/mandos/release : revision 237.7.297

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

3

#

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

39

try:

48

40

import SocketServer as socketserver

49

41

except ImportError:

50

42

import socketserver

51

43

import socket

44

import argparse

52

45

import datetime

53

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

54

53

try:

55

54

import ConfigParser as configparser

56

55

except ImportError:

57

56

import configparser

57

import sys

58

import re

59

import os

59

60

import signal

60

61

import subprocess

61

62

import atexit

62

63

import stat

64

import logging

63

65

import logging.handlers

64

66

import pwd

65

67

import contextlib

76

78

import tempfile

77

79

import itertools

78

80

import collections

79

import codecs

80

import random

81

import shlex

82

81

83

82

import dbus

84

83

import dbus.service

85

import gi

86

from gi.repository import GLib

84

try:

85

import gobject

86

except ImportError:

87

from gi.repository import GObject as gobject

88

import avahi

87

89

from dbus.mainloop.glib import DBusGMainLoop

88

90

import ctypes

89

91

import ctypes.util

90

92

import xml.dom.minidom

91

93

import inspect

92

94

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

95

try:

122

96

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

97

except AttributeError:

124

98

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

99

from IN import SO_BINDTODEVICE

128

100

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.16"

101

SO_BINDTODEVICE = None

102

103

if sys.version_info.major == 2:

104

str = unicode

105

106

version = "1.6.9"

147

107

stored_state_file = "clients.pickle"

148

108

149

log = logging.getLogger(os.path.basename(sys.argv[0]))

150

logging.captureWarnings(True) # Show warnings via the logging system

109

logger = logging.getLogger()

151

110

syslogger = None

152

111

153

112

try:

154

113

if_nametoindex = ctypes.cdll.LoadLibrary(

155

114

ctypes.util.find_library("c")).if_nametoindex

156

115

except (OSError, AttributeError):

157

116

158

117

def if_nametoindex(interface):

159

118

"Get an interface index the hard way, i.e. using fcntl()"

160

119

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

165

124

return interface_index

166

125

167

126

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

127

def initlogger(debug, level=logging.WARNING):

185

128

"""init logger and add loglevel"""

186

129

187

130

global syslogger

188

131

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

132

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

133

address = "/dev/log"))

191

134

syslogger.setFormatter(logging.Formatter

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

194

log.addHandler(syslogger)

195

135

('Mandos [%(process)d]: %(levelname)s:'

136

' %(message)s'))

137

logger.addHandler(syslogger)

138

196

139

if debug:

197

140

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

202

log.addHandler(console)

203

log.setLevel(level)

141

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

142

' [%(process)d]:'

143

' %(levelname)s:'

144

' %(message)s'))

145

logger.addHandler(console)

146

logger.setLevel(level)

204

147

205

148

206

149

class PGPError(Exception):

208

151

pass

209

152

210

153

211

class PGPEngine:

154

class PGPEngine(object):

212

155

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

156

214

157

def __init__(self):

215

158

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

159

self.gnupgargs = ['--batch',

160

'--home', self.tempdir,

161

'--force-mdc',

162

'--quiet',

163

'--no-use-agent']

164

235

165

def __enter__(self):

236

166

return self

237

167

238

168

def __exit__(self, exc_type, exc_value, traceback):

239

169

self._cleanup()

240

170

return False

241

171

242

172

def __del__(self):

243

173

self._cleanup()

244

174

245

175

def _cleanup(self):

246

176

if self.tempdir is not None:

247

177

# Delete contents of tempdir

248

178

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

179

topdown = False):

250

180

for filename in files:

251

181

os.remove(os.path.join(root, filename))

252

182

for dirname in dirs:

254

184

# Remove tempdir

255

185

os.rmdir(self.tempdir)

256

186

self.tempdir = None

257

187

258

188

def password_encode(self, password):

259

189

# Passphrase can not be empty and can not contain newlines or

260

190

# NUL bytes. So we prefix it and hex encode it.

265

195

.replace(b"\n", b"\\n")

