/mandos/release : revision 237.7.249

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

72

84

73

import dbus

85

74

import dbus.service

86

import gi

87

from gi.repository import GLib

75

import gobject

76

import avahi

88

77

from dbus.mainloop.glib import DBusGMainLoop

89

78

import ctypes

90

79

import ctypes.util

91

80

import xml.dom.minidom

92

81

import inspect

93

82

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

83

try:

122

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

85

except AttributeError:

124

86

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

87

from IN import SO_BINDTODEVICE

128

88

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.12"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.5"

147

92

stored_state_file = "clients.pickle"

148

93

149

94

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

95

syslogger = None

152

96

153

97

try:

154

if_nametoindex = ctypes.cdll.LoadLibrary(

155

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

156

101

except (OSError, AttributeError):

157

158

102

def if_nametoindex(interface):

159

103

"Get an interface index the hard way, i.e. using fcntl()"

160

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

161

105

with contextlib.closing(socket.socket()) as s:

162

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

163

struct.pack(b"16s16x", interface))

164

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

165

111

return interface_index

166

112

167

113

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

114

def initlogger(debug, level=logging.WARNING):

185

115

"""init logger and add loglevel"""

186

116

187

117

global syslogger

188

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

118

syslogger = (logging.handlers.SysLogHandler

119

(facility =

120

logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = str("/dev/log")))

191

122

syslogger.setFormatter(logging.Formatter

192

123

('Mandos [%(process)d]: %(levelname)s:'

193

124

' %(message)s'))

194

125

logger.addHandler(syslogger)

195

126

196

127

if debug:

197

128

console = logging.StreamHandler()

198

129

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

208

139

pass

209

140

210

141

211

class PGPEngine:

142

class PGPEngine(object):

212

143

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

214

144

def __init__(self):

215

145

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

146

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

147

'--home', self.tempdir,

229

148

'--force-mdc',

230

'--quiet']

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

149

'--quiet',

150

'--no-use-agent']

151

235

152

def __enter__(self):

236

153

return self

237

154

238

155

def __exit__(self, exc_type, exc_value, traceback):

239

156

self._cleanup()

240

157

return False

241

158

242

159

def __del__(self):

243

160

self._cleanup()

244

161

245

162

def _cleanup(self):

246

163

if self.tempdir is not None:

247

164

# Delete contents of tempdir

248

165

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

166

topdown = False):

250

167

for filename in files:

251

168

os.remove(os.path.join(root, filename))

252

169

for dirname in dirs:

254

171

# Remove tempdir

255

172

os.rmdir(self.tempdir)

256

173

self.tempdir = None

257

174

258

175

def password_encode(self, password):

259

176

# Passphrase can not be empty and can not contain newlines or

260

177

# NUL bytes. So we prefix it and hex encode it.

265

182

.replace(b"\n", b"\\n")

266

183

.replace(b"\0", b"\\x00"))

267

184

return encoded

268

185

269

186

def encrypt(self, data, password):

270

187

passphrase = self.password_encode(password)

271

with tempfile.NamedTemporaryFile(

272

dir=self.tempdir) as passfile:

188

with tempfile.NamedTemporaryFile(dir=self.tempdir

189

) as passfile:

273

190

passfile.write(passphrase)

274

191

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

192

proc = subprocess.Popen(['gpg', '--symmetric',

276

193

'--passphrase-file',

277

194

passfile.name]

278

195

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

196

stdin = subprocess.PIPE,

197

stdout = subprocess.PIPE,

198

stderr = subprocess.PIPE)

199

ciphertext, err = proc.communicate(input = data)

283

200

if proc.returncode != 0:

284

201

raise PGPError(err)

285

202

return ciphertext

286

203

287

204

def decrypt(self, data, password):

288

205

passphrase = self.password_encode(password)

289

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

206

with tempfile.NamedTemporaryFile(dir = self.tempdir

207

) as passfile:

291

208

passfile.write(passphrase)

292

209

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

210

proc = subprocess.Popen(['gpg', '--decrypt',

294

211

'--passphrase-file',

295

212

passfile.name]

296

213

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

214

stdin = subprocess.PIPE,

215

stdout = subprocess.PIPE,

216

stderr = subprocess.PIPE)

217

decrypted_plaintext, err = proc.communicate(input

218

= data)

301

219

if proc.returncode != 0:

302

220

raise PGPError(err)

303

221

return decrypted_plaintext

304

222

305

223

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

224

class AvahiError(Exception):

333

225

def __init__(self, value, *args, **kwargs):

334

226

self.value = value

335

return super(AvahiError, self).__init__(value, *args,

336

**kwargs)

337

227

super(AvahiError, self).__init__(value, *args, **kwargs)

228

def __unicode__(self):

229

return unicode(repr(self.value))

338

230

339

231

class AvahiServiceError(AvahiError):

340

232

pass

341

233

342

343

234

class AvahiGroupError(AvahiError):

344

235

pass

345

236

346

237

347

class AvahiService:

238

class AvahiService(object):

348

239

"""An Avahi (Zeroconf) service.

349

240

350

241

Attributes:

351

242

interface: integer; avahi.IF_UNSPEC or an interface index.

352

243

Used to optionally bind to the specified interface.

364

255

server: D-Bus Server

365

256

bus: dbus.SystemBus()

366

257

"""

367

368

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

258

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

379

263

self.interface = interface

380

264

self.name = name

381

265

self.type = servicetype

390

274

self.server = None

391

275

self.bus = bus

392

276

self.entry_group_state_changed_match = None

393

394

def rename(self, remove=True):

277

278

def rename(self):

395

279

"""Derived from the Avahi example code"""

396

280

if self.rename_count >= self.max_renames:

397

281

logger.critical("No suitable Zeroconf service name found"

398

282

" after %i retries, exiting.",

399

283

self.rename_count)

400

284

raise AvahiServiceError("Too many renames")

401

self.name = str(

402

self.server.GetAlternativeServiceName(self.name))

403

self.rename_count += 1

285

self.name = unicode(self.server

286

.GetAlternativeServiceName(self.name))

404

287

logger.info("Changing Zeroconf service name to %r ...",

405

288

self.name)

406

if remove:

407

self.remove()

289

self.remove()

408

290

try:

409

291

self.add()

410

292

except dbus.exceptions.DBusException as error:

411

if (error.get_dbus_name()

412

== "org.freedesktop.Avahi.CollisionError"):

413

logger.info("Local Zeroconf service name collision.")

414

return self.rename(remove=False)

415

else:

416

logger.critical("D-Bus Exception", exc_info=error)

417

self.cleanup()

418

os._exit(1)

419

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

297

420

298

def remove(self):

421

299

"""Derived from the Avahi example code"""

422

300

if self.entry_group_state_changed_match is not None:

424

302

self.entry_group_state_changed_match = None

425

303

if self.group is not None:

426

304

self.group.Reset()

427

305

428

306

def add(self):

429

307

"""Derived from the Avahi example code"""

430

308

self.remove()

447

325

dbus.UInt16(self.port),

448

326

avahi.string_array_to_txt_array(self.TXT))

449

327

self.group.Commit()

450

328

451

329

def entry_group_state_changed(self, state, error):

452

330

"""Derived from the Avahi example code"""

453

331

logger.debug("Avahi entry group state change: %i", state)

454

332

455

333

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

334

logger.debug("Zeroconf service established.")

457

335

elif state == avahi.ENTRY_GROUP_COLLISION:

459

337

self.rename()

460

338

elif state == avahi.ENTRY_GROUP_FAILURE:

461

339

logger.critical("Avahi: Error in group state changed %s",

462

str(error))

463

raise AvahiGroupError("State changed: {!s}".format(error))

464

340

unicode(error))

341

raise AvahiGroupError("State changed: {0!s}"

342

.format(error))

343

465

344

def cleanup(self):

466

345

"""Derived from the Avahi example code"""

467

346

if self.group is not None:

472

351

pass

473

352

self.group = None

474

353

self.remove()

475

354

476

355

def server_state_changed(self, state, error=None):

477

356

"""Derived from the Avahi example code"""

478

357

logger.debug("Avahi server state change: %i", state)

479

bad_states = {

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

avahi.SERVER_REGISTERING: None,

482

avahi.SERVER_COLLISION: "Zeroconf server name collision",

483

avahi.SERVER_FAILURE: "Zeroconf server failure",

484

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

485

365

if state in bad_states:

486

366

if bad_states[state] is not None:

487

367

if error is None:

490

370

logger.error(bad_states[state] + ": %r", error)

491

371

self.cleanup()

492

372

elif state == avahi.SERVER_RUNNING:

493

try:

494

self.add()

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

logger.info("Local Zeroconf service name"

499

" collision.")

500

return self.rename(remove=False)

501

else:

502

logger.critical("D-Bus Exception", exc_info=error)

503

self.cleanup()

504

os._exit(1)

373

self.add()

505

374

else:

506

375

if error is None:

507

376

logger.debug("Unknown state: %r", state)

508

377

else:

509

378

logger.debug("Unknown state: %r: %r", state, error)

510

379

511

380

def activate(self):

512

381

"""Derived from the Avahi example code"""

513

382

if self.server is None:

517

386

follow_name_owner_changes=True),

518

387

avahi.DBUS_INTERFACE_SERVER)

519

388

self.server.connect_to_signal("StateChanged",

520

self.server_state_changed)

389

self.server_state_changed)

521

390

self.server_state_changed(self.server.GetState())

522

391

523

392

524

393

class AvahiServiceToSyslog(AvahiService):

525

def rename(self, *args, **kwargs):

394

def rename(self):

526

395

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

529

syslogger.setFormatter(logging.Formatter(

530

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({0}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

532

401

return ret

533

402

534

403

535

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

538

539

library = ctypes.util.find_library("gnutls")

540

if library is None:

541

library = ctypes.util.find_library("gnutls-deb0")

542

_library = ctypes.cdll.LoadLibrary(library)

543

del library

544

545

# Unless otherwise indicated, the constants and types below are

546

# all from the gnutls/gnutls.h C header file.

547

548

# Constants

549

E_SUCCESS = 0

550

E_INTERRUPTED = -52

551

E_AGAIN = -28

552

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

CLIENT = 2

555

SHUT_RDWR = 0

556

CRD_CERTIFICATE = 1

557

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

565

# Types

566

class session_int(ctypes.Structure):

567

_fields_ = []

568

session_t = ctypes.POINTER(session_int)

569

570

class certificate_credentials_st(ctypes.Structure):

571

_fields_ = []

572

certificate_credentials_t = ctypes.POINTER(

573

certificate_credentials_st)

574

certificate_type_t = ctypes.c_int

575

576

class datum_t(ctypes.Structure):

577

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

578

('size', ctypes.c_uint)]

579

580

class openpgp_crt_int(ctypes.Structure):

581

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

credentials_type_t = ctypes.c_int

586

transport_ptr_t = ctypes.c_void_p

587

close_request_t = ctypes.c_int

588

589

# Exceptions

590

class Error(Exception):

591

def __init__(self, message=None, code=None, args=()):

592

# Default usage is by a message string, but if a return

593

# code is passed, convert it to a string with

594

# gnutls.strerror()

595

self.code = code

596

if message is None and code is not None:

597

message = gnutls.strerror(code)

598

return super(gnutls.Error, self).__init__(

599

message, *args)

600

601

class CertificateSecurityError(Error):

602

pass

603

604

# Classes

605

class Credentials:

606

def __init__(self):

607

self._c_object = gnutls.certificate_credentials_t()

608

gnutls.certificate_allocate_credentials(

609

ctypes.byref(self._c_object))

610

self.type = gnutls.CRD_CERTIFICATE

611

612

def __del__(self):

613

gnutls.certificate_free_credentials(self._c_object)

614

615

class ClientSession:

616

def __init__(self, socket, credentials=None):

617

self._c_object = gnutls.session_t()

618

gnutls_flags = gnutls.CLIENT

619

if gnutls.check_version(b"3.5.6"):

620

gnutls_flags |= gnutls.NO_TICKETS

621

if gnutls.has_rawpk:

622

gnutls_flags |= gnutls.ENABLE_RAWPK

623

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

624

del gnutls_flags

625

gnutls.set_default_priority(self._c_object)

626

gnutls.transport_set_ptr(self._c_object, socket.fileno())

627

gnutls.handshake_set_private_extensions(self._c_object,

628

True)

629

self.socket = socket

630

if credentials is None:

631

credentials = gnutls.Credentials()

632

gnutls.credentials_set(self._c_object, credentials.type,

633

ctypes.cast(credentials._c_object,

634

ctypes.c_void_p))

635

self.credentials = credentials

636

637

def __del__(self):

638

gnutls.deinit(self._c_object)

639

640

def handshake(self):

641

return gnutls.handshake(self._c_object)

642

643

def send(self, data):

644

data = bytes(data)

645

data_len = len(data)

646

while data_len > 0:

647

data_len -= gnutls.record_send(self._c_object,

648

data[-data_len:],

649

data_len)

650

651

def bye(self):

652

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

653

654

# Error handling functions

655

def _error_code(result):

656

"""A function to raise exceptions on errors, suitable

657

for the 'restype' attribute on ctypes functions"""

658

if result >= 0:

659

return result

660

if result == gnutls.E_NO_CERTIFICATE_FOUND:

661

raise gnutls.CertificateSecurityError(code=result)

662

raise gnutls.Error(code=result)

663

664

def _retry_on_error(result, func, arguments):

665

"""A function to retry on some errors, suitable

666

for the 'errcheck' attribute on ctypes functions"""

667

while result < 0:

668

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

669

return _error_code(result)

670

result = func(*arguments)

671

return result

672

673

# Unless otherwise indicated, the function declarations below are

674

# all from the gnutls/gnutls.h C header file.

675

676

# Functions

677

priority_set_direct = _library.gnutls_priority_set_direct

678

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

679

ctypes.POINTER(ctypes.c_char_p)]

680

priority_set_direct.restype = _error_code

681

682

init = _library.gnutls_init

683

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

684

init.restype = _error_code

685

686

set_default_priority = _library.gnutls_set_default_priority

687

set_default_priority.argtypes = [session_t]

688

set_default_priority.restype = _error_code

689

690

record_send = _library.gnutls_record_send

691

record_send.argtypes = [session_t, ctypes.c_void_p,

692

ctypes.c_size_t]

693

record_send.restype = ctypes.c_ssize_t

694

record_send.errcheck = _retry_on_error

695

696

certificate_allocate_credentials = (

697

_library.gnutls_certificate_allocate_credentials)

698

certificate_allocate_credentials.argtypes = [

699

ctypes.POINTER(certificate_credentials_t)]

700

certificate_allocate_credentials.restype = _error_code

701

702

certificate_free_credentials = (

703

_library.gnutls_certificate_free_credentials)

704

certificate_free_credentials.argtypes = [

705

certificate_credentials_t]

706

certificate_free_credentials.restype = None

707

708

handshake_set_private_extensions = (

709

_library.gnutls_handshake_set_private_extensions)

710

handshake_set_private_extensions.argtypes = [session_t,

711

ctypes.c_int]

712

handshake_set_private_extensions.restype = None

713

714

credentials_set = _library.gnutls_credentials_set

715

credentials_set.argtypes = [session_t, credentials_type_t,

716

ctypes.c_void_p]

717

credentials_set.restype = _error_code

718

719

strerror = _library.gnutls_strerror

720

strerror.argtypes = [ctypes.c_int]

721

strerror.restype = ctypes.c_char_p

722

723

certificate_type_get = _library.gnutls_certificate_type_get

724

certificate_type_get.argtypes = [session_t]

725

certificate_type_get.restype = _error_code

726

727

certificate_get_peers = _library.gnutls_certificate_get_peers

728

certificate_get_peers.argtypes = [session_t,

729

ctypes.POINTER(ctypes.c_uint)]

730

certificate_get_peers.restype = ctypes.POINTER(datum_t)

731

732

global_set_log_level = _library.gnutls_global_set_log_level

733

global_set_log_level.argtypes = [ctypes.c_int]

734

global_set_log_level.restype = None

735

736

global_set_log_function = _library.gnutls_global_set_log_function

737

global_set_log_function.argtypes = [log_func]

738

global_set_log_function.restype = None

739

740

deinit = _library.gnutls_deinit

741

deinit.argtypes = [session_t]

742

deinit.restype = None

743

744

handshake = _library.gnutls_handshake

745

handshake.argtypes = [session_t]

746

handshake.restype = _error_code

747

handshake.errcheck = _retry_on_error

748

749

transport_set_ptr = _library.gnutls_transport_set_ptr

750

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

751

transport_set_ptr.restype = None

752

753

bye = _library.gnutls_bye

754

bye.argtypes = [session_t, close_request_t]

755

bye.restype = _error_code

756

bye.errcheck = _retry_on_error

757

758

check_version = _library.gnutls_check_version

759

check_version.argtypes = [ctypes.c_char_p]

760

check_version.restype = ctypes.c_char_p

761

762

_need_version = b"3.3.0"

763

if check_version(_need_version) is None:

764

raise self.Error("Needs GnuTLS {} or later"

765

.format(_need_version))

766

767

_tls_rawpk_version = b"3.6.6"

768

has_rawpk = bool(check_version(_tls_rawpk_version))

769

770

if has_rawpk:

771

# Types

772

class pubkey_st(ctypes.Structure):

773

_fields = []

774

pubkey_t = ctypes.POINTER(pubkey_st)

775

776

x509_crt_fmt_t = ctypes.c_int

777

778

# All the function declarations below are from

779

# gnutls/abstract.h

780

pubkey_init = _library.gnutls_pubkey_init

781

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

782

pubkey_init.restype = _error_code

783

784

pubkey_import = _library.gnutls_pubkey_import

785

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

786

x509_crt_fmt_t]

787

pubkey_import.restype = _error_code

788

789

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

790

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

791

ctypes.POINTER(ctypes.c_ubyte),

792

ctypes.POINTER(ctypes.c_size_t)]

793

pubkey_get_key_id.restype = _error_code

794

795

pubkey_deinit = _library.gnutls_pubkey_deinit

796

pubkey_deinit.argtypes = [pubkey_t]

797

pubkey_deinit.restype = None

798

else:

799

# All the function declarations below are from

800

# gnutls/openpgp.h

801

802

openpgp_crt_init = _library.gnutls_openpgp_crt_init

803

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

804

openpgp_crt_init.restype = _error_code

805

806

openpgp_crt_import = _library.gnutls_openpgp_crt_import

807

openpgp_crt_import.argtypes = [openpgp_crt_t,

808

ctypes.POINTER(datum_t),

809

openpgp_crt_fmt_t]

810

openpgp_crt_import.restype = _error_code

811

812

openpgp_crt_verify_self = \

813

_library.gnutls_openpgp_crt_verify_self

814

openpgp_crt_verify_self.argtypes = [

815

openpgp_crt_t,

816

ctypes.c_uint,

817

ctypes.POINTER(ctypes.c_uint),

818

]

819

openpgp_crt_verify_self.restype = _error_code

820

821

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

822

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

823

openpgp_crt_deinit.restype = None

824

825

openpgp_crt_get_fingerprint = (

826

_library.gnutls_openpgp_crt_get_fingerprint)

827

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

828

ctypes.c_void_p,

829

ctypes.POINTER(

830

ctypes.c_size_t)]

831

openpgp_crt_get_fingerprint.restype = _error_code

832

833

if check_version(b"3.6.4"):

834

certificate_type_get2 = _library.gnutls_certificate_type_get2

835

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

836

certificate_type_get2.restype = _error_code

837

838

# Remove non-public functions

839

del _error_code, _retry_on_error

840

841

842

def call_pipe(connection, # : multiprocessing.Connection

843

func, *args, **kwargs):

844

"""This function is meant to be called by multiprocessing.Process

845

846

This function runs func(*args, **kwargs), and writes the resulting

847

return value on the provided multiprocessing.Connection.

