

159

self._cleanup()

215

160

216

161

def _cleanup(self):

217

162

if self.tempdir is not None:

218

163

# Delete contents of tempdir

219

164

for root, dirs, files in os.walk(self.tempdir,

220

topdown=False):

165

topdown = False):

221

166

for filename in files:

222

167

os.remove(os.path.join(root, filename))

223

168

for dirname in dirs:

225

170

# Remove tempdir

226

171

os.rmdir(self.tempdir)

227

172

self.tempdir = None

228

173

229

174

def password_encode(self, password):

230

175

# Passphrase can not be empty and can not contain newlines or

231

176

# NUL bytes. So we prefix it and hex encode it.

236

181

.replace(b"\n", b"\\n")

237

182

.replace(b"\0", b"\\x00"))

238

183

return encoded

239

184

240

185

def encrypt(self, data, password):

241

186

passphrase = self.password_encode(password)

242

with tempfile.NamedTemporaryFile(

243

dir=self.tempdir) as passfile:

187

with tempfile.NamedTemporaryFile(dir=self.tempdir

188

) as passfile:

244

189

passfile.write(passphrase)

245

190

passfile.flush()

246

proc = subprocess.Popen([self.gpg, '--symmetric',

191

proc = subprocess.Popen(['gpg', '--symmetric',

247

192

'--passphrase-file',

248

193

passfile.name]

249

194

+ self.gnupgargs,

250

stdin=subprocess.PIPE,

251

stdout=subprocess.PIPE,

252

stderr=subprocess.PIPE)

253

ciphertext, err = proc.communicate(input=data)

195

stdin = subprocess.PIPE,

196

stdout = subprocess.PIPE,

197

stderr = subprocess.PIPE)

198

ciphertext, err = proc.communicate(input = data)

254

199

if proc.returncode != 0:

255

200

raise PGPError(err)

256

201

return ciphertext

257

202

258

203

def decrypt(self, data, password):

259

204

passphrase = self.password_encode(password)

260

with tempfile.NamedTemporaryFile(

261

dir=self.tempdir) as passfile:

205

with tempfile.NamedTemporaryFile(dir = self.tempdir

206

) as passfile:

262

207

passfile.write(passphrase)

263

208

passfile.flush()

264

proc = subprocess.Popen([self.gpg, '--decrypt',

209

proc = subprocess.Popen(['gpg', '--decrypt',

265

210

'--passphrase-file',

266

211

passfile.name]

267

212

+ self.gnupgargs,

268

stdin=subprocess.PIPE,

269

stdout=subprocess.PIPE,

270

stderr=subprocess.PIPE)

271

decrypted_plaintext, err = proc.communicate(input=data)

213

stdin = subprocess.PIPE,

214

stdout = subprocess.PIPE,

215

stderr = subprocess.PIPE)

216

decrypted_plaintext, err = proc.communicate(input

217

= data)

272

218

if proc.returncode != 0:

273

219

raise PGPError(err)

274

220

return decrypted_plaintext

275

221

276

222

277

# Pretend that we have an Avahi module

278

class avahi(object):

279

"""This isn't so much a class as it is a module-like namespace."""

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

284

DBUS_NAME = "org.freedesktop.Avahi"

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

287

DBUS_PATH_SERVER = "/"

288

289

@staticmethod

290

def string_array_to_txt_array(t):

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

292

for s in t), signature="ay")

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

294

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

295

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

296

SERVER_INVALID = 0 # avahi-common/defs.h

297

SERVER_REGISTERING = 1 # avahi-common/defs.h

298

SERVER_RUNNING = 2 # avahi-common/defs.h

299

SERVER_COLLISION = 3 # avahi-common/defs.h

300

SERVER_FAILURE = 4 # avahi-common/defs.h

301

302

303

223

class AvahiError(Exception):

304

224

def __init__(self, value, *args, **kwargs):

305

225

self.value = value

306

return super(AvahiError, self).__init__(value, *args,

307

**kwargs)

308

226

super(AvahiError, self).__init__(value, *args, **kwargs)

227

def __unicode__(self):

228

return unicode(repr(self.value))

309

229

310

230

class AvahiServiceError(AvahiError):

311

231

pass

312

232

313

314

233

class AvahiGroupError(AvahiError):

315

234

pass

316

235

317

236

318

237

class AvahiService(object):

319

238

"""An Avahi (Zeroconf) service.

320

239

321

240

Attributes:

322

241

interface: integer; avahi.IF_UNSPEC or an interface index.

323

242

Used to optionally bind to the specified interface.

335

254

server: D-Bus Server

336

255

bus: dbus.SystemBus()

337

256

"""

338

339

def __init__(self,

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

257

258

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

259

servicetype = None, port = None, TXT = None,

260

domain = "", host = "", max_renames = 32768,

261

protocol = avahi.PROTO_UNSPEC, bus = None):

350

262

self.interface = interface

351

263

self.name = name

352

264

self.type = servicetype

361

273

self.server = None

362

274

self.bus = bus

363

275

self.entry_group_state_changed_match = None

364

365

def rename(self, remove=True):

276

277

def rename(self):

366

278

"""Derived from the Avahi example code"""

367

279

if self.rename_count >= self.max_renames:

368

280

logger.critical("No suitable Zeroconf service name found"

369

281

" after %i retries, exiting.",

370

282

self.rename_count)

371

283

raise AvahiServiceError("Too many renames")

372

self.name = str(

373

self.server.GetAlternativeServiceName(self.name))

374

self.rename_count += 1

284

self.name = unicode(self.server

285

.GetAlternativeServiceName(self.name))

375

286

logger.info("Changing Zeroconf service name to %r ...",

376

287

self.name)

377

if remove:

378

self.remove()

288

self.remove()

379

289

try:

380

290

self.add()

381

291

except dbus.exceptions.DBusException as error:

382

if (error.get_dbus_name()

383

== "org.freedesktop.Avahi.CollisionError"):

384

logger.info("Local Zeroconf service name collision.")

385

return self.rename(remove=False)

386

else:

387

logger.critical("D-Bus Exception", exc_info=error)

388

self.cleanup()

389

os._exit(1)

390

292

logger.critical("D-Bus Exception", exc_info=error)

293

self.cleanup()

294

os._exit(1)

295

self.rename_count += 1

296

391

297

def remove(self):

392

298

"""Derived from the Avahi example code"""

393

299

if self.entry_group_state_changed_match is not None:

395

301

self.entry_group_state_changed_match = None

396

302

if self.group is not None:

397

303

self.group.Reset()

398

304

399

305

def add(self):

400

306

"""Derived from the Avahi example code"""

401

307

self.remove()

418

324

dbus.UInt16(self.port),

419

325

avahi.string_array_to_txt_array(self.TXT))

420

326

self.group.Commit()

421

327

422

328

def entry_group_state_changed(self, state, error):

423

329

"""Derived from the Avahi example code"""

424

330

logger.debug("Avahi entry group state change: %i", state)

425

331

426

332

if state == avahi.ENTRY_GROUP_ESTABLISHED:

427

333

logger.debug("Zeroconf service established.")

428

334

elif state == avahi.ENTRY_GROUP_COLLISION:

430

336

self.rename()

431

337

elif state == avahi.ENTRY_GROUP_FAILURE:

432

338

logger.critical("Avahi: Error in group state changed %s",

433

str(error))

434

raise AvahiGroupError("State changed: {!s}".format(error))

435

339

unicode(error))

340

raise AvahiGroupError("State changed: {0!s}"

341

.format(error))

342

436

343

def cleanup(self):

437

344

"""Derived from the Avahi example code"""

438

345

if self.group is not None:

443

350

pass

444

351

self.group = None

445

352

self.remove()

446

353

447

354

def server_state_changed(self, state, error=None):

448

355

"""Derived from the Avahi example code"""

449

356

logger.debug("Avahi server state change: %i", state)

450

bad_states = {

451

avahi.SERVER_INVALID: "Zeroconf server invalid",

452

avahi.SERVER_REGISTERING: None,

453

avahi.SERVER_COLLISION: "Zeroconf server name collision",

454

avahi.SERVER_FAILURE: "Zeroconf server failure",

455

}

357

bad_states = { avahi.SERVER_INVALID:

358

"Zeroconf server invalid",

359

avahi.SERVER_REGISTERING: None,

360

avahi.SERVER_COLLISION:

361

"Zeroconf server name collision",

362

avahi.SERVER_FAILURE:

363

"Zeroconf server failure" }

456

364

if state in bad_states:

457

365

if bad_states[state] is not None:

458

366

if error is None:

461

369

logger.error(bad_states[state] + ": %r", error)

462

370

self.cleanup()

463

371

elif state == avahi.SERVER_RUNNING:

464

try:

465

self.add()

466

except dbus.exceptions.DBusException as error:

467

if (error.get_dbus_name()

468

== "org.freedesktop.Avahi.CollisionError"):

469

logger.info("Local Zeroconf service name"

470

" collision.")

471

return self.rename(remove=False)

472

else:

473

logger.critical("D-Bus Exception", exc_info=error)

474

self.cleanup()

475

os._exit(1)

372

self.add()

476

373

else:

477

374

if error is None:

478

375

logger.debug("Unknown state: %r", state)

479

376

else:

480

377

logger.debug("Unknown state: %r: %r", state, error)

481

378

482

379

def activate(self):

483

380

"""Derived from the Avahi example code"""

484

381

if self.server is None:

488

385

follow_name_owner_changes=True),

489

386

avahi.DBUS_INTERFACE_SERVER)

490

387

self.server.connect_to_signal("StateChanged",

491

self.server_state_changed)

388

self.server_state_changed)

492

389

self.server_state_changed(self.server.GetState())

493

390

494

391

495

392

class AvahiServiceToSyslog(AvahiService):

496

def rename(self, *args, **kwargs):

393

def rename(self):

497

394

"""Add the new name to the syslog messages"""

498

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

499

syslogger.setFormatter(logging.Formatter(

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

501

.format(self.name)))

395

ret = AvahiService.rename(self)

396

syslogger.setFormatter(logging.Formatter

397

('Mandos ({0}) [%(process)d]:'

398

' %(levelname)s: %(message)s'

399

.format(self.name)))

502

400

return ret

503

401

504

402

505

# Pretend that we have a GnuTLS module

506

class gnutls(object):

507

"""This isn't so much a class as it is a module-like namespace."""

508

509

library = ctypes.util.find_library("gnutls")

510

if library is None:

511

library = ctypes.util.find_library("gnutls-deb0")

512

_library = ctypes.cdll.LoadLibrary(library)

513

del library

514

515

# Unless otherwise indicated, the constants and types below are

516

# all from the gnutls/gnutls.h C header file.

517

518

# Constants

519

E_SUCCESS = 0

520

E_INTERRUPTED = -52

521

E_AGAIN = -28

522

CRT_OPENPGP = 2

523

CRT_RAWPK = 3

524

CLIENT = 2

525

SHUT_RDWR = 0

526

CRD_CERTIFICATE = 1

527

E_NO_CERTIFICATE_FOUND = -49

528

X509_FMT_DER = 0

529

NO_TICKETS = 1<<10

530

ENABLE_RAWPK = 1<<18

531

CTYPE_PEERS = 3

532

KEYID_USE_SHA256 = 1 # gnutls/x509.h

533

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

534

535

# Types

536

class session_int(ctypes.Structure):

537

_fields_ = []

538

session_t = ctypes.POINTER(session_int)

539

540

class certificate_credentials_st(ctypes.Structure):

541

_fields_ = []

542

certificate_credentials_t = ctypes.POINTER(

543

certificate_credentials_st)

544

certificate_type_t = ctypes.c_int

545

546

class datum_t(ctypes.Structure):

547

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

548

('size', ctypes.c_uint)]

549

550

class openpgp_crt_int(ctypes.Structure):

551

_fields_ = []

552

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

553

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

554

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

555

credentials_type_t = ctypes.c_int

556

transport_ptr_t = ctypes.c_void_p

557

close_request_t = ctypes.c_int

558

559

# Exceptions

560

class Error(Exception):

561

def __init__(self, message=None, code=None, args=()):

562

# Default usage is by a message string, but if a return

563

# code is passed, convert it to a string with

564

# gnutls.strerror()

565

self.code = code

566

if message is None and code is not None:

567

message = gnutls.strerror(code)

568

return super(gnutls.Error, self).__init__(

569

message, *args)

570

571

class CertificateSecurityError(Error):

572

pass

573

574

# Classes

575

class Credentials(object):

576

def __init__(self):

577

self._c_object = gnutls.certificate_credentials_t()

578

gnutls.certificate_allocate_credentials(

579

ctypes.byref(self._c_object))

580

self.type = gnutls.CRD_CERTIFICATE

581

582

def __del__(self):

583

gnutls.certificate_free_credentials(self._c_object)

584

585

class ClientSession(object):

586

def __init__(self, socket, credentials=None):

587

self._c_object = gnutls.session_t()

588

gnutls_flags = gnutls.CLIENT

589

if gnutls.check_version(b"3.5.6"):

590

gnutls_flags |= gnutls.NO_TICKETS

591

if gnutls.has_rawpk:

592

gnutls_flags |= gnutls.ENABLE_RAWPK

593

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

594

del gnutls_flags

595

gnutls.set_default_priority(self._c_object)

596

gnutls.transport_set_ptr(self._c_object, socket.fileno())

597

gnutls.handshake_set_private_extensions(self._c_object,

598

True)

599

self.socket = socket

600

if credentials is None:

601

credentials = gnutls.Credentials()

602

gnutls.credentials_set(self._c_object, credentials.type,

603

ctypes.cast(credentials._c_object,

604

ctypes.c_void_p))

605

self.credentials = credentials

606

607

def __del__(self):

608

gnutls.deinit(self._c_object)

609

610

def handshake(self):

611

return gnutls.handshake(self._c_object)

612

613

def send(self, data):

614

data = bytes(data)

615

data_len = len(data)

616

while data_len > 0:

617

data_len -= gnutls.record_send(self._c_object,

618

data[-data_len:],

619

data_len)

620

621

def bye(self):

622

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

623

624

# Error handling functions

625

def _error_code(result):

626

"""A function to raise exceptions on errors, suitable

627

for the 'restype' attribute on ctypes functions"""

628

if result >= 0:

629

return result

630

if result == gnutls.E_NO_CERTIFICATE_FOUND:

631

raise gnutls.CertificateSecurityError(code=result)

632

raise gnutls.Error(code=result)

633

634

def _retry_on_error(result, func, arguments):

635

"""A function to retry on some errors, suitable

636

for the 'errcheck' attribute on ctypes functions"""

637

while result < 0:

638

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

639

return _error_code(result)

640

result = func(*arguments)

641

return result

642

643

# Unless otherwise indicated, the function declarations below are

644

# all from the gnutls/gnutls.h C header file.

645

646

# Functions

647

priority_set_direct = _library.gnutls_priority_set_direct

648

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

649

ctypes.POINTER(ctypes.c_char_p)]

650

priority_set_direct.restype = _error_code

651

652

init = _library.gnutls_init

653

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

654

init.restype = _error_code

655

656

set_default_priority = _library.gnutls_set_default_priority

657

set_default_priority.argtypes = [session_t]

658

set_default_priority.restype = _error_code

659

660

record_send = _library.gnutls_record_send

661

record_send.argtypes = [session_t, ctypes.c_void_p,

662

ctypes.c_size_t]

663

record_send.restype = ctypes.c_ssize_t

664

record_send.errcheck = _retry_on_error

665

666

certificate_allocate_credentials = (

667

_library.gnutls_certificate_allocate_credentials)

668

certificate_allocate_credentials.argtypes = [

669

ctypes.POINTER(certificate_credentials_t)]

670

certificate_allocate_credentials.restype = _error_code

671

672

certificate_free_credentials = (

673

_library.gnutls_certificate_free_credentials)

674

certificate_free_credentials.argtypes = [

675

certificate_credentials_t]

676

certificate_free_credentials.restype = None

677

678

handshake_set_private_extensions = (

679

_library.gnutls_handshake_set_private_extensions)

680

handshake_set_private_extensions.argtypes = [session_t,

681

ctypes.c_int]

682

handshake_set_private_extensions.restype = None

683

684

credentials_set = _library.gnutls_credentials_set

685

credentials_set.argtypes = [session_t, credentials_type_t,

686

ctypes.c_void_p]

687

credentials_set.restype = _error_code

688

689

strerror = _library.gnutls_strerror

690

strerror.argtypes = [ctypes.c_int]

691

strerror.restype = ctypes.c_char_p

692

693

certificate_type_get = _library.gnutls_certificate_type_get

694

certificate_type_get.argtypes = [session_t]

695

certificate_type_get.restype = _error_code

696

697

certificate_get_peers = _library.gnutls_certificate_get_peers

698

certificate_get_peers.argtypes = [session_t,

699

ctypes.POINTER(ctypes.c_uint)]

700

certificate_get_peers.restype = ctypes.POINTER(datum_t)

701

702

global_set_log_level = _library.gnutls_global_set_log_level

703

global_set_log_level.argtypes = [ctypes.c_int]

704

global_set_log_level.restype = None

705

706

global_set_log_function = _library.gnutls_global_set_log_function

707

global_set_log_function.argtypes = [log_func]

708

global_set_log_function.restype = None

709

710

deinit = _library.gnutls_deinit

711

deinit.argtypes = [session_t]

712

deinit.restype = None

713

714

handshake = _library.gnutls_handshake

715

handshake.argtypes = [session_t]

716

handshake.restype = _error_code

717

handshake.errcheck = _retry_on_error

718

719

transport_set_ptr = _library.gnutls_transport_set_ptr

720

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

721

transport_set_ptr.restype = None

722

723

bye = _library.gnutls_bye

724

bye.argtypes = [session_t, close_request_t]

725

bye.restype = _error_code

726

bye.errcheck = _retry_on_error

727

728

check_version = _library.gnutls_check_version

729

check_version.argtypes = [ctypes.c_char_p]

730

check_version.restype = ctypes.c_char_p

731

732

_need_version = b"3.3.0"