266

196

.replace(b"\0", b"\\x00"))

267

197

return encoded

268

198

269

199

def encrypt(self, data, password):

270

200

passphrase = self.password_encode(password)

271

201

with tempfile.NamedTemporaryFile(

272

202

dir=self.tempdir) as passfile:

273

203

passfile.write(passphrase)

274

204

passfile.flush()

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

205

proc = subprocess.Popen(['gpg', '--symmetric',

206

'--passphrase-file',

277

207

passfile.name]

278

208

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

209

stdin = subprocess.PIPE,

210

stdout = subprocess.PIPE,

211

stderr = subprocess.PIPE)

212

ciphertext, err = proc.communicate(input = data)

283

213

if proc.returncode != 0:

284

214

raise PGPError(err)

285

215

return ciphertext

286

216

287

217

def decrypt(self, data, password):

288

218

passphrase = self.password_encode(password)

289

219

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

220

dir = self.tempdir) as passfile:

291

221

passfile.write(passphrase)

292

222

passfile.flush()

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

223

proc = subprocess.Popen(['gpg', '--decrypt',

224

'--passphrase-file',

295

225

passfile.name]

296

226

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

227

stdin = subprocess.PIPE,

228

stdout = subprocess.PIPE,

229

stderr = subprocess.PIPE)

230

decrypted_plaintext, err = proc.communicate(input = data)

301

231

if proc.returncode != 0:

302

232

raise PGPError(err)

303

233

return decrypted_plaintext

304

234

305

235

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

236

class AvahiError(Exception):

333

237

def __init__(self, value, *args, **kwargs):

334

238

self.value = value

344

248

pass

345

249

346

250

347

class AvahiService:

251

class AvahiService(object):

348

252

"""An Avahi (Zeroconf) service.

349

253

350

254

Attributes:

351

255

interface: integer; avahi.IF_UNSPEC or an interface index.

352

256

Used to optionally bind to the specified interface.

353

354

type: string; Example: "_mandos._tcp".

257

258

type: string; Example: '_mandos._tcp'.

355

259

See <https://www.iana.org/assignments/service-names-port-numbers>

356

260

port: integer; what port to announce

357

261

TXT: list of strings; TXT record for the service

364

268

server: D-Bus Server

365

269

bus: dbus.SystemBus()

366

270

"""

367

271

368

272

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

273

interface = avahi.IF_UNSPEC,

274

name = None,

275

servicetype = None,

276

port = None,

277

TXT = None,

278

domain = "",

279

host = "",

280

max_renames = 32768,

281

protocol = avahi.PROTO_UNSPEC,

282

bus = None):

379

283

self.interface = interface

380

284

self.name = name

381

285

self.type = servicetype

390

294

self.server = None

391

295

self.bus = bus

392

296

self.entry_group_state_changed_match = None

393

297

394

298

def rename(self, remove=True):

395

299

"""Derived from the Avahi example code"""

396

300

if self.rename_count >= self.max_renames:

397

log.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

301

logger.critical("No suitable Zeroconf service name found"

302

" after %i retries, exiting.",

303

self.rename_count)

400

304

raise AvahiServiceError("Too many renames")

401

305

self.name = str(

402

306

self.server.GetAlternativeServiceName(self.name))

403

307

self.rename_count += 1

404

log.info("Changing Zeroconf service name to %r ...",

405

self.name)

308

logger.info("Changing Zeroconf service name to %r ...",

309

self.name)

406

310

if remove:

407

311

self.remove()

408

312

try:

410

314

except dbus.exceptions.DBusException as error:

411

315

if (error.get_dbus_name()

412

316

== "org.freedesktop.Avahi.CollisionError"):

413

log.info("Local Zeroconf service name collision.")

317

logger.info("Local Zeroconf service name collision.")