848

"""

849

connection.send(func(*args, **kwargs))

850

connection.close()

851

852

853

class Client:

404

def timedelta_to_milliseconds(td):

405

"Convert a datetime.timedelta() to milliseconds"

406

return ((td.days * 24 * 60 * 60 * 1000)

407

+ (td.seconds * 1000)

408

+ (td.microseconds // 1000))

409

410

411

class Client(object):

854

412

"""A representation of a client host served by this server.

855

413

856

414

Attributes:

857

415

approved: bool(); 'None' if not yet approved/disapproved

858

416

approval_delay: datetime.timedelta(); Time to wait for approval

859

417

approval_duration: datetime.timedelta(); Duration of one approval

860

checker: multiprocessing.Process(); a running checker process used

861

to see if the client lives. 'None' if no process is

862

running.

863

checker_callback_tag: a GLib event source tag, or None

418

checker: subprocess.Popen(); a running checker process used

419

to see if the client lives.

420

'None' if no process is running.

421

checker_callback_tag: a gobject event source tag, or None

864

422

checker_command: string; External command which is run to check

865

423

if client lives. %() expansions are done at

866

424

runtime with vars(self) as dict, so that for

867

425

instance %(name)s can be used in the command.

868

checker_initiator_tag: a GLib event source tag, or None

426

checker_initiator_tag: a gobject event source tag, or None

869

427

created: datetime.datetime(); (UTC) object creation

870

428

client_structure: Object describing what attributes a client has

871

429

and is used for storing the client at exit

872

430

current_checker_command: string; current running checker_command

873

disable_initiator_tag: a GLib event source tag, or None

431

disable_initiator_tag: a gobject event source tag, or None

874

432

enabled: bool()

875

433

fingerprint: string (40 or 32 hexadecimal digits); used to

876

uniquely identify an OpenPGP client

877

key_id: string (64 hexadecimal digits); used to uniquely identify

878

a client using raw public keys

434

uniquely identify the client

879

435

host: string; available for use by the checker command

880

436

interval: datetime.timedelta(); How often to start a new checker

881

437

last_approval_request: datetime.datetime(); (UTC) or None

883

439

last_checker_status: integer between 0 and 255 reflecting exit

884

440

status of last checker. -1 reflects crashed

885

441

checker, -2 means no checker completed yet.

886

last_checker_signal: The signal which killed the last checker, if

887

last_checker_status is -1

888

442

last_enabled: datetime.datetime(); (UTC) or None

889

443

name: string; from the config file, used in log messages and

890

444

D-Bus identifiers

897

451

disabled, or None

898

452

server_settings: The server_settings dict from main()

899

453

"""

900

454

901

455

runtime_expansions = ("approval_delay", "approval_duration",

902

"created", "enabled", "expires", "key_id",

456

"created", "enabled", "expires",

903

457

"fingerprint", "host", "interval",

904

458

"last_approval_request", "last_checked_ok",

905

459

"last_enabled", "name", "timeout")

906

client_defaults = {

907

"timeout": "PT5M",

908

"extended_timeout": "PT15M",

909

"interval": "PT2M",

910

"checker": "fping -q -- %%(host)s",

911

"host": "",

912

"approval_delay": "PT0S",

913

"approval_duration": "PT1S",

914

"approved_by_default": "True",

915

"enabled": "True",

916

}

917

460

client_defaults = { "timeout": "PT5M",

461

"extended_timeout": "PT15M",

462

"interval": "PT2M",

463

"checker": "fping -q -- %%(host)s",

464

"host": "",

465

"approval_delay": "PT0S",

466

"approval_duration": "PT1S",

467

"approved_by_default": "True",

468

"enabled": "True",

469

}

470

471

def timeout_milliseconds(self):

472

"Return the 'timeout' attribute in milliseconds"

473

return timedelta_to_milliseconds(self.timeout)

474

475

def extended_timeout_milliseconds(self):

476

"Return the 'extended_timeout' attribute in milliseconds"

477

return timedelta_to_milliseconds(self.extended_timeout)

478

479

def interval_milliseconds(self):

480

"Return the 'interval' attribute in milliseconds"

481

return timedelta_to_milliseconds(self.interval)

482

483

def approval_delay_milliseconds(self):

484

return timedelta_to_milliseconds(self.approval_delay)

485

918

486

@staticmethod

919

487

def config_parser(config):

920

488

"""Construct a new dict of client settings of this form:

927

495

for client_name in config.sections():

928

496

section = dict(config.items(client_name))

929

497

client = settings[client_name] = {}

930

498

931

499

client["host"] = section["host"]

932

500

# Reformat values from string types to Python types

933

501

client["approved_by_default"] = config.getboolean(

934

502

client_name, "approved_by_default")

935

503

client["enabled"] = config.getboolean(client_name,

936

504

"enabled")

937

938

# Uppercase and remove spaces from key_id and fingerprint

939

# for later comparison purposes with return value from the

940

# key_id() and fingerprint() functions

941

client["key_id"] = (section.get("key_id", "").upper()

942

.replace(" ", ""))

505

943

506

client["fingerprint"] = (section["fingerprint"].upper()

944

507

.replace(" ", ""))

945

508

if "secret" in section:

946

client["secret"] = codecs.decode(section["secret"]

947

.encode("utf-8"),

948

"base64")

509

client["secret"] = section["secret"].decode("base64")

949

510

elif "secfile" in section:

950

511

with open(os.path.expanduser(os.path.expandvars

951

512

(section["secfile"])),

952

513

"rb") as secfile:

953

514

client["secret"] = secfile.read()

954

515

else:

955

raise TypeError("No secret or secfile for section {}"

516

raise TypeError("No secret or secfile for section {0}"

956

517

.format(section))

957

518

client["timeout"] = string_to_delta(section["timeout"])

958

519

client["extended_timeout"] = string_to_delta(

966

527

client["last_approval_request"] = None

967

528

client["last_checked_ok"] = None

968

529

client["last_checker_status"] = -2

969

530

970

531

return settings

971

972

def __init__(self, settings, name=None, server_settings=None):

532

533

def __init__(self, settings, name = None, server_settings=None):

973

534

self.name = name

974

535

if server_settings is None:

975

536

server_settings = {}

976

537

self.server_settings = server_settings

977

538

# adding all client settings

978

for setting, value in settings.items():

539

for setting, value in settings.iteritems():

979

540

setattr(self, setting, value)

980

541

981

542

if self.enabled:

982

543

if not hasattr(self, "last_enabled"):

983

544

self.last_enabled = datetime.datetime.utcnow()

987

548

else:

988

549

self.last_enabled = None

989

550

self.expires = None

990

551

991

552

logger.debug("Creating client %r", self.name)

992

logger.debug(" Key ID: %s", self.key_id)

553

# Uppercase and remove spaces from fingerprint for later

554

# comparison purposes with return value from the fingerprint()

555

# function

993

556

logger.debug(" Fingerprint: %s", self.fingerprint)

994

557

self.created = settings.get("created",

995

558

datetime.datetime.utcnow())

996

559

997

560

# attributes specific for this server instance

998

561

self.checker = None

999

562

self.checker_initiator_tag = None

1002

565

self.current_checker_command = None

1003

566

self.approved = None

1004

567

self.approvals_pending = 0

1005

self.changedstate = multiprocessing_manager.Condition(

1006

multiprocessing_manager.Lock())

1007

self.client_structure = [attr

1008

for attr in self.__dict__.keys()

568

self.changedstate = (multiprocessing_manager

569

.Condition(multiprocessing_manager

570

.Lock()))

571

self.client_structure = [attr for attr in

572

self.__dict__.iterkeys()

1009

573

if not attr.startswith("_")]

1010

574

self.client_structure.append("client_structure")

1011

1012

for name, t in inspect.getmembers(

1013

type(self), lambda obj: isinstance(obj, property)):

575

576

for name, t in inspect.getmembers(type(self),

577

lambda obj:

578

isinstance(obj,

579

property)):

1014

580

if not name.startswith("_"):

1015

581

self.client_structure.append(name)

1016

582

1017

583

# Send notice to process children that client state has changed

1018

584

def send_changedstate(self):

1019

585

with self.changedstate:

1020

586

self.changedstate.notify_all()

1021

587

1022

588

def enable(self):

1023

589

"""Start this client's checker and timeout hooks"""

1024

590

if getattr(self, "enabled", False):

1029

595

self.last_enabled = datetime.datetime.utcnow()

1030

596

self.init_checker()

1031

597

self.send_changedstate()

1032

598

1033

599

def disable(self, quiet=True):

1034

600

"""Disable this client."""

1035

601

if not getattr(self, "enabled", False):

1037

603

if not quiet:

1038

604

logger.info("Disabling client %s", self.name)

1039

605

if getattr(self, "disable_initiator_tag", None) is not None:

1040

GLib.source_remove(self.disable_initiator_tag)

606

gobject.source_remove(self.disable_initiator_tag)

1041

607

self.disable_initiator_tag = None

1042

608

self.expires = None

1043

609

if getattr(self, "checker_initiator_tag", None) is not None:

1044

GLib.source_remove(self.checker_initiator_tag)

610

gobject.source_remove(self.checker_initiator_tag)

1045

611

self.checker_initiator_tag = None

1046

612

self.stop_checker()

1047

613

self.enabled = False

1048

614

if not quiet:

1049

615

self.send_changedstate()

1050

# Do not run this again if called by a GLib.timeout_add

616

# Do not run this again if called by a gobject.timeout_add

1051

617

return False

1052

618

1053

619

def __del__(self):

1054

620

self.disable()

1055

621

1056

622

def init_checker(self):

1057

623

# Schedule a new checker to be started an 'interval' from now,

1058

624

# and every interval from then on.

1059

625

if self.checker_initiator_tag is not None:

1060

GLib.source_remove(self.checker_initiator_tag)

1061

self.checker_initiator_tag = GLib.timeout_add(

1062

random.randrange(int(self.interval.total_seconds() * 1000

1063

+ 1)),

1064

self.start_checker)

626

gobject.source_remove(self.checker_initiator_tag)

627

self.checker_initiator_tag = (gobject.timeout_add

628

(self.interval_milliseconds(),

629

self.start_checker))

1065

630

# Schedule a disable() when 'timeout' has passed

1066

631

if self.disable_initiator_tag is not None:

1067

GLib.source_remove(self.disable_initiator_tag)

1068

self.disable_initiator_tag = GLib.timeout_add(

1069

int(self.timeout.total_seconds() * 1000), self.disable)

632

gobject.source_remove(self.disable_initiator_tag)

633

self.disable_initiator_tag = (gobject.timeout_add

634

(self.timeout_milliseconds(),

635

self.disable))

1070

636

# Also start a new checker *right now*.

1071

637

self.start_checker()

1072

1073

def checker_callback(self, source, condition, connection,

1074

command):

638

639

def checker_callback(self, pid, condition, command):

1075

640

"""The checker has completed, so take appropriate actions."""

1076

# Read return code from connection (see call_pipe)

1077

returncode = connection.recv()

1078

connection.close()

1079

if self.checker is not None:

1080

self.checker.join()

1081

641

self.checker_callback_tag = None

1082

642

self.checker = None

1083

1084

if returncode >= 0:

1085

self.last_checker_status = returncode

1086

self.last_checker_signal = None

643

if os.WIFEXITED(condition):

644

self.last_checker_status = os.WEXITSTATUS(condition)

1087

645

if self.last_checker_status == 0:

1088

646

logger.info("Checker for %(name)s succeeded",

1089

647

vars(self))

1090

648

self.checked_ok()

1091

649

else:

1092

logger.info("Checker for %(name)s failed", vars(self))

650

logger.info("Checker for %(name)s failed",

651

vars(self))

1093

652

else:

1094

653

self.last_checker_status = -1

1095

self.last_checker_signal = -returncode

1096

654

logger.warning("Checker for %(name)s crashed?",

1097

655

vars(self))

1098

return False

1099

656

1100

657

def checked_ok(self):

1101

658

"""Assert that the client has been seen, alive and well."""

1102

659

self.last_checked_ok = datetime.datetime.utcnow()

1103

660

self.last_checker_status = 0

1104

self.last_checker_signal = None

1105

661

self.bump_timeout()

1106

662

1107

663

def bump_timeout(self, timeout=None):

1108

664

"""Bump up the timeout for this client."""

1109

665

if timeout is None:

1110

666

timeout = self.timeout

1111

667

if self.disable_initiator_tag is not None:

1112

GLib.source_remove(self.disable_initiator_tag)

668

gobject.source_remove(self.disable_initiator_tag)

1113

669

self.disable_initiator_tag = None

1114

670

if getattr(self, "enabled", False):

1115

self.disable_initiator_tag = GLib.timeout_add(

1116

int(timeout.total_seconds() * 1000), self.disable)

671

self.disable_initiator_tag = (gobject.timeout_add

672

(timedelta_to_milliseconds

673

(timeout), self.disable))

1117

674

self.expires = datetime.datetime.utcnow() + timeout

1118

675

1119

676

def need_approval(self):

1120

677

self.last_approval_request = datetime.datetime.utcnow()

1121

678

1122

679

def start_checker(self):

1123

680

"""Start a new checker subprocess if one is not running.

1124

681

1125

682

If a checker already exists, leave it running and do

1126

683

nothing."""

1127

684

# The reason for not killing a running checker is that if we

1132

689

# checkers alone, the checker would have to take more time

1133

690

# than 'timeout' for the client to be disabled, which is as it

1134

691

# should be.

1135

1136

if self.checker is not None and not self.checker.is_alive():

1137

logger.warning("Checker was not alive; joining")

1138

self.checker.join()

1139

self.checker = None

692

693

# If a checker exists, make sure it is not a zombie

694

try:

695

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

696

except AttributeError:

697

pass

698

except OSError as error:

699

if error.errno != errno.ECHILD:

700

raise

701

else:

702

if pid:

703

logger.warning("Checker was a zombie")

704

gobject.source_remove(self.checker_callback_tag)

705

self.checker_callback(pid, status,

706

self.current_checker_command)

1140

707

# Start a new checker if needed

1141

708

if self.checker is None:

1142

709

# Escape attributes for the shell

1143

escaped_attrs = {

1144

attr: shlex.quote(str(getattr(self, attr)))

1145

for attr in self.runtime_expansions}

710

escaped_attrs = dict(

711

(attr, re.escape(unicode(getattr(self, attr))))

712

for attr in

713

self.runtime_expansions)

1146

714

try:

1147

715

command = self.checker_command % escaped_attrs

1148

716

except TypeError as error:

1149

717

logger.error('Could not format string "%s"',

1150

self.checker_command,

718

self.checker_command, exc_info=error)

719

return True # Try again later

720

self.current_checker_command = command

721

try:

722

logger.info("Starting checker %r for %s",

723

command, self.name)

724

# We don't need to redirect stdout and stderr, since

725

# in normal mode, that is already done by daemon(),

726

# and in debug mode we don't want to. (Stdin is

727

# always replaced by /dev/null.)

728

# The exception is when not debugging but nevertheless

729

# running in the foreground; use the previously

730

# created wnull.

731

popen_args = {}

732

if (not self.server_settings["debug"]

733

and self.server_settings["foreground"]):

734

popen_args.update({"stdout": wnull,

735

"stderr": wnull })

736

self.checker = subprocess.Popen(command,

737

close_fds=True,

738

shell=True, cwd="/",

739

**popen_args)

740

except OSError as error:

741

logger.error("Failed to start subprocess",

1151

742

exc_info=error)

1152

return True # Try again later

1153

self.current_checker_command = command

1154

logger.info("Starting checker %r for %s", command,

1155

self.name)

1156

# We don't need to redirect stdout and stderr, since

1157

# in normal mode, that is already done by daemon(),

1158

# and in debug mode we don't want to. (Stdin is

1159

# always replaced by /dev/null.)

1160

# The exception is when not debugging but nevertheless

1161

# running in the foreground; use the previously

1162

# created wnull.

1163

popen_args = {"close_fds": True,

1164

"shell": True,

1165

"cwd": "/"}

1166

if (not self.server_settings["debug"]

1167

and self.server_settings["foreground"]):

1168

popen_args.update({"stdout": wnull,

1169

"stderr": wnull})

1170

pipe = multiprocessing.Pipe(duplex=False)

1171

self.checker = multiprocessing.Process(

1172

target=call_pipe,

1173

args=(pipe[1], subprocess.call, command),

1174

kwargs=popen_args)

1175

self.checker.start()

1176

self.checker_callback_tag = GLib.io_add_watch(

1177

GLib.IOChannel.unix_new(pipe[0].fileno()),

1178

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1179

self.checker_callback, pipe[0], command)

1180

# Re-run this periodically if run by GLib.timeout_add

743

return True

744

self.checker_callback_tag = (gobject.child_watch_add

745

(self.checker.pid,

746

self.checker_callback,

747

data=command))

748

# The checker may have completed before the gobject

749

# watch was added. Check for this.

750

try:

751

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

752

except OSError as error:

753

if error.errno == errno.ECHILD:

754

# This should never happen

755

logger.error("Child process vanished",

756

exc_info=error)

757

return True

758

raise

759

if pid:

760

gobject.source_remove(self.checker_callback_tag)

761

self.checker_callback(pid, status, command)

762

# Re-run this periodically if run by gobject.timeout_add

1181

763

return True

1182

764

1183

765

def stop_checker(self):

1184

766

"""Force the checker process, if any, to stop."""