733

if check_version(_need_version) is None:

734

raise self.Error("Needs GnuTLS {} or later"

735

.format(_need_version))

736

737

_tls_rawpk_version = b"3.6.6"

738

has_rawpk = bool(check_version(_tls_rawpk_version))

739

740

if has_rawpk:

741

# Types

742

class pubkey_st(ctypes.Structure):

743

_fields = []

744

pubkey_t = ctypes.POINTER(pubkey_st)

745

746

x509_crt_fmt_t = ctypes.c_int

747

748

# All the function declarations below are from gnutls/abstract.h

749

pubkey_init = _library.gnutls_pubkey_init

750

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

751

pubkey_init.restype = _error_code

752

753

pubkey_import = _library.gnutls_pubkey_import

754

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

755

x509_crt_fmt_t]

756

pubkey_import.restype = _error_code

757

758

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

759

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

760

ctypes.POINTER(ctypes.c_ubyte),

761

ctypes.POINTER(ctypes.c_size_t)]

762

pubkey_get_key_id.restype = _error_code

763

764

pubkey_deinit = _library.gnutls_pubkey_deinit

765

pubkey_deinit.argtypes = [pubkey_t]

766

pubkey_deinit.restype = None

767

else:

768

# All the function declarations below are from gnutls/openpgp.h

769

770

openpgp_crt_init = _library.gnutls_openpgp_crt_init

771

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

772

openpgp_crt_init.restype = _error_code

773

774

openpgp_crt_import = _library.gnutls_openpgp_crt_import

775

openpgp_crt_import.argtypes = [openpgp_crt_t,

776

ctypes.POINTER(datum_t),

777

openpgp_crt_fmt_t]

778

openpgp_crt_import.restype = _error_code

779

780

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

781

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

782

ctypes.POINTER(ctypes.c_uint)]

783

openpgp_crt_verify_self.restype = _error_code

784

785

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

786

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

787

openpgp_crt_deinit.restype = None

788

789

openpgp_crt_get_fingerprint = (

790

_library.gnutls_openpgp_crt_get_fingerprint)

791

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

792

ctypes.c_void_p,

793

ctypes.POINTER(

794

ctypes.c_size_t)]

795

openpgp_crt_get_fingerprint.restype = _error_code

796

797

if check_version(b"3.6.4"):

798

certificate_type_get2 = _library.gnutls_certificate_type_get2

799

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

800

certificate_type_get2.restype = _error_code

801

802

# Remove non-public functions

803

del _error_code, _retry_on_error

804

805

806

def call_pipe(connection, # : multiprocessing.Connection

807

func, *args, **kwargs):

808

"""This function is meant to be called by multiprocessing.Process

809

810

This function runs func(*args, **kwargs), and writes the resulting

811

return value on the provided multiprocessing.Connection.

812

"""

813

connection.send(func(*args, **kwargs))

814

connection.close()

403

def timedelta_to_milliseconds(td):

404

"Convert a datetime.timedelta() to milliseconds"

405

return ((td.days * 24 * 60 * 60 * 1000)

406

+ (td.seconds * 1000)

407

+ (td.microseconds // 1000))

815

408

816

409

817

410

class Client(object):

818

411

"""A representation of a client host served by this server.

819

412

820

413

Attributes:

821

414

approved: bool(); 'None' if not yet approved/disapproved

822

415

approval_delay: datetime.timedelta(); Time to wait for approval

823

416

approval_duration: datetime.timedelta(); Duration of one approval

824

checker: multiprocessing.Process(); a running checker process used

825

to see if the client lives. 'None' if no process is

826

running.

827

checker_callback_tag: a GLib event source tag, or None

417

checker: subprocess.Popen(); a running checker process used

418

to see if the client lives.

419

'None' if no process is running.

420

checker_callback_tag: a gobject event source tag, or None

828

421

checker_command: string; External command which is run to check

829

422

if client lives. %() expansions are done at

830

423

runtime with vars(self) as dict, so that for

831

424

instance %(name)s can be used in the command.

832

checker_initiator_tag: a GLib event source tag, or None

425

checker_initiator_tag: a gobject event source tag, or None

833

426

created: datetime.datetime(); (UTC) object creation

834

427

client_structure: Object describing what attributes a client has

835

428

and is used for storing the client at exit

836

429

current_checker_command: string; current running checker_command

837

disable_initiator_tag: a GLib event source tag, or None

430

disable_initiator_tag: a gobject event source tag, or None

838

431

enabled: bool()

839

432

fingerprint: string (40 or 32 hexadecimal digits); used to

840

uniquely identify an OpenPGP client

841

key_id: string (64 hexadecimal digits); used to uniquely identify

842

a client using raw public keys

433

uniquely identify the client

843

434

host: string; available for use by the checker command

844

435

interval: datetime.timedelta(); How often to start a new checker

845

436

last_approval_request: datetime.datetime(); (UTC) or None

847

438

last_checker_status: integer between 0 and 255 reflecting exit

848

439

status of last checker. -1 reflects crashed

849

440

checker, -2 means no checker completed yet.

850

last_checker_signal: The signal which killed the last checker, if

851

last_checker_status is -1

852

441

last_enabled: datetime.datetime(); (UTC) or None

853

442

name: string; from the config file, used in log messages and

854

443

D-Bus identifiers

861

450

disabled, or None

862

451

server_settings: The server_settings dict from main()

863

452

"""

864

453

865

454

runtime_expansions = ("approval_delay", "approval_duration",

866

"created", "enabled", "expires", "key_id",

455

"created", "enabled", "expires",

867

456

"fingerprint", "host", "interval",

868

457

"last_approval_request", "last_checked_ok",

869

458

"last_enabled", "name", "timeout")

870

client_defaults = {

871

"timeout": "PT5M",

872

"extended_timeout": "PT15M",

873

"interval": "PT2M",

874

"checker": "fping -q -- %%(host)s",

875

"host": "",

876

"approval_delay": "PT0S",

877

"approval_duration": "PT1S",

878

"approved_by_default": "True",

879

"enabled": "True",

880

}

881

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

469

470

def timeout_milliseconds(self):

471

"Return the 'timeout' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.timeout)

473

474

def extended_timeout_milliseconds(self):

475

"Return the 'extended_timeout' attribute in milliseconds"

476

return timedelta_to_milliseconds(self.extended_timeout)

477

478

def interval_milliseconds(self):

479

"Return the 'interval' attribute in milliseconds"

480

return timedelta_to_milliseconds(self.interval)

481

482

def approval_delay_milliseconds(self):

483

return timedelta_to_milliseconds(self.approval_delay)

484

882

485

@staticmethod

883

486

def config_parser(config):

884

487

"""Construct a new dict of client settings of this form:

891

494

for client_name in config.sections():

892

495

section = dict(config.items(client_name))

893

496

client = settings[client_name] = {}

894

497

895

498

client["host"] = section["host"]

896

499

# Reformat values from string types to Python types

897

500

client["approved_by_default"] = config.getboolean(

898

501

client_name, "approved_by_default")

899

502

client["enabled"] = config.getboolean(client_name,

900

503

"enabled")

901

902

# Uppercase and remove spaces from key_id and fingerprint

903

# for later comparison purposes with return value from the

904

# key_id() and fingerprint() functions

905

client["key_id"] = (section.get("key_id", "").upper()

906

.replace(" ", ""))

504

907

505

client["fingerprint"] = (section["fingerprint"].upper()

908

506

.replace(" ", ""))

909

507

if "secret" in section:

910

client["secret"] = codecs.decode(section["secret"]

911

.encode("utf-8"),

912

"base64")

508

client["secret"] = section["secret"].decode("base64")

913

509

elif "secfile" in section:

914

510

with open(os.path.expanduser(os.path.expandvars

915

511

(section["secfile"])),

916

512

"rb") as secfile:

917

513

client["secret"] = secfile.read()

918

514

else:

919

raise TypeError("No secret or secfile for section {}"

515

raise TypeError("No secret or secfile for section {0}"

920

516

.format(section))

921

517

client["timeout"] = string_to_delta(section["timeout"])

922

518

client["extended_timeout"] = string_to_delta(

930

526

client["last_approval_request"] = None

931

527

client["last_checked_ok"] = None

932

528

client["last_checker_status"] = -2

933

529

934

530

return settings

935

936

def __init__(self, settings, name=None, server_settings=None):

531

532

def __init__(self, settings, name = None, server_settings=None):

937

533

self.name = name

938

534

if server_settings is None:

939

535

server_settings = {}

940

536

self.server_settings = server_settings

941

537

# adding all client settings

942

for setting, value in settings.items():

538

for setting, value in settings.iteritems():

943

539

setattr(self, setting, value)

944

540

945

541

if self.enabled:

946

542

if not hasattr(self, "last_enabled"):

947

543

self.last_enabled = datetime.datetime.utcnow()

951

547

else:

952

548

self.last_enabled = None

953

549

self.expires = None

954

550

955

551

logger.debug("Creating client %r", self.name)

956

logger.debug(" Key ID: %s", self.key_id)

552

# Uppercase and remove spaces from fingerprint for later

553

# comparison purposes with return value from the fingerprint()

554

# function

957

555

logger.debug(" Fingerprint: %s", self.fingerprint)

958

556

self.created = settings.get("created",

959

557

datetime.datetime.utcnow())

960

558

961

559

# attributes specific for this server instance

962

560

self.checker = None

963

561

self.checker_initiator_tag = None

966

564

self.current_checker_command = None

967

565

self.approved = None

968

566

self.approvals_pending = 0

969

self.changedstate = multiprocessing_manager.Condition(

970

multiprocessing_manager.Lock())

971

self.client_structure = [attr

972

for attr in self.__dict__.keys()

567

self.changedstate = (multiprocessing_manager

568

.Condition(multiprocessing_manager

569

.Lock()))

570

self.client_structure = [attr for attr in

571

self.__dict__.iterkeys()

973

572

if not attr.startswith("_")]

974

573

self.client_structure.append("client_structure")

975

976

for name, t in inspect.getmembers(

977

type(self), lambda obj: isinstance(obj, property)):

574

575

for name, t in inspect.getmembers(type(self),

576

lambda obj:

577

isinstance(obj,

578

property)):

978

579

if not name.startswith("_"):

979

580

self.client_structure.append(name)

980

581

981

582

# Send notice to process children that client state has changed

982

583

def send_changedstate(self):

983

584

with self.changedstate:

984

585

self.changedstate.notify_all()

985

586

986

587

def enable(self):

987

588

"""Start this client's checker and timeout hooks"""

988

589

if getattr(self, "enabled", False):

993

594

self.last_enabled = datetime.datetime.utcnow()

994

595

self.init_checker()

995

596

self.send_changedstate()

996

597

997

598

def disable(self, quiet=True):

998

599

"""Disable this client."""

999

600

if not getattr(self, "enabled", False):

1001

602

if not quiet:

1002

603

logger.info("Disabling client %s", self.name)

1003

604

if getattr(self, "disable_initiator_tag", None) is not None:

1004

GLib.source_remove(self.disable_initiator_tag)

605

gobject.source_remove(self.disable_initiator_tag)

1005

606

self.disable_initiator_tag = None

1006

607

self.expires = None

1007

608

if getattr(self, "checker_initiator_tag", None) is not None:

1008

GLib.source_remove(self.checker_initiator_tag)

609

gobject.source_remove(self.checker_initiator_tag)

1009

610

self.checker_initiator_tag = None

1010

611

self.stop_checker()

1011

612

self.enabled = False

1012

613

if not quiet:

1013

614

self.send_changedstate()

1014

# Do not run this again if called by a GLib.timeout_add

615

# Do not run this again if called by a gobject.timeout_add

1015

616

return False

1016

617

1017

618

def __del__(self):

1018

619

self.disable()

1019

620

1020

621

def init_checker(self):

1021

622

# Schedule a new checker to be started an 'interval' from now,

1022

623

# and every interval from then on.

1023

624

if self.checker_initiator_tag is not None:

1024

GLib.source_remove(self.checker_initiator_tag)

1025

self.checker_initiator_tag = GLib.timeout_add(

1026

int(self.interval.total_seconds() * 1000),

1027

self.start_checker)

625

gobject.source_remove(self.checker_initiator_tag)

626

self.checker_initiator_tag = (gobject.timeout_add

627

(self.interval_milliseconds(),

628

self.start_checker))

1028

629

# Schedule a disable() when 'timeout' has passed

1029

630

if self.disable_initiator_tag is not None:

1030

GLib.source_remove(self.disable_initiator_tag)

1031

self.disable_initiator_tag = GLib.timeout_add(

1032

int(self.timeout.total_seconds() * 1000), self.disable)

631

gobject.source_remove(self.disable_initiator_tag)

632

self.disable_initiator_tag = (gobject.timeout_add

633

(self.timeout_milliseconds(),

634

self.disable))

1033

635

# Also start a new checker *right now*.

1034

636

self.start_checker()

1035

1036

def checker_callback(self, source, condition, connection,

1037

command):

637

638

def checker_callback(self, pid, condition, command):

1038

639

"""The checker has completed, so take appropriate actions."""

1039

# Read return code from connection (see call_pipe)

1040

returncode = connection.recv()

1041

connection.close()

1042

self.checker.join()

1043

640

self.checker_callback_tag = None

1044

641

self.checker = None

1045

1046

if returncode >= 0:

1047

self.last_checker_status = returncode

1048

self.last_checker_signal = None

642

if os.WIFEXITED(condition):

643

self.last_checker_status = os.WEXITSTATUS(condition)

1049

644

if self.last_checker_status == 0:

1050

645

logger.info("Checker for %(name)s succeeded",

1051

646

vars(self))

1052

647

self.checked_ok()

1053

648

else:

1054

logger.info("Checker for %(name)s failed", vars(self))

649

logger.info("Checker for %(name)s failed",

650

vars(self))

1055

651

else:

1056

652

self.last_checker_status = -1

1057

self.last_checker_signal = -returncode

1058

653

logger.warning("Checker for %(name)s crashed?",

1059

654

vars(self))

1060

return False

1061

655

1062

656

def checked_ok(self):

1063

657

"""Assert that the client has been seen, alive and well."""

1064

658

self.last_checked_ok = datetime.datetime.utcnow()

1065

659

self.last_checker_status = 0

1066

self.last_checker_signal = None

1067

660

self.bump_timeout()

1068

661

1069

662

def bump_timeout(self, timeout=None):

1070

663

"""Bump up the timeout for this client."""

1071

664

if timeout is None:

1072

665

timeout = self.timeout

1073

666

if self.disable_initiator_tag is not None:

1074

GLib.source_remove(self.disable_initiator_tag)

667

gobject.source_remove(self.disable_initiator_tag)

1075

668

self.disable_initiator_tag = None

1076

669

if getattr(self, "enabled", False):

1077

self.disable_initiator_tag = GLib.timeout_add(

1078

int(timeout.total_seconds() * 1000), self.disable)

670

self.disable_initiator_tag = (gobject.timeout_add

671

(timedelta_to_milliseconds

672

(timeout), self.disable))

1079

673

self.expires = datetime.datetime.utcnow() + timeout

1080

674

1081

675

def need_approval(self):

1082

676

self.last_approval_request = datetime.datetime.utcnow()

1083

677

1084

678

def start_checker(self):

1085

679

"""Start a new checker subprocess if one is not running.

1086

680

1087

681

If a checker already exists, leave it running and do

1088

682

nothing."""

1089

683

# The reason for not killing a running checker is that if we

1094

688

# checkers alone, the checker would have to take more time

1095

689

# than 'timeout' for the client to be disabled, which is as it

1096

690

# should be.

1097

1098

if self.checker is not None and not self.checker.is_alive():

1099

logger.warning("Checker was not alive; joining")

1100

self.checker.join()

1101

self.checker = None

691

692

# If a checker exists, make sure it is not a zombie

693

try:

694

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

695

except AttributeError:

696

pass

697

except OSError as error:

698

if error.errno != errno.ECHILD:

699

raise

700

else:

701

if pid:

702

logger.warning("Checker was a zombie")

703

gobject.source_remove(self.checker_callback_tag)

704

self.checker_callback(pid, status,

705

self.current_checker_command)

1102

706

# Start a new checker if needed

1103

707

if self.checker is None:

1104

708

# Escape attributes for the shell

1105

escaped_attrs = {

1106

attr: re.escape(str(getattr(self, attr)))

1107

for attr in self.runtime_expansions}

709

escaped_attrs = dict(

710

(attr, re.escape(unicode(getattr(self, attr))))

711

for attr in

712

self.runtime_expansions)

1108

713

try:

1109

714

command = self.checker_command % escaped_attrs

1110

715

except TypeError as error:

1111

716

logger.error('Could not format string "%s"',

1112

self.checker_command,

717

self.checker_command, exc_info=error)

718

return True # Try again later

719

self.current_checker_command = command

720

try:

721

logger.info("Starting checker %r for %s",

722

command, self.name)

723

# We don't need to redirect stdout and stderr, since

724

# in normal mode, that is already done by daemon(),

725

# and in debug mode we don't want to. (Stdin is

726

# always replaced by /dev/null.)

727

# The exception is when not debugging but nevertheless

728

# running in the foreground; use the previously

729

# created wnull.

730

popen_args = {}

731

if (not self.server_settings["debug"]

732

and self.server_settings["foreground"]):

733

popen_args.update({"stdout": wnull,

734

"stderr": wnull })

735

self.checker = subprocess.Popen(command,

736

close_fds=True,

737

shell=True, cwd="/",

738

**popen_args)

739

except OSError as error:

740

logger.error("Failed to start subprocess",

1113

741

exc_info=error)

1114

return True # Try again later

1115

self.current_checker_command = command

1116

logger.info("Starting checker %r for %s", command,

1117

self.name)

1118

# We don't need to redirect stdout and stderr, since

1119

# in normal mode, that is already done by daemon(),

1120

# and in debug mode we don't want to. (Stdin is

1121

# always replaced by /dev/null.)

1122

# The exception is when not debugging but nevertheless

1123

# running in the foreground; use the previously

1124

# created wnull.

1125

popen_args = {"close_fds": True,

1126

"shell": True,

1127

"cwd": "/"}

1128

if (not self.server_settings["debug"]

1129

and self.server_settings["foreground"]):

1130

popen_args.update({"stdout": wnull,

1131

"stderr": wnull})

1132

pipe = multiprocessing.Pipe(duplex=False)

1133

self.checker = multiprocessing.Process(

1134

target=call_pipe,

1135

args=(pipe[1], subprocess.call, command),

1136

kwargs=popen_args)

1137

self.checker.start()

1138

self.checker_callback_tag = GLib.io_add_watch(

1139

pipe[0].fileno(), GLib.IO_IN,

1140

self.checker_callback, pipe[0], command)

1141

# Re-run this periodically if run by GLib.timeout_add

742

return True

743

self.checker_callback_tag = (gobject.child_watch_add

744

(self.checker.pid,

745

self.checker_callback,

746

data=command))

747

# The checker may have completed before the gobject

748

# watch was added. Check for this.

749

try:

750

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

751

except OSError as error:

752

if error.errno == errno.ECHILD:

753

# This should never happen

754

logger.error("Child process vanished",

755

exc_info=error)

756

return True

757

raise

758

if pid:

759

gobject.source_remove(self.checker_callback_tag)

760

self.checker_callback(pid, status, command)

761

# Re-run this periodically if run by gobject.timeout_add

1142

762

return True

1143

763

1144

764

def stop_checker(self):

1145

765

"""Force the checker process, if any, to stop."""