414

318

return self.rename(remove=False)

415

319

else:

416

log.critical("D-Bus Exception", exc_info=error)

320

logger.critical("D-Bus Exception", exc_info=error)

417

321

self.cleanup()

418

322

os._exit(1)

419

323

420

324

def remove(self):

421

325

"""Derived from the Avahi example code"""

422

326

if self.entry_group_state_changed_match is not None:

424

328

self.entry_group_state_changed_match = None

425

329

if self.group is not None:

426

330

self.group.Reset()

427

331

428

332

def add(self):

429

333

"""Derived from the Avahi example code"""

430

334

self.remove()

435

339

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

340

self.entry_group_state_changed_match = (

437

341

self.group.connect_to_signal(

438

"StateChanged", self.entry_group_state_changed))

439

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

342

'StateChanged', self.entry_group_state_changed))

343

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

344

self.name, self.type)

441

345

self.group.AddService(

442

346

self.interface,

443

347

self.protocol,

447

351

dbus.UInt16(self.port),

448

352

avahi.string_array_to_txt_array(self.TXT))

449

353

self.group.Commit()

450

354

451

355

def entry_group_state_changed(self, state, error):

452

356

"""Derived from the Avahi example code"""

453

log.debug("Avahi entry group state change: %i", state)

454

357

logger.debug("Avahi entry group state change: %i", state)

358

455

359

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

log.debug("Zeroconf service established.")

360

logger.debug("Zeroconf service established.")

457

361

elif state == avahi.ENTRY_GROUP_COLLISION:

458

log.info("Zeroconf service name collision.")

362

logger.info("Zeroconf service name collision.")

459

363

self.rename()

460

364

elif state == avahi.ENTRY_GROUP_FAILURE:

461

log.critical("Avahi: Error in group state changed %s",

462

str(error))

365

logger.critical("Avahi: Error in group state changed %s",

366

str(error))

463

367

raise AvahiGroupError("State changed: {!s}".format(error))

464

368

465

369

def cleanup(self):

466

370

"""Derived from the Avahi example code"""

467

371

if self.group is not None:

472

376

pass

473

377

self.group = None

474

378

self.remove()

475

379

476

380

def server_state_changed(self, state, error=None):

477

381

"""Derived from the Avahi example code"""

478

log.debug("Avahi server state change: %i", state)

382

logger.debug("Avahi server state change: %i", state)

479

383

bad_states = {

480

384

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

385

avahi.SERVER_REGISTERING: None,

485

389

if state in bad_states:

486

390

if bad_states[state] is not None:

487

391

if error is None:

488

log.error(bad_states[state])

392

logger.error(bad_states[state])

489

393

else:

490

log.error(bad_states[state] + ": %r", error)

394

logger.error(bad_states[state] + ": %r", error)

491

395

self.cleanup()

492

396

elif state == avahi.SERVER_RUNNING:

493

try:

494

self.add()

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

log.info("Local Zeroconf service name collision.")

499

return self.rename(remove=False)

500

else:

501

log.critical("D-Bus Exception", exc_info=error)

502

self.cleanup()

503

os._exit(1)

397

self.add()

504

398

else:

505

399

if error is None:

506

log.debug("Unknown state: %r", state)

400

logger.debug("Unknown state: %r", state)

507

401

else:

508

log.debug("Unknown state: %r: %r", state, error)

509

402

logger.debug("Unknown state: %r: %r", state, error)

403

510

404

def activate(self):

511

405

"""Derived from the Avahi example code"""

512

406

if self.server is None:

523

417

class AvahiServiceToSyslog(AvahiService):

524

418

def rename(self, *args, **kwargs):

525

419

"""Add the new name to the syslog messages"""

526

ret = super(AvahiServiceToSyslog, self).rename(*args,

527

**kwargs)

420

ret = AvahiService.rename(self, *args, **kwargs)

528

421

syslogger.setFormatter(logging.Formatter(

529

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

422

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

530

423

.format(self.name)))

531

424

return ret

532

425

533

426

534

# Pretend that we have a GnuTLS module

535

class gnutls:

536

"""This isn't so much a class as it is a module-like namespace."""