1185

767

if self.checker_callback_tag:

1186

GLib.source_remove(self.checker_callback_tag)

768

gobject.source_remove(self.checker_callback_tag)

1187

769

self.checker_callback_tag = None

1188

770

if getattr(self, "checker", None) is None:

1189

771

return

1190

772

logger.debug("Stopping checker for %(name)s", vars(self))

1191

self.checker.terminate()

773

try:

774

self.checker.terminate()

775

#time.sleep(0.5)

776

#if self.checker.poll() is None:

777

# self.checker.kill()

778

except OSError as error:

779

if error.errno != errno.ESRCH: # No such process

780

raise

1192

781

self.checker = None

1193

782

1194

783

1195

def dbus_service_property(dbus_interface,

1196

signature="v",

1197

access="readwrite",

1198

byte_arrays=False):

784

def dbus_service_property(dbus_interface, signature="v",

785

access="readwrite", byte_arrays=False):

1199

786

"""Decorators for marking methods of a DBusObjectWithProperties to

1200

787

become properties on the D-Bus.

1201

788

1202

789

The decorated method will be called with no arguments by "Get"

1203

790

and with one argument by "Set".

1204

791

1205

792

The parameters, where they are supported, are the same as

1206

793

dbus.service.method, except there is only "signature", since the

1207

794

type from Get() and the type sent to Set() is the same.

1210

797

# "Set" method, so we fail early here:

1211

798

if byte_arrays and signature != "ay":

1212

799

raise ValueError("Byte arrays not supported for non-'ay'"

1213

" signature {!r}".format(signature))

1214

800

" signature {0!r}".format(signature))

1215

801

def decorator(func):

1216

802

func._dbus_is_property = True

1217

803

func._dbus_interface = dbus_interface

1220

806

func._dbus_name = func.__name__

1221

807

if func._dbus_name.endswith("_dbus_property"):

1222

808

func._dbus_name = func._dbus_name[:-14]

1223

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

809

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1224

810

return func

1225

1226

811

return decorator

1227

812

1228

813

1229

814

def dbus_interface_annotations(dbus_interface):

1230

815

"""Decorator for marking functions returning interface annotations

1231

816

1232

817

Usage:

1233

818

1234

819

@dbus_interface_annotations("org.example.Interface")

1235

820

def _foo(self): # Function name does not matter

1236

821

return {"org.freedesktop.DBus.Deprecated": "true",

1237

822

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1238

823

"false"}

1239

824

"""

1240

1241

825

def decorator(func):

1242

826

func._dbus_is_interface = True

1243

827

func._dbus_interface = dbus_interface

1244

828

func._dbus_name = dbus_interface

1245

829

return func

1246

1247

830

return decorator

1248

831

1249

832

1250

833

def dbus_annotations(annotations):

1251

834

"""Decorator to annotate D-Bus methods, signals or properties

1252

835

Usage:

1253

1254

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1255

"org.freedesktop.DBus.Property."

1256

"EmitsChangedSignal": "false"})

836

1257

837

@dbus_service_property("org.example.Interface", signature="b",

1258

838

access="r")

839

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

840

"org.freedesktop.DBus.Property."

841

"EmitsChangedSignal": "false"})

1259

842

def Property_dbus_property(self):

1260

843

return dbus.Boolean(False)

1261

1262

See also the DBusObjectWithAnnotations class.

1263

844

"""

1264

1265

845

def decorator(func):

1266

846

func._dbus_annotations = annotations

1267

847

return func

1268

1269

848

return decorator

1270

849

1271

850

1272

851

class DBusPropertyException(dbus.exceptions.DBusException):

1273

852

"""A base class for D-Bus property-related exceptions

1274

853

"""

1275

pass

854

def __unicode__(self):

855

return unicode(str(self))

1276

856

1277

857

1278

858

class DBusPropertyAccessException(DBusPropertyException):

1287

867

pass

1288

868

1289

869

1290

class DBusObjectWithAnnotations(dbus.service.Object):

1291

"""A D-Bus object with annotations.

1292

1293

Classes inheriting from this can use the dbus_annotations

1294

decorator to add annotations to methods or signals.

870

class DBusObjectWithProperties(dbus.service.Object):

871

"""A D-Bus object with properties.

872

873

Classes inheriting from this can use the dbus_service_property

874

decorator to expose methods as D-Bus properties. It exposes the

875

standard Get(), Set(), and GetAll() methods on the D-Bus.

1295

876

"""

1296

877

1297

878

@staticmethod

1298

879

def _is_dbus_thing(thing):

1299

880

"""Returns a function testing if an attribute is a D-Bus thing

1300

881

1301

882

If called like _is_dbus_thing("method") it returns a function

1302

883

suitable for use as predicate to inspect.getmembers().

1303

884

"""

1304

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

885

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1305

886

False)

1306

887

1307

888

def _get_all_dbus_things(self, thing):

1308

889

"""Returns a generator of (name, attribute) pairs

1309

890

"""

1310

return ((getattr(athing.__get__(self), "_dbus_name", name),

891

return ((getattr(athing.__get__(self), "_dbus_name",

892

name),

1311

893

athing.__get__(self))

1312

894

for cls in self.__class__.__mro__

1313

895

for name, athing in

1314

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1315

1316

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1317

out_signature="s",

1318

path_keyword='object_path',

1319

connection_keyword='connection')

1320

def Introspect(self, object_path, connection):

1321

"""Overloading of standard D-Bus method.

1322

1323

Inserts annotation tags on methods and signals.

1324

"""

1325

xmlstring = dbus.service.Object.Introspect(self, object_path,

1326

connection)

1327

try:

1328

document = xml.dom.minidom.parseString(xmlstring)

1329

1330

for if_tag in document.getElementsByTagName("interface"):

1331

# Add annotation tags

1332

for typ in ("method", "signal"):

1333

for tag in if_tag.getElementsByTagName(typ):

1334

annots = dict()

1335

for name, prop in (self.

1336

_get_all_dbus_things(typ)):

1337

if (name == tag.getAttribute("name")

1338

and prop._dbus_interface

1339

== if_tag.getAttribute("name")):

1340

annots.update(getattr(

1341

prop, "_dbus_annotations", {}))

1342

for name, value in annots.items():

1343

ann_tag = document.createElement(

1344

"annotation")

1345

ann_tag.setAttribute("name", name)

1346

ann_tag.setAttribute("value", value)

1347

tag.appendChild(ann_tag)

1348

# Add interface annotation tags

1349

for annotation, value in dict(

1350

itertools.chain.from_iterable(

1351

annotations().items()

1352

for name, annotations

1353

in self._get_all_dbus_things("interface")

1354

if name == if_tag.getAttribute("name")

1355

)).items():

1356

ann_tag = document.createElement("annotation")

1357

ann_tag.setAttribute("name", annotation)

1358

ann_tag.setAttribute("value", value)

1359

if_tag.appendChild(ann_tag)

1360

# Fix argument name for the Introspect method itself

1361

if (if_tag.getAttribute("name")

1362

== dbus.INTROSPECTABLE_IFACE):

1363

for cn in if_tag.getElementsByTagName("method"):

1364

if cn.getAttribute("name") == "Introspect":

1365

for arg in cn.getElementsByTagName("arg"):

1366

if (arg.getAttribute("direction")

1367

== "out"):

1368

arg.setAttribute("name",

1369

"xml_data")

1370

xmlstring = document.toxml("utf-8")

1371

document.unlink()

1372

except (AttributeError, xml.dom.DOMException,

1373

xml.parsers.expat.ExpatError) as error:

1374

logger.error("Failed to override Introspection method",

1375

exc_info=error)

1376

return xmlstring

1377

1378

1379

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1380

"""A D-Bus object with properties.

1381

1382

Classes inheriting from this can use the dbus_service_property

1383

decorator to expose methods as D-Bus properties. It exposes the

1384

standard Get(), Set(), and GetAll() methods on the D-Bus.

1385

"""

1386

896

inspect.getmembers(cls,

897

self._is_dbus_thing(thing)))

898

1387

899

def _get_dbus_property(self, interface_name, property_name):

1388

900

"""Returns a bound method if one exists which is a D-Bus

1389

901

property with the specified name and interface.

1390

902

"""

1391

for cls in self.__class__.__mro__:

1392

for name, value in inspect.getmembers(

1393

cls, self._is_dbus_thing("property")):

903

for cls in self.__class__.__mro__:

904

for name, value in (inspect.getmembers

905

(cls,

906

self._is_dbus_thing("property"))):

1394

907

if (value._dbus_name == property_name

1395

908

and value._dbus_interface == interface_name):

1396

909

return value.__get__(self)

1397

910

1398

911

# No such property

1399

raise DBusPropertyNotFound("{}:{}.{}".format(

1400

self.dbus_object_path, interface_name, property_name))

1401

1402

@classmethod

1403

def _get_all_interface_names(cls):

1404

"""Get a sequence of all interfaces supported by an object"""

1405

return (name for name in set(getattr(getattr(x, attr),

1406

"_dbus_interface", None)

1407

for x in (inspect.getmro(cls))

1408

for attr in dir(x))

1409

if name is not None)

1410

1411

@dbus.service.method(dbus.PROPERTIES_IFACE,

1412

in_signature="ss",

912

raise DBusPropertyNotFound(self.dbus_object_path + ":"

913

+ interface_name + "."

914

+ property_name)

915

916

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1413

917

out_signature="v")

1414

918

def Get(self, interface_name, property_name):

1415

919

"""Standard D-Bus property Get() method, see D-Bus standard.

1421

925

if not hasattr(value, "variant_level"):

1422

926

return value

1423

927

return type(value)(value, variant_level=value.variant_level+1)

1424

928

1425

929

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1426

930

def Set(self, interface_name, property_name, value):

1427

931

"""Standard D-Bus property Set() method, see D-Bus standard.

1434

938

# signatures other than "ay".

1435

939

if prop._dbus_signature != "ay":

1436

940

raise ValueError("Byte arrays not supported for non-"

1437

"'ay' signature {!r}"

941

"'ay' signature {0!r}"

1438

942

.format(prop._dbus_signature))

1439

value = dbus.ByteArray(bytes(value))

943

value = dbus.ByteArray(b''.join(chr(byte)

944

for byte in value))

1440

945

prop(value)

1441

1442

@dbus.service.method(dbus.PROPERTIES_IFACE,

1443

in_signature="s",

946

947

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1444

948

out_signature="a{sv}")

1445

949

def GetAll(self, interface_name):

1446

950

"""Standard D-Bus property GetAll() method, see D-Bus

1447

951

standard.

1448

952

1449

953

Note: Will not include properties with access="write".

1450

954

"""

1451

955

properties = {}

1461

965

if not hasattr(value, "variant_level"):

1462

966

properties[name] = value

1463

967

continue

1464

properties[name] = type(value)(

1465

value, variant_level=value.variant_level + 1)

968

properties[name] = type(value)(value, variant_level=

969

value.variant_level+1)

1466

970

return dbus.Dictionary(properties, signature="sv")

1467

1468

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1469

def PropertiesChanged(self, interface_name, changed_properties,

1470

invalidated_properties):

1471

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1472

standard.

1473

"""

1474

pass

1475

971

1476

972

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1477

973

out_signature="s",

1478

974

path_keyword='object_path',

1479

975

connection_keyword='connection')

1480

976

def Introspect(self, object_path, connection):

1481

977

"""Overloading of standard D-Bus method.

1482

978

1483

979

Inserts property tags and interface annotation tags.

1484

980

"""

1485

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1486

object_path,

1487

connection)

981

xmlstring = dbus.service.Object.Introspect(self, object_path,

982

connection)

1488

983

try:

1489

984

document = xml.dom.minidom.parseString(xmlstring)

1490

1491

985

def make_tag(document, name, prop):

1492

986

e = document.createElement("property")

1493

987

e.setAttribute("name", name)

1494

988

e.setAttribute("type", prop._dbus_signature)

1495

989

e.setAttribute("access", prop._dbus_access)

1496

990

return e

1497

1498

991

for if_tag in document.getElementsByTagName("interface"):

1499

992

# Add property tags

1500

993

for tag in (make_tag(document, name, prop)

1503

996

if prop._dbus_interface

1504

997

== if_tag.getAttribute("name")):

1505

998

if_tag.appendChild(tag)

1506

# Add annotation tags for properties

1507

for tag in if_tag.getElementsByTagName("property"):

1508

annots = dict()

1509

for name, prop in self._get_all_dbus_things(

1510

"property"):

1511

if (name == tag.getAttribute("name")

1512

and prop._dbus_interface

1513

== if_tag.getAttribute("name")):

1514

annots.update(getattr(

1515

prop, "_dbus_annotations", {}))

1516

for name, value in annots.items():

1517

ann_tag = document.createElement(

1518

"annotation")

1519

ann_tag.setAttribute("name", name)

1520

ann_tag.setAttribute("value", value)

1521

tag.appendChild(ann_tag)

999

# Add annotation tags

1000

for typ in ("method", "signal", "property"):

1001

for tag in if_tag.getElementsByTagName(typ):

1002

annots = dict()

1003

for name, prop in (self.

1004

_get_all_dbus_things(typ)):

1005

if (name == tag.getAttribute("name")

1006

and prop._dbus_interface

1007

== if_tag.getAttribute("name")):

1008

annots.update(getattr

1009

(prop,

1010

"_dbus_annotations",

1011

{}))

1012

for name, value in annots.iteritems():

1013

ann_tag = document.createElement(

1014

"annotation")

1015

ann_tag.setAttribute("name", name)

1016

ann_tag.setAttribute("value", value)

1017

tag.appendChild(ann_tag)

1018

# Add interface annotation tags

1019

for annotation, value in dict(

1020

itertools.chain.from_iterable(

1021

annotations().iteritems()

1022

for name, annotations in

1023

self._get_all_dbus_things("interface")

1024

if name == if_tag.getAttribute("name")

1025

)).iteritems():

1026

ann_tag = document.createElement("annotation")

1027

ann_tag.setAttribute("name", annotation)

1028

ann_tag.setAttribute("value", value)

1029

if_tag.appendChild(ann_tag)

1522

1030

# Add the names to the return values for the

1523

1031

# "org.freedesktop.DBus.Properties" methods

1524

1032

if (if_tag.getAttribute("name")

1543

1051

return xmlstring

1544

1052

1545

1053

1546

try:

1547

dbus.OBJECT_MANAGER_IFACE

1548

except AttributeError:

1549

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1550

1551

1552

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1553

"""A D-Bus object with an ObjectManager.

1554

1555

Classes inheriting from this exposes the standard

1556

GetManagedObjects call and the InterfacesAdded and

1557

InterfacesRemoved signals on the standard

1558

"org.freedesktop.DBus.ObjectManager" interface.

1559

1560

Note: No signals are sent automatically; they must be sent

1561

manually.

1562

"""

1563

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1564

out_signature="a{oa{sa{sv}}}")

1565

def GetManagedObjects(self):

1566

"""This function must be overridden"""

1567

raise NotImplementedError()

1568

1569

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1570

signature="oa{sa{sv}}")

1571

def InterfacesAdded(self, object_path, interfaces_and_properties):

1572

pass

1573

1574

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1575

def InterfacesRemoved(self, object_path, interfaces):

1576

pass

1577

1578

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1579

out_signature="s",

1580

path_keyword='object_path',

1581

connection_keyword='connection')

1582

def Introspect(self, object_path, connection):

1583

"""Overloading of standard D-Bus method.

1584

1585

Override return argument name of GetManagedObjects to be

1586

"objpath_interfaces_and_properties"

1587

"""

1588

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1589

object_path,

1590

connection)

1591

try:

1592

document = xml.dom.minidom.parseString(xmlstring)

1593

1594

for if_tag in document.getElementsByTagName("interface"):

1595

# Fix argument name for the GetManagedObjects method

1596

if (if_tag.getAttribute("name")

1597

== dbus.OBJECT_MANAGER_IFACE):

1598

for cn in if_tag.getElementsByTagName("method"):

1599

if (cn.getAttribute("name")

1600

== "GetManagedObjects"):

1601

for arg in cn.getElementsByTagName("arg"):

1602

if (arg.getAttribute("direction")

1603

== "out"):

1604

arg.setAttribute(

1605

"name",

1606

"objpath_interfaces"

1607

"_and_properties")

1608

xmlstring = document.toxml("utf-8")

1609

document.unlink()

1610

except (AttributeError, xml.dom.DOMException,

1611

xml.parsers.expat.ExpatError) as error:

1612

logger.error("Failed to override Introspection method",

1613

exc_info=error)

1614

return xmlstring

1615

1616

1617

1054

def datetime_to_dbus(dt, variant_level=0):

1618

1055

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1619

1056

if dt is None:

1620

return dbus.String("", variant_level=variant_level)

1621

return dbus.String(dt.isoformat(), variant_level=variant_level)

1057

return dbus.String("", variant_level = variant_level)

1058

return dbus.String(dt.isoformat(),

1059

variant_level=variant_level)

1622

1060

1623

1061

1624

1062

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1626

1064

dbus.service.Object, it will add alternate D-Bus attributes with

1627

1065

interface names according to the "alt_interface_names" mapping.

1628

1066

Usage:

1629

1067

1630

1068

@alternate_dbus_interfaces({"org.example.Interface":

1631

1069

"net.example.AlternateInterface"})

1632

1070

class SampleDBusObject(dbus.service.Object):

1633

1071

@dbus.service.method("org.example.Interface")

1634

1072

def SampleDBusMethod():

1635

1073

pass

1636

1074

1637

1075

The above "SampleDBusMethod" on "SampleDBusObject" will be

1638

1076

reachable via two interfaces: "org.example.Interface" and

1639

1077

"net.example.AlternateInterface", the latter of which will have

1640

1078

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1641

1079

"true", unless "deprecate" is passed with a False value.