1146

766

if self.checker_callback_tag:

1147

GLib.source_remove(self.checker_callback_tag)

767

gobject.source_remove(self.checker_callback_tag)

1148

768

self.checker_callback_tag = None

1149

769

if getattr(self, "checker", None) is None:

1150

770

return

1151

771

logger.debug("Stopping checker for %(name)s", vars(self))

1152

self.checker.terminate()

772

try:

773

self.checker.terminate()

774

#time.sleep(0.5)

775

#if self.checker.poll() is None:

776

# self.checker.kill()

777

except OSError as error:

778

if error.errno != errno.ESRCH: # No such process

779

raise

1153

780

self.checker = None

1154

781

1155

782

1156

def dbus_service_property(dbus_interface,

1157

signature="v",

1158

access="readwrite",

1159

byte_arrays=False):

783

def dbus_service_property(dbus_interface, signature="v",

784

access="readwrite", byte_arrays=False):

1160

785

"""Decorators for marking methods of a DBusObjectWithProperties to

1161

786

become properties on the D-Bus.

1162

787

1163

788

The decorated method will be called with no arguments by "Get"

1164

789

and with one argument by "Set".

1165

790

1166

791

The parameters, where they are supported, are the same as

1167

792

dbus.service.method, except there is only "signature", since the

1168

793

type from Get() and the type sent to Set() is the same.

1171

796

# "Set" method, so we fail early here:

1172

797

if byte_arrays and signature != "ay":

1173

798

raise ValueError("Byte arrays not supported for non-'ay'"

1174

" signature {!r}".format(signature))

1175

799

" signature {0!r}".format(signature))

1176

800

def decorator(func):

1177

801

func._dbus_is_property = True

1178

802

func._dbus_interface = dbus_interface

1181

805

func._dbus_name = func.__name__

1182

806

if func._dbus_name.endswith("_dbus_property"):

1183

807

func._dbus_name = func._dbus_name[:-14]

1184

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

808

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1185

809

return func

1186

1187

810

return decorator

1188

811

1189

812

1190

813

def dbus_interface_annotations(dbus_interface):

1191

814

"""Decorator for marking functions returning interface annotations

1192

815

1193

816

Usage:

1194

817

1195

818

@dbus_interface_annotations("org.example.Interface")

1196

819

def _foo(self): # Function name does not matter

1197

820

return {"org.freedesktop.DBus.Deprecated": "true",

1198

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1199

822

"false"}

1200

823

"""

1201

1202

824

def decorator(func):

1203

825

func._dbus_is_interface = True

1204

826

func._dbus_interface = dbus_interface

1205

827

func._dbus_name = dbus_interface

1206

828

return func

1207

1208

829

return decorator

1209

830

1210

831

1211

832

def dbus_annotations(annotations):

1212

833

"""Decorator to annotate D-Bus methods, signals or properties

1213

834

Usage:

1214

1215

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1216

"org.freedesktop.DBus.Property."

1217

"EmitsChangedSignal": "false"})

835

1218

836

@dbus_service_property("org.example.Interface", signature="b",

1219

837

access="r")

838

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

1220

841

def Property_dbus_property(self):

1221

842

return dbus.Boolean(False)

1222

1223

See also the DBusObjectWithAnnotations class.

1224

843

"""

1225

1226

844

def decorator(func):

1227

845

func._dbus_annotations = annotations

1228

846

return func

1229

1230

847

return decorator

1231

848

1232

849

1233

850

class DBusPropertyException(dbus.exceptions.DBusException):

1234

851

"""A base class for D-Bus property-related exceptions

1235

852

"""

1236

pass

853

def __unicode__(self):

854

return unicode(str(self))

1237

855

1238

856

1239

857

class DBusPropertyAccessException(DBusPropertyException):

1248

866

pass

1249

867

1250

868

1251

class DBusObjectWithAnnotations(dbus.service.Object):

1252

"""A D-Bus object with annotations.

1253

1254

Classes inheriting from this can use the dbus_annotations

1255

decorator to add annotations to methods or signals.

869

class DBusObjectWithProperties(dbus.service.Object):

870

"""A D-Bus object with properties.

871

872

Classes inheriting from this can use the dbus_service_property

873

decorator to expose methods as D-Bus properties. It exposes the

874

standard Get(), Set(), and GetAll() methods on the D-Bus.

1256

875

"""

1257

876

1258

877

@staticmethod

1259

878

def _is_dbus_thing(thing):

1260

879

"""Returns a function testing if an attribute is a D-Bus thing

1261

880

1262

881

If called like _is_dbus_thing("method") it returns a function

1263

882

suitable for use as predicate to inspect.getmembers().

1264

883

"""

1265

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

884

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1266

885

False)

1267

886

1268

887

def _get_all_dbus_things(self, thing):

1269

888

"""Returns a generator of (name, attribute) pairs

1270

889

"""

1271

return ((getattr(athing.__get__(self), "_dbus_name", name),

890

return ((getattr(athing.__get__(self), "_dbus_name",

891

name),

1272

892

athing.__get__(self))

1273

893

for cls in self.__class__.__mro__

1274

894

for name, athing in

1275

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1276

1277

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1278

out_signature="s",

1279

path_keyword='object_path',

1280

connection_keyword='connection')

1281

def Introspect(self, object_path, connection):

1282

"""Overloading of standard D-Bus method.

1283

1284

Inserts annotation tags on methods and signals.

1285

"""

1286

xmlstring = dbus.service.Object.Introspect(self, object_path,

1287

connection)

1288

try:

1289

document = xml.dom.minidom.parseString(xmlstring)

1290

1291

for if_tag in document.getElementsByTagName("interface"):

1292

# Add annotation tags

1293

for typ in ("method", "signal"):

1294

for tag in if_tag.getElementsByTagName(typ):

1295

annots = dict()

1296

for name, prop in (self.

1297

_get_all_dbus_things(typ)):

1298

if (name == tag.getAttribute("name")

1299

and prop._dbus_interface

1300

== if_tag.getAttribute("name")):

1301

annots.update(getattr(

1302

prop, "_dbus_annotations", {}))

1303

for name, value in annots.items():

1304

ann_tag = document.createElement(

1305

"annotation")

1306

ann_tag.setAttribute("name", name)

1307

ann_tag.setAttribute("value", value)

1308

tag.appendChild(ann_tag)

1309

# Add interface annotation tags

1310

for annotation, value in dict(

1311

itertools.chain.from_iterable(

1312

annotations().items()

1313

for name, annotations

1314

in self._get_all_dbus_things("interface")

1315

if name == if_tag.getAttribute("name")

1316

)).items():

1317

ann_tag = document.createElement("annotation")

1318

ann_tag.setAttribute("name", annotation)

1319

ann_tag.setAttribute("value", value)

1320

if_tag.appendChild(ann_tag)

1321

# Fix argument name for the Introspect method itself

1322

if (if_tag.getAttribute("name")

1323

== dbus.INTROSPECTABLE_IFACE):

1324

for cn in if_tag.getElementsByTagName("method"):

1325

if cn.getAttribute("name") == "Introspect":

1326

for arg in cn.getElementsByTagName("arg"):

1327

if (arg.getAttribute("direction")

1328

== "out"):

1329

arg.setAttribute("name",

1330

"xml_data")

1331

xmlstring = document.toxml("utf-8")

1332

document.unlink()

1333

except (AttributeError, xml.dom.DOMException,

1334

xml.parsers.expat.ExpatError) as error:

1335

logger.error("Failed to override Introspection method",

1336

exc_info=error)

1337

return xmlstring

1338

1339

1340

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1341

"""A D-Bus object with properties.

1342

1343

Classes inheriting from this can use the dbus_service_property

1344

decorator to expose methods as D-Bus properties. It exposes the

1345

standard Get(), Set(), and GetAll() methods on the D-Bus.

1346

"""

1347

895

inspect.getmembers(cls,

896

self._is_dbus_thing(thing)))

897

1348

898

def _get_dbus_property(self, interface_name, property_name):

1349

899

"""Returns a bound method if one exists which is a D-Bus

1350

900

property with the specified name and interface.

1351

901

"""

1352

for cls in self.__class__.__mro__:

1353

for name, value in inspect.getmembers(

1354

cls, self._is_dbus_thing("property")):

902

for cls in self.__class__.__mro__:

903

for name, value in (inspect.getmembers

904

(cls,

905

self._is_dbus_thing("property"))):

1355

906

if (value._dbus_name == property_name

1356

907

and value._dbus_interface == interface_name):

1357

908

return value.__get__(self)

1358

909

1359

910

# No such property

1360

raise DBusPropertyNotFound("{}:{}.{}".format(

1361

self.dbus_object_path, interface_name, property_name))

1362

1363

@classmethod

1364

def _get_all_interface_names(cls):

1365

"""Get a sequence of all interfaces supported by an object"""

1366

return (name for name in set(getattr(getattr(x, attr),

1367

"_dbus_interface", None)

1368

for x in (inspect.getmro(cls))

1369

for attr in dir(x))

1370

if name is not None)

1371

1372

@dbus.service.method(dbus.PROPERTIES_IFACE,

1373

in_signature="ss",

911

raise DBusPropertyNotFound(self.dbus_object_path + ":"

912

+ interface_name + "."

913

+ property_name)

914

915

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1374

916

out_signature="v")

1375

917

def Get(self, interface_name, property_name):

1376

918

"""Standard D-Bus property Get() method, see D-Bus standard.

1382

924

if not hasattr(value, "variant_level"):

1383

925

return value

1384

926

return type(value)(value, variant_level=value.variant_level+1)

1385

927

1386

928

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1387

929

def Set(self, interface_name, property_name, value):

1388

930

"""Standard D-Bus property Set() method, see D-Bus standard.

1395

937

# signatures other than "ay".

1396

938

if prop._dbus_signature != "ay":

1397

939

raise ValueError("Byte arrays not supported for non-"

1398

"'ay' signature {!r}"

940

"'ay' signature {0!r}"

1399

941

.format(prop._dbus_signature))

1400

942

value = dbus.ByteArray(b''.join(chr(byte)

1401

943

for byte in value))

1402

944

prop(value)

1403

1404

@dbus.service.method(dbus.PROPERTIES_IFACE,

1405

in_signature="s",

945

946

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1406

947

out_signature="a{sv}")

1407

948

def GetAll(self, interface_name):

1408

949

"""Standard D-Bus property GetAll() method, see D-Bus

1409

950

standard.

1410

951

1411

952

Note: Will not include properties with access="write".

1412

953

"""

1413

954

properties = {}

1423

964

if not hasattr(value, "variant_level"):

1424

965

properties[name] = value

1425

966

continue

1426

properties[name] = type(value)(

1427

value, variant_level=value.variant_level + 1)

967

properties[name] = type(value)(value, variant_level=

968

value.variant_level+1)

1428

969

return dbus.Dictionary(properties, signature="sv")

1429

1430

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1431

def PropertiesChanged(self, interface_name, changed_properties,

1432

invalidated_properties):

1433

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1434

standard.

1435

"""

1436

pass

1437

970

1438

971

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1439

972

out_signature="s",

1440

973

path_keyword='object_path',

1441

974

connection_keyword='connection')

1442

975

def Introspect(self, object_path, connection):

1443

976

"""Overloading of standard D-Bus method.

1444

977

1445

978

Inserts property tags and interface annotation tags.

1446

979

"""

1447

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1448

object_path,

1449

connection)

980

xmlstring = dbus.service.Object.Introspect(self, object_path,

981

connection)

1450

982

try:

1451

983

document = xml.dom.minidom.parseString(xmlstring)

1452

1453

984

def make_tag(document, name, prop):

1454

985

e = document.createElement("property")

1455

986

e.setAttribute("name", name)

1456

987

e.setAttribute("type", prop._dbus_signature)

1457

988

e.setAttribute("access", prop._dbus_access)

1458

989

return e

1459

1460

990

for if_tag in document.getElementsByTagName("interface"):

1461

991

# Add property tags

1462

992

for tag in (make_tag(document, name, prop)

1465

995

if prop._dbus_interface

1466

996

== if_tag.getAttribute("name")):

1467

997

if_tag.appendChild(tag)

1468

# Add annotation tags for properties

1469

for tag in if_tag.getElementsByTagName("property"):

1470

annots = dict()

1471

for name, prop in self._get_all_dbus_things(

1472

"property"):

1473

if (name == tag.getAttribute("name")

1474

and prop._dbus_interface

1475

== if_tag.getAttribute("name")):

1476

annots.update(getattr(

1477

prop, "_dbus_annotations", {}))

1478

for name, value in annots.items():

1479

ann_tag = document.createElement(

1480

"annotation")

1481

ann_tag.setAttribute("name", name)

1482

ann_tag.setAttribute("value", value)

1483

tag.appendChild(ann_tag)

998

# Add annotation tags

999

for typ in ("method", "signal", "property"):

1000

for tag in if_tag.getElementsByTagName(typ):

1001

annots = dict()

1002

for name, prop in (self.

1003

_get_all_dbus_things(typ)):

1004

if (name == tag.getAttribute("name")

1005

and prop._dbus_interface

1006

== if_tag.getAttribute("name")):

1007

annots.update(getattr

1008

(prop,

1009

"_dbus_annotations",

1010

{}))

1011

for name, value in annots.iteritems():

1012

ann_tag = document.createElement(

1013

"annotation")

1014

ann_tag.setAttribute("name", name)

1015

ann_tag.setAttribute("value", value)

1016

tag.appendChild(ann_tag)

1017

# Add interface annotation tags

1018

for annotation, value in dict(

1019

itertools.chain.from_iterable(

1020

annotations().iteritems()

1021

for name, annotations in

1022

self._get_all_dbus_things("interface")

1023

if name == if_tag.getAttribute("name")

1024

)).iteritems():

1025

ann_tag = document.createElement("annotation")

1026

ann_tag.setAttribute("name", annotation)

1027

ann_tag.setAttribute("value", value)

1028

if_tag.appendChild(ann_tag)

1484

1029

# Add the names to the return values for the

1485

1030

# "org.freedesktop.DBus.Properties" methods

1486

1031

if (if_tag.getAttribute("name")

1505

1050

return xmlstring

1506

1051

1507

1052

1508

try:

1509

dbus.OBJECT_MANAGER_IFACE

1510

except AttributeError:

1511

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1512

1513

1514

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1515

"""A D-Bus object with an ObjectManager.

1516

1517

Classes inheriting from this exposes the standard

1518

GetManagedObjects call and the InterfacesAdded and

1519

InterfacesRemoved signals on the standard

1520

"org.freedesktop.DBus.ObjectManager" interface.

1521

1522

Note: No signals are sent automatically; they must be sent

1523

manually.

1524

"""

1525

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1526

out_signature="a{oa{sa{sv}}}")

1527

def GetManagedObjects(self):

1528

"""This function must be overridden"""

1529

raise NotImplementedError()

1530

1531

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1532

signature="oa{sa{sv}}")

1533

def InterfacesAdded(self, object_path, interfaces_and_properties):

1534

pass

1535

1536

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1537

def InterfacesRemoved(self, object_path, interfaces):

1538

pass

1539

1540

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1541

out_signature="s",

1542

path_keyword='object_path',

1543

connection_keyword='connection')

1544

def Introspect(self, object_path, connection):

1545

"""Overloading of standard D-Bus method.

1546

1547

Override return argument name of GetManagedObjects to be

1548

"objpath_interfaces_and_properties"

1549

"""

1550

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1551

object_path,

1552

connection)

1553

try:

1554

document = xml.dom.minidom.parseString(xmlstring)

1555

1556

for if_tag in document.getElementsByTagName("interface"):

1557

# Fix argument name for the GetManagedObjects method

1558

if (if_tag.getAttribute("name")

1559

== dbus.OBJECT_MANAGER_IFACE):

1560

for cn in if_tag.getElementsByTagName("method"):

1561

if (cn.getAttribute("name")

1562

== "GetManagedObjects"):

1563

for arg in cn.getElementsByTagName("arg"):

1564

if (arg.getAttribute("direction")

1565

== "out"):

1566

arg.setAttribute(

1567

"name",

1568

"objpath_interfaces"

1569

"_and_properties")

1570

xmlstring = document.toxml("utf-8")

1571

document.unlink()

1572

except (AttributeError, xml.dom.DOMException,

1573

xml.parsers.expat.ExpatError) as error:

1574

logger.error("Failed to override Introspection method",

1575

exc_info=error)

1576

return xmlstring

1577

1578

1579

1053

def datetime_to_dbus(dt, variant_level=0):

1580

1054

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1581

1055

if dt is None:

1582

return dbus.String("", variant_level=variant_level)

1583

return dbus.String(dt.isoformat(), variant_level=variant_level)

1056

return dbus.String("", variant_level = variant_level)

1057

return dbus.String(dt.isoformat(),

1058

variant_level=variant_level)

1584

1059

1585

1060

1586

1061

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1588

1063

dbus.service.Object, it will add alternate D-Bus attributes with

1589

1064

interface names according to the "alt_interface_names" mapping.