537

538

library = ctypes.util.find_library("gnutls")

539

if library is None:

540

library = ctypes.util.find_library("gnutls-deb0")

541

_library = ctypes.cdll.LoadLibrary(library)

542

del library

543

544

# Unless otherwise indicated, the constants and types below are

545

# all from the gnutls/gnutls.h C header file.

546

547

# Constants

548

E_SUCCESS = 0

549

E_INTERRUPTED = -52

550

E_AGAIN = -28

551

CRT_OPENPGP = 2

552

CRT_RAWPK = 3

553

CLIENT = 2

554

SHUT_RDWR = 0

555

CRD_CERTIFICATE = 1

556

E_NO_CERTIFICATE_FOUND = -49

557

X509_FMT_DER = 0

558

NO_TICKETS = 1<<10

559

ENABLE_RAWPK = 1<<18

560

CTYPE_PEERS = 3

561

KEYID_USE_SHA256 = 1 # gnutls/x509.h

562

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

563

564

# Types

565

class _session_int(ctypes.Structure):

566

_fields_ = []

567

session_t = ctypes.POINTER(_session_int)

568

569

class certificate_credentials_st(ctypes.Structure):

570

_fields_ = []

571

certificate_credentials_t = ctypes.POINTER(

572

certificate_credentials_st)

573

certificate_type_t = ctypes.c_int

574

575

class datum_t(ctypes.Structure):

576

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

577

("size", ctypes.c_uint)]

578

579

class _openpgp_crt_int(ctypes.Structure):

580

_fields_ = []

581

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

582

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

583

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

584

credentials_type_t = ctypes.c_int

585

transport_ptr_t = ctypes.c_void_p

586

close_request_t = ctypes.c_int

587

588

# Exceptions

589

class Error(Exception):

590

def __init__(self, message=None, code=None, args=()):

591

# Default usage is by a message string, but if a return

592

# code is passed, convert it to a string with

593

# gnutls.strerror()

594

self.code = code

595

if message is None and code is not None:

596

message = gnutls.strerror(code).decode(

597

"utf-8", errors="replace")

598

return super(gnutls.Error, self).__init__(

599

message, *args)

600

601

class CertificateSecurityError(Error):

602

pass

603

604

class PointerTo:

605

def __init__(self, cls):

606

self.cls = cls

607

608

def from_param(self, obj):

609

if not isinstance(obj, self.cls):

610

raise TypeError("Not of type {}: {!r}"

611

.format(self.cls.__name__, obj))

612

return ctypes.byref(obj.from_param(obj))

613

614

class CastToVoidPointer:

615

def __init__(self, cls):

616

self.cls = cls

617

618

def from_param(self, obj):

619

if not isinstance(obj, self.cls):

620

raise TypeError("Not of type {}: {!r}"

621

.format(self.cls.__name__, obj))

622

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

623

624

class With_from_param:

625

@classmethod

626

def from_param(cls, obj):

627

return obj._as_parameter_

628

629

# Classes

630

class Credentials(With_from_param):

631

def __init__(self):

632

self._as_parameter_ = gnutls.certificate_credentials_t()

633

gnutls.certificate_allocate_credentials(self)

634

self.type = gnutls.CRD_CERTIFICATE

635

636

def __del__(self):

637

gnutls.certificate_free_credentials(self)

638

639

class ClientSession(With_from_param):

640

def __init__(self, socket, credentials=None):

641

self._as_parameter_ = gnutls.session_t()

642

gnutls_flags = gnutls.CLIENT

643

if gnutls.check_version(b"3.5.6"):

644

gnutls_flags |= gnutls.NO_TICKETS

645

if gnutls.has_rawpk:

646

gnutls_flags |= gnutls.ENABLE_RAWPK

647

gnutls.init(self, gnutls_flags)

648

del gnutls_flags

649

gnutls.set_default_priority(self)

650

gnutls.transport_set_ptr(self, socket.fileno())

651

gnutls.handshake_set_private_extensions(self, True)