1642

1080

1643

1081

This works for methods and signals, and also for D-Bus properties

1644

1082

(from DBusObjectWithProperties) and interfaces (from the

1645

1083

dbus_interface_annotations decorator).

1646

1084

"""

1647

1648

1085

def wrapper(cls):

1649

1086

for orig_interface_name, alt_interface_name in (

1650

alt_interface_names.items()):

1087

alt_interface_names.iteritems()):

1651

1088

attr = {}

1652

1089

interface_names = set()

1653

1090

# Go though all attributes of the class

1655

1092

# Ignore non-D-Bus attributes, and D-Bus attributes

1656

1093

# with the wrong interface name

1657

1094

if (not hasattr(attribute, "_dbus_interface")

1658

or not attribute._dbus_interface.startswith(

1659

orig_interface_name)):

1095

or not attribute._dbus_interface

1096

.startswith(orig_interface_name)):

1660

1097

continue

1661

1098

# Create an alternate D-Bus interface name based on

1662

1099

# the current name

1663

alt_interface = attribute._dbus_interface.replace(

1664

orig_interface_name, alt_interface_name)

1100

alt_interface = (attribute._dbus_interface

1101

.replace(orig_interface_name,

1102

alt_interface_name))

1665

1103

interface_names.add(alt_interface)

1666

1104

# Is this a D-Bus signal?

1667

1105

if getattr(attribute, "_dbus_is_signal", False):

1668

1106

# Extract the original non-method undecorated

1669

1107

# function by black magic

1670

if sys.version_info.major == 2:

1671

nonmethod_func = (dict(

1108

nonmethod_func = (dict(

1672

1109

zip(attribute.func_code.co_freevars,

1673

attribute.__closure__))

1674

["func"].cell_contents)

1675

else:

1676

nonmethod_func = (dict(

1677

zip(attribute.__code__.co_freevars,

1678

attribute.__closure__))

1679

["func"].cell_contents)

1110

attribute.__closure__))["func"]

1111

.cell_contents)

1680

1112

# Create a new, but exactly alike, function

1681

1113

# object, and decorate it to be a new D-Bus signal

1682

1114

# with the alternate D-Bus interface name

1683

new_function = copy_function(nonmethod_func)

1684

new_function = (dbus.service.signal(

1685

alt_interface,

1686

attribute._dbus_signature)(new_function))

1115

new_function = (dbus.service.signal

1116

(alt_interface,

1117

attribute._dbus_signature)

1118

(types.FunctionType(

1119

nonmethod_func.func_code,

1120

nonmethod_func.func_globals,

1121

nonmethod_func.func_name,

1122

nonmethod_func.func_defaults,

1123

nonmethod_func.func_closure)))

1687

1124

# Copy annotations, if any

1688

1125

try:

1689

new_function._dbus_annotations = dict(

1690

attribute._dbus_annotations)

1126

new_function._dbus_annotations = (

1127

dict(attribute._dbus_annotations))

1691

1128

except AttributeError:

1692

1129

pass

1693

1694

1130

# Define a creator of a function to call both the

1695

1131

# original and alternate functions, so both the

1696

1132

# original and alternate signals gets sent when

1699

1135

"""This function is a scope container to pass

1700

1136

func1 and func2 to the "call_both" function

1701

1137

outside of its arguments"""

1702

1703

@functools.wraps(func2)

1704

1138

def call_both(*args, **kwargs):

1705

1139

"""This function will emit two D-Bus

1706

1140

signals by calling func1 and func2"""

1707

1141

func1(*args, **kwargs)

1708

1142

func2(*args, **kwargs)

1709

# Make wrapper function look like a D-Bus

1710

# signal

1711

for name, attr in inspect.getmembers(func2):

1712

if name.startswith("_dbus_"):

1713

setattr(call_both, name, attr)

1714

1715

1143

return call_both

1716

1144

# Create the "call_both" function and add it to

1717

1145

# the class

1722

1150

# object. Decorate it to be a new D-Bus method

1723

1151

# with the alternate D-Bus interface name. Add it

1724

1152

# to the class.

1725

attr[attrname] = (

1726

dbus.service.method(

1727

alt_interface,

1728

attribute._dbus_in_signature,

1729

attribute._dbus_out_signature)

1730

(copy_function(attribute)))

1153

attr[attrname] = (dbus.service.method

1154

(alt_interface,

1155

attribute._dbus_in_signature,

1156

attribute._dbus_out_signature)

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1731

1163

# Copy annotations, if any

1732

1164

try:

1733

attr[attrname]._dbus_annotations = dict(

1734

attribute._dbus_annotations)

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1735

1167

except AttributeError:

1736

1168

pass

1737

1169

# Is this a D-Bus property?

1740

1172

# object, and decorate it to be a new D-Bus

1741

1173

# property with the alternate D-Bus interface

1742

1174

# name. Add it to the class.

1743

attr[attrname] = (dbus_service_property(

1744

alt_interface, attribute._dbus_signature,

1745

attribute._dbus_access,

1746

attribute._dbus_get_args_options

1747

["byte_arrays"])

1748

(copy_function(attribute)))

1175

attr[attrname] = (dbus_service_property

1176

(alt_interface,

1177

attribute._dbus_signature,

1178

attribute._dbus_access,

1179

attribute

1180

._dbus_get_args_options

1181

["byte_arrays"])

1182

(types.FunctionType

1183

(attribute.func_code,

1184

attribute.func_globals,

1185

attribute.func_name,

1186

attribute.func_defaults,

1187

attribute.func_closure)))

1749

1188

# Copy annotations, if any

1750

1189

try:

1751

attr[attrname]._dbus_annotations = dict(

1752

attribute._dbus_annotations)

1190

attr[attrname]._dbus_annotations = (

1191

dict(attribute._dbus_annotations))

1753

1192

except AttributeError:

1754

1193

pass

1755

1194

# Is this a D-Bus interface?

1758

1197

# object. Decorate it to be a new D-Bus interface

1759

1198

# with the alternate D-Bus interface name. Add it

1760

1199

# to the class.

1761

attr[attrname] = (

1762

dbus_interface_annotations(alt_interface)

1763

(copy_function(attribute)))

1200

attr[attrname] = (dbus_interface_annotations

1201

(alt_interface)

1202

(types.FunctionType

1203

(attribute.func_code,

1204

attribute.func_globals,

1205

attribute.func_name,

1206

attribute.func_defaults,

1207

attribute.func_closure)))

1764

1208

if deprecate:

1765

1209

# Deprecate all alternate interfaces

1766

iname = "_AlternateDBusNames_interface_annotation{}"

1210

iname="_AlternateDBusNames_interface_annotation{0}"

1767

1211

for interface_name in interface_names:

1768

1769

1212

@dbus_interface_annotations(interface_name)

1770

1213

def func(self):

1771

return {"org.freedesktop.DBus.Deprecated":

1772

"true"}

1214

return { "org.freedesktop.DBus.Deprecated":

1215

"true" }

1773

1216

# Find an unused name

1774

1217

for aname in (iname.format(i)

1775

1218

for i in itertools.count()):

1779

1222

if interface_names:

1780

1223

# Replace the class with a new subclass of it with

1781

1224

# methods, signals, etc. as created above.

1782

if sys.version_info.major == 2:

1783

cls = type(b"{}Alternate".format(cls.__name__),

1784

(cls, ), attr)

1785

else:

1786

cls = type("{}Alternate".format(cls.__name__),

1787

(cls, ), attr)

1225

cls = type(b"{0}Alternate".format(cls.__name__),

1226

(cls,), attr)

1788

1227

return cls

1789

1790

1228

return wrapper

1791

1229

1792

1230

1793

1231

@alternate_dbus_interfaces({"se.recompile.Mandos":

1794

"se.bsnet.fukt.Mandos"})

1232

"se.bsnet.fukt.Mandos"})

1795

1233

class ClientDBus(Client, DBusObjectWithProperties):

1796

1234

"""A Client class using D-Bus

1797

1235

1798

1236

Attributes:

1799

1237

dbus_object_path: dbus.ObjectPath

1800

1238

bus: dbus.SystemBus()

1801

1239

"""

1802

1240

1803

1241

runtime_expansions = (Client.runtime_expansions

1804

+ ("dbus_object_path", ))

1805

1806

_interface = "se.recompile.Mandos.Client"

1807

1242

+ ("dbus_object_path",))

1243

1808

1244

# dbus.service.Object doesn't use super(), so we can't either.

1809

1810

def __init__(self, bus=None, *args, **kwargs):

1245

1246

def __init__(self, bus = None, *args, **kwargs):

1811

1247

self.bus = bus

1812

1248

Client.__init__(self, *args, **kwargs)

1813

1249

# Only now, when this client is initialized, can it show up on

1814

1250

# the D-Bus

1815

client_object_name = str(self.name).translate(

1251

client_object_name = unicode(self.name).translate(

1816

1252

{ord("."): ord("_"),

1817

1253

ord("-"): ord("_")})

1818

self.dbus_object_path = dbus.ObjectPath(

1819

"/clients/" + client_object_name)

1254

self.dbus_object_path = (dbus.ObjectPath

1255

("/clients/" + client_object_name))

1820

1256

DBusObjectWithProperties.__init__(self, self.bus,

1821

1257

self.dbus_object_path)

1822

1823

def notifychangeproperty(transform_func, dbus_name,

1824

type_func=lambda x: x,

1825

variant_level=1,

1826

invalidate_only=False,

1827

_interface=_interface):

1258

1259

def notifychangeproperty(transform_func,

1260

dbus_name, type_func=lambda x: x,

1261

variant_level=1):

1828

1262

""" Modify a variable so that it's a property which announces

1829

1263

its changes to DBus.

1830

1264

1831

1265

transform_fun: Function that takes a value and a variant_level

1832

1266

and transforms it to a D-Bus type.

1833

1267

dbus_name: D-Bus name of the variable

1835

1269

to the D-Bus. Default: no transform

1836

1270

variant_level: D-Bus variant level. Default: 1

1837

1271

"""

1838

attrname = "_{}".format(dbus_name)

1839

1272

attrname = "_{0}".format(dbus_name)

1840

1273

def setter(self, value):

1841

1274

if hasattr(self, "dbus_object_path"):

1842

1275

if (not hasattr(self, attrname) or

1843

1276

type_func(getattr(self, attrname, None))

1844

1277

!= type_func(value)):

1845

if invalidate_only:

1846

self.PropertiesChanged(

1847

_interface, dbus.Dictionary(),

1848

dbus.Array((dbus_name, )))

1849

else:

1850

dbus_value = transform_func(

1851

type_func(value),

1852

variant_level=variant_level)

1853

self.PropertyChanged(dbus.String(dbus_name),

1854

dbus_value)

1855

self.PropertiesChanged(

1856

_interface,

1857

dbus.Dictionary({dbus.String(dbus_name):

1858

dbus_value}),

1859

dbus.Array())

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1281

self.PropertyChanged(dbus.String(dbus_name),

1282

dbus_value)

1860

1283

setattr(self, attrname, value)

1861

1284

1862

1285

return property(lambda self: getattr(self, attrname), setter)

1863

1286

1864

1287

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1865

1288

approvals_pending = notifychangeproperty(dbus.Boolean,

1866

1289

"ApprovalPending",

1867

type_func=bool)

1290

type_func = bool)

1868

1291

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1869

1292

last_enabled = notifychangeproperty(datetime_to_dbus,

1870

1293

"LastEnabled")

1871

checker = notifychangeproperty(

1872

dbus.Boolean, "CheckerRunning",

1873

type_func=lambda checker: checker is not None)

1294

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1295

type_func = lambda checker:

1296

checker is not None)

1874

1297

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1875

1298

"LastCheckedOK")

1876

1299

last_checker_status = notifychangeproperty(dbus.Int16,

1879

1302

datetime_to_dbus, "LastApprovalRequest")

1880

1303

approved_by_default = notifychangeproperty(dbus.Boolean,

1881

1304

"ApprovedByDefault")

1882

approval_delay = notifychangeproperty(

1883

dbus.UInt64, "ApprovalDelay",

1884

type_func=lambda td: td.total_seconds() * 1000)

1305

approval_delay = notifychangeproperty(dbus.UInt64,

1306

"ApprovalDelay",

1307

type_func =

1308

timedelta_to_milliseconds)

1885

1309

approval_duration = notifychangeproperty(

1886

1310

dbus.UInt64, "ApprovalDuration",

1887

type_func=lambda td: td.total_seconds() * 1000)

1311

type_func = timedelta_to_milliseconds)

1888

1312

host = notifychangeproperty(dbus.String, "Host")

1889

timeout = notifychangeproperty(

1890

dbus.UInt64, "Timeout",

1891

type_func=lambda td: td.total_seconds() * 1000)

1313

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1314

type_func =

1315

timedelta_to_milliseconds)

1892

1316

extended_timeout = notifychangeproperty(

1893

1317

dbus.UInt64, "ExtendedTimeout",

1894

type_func=lambda td: td.total_seconds() * 1000)

1895

interval = notifychangeproperty(

1896

dbus.UInt64, "Interval",

1897

type_func=lambda td: td.total_seconds() * 1000)

1318

type_func = timedelta_to_milliseconds)

1319

interval = notifychangeproperty(dbus.UInt64,

1320

"Interval",

1321

type_func =

1322

timedelta_to_milliseconds)

1898

1323

checker_command = notifychangeproperty(dbus.String, "Checker")

1899

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1900

invalidate_only=True)

1901

1324

1902

1325

del notifychangeproperty

1903

1326

1904

1327

def __del__(self, *args, **kwargs):

1905

1328

try:

1906

1329

self.remove_from_connection()

1909

1332

if hasattr(DBusObjectWithProperties, "__del__"):

1910

1333

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1911

1334

Client.__del__(self, *args, **kwargs)

1912

1913

def checker_callback(self, source, condition,

1914

connection, command, *args, **kwargs):

1915

ret = Client.checker_callback(self, source, condition,

1916

connection, command, *args,

1917

**kwargs)

1918

exitstatus = self.last_checker_status

1919

if exitstatus >= 0:

1335

1336

def checker_callback(self, pid, condition, command,

1337

*args, **kwargs):

1338

self.checker_callback_tag = None

1339

self.checker = None

1340

if os.WIFEXITED(condition):

1341

exitstatus = os.WEXITSTATUS(condition)

1920

1342

# Emit D-Bus signal

1921

1343

self.CheckerCompleted(dbus.Int16(exitstatus),

1922

# This is specific to GNU libC

1923

dbus.Int64(exitstatus << 8),

1344

dbus.Int64(condition),

1924

1345

dbus.String(command))

1925

1346

else:

1926

1347

# Emit D-Bus signal

1927

1348

self.CheckerCompleted(dbus.Int16(-1),

1928

dbus.Int64(

1929

# This is specific to GNU libC

1930

(exitstatus << 8)

1931

| self.last_checker_signal),

1349

dbus.Int64(condition),

1932

1350

dbus.String(command))

1933

return ret

1934

1351

1352

return Client.checker_callback(self, pid, condition, command,

1353

*args, **kwargs)

1354

1935

1355

def start_checker(self, *args, **kwargs):

1936

1356

old_checker_pid = getattr(self.checker, "pid", None)

1937

1357

r = Client.start_checker(self, *args, **kwargs)

1941

1361

# Emit D-Bus signal

1942

1362

self.CheckerStarted(self.current_checker_command)

1943

1363

return r

1944

1364

1945

1365

def _reset_approved(self):

1946

1366

self.approved = None

1947

1367

return False

1948

1368

1949

1369

def approve(self, value=True):

1950

1370

self.approved = value

1951

GLib.timeout_add(int(self.approval_duration.total_seconds()

1952

* 1000), self._reset_approved)

1371

gobject.timeout_add(timedelta_to_milliseconds

1372

(self.approval_duration),

1373

self._reset_approved)

1953

1374

self.send_changedstate()

1954

1955

# D-Bus methods, signals & properties

1956

1957

# Interfaces

1958

1959

# Signals

1960

1375

1376

## D-Bus methods, signals & properties

1377

_interface = "se.recompile.Mandos.Client"

1378

1379

## Interfaces

1380

1381

@dbus_interface_annotations(_interface)

1382

def _foo(self):

1383

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1384

"false"}

1385

1386

## Signals

1387

1961

1388

# CheckerCompleted - signal

1962

1389

@dbus.service.signal(_interface, signature="nxs")

1963

1390

def CheckerCompleted(self, exitcode, waitstatus, command):

1964

1391

"D-Bus signal"

1965

1392

pass

1966

1393

1967

1394

# CheckerStarted - signal

1968

1395

@dbus.service.signal(_interface, signature="s")

1969

1396

def CheckerStarted(self, command):

1970

1397

"D-Bus signal"

1971

1398

pass

1972

1399

1973

1400

# PropertyChanged - signal

1974

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1975

1401

@dbus.service.signal(_interface, signature="sv")

1976

1402

def PropertyChanged(self, property, value):

1977

1403

"D-Bus signal"

1978

1404

pass

1979

1405

1980

1406

# GotSecret - signal

1981

1407

@dbus.service.signal(_interface)

1982

1408

def GotSecret(self):

1985

1411

server to mandos-client

1986

1412

"""

1987

1413

pass

1988

1414

1989

1415

# Rejected - signal

1990

1416

@dbus.service.signal(_interface, signature="s")

1991

1417

def Rejected(self, reason):

1992

1418

"D-Bus signal"

1993

1419

pass

1994

1420

1995

1421

# NeedApproval - signal

1996

1422

@dbus.service.signal(_interface, signature="tb")

1997

1423

def NeedApproval(self, timeout, default):

1998

1424

"D-Bus signal"

1999

1425

return self.need_approval()

2000

2001

# Methods

2002

1426

1427

## Methods

1428

2003

1429

# Approve - method

2004

1430

@dbus.service.method(_interface, in_signature="b")

2005

1431

def Approve(self, value):

2006

1432

self.approve(value)