1590

1065

Usage:

1591

1066

1592

1067

@alternate_dbus_interfaces({"org.example.Interface":

1593

1068

"net.example.AlternateInterface"})

1594

1069

class SampleDBusObject(dbus.service.Object):

1595

1070

@dbus.service.method("org.example.Interface")

1596

1071

def SampleDBusMethod():

1597

1072

pass

1598

1073

1599

1074

The above "SampleDBusMethod" on "SampleDBusObject" will be

1600

1075

reachable via two interfaces: "org.example.Interface" and

1601

1076

"net.example.AlternateInterface", the latter of which will have

1602

1077

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1603

1078

"true", unless "deprecate" is passed with a False value.

1604

1079

1605

1080

This works for methods and signals, and also for D-Bus properties

1606

1081

(from DBusObjectWithProperties) and interfaces (from the

1607

1082

dbus_interface_annotations decorator).

1608

1083

"""

1609

1610

1084

def wrapper(cls):

1611

1085

for orig_interface_name, alt_interface_name in (

1612

alt_interface_names.items()):

1086

alt_interface_names.iteritems()):

1613

1087

attr = {}

1614

1088

interface_names = set()

1615

1089

# Go though all attributes of the class

1617

1091

# Ignore non-D-Bus attributes, and D-Bus attributes

1618

1092

# with the wrong interface name

1619

1093

if (not hasattr(attribute, "_dbus_interface")

1620

or not attribute._dbus_interface.startswith(

1621

orig_interface_name)):

1094

or not attribute._dbus_interface

1095

.startswith(orig_interface_name)):

1622

1096

continue

1623

1097

# Create an alternate D-Bus interface name based on

1624

1098

# the current name

1625

alt_interface = attribute._dbus_interface.replace(

1626

orig_interface_name, alt_interface_name)

1099

alt_interface = (attribute._dbus_interface

1100

.replace(orig_interface_name,

1101

alt_interface_name))

1627

1102

interface_names.add(alt_interface)

1628

1103

# Is this a D-Bus signal?

1629

1104

if getattr(attribute, "_dbus_is_signal", False):

1630

1105

# Extract the original non-method undecorated

1631

1106

# function by black magic

1632

if sys.version_info.major == 2:

1633

nonmethod_func = (dict(

1107

nonmethod_func = (dict(

1634

1108

zip(attribute.func_code.co_freevars,

1635

attribute.__closure__))

1636

["func"].cell_contents)

1637

else:

1638

nonmethod_func = (dict(

1639

zip(attribute.__code__.co_freevars,

1640

attribute.__closure__))

1641

["func"].cell_contents)

1109

attribute.__closure__))["func"]

1110

.cell_contents)

1642

1111

# Create a new, but exactly alike, function

1643

1112

# object, and decorate it to be a new D-Bus signal

1644

1113

# with the alternate D-Bus interface name

1645

new_function = copy_function(nonmethod_func)

1646

new_function = (dbus.service.signal(

1647

alt_interface,

1648

attribute._dbus_signature)(new_function))

1114

new_function = (dbus.service.signal

1115

(alt_interface,

1116

attribute._dbus_signature)

1117

(types.FunctionType(

1118

nonmethod_func.func_code,

1119

nonmethod_func.func_globals,

1120

nonmethod_func.func_name,

1121

nonmethod_func.func_defaults,

1122

nonmethod_func.func_closure)))

1649

1123

# Copy annotations, if any

1650

1124

try:

1651

new_function._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1125

new_function._dbus_annotations = (

1126

dict(attribute._dbus_annotations))

1653

1127

except AttributeError:

1654

1128

pass

1655

1656

1129

# Define a creator of a function to call both the

1657

1130

# original and alternate functions, so both the

1658

1131

# original and alternate signals gets sent when

1661

1134

"""This function is a scope container to pass

1662

1135

func1 and func2 to the "call_both" function

1663

1136

outside of its arguments"""

1664

1665

@functools.wraps(func2)

1666

1137

def call_both(*args, **kwargs):

1667

1138

"""This function will emit two D-Bus

1668

1139

signals by calling func1 and func2"""

1669

1140

func1(*args, **kwargs)

1670

1141

func2(*args, **kwargs)

1671

# Make wrapper function look like a D-Bus

1672

# signal

1673

for name, attr in inspect.getmembers(func2):

1674

if name.startswith("_dbus_"):

1675

setattr(call_both, name, attr)

1676

1677

1142

return call_both

1678

1143

# Create the "call_both" function and add it to

1679

1144

# the class

1684

1149

# object. Decorate it to be a new D-Bus method

1685

1150

# with the alternate D-Bus interface name. Add it

1686

1151

# to the class.

1687

attr[attrname] = (

1688

dbus.service.method(

1689

alt_interface,

1690

attribute._dbus_in_signature,

1691

attribute._dbus_out_signature)

1692

(copy_function(attribute)))

1152

attr[attrname] = (dbus.service.method

1153

(alt_interface,

1154

attribute._dbus_in_signature,

1155

attribute._dbus_out_signature)

1156

(types.FunctionType

1157

(attribute.func_code,

1158

attribute.func_globals,

1159

attribute.func_name,

1160

attribute.func_defaults,

1161

attribute.func_closure)))

1693

1162

# Copy annotations, if any

1694

1163

try:

1695

attr[attrname]._dbus_annotations = dict(

1696

attribute._dbus_annotations)

1164

attr[attrname]._dbus_annotations = (

1165

dict(attribute._dbus_annotations))

1697

1166

except AttributeError:

1698

1167

pass

1699

1168

# Is this a D-Bus property?

1702

1171

# object, and decorate it to be a new D-Bus

1703

1172

# property with the alternate D-Bus interface

1704

1173

# name. Add it to the class.

1705

attr[attrname] = (dbus_service_property(

1706

alt_interface, attribute._dbus_signature,

1707

attribute._dbus_access,

1708

attribute._dbus_get_args_options

1709

["byte_arrays"])

1710

(copy_function(attribute)))

1174

attr[attrname] = (dbus_service_property

1175

(alt_interface,

1176

attribute._dbus_signature,

1177

attribute._dbus_access,

1178

attribute

1179

._dbus_get_args_options

1180

["byte_arrays"])

1181

(types.FunctionType

1182

(attribute.func_code,

1183

attribute.func_globals,

1184

attribute.func_name,

1185

attribute.func_defaults,

1186

attribute.func_closure)))

1711

1187

# Copy annotations, if any

1712

1188

try:

1713

attr[attrname]._dbus_annotations = dict(

1714

attribute._dbus_annotations)

1189

attr[attrname]._dbus_annotations = (

1190

dict(attribute._dbus_annotations))

1715

1191

except AttributeError:

1716

1192

pass

1717

1193

# Is this a D-Bus interface?

1720

1196

# object. Decorate it to be a new D-Bus interface

1721

1197

# with the alternate D-Bus interface name. Add it

1722

1198

# to the class.

1723

attr[attrname] = (

1724

dbus_interface_annotations(alt_interface)

1725

(copy_function(attribute)))

1199

attr[attrname] = (dbus_interface_annotations

1200

(alt_interface)

1201

(types.FunctionType

1202

(attribute.func_code,

1203

attribute.func_globals,

1204

attribute.func_name,

1205

attribute.func_defaults,

1206

attribute.func_closure)))

1726

1207

if deprecate:

1727

1208

# Deprecate all alternate interfaces

1728

iname = "_AlternateDBusNames_interface_annotation{}"

1209

iname="_AlternateDBusNames_interface_annotation{0}"

1729

1210

for interface_name in interface_names:

1730

1731

1211

@dbus_interface_annotations(interface_name)

1732

1212

def func(self):

1733

return {"org.freedesktop.DBus.Deprecated":

1734

"true"}

1213

return { "org.freedesktop.DBus.Deprecated":

1214

"true" }

1735

1215

# Find an unused name

1736

1216

for aname in (iname.format(i)

1737

1217

for i in itertools.count()):

1741

1221

if interface_names:

1742

1222

# Replace the class with a new subclass of it with

1743

1223

# methods, signals, etc. as created above.

1744

if sys.version_info.major == 2:

1745

cls = type(b"{}Alternate".format(cls.__name__),

1746

(cls, ), attr)

1747

else:

1748

cls = type("{}Alternate".format(cls.__name__),

1749

(cls, ), attr)

1224

cls = type(b"{0}Alternate".format(cls.__name__),

1225

(cls,), attr)

1750

1226

return cls

1751

1752

1227

return wrapper

1753

1228

1754

1229

1755

1230

@alternate_dbus_interfaces({"se.recompile.Mandos":

1756

"se.bsnet.fukt.Mandos"})

1231

"se.bsnet.fukt.Mandos"})

1757

1232

class ClientDBus(Client, DBusObjectWithProperties):

1758

1233

"""A Client class using D-Bus

1759

1234

1760

1235

Attributes:

1761

1236

dbus_object_path: dbus.ObjectPath

1762

1237

bus: dbus.SystemBus()

1763

1238

"""

1764

1239

1765

1240

runtime_expansions = (Client.runtime_expansions

1766

+ ("dbus_object_path", ))

1767

1768

_interface = "se.recompile.Mandos.Client"

1769

1241

+ ("dbus_object_path",))

1242

1770

1243

# dbus.service.Object doesn't use super(), so we can't either.

1771

1772

def __init__(self, bus=None, *args, **kwargs):

1244

1245

def __init__(self, bus = None, *args, **kwargs):

1773

1246

self.bus = bus

1774

1247

Client.__init__(self, *args, **kwargs)

1775

1248

# Only now, when this client is initialized, can it show up on

1776

1249

# the D-Bus

1777

client_object_name = str(self.name).translate(

1250

client_object_name = unicode(self.name).translate(

1778

1251

{ord("."): ord("_"),

1779

1252

ord("-"): ord("_")})

1780

self.dbus_object_path = dbus.ObjectPath(

1781

"/clients/" + client_object_name)

1253

self.dbus_object_path = (dbus.ObjectPath

1254

("/clients/" + client_object_name))

1782

1255

DBusObjectWithProperties.__init__(self, self.bus,

1783

1256

self.dbus_object_path)

1784

1785

def notifychangeproperty(transform_func, dbus_name,

1786

type_func=lambda x: x,

1787

variant_level=1,

1788

invalidate_only=False,

1789

_interface=_interface):

1257

1258

def notifychangeproperty(transform_func,

1259

dbus_name, type_func=lambda x: x,

1260

variant_level=1):

1790

1261

""" Modify a variable so that it's a property which announces

1791

1262

its changes to DBus.

1792

1263

1793

1264

transform_fun: Function that takes a value and a variant_level

1794

1265

and transforms it to a D-Bus type.

1795

1266

dbus_name: D-Bus name of the variable

1797

1268

to the D-Bus. Default: no transform

1798

1269

variant_level: D-Bus variant level. Default: 1

1799

1270

"""

1800

attrname = "_{}".format(dbus_name)

1801

1271

attrname = "_{0}".format(dbus_name)

1802

1272

def setter(self, value):

1803

1273

if hasattr(self, "dbus_object_path"):

1804

1274

if (not hasattr(self, attrname) or

1805

1275

type_func(getattr(self, attrname, None))

1806

1276

!= type_func(value)):

1807

if invalidate_only:

1808

self.PropertiesChanged(

1809

_interface, dbus.Dictionary(),

1810

dbus.Array((dbus_name, )))

1811

else:

1812

dbus_value = transform_func(

1813

type_func(value),

1814

variant_level=variant_level)

1815

self.PropertyChanged(dbus.String(dbus_name),

1816

dbus_value)

1817

self.PropertiesChanged(

1818

_interface,

1819

dbus.Dictionary({dbus.String(dbus_name):

1820

dbus_value}),

1821

dbus.Array())

1277

dbus_value = transform_func(type_func(value),

1278

variant_level

1279

=variant_level)

1280

self.PropertyChanged(dbus.String(dbus_name),

1281

dbus_value)

1822

1282

setattr(self, attrname, value)

1823

1283

1824

1284

return property(lambda self: getattr(self, attrname), setter)

1825

1285

1826

1286

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1827

1287

approvals_pending = notifychangeproperty(dbus.Boolean,

1828

1288

"ApprovalPending",

1829

type_func=bool)

1289

type_func = bool)

1830

1290

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1831

1291

last_enabled = notifychangeproperty(datetime_to_dbus,

1832

1292

"LastEnabled")

1833

checker = notifychangeproperty(

1834

dbus.Boolean, "CheckerRunning",

1835

type_func=lambda checker: checker is not None)

1293

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1294

type_func = lambda checker:

1295

checker is not None)

1836

1296

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1837

1297

"LastCheckedOK")

1838

1298

last_checker_status = notifychangeproperty(dbus.Int16,

1841

1301

datetime_to_dbus, "LastApprovalRequest")

1842

1302

approved_by_default = notifychangeproperty(dbus.Boolean,

1843

1303

"ApprovedByDefault")

1844

approval_delay = notifychangeproperty(

1845

dbus.UInt64, "ApprovalDelay",

1846

type_func=lambda td: td.total_seconds() * 1000)

1304

approval_delay = notifychangeproperty(dbus.UInt64,

1305

"ApprovalDelay",

1306

type_func =

1307

timedelta_to_milliseconds)

1847

1308

approval_duration = notifychangeproperty(

1848

1309

dbus.UInt64, "ApprovalDuration",

1849

type_func=lambda td: td.total_seconds() * 1000)

1310

type_func = timedelta_to_milliseconds)

1850

1311

host = notifychangeproperty(dbus.String, "Host")

1851

timeout = notifychangeproperty(

1852

dbus.UInt64, "Timeout",

1853

type_func=lambda td: td.total_seconds() * 1000)

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func =

1314

timedelta_to_milliseconds)

1854

1315

extended_timeout = notifychangeproperty(

1855

1316

dbus.UInt64, "ExtendedTimeout",

1856

type_func=lambda td: td.total_seconds() * 1000)

1857

interval = notifychangeproperty(

1858

dbus.UInt64, "Interval",

1859

type_func=lambda td: td.total_seconds() * 1000)

1317

type_func = timedelta_to_milliseconds)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

timedelta_to_milliseconds)

1860

1322

checker_command = notifychangeproperty(dbus.String, "Checker")

1861

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1862

invalidate_only=True)

1863

1323

1864

1324

del notifychangeproperty

1865

1325

1866

1326

def __del__(self, *args, **kwargs):

1867

1327

try:

1868

1328

self.remove_from_connection()

1871

1331

if hasattr(DBusObjectWithProperties, "__del__"):

1872

1332

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1873

1333

Client.__del__(self, *args, **kwargs)

1874

1875

def checker_callback(self, source, condition,

1876

connection, command, *args, **kwargs):

1877

ret = Client.checker_callback(self, source, condition,

1878

connection, command, *args,

1879

**kwargs)

1880

exitstatus = self.last_checker_status

1881

if exitstatus >= 0:

1334

1335

def checker_callback(self, pid, condition, command,

1336

*args, **kwargs):

1337

self.checker_callback_tag = None

1338

self.checker = None

1339

if os.WIFEXITED(condition):

1340

exitstatus = os.WEXITSTATUS(condition)

1882

1341

# Emit D-Bus signal

1883

1342

self.CheckerCompleted(dbus.Int16(exitstatus),

1884

# This is specific to GNU libC

1885

dbus.Int64(exitstatus << 8),

1343

dbus.Int64(condition),

1886

1344

dbus.String(command))

1887

1345

else:

1888

1346

# Emit D-Bus signal

1889

1347

self.CheckerCompleted(dbus.Int16(-1),

1890

dbus.Int64(

1891

# This is specific to GNU libC

1892

(exitstatus << 8)

1893

| self.last_checker_signal),

1348

dbus.Int64(condition),

1894

1349

dbus.String(command))

1895

return ret

1896

1350

1351

return Client.checker_callback(self, pid, condition, command,

1352

*args, **kwargs)

1353

1897

1354

def start_checker(self, *args, **kwargs):

1898

old_checker_pid = getattr(self.checker, "pid", None)

1355

old_checker = self.checker

1356

if self.checker is not None:

1357

old_checker_pid = self.checker.pid

1358

else:

1359

old_checker_pid = None

1899

1360

r = Client.start_checker(self, *args, **kwargs)

1900

1361

# Only if new checker process was started

1901

1362

if (self.checker is not None

1903

1364

# Emit D-Bus signal

1904

1365

self.CheckerStarted(self.current_checker_command)

1905

1366

return r

1906

1367

1907

1368

def _reset_approved(self):

1908

1369

self.approved = None

1909

1370

return False

1910

1371

1911

1372

def approve(self, value=True):

1912

1373

self.approved = value

1913

GLib.timeout_add(int(self.approval_duration.total_seconds()

1914

* 1000), self._reset_approved)

1374

gobject.timeout_add(timedelta_to_milliseconds

1375

(self.approval_duration),

1376

self._reset_approved)

1915

1377

self.send_changedstate()

1916

1917

# D-Bus methods, signals & properties

1918

1919

# Interfaces

1920

1921

# Signals

1922

1378

1379

## D-Bus methods, signals & properties

1380

_interface = "se.recompile.Mandos.Client"

1381

1382

## Interfaces

1383

1384

@dbus_interface_annotations(_interface)

1385

def _foo(self):

1386

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1387

"false"}

1388

1389

## Signals

1390

1923

1391

# CheckerCompleted - signal

1924

1392

@dbus.service.signal(_interface, signature="nxs")

1925

1393

def CheckerCompleted(self, exitcode, waitstatus, command):