652

self.socket = socket

653

if credentials is None:

654

credentials = gnutls.Credentials()

655

gnutls.credentials_set(self, credentials.type,

656

credentials)

657

self.credentials = credentials

658

659

def __del__(self):

660

gnutls.deinit(self)

661

662

def handshake(self):

663

return gnutls.handshake(self)

664

665

def send(self, data):

666

data = bytes(data)

667

data_len = len(data)

668

while data_len > 0:

669

data_len -= gnutls.record_send(self, data[-data_len:],

670

data_len)

671

672

def bye(self):

673

return gnutls.bye(self, gnutls.SHUT_RDWR)

674

675

# Error handling functions

676

def _error_code(result):

677

"""A function to raise exceptions on errors, suitable

678

for the "restype" attribute on ctypes functions"""

679

if result >= gnutls.E_SUCCESS:

680

return result

681

if result == gnutls.E_NO_CERTIFICATE_FOUND:

682

raise gnutls.CertificateSecurityError(code=result)

683

raise gnutls.Error(code=result)

684

685

def _retry_on_error(result, func, arguments,

686

_error_code=_error_code):

687

"""A function to retry on some errors, suitable

688

for the "errcheck" attribute on ctypes functions"""

689

while result < gnutls.E_SUCCESS:

690

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

691

return _error_code(result)

692

result = func(*arguments)

693

return result

694

695

# Unless otherwise indicated, the function declarations below are

696

# all from the gnutls/gnutls.h C header file.

697

698

# Functions

699

priority_set_direct = _library.gnutls_priority_set_direct

700

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

701

ctypes.POINTER(ctypes.c_char_p)]

702

priority_set_direct.restype = _error_code

703

704

init = _library.gnutls_init

705

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

706

init.restype = _error_code

707

708

set_default_priority = _library.gnutls_set_default_priority

709

set_default_priority.argtypes = [ClientSession]

710

set_default_priority.restype = _error_code

711

712

record_send = _library.gnutls_record_send

713

record_send.argtypes = [ClientSession, ctypes.c_void_p,

714

ctypes.c_size_t]

715

record_send.restype = ctypes.c_ssize_t

716

record_send.errcheck = _retry_on_error

717

718

certificate_allocate_credentials = (

719

_library.gnutls_certificate_allocate_credentials)

720

certificate_allocate_credentials.argtypes = [

721

PointerTo(Credentials)]

722

certificate_allocate_credentials.restype = _error_code

723

724

certificate_free_credentials = (

725

_library.gnutls_certificate_free_credentials)

726

certificate_free_credentials.argtypes = [Credentials]

727

certificate_free_credentials.restype = None

728

729

handshake_set_private_extensions = (

730

_library.gnutls_handshake_set_private_extensions)

731

handshake_set_private_extensions.argtypes = [ClientSession,

732

ctypes.c_int]

733

handshake_set_private_extensions.restype = None

734

735

credentials_set = _library.gnutls_credentials_set

736

credentials_set.argtypes = [ClientSession, credentials_type_t,

737

CastToVoidPointer(Credentials)]

738

credentials_set.restype = _error_code

739

740

strerror = _library.gnutls_strerror

741

strerror.argtypes = [ctypes.c_int]

742

strerror.restype = ctypes.c_char_p

743

744

certificate_type_get = _library.gnutls_certificate_type_get

745

certificate_type_get.argtypes = [ClientSession]

746

certificate_type_get.restype = _error_code

747

748

certificate_get_peers = _library.gnutls_certificate_get_peers

749

certificate_get_peers.argtypes = [ClientSession,

750

ctypes.POINTER(ctypes.c_uint)]

751

certificate_get_peers.restype = ctypes.POINTER(datum_t)

752

753

global_set_log_level = _library.gnutls_global_set_log_level

754

global_set_log_level.argtypes = [ctypes.c_int]

755

global_set_log_level.restype = None

756

757

global_set_log_function = _library.gnutls_global_set_log_function

758

global_set_log_function.argtypes = [log_func]