2007

1433

2008

1434

# CheckedOK - method

2009

1435

@dbus.service.method(_interface)

2010

1436

def CheckedOK(self):

2011

1437

self.checked_ok()

2012

1438

2013

1439

# Enable - method

2014

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1440

@dbus.service.method(_interface)

2016

1441

def Enable(self):

2017

1442

"D-Bus method"

2018

1443

self.enable()

2019

1444

2020

1445

# StartChecker - method

2021

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2022

1446

@dbus.service.method(_interface)

2023

1447

def StartChecker(self):

2024

1448

"D-Bus method"

2025

1449

self.start_checker()

2026

1450

2027

1451

# Disable - method

2028

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2029

1452

@dbus.service.method(_interface)

2030

1453

def Disable(self):

2031

1454

"D-Bus method"

2032

1455

self.disable()

2033

1456

2034

1457

# StopChecker - method

2035

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2036

1458

@dbus.service.method(_interface)

2037

1459

def StopChecker(self):

2038

1460

self.stop_checker()

2039

2040

# Properties

2041

1461

1462

## Properties

1463

2042

1464

# ApprovalPending - property

2043

1465

@dbus_service_property(_interface, signature="b", access="read")

2044

1466

def ApprovalPending_dbus_property(self):

2045

1467

return dbus.Boolean(bool(self.approvals_pending))

2046

1468

2047

1469

# ApprovedByDefault - property

2048

@dbus_service_property(_interface,

2049

signature="b",

1470

@dbus_service_property(_interface, signature="b",

2050

1471

access="readwrite")

2051

1472

def ApprovedByDefault_dbus_property(self, value=None):

2052

1473

if value is None: # get

2053

1474

return dbus.Boolean(self.approved_by_default)

2054

1475

self.approved_by_default = bool(value)

2055

1476

2056

1477

# ApprovalDelay - property

2057

@dbus_service_property(_interface,

2058

signature="t",

1478

@dbus_service_property(_interface, signature="t",

2059

1479

access="readwrite")

2060

1480

def ApprovalDelay_dbus_property(self, value=None):

2061

1481

if value is None: # get

2062

return dbus.UInt64(self.approval_delay.total_seconds()

2063

* 1000)

1482

return dbus.UInt64(self.approval_delay_milliseconds())

2064

1483

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2065

1484

2066

1485

# ApprovalDuration - property

2067

@dbus_service_property(_interface,

2068

signature="t",

1486

@dbus_service_property(_interface, signature="t",

2069

1487

access="readwrite")

2070

1488

def ApprovalDuration_dbus_property(self, value=None):

2071

1489

if value is None: # get

2072

return dbus.UInt64(self.approval_duration.total_seconds()

2073

* 1000)

1490

return dbus.UInt64(timedelta_to_milliseconds(

1491

self.approval_duration))

2074

1492

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2075

1493

2076

1494

# Name - property

2077

@dbus_annotations(

2078

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2079

1495

@dbus_service_property(_interface, signature="s", access="read")

2080

1496

def Name_dbus_property(self):

2081

1497

return dbus.String(self.name)

2082

2083

# KeyID - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

@dbus_service_property(_interface, signature="s", access="read")

2087

def KeyID_dbus_property(self):

2088

return dbus.String(self.key_id)

2089

1498

2090

1499

# Fingerprint - property

2091

@dbus_annotations(

2092

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2093

1500

@dbus_service_property(_interface, signature="s", access="read")

2094

1501

def Fingerprint_dbus_property(self):

2095

1502

return dbus.String(self.fingerprint)

2096

1503

2097

1504

# Host - property

2098

@dbus_service_property(_interface,

2099

signature="s",

1505

@dbus_service_property(_interface, signature="s",

2100

1506

access="readwrite")

2101

1507

def Host_dbus_property(self, value=None):

2102

1508

if value is None: # get

2103

1509

return dbus.String(self.host)

2104

self.host = str(value)

2105

1510

self.host = unicode(value)

1511

2106

1512

# Created - property

2107

@dbus_annotations(

2108

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2109

1513

@dbus_service_property(_interface, signature="s", access="read")

2110

1514

def Created_dbus_property(self):

2111

1515

return datetime_to_dbus(self.created)

2112

1516

2113

1517

# LastEnabled - property

2114

1518

@dbus_service_property(_interface, signature="s", access="read")

2115

1519

def LastEnabled_dbus_property(self):

2116

1520

return datetime_to_dbus(self.last_enabled)

2117

1521

2118

1522

# Enabled - property

2119

@dbus_service_property(_interface,

2120

signature="b",

1523

@dbus_service_property(_interface, signature="b",

2121

1524

access="readwrite")

2122

1525

def Enabled_dbus_property(self, value=None):

2123

1526

if value is None: # get

2126

1529

self.enable()

2127

1530

else:

2128

1531

self.disable()

2129

1532

2130

1533

# LastCheckedOK - property

2131

@dbus_service_property(_interface,

2132

signature="s",

1534

@dbus_service_property(_interface, signature="s",

2133

1535

access="readwrite")

2134

1536

def LastCheckedOK_dbus_property(self, value=None):

2135

1537

if value is not None:

2136

1538

self.checked_ok()

2137

1539

return

2138

1540

return datetime_to_dbus(self.last_checked_ok)

2139

1541

2140

1542

# LastCheckerStatus - property

2141

@dbus_service_property(_interface, signature="n", access="read")

1543

@dbus_service_property(_interface, signature="n",

1544

access="read")

2142

1545

def LastCheckerStatus_dbus_property(self):

2143

1546

return dbus.Int16(self.last_checker_status)

2144

1547

2145

1548

# Expires - property

2146

1549

@dbus_service_property(_interface, signature="s", access="read")

2147

1550

def Expires_dbus_property(self):

2148

1551

return datetime_to_dbus(self.expires)

2149

1552

2150

1553

# LastApprovalRequest - property

2151

1554

@dbus_service_property(_interface, signature="s", access="read")

2152

1555

def LastApprovalRequest_dbus_property(self):

2153

1556

return datetime_to_dbus(self.last_approval_request)

2154

1557

2155

1558

# Timeout - property

2156

@dbus_service_property(_interface,

2157

signature="t",

1559

@dbus_service_property(_interface, signature="t",

2158

1560

access="readwrite")

2159

1561

def Timeout_dbus_property(self, value=None):

2160

1562

if value is None: # get

2161

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1563

return dbus.UInt64(self.timeout_milliseconds())

2162

1564

old_timeout = self.timeout

2163

1565

self.timeout = datetime.timedelta(0, 0, 0, value)

2164

1566

# Reschedule disabling

2172

1574

if (getattr(self, "disable_initiator_tag", None)

2173

1575

is None):

2174

1576

return

2175

GLib.source_remove(self.disable_initiator_tag)

2176

self.disable_initiator_tag = GLib.timeout_add(

2177

int((self.expires - now).total_seconds() * 1000),

2178

self.disable)

2179

1577

gobject.source_remove(self.disable_initiator_tag)

1578

self.disable_initiator_tag = (

1579

gobject.timeout_add(

1580

timedelta_to_milliseconds(self.expires - now),

1581

self.disable))

1582

2180

1583

# ExtendedTimeout - property

2181

@dbus_service_property(_interface,

2182

signature="t",

1584

@dbus_service_property(_interface, signature="t",

2183

1585

access="readwrite")

2184

1586

def ExtendedTimeout_dbus_property(self, value=None):

2185

1587

if value is None: # get

2186

return dbus.UInt64(self.extended_timeout.total_seconds()

2187

* 1000)

1588

return dbus.UInt64(self.extended_timeout_milliseconds())

2188

1589

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2189

1590

2190

1591

# Interval - property

2191

@dbus_service_property(_interface,

2192

signature="t",

1592

@dbus_service_property(_interface, signature="t",

2193

1593

access="readwrite")

2194

1594

def Interval_dbus_property(self, value=None):

2195

1595

if value is None: # get

2196

return dbus.UInt64(self.interval.total_seconds() * 1000)

1596

return dbus.UInt64(self.interval_milliseconds())

2197

1597

self.interval = datetime.timedelta(0, 0, 0, value)

2198

1598

if getattr(self, "checker_initiator_tag", None) is None:

2199

1599

return

2200

1600

if self.enabled:

2201

1601

# Reschedule checker run

2202

GLib.source_remove(self.checker_initiator_tag)

2203

self.checker_initiator_tag = GLib.timeout_add(

2204

value, self.start_checker)

2205

self.start_checker() # Start one now, too

2206

1602

gobject.source_remove(self.checker_initiator_tag)

1603

self.checker_initiator_tag = (gobject.timeout_add

1604

(value, self.start_checker))

1605

self.start_checker() # Start one now, too

1606

2207

1607

# Checker - property

2208

@dbus_service_property(_interface,

2209

signature="s",

1608

@dbus_service_property(_interface, signature="s",

2210

1609

access="readwrite")

2211

1610

def Checker_dbus_property(self, value=None):

2212

1611

if value is None: # get

2213

1612

return dbus.String(self.checker_command)

2214

self.checker_command = str(value)

2215

1613

self.checker_command = unicode(value)

1614

2216

1615

# CheckerRunning - property

2217

@dbus_service_property(_interface,

2218

signature="b",

1616

@dbus_service_property(_interface, signature="b",

2219

1617

access="readwrite")

2220

1618

def CheckerRunning_dbus_property(self, value=None):

2221

1619

if value is None: # get

2224

1622

self.start_checker()

2225

1623

else:

2226

1624

self.stop_checker()

2227

1625

2228

1626

# ObjectPath - property

2229

@dbus_annotations(

2230

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2231

"org.freedesktop.DBus.Deprecated": "true"})

2232

1627

@dbus_service_property(_interface, signature="o", access="read")

2233

1628

def ObjectPath_dbus_property(self):

2234

return self.dbus_object_path # is already a dbus.ObjectPath

2235

1629

return self.dbus_object_path # is already a dbus.ObjectPath

1630

2236

1631

# Secret = property

2237

@dbus_annotations(

2238

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2239

"invalidates"})

2240

@dbus_service_property(_interface,

2241

signature="ay",

2242

access="write",

2243

byte_arrays=True)

1632

@dbus_service_property(_interface, signature="ay",

1633

access="write", byte_arrays=True)

2244

1634

def Secret_dbus_property(self, value):

2245

self.secret = bytes(value)

2246

1635

self.secret = str(value)

1636

2247

1637

del _interface

2248

1638

2249

1639

2250

class ProxyClient:

2251

def __init__(self, child_pipe, key_id, fpr, address):

1640

class ProxyClient(object):

1641

def __init__(self, child_pipe, fpr, address):

2252

1642

self._pipe = child_pipe

2253

self._pipe.send(('init', key_id, fpr, address))

1643

self._pipe.send(('init', fpr, address))

2254

1644

if not self._pipe.recv():

2255

raise KeyError(key_id or fpr)

2256

1645

raise KeyError()

1646

2257

1647

def __getattribute__(self, name):

2258

1648

if name == '_pipe':

2259

1649

return super(ProxyClient, self).__getattribute__(name)

2262

1652

if data[0] == 'data':

2263

1653

return data[1]

2264

1654

if data[0] == 'function':

2265

2266

1655

def func(*args, **kwargs):

2267

1656

self._pipe.send(('funcall', name, args, kwargs))

2268

1657

return self._pipe.recv()[1]

2269

2270

1658

return func

2271

1659

2272

1660

def __setattr__(self, name, value):

2273

1661

if name == '_pipe':

2274

1662

return super(ProxyClient, self).__setattr__(name, value)

2277

1665

2278

1666

class ClientHandler(socketserver.BaseRequestHandler, object):

2279

1667

"""A class to handle client connections.

2280

1668

2281

1669

Instantiated once for each connection to handle it.

2282

1670

Note: This will run in its own forked process."""

2283

1671

2284

1672

def handle(self):

2285

1673

with contextlib.closing(self.server.child_pipe) as child_pipe:

2286

1674

logger.info("TCP connection from: %s",

2287

str(self.client_address))

1675

unicode(self.client_address))

2288

1676

logger.debug("Pipe FD: %d",

2289

1677

self.server.child_pipe.fileno())

2290

2291

session = gnutls.ClientSession(self.request)

2292

2293

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2294

# "+AES-256-CBC", "+SHA1",

2295

# "+COMP-NULL", "+CTYPE-OPENPGP",

2296

# "+DHE-DSS"))

1678

1679

session = (gnutls.connection

1680

.ClientSession(self.request,

1681

gnutls.connection

1682

.X509Credentials()))

1683

1684

# Note: gnutls.connection.X509Credentials is really a

1685

# generic GnuTLS certificate credentials object so long as

1686

# no X.509 keys are added to it. Therefore, we can use it

1687

# here despite using OpenPGP certificates.

1688

1689

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1690

# "+AES-256-CBC", "+SHA1",

1691

# "+COMP-NULL", "+CTYPE-OPENPGP",

1692

# "+DHE-DSS"))

2297

1693

# Use a fallback default, since this MUST be set.

2298

1694

priority = self.server.gnutls_priority

2299

1695

if priority is None:

2300

1696

priority = "NORMAL"

2301

gnutls.priority_set_direct(session._c_object,

2302

priority.encode("utf-8"),

2303

None)

2304

1697

(gnutls.library.functions

1698

.gnutls_priority_set_direct(session._c_object,

1699

priority, None))

1700

2305

1701

# Start communication using the Mandos protocol

2306

1702

# Get protocol number

2307

1703

line = self.request.makefile().readline()

2312

1708

except (ValueError, IndexError, RuntimeError) as error:

2313

1709

logger.error("Unknown protocol version: %s", error)

2314

1710

return

2315

1711

2316

1712

# Start GnuTLS connection

2317

1713

try:

2318

1714

session.handshake()

2319

except gnutls.Error as error:

1715

except gnutls.errors.GNUTLSError as error:

2320

1716

logger.warning("Handshake failed: %s", error)

2321

1717

# Do not run session.bye() here: the session is not

2322

1718

# established. Just abandon the request.

2323

1719

return

2324

1720

logger.debug("Handshake succeeded")

2325

1721

2326

1722

approval_required = False

2327

1723

try:

2328

if gnutls.has_rawpk:

2329

fpr = b""

2330

try:

2331

key_id = self.key_id(

2332

self.peer_certificate(session))

2333

except (TypeError, gnutls.Error) as error:

2334

logger.warning("Bad certificate: %s", error)

2335

return

2336

logger.debug("Key ID: %s", key_id)

2337

2338

else:

2339

key_id = b""

2340

try:

2341

fpr = self.fingerprint(

2342

self.peer_certificate(session))

2343

except (TypeError, gnutls.Error) as error:

2344

logger.warning("Bad certificate: %s", error)

2345

return

2346

logger.debug("Fingerprint: %s", fpr)

2347

2348

try:

2349

client = ProxyClient(child_pipe, key_id, fpr,

1724

try:

1725

fpr = self.fingerprint(self.peer_certificate

1726

(session))

1727

except (TypeError,

1728

gnutls.errors.GNUTLSError) as error:

1729

logger.warning("Bad certificate: %s", error)

1730

return

1731

logger.debug("Fingerprint: %s", fpr)

1732

1733

try:

1734

client = ProxyClient(child_pipe, fpr,

2350

1735

self.client_address)

2351

1736

except KeyError:

2352

1737

return

2353

1738

2354

1739

if client.approval_delay:

2355

1740

delay = client.approval_delay

2356

1741

client.approvals_pending += 1

2357

1742

approval_required = True

2358

1743

2359

1744

while True:

2360

1745

if not client.enabled:

2361

1746

logger.info("Client %s is disabled",

2362

client.name)

1747

client.name)

2363

1748

if self.server.use_dbus:

2364

1749

# Emit D-Bus signal

2365

1750

client.Rejected("Disabled")

2366

1751

return

2367

1752

2368

1753

if client.approved or not client.approval_delay:

2369

# We are approved or approval is disabled

1754

#We are approved or approval is disabled

2370

1755

break

2371

1756

elif client.approved is None:

2372

1757

logger.info("Client %s needs approval",

2374

1759

if self.server.use_dbus:

2375

1760

# Emit D-Bus signal

2376

1761

client.NeedApproval(

2377

client.approval_delay.total_seconds()

2378

* 1000, client.approved_by_default)

1762

client.approval_delay_milliseconds(),

1763

client.approved_by_default)

2379

1764

else:

2380

1765

logger.warning("Client %s was not approved",

2381

1766

client.name)

2383

1768

# Emit D-Bus signal

2384

1769

client.Rejected("Denied")

2385

1770

return

2386

2387

# wait until timeout or approved

1771

1772

#wait until timeout or approved

2388

1773

time = datetime.datetime.now()

2389

1774

client.changedstate.acquire()

2390

client.changedstate.wait(delay.total_seconds())

1775

client.changedstate.wait(

1776

float(timedelta_to_milliseconds(delay)

1777

/ 1000))

2391

1778

client.changedstate.release()

2392

1779

time2 = datetime.datetime.now()

2393

1780

if (time2 - time) >= delay:

2403

1790

break

2404

1791

else:

2405

1792

delay -= time2 - time

2406

2407

try:

2408

session.send(client.secret)

2409

except gnutls.Error as error:

2410

logger.warning("gnutls send failed",

2411

exc_info=error)

2412

return

2413

1793

1794

sent_size = 0

1795

while sent_size < len(client.secret):

1796

try:

1797

sent = session.send(client.secret[sent_size:])

1798

except gnutls.errors.GNUTLSError as error:

1799

logger.warning("gnutls send failed",

1800

exc_info=error)

1801

return

1802

logger.debug("Sent: %d, remaining: %d",

1803

sent, len(client.secret)

1804

- (sent_size + sent))

1805

sent_size += sent

1806

2414

1807

logger.info("Sending secret to %s", client.name)

2415

1808

# bump the timeout using extended_timeout

2416

1809

client.bump_timeout(client.extended_timeout)

2417

1810

if self.server.use_dbus:

2418

1811

# Emit D-Bus signal

2419

1812

client.GotSecret()

2420

1813

2421

1814

finally:

2422

1815

if approval_required:

2423

1816

client.approvals_pending -= 1

2424

1817

try:

2425

1818

session.bye()

2426

except gnutls.Error as error:

1819

except gnutls.errors.GNUTLSError as error:

2427

1820

logger.warning("GnuTLS bye failed",

2428

1821

exc_info=error)

2429

1822

2430

1823

@staticmethod

2431

1824

def peer_certificate(session):

2432

"Return the peer's certificate as a bytestring"

2433

try:

2434

cert_type = gnutls.certificate_type_get2(session._c_object,

2435

gnutls.CTYPE_PEERS)

2436

except AttributeError:

2437

cert_type = gnutls.certificate_type_get(session._c_object)

2438

if gnutls.has_rawpk:

2439

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2440

else:

2441

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2442

# If not a valid certificate type...

2443

if cert_type not in valid_cert_types:

2444

logger.info("Cert type %r not in %r", cert_type,

2445

valid_cert_types)

2446

# ...return invalid data

2447

return b""

1825

"Return the peer's OpenPGP certificate as a bytestring"

1826

# If not an OpenPGP certificate...

1827

if (gnutls.library.functions

1828

.gnutls_certificate_type_get(session._c_object)

1829

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1830

# ...do the normal thing

1831

return session.peer_certificate

2448

1832

list_size = ctypes.c_uint(1)

2449

cert_list = (gnutls.certificate_get_peers

1833

cert_list = (gnutls.library.functions

1834

.gnutls_certificate_get_peers

2450

1835

(session._c_object, ctypes.byref(list_size)))

2451

1836

if not bool(cert_list) and list_size.value != 0:

2452

raise gnutls.Error("error getting peer certificate")

1837

raise gnutls.errors.GNUTLSError("error getting peer"

1838

" certificate")

2453

1839

if list_size.value == 0:

2454

1840

return None

2455

1841

cert = cert_list[0]

2456

1842

return ctypes.string_at(cert.data, cert.size)

2457

2458

@staticmethod

2459

def key_id(certificate):

2460

"Convert a certificate bytestring to a hexdigit key ID"

2461

# New GnuTLS "datum" with the public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(certificate),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(certificate)))

2466

# XXX all these need to be created in the gnutls "module"

2467

# New empty GnuTLS certificate

2468

pubkey = gnutls.pubkey_t()

2469

gnutls.pubkey_init(ctypes.byref(pubkey))

2470

# Import the raw public key into the certificate

2471

gnutls.pubkey_import(pubkey,

2472

ctypes.byref(datum),

2473

gnutls.X509_FMT_DER)

2474

# New buffer for the key ID

2475

buf = ctypes.create_string_buffer(32)

2476

buf_len = ctypes.c_size_t(len(buf))

2477

# Get the key ID from the raw public key into the buffer

2478

gnutls.pubkey_get_key_id(

2479

pubkey,

2480

gnutls.KEYID_USE_SHA256,

2481

ctypes.cast(ctypes.byref(buf),

2482

ctypes.POINTER(ctypes.c_ubyte)),

2483

ctypes.byref(buf_len))

2484

# Deinit the certificate

2485

gnutls.pubkey_deinit(pubkey)

2486

2487

# Convert the buffer to a Python bytestring

2488

key_id = ctypes.string_at(buf, buf_len.value)

2489

# Convert the bytestring to hexadecimal notation

2490

hex_key_id = binascii.hexlify(key_id).upper()

2491

return hex_key_id

2492

1843

2493

1844

@staticmethod

2494

1845

def fingerprint(openpgp):

2495

1846

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2496

1847

# New GnuTLS "datum" with the OpenPGP public key

2497

datum = gnutls.datum_t(

2498

ctypes.cast(ctypes.c_char_p(openpgp),

2499

ctypes.POINTER(ctypes.c_ubyte)),

2500

ctypes.c_uint(len(openpgp)))

1848

datum = (gnutls.library.types

1849

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1850

ctypes.POINTER

1851

(ctypes.c_ubyte)),

1852

ctypes.c_uint(len(openpgp))))

2501

1853

# New empty GnuTLS certificate

2502

crt = gnutls.openpgp_crt_t()

2503

gnutls.openpgp_crt_init(ctypes.byref(crt))

1854

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1855

(gnutls.library.functions

1856

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2504

1857

# Import the OpenPGP public key into the certificate

2505

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2506

gnutls.OPENPGP_FMT_RAW)

1858

(gnutls.library.functions

1859

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1860

gnutls.library.constants

1861

.GNUTLS_OPENPGP_FMT_RAW))

2507

1862

# Verify the self signature in the key

2508

1863

crtverify = ctypes.c_uint()

2509

gnutls.openpgp_crt_verify_self(crt, 0,

2510

ctypes.byref(crtverify))

1864

(gnutls.library.functions

1865

.gnutls_openpgp_crt_verify_self(crt, 0,

1866

ctypes.byref(crtverify)))

2511

1867

if crtverify.value != 0:

2512

gnutls.openpgp_crt_deinit(crt)

2513

raise gnutls.CertificateSecurityError(code

2514

=crtverify.value)

1868

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1869

raise (gnutls.errors.CertificateSecurityError

1870

("Verify failed"))

2515

1871

# New buffer for the fingerprint

2516

1872

buf = ctypes.create_string_buffer(20)

2517

1873

buf_len = ctypes.c_size_t()

2518

1874

# Get the fingerprint from the certificate into the buffer

2519

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2520

ctypes.byref(buf_len))

1875

(gnutls.library.functions

1876

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1877

ctypes.byref(buf_len)))

2521

1878

# Deinit the certificate

2522

gnutls.openpgp_crt_deinit(crt)

1879

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2523

1880

# Convert the buffer to a Python bytestring

2524

1881

fpr = ctypes.string_at(buf, buf_len.value)

2525

1882

# Convert the bytestring to hexadecimal notation

2527

1884

return hex_fpr

2528

1885

2529

1886

2530

class MultiprocessingMixIn:

1887

class MultiprocessingMixIn(object):

2531

1888

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2532

2533

1889

def sub_process_main(self, request, address):

2534

1890

try:

2535

1891

self.finish_request(request, address)

2536

1892

except Exception:

2537

1893

self.handle_error(request, address)

2538

1894

self.close_request(request)

2539

1895

2540

1896

def process_request(self, request, address):

2541

1897

"""Start a new process to process the request."""

2542

proc = multiprocessing.Process(target=self.sub_process_main,

2543

args=(request, address))

1898

proc = multiprocessing.Process(target = self.sub_process_main,

1899

args = (request, address))

2544

1900

proc.start()

2545

1901

return proc

2546

1902

2547

1903

2548

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1904

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2549

1905

""" adds a pipe to the MixIn """

2550

2551

1906

def process_request(self, request, client_address):

2552

1907

"""Overrides and wraps the original process_request().

2553

1908

2554

1909

This function creates a new pipe in self.pipe

2555

1910

"""

2556

1911

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2557

1912

2558

1913

proc = MultiprocessingMixIn.process_request(self, request,

2559

1914

client_address)

2560

1915

self.child_pipe.close()

2561

1916

self.add_pipe(parent_pipe, proc)

2562

1917

2563

1918

def add_pipe(self, parent_pipe, proc):

2564

1919

"""Dummy function; override as necessary"""

2565

1920

raise NotImplementedError()

2566

1921

2567

1922

2568

1923

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2569

socketserver.TCPServer):

1924

socketserver.TCPServer, object):

2570

1925

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2571

1926

2572

1927

Attributes:

2573

1928

enabled: Boolean; whether this server is activated yet

2574

1929

interface: None or a network interface name (string)

2575

1930

use_ipv6: Boolean; to use IPv6 or not

2576

1931

"""

2577

2578

1932

def __init__(self, server_address, RequestHandlerClass,

2579

interface=None,

2580

use_ipv6=True,

2581

socketfd=None):

1933

interface=None, use_ipv6=True, socketfd=None):

2582

1934

"""If socketfd is set, use that file descriptor instead of

2583

1935

creating a new one with socket.socket().

2584

1936

"""

2590

1942

self.socketfd = socketfd

2591

1943

# Save the original socket.socket() function

2592

1944

self.socket_socket = socket.socket

2593

2594

1945

# To implement --socket, we monkey patch socket.socket.

2595

#

1946

#

2596

1947

# (When socketserver.TCPServer is a new-style class, we

2597

1948

# could make self.socket into a property instead of monkey

2598

1949

# patching socket.socket.)

2599

#

1950

#

2600

1951

# Create a one-time-only replacement for socket.socket()

2601

1952

@functools.wraps(socket.socket)

2602

1953

def socket_wrapper(*args, **kwargs):

2614

1965

# socket_wrapper(), if socketfd was set.

2615

1966

socketserver.TCPServer.__init__(self, server_address,

2616

1967

RequestHandlerClass)

2617

1968

2618

1969

def server_bind(self):

2619

1970

"""This overrides the normal server_bind() function

2620

1971

to bind to an interface if one was specified, and also NOT to

2621

1972

bind to an address or port if they were not specified."""

2622

global SO_BINDTODEVICE

2623

1973

if self.interface is not None:

2624

1974

if SO_BINDTODEVICE is None:

2625

# Fall back to a hard-coded value which seems to be

2626

# common enough.

2627

logger.warning("SO_BINDTODEVICE not found, trying 25")

2628

SO_BINDTODEVICE = 25

2629

try:

2630

self.socket.setsockopt(

2631

socket.SOL_SOCKET, SO_BINDTODEVICE,

2632

(self.interface + "\0").encode("utf-8"))

2633

except socket.error as error:

2634

if error.errno == errno.EPERM:

2635

logger.error("No permission to bind to"

2636

" interface %s", self.interface)

2637

elif error.errno == errno.ENOPROTOOPT:

2638

logger.error("SO_BINDTODEVICE not available;"

2639

" cannot bind to interface %s",

2640

self.interface)

2641

elif error.errno == errno.ENODEV:

2642

logger.error("Interface %s does not exist,"

2643

" cannot bind", self.interface)

2644

else:

2645

raise

1975

logger.error("SO_BINDTODEVICE does not exist;"

1976

" cannot bind to interface %s",

1977

self.interface)

1978

else:

1979

try:

1980

self.socket.setsockopt(socket.SOL_SOCKET,

1981

SO_BINDTODEVICE,

1982

str(self.interface + '\0'))

1983

except socket.error as error:

1984

if error.errno == errno.EPERM:

1985

logger.error("No permission to bind to"

1986

" interface %s", self.interface)

1987

elif error.errno == errno.ENOPROTOOPT:

1988

logger.error("SO_BINDTODEVICE not available;"

1989

" cannot bind to interface %s",

1990

self.interface)

1991

elif error.errno == errno.ENODEV:

1992

logger.error("Interface %s does not exist,"

1993

" cannot bind", self.interface)

1994

else:

1995

raise

2646

1996

# Only bind(2) the socket if we really need to.

2647

1997

if self.server_address[0] or self.server_address[1]:

2648

if self.server_address[1]:

2649

self.allow_reuse_address = True

2650

1998

if not self.server_address[0]:

2651

1999

if self.address_family == socket.AF_INET6:

2652

any_address = "::" # in6addr_any

2000

any_address = "::" # in6addr_any

2653

2001

else:

2654

any_address = "0.0.0.0" # INADDR_ANY

2002

any_address = "0.0.0.0" # INADDR_ANY

2655

2003

self.server_address = (any_address,

2656

2004

self.server_address[1])

2657

2005

elif not self.server_address[1]:

2658

self.server_address = (self.server_address[0], 0)

2006

self.server_address = (self.server_address[0],

2007

0)

2659

2008

# if self.interface:

2660

2009

# self.server_address = (self.server_address[0],

2661

2010

# 0, # port

2667

2016

2668

2017

class MandosServer(IPv6_TCPServer):

2669

2018

"""Mandos server.

2670

2019

2671

2020

Attributes:

2672

2021

clients: set of Client objects

2673

2022

gnutls_priority GnuTLS priority string

2674

2023

use_dbus: Boolean; to emit D-Bus signals or not

2675

2676

Assumes a GLib.MainLoop event loop.

2024

2025

Assumes a gobject.MainLoop event loop.

2677

2026

"""

2678

2679

2027

def __init__(self, server_address, RequestHandlerClass,

2680

interface=None,

2681

use_ipv6=True,

2682

clients=None,

2683

gnutls_priority=None,

2684

use_dbus=True,

2685

socketfd=None):

2028

interface=None, use_ipv6=True, clients=None,

2029

gnutls_priority=None, use_dbus=True, socketfd=None):

2686

2030

self.enabled = False

2687

2031

self.clients = clients

2688

2032

if self.clients is None:

2691

2035

self.gnutls_priority = gnutls_priority

2692

2036

IPv6_TCPServer.__init__(self, server_address,

2693

2037

RequestHandlerClass,

2694

interface=interface,

2695

use_ipv6=use_ipv6,

2696

socketfd=socketfd)

2697

2038

interface = interface,

2039

use_ipv6 = use_ipv6,

2040

socketfd = socketfd)

2698

2041

def server_activate(self):

2699

2042

if self.enabled:

2700

2043

return socketserver.TCPServer.server_activate(self)

2701

2044

2702

2045

def enable(self):

2703

2046

self.enabled = True

2704

2047

2705

2048

def add_pipe(self, parent_pipe, proc):

2706

2049

# Call "handle_ipc" for both data and EOF events

2707

GLib.io_add_watch(

2708

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2709

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2710

functools.partial(self.handle_ipc,

2711

parent_pipe=parent_pipe,

2712

proc=proc))

2713

2714

def handle_ipc(self, source, condition,

2715

parent_pipe=None,

2716

proc=None,

2717

client_object=None):

2050

gobject.io_add_watch(parent_pipe.fileno(),

2051

gobject.IO_IN | gobject.IO_HUP,

2052

functools.partial(self.handle_ipc,

2053

parent_pipe =

2054

parent_pipe,

2055

proc = proc))

2056

2057

def handle_ipc(self, source, condition, parent_pipe=None,

2058

proc = None, client_object=None):

2718

2059

# error, or the other end of multiprocessing.Pipe has closed

2719

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2060

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2720

2061

# Wait for other process to exit

2721

2062

proc.join()

2722

2063

return False

2723

2064

2724

2065

# Read a request from the child

2725

2066

request = parent_pipe.recv()

2726

2067

command = request[0]

2727

2068

2728

2069

if command == 'init':

2729

key_id = request[1].decode("ascii")

2730

fpr = request[2].decode("ascii")

2731

address = request[3]

2732

2733

for c in self.clients.values():

2734

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2735

"27AE41E4649B934CA495991B7852B855"):

2736

continue

2737

if key_id and c.key_id == key_id:

2738

client = c

2739

break

2740

if fpr and c.fingerprint == fpr:

2070

fpr = request[1]

2071

address = request[2]

2072

2073

for c in self.clients.itervalues():

2074

if c.fingerprint == fpr:

2741

2075

client = c

2742

2076

break

2743

2077

else:

2744

logger.info("Client not found for key ID: %s, address"

2745

": %s", key_id or fpr, address)

2078

logger.info("Client not found for fingerprint: %s, ad"

2079

"dress: %s", fpr, address)

2746

2080

if self.use_dbus:

2747

2081

# Emit D-Bus signal

2748

mandos_dbus_service.ClientNotFound(key_id or fpr,

2082

mandos_dbus_service.ClientNotFound(fpr,

2749

2083

address[0])

2750

2084

parent_pipe.send(False)

2751

2085

return False

2752

2753

GLib.io_add_watch(

2754

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2755

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2756

functools.partial(self.handle_ipc,

2757

parent_pipe=parent_pipe,

2758

proc=proc,

2759

client_object=client))

2086

2087

gobject.io_add_watch(parent_pipe.fileno(),

2088

gobject.IO_IN | gobject.IO_HUP,

2089

functools.partial(self.handle_ipc,

2090

parent_pipe =

2091

parent_pipe,

2092

proc = proc,

2093

client_object =

2094

client))

2760

2095

parent_pipe.send(True)

2761

2096

# remove the old hook in favor of the new above hook on

2762

2097

# same fileno

2765

2100

funcname = request[1]

2766

2101

args = request[2]

2767

2102

kwargs = request[3]

2768

2103

2769

2104

parent_pipe.send(('data', getattr(client_object,

2770

2105

funcname)(*args,

2771

**kwargs)))

2772

2106

**kwargs)))

2107

2773

2108

if command == 'getattr':

2774

2109

attrname = request[1]

2775

if isinstance(client_object.__getattribute__(attrname),

2776

collections.abc.Callable):

2777

parent_pipe.send(('function', ))

2110

if callable(client_object.__getattribute__(attrname)):

2111

parent_pipe.send(('function',))

2778

2112

else:

2779

parent_pipe.send((

2780

'data', client_object.__getattribute__(attrname)))

2781

2113

parent_pipe.send(('data', client_object

2114

.__getattribute__(attrname)))

2115

2782

2116

if command == 'setattr':

2783

2117

attrname = request[1]

2784

2118

value = request[2]

2785

2119

setattr(client_object, attrname, value)

2786

2120

2787

2121

return True

2788

2122

2789

2123

2790

2124

def rfc3339_duration_to_delta(duration):

2791

2125

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2792

2793

>>> timedelta = datetime.timedelta

2794

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2795

True

2796

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2797

True

2798

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2799

True

2800

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2801

True

2802

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2803

True

2804

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2805

True

2806

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2807

True

2808

>>> del timedelta

2126

2127

>>> rfc3339_duration_to_delta("P7D")

2128

datetime.timedelta(7)

2129

>>> rfc3339_duration_to_delta("PT60S")

2130

datetime.timedelta(0, 60)

2131

>>> rfc3339_duration_to_delta("PT60M")

2132

datetime.timedelta(0, 3600)

2133

>>> rfc3339_duration_to_delta("PT24H")

2134

datetime.timedelta(1)

2135

>>> rfc3339_duration_to_delta("P1W")

2136

datetime.timedelta(7)

2137

>>> rfc3339_duration_to_delta("PT5M30S")

2138

datetime.timedelta(0, 330)

2139

>>> rfc3339_duration_to_delta("P1DT3M20S")

2140

datetime.timedelta(1, 200)

2809

2141

"""