1926

1394

"D-Bus signal"

1927

1395

pass

1928

1396

1929

1397

# CheckerStarted - signal

1930

1398

@dbus.service.signal(_interface, signature="s")

1931

1399

def CheckerStarted(self, command):

1932

1400

"D-Bus signal"

1933

1401

pass

1934

1402

1935

1403

# PropertyChanged - signal

1936

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1937

1404

@dbus.service.signal(_interface, signature="sv")

1938

1405

def PropertyChanged(self, property, value):

1939

1406

"D-Bus signal"

1940

1407

pass

1941

1408

1942

1409

# GotSecret - signal

1943

1410

@dbus.service.signal(_interface)

1944

1411

def GotSecret(self):

1947

1414

server to mandos-client

1948

1415

"""

1949

1416

pass

1950

1417

1951

1418

# Rejected - signal

1952

1419

@dbus.service.signal(_interface, signature="s")

1953

1420

def Rejected(self, reason):

1954

1421

"D-Bus signal"

1955

1422

pass

1956

1423

1957

1424

# NeedApproval - signal

1958

1425

@dbus.service.signal(_interface, signature="tb")

1959

1426

def NeedApproval(self, timeout, default):

1960

1427

"D-Bus signal"

1961

1428

return self.need_approval()

1962

1963

# Methods

1964

1429

1430

## Methods

1431

1965

1432

# Approve - method

1966

1433

@dbus.service.method(_interface, in_signature="b")

1967

1434

def Approve(self, value):

1968

1435

self.approve(value)

1969

1436

1970

1437

# CheckedOK - method

1971

1438

@dbus.service.method(_interface)

1972

1439

def CheckedOK(self):

1973

1440

self.checked_ok()

1974

1441

1975

1442

# Enable - method

1976

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1977

1443

@dbus.service.method(_interface)

1978

1444

def Enable(self):

1979

1445

"D-Bus method"

1980

1446

self.enable()

1981

1447

1982

1448

# StartChecker - method

1983

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1984

1449

@dbus.service.method(_interface)

1985

1450

def StartChecker(self):

1986

1451

"D-Bus method"

1987

1452

self.start_checker()

1988

1453

1989

1454

# Disable - method

1990

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1991

1455

@dbus.service.method(_interface)

1992

1456

def Disable(self):

1993

1457

"D-Bus method"

1994

1458

self.disable()

1995

1459

1996

1460

# StopChecker - method

1997

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1998

1461

@dbus.service.method(_interface)

1999

1462

def StopChecker(self):

2000

1463

self.stop_checker()

2001

2002

# Properties

2003

1464

1465

## Properties

1466

2004

1467

# ApprovalPending - property

2005

1468

@dbus_service_property(_interface, signature="b", access="read")

2006

1469

def ApprovalPending_dbus_property(self):

2007

1470

return dbus.Boolean(bool(self.approvals_pending))

2008

1471

2009

1472

# ApprovedByDefault - property

2010

@dbus_service_property(_interface,

2011

signature="b",

1473

@dbus_service_property(_interface, signature="b",

2012

1474

access="readwrite")

2013

1475

def ApprovedByDefault_dbus_property(self, value=None):

2014

1476

if value is None: # get

2015

1477

return dbus.Boolean(self.approved_by_default)

2016

1478

self.approved_by_default = bool(value)

2017

1479

2018

1480

# ApprovalDelay - property

2019

@dbus_service_property(_interface,

2020

signature="t",

1481

@dbus_service_property(_interface, signature="t",

2021

1482

access="readwrite")

2022

1483

def ApprovalDelay_dbus_property(self, value=None):

2023

1484

if value is None: # get

2024

return dbus.UInt64(self.approval_delay.total_seconds()

2025

* 1000)

1485

return dbus.UInt64(self.approval_delay_milliseconds())

2026

1486

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2027

1487

2028

1488

# ApprovalDuration - property

2029

@dbus_service_property(_interface,

2030

signature="t",

1489

@dbus_service_property(_interface, signature="t",

2031

1490

access="readwrite")

2032

1491

def ApprovalDuration_dbus_property(self, value=None):

2033

1492

if value is None: # get

2034

return dbus.UInt64(self.approval_duration.total_seconds()

2035

* 1000)

1493

return dbus.UInt64(timedelta_to_milliseconds(

1494

self.approval_duration))

2036

1495

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2037

1496

2038

1497

# Name - property

2039

@dbus_annotations(

2040

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2041

1498

@dbus_service_property(_interface, signature="s", access="read")

2042

1499

def Name_dbus_property(self):

2043

1500

return dbus.String(self.name)

2044

2045

# KeyID - property

2046

@dbus_annotations(

2047

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2048

@dbus_service_property(_interface, signature="s", access="read")

2049

def KeyID_dbus_property(self):

2050

return dbus.String(self.key_id)

2051

1501

2052

1502

# Fingerprint - property

2053

@dbus_annotations(

2054

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2055

1503

@dbus_service_property(_interface, signature="s", access="read")

2056

1504

def Fingerprint_dbus_property(self):

2057

1505

return dbus.String(self.fingerprint)

2058

1506

2059

1507

# Host - property

2060

@dbus_service_property(_interface,

2061

signature="s",

1508

@dbus_service_property(_interface, signature="s",

2062

1509

access="readwrite")

2063

1510

def Host_dbus_property(self, value=None):

2064

1511

if value is None: # get

2065

1512

return dbus.String(self.host)

2066

self.host = str(value)

2067

1513

self.host = unicode(value)

1514

2068

1515

# Created - property

2069

@dbus_annotations(

2070

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2071

1516

@dbus_service_property(_interface, signature="s", access="read")

2072

1517

def Created_dbus_property(self):

2073

1518

return datetime_to_dbus(self.created)

2074

1519

2075

1520

# LastEnabled - property

2076

1521

@dbus_service_property(_interface, signature="s", access="read")

2077

1522

def LastEnabled_dbus_property(self):

2078

1523

return datetime_to_dbus(self.last_enabled)

2079

1524

2080

1525

# Enabled - property

2081

@dbus_service_property(_interface,

2082

signature="b",

1526

@dbus_service_property(_interface, signature="b",

2083

1527

access="readwrite")

2084

1528

def Enabled_dbus_property(self, value=None):

2085

1529

if value is None: # get

2088

1532

self.enable()

2089

1533

else:

2090

1534

self.disable()

2091

1535

2092

1536

# LastCheckedOK - property

2093

@dbus_service_property(_interface,

2094

signature="s",

1537

@dbus_service_property(_interface, signature="s",

2095

1538

access="readwrite")

2096

1539

def LastCheckedOK_dbus_property(self, value=None):

2097

1540

if value is not None:

2098

1541

self.checked_ok()

2099

1542

return

2100

1543

return datetime_to_dbus(self.last_checked_ok)

2101

1544

2102

1545

# LastCheckerStatus - property

2103

@dbus_service_property(_interface, signature="n", access="read")

1546

@dbus_service_property(_interface, signature="n",

1547

access="read")

2104

1548

def LastCheckerStatus_dbus_property(self):

2105

1549

return dbus.Int16(self.last_checker_status)

2106

1550

2107

1551

# Expires - property

2108

1552

@dbus_service_property(_interface, signature="s", access="read")

2109

1553

def Expires_dbus_property(self):

2110

1554

return datetime_to_dbus(self.expires)

2111

1555

2112

1556

# LastApprovalRequest - property

2113

1557

@dbus_service_property(_interface, signature="s", access="read")

2114

1558

def LastApprovalRequest_dbus_property(self):

2115

1559

return datetime_to_dbus(self.last_approval_request)

2116

1560

2117

1561

# Timeout - property

2118

@dbus_service_property(_interface,

2119

signature="t",

1562

@dbus_service_property(_interface, signature="t",

2120

1563

access="readwrite")

2121

1564

def Timeout_dbus_property(self, value=None):

2122

1565

if value is None: # get

2123

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1566

return dbus.UInt64(self.timeout_milliseconds())

2124

1567

old_timeout = self.timeout

2125

1568

self.timeout = datetime.timedelta(0, 0, 0, value)

2126

1569

# Reschedule disabling

2134

1577

if (getattr(self, "disable_initiator_tag", None)

2135

1578

is None):

2136

1579

return

2137

GLib.source_remove(self.disable_initiator_tag)

2138

self.disable_initiator_tag = GLib.timeout_add(

2139

int((self.expires - now).total_seconds() * 1000),

2140

self.disable)

2141

1580

gobject.source_remove(self.disable_initiator_tag)

1581

self.disable_initiator_tag = (

1582

gobject.timeout_add(

1583

timedelta_to_milliseconds(self.expires - now),

1584

self.disable))

1585

2142

1586

# ExtendedTimeout - property

2143

@dbus_service_property(_interface,

2144

signature="t",

1587

@dbus_service_property(_interface, signature="t",

2145

1588

access="readwrite")

2146

1589

def ExtendedTimeout_dbus_property(self, value=None):

2147

1590

if value is None: # get

2148

return dbus.UInt64(self.extended_timeout.total_seconds()

2149

* 1000)

1591

return dbus.UInt64(self.extended_timeout_milliseconds())

2150

1592

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2151

1593

2152

1594

# Interval - property

2153

@dbus_service_property(_interface,

2154

signature="t",

1595

@dbus_service_property(_interface, signature="t",

2155

1596

access="readwrite")

2156

1597

def Interval_dbus_property(self, value=None):

2157

1598

if value is None: # get

2158

return dbus.UInt64(self.interval.total_seconds() * 1000)

1599

return dbus.UInt64(self.interval_milliseconds())

2159

1600

self.interval = datetime.timedelta(0, 0, 0, value)

2160

1601

if getattr(self, "checker_initiator_tag", None) is None:

2161

1602

return

2162

1603

if self.enabled:

2163

1604

# Reschedule checker run

2164

GLib.source_remove(self.checker_initiator_tag)

2165

self.checker_initiator_tag = GLib.timeout_add(

2166

value, self.start_checker)

2167

self.start_checker() # Start one now, too

2168

1605

gobject.source_remove(self.checker_initiator_tag)

1606

self.checker_initiator_tag = (gobject.timeout_add

1607

(value, self.start_checker))

1608

self.start_checker() # Start one now, too

1609

2169

1610

# Checker - property

2170

@dbus_service_property(_interface,

2171

signature="s",

1611

@dbus_service_property(_interface, signature="s",

2172

1612

access="readwrite")

2173

1613

def Checker_dbus_property(self, value=None):

2174

1614

if value is None: # get

2175

1615

return dbus.String(self.checker_command)

2176

self.checker_command = str(value)

2177

1616

self.checker_command = unicode(value)

1617

2178

1618

# CheckerRunning - property

2179

@dbus_service_property(_interface,

2180

signature="b",

1619

@dbus_service_property(_interface, signature="b",

2181

1620

access="readwrite")

2182

1621

def CheckerRunning_dbus_property(self, value=None):

2183

1622

if value is None: # get

2186

1625

self.start_checker()

2187

1626

else:

2188

1627

self.stop_checker()

2189

1628

2190

1629

# ObjectPath - property

2191

@dbus_annotations(

2192

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2193

"org.freedesktop.DBus.Deprecated": "true"})

2194

1630

@dbus_service_property(_interface, signature="o", access="read")

2195

1631

def ObjectPath_dbus_property(self):

2196

return self.dbus_object_path # is already a dbus.ObjectPath

2197

1632

return self.dbus_object_path # is already a dbus.ObjectPath

1633

2198

1634

# Secret = property

2199

@dbus_annotations(

2200

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2201

"invalidates"})

2202

@dbus_service_property(_interface,

2203

signature="ay",

2204

access="write",

2205

byte_arrays=True)

1635

@dbus_service_property(_interface, signature="ay",

1636

access="write", byte_arrays=True)

2206

1637

def Secret_dbus_property(self, value):

2207

self.secret = bytes(value)

2208

1638

self.secret = str(value)

1639

2209

1640

del _interface

2210

1641

2211

1642

2212

1643

class ProxyClient(object):

2213

def __init__(self, child_pipe, key_id, fpr, address):

1644

def __init__(self, child_pipe, fpr, address):

2214

1645

self._pipe = child_pipe

2215

self._pipe.send(('init', key_id, fpr, address))

1646

self._pipe.send(('init', fpr, address))

2216

1647

if not self._pipe.recv():

2217

raise KeyError(key_id or fpr)

2218

1648

raise KeyError()

1649

2219

1650

def __getattribute__(self, name):

2220

1651

if name == '_pipe':

2221

1652

return super(ProxyClient, self).__getattribute__(name)

2224

1655

if data[0] == 'data':

2225

1656

return data[1]

2226

1657

if data[0] == 'function':

2227

2228

1658

def func(*args, **kwargs):

2229

1659

self._pipe.send(('funcall', name, args, kwargs))

2230

1660

return self._pipe.recv()[1]

2231

2232

1661

return func

2233

1662

2234

1663

def __setattr__(self, name, value):

2235

1664

if name == '_pipe':

2236

1665

return super(ProxyClient, self).__setattr__(name, value)

2239

1668

2240

1669

class ClientHandler(socketserver.BaseRequestHandler, object):

2241

1670

"""A class to handle client connections.

2242

1671

2243

1672

Instantiated once for each connection to handle it.

2244

1673

Note: This will run in its own forked process."""

2245

1674

2246

1675

def handle(self):

2247

1676

with contextlib.closing(self.server.child_pipe) as child_pipe:

2248

1677

logger.info("TCP connection from: %s",

2249

str(self.client_address))

1678

unicode(self.client_address))

2250

1679

logger.debug("Pipe FD: %d",

2251

1680

self.server.child_pipe.fileno())

2252

2253

session = gnutls.ClientSession(self.request)

2254

2255

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2256

# "+AES-256-CBC", "+SHA1",

2257

# "+COMP-NULL", "+CTYPE-OPENPGP",

2258

# "+DHE-DSS"))

1681

1682

session = (gnutls.connection

1683

.ClientSession(self.request,

1684

gnutls.connection

1685

.X509Credentials()))

1686

1687

# Note: gnutls.connection.X509Credentials is really a

1688

# generic GnuTLS certificate credentials object so long as

1689

# no X.509 keys are added to it. Therefore, we can use it

1690

# here despite using OpenPGP certificates.

1691

1692

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1693

# "+AES-256-CBC", "+SHA1",

1694

# "+COMP-NULL", "+CTYPE-OPENPGP",

1695

# "+DHE-DSS"))

2259

1696

# Use a fallback default, since this MUST be set.

2260

1697

priority = self.server.gnutls_priority

2261

1698

if priority is None:

2262

1699

priority = "NORMAL"

2263

gnutls.priority_set_direct(session._c_object,

2264

priority.encode("utf-8"),

2265

None)

2266

1700

(gnutls.library.functions

1701

.gnutls_priority_set_direct(session._c_object,

1702

priority, None))

1703

2267

1704

# Start communication using the Mandos protocol

2268

1705

# Get protocol number

2269

1706

line = self.request.makefile().readline()

2274

1711

except (ValueError, IndexError, RuntimeError) as error:

2275

1712

logger.error("Unknown protocol version: %s", error)

2276

1713

return

2277

1714

2278

1715

# Start GnuTLS connection

2279

1716

try:

2280

1717

session.handshake()

2281

except gnutls.Error as error:

1718

except gnutls.errors.GNUTLSError as error:

2282

1719

logger.warning("Handshake failed: %s", error)

2283

1720

# Do not run session.bye() here: the session is not

2284

1721

# established. Just abandon the request.

2285

1722

return

2286

1723

logger.debug("Handshake succeeded")

2287

1724

2288

1725

approval_required = False

2289

1726

try:

2290

if gnutls.has_rawpk:

2291

fpr = b""

2292

try:

2293

key_id = self.key_id(

2294

self.peer_certificate(session))

2295

except (TypeError, gnutls.Error) as error:

2296

logger.warning("Bad certificate: %s", error)

2297

return

2298

logger.debug("Key ID: %s", key_id)

2299

2300

else:

2301

key_id = b""

2302

try:

2303

fpr = self.fingerprint(

2304

self.peer_certificate(session))

2305

except (TypeError, gnutls.Error) as error:

2306

logger.warning("Bad certificate: %s", error)

2307

return

2308

logger.debug("Fingerprint: %s", fpr)

2309

2310

try:

2311

client = ProxyClient(child_pipe, key_id, fpr,

1727

try:

1728

fpr = self.fingerprint(self.peer_certificate

1729

(session))

1730

except (TypeError,

1731

gnutls.errors.GNUTLSError) as error:

1732

logger.warning("Bad certificate: %s", error)

1733

return

1734

logger.debug("Fingerprint: %s", fpr)

1735

1736

try:

1737

client = ProxyClient(child_pipe, fpr,

2312

1738

self.client_address)

2313

1739

except KeyError:

2314

1740

return

2315

1741

2316

1742

if client.approval_delay:

2317

1743

delay = client.approval_delay

2318

1744

client.approvals_pending += 1

2319

1745

approval_required = True

2320

1746

2321

1747

while True:

2322

1748

if not client.enabled:

2323

1749

logger.info("Client %s is disabled",

2324

client.name)

1750

client.name)

2325

1751

if self.server.use_dbus:

2326

1752

# Emit D-Bus signal

2327

1753

client.Rejected("Disabled")

2328

1754

return

2329

1755

2330

1756

if client.approved or not client.approval_delay:

2331

# We are approved or approval is disabled

1757

#We are approved or approval is disabled

2332

1758

break

2333

1759

elif client.approved is None:

2334

1760

logger.info("Client %s needs approval",

2336

1762

if self.server.use_dbus:

2337

1763

# Emit D-Bus signal

2338

1764

client.NeedApproval(

2339

client.approval_delay.total_seconds()

2340

* 1000, client.approved_by_default)

1765

client.approval_delay_milliseconds(),

1766

client.approved_by_default)

2341

1767

else:

2342

1768

logger.warning("Client %s was not approved",

2343

1769

client.name)