759

global_set_log_function.restype = None

760

761

deinit = _library.gnutls_deinit

762

deinit.argtypes = [ClientSession]

763

deinit.restype = None

764

765

handshake = _library.gnutls_handshake

766

handshake.argtypes = [ClientSession]

767

handshake.restype = ctypes.c_int

768

handshake.errcheck = _retry_on_error

769

770

transport_set_ptr = _library.gnutls_transport_set_ptr

771

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

772

transport_set_ptr.restype = None

773

774

bye = _library.gnutls_bye

775

bye.argtypes = [ClientSession, close_request_t]

776

bye.restype = ctypes.c_int

777

bye.errcheck = _retry_on_error

778

779

check_version = _library.gnutls_check_version

780

check_version.argtypes = [ctypes.c_char_p]

781

check_version.restype = ctypes.c_char_p

782

783

_need_version = b"3.3.0"

784

if check_version(_need_version) is None:

785

raise self.Error("Needs GnuTLS {} or later"

786

.format(_need_version))

787

788

_tls_rawpk_version = b"3.6.6"

789

has_rawpk = bool(check_version(_tls_rawpk_version))

790

791

if has_rawpk:

792

# Types

793

class pubkey_st(ctypes.Structure):

794

_fields = []

795

pubkey_t = ctypes.POINTER(pubkey_st)

796

797

x509_crt_fmt_t = ctypes.c_int

798

799

# All the function declarations below are from

800

# gnutls/abstract.h

801

pubkey_init = _library.gnutls_pubkey_init

802

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

803

pubkey_init.restype = _error_code

804

805

pubkey_import = _library.gnutls_pubkey_import

806

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

807

x509_crt_fmt_t]

808

pubkey_import.restype = _error_code

809

810

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

811

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

812

ctypes.POINTER(ctypes.c_ubyte),

813

ctypes.POINTER(ctypes.c_size_t)]

814

pubkey_get_key_id.restype = _error_code

815

816

pubkey_deinit = _library.gnutls_pubkey_deinit

817

pubkey_deinit.argtypes = [pubkey_t]

818

pubkey_deinit.restype = None

819

else:

820

# All the function declarations below are from

821

# gnutls/openpgp.h

822

823

openpgp_crt_init = _library.gnutls_openpgp_crt_init

824

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

825

openpgp_crt_init.restype = _error_code

826

827

openpgp_crt_import = _library.gnutls_openpgp_crt_import

828

openpgp_crt_import.argtypes = [openpgp_crt_t,

829

ctypes.POINTER(datum_t),

830

openpgp_crt_fmt_t]

831

openpgp_crt_import.restype = _error_code

832

833

openpgp_crt_verify_self = \

834

_library.gnutls_openpgp_crt_verify_self

835

openpgp_crt_verify_self.argtypes = [

836

openpgp_crt_t,

837

ctypes.c_uint,

838

ctypes.POINTER(ctypes.c_uint),

839

]

840

openpgp_crt_verify_self.restype = _error_code

841

842

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

843

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

844

openpgp_crt_deinit.restype = None

845

846

openpgp_crt_get_fingerprint = (

847

_library.gnutls_openpgp_crt_get_fingerprint)

848

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

849

ctypes.c_void_p,

850

ctypes.POINTER(

851

ctypes.c_size_t)]

852

openpgp_crt_get_fingerprint.restype = _error_code

853

854

if check_version(b"3.6.4"):

855

certificate_type_get2 = _library.gnutls_certificate_type_get2

856

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

857

certificate_type_get2.restype = _error_code

858

859

# Remove non-public functions

860

del _error_code, _retry_on_error

861

862

863

def call_pipe(connection, # : multiprocessing.Connection

864

func, *args, **kwargs):

865

"""This function is meant to be called by multiprocessing.Process

866

867

This function runs func(*args, **kwargs), and writes the resulting

868

return value on the provided multiprocessing.Connection.