2810

2142

2811

2143

# Parsing an RFC 3339 duration with regular expressions is not

2812

2144

# possible - there would have to be multiple places for the same

2813

2145

# values, like seconds. The current code, while more esoteric, is

2814

2146

# cleaner without depending on a parsing library. If Python had a

2815

2147

# built-in library for parsing we would use it, but we'd like to

2816

2148

# avoid excessive use of external libraries.

2817

2149

2818

2150

# New type for defining tokens, syntax, and semantics all-in-one

2819

Token = collections.namedtuple("Token", (

2820

"regexp", # To match token; if "value" is not None, must have

2821

# a "group" containing digits

2822

"value", # datetime.timedelta or None

2823

"followers")) # Tokens valid after this token

2151

Token = collections.namedtuple("Token",

2152

("regexp", # To match token; if

2153

# "value" is not None,

2154

# must have a "group"

2155

# containing digits

2156

"value", # datetime.timedelta or

2157

# None

2158

"followers")) # Tokens valid after

2159

# this token

2824

2160

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2825

2161

# the "duration" ABNF definition in RFC 3339, Appendix A.

2826

2162

token_end = Token(re.compile(r"$"), None, frozenset())

2827

2163

token_second = Token(re.compile(r"(\d+)S"),

2828

2164

datetime.timedelta(seconds=1),

2829

frozenset((token_end, )))

2165

frozenset((token_end,)))

2830

2166

token_minute = Token(re.compile(r"(\d+)M"),

2831

2167

datetime.timedelta(minutes=1),

2832

2168

frozenset((token_second, token_end)))

2848

2184

frozenset((token_month, token_end)))

2849

2185

token_week = Token(re.compile(r"(\d+)W"),

2850

2186

datetime.timedelta(weeks=1),

2851

frozenset((token_end, )))

2187

frozenset((token_end,)))

2852

2188

token_duration = Token(re.compile(r"P"), None,

2853

2189

frozenset((token_year, token_month,

2854

2190

token_day, token_time,

2855

token_week)))

2856

# Define starting values:

2857

# Value so far

2858

value = datetime.timedelta()

2191

token_week))),

2192

# Define starting values

2193

value = datetime.timedelta() # Value so far

2859

2194

found_token = None

2860

# Following valid tokens

2861

followers = frozenset((token_duration, ))

2862

# String left to parse

2863

s = duration

2195

followers = frozenset(token_duration,) # Following valid tokens

2196

s = duration # String left to parse

2864

2197

# Loop until end token is found

2865

2198

while found_token is not token_end:

2866

2199

# Search for any currently valid tokens

2882

2215

break

2883

2216

else:

2884

2217

# No currently valid tokens were found

2885

raise ValueError("Invalid RFC 3339 duration: {!r}"

2886

.format(duration))

2218

raise ValueError("Invalid RFC 3339 duration")

2887

2219

# End token found

2888

2220

return value

2889

2221

2890

2222

2891

2223

def string_to_delta(interval):

2892

2224

"""Parse a string and return a datetime.timedelta

2893

2894

>>> string_to_delta('7d') == datetime.timedelta(7)

2895

True

2896

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2897

True

2898

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2899

True

2900

>>> string_to_delta('24h') == datetime.timedelta(1)

2901

True

2902

>>> string_to_delta('1w') == datetime.timedelta(7)

2903

True

2904

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2905

True

2225

2226

>>> string_to_delta('7d')

2227

datetime.timedelta(7)

2228

>>> string_to_delta('60s')

2229

datetime.timedelta(0, 60)

2230

>>> string_to_delta('60m')

2231

datetime.timedelta(0, 3600)

2232

>>> string_to_delta('24h')

2233

datetime.timedelta(1)

2234

>>> string_to_delta('1w')

2235

datetime.timedelta(7)

2236

>>> string_to_delta('5m 30s')

2237

datetime.timedelta(0, 330)

2906

2238

"""

2907

2239

2908

2240

try:

2909

2241

return rfc3339_duration_to_delta(interval)

2910

2242

except ValueError:

2911

2243

pass

2912

2244

2913

2245

timevalue = datetime.timedelta(0)

2914

2246

for s in interval.split():

2915

2247

try:

2916

suffix = s[-1]

2248

suffix = unicode(s[-1])

2917

2249

value = int(s[:-1])

2918

2250

if suffix == "d":

2919

2251

delta = datetime.timedelta(value)

2926

2258

elif suffix == "w":

2927

2259

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2928

2260

else:

2929

raise ValueError("Unknown suffix {!r}".format(suffix))

2261

raise ValueError("Unknown suffix {0!r}"

2262

.format(suffix))

2930

2263

except IndexError as e:

2931

2264

raise ValueError(*(e.args))

2932

2265

timevalue += delta

2933

2266

return timevalue

2934

2267

2935

2268

2936

def daemon(nochdir=False, noclose=False):

2269

def daemon(nochdir = False, noclose = False):

2937

2270

"""See daemon(3). Standard BSD Unix function.

2938

2271

2939

2272

This should really exist as os.daemon, but it doesn't (yet)."""

2940

2273

if os.fork():

2941

2274

sys.exit()

2949

2282

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2950

2283

if not stat.S_ISCHR(os.fstat(null).st_mode):

2951

2284

raise OSError(errno.ENODEV,

2952

"{} not a character device"

2285

"{0} not a character device"

2953

2286

.format(os.devnull))

2954

2287

os.dup2(null, sys.stdin.fileno())

2955

2288

os.dup2(null, sys.stdout.fileno())

2959

2292

2960

2293

2961

2294

def main():

2962

2295

2963

2296

##################################################################

2964

2297

# Parsing of options, both command line and config file

2965

2298

2966

2299

parser = argparse.ArgumentParser()

2967

2300

parser.add_argument("-v", "--version", action="version",

2968

version="%(prog)s {}".format(version),

2301

version = "%(prog)s {0}".format(version),

2969

2302

help="show version number and exit")

2970

2303

parser.add_argument("-i", "--interface", metavar="IF",

2971

2304

help="Bind to interface IF")

3004

2337

help="Directory to save/restore state in")

3005

2338

parser.add_argument("--foreground", action="store_true",

3006

2339

help="Run in foreground", default=None)

3007

parser.add_argument("--no-zeroconf", action="store_false",

3008

dest="zeroconf", help="Do not use Zeroconf",

3009

default=None)

3010

2340

3011

2341

options = parser.parse_args()

3012

2342

2343

if options.check:

2344

import doctest

2345

fail_count, test_count = doctest.testmod()

2346

sys.exit(os.EX_OK if fail_count == 0 else 1)

2347

3013

2348

# Default values for config file for server-global settings

3014

if gnutls.has_rawpk:

3015

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3016

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3017

else:

3018

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3019

":+SIGN-DSA-SHA256")

3020

server_defaults = {"interface": "",

3021

"address": "",

3022

"port": "",

3023

"debug": "False",

3024

"priority": priority,

3025

"servicename": "Mandos",

3026

"use_dbus": "True",

3027

"use_ipv6": "True",

3028

"debuglevel": "",

3029

"restore": "True",

3030

"socket": "",

3031

"statedir": "/var/lib/mandos",

3032

"foreground": "False",

3033

"zeroconf": "True",

3034

}

3035

del priority

3036

2349

server_defaults = { "interface": "",

2350

"address": "",

2351

"port": "",

2352

"debug": "False",

2353

"priority":

2354

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2355

"servicename": "Mandos",

2356

"use_dbus": "True",

2357

"use_ipv6": "True",

2358

"debuglevel": "",

2359

"restore": "True",

2360

"socket": "",

2361

"statedir": "/var/lib/mandos",

2362

"foreground": "False",

2363

}

2364

3037

2365

# Parse config file for server-global settings

3038

server_config = configparser.ConfigParser(server_defaults)

2366

server_config = configparser.SafeConfigParser(server_defaults)

3039

2367

del server_defaults

3040

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3041

# Convert the ConfigParser object to a dict

2368

server_config.read(os.path.join(options.configdir,

2369

"mandos.conf"))

2370

# Convert the SafeConfigParser object to a dict

3042

2371

server_settings = server_config.defaults()

3043

2372

# Use the appropriate methods on the non-string config options

3044

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3045

"foreground", "zeroconf"):

2373

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3046

2374

server_settings[option] = server_config.getboolean("DEFAULT",

3047

2375

option)

3048

2376

if server_settings["port"]:

3058

2386

server_settings["socket"] = os.dup(server_settings

3059

2387

["socket"])

3060

2388

del server_config

3061

2389

3062

2390

# Override the settings from the config file with command line

3063

2391

# options, if set.

3064

2392

for option in ("interface", "address", "port", "debug",

3065

"priority", "servicename", "configdir", "use_dbus",

3066

"use_ipv6", "debuglevel", "restore", "statedir",

3067

"socket", "foreground", "zeroconf"):

2393

"priority", "servicename", "configdir",

2394

"use_dbus", "use_ipv6", "debuglevel", "restore",

2395

"statedir", "socket", "foreground"):

3068

2396

value = getattr(options, option)

3069

2397

if value is not None:

3070

2398

server_settings[option] = value

3071

2399

del options

3072

2400

# Force all strings to be unicode

3073

2401

for option in server_settings.keys():

3074

if isinstance(server_settings[option], bytes):

3075

server_settings[option] = (server_settings[option]

3076

.decode("utf-8"))

2402

if type(server_settings[option]) is str:

2403

server_settings[option] = unicode(server_settings[option])

3077

2404

# Force all boolean options to be boolean

3078

2405

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3079

"foreground", "zeroconf"):

2406

"foreground"):

3080

2407

server_settings[option] = bool(server_settings[option])

3081

2408

# Debug implies foreground

3082

2409

if server_settings["debug"]:

3083

2410

server_settings["foreground"] = True

3084

2411

# Now we have our good server settings in "server_settings"

3085

2412

3086

2413

##################################################################

3087

3088

if (not server_settings["zeroconf"]

3089

and not (server_settings["port"]

3090

or server_settings["socket"] != "")):

3091

parser.error("Needs port or socket to work without Zeroconf")

3092

2414

3093

2415

# For convenience

3094

2416

debug = server_settings["debug"]

3095

2417

debuglevel = server_settings["debuglevel"]

3098

2420

stored_state_path = os.path.join(server_settings["statedir"],

3099

2421

stored_state_file)

3100

2422

foreground = server_settings["foreground"]

3101

zeroconf = server_settings["zeroconf"]

3102

2423

3103

2424

if debug:

3104

2425

initlogger(debug, logging.DEBUG)

3105

2426

else:

3108

2429

else:

3109

2430

level = getattr(logging, debuglevel.upper())

3110

2431

initlogger(debug, level)

3111

2432

3112

2433

if server_settings["servicename"] != "Mandos":

3113

syslogger.setFormatter(

3114

logging.Formatter('Mandos ({}) [%(process)d]:'

3115

' %(levelname)s: %(message)s'.format(

3116

server_settings["servicename"])))

3117

2434

syslogger.setFormatter(logging.Formatter

2435

('Mandos ({0}) [%(process)d]:'

2436

' %(levelname)s: %(message)s'

2437

.format(server_settings

2438

["servicename"])))

2439

3118

2440

# Parse config file with clients

3119

client_config = configparser.ConfigParser(Client.client_defaults)

2441

client_config = configparser.SafeConfigParser(Client

2442

.client_defaults)

3120

2443

client_config.read(os.path.join(server_settings["configdir"],

3121

2444

"clients.conf"))

3122

2445

3123

2446

global mandos_dbus_service

3124

2447

mandos_dbus_service = None

3125

3126

socketfd = None

3127

if server_settings["socket"] != "":

3128

socketfd = server_settings["socket"]

3129

tcp_server = MandosServer(

3130

(server_settings["address"], server_settings["port"]),

3131

ClientHandler,

3132

interface=(server_settings["interface"] or None),

3133

use_ipv6=use_ipv6,

3134

gnutls_priority=server_settings["priority"],

3135

use_dbus=use_dbus,

3136

socketfd=socketfd)

2448

2449

tcp_server = MandosServer((server_settings["address"],

2450

server_settings["port"]),

2451

ClientHandler,

2452

interface=(server_settings["interface"]

2453

or None),

2454

use_ipv6=use_ipv6,

2455

gnutls_priority=

2456

server_settings["priority"],

2457

use_dbus=use_dbus,

2458

socketfd=(server_settings["socket"]

2459

or None))

3137

2460

if not foreground:

3138

2461

pidfilename = "/run/mandos.pid"

3139

2462

if not os.path.isdir("/run/."):

3140

2463

pidfilename = "/var/run/mandos.pid"

3141

2464

pidfile = None

3142

2465

try:

3143

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2466

pidfile = open(pidfilename, "w")

3144

2467

except IOError as e:

3145

2468

logger.error("Could not open file %r", pidfilename,

3146

2469

exc_info=e)

3147

3148

for name, group in (("_mandos", "_mandos"),

3149

("mandos", "mandos"),

3150

("nobody", "nogroup")):

2470

2471

for name in ("_mandos", "mandos", "nobody"):

3151

2472

try:

3152

2473

uid = pwd.getpwnam(name).pw_uid

3153

gid = pwd.getpwnam(group).pw_gid

2474

gid = pwd.getpwnam(name).pw_gid

3154

2475

break

3155

2476

except KeyError:

3156

2477

continue

3160

2481

try:

3161

2482

os.setgid(gid)

3162

2483

os.setuid(uid)

3163

if debug:

3164

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3165

gid))

3166

2484

except OSError as error:

3167

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3168

.format(uid, gid, os.strerror(error.errno)))

3169

2485

if error.errno != errno.EPERM:

3170

2486

raise

3171

2487

3172

2488

if debug:

3173

2489

# Enable all possible GnuTLS debugging

3174

2490

3175

2491

# "Use a log level over 10 to enable all debugging options."

3176

2492

# - GnuTLS manual

3177

gnutls.global_set_log_level(11)

3178

3179

@gnutls.log_func

2493

gnutls.library.functions.gnutls_global_set_log_level(11)

2494

2495

@gnutls.library.types.gnutls_log_func

3180

2496

def debug_gnutls(level, string):

3181

2497

logger.debug("GnuTLS: %s", string[:-1])

3182

3183

gnutls.global_set_log_function(debug_gnutls)

3184

2498

2499

(gnutls.library.functions

2500

.gnutls_global_set_log_function(debug_gnutls))

2501

3185

2502

# Redirect stdin so all checkers get /dev/null

3186

2503

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3187

2504

os.dup2(null, sys.stdin.fileno())

3188

2505

if null > 2:

3189

2506

os.close(null)

3190

2507

3191

2508

# Need to fork before connecting to D-Bus

3192

2509

if not foreground:

3193

2510

# Close all input and output, do double fork, etc.

3194

2511

daemon()

3195

3196

if gi.version_info < (3, 10, 2):

3197

# multiprocessing will use threads, so before we use GLib we

3198

# need to inform GLib that threads will be used.

3199

GLib.threads_init()

3200

2512

2513

# multiprocessing will use threads, so before we use gobject we

2514

# need to inform gobject that threads will be used.

2515

gobject.threads_init()

2516

3201

2517

global main_loop

3202

2518

# From the Avahi example code

3203

2519

DBusGMainLoop(set_as_default=True)

3204

main_loop = GLib.MainLoop()

2520

main_loop = gobject.MainLoop()

3205

2521

bus = dbus.SystemBus()

3206

2522

# End of Avahi example code

3207

2523

if use_dbus:

3208

2524

try:

3209

2525

bus_name = dbus.service.BusName("se.recompile.Mandos",

3210

bus,

3211

do_not_queue=True)

3212

old_bus_name = dbus.service.BusName(

3213

"se.bsnet.fukt.Mandos", bus,

3214

do_not_queue=True)

3215

except dbus.exceptions.DBusException as e:

2526

bus, do_not_queue=True)

2527

old_bus_name = (dbus.service.BusName

2528

("se.bsnet.fukt.Mandos", bus,

2529

do_not_queue=True))

2530

except dbus.exceptions.NameExistsException as e:

3216

2531

logger.error("Disabling D-Bus:", exc_info=e)

3217

2532

use_dbus = False

3218

2533

server_settings["use_dbus"] = False

3219

2534

tcp_server.use_dbus = False

3220

if zeroconf:

3221

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3222

service = AvahiServiceToSyslog(

3223

name=server_settings["servicename"],

3224

servicetype="_mandos._tcp",

3225

protocol=protocol,

3226

bus=bus)

3227

if server_settings["interface"]:

3228

service.interface = if_nametoindex(

3229

server_settings["interface"].encode("utf-8"))

3230

2535

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2536

service = AvahiServiceToSyslog(name =

2537

server_settings["servicename"],

2538

servicetype = "_mandos._tcp",

2539

protocol = protocol, bus = bus)

2540

if server_settings["interface"]:

2541

service.interface = (if_nametoindex

2542

(str(server_settings["interface"])))

2543

3231

2544

global multiprocessing_manager

3232

2545

multiprocessing_manager = multiprocessing.Manager()

3233

2546

3234

2547

client_class = Client

3235

2548

if use_dbus:

3236

client_class = functools.partial(ClientDBus, bus=bus)

3237

2549

client_class = functools.partial(ClientDBus, bus = bus)

2550

3238

2551

client_settings = Client.config_parser(client_config)

3239

2552

old_client_settings = {}

3240

2553

clients_data = {}

3241

2554

3242

2555

# This is used to redirect stdout and stderr for checker processes

3243

2556

global wnull

3244

wnull = open(os.devnull, "w") # A writable /dev/null

2557

wnull = open(os.devnull, "w") # A writable /dev/null

3245

2558

# Only used if server is running in foreground but not in debug

3246

2559

# mode

3247

2560

if debug or not foreground:

3248

2561

wnull.close()

3249

2562

3250

2563

# Get client data and settings from last running state.

3251

2564

if server_settings["restore"]:

3252

2565

try:

3253

2566

with open(stored_state_path, "rb") as stored_state:

3254

if sys.version_info.major == 2:

3255

clients_data, old_client_settings = pickle.load(

3256

stored_state)

3257

else:

3258

bytes_clients_data, bytes_old_client_settings = (

3259

pickle.load(stored_state, encoding="bytes"))

3260

# Fix bytes to strings

3261

# clients_data

3262

# .keys()

3263

clients_data = {(key.decode("utf-8")

3264

if isinstance(key, bytes)