2345

1771

# Emit D-Bus signal

2346

1772

client.Rejected("Denied")

2347

1773

return

2348

2349

# wait until timeout or approved

1774

1775

#wait until timeout or approved

2350

1776

time = datetime.datetime.now()

2351

1777

client.changedstate.acquire()

2352

client.changedstate.wait(delay.total_seconds())

1778

client.changedstate.wait(

1779

float(timedelta_to_milliseconds(delay)

1780

/ 1000))

2353

1781

client.changedstate.release()

2354

1782

time2 = datetime.datetime.now()

2355

1783

if (time2 - time) >= delay:

2365

1793

break

2366

1794

else:

2367

1795

delay -= time2 - time

2368

2369

try:

2370

session.send(client.secret)

2371

except gnutls.Error as error:

2372

logger.warning("gnutls send failed",

2373

exc_info=error)

2374

return

2375

1796

1797

sent_size = 0

1798

while sent_size < len(client.secret):

1799

try:

1800

sent = session.send(client.secret[sent_size:])

1801

except gnutls.errors.GNUTLSError as error:

1802

logger.warning("gnutls send failed",

1803

exc_info=error)

1804

return

1805

logger.debug("Sent: %d, remaining: %d",

1806

sent, len(client.secret)

1807

- (sent_size + sent))

1808

sent_size += sent

1809

2376

1810

logger.info("Sending secret to %s", client.name)

2377

1811

# bump the timeout using extended_timeout

2378

1812

client.bump_timeout(client.extended_timeout)

2379

1813

if self.server.use_dbus:

2380

1814

# Emit D-Bus signal

2381

1815

client.GotSecret()

2382

1816

2383

1817

finally:

2384

1818

if approval_required:

2385

1819

client.approvals_pending -= 1

2386

1820

try:

2387

1821

session.bye()

2388

except gnutls.Error as error:

1822

except gnutls.errors.GNUTLSError as error:

2389

1823

logger.warning("GnuTLS bye failed",

2390

1824

exc_info=error)

2391

1825

2392

1826

@staticmethod

2393

1827

def peer_certificate(session):

2394

"Return the peer's certificate as a bytestring"

2395

try:

2396

cert_type = gnutls.certificate_type_get2(session._c_object,

2397

gnutls.CTYPE_PEERS)

2398

except AttributeError:

2399

cert_type = gnutls.certificate_type_get(session._c_object)

2400

if gnutls.has_rawpk:

2401

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2402

else:

2403

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2404

# If not a valid certificate type...

2405

if cert_type not in valid_cert_types:

2406

logger.info("Cert type %r not in %r", cert_type,

2407

valid_cert_types)

2408

# ...return invalid data

2409

return b""

1828

"Return the peer's OpenPGP certificate as a bytestring"

1829

# If not an OpenPGP certificate...

1830

if (gnutls.library.functions

1831

.gnutls_certificate_type_get(session._c_object)

1832

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1833

# ...do the normal thing

1834

return session.peer_certificate

2410

1835

list_size = ctypes.c_uint(1)

2411

cert_list = (gnutls.certificate_get_peers

1836

cert_list = (gnutls.library.functions

1837

.gnutls_certificate_get_peers

2412

1838

(session._c_object, ctypes.byref(list_size)))

2413

1839

if not bool(cert_list) and list_size.value != 0:

2414

raise gnutls.Error("error getting peer certificate")

1840

raise gnutls.errors.GNUTLSError("error getting peer"

1841

" certificate")

2415

1842

if list_size.value == 0:

2416

1843

return None

2417

1844

cert = cert_list[0]

2418

1845

return ctypes.string_at(cert.data, cert.size)

2419

2420

@staticmethod

2421

def key_id(certificate):

2422

"Convert a certificate bytestring to a hexdigit key ID"

2423

# New GnuTLS "datum" with the public key

2424

datum = gnutls.datum_t(

2425

ctypes.cast(ctypes.c_char_p(certificate),

2426

ctypes.POINTER(ctypes.c_ubyte)),

2427

ctypes.c_uint(len(certificate)))

2428

# XXX all these need to be created in the gnutls "module"

2429

# New empty GnuTLS certificate

2430

pubkey = gnutls.pubkey_t()

2431

gnutls.pubkey_init(ctypes.byref(pubkey))

2432

# Import the raw public key into the certificate

2433

gnutls.pubkey_import(pubkey,

2434

ctypes.byref(datum),

2435

gnutls.X509_FMT_DER)

2436

# New buffer for the key ID

2437

buf = ctypes.create_string_buffer(32)

2438

buf_len = ctypes.c_size_t(len(buf))

2439

# Get the key ID from the raw public key into the buffer

2440

gnutls.pubkey_get_key_id(pubkey,

2441

gnutls.KEYID_USE_SHA256,

2442

ctypes.cast(ctypes.byref(buf),

2443

ctypes.POINTER(ctypes.c_ubyte)),

2444

ctypes.byref(buf_len))

2445

# Deinit the certificate

2446

gnutls.pubkey_deinit(pubkey)

2447

2448

# Convert the buffer to a Python bytestring

2449

key_id = ctypes.string_at(buf, buf_len.value)

2450

# Convert the bytestring to hexadecimal notation

2451

hex_key_id = binascii.hexlify(key_id).upper()

2452

return hex_key_id

2453

1846

2454

1847

@staticmethod

2455

1848

def fingerprint(openpgp):

2456

1849

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2457

1850

# New GnuTLS "datum" with the OpenPGP public key

2458

datum = gnutls.datum_t(

2459

ctypes.cast(ctypes.c_char_p(openpgp),

2460

ctypes.POINTER(ctypes.c_ubyte)),

2461

ctypes.c_uint(len(openpgp)))

1851

datum = (gnutls.library.types

1852

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1853

ctypes.POINTER

1854

(ctypes.c_ubyte)),

1855

ctypes.c_uint(len(openpgp))))

2462

1856

# New empty GnuTLS certificate

2463

crt = gnutls.openpgp_crt_t()

2464

gnutls.openpgp_crt_init(ctypes.byref(crt))

1857

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1858

(gnutls.library.functions

1859

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2465

1860

# Import the OpenPGP public key into the certificate

2466

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2467

gnutls.OPENPGP_FMT_RAW)

1861

(gnutls.library.functions

1862

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1863

gnutls.library.constants

1864

.GNUTLS_OPENPGP_FMT_RAW))

2468

1865

# Verify the self signature in the key

2469

1866

crtverify = ctypes.c_uint()

2470

gnutls.openpgp_crt_verify_self(crt, 0,

2471

ctypes.byref(crtverify))

1867

(gnutls.library.functions

1868

.gnutls_openpgp_crt_verify_self(crt, 0,

1869

ctypes.byref(crtverify)))

2472

1870

if crtverify.value != 0:

2473

gnutls.openpgp_crt_deinit(crt)

2474

raise gnutls.CertificateSecurityError(code

2475

=crtverify.value)

1871

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1872

raise (gnutls.errors.CertificateSecurityError

1873

("Verify failed"))

2476

1874

# New buffer for the fingerprint

2477

1875

buf = ctypes.create_string_buffer(20)

2478

1876

buf_len = ctypes.c_size_t()

2479

1877

# Get the fingerprint from the certificate into the buffer

2480

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2481

ctypes.byref(buf_len))

1878

(gnutls.library.functions

1879

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1880

ctypes.byref(buf_len)))

2482

1881

# Deinit the certificate

2483

gnutls.openpgp_crt_deinit(crt)

1882

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2484

1883

# Convert the buffer to a Python bytestring

2485

1884

fpr = ctypes.string_at(buf, buf_len.value)

2486

1885

# Convert the bytestring to hexadecimal notation

2490

1889

2491

1890

class MultiprocessingMixIn(object):

2492

1891

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2493

2494

1892

def sub_process_main(self, request, address):

2495

1893

try:

2496

1894

self.finish_request(request, address)

2497

1895

except Exception:

2498

1896

self.handle_error(request, address)

2499

1897

self.close_request(request)

2500

1898

2501

1899

def process_request(self, request, address):

2502

1900

"""Start a new process to process the request."""

2503

proc = multiprocessing.Process(target=self.sub_process_main,

2504

args=(request, address))

1901

proc = multiprocessing.Process(target = self.sub_process_main,

1902

args = (request, address))

2505

1903

proc.start()

2506

1904

return proc

2507

1905

2508

1906

2509

1907

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2510

1908

""" adds a pipe to the MixIn """

2511

2512

1909

def process_request(self, request, client_address):

2513

1910

"""Overrides and wraps the original process_request().

2514

1911

2515

1912

This function creates a new pipe in self.pipe

2516

1913

"""

2517

1914

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2518

1915

2519

1916

proc = MultiprocessingMixIn.process_request(self, request,

2520

1917

client_address)

2521

1918

self.child_pipe.close()

2522

1919

self.add_pipe(parent_pipe, proc)

2523

1920

2524

1921

def add_pipe(self, parent_pipe, proc):

2525

1922

"""Dummy function; override as necessary"""

2526

1923

raise NotImplementedError()

2529

1926

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2530

1927

socketserver.TCPServer, object):

2531

1928

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2532

1929

2533

1930

Attributes:

2534

1931

enabled: Boolean; whether this server is activated yet

2535

1932

interface: None or a network interface name (string)

2536

1933

use_ipv6: Boolean; to use IPv6 or not

2537

1934

"""

2538

2539

1935

def __init__(self, server_address, RequestHandlerClass,

2540

interface=None,

2541

use_ipv6=True,

2542

socketfd=None):

1936

interface=None, use_ipv6=True, socketfd=None):

2543

1937

"""If socketfd is set, use that file descriptor instead of

2544

1938

creating a new one with socket.socket().

2545

1939

"""

2551

1945

self.socketfd = socketfd

2552

1946

# Save the original socket.socket() function

2553

1947

self.socket_socket = socket.socket

2554

2555

1948

# To implement --socket, we monkey patch socket.socket.

2556

#

1949

#

2557

1950

# (When socketserver.TCPServer is a new-style class, we

2558

1951

# could make self.socket into a property instead of monkey

2559

1952

# patching socket.socket.)

2560

#

1953

#

2561

1954

# Create a one-time-only replacement for socket.socket()

2562

1955

@functools.wraps(socket.socket)

2563

1956

def socket_wrapper(*args, **kwargs):

2575

1968

# socket_wrapper(), if socketfd was set.

2576

1969

socketserver.TCPServer.__init__(self, server_address,

2577

1970

RequestHandlerClass)

2578

1971

2579

1972

def server_bind(self):

2580

1973

"""This overrides the normal server_bind() function

2581

1974

to bind to an interface if one was specified, and also NOT to

2582

1975

bind to an address or port if they were not specified."""

2583

global SO_BINDTODEVICE

2584

1976

if self.interface is not None:

2585

1977

if SO_BINDTODEVICE is None:

2586

# Fall back to a hard-coded value which seems to be

2587

# common enough.

2588

logger.warning("SO_BINDTODEVICE not found, trying 25")

2589

SO_BINDTODEVICE = 25

2590

try:

2591

self.socket.setsockopt(

2592

socket.SOL_SOCKET, SO_BINDTODEVICE,

2593

(self.interface + "\0").encode("utf-8"))

2594

except socket.error as error:

2595

if error.errno == errno.EPERM:

2596

logger.error("No permission to bind to"

2597

" interface %s", self.interface)

2598

elif error.errno == errno.ENOPROTOOPT:

2599

logger.error("SO_BINDTODEVICE not available;"

2600

" cannot bind to interface %s",

2601

self.interface)

2602

elif error.errno == errno.ENODEV:

2603

logger.error("Interface %s does not exist,"

2604

" cannot bind", self.interface)

2605

else:

2606

raise

1978

logger.error("SO_BINDTODEVICE does not exist;"

1979

" cannot bind to interface %s",

1980

self.interface)

1981

else:

1982

try:

1983

self.socket.setsockopt(socket.SOL_SOCKET,

1984

SO_BINDTODEVICE,

1985

str(self.interface + '\0'))

1986

except socket.error as error:

1987

if error.errno == errno.EPERM:

1988

logger.error("No permission to bind to"

1989

" interface %s", self.interface)

1990

elif error.errno == errno.ENOPROTOOPT:

1991

logger.error("SO_BINDTODEVICE not available;"

1992

" cannot bind to interface %s",

1993

self.interface)

1994

elif error.errno == errno.ENODEV:

1995

logger.error("Interface %s does not exist,"

1996

" cannot bind", self.interface)

1997

else:

1998

raise

2607

1999

# Only bind(2) the socket if we really need to.

2608

2000

if self.server_address[0] or self.server_address[1]:

2609

if self.server_address[1]:

2610

self.allow_reuse_address = True

2611

2001

if not self.server_address[0]:

2612

2002

if self.address_family == socket.AF_INET6:

2613

any_address = "::" # in6addr_any

2003

any_address = "::" # in6addr_any

2614

2004

else:

2615

any_address = "0.0.0.0" # INADDR_ANY

2005

any_address = "0.0.0.0" # INADDR_ANY

2616

2006

self.server_address = (any_address,

2617

2007

self.server_address[1])

2618

2008

elif not self.server_address[1]:

2619

self.server_address = (self.server_address[0], 0)

2009

self.server_address = (self.server_address[0],

2010

0)

2620

2011

# if self.interface:

2621

2012

# self.server_address = (self.server_address[0],

2622

2013

# 0, # port

2628

2019

2629

2020

class MandosServer(IPv6_TCPServer):

2630

2021

"""Mandos server.

2631

2022

2632

2023

Attributes:

2633

2024

clients: set of Client objects

2634

2025

gnutls_priority GnuTLS priority string

2635

2026

use_dbus: Boolean; to emit D-Bus signals or not

2636

2637

Assumes a GLib.MainLoop event loop.

2027

2028

Assumes a gobject.MainLoop event loop.

2638

2029

"""

2639

2640

2030

def __init__(self, server_address, RequestHandlerClass,

2641

interface=None,

2642

use_ipv6=True,

2643

clients=None,

2644

gnutls_priority=None,

2645

use_dbus=True,

2646

socketfd=None):

2031

interface=None, use_ipv6=True, clients=None,

2032

gnutls_priority=None, use_dbus=True, socketfd=None):

2647

2033

self.enabled = False

2648

2034

self.clients = clients

2649

2035

if self.clients is None:

2652

2038

self.gnutls_priority = gnutls_priority

2653

2039

IPv6_TCPServer.__init__(self, server_address,

2654

2040

RequestHandlerClass,

2655

interface=interface,

2656

use_ipv6=use_ipv6,

2657

socketfd=socketfd)

2658

2041

interface = interface,

2042

use_ipv6 = use_ipv6,

2043

socketfd = socketfd)

2659

2044

def server_activate(self):

2660

2045

if self.enabled:

2661

2046

return socketserver.TCPServer.server_activate(self)

2662

2047

2663

2048

def enable(self):

2664

2049

self.enabled = True

2665

2050

2666

2051

def add_pipe(self, parent_pipe, proc):

2667

2052

# Call "handle_ipc" for both data and EOF events

2668

GLib.io_add_watch(

2669

parent_pipe.fileno(),

2670

GLib.IO_IN | GLib.IO_HUP,

2671

functools.partial(self.handle_ipc,

2672

parent_pipe=parent_pipe,

2673

proc=proc))

2674

2675

def handle_ipc(self, source, condition,

2676

parent_pipe=None,

2677

proc=None,

2678

client_object=None):

2053

gobject.io_add_watch(parent_pipe.fileno(),

2054

gobject.IO_IN | gobject.IO_HUP,

2055

functools.partial(self.handle_ipc,

2056

parent_pipe =

2057

parent_pipe,

2058

proc = proc))

2059

2060

def handle_ipc(self, source, condition, parent_pipe=None,

2061

proc = None, client_object=None):

2679

2062

# error, or the other end of multiprocessing.Pipe has closed

2680

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2063

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2681

2064

# Wait for other process to exit

2682

2065

proc.join()

2683

2066

return False

2684

2067

2685

2068

# Read a request from the child

2686

2069

request = parent_pipe.recv()

2687

2070

command = request[0]

2688

2071

2689

2072

if command == 'init':

2690

key_id = request[1].decode("ascii")

2691

fpr = request[2].decode("ascii")

2692

address = request[3]

2693

2694

for c in self.clients.values():

2695

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2696

continue

2697

if key_id and c.key_id == key_id:

2698

client = c

2699

break

2700

if fpr and c.fingerprint == fpr:

2073

fpr = request[1]

2074

address = request[2]

2075

2076

for c in self.clients.itervalues():

2077

if c.fingerprint == fpr:

2701

2078

client = c

2702

2079

break

2703

2080

else:

2704

logger.info("Client not found for key ID: %s, address"

2705

": %s", key_id or fpr, address)

2081

logger.info("Client not found for fingerprint: %s, ad"

2082

"dress: %s", fpr, address)

2706

2083

if self.use_dbus:

2707

2084

# Emit D-Bus signal

2708

mandos_dbus_service.ClientNotFound(key_id or fpr,

2085

mandos_dbus_service.ClientNotFound(fpr,

2709

2086

address[0])

2710

2087

parent_pipe.send(False)

2711

2088

return False

2712

2713

GLib.io_add_watch(

2714

parent_pipe.fileno(),

2715

GLib.IO_IN | GLib.IO_HUP,

2716

functools.partial(self.handle_ipc,

2717

parent_pipe=parent_pipe,

2718

proc=proc,

2719

client_object=client))

2089

2090

gobject.io_add_watch(parent_pipe.fileno(),

2091

gobject.IO_IN | gobject.IO_HUP,

2092

functools.partial(self.handle_ipc,

2093

parent_pipe =

2094

parent_pipe,

2095

proc = proc,

2096

client_object =

2097

client))

2720

2098

parent_pipe.send(True)

2721

2099

# remove the old hook in favor of the new above hook on

2722

2100

# same fileno

2725

2103

funcname = request[1]

2726

2104

args = request[2]

2727

2105

kwargs = request[3]