869

"""

870

connection.send(func(*args, **kwargs))

871

connection.close()

872

873

874

class Client:

427

class Client(object):

875

428

"""A representation of a client host served by this server.

876

429

877

430

Attributes:

878

approved: bool(); None if not yet approved/disapproved

431

approved: bool(); 'None' if not yet approved/disapproved

879

432

approval_delay: datetime.timedelta(); Time to wait for approval

880

433

approval_duration: datetime.timedelta(); Duration of one approval

881

checker: multiprocessing.Process(); a running checker process used

882

to see if the client lives. None if no process is

883

running.

884

checker_callback_tag: a GLib event source tag, or None

434

checker: subprocess.Popen(); a running checker process used

435

to see if the client lives.

436

'None' if no process is running.

437

checker_callback_tag: a gobject event source tag, or None

885

438

checker_command: string; External command which is run to check

886

439

if client lives. %() expansions are done at

887

440

runtime with vars(self) as dict, so that for

888

441

instance %(name)s can be used in the command.

889

checker_initiator_tag: a GLib event source tag, or None

442

checker_initiator_tag: a gobject event source tag, or None

890

443

created: datetime.datetime(); (UTC) object creation

891

444

client_structure: Object describing what attributes a client has

892

445

and is used for storing the client at exit

893

446

current_checker_command: string; current running checker_command

894

disable_initiator_tag: a GLib event source tag, or None

447

disable_initiator_tag: a gobject event source tag, or None

895

448

enabled: bool()

896

449

fingerprint: string (40 or 32 hexadecimal digits); used to

897

uniquely identify an OpenPGP client

898

key_id: string (64 hexadecimal digits); used to uniquely identify

899

a client using raw public keys

450

uniquely identify the client

900

451

host: string; available for use by the checker command

901

452

interval: datetime.timedelta(); How often to start a new checker

902

453

last_approval_request: datetime.datetime(); (UTC) or None

904

455

last_checker_status: integer between 0 and 255 reflecting exit

905

456

status of last checker. -1 reflects crashed

906

457

checker, -2 means no checker completed yet.

907

last_checker_signal: The signal which killed the last checker, if

908

last_checker_status is -1

909

458

last_enabled: datetime.datetime(); (UTC) or None

910

459

911

460

D-Bus identifiers

918

467

disabled, or None

919

468

server_settings: The server_settings dict from main()

920

469

"""

921

470

922

471

runtime_expansions = ("approval_delay", "approval_duration",

923

"created", "enabled", "expires", "key_id",

472

"created", "enabled", "expires",

924

473

"fingerprint", "host", "interval",

925

474

"last_approval_request", "last_checked_ok",

926

475

"last_enabled", "name", "timeout")

935

484

"approved_by_default": "True",

936

485

"enabled": "True",

937

486

}

938

487

939

488

@staticmethod

940

489

def config_parser(config):

941

490

"""Construct a new dict of client settings of this form:

948

497

for client_name in config.sections():

949

498

section = dict(config.items(client_name))

950

499

client = settings[client_name] = {}

951

500

952

501

client["host"] = section["host"]

953

502

# Reformat values from string types to Python types

954

503

client["approved_by_default"] = config.getboolean(

955

504

client_name, "approved_by_default")

956

505

client["enabled"] = config.getboolean(client_name,

957

506

"enabled")

958

959

# Uppercase and remove spaces from key_id and fingerprint

960

# for later comparison purposes with return value from the

961

# key_id() and fingerprint() functions

962

client["key_id"] = (section.get("key_id", "").upper()

963

.replace(" ", ""))

507

508

# Uppercase and remove spaces from fingerprint for later

509

# comparison purposes with return value from the

510

# fingerprint() function

964

511

client["fingerprint"] = (section["fingerprint"].upper()

965

512

.replace(" ", ""))

966

513

if "secret" in section:

967

client["secret"] = codecs.decode(section["secret"]

968

.encode("utf-8"),

969

"base64")