3265

else key): value

3266

for key, value in

3267

bytes_clients_data.items()}

3268

del bytes_clients_data

3269

for key in clients_data:

3270

value = {(k.decode("utf-8")

3271

if isinstance(k, bytes) else k): v

3272

for k, v in

3273

clients_data[key].items()}

3274

clients_data[key] = value

3275

# .client_structure

3276

value["client_structure"] = [

3277

(s.decode("utf-8")

3278

if isinstance(s, bytes)

3279

else s) for s in

3280

value["client_structure"]]

3281

# .name, .host, and .checker_command

3282

for k in ("name", "host", "checker_command"):

3283

if isinstance(value[k], bytes):

3284

value[k] = value[k].decode("utf-8")

3285

if "key_id" not in value:

3286

value["key_id"] = ""

3287

elif "fingerprint" not in value:

3288

value["fingerprint"] = ""

3289

# old_client_settings

3290

# .keys()

3291

old_client_settings = {

3292

(key.decode("utf-8")

3293

if isinstance(key, bytes)

3294

else key): value

3295

for key, value in

3296

bytes_old_client_settings.items()}

3297

del bytes_old_client_settings

3298

# .host and .checker_command

3299

for value in old_client_settings.values():

3300

for attribute in ("host", "checker_command"):

3301

if isinstance(value[attribute], bytes):

3302

value[attribute] = (value[attribute]

3303

.decode("utf-8"))

2567

clients_data, old_client_settings = (pickle.load

2568

(stored_state))

3304

2569

os.remove(stored_state_path)

3305

2570

except IOError as e:

3306

2571

if e.errno == errno.ENOENT:

3307

logger.warning("Could not load persistent state:"

3308

" {}".format(os.strerror(e.errno)))

2572

logger.warning("Could not load persistent state: {0}"

2573

.format(os.strerror(e.errno)))

3309

2574

else:

3310

2575

logger.critical("Could not load persistent state:",

3311

2576

exc_info=e)

3312

2577

raise

3313

2578

except EOFError as e:

3314

2579

logger.warning("Could not load persistent state: "

3315

"EOFError:",

3316

exc_info=e)

3317

2580

"EOFError:", exc_info=e)

2581

3318

2582

with PGPEngine() as pgp:

3319

for client_name, client in clients_data.items():

2583

for client_name, client in clients_data.iteritems():

3320

2584

# Skip removed clients

3321

2585

if client_name not in client_settings:

3322

2586

continue

3323

2587

3324

2588

# Decide which value to use after restoring saved state.

3325

2589

# We have three different values: Old config file,

3326

2590

# new config file, and saved state.

3331

2595

# For each value in new config, check if it

3332

2596

# differs from the old config value (Except for

3333

2597

# the "secret" attribute)

3334

if (name != "secret"

3335

and (value !=

3336

old_client_settings[client_name][name])):

2598

if (name != "secret" and

2599

value != old_client_settings[client_name]

2600

[name]):

3337

2601

client[name] = value

3338

2602

except KeyError:

3339

2603

pass

3340

2604

3341

2605

# Clients who has passed its expire date can still be

3342

# enabled if its last checker was successful. A Client

2606

# enabled if its last checker was successful. Clients

3343

2607

# whose checker succeeded before we stored its state is

3344

2608

# assumed to have successfully run all checkers during

3345

2609

# downtime.

3347

2611

if datetime.datetime.utcnow() >= client["expires"]:

3348

2612

if not client["last_checked_ok"]:

3349

2613

logger.warning(

3350

"disabling client {} - Client never "

3351

"performed a successful checker".format(

3352

client_name))

2614

"disabling client {0} - Client never "

2615

"performed a successful checker"

2616

.format(client_name))

3353

2617

client["enabled"] = False

3354

2618

elif client["last_checker_status"] != 0:

3355

2619

logger.warning(

3356

"disabling client {} - Client last"

3357

" checker failed with error code"

3358

" {}".format(

3359

client_name,

3360

client["last_checker_status"]))

2620

"disabling client {0} - Client "

2621

"last checker failed with error code {1}"

2622

.format(client_name,

2623

client["last_checker_status"]))

3361

2624

client["enabled"] = False

3362

2625

else:

3363

client["expires"] = (

3364

datetime.datetime.utcnow()

3365

+ client["timeout"])

2626

client["expires"] = (datetime.datetime

2627

.utcnow()

2628

+ client["timeout"])

3366

2629

logger.debug("Last checker succeeded,"

3367

" keeping {} enabled".format(

3368

client_name))

2630

" keeping {0} enabled"

2631

.format(client_name))

3369

2632

try:

3370

client["secret"] = pgp.decrypt(

3371

client["encrypted_secret"],

3372

client_settings[client_name]["secret"])

2633

client["secret"] = (

2634

pgp.decrypt(client["encrypted_secret"],

2635

client_settings[client_name]

2636

["secret"]))

3373

2637

except PGPError:

3374

2638

# If decryption fails, we use secret from new settings

3375

logger.debug("Failed to decrypt {} old secret".format(

3376

client_name))

3377

client["secret"] = (client_settings[client_name]

3378

["secret"])

3379

2639

logger.debug("Failed to decrypt {0} old secret"

2640

.format(client_name))

2641

client["secret"] = (

2642

client_settings[client_name]["secret"])

2643

3380

2644

# Add/remove clients based on new changes made to config

3381

2645

for client_name in (set(old_client_settings)

3382

2646

- set(client_settings)):

3384

2648

for client_name in (set(client_settings)

3385

2649

- set(old_client_settings)):

3386

2650

clients_data[client_name] = client_settings[client_name]

3387

2651

3388

2652

# Create all client objects

3389

for client_name, client in clients_data.items():

2653

for client_name, client in clients_data.iteritems():

3390

2654

tcp_server.clients[client_name] = client_class(

3391

name=client_name,

3392

settings=client,

3393

server_settings=server_settings)

3394

2655

name = client_name, settings = client,

2656

server_settings = server_settings)

2657

3395

2658

if not tcp_server.clients:

3396

2659

logger.warning("No clients defined")

3397

2660

3398

2661

if not foreground:

3399

2662

if pidfile is not None:

3400

pid = os.getpid()

3401

2663

try:

3402

2664

with pidfile:

3403

print(pid, file=pidfile)

2665

pid = os.getpid()

2666

pidfile.write(str(pid) + "\n".encode("utf-8"))

3404

2667

except IOError:

3405

2668

logger.error("Could not write to file %r with PID %d",

3406

2669

pidfilename, pid)

3407

2670

del pidfile

3408

2671

del pidfilename

3409

3410

for termsig in (signal.SIGHUP, signal.SIGTERM):

3411

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3412

lambda: main_loop.quit() and False)

3413

2672

2673

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2674

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2675

3414

2676

if use_dbus:

3415

3416

@alternate_dbus_interfaces(

3417

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3418

class MandosDBusService(DBusObjectWithObjectManager):

2677

@alternate_dbus_interfaces({"se.recompile.Mandos":

2678

"se.bsnet.fukt.Mandos"})

2679

class MandosDBusService(DBusObjectWithProperties):

3419

2680

"""A D-Bus proxy object"""

3420

3421

2681

def __init__(self):

3422

2682

dbus.service.Object.__init__(self, bus, "/")

3423

3424

2683

_interface = "se.recompile.Mandos"

3425

2684

2685

@dbus_interface_annotations(_interface)

2686

def _foo(self):

2687

return { "org.freedesktop.DBus.Property"

2688

".EmitsChangedSignal":

2689

"false"}

2690

3426

2691

@dbus.service.signal(_interface, signature="o")

3427

2692

def ClientAdded(self, objpath):

3428

2693

"D-Bus signal"

3429

2694

pass

3430

2695

3431

2696

@dbus.service.signal(_interface, signature="ss")

3432

def ClientNotFound(self, key_id, address):

2697

def ClientNotFound(self, fingerprint, address):

3433

2698

"D-Bus signal"

3434

2699

pass

3435

3436

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3437

"true"})

2700

3438

2701

@dbus.service.signal(_interface, signature="os")

3439

2702

def ClientRemoved(self, objpath, name):

3440

2703

"D-Bus signal"

3441

2704

pass

3442

3443

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3444

"true"})

2705

3445

2706

@dbus.service.method(_interface, out_signature="ao")

3446

2707

def GetAllClients(self):

3447

2708

"D-Bus method"

3448

return dbus.Array(c.dbus_object_path for c in

3449

tcp_server.clients.values())

3450

3451

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3452

"true"})

2709

return dbus.Array(c.dbus_object_path

2710

for c in

2711

tcp_server.clients.itervalues())

2712

3453

2713

@dbus.service.method(_interface,

3454

2714

out_signature="a{oa{sv}}")

3455

2715

def GetAllClientsWithProperties(self):

3456

2716

"D-Bus method"

3457

2717

return dbus.Dictionary(

3458

{c.dbus_object_path: c.GetAll(

3459

"se.recompile.Mandos.Client")

3460

for c in tcp_server.clients.values()},

2718

((c.dbus_object_path, c.GetAll(""))

2719

for c in tcp_server.clients.itervalues()),

3461

2720

signature="oa{sv}")

3462

2721

3463

2722

@dbus.service.method(_interface, in_signature="o")

3464

2723

def RemoveClient(self, object_path):

3465

2724

"D-Bus method"

3466

for c in tcp_server.clients.values():

2725

for c in tcp_server.clients.itervalues():

3467

2726

if c.dbus_object_path == object_path:

3468

2727

del tcp_server.clients[c.name]

3469

2728

c.remove_from_connection()

3470

# Don't signal the disabling

2729

# Don't signal anything except ClientRemoved

3471

2730

c.disable(quiet=True)

3472

# Emit D-Bus signal for removal

3473

self.client_removed_signal(c)

2731

# Emit D-Bus signal

2732

self.ClientRemoved(object_path, c.name)

3474

2733

return

3475

2734

raise KeyError(object_path)

3476

2735

3477

2736

del _interface

3478

3479

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3480

out_signature="a{oa{sa{sv}}}")

3481

def GetManagedObjects(self):

3482

"""D-Bus method"""

3483

return dbus.Dictionary(

3484

{client.dbus_object_path:

3485

dbus.Dictionary(

3486

{interface: client.GetAll(interface)

3487

for interface in

3488

client._get_all_interface_names()})

3489

for client in tcp_server.clients.values()})

3490

3491

def client_added_signal(self, client):

3492

"""Send the new standard signal and the old signal"""

3493

if use_dbus:

3494

# New standard signal

3495

self.InterfacesAdded(

3496

client.dbus_object_path,

3497

dbus.Dictionary(

3498

{interface: client.GetAll(interface)

3499

for interface in

3500

client._get_all_interface_names()}))

3501

# Old signal

3502

self.ClientAdded(client.dbus_object_path)

3503

3504

def client_removed_signal(self, client):

3505

"""Send the new standard signal and the old signal"""

3506

if use_dbus:

3507

# New standard signal

3508

self.InterfacesRemoved(

3509

client.dbus_object_path,

3510

client._get_all_interface_names())

3511

# Old signal

3512

self.ClientRemoved(client.dbus_object_path,

3513

client.name)

3514

2737

3515

2738

mandos_dbus_service = MandosDBusService()

3516

3517

# Save modules to variables to exempt the modules from being

3518

# unloaded before the function registered with atexit() is run.

3519

mp = multiprocessing

3520

wn = wnull

3521

2739

3522

2740

def cleanup():

3523

2741

"Cleanup function; run on exit"

3524

if zeroconf:

3525

service.cleanup()

3526

3527

mp.active_children()

3528

wn.close()

2742

service.cleanup()

2743

2744

multiprocessing.active_children()

2745

wnull.close()

3529

2746

if not (tcp_server.clients or client_settings):

3530

2747

return

3531

2748

3532

2749

# Store client before exiting. Secrets are encrypted with key

3533

2750

# based on what config file has. If config file is

3534

2751

# removed/edited, old secret will thus be unrecovable.

3535

2752

clients = {}

3536

2753

with PGPEngine() as pgp:

3537

for client in tcp_server.clients.values():

2754

for client in tcp_server.clients.itervalues():

3538

2755

key = client_settings[client.name]["secret"]

3539

2756

client.encrypted_secret = pgp.encrypt(client.secret,

3540

2757

key)

3541

2758

client_dict = {}

3542

2759

3543

2760

# A list of attributes that can not be pickled

3544

2761

# + secret.

3545

exclude = {"bus", "changedstate", "secret",

3546

"checker", "server_settings"}

3547

for name, typ in inspect.getmembers(dbus.service

3548

.Object):

2762

exclude = set(("bus", "changedstate", "secret",

2763

"checker", "server_settings"))

2764

for name, typ in (inspect.getmembers

2765

(dbus.service.Object)):

3549

2766

exclude.add(name)

3550

2767

3551

2768

client_dict["encrypted_secret"] = (client

3552

2769

.encrypted_secret)

3553

2770

for attr in client.client_structure:

3554

2771

if attr not in exclude:

3555

2772

client_dict[attr] = getattr(client, attr)

3556

2773

3557

2774

clients[client.name] = client_dict

3558

2775

del client_settings[client.name]["secret"]

3559

2776

3560

2777

try:

3561

with tempfile.NamedTemporaryFile(

3562

mode='wb',

3563

suffix=".pickle",

3564

prefix='clients-',

3565

dir=os.path.dirname(stored_state_path),

3566

delete=False) as stored_state:

3567

pickle.dump((clients, client_settings), stored_state,

3568

protocol=2)

3569

tempname = stored_state.name

2778

with (tempfile.NamedTemporaryFile

2779

(mode='wb', suffix=".pickle", prefix='clients-',

2780

dir=os.path.dirname(stored_state_path),

2781

delete=False)) as stored_state:

2782

pickle.dump((clients, client_settings), stored_state)

2783

tempname=stored_state.name

3570

2784

os.rename(tempname, stored_state_path)

3571

2785

except (IOError, OSError) as e:

3572

2786

if not debug:

3575

2789

except NameError:

3576

2790

pass

3577

2791

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3578

logger.warning("Could not save persistent state: {}"

2792

logger.warning("Could not save persistent state: {0}"

3579

2793

.format(os.strerror(e.errno)))

3580

2794

else:

3581

2795

logger.warning("Could not save persistent state:",

3582

2796

exc_info=e)

3583

2797

raise

3584

2798

3585

2799

# Delete all clients, and settings from config

3586

2800

while tcp_server.clients:

3587

2801

name, client = tcp_server.clients.popitem()

3588

2802

if use_dbus:

3589

2803

client.remove_from_connection()

3590

# Don't signal the disabling

2804

# Don't signal anything except ClientRemoved

3591

2805

client.disable(quiet=True)

3592

# Emit D-Bus signal for removal

3593

2806

if use_dbus:

3594

mandos_dbus_service.client_removed_signal(client)

2807

# Emit D-Bus signal

2808

mandos_dbus_service.ClientRemoved(client

2809

.dbus_object_path,

2810

client.name)

3595

2811

client_settings.clear()

3596

2812

3597

2813

atexit.register(cleanup)

3598

3599

for client in tcp_server.clients.values():

2814

2815

for client in tcp_server.clients.itervalues():

3600

2816

if use_dbus:

3601

# Emit D-Bus signal for adding

3602

mandos_dbus_service.client_added_signal(client)

2817

# Emit D-Bus signal

2818

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3603

2819

# Need to initiate checking of clients

3604

2820

if client.enabled:

3605

2821

client.init_checker()

3606

2822

3607

2823

tcp_server.enable()

3608

2824

tcp_server.server_activate()

3609

2825

3610

2826

# Find out what port we got

3611

if zeroconf:

3612

service.port = tcp_server.socket.getsockname()[1]

2827

service.port = tcp_server.socket.getsockname()[1]

3613

2828

if use_ipv6:

3614

2829

logger.info("Now listening on address %r, port %d,"

3615

2830

" flowinfo %d, scope_id %d",

3617

2832

else: # IPv4

3618

2833

logger.info("Now listening on address %r, port %d",

3619

2834

*tcp_server.socket.getsockname())

3620

3621

# service.interface = tcp_server.socket.getsockname()[3]

3622

2835

2836

#service.interface = tcp_server.socket.getsockname()[3]

2837

3623

2838

try:

3624

if zeroconf:

3625

# From the Avahi example code

3626

try:

3627

service.activate()

3628

except dbus.exceptions.DBusException as error:

3629

logger.critical("D-Bus Exception", exc_info=error)

3630

cleanup()

3631

sys.exit(1)

3632

# End of Avahi example code

3633

3634

GLib.io_add_watch(

3635

GLib.IOChannel.unix_new(tcp_server.fileno()),

3636

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3637

lambda *args, **kwargs: (tcp_server.handle_request

3638

(*args[2:], **kwargs) or True))

3639

2839

# From the Avahi example code

2840

try:

2841

service.activate()

2842

except dbus.exceptions.DBusException as error:

2843

logger.critical("D-Bus Exception", exc_info=error)

2844

cleanup()

2845

sys.exit(1)

2846

# End of Avahi example code

2847

2848

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2849

lambda *args, **kwargs:

2850

(tcp_server.handle_request

2851

(*args[2:], **kwargs) or True))

2852

3640

2853

logger.debug("Starting main loop")

3641

2854

main_loop.run()

3642

2855

except AvahiError as error:

3651

2864

# Must run before the D-Bus bus name gets deregistered

3652

2865

cleanup()

3653

2866

3654

3655

def should_only_run_tests():

3656

parser = argparse.ArgumentParser(add_help=False)

3657

parser.add_argument("--check", action='store_true')

3658

args, unknown_args = parser.parse_known_args()

3659

run_tests = args.check

3660

if run_tests:

3661

# Remove --check argument from sys.argv

3662

sys.argv[1:] = unknown_args

3663

return run_tests

3664

3665

# Add all tests from doctest strings

3666

def load_tests(loader, tests, none):

3667

import doctest

3668

tests.addTests(doctest.DocTestSuite())

3669

return tests

3670

3671

2867

if __name__ == '__main__':

3672

try:

3673

if should_only_run_tests():

3674

# Call using ./mandos --check [--verbose]

3675

unittest.main()

3676

else:

3677

main()

3678

finally:

3679

logging.shutdown()

2868

main()