2728

2106

2729

2107

parent_pipe.send(('data', getattr(client_object,

2730

2108

funcname)(*args,

2731

**kwargs)))

2732

2109

**kwargs)))

2110

2733

2111

if command == 'getattr':

2734

2112

attrname = request[1]

2735

if isinstance(client_object.__getattribute__(attrname),

2736

collections.Callable):

2737

parent_pipe.send(('function', ))

2113

if callable(client_object.__getattribute__(attrname)):

2114

parent_pipe.send(('function',))

2738

2115

else:

2739

parent_pipe.send((

2740

'data', client_object.__getattribute__(attrname)))

2741

2116

parent_pipe.send(('data', client_object

2117

.__getattribute__(attrname)))

2118

2742

2119

if command == 'setattr':

2743

2120

attrname = request[1]

2744

2121

value = request[2]

2745

2122

setattr(client_object, attrname, value)

2746

2123

2747

2124

return True

2748

2125

2749

2126

2750

2127

def rfc3339_duration_to_delta(duration):

2751

2128

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2752

2129

2753

2130

>>> rfc3339_duration_to_delta("P7D")

2754

2131

datetime.timedelta(7)

2755

2132

>>> rfc3339_duration_to_delta("PT60S")

2765

2142

>>> rfc3339_duration_to_delta("P1DT3M20S")

2766

2143

datetime.timedelta(1, 200)

2767

2144

"""

2768

2145

2769

2146

# Parsing an RFC 3339 duration with regular expressions is not

2770

2147

# possible - there would have to be multiple places for the same

2771

2148

# values, like seconds. The current code, while more esoteric, is

2772

2149

# cleaner without depending on a parsing library. If Python had a

2773

2150

# built-in library for parsing we would use it, but we'd like to

2774

2151

# avoid excessive use of external libraries.

2775

2152

2776

2153

# New type for defining tokens, syntax, and semantics all-in-one

2777

Token = collections.namedtuple("Token", (

2778

"regexp", # To match token; if "value" is not None, must have

2779

# a "group" containing digits

2780

"value", # datetime.timedelta or None

2781

"followers")) # Tokens valid after this token

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2782

2163

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2783

2164

# the "duration" ABNF definition in RFC 3339, Appendix A.

2784

2165

token_end = Token(re.compile(r"$"), None, frozenset())

2785

2166

token_second = Token(re.compile(r"(\d+)S"),

2786

2167

datetime.timedelta(seconds=1),

2787

frozenset((token_end, )))

2168

frozenset((token_end,)))

2788

2169

token_minute = Token(re.compile(r"(\d+)M"),

2789

2170

datetime.timedelta(minutes=1),

2790

2171

frozenset((token_second, token_end)))

2806

2187

frozenset((token_month, token_end)))

2807

2188

token_week = Token(re.compile(r"(\d+)W"),

2808

2189

datetime.timedelta(weeks=1),

2809

frozenset((token_end, )))

2190

frozenset((token_end,)))

2810

2191

token_duration = Token(re.compile(r"P"), None,

2811

2192

frozenset((token_year, token_month,

2812

2193

token_day, token_time,

2813

token_week)))

2814

# Define starting values:

2815

# Value so far

2816

value = datetime.timedelta()

2194

token_week))),

2195

# Define starting values

2196

value = datetime.timedelta() # Value so far

2817

2197

found_token = None

2818

# Following valid tokens

2819

followers = frozenset((token_duration, ))

2820

# String left to parse

2821

s = duration

2198

followers = frozenset(token_duration,) # Following valid tokens

2199

s = duration # String left to parse

2822

2200

# Loop until end token is found

2823

2201

while found_token is not token_end:

2824

2202

# Search for any currently valid tokens

2840

2218

break

2841

2219

else:

2842

2220

# No currently valid tokens were found

2843

raise ValueError("Invalid RFC 3339 duration: {!r}"

2844

.format(duration))

2221

raise ValueError("Invalid RFC 3339 duration")

2845

2222

# End token found

2846

2223

return value

2847

2224

2848

2225

2849

2226

def string_to_delta(interval):

2850

2227

"""Parse a string and return a datetime.timedelta

2851

2228

2852

2229

>>> string_to_delta('7d')

2853

2230

datetime.timedelta(7)

2854

2231

>>> string_to_delta('60s')

2862

2239

>>> string_to_delta('5m 30s')

2863

2240

datetime.timedelta(0, 330)

2864

2241

"""

2865

2242

2866

2243

try:

2867

2244

return rfc3339_duration_to_delta(interval)

2868

2245

except ValueError:

2869

2246

pass

2870

2247

2871

2248

timevalue = datetime.timedelta(0)

2872

2249

for s in interval.split():

2873

2250

try:

2874

suffix = s[-1]

2251

suffix = unicode(s[-1])

2875

2252

value = int(s[:-1])

2876

2253

if suffix == "d":

2877

2254

delta = datetime.timedelta(value)

2884

2261

elif suffix == "w":

2885

2262

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2886

2263

else:

2887

raise ValueError("Unknown suffix {!r}".format(suffix))

2264

raise ValueError("Unknown suffix {0!r}"

2265

.format(suffix))

2888

2266

except IndexError as e:

2889

2267

raise ValueError(*(e.args))

2890

2268

timevalue += delta

2891

2269

return timevalue

2892

2270

2893

2271

2894

def daemon(nochdir=False, noclose=False):

2272

def daemon(nochdir = False, noclose = False):

2895

2273

"""See daemon(3). Standard BSD Unix function.

2896

2274

2897

2275

This should really exist as os.daemon, but it doesn't (yet)."""

2898

2276

if os.fork():

2899

2277

sys.exit()

2907

2285

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2908

2286

if not stat.S_ISCHR(os.fstat(null).st_mode):

2909

2287

raise OSError(errno.ENODEV,

2910

"{} not a character device"

2288

"{0} not a character device"

2911

2289

.format(os.devnull))

2912

2290

os.dup2(null, sys.stdin.fileno())

2913

2291

os.dup2(null, sys.stdout.fileno())

2917

2295

2918

2296

2919

2297

def main():

2920

2298

2921

2299

##################################################################

2922

2300

# Parsing of options, both command line and config file

2923

2301

2924

2302

parser = argparse.ArgumentParser()

2925

2303

parser.add_argument("-v", "--version", action="version",

2926

version="%(prog)s {}".format(version),

2304

version = "%(prog)s {0}".format(version),

2927

2305

help="show version number and exit")

2928

2306

parser.add_argument("-i", "--interface", metavar="IF",

2929

2307

help="Bind to interface IF")

2962

2340

help="Directory to save/restore state in")

2963

2341

parser.add_argument("--foreground", action="store_true",

2964

2342

help="Run in foreground", default=None)

2965

parser.add_argument("--no-zeroconf", action="store_false",

2966

dest="zeroconf", help="Do not use Zeroconf",

2967

default=None)

2968

2343

2969

2344

options = parser.parse_args()

2970

2345

2971

2346

if options.check:

2972

2347

import doctest

2973

2348

fail_count, test_count = doctest.testmod()

2974

2349

sys.exit(os.EX_OK if fail_count == 0 else 1)

2975

2350

2976

2351

# Default values for config file for server-global settings

2977

if gnutls.has_rawpk:

2978

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2979

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2980

else:

2981

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2982

":+SIGN-DSA-SHA256")

2983

server_defaults = {"interface": "",

2984

"address": "",

2985

"port": "",

2986

"debug": "False",

2987

"priority": priority,

2988

"servicename": "Mandos",

2989

"use_dbus": "True",

2990

"use_ipv6": "True",

2991

"debuglevel": "",

2992

"restore": "True",

2993

"socket": "",

2994

"statedir": "/var/lib/mandos",

2995

"foreground": "False",

2996

"zeroconf": "True",

2997

}

2998

del priority

2999

2352

server_defaults = { "interface": "",

2353

"address": "",

2354

"port": "",

2355

"debug": "False",

2356

"priority":

2357

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2358

"servicename": "Mandos",

2359

"use_dbus": "True",

2360

"use_ipv6": "True",

2361

"debuglevel": "",

2362

"restore": "True",

2363

"socket": "",

2364

"statedir": "/var/lib/mandos",

2365

"foreground": "False",

2366

}

2367

3000

2368

# Parse config file for server-global settings

3001

2369

server_config = configparser.SafeConfigParser(server_defaults)

3002

2370

del server_defaults

3003

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2371

server_config.read(os.path.join(options.configdir,

2372

"mandos.conf"))

3004

2373

# Convert the SafeConfigParser object to a dict

3005

2374

server_settings = server_config.defaults()

3006

2375

# Use the appropriate methods on the non-string config options

3007

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3008

"foreground", "zeroconf"):

2376

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3009

2377

server_settings[option] = server_config.getboolean("DEFAULT",

3010

2378

option)

3011

2379

if server_settings["port"]:

3021

2389

server_settings["socket"] = os.dup(server_settings

3022

2390

["socket"])

3023

2391

del server_config

3024

2392

3025

2393

# Override the settings from the config file with command line

3026

2394

# options, if set.

3027

2395

for option in ("interface", "address", "port", "debug",

3028

"priority", "servicename", "configdir", "use_dbus",

3029

"use_ipv6", "debuglevel", "restore", "statedir",

3030

"socket", "foreground", "zeroconf"):

2396

"priority", "servicename", "configdir",

2397

"use_dbus", "use_ipv6", "debuglevel", "restore",

2398

"statedir", "socket", "foreground"):

3031

2399

value = getattr(options, option)

3032

2400

if value is not None:

3033

2401

server_settings[option] = value

3034

2402

del options

3035

2403

# Force all strings to be unicode

3036

2404

for option in server_settings.keys():

3037

if isinstance(server_settings[option], bytes):

3038

server_settings[option] = (server_settings[option]

3039

.decode("utf-8"))

2405

if type(server_settings[option]) is str:

2406

server_settings[option] = unicode(server_settings[option])

3040

2407

# Force all boolean options to be boolean

3041

2408

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3042

"foreground", "zeroconf"):

2409

"foreground"):

3043

2410

server_settings[option] = bool(server_settings[option])

3044

2411

# Debug implies foreground

3045

2412

if server_settings["debug"]:

3046

2413

server_settings["foreground"] = True

3047

2414

# Now we have our good server settings in "server_settings"

3048

2415

3049

2416

##################################################################

3050

3051

if (not server_settings["zeroconf"]

3052

and not (server_settings["port"]

3053

or server_settings["socket"] != "")):

3054

parser.error("Needs port or socket to work without Zeroconf")

3055

2417

3056

2418

# For convenience

3057

2419

debug = server_settings["debug"]

3058

2420

debuglevel = server_settings["debuglevel"]

3061

2423

stored_state_path = os.path.join(server_settings["statedir"],

3062

2424

stored_state_file)

3063

2425

foreground = server_settings["foreground"]

3064

zeroconf = server_settings["zeroconf"]

3065

2426

3066

2427

if debug:

3067

2428

initlogger(debug, logging.DEBUG)

3068

2429

else:

3071

2432

else:

3072

2433

level = getattr(logging, debuglevel.upper())

3073

2434

initlogger(debug, level)

3074

2435

3075

2436

if server_settings["servicename"] != "Mandos":

3076

syslogger.setFormatter(

3077

logging.Formatter('Mandos ({}) [%(process)d]:'

3078

' %(levelname)s: %(message)s'.format(

3079

server_settings["servicename"])))

3080

2437

syslogger.setFormatter(logging.Formatter

2438

('Mandos ({0}) [%(process)d]:'

2439

' %(levelname)s: %(message)s'

2440

.format(server_settings

2441

["servicename"])))

2442

3081

2443

# Parse config file with clients

3082

2444

client_config = configparser.SafeConfigParser(Client

3083

2445

.client_defaults)

3084

2446

client_config.read(os.path.join(server_settings["configdir"],

3085

2447

"clients.conf"))

3086

2448

3087

2449

global mandos_dbus_service

3088

2450

mandos_dbus_service = None

3089

3090

socketfd = None

3091

if server_settings["socket"] != "":

3092

socketfd = server_settings["socket"]

3093

tcp_server = MandosServer(

3094

(server_settings["address"], server_settings["port"]),

3095

ClientHandler,

3096

interface=(server_settings["interface"] or None),

3097

use_ipv6=use_ipv6,

3098

gnutls_priority=server_settings["priority"],

3099

use_dbus=use_dbus,

3100

socketfd=socketfd)

2451

2452

tcp_server = MandosServer((server_settings["address"],

2453

server_settings["port"]),

2454

ClientHandler,

2455

interface=(server_settings["interface"]

2456

or None),

2457

use_ipv6=use_ipv6,

2458

gnutls_priority=

2459

server_settings["priority"],

2460

use_dbus=use_dbus,

2461

socketfd=(server_settings["socket"]

2462

or None))

3101

2463

if not foreground:

3102

2464

pidfilename = "/run/mandos.pid"

3103

2465

if not os.path.isdir("/run/."):

3104

2466

pidfilename = "/var/run/mandos.pid"

3105

2467

pidfile = None

3106

2468

try:

3107

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2469

pidfile = open(pidfilename, "w")

3108

2470

except IOError as e:

3109

2471

logger.error("Could not open file %r", pidfilename,

3110

2472

exc_info=e)

3111

3112

for name, group in (("_mandos", "_mandos"),

3113

("mandos", "mandos"),

3114

("nobody", "nogroup")):

2473

2474

for name in ("_mandos", "mandos", "nobody"):

3115

2475

try:

3116

2476

uid = pwd.getpwnam(name).pw_uid

3117

gid = pwd.getpwnam(group).pw_gid

2477

gid = pwd.getpwnam(name).pw_gid

3118

2478

break

3119

2479

except KeyError:

3120

2480

continue

3124

2484

try:

3125

2485

os.setgid(gid)

3126

2486

os.setuid(uid)

3127

if debug:

3128

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3129

gid))

3130

2487

except OSError as error:

3131

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3132

.format(uid, gid, os.strerror(error.errno)))

3133

2488

if error.errno != errno.EPERM:

3134

2489

raise

3135

2490

3136

2491

if debug:

3137

2492

# Enable all possible GnuTLS debugging

3138

2493

3139

2494

# "Use a log level over 10 to enable all debugging options."

3140

2495

# - GnuTLS manual

3141

gnutls.global_set_log_level(11)

3142

3143

@gnutls.log_func

2496

gnutls.library.functions.gnutls_global_set_log_level(11)

2497

2498

@gnutls.library.types.gnutls_log_func

3144

2499

def debug_gnutls(level, string):

3145

2500

logger.debug("GnuTLS: %s", string[:-1])

3146

3147

gnutls.global_set_log_function(debug_gnutls)

3148

2501

2502

(gnutls.library.functions

2503

.gnutls_global_set_log_function(debug_gnutls))

2504

3149

2505

# Redirect stdin so all checkers get /dev/null

3150

2506

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3151

2507

os.dup2(null, sys.stdin.fileno())

3152

2508

if null > 2:

3153

2509

os.close(null)

3154

2510

3155

2511

# Need to fork before connecting to D-Bus

3156

2512

if not foreground:

3157

2513

# Close all input and output, do double fork, etc.

3158

2514

daemon()

3159

3160

# multiprocessing will use threads, so before we use GLib we need

3161

# to inform GLib that threads will be used.

3162

GLib.threads_init()

3163

2515

2516

# multiprocessing will use threads, so before we use gobject we

2517

# need to inform gobject that threads will be used.

2518

gobject.threads_init()

2519

3164

2520

global main_loop

3165

2521

# From the Avahi example code

3166

2522

DBusGMainLoop(set_as_default=True)

3167

main_loop = GLib.MainLoop()

2523

main_loop = gobject.MainLoop()

3168

2524

bus = dbus.SystemBus()

3169

2525

# End of Avahi example code

3170

2526

if use_dbus:

3171

2527

try:

3172

2528

bus_name = dbus.service.BusName("se.recompile.Mandos",

3173

bus,

3174

do_not_queue=True)

3175

old_bus_name = dbus.service.BusName(

3176

"se.bsnet.fukt.Mandos", bus,

3177

do_not_queue=True)

3178

except dbus.exceptions.DBusException as e:

2529

bus, do_not_queue=True)

2530

old_bus_name = (dbus.service.BusName

2531

("se.bsnet.fukt.Mandos", bus,

2532

do_not_queue=True))

2533

except dbus.exceptions.NameExistsException as e:

3179

2534

logger.error("Disabling D-Bus:", exc_info=e)

3180

2535

use_dbus = False

3181

2536

server_settings["use_dbus"] = False

3182

2537

tcp_server.use_dbus = False

3183

if zeroconf:

3184

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3185

service = AvahiServiceToSyslog(

3186

name=server_settings["servicename"],

3187

servicetype="_mandos._tcp",

3188

protocol=protocol,

3189

bus=bus)

3190

if server_settings["interface"]:

3191

service.interface = if_nametoindex(

3192

server_settings["interface"].encode("utf-8"))

3193

2538

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2539

service = AvahiServiceToSyslog(name =

2540

server_settings["servicename"],

2541

servicetype = "_mandos._tcp",

2542

protocol = protocol, bus = bus)

2543

if server_settings["interface"]:

2544

service.interface = (if_nametoindex

2545

(str(server_settings["interface"])))

2546

3194

2547

global multiprocessing_manager

3195

2548

multiprocessing_manager = multiprocessing.Manager()

3196

2549

3197

2550

client_class = Client

3198

2551

if use_dbus:

3199

client_class = functools.partial(ClientDBus, bus=bus)

3200

2552

client_class = functools.partial(ClientDBus, bus = bus)

2553

3201

2554

client_settings = Client.config_parser(client_config)

3202

2555

old_client_settings = {}

3203

2556

clients_data = {}

3204

2557

3205

2558

# This is used to redirect stdout and stderr for checker processes

3206

2559

global wnull

3207

wnull = open(os.devnull, "w") # A writable /dev/null

2560

wnull = open(os.devnull, "w") # A writable /dev/null

3208

2561

# Only used if server is running in foreground but not in debug

3209

2562

# mode

3210

2563

if debug or not foreground:

3211

2564

wnull.close()

3212

2565

3213

2566

# Get client data and settings from last running state.

3214

2567

if server_settings["restore"]:

3215

2568

try:

3216

2569

with open(stored_state_path, "rb") as stored_state:

3217

if sys.version_info.major == 2:

3218

clients_data, old_client_settings = pickle.load(

3219

stored_state)

3220

else:

3221

bytes_clients_data, bytes_old_client_settings = (

3222

pickle.load(stored_state, encoding="bytes"))

3223

# Fix bytes to strings

3224

# clients_data

3225

# .keys()

3226

clients_data = {(key.decode("utf-8")

3227

if isinstance(key, bytes)

3228

else key): value

3229

for key, value in

3230

bytes_clients_data.items()}

3231

del bytes_clients_data

3232

for key in clients_data:

3233

value = {(k.decode("utf-8")

3234

if isinstance(k, bytes) else k): v

3235

for k, v in

3236

clients_data[key].items()}

3237

clients_data[key] = value

3238

# .client_structure

3239

value["client_structure"] = [

3240

(s.decode("utf-8")

3241

if isinstance(s, bytes)

3242

else s) for s in

3243

value["client_structure"]]

3244

# .name & .host

3245

for k in ("name", "host"):

3246

if isinstance(value[k], bytes):

3247

value[k] = value[k].decode("utf-8")

3248

if "key_id" not in value:

3249

value["key_id"] = ""

3250

elif "fingerprint" not in value:

3251

value["fingerprint"] = ""

3252

# old_client_settings

3253

# .keys()

3254

old_client_settings = {

3255

(key.decode("utf-8")

3256

if isinstance(key, bytes)

3257

else key): value

3258

for key, value in

3259

bytes_old_client_settings.items()}

3260

del bytes_old_client_settings

3261

# .host

3262

for value in old_client_settings.values():

3263

if isinstance(value["host"], bytes):

3264

value["host"] = (value["host"]

3265

.decode("utf-8"))

2570

clients_data, old_client_settings = (pickle.load

2571

(stored_state))

3266

2572

os.remove(stored_state_path)

3267

2573

except IOError as e:

3268

2574

if e.errno == errno.ENOENT:

3269

logger.warning("Could not load persistent state:"

3270

" {}".format(os.strerror(e.errno)))

2575

logger.warning("Could not load persistent state: {0}"

2576

.format(os.strerror(e.errno)))

3271

2577

else:

3272

2578

logger.critical("Could not load persistent state:",

3273

2579

exc_info=e)

3274

2580

raise

3275

2581

except EOFError as e:

3276

2582

logger.warning("Could not load persistent state: "

3277

"EOFError:",

3278

exc_info=e)

3279

2583

"EOFError:", exc_info=e)

2584

3280

2585

with PGPEngine() as pgp:

3281

for client_name, client in clients_data.items():

2586

for client_name, client in clients_data.iteritems():

3282

2587

# Skip removed clients

3283

2588

if client_name not in client_settings:

3284

2589

continue

3285

2590

3286

2591

# Decide which value to use after restoring saved state.

3287

2592

# We have three different values: Old config file,

3288

2593

# new config file, and saved state.

3293

2598

# For each value in new config, check if it

3294

2599

# differs from the old config value (Except for

3295

2600

# the "secret" attribute)

3296

if (name != "secret"

3297

and (value !=

3298

old_client_settings[client_name][name])):

2601

if (name != "secret" and

2602

value != old_client_settings[client_name]

2603

[name]):

3299

2604

client[name] = value

3300

2605

except KeyError:

3301

2606

pass

3302

2607

3303

2608

# Clients who has passed its expire date can still be

3304

# enabled if its last checker was successful. A Client

2609

# enabled if its last checker was successful. Clients

3305

2610

# whose checker succeeded before we stored its state is

3306

2611

# assumed to have successfully run all checkers during

3307

2612

# downtime.

3309

2614

if datetime.datetime.utcnow() >= client["expires"]:

3310

2615

if not client["last_checked_ok"]:

3311

2616

logger.warning(

3312

"disabling client {} - Client never "

3313

"performed a successful checker".format(

3314

client_name))

2617

"disabling client {0} - Client never "

2618

"performed a successful checker"

2619

.format(client_name))

3315

2620

client["enabled"] = False

3316

2621

elif client["last_checker_status"] != 0:

3317

2622

logger.warning(

3318

"disabling client {} - Client last"

3319

" checker failed with error code"

3320

" {}".format(

3321

client_name,

3322

client["last_checker_status"]))

2623

"disabling client {0} - Client "

2624

"last checker failed with error code {1}"

2625

.format(client_name,

2626

client["last_checker_status"]))

3323

2627

client["enabled"] = False

3324

2628

else:

3325

client["expires"] = (

3326

datetime.datetime.utcnow()

3327

+ client["timeout"])

2629

client["expires"] = (datetime.datetime

2630

.utcnow()

2631

+ client["timeout"])

3328

2632

logger.debug("Last checker succeeded,"

3329

" keeping {} enabled".format(

3330

client_name))

2633

" keeping {0} enabled"

2634

.format(client_name))

3331

2635

try:

3332

client["secret"] = pgp.decrypt(

3333

client["encrypted_secret"],

3334

client_settings[client_name]["secret"])

2636

client["secret"] = (

2637

pgp.decrypt(client["encrypted_secret"],

2638

client_settings[client_name]

2639

["secret"]))

3335

2640

except PGPError:

3336

2641

# If decryption fails, we use secret from new settings

3337

logger.debug("Failed to decrypt {} old secret".format(

3338

client_name))

3339

client["secret"] = (client_settings[client_name]

3340

["secret"])

3341

2642

logger.debug("Failed to decrypt {0} old secret"

2643

.format(client_name))

2644

client["secret"] = (

2645

client_settings[client_name]["secret"])

2646

3342

2647

# Add/remove clients based on new changes made to config

3343

2648

for client_name in (set(old_client_settings)

3344

2649

- set(client_settings)):

3346

2651

for client_name in (set(client_settings)

3347

2652

- set(old_client_settings)):

3348

2653

clients_data[client_name] = client_settings[client_name]

3349

2654

3350

2655

# Create all client objects

3351

for client_name, client in clients_data.items():

2656

for client_name, client in clients_data.iteritems():

3352

2657

tcp_server.clients[client_name] = client_class(

3353

name=client_name,

3354

settings=client,

3355

server_settings=server_settings)

3356

2658

name = client_name, settings = client,

2659

server_settings = server_settings)

2660

3357

2661

if not tcp_server.clients:

3358

2662

logger.warning("No clients defined")

3359

2663

3360

2664

if not foreground:

3361

2665

if pidfile is not None:

3362

pid = os.getpid()

3363

2666

try:

3364

2667

with pidfile:

3365

print(pid, file=pidfile)

2668

pid = os.getpid()

2669

pidfile.write(str(pid) + "\n".encode("utf-8"))

3366

2670

except IOError:

3367

2671

logger.error("Could not write to file %r with PID %d",

3368

2672

pidfilename, pid)

3369

2673

del pidfile

3370

2674

del pidfilename

3371

3372

for termsig in (signal.SIGHUP, signal.SIGTERM):

3373

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3374

lambda: main_loop.quit() and False)

3375

2675

2676

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2677

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2678

3376

2679

if use_dbus:

3377

3378

@alternate_dbus_interfaces(

3379

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3380

class MandosDBusService(DBusObjectWithObjectManager):

2680

@alternate_dbus_interfaces({"se.recompile.Mandos":

2681

"se.bsnet.fukt.Mandos"})

2682

class MandosDBusService(DBusObjectWithProperties):

3381

2683

"""A D-Bus proxy object"""

3382

3383

2684

def __init__(self):

3384

2685

dbus.service.Object.__init__(self, bus, "/")

3385

3386

2686

_interface = "se.recompile.Mandos"

3387

2687

2688

@dbus_interface_annotations(_interface)

2689

def _foo(self):

2690

return { "org.freedesktop.DBus.Property"

2691

".EmitsChangedSignal":

2692

"false"}

2693

3388

2694

@dbus.service.signal(_interface, signature="o")

3389

2695

def ClientAdded(self, objpath):

3390

2696

"D-Bus signal"

3391

2697

pass

3392

2698

3393

2699

@dbus.service.signal(_interface, signature="ss")

3394

def ClientNotFound(self, key_id, address):

2700

def ClientNotFound(self, fingerprint, address):

3395

2701

"D-Bus signal"

3396

2702

pass

3397

3398

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3399

"true"})

2703

3400

2704

@dbus.service.signal(_interface, signature="os")

3401

2705

def ClientRemoved(self, objpath, name):

3402

2706

"D-Bus signal"

3403

2707

pass

3404

3405

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3406

"true"})

2708

3407

2709

@dbus.service.method(_interface, out_signature="ao")

3408

2710

def GetAllClients(self):

3409

2711

"D-Bus method"

3410

return dbus.Array(c.dbus_object_path for c in

3411

tcp_server.clients.values())

3412

3413

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3414

"true"})

2712

return dbus.Array(c.dbus_object_path

2713

for c in

2714

tcp_server.clients.itervalues())

2715

3415

2716

@dbus.service.method(_interface,

3416

2717

out_signature="a{oa{sv}}")

3417

2718

def GetAllClientsWithProperties(self):

3418

2719

"D-Bus method"

3419

2720

return dbus.Dictionary(

3420

{c.dbus_object_path: c.GetAll(

3421

"se.recompile.Mandos.Client")

3422

for c in tcp_server.clients.values()},

2721

((c.dbus_object_path, c.GetAll(""))

2722

for c in tcp_server.clients.itervalues()),

3423

2723

signature="oa{sv}")

3424

2724

3425

2725

@dbus.service.method(_interface, in_signature="o")

3426

2726

def RemoveClient(self, object_path):

3427

2727

"D-Bus method"

3428

for c in tcp_server.clients.values():

2728

for c in tcp_server.clients.itervalues():

3429

2729

if c.dbus_object_path == object_path:

3430

2730

del tcp_server.clients[c.name]

3431

2731

c.remove_from_connection()

3432

# Don't signal the disabling

2732

# Don't signal anything except ClientRemoved

3433

2733

c.disable(quiet=True)

3434

# Emit D-Bus signal for removal

3435

self.client_removed_signal(c)

2734

# Emit D-Bus signal

2735

self.ClientRemoved(object_path, c.name)

3436

2736

return

3437

2737

raise KeyError(object_path)

3438

2738

3439

2739

del _interface

3440

3441

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3442

out_signature="a{oa{sa{sv}}}")

3443

def GetManagedObjects(self):

3444

"""D-Bus method"""

3445

return dbus.Dictionary(

3446

{client.dbus_object_path:

3447

dbus.Dictionary(

3448

{interface: client.GetAll(interface)

3449

for interface in

3450

client._get_all_interface_names()})

3451

for client in tcp_server.clients.values()})

3452

3453

def client_added_signal(self, client):

3454

"""Send the new standard signal and the old signal"""

3455

if use_dbus:

3456

# New standard signal

3457

self.InterfacesAdded(

3458

client.dbus_object_path,

3459

dbus.Dictionary(

3460

{interface: client.GetAll(interface)

3461

for interface in

3462

client._get_all_interface_names()}))

3463

# Old signal

3464

self.ClientAdded(client.dbus_object_path)

3465

3466

def client_removed_signal(self, client):

3467

"""Send the new standard signal and the old signal"""

3468

if use_dbus:

3469

# New standard signal

3470

self.InterfacesRemoved(

3471

client.dbus_object_path,

3472

client._get_all_interface_names())

3473

# Old signal

3474

self.ClientRemoved(client.dbus_object_path,

3475

client.name)

3476

2740

3477

2741

mandos_dbus_service = MandosDBusService()

3478

3479

# Save modules to variables to exempt the modules from being

3480

# unloaded before the function registered with atexit() is run.

3481

mp = multiprocessing

3482

wn = wnull

3483

2742

3484

2743

def cleanup():

3485

2744

"Cleanup function; run on exit"

3486

if zeroconf:

3487

service.cleanup()

3488

3489

mp.active_children()

3490

wn.close()

2745

service.cleanup()

2746

2747

multiprocessing.active_children()

2748

wnull.close()

3491

2749

if not (tcp_server.clients or client_settings):

3492

2750

return

3493

2751

3494

2752

# Store client before exiting. Secrets are encrypted with key

3495

2753

# based on what config file has. If config file is

3496

2754

# removed/edited, old secret will thus be unrecovable.

3497

2755

clients = {}

3498

2756

with PGPEngine() as pgp:

3499

for client in tcp_server.clients.values():

2757

for client in tcp_server.clients.itervalues():

3500

2758

key = client_settings[client.name]["secret"]

3501

2759

client.encrypted_secret = pgp.encrypt(client.secret,

3502

2760

key)

3503

2761

client_dict = {}

3504

2762

3505

2763

# A list of attributes that can not be pickled

3506

2764

# + secret.

3507

exclude = {"bus", "changedstate", "secret",

3508

"checker", "server_settings"}

3509

for name, typ in inspect.getmembers(dbus.service

3510

.Object):

2765

exclude = set(("bus", "changedstate", "secret",

2766

"checker", "server_settings"))

2767

for name, typ in (inspect.getmembers

2768

(dbus.service.Object)):

3511

2769

exclude.add(name)

3512

2770

3513

2771

client_dict["encrypted_secret"] = (client

3514

2772

.encrypted_secret)

3515

2773

for attr in client.client_structure:

3516

2774

if attr not in exclude:

3517

2775

client_dict[attr] = getattr(client, attr)

3518

2776

3519

2777

clients[client.name] = client_dict

3520

2778

del client_settings[client.name]["secret"]

3521

2779

3522

2780

try:

3523

with tempfile.NamedTemporaryFile(

3524

mode='wb',

3525

suffix=".pickle",

3526

prefix='clients-',

3527

dir=os.path.dirname(stored_state_path),

3528

delete=False) as stored_state:

3529

pickle.dump((clients, client_settings), stored_state,

3530

protocol=2)

3531

tempname = stored_state.name

2781

with (tempfile.NamedTemporaryFile

2782

(mode='wb', suffix=".pickle", prefix='clients-',

2783

dir=os.path.dirname(stored_state_path),

2784

delete=False)) as stored_state:

2785

pickle.dump((clients, client_settings), stored_state)

2786

tempname=stored_state.name

3532

2787

os.rename(tempname, stored_state_path)

3533

2788

except (IOError, OSError) as e:

3534

2789

if not debug:

3537

2792

except NameError:

3538

2793

pass

3539

2794

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3540

logger.warning("Could not save persistent state: {}"

2795

logger.warning("Could not save persistent state: {0}"

3541

2796

.format(os.strerror(e.errno)))

3542

2797

else:

3543

2798

logger.warning("Could not save persistent state:",

3544

2799

exc_info=e)

3545

2800

raise

3546

2801

3547

2802

# Delete all clients, and settings from config

3548

2803

while tcp_server.clients:

3549

2804

name, client = tcp_server.clients.popitem()

3550

2805

if use_dbus:

3551

2806

client.remove_from_connection()

3552

# Don't signal the disabling

2807

# Don't signal anything except ClientRemoved

3553

2808

client.disable(quiet=True)

3554

# Emit D-Bus signal for removal

3555

2809

if use_dbus:

3556

mandos_dbus_service.client_removed_signal(client)

2810

# Emit D-Bus signal

2811

mandos_dbus_service.ClientRemoved(client

2812

.dbus_object_path,

2813

client.name)

3557

2814

client_settings.clear()

3558

2815

3559

2816

atexit.register(cleanup)

3560

3561

for client in tcp_server.clients.values():

2817

2818

for client in tcp_server.clients.itervalues():

3562

2819

if use_dbus:

3563

# Emit D-Bus signal for adding

3564

mandos_dbus_service.client_added_signal(client)

2820

# Emit D-Bus signal

2821

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3565

2822

# Need to initiate checking of clients

3566

2823

if client.enabled:

3567

2824

client.init_checker()

3568

2825

3569

2826

tcp_server.enable()

3570

2827

tcp_server.server_activate()

3571

2828

3572

2829

# Find out what port we got

3573

if zeroconf:

3574

service.port = tcp_server.socket.getsockname()[1]

2830

service.port = tcp_server.socket.getsockname()[1]

3575

2831

if use_ipv6:

3576

2832

logger.info("Now listening on address %r, port %d,"

3577

2833

" flowinfo %d, scope_id %d",

3579

2835

else: # IPv4

3580

2836

logger.info("Now listening on address %r, port %d",

3581

2837

*tcp_server.socket.getsockname())

3582

3583

# service.interface = tcp_server.socket.getsockname()[3]

3584

2838

2839

#service.interface = tcp_server.socket.getsockname()[3]

2840

3585

2841

try:

3586

if zeroconf:

3587

# From the Avahi example code

3588

try:

3589

service.activate()

3590

except dbus.exceptions.DBusException as error:

3591

logger.critical("D-Bus Exception", exc_info=error)

3592

cleanup()

3593

sys.exit(1)

3594

# End of Avahi example code

3595

3596

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3597

lambda *args, **kwargs:

3598

(tcp_server.handle_request

3599

(*args[2:], **kwargs) or True))

3600

2842

# From the Avahi example code

2843

try:

2844

service.activate()

2845

except dbus.exceptions.DBusException as error:

2846

logger.critical("D-Bus Exception", exc_info=error)

2847

cleanup()

2848

sys.exit(1)

2849

# End of Avahi example code

2850

2851

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2852

lambda *args, **kwargs:

2853

(tcp_server.handle_request

2854

(*args[2:], **kwargs) or True))

2855

3601

2856

logger.debug("Starting main loop")

3602

2857

main_loop.run()

3603

2858

except AvahiError as error:

3612

2867

# Must run before the D-Bus bus name gets deregistered

3613

2868

cleanup()

3614

2869

3615

3616

2870

if __name__ == '__main__':

3617

2871

main()