514

client["secret"] = section["secret"].decode("base64")

970

515

elif "secfile" in section:

971

516

with open(os.path.expanduser(os.path.expandvars

972

517

(section["secfile"])),

987

532

client["last_approval_request"] = None

988

533

client["last_checked_ok"] = None

989

534

client["last_checker_status"] = -2

990

535

991

536

return settings

992

993

def __init__(self, settings, name=None, server_settings=None):

537

538

def __init__(self, settings, name = None, server_settings=None):

994

539

self.name = name

995

540

if server_settings is None:

996

541

server_settings = {}

998

543

# adding all client settings

999

544

for setting, value in settings.items():

1000

545

setattr(self, setting, value)

1001

546

1002

547

if self.enabled:

1003

548

if not hasattr(self, "last_enabled"):

1004

549

self.last_enabled = datetime.datetime.utcnow()

1008

553

else:

1009

554

self.last_enabled = None

1010

555

self.expires = None

1011

1012

log.debug("Creating client %r", self.name)

1013

log.debug(" Key ID: %s", self.key_id)

1014

log.debug(" Fingerprint: %s", self.fingerprint)

556

557

logger.debug("Creating client %r", self.name)

558

logger.debug(" Fingerprint: %s", self.fingerprint)

1015

559

self.created = settings.get("created",

1016

560

datetime.datetime.utcnow())

1017

561

1018

562

# attributes specific for this server instance

1019

563

self.checker = None

1020

564

self.checker_initiator_tag = None

1026

570

self.changedstate = multiprocessing_manager.Condition(

1027

571

multiprocessing_manager.Lock())

1028

572

self.client_structure = [attr

1029

for attr in self.__dict__.keys()

573

for attr in self.__dict__.iterkeys()

1030

574

if not attr.startswith("_")]

1031

575

self.client_structure.append("client_structure")

1032

576

1033

577

for name, t in inspect.getmembers(

1034

578

type(self), lambda obj: isinstance(obj, property)):

1035

579

if not name.startswith("_"):

1036

580

self.client_structure.append(name)

1037

581

1038

582

# Send notice to process children that client state has changed

1039

583

def send_changedstate(self):

1040

584

with self.changedstate:

1041

585

self.changedstate.notify_all()

1042

586

1043

587

def enable(self):

1044

588

"""Start this client's checker and timeout hooks"""

1045

589

if getattr(self, "enabled", False):

1046

590

# Already enabled

1047

591

return

592

self.expires = datetime.datetime.utcnow() + self.timeout

1048

593

self.enabled = True

1049

594

self.last_enabled = datetime.datetime.utcnow()

1050

595

self.init_checker()

1051

596

self.send_changedstate()

1052

597

1053

598

def disable(self, quiet=True):

1054

599

"""Disable this client."""

1055

600

if not getattr(self, "enabled", False):

1056

601

return False

1057

602

if not quiet:

1058

log.info("Disabling client %s", self.name)

603

logger.info("Disabling client %s", self.name)

1059

604

if getattr(self, "disable_initiator_tag", None) is not None:

1060

GLib.source_remove(self.disable_initiator_tag)

605

gobject.source_remove(self.disable_initiator_tag)

1061

606

self.disable_initiator_tag = None

1062

607

self.expires = None

1063

608

if getattr(self, "checker_initiator_tag", None) is not None:

1064

GLib.source_remove(self.checker_initiator_tag)

609

gobject.source_remove(self.checker_initiator_tag)

1065

610

self.checker_initiator_tag = None

1066

611

self.stop_checker()

1067

612

self.enabled = False

1068

613

if not quiet:

1069

614

self.send_changedstate()

1070

# Do not run this again if called by a GLib.timeout_add

615

# Do not run this again if called by a gobject.timeout_add

1071

616

return False

1072

617

1073

618

def __del__(self):

1074

619

self.disable()

1075

1076

def init_checker(self, randomize_start=False):

1077

# Schedule a new checker to be started a randomly selected

1078

# time (a fraction of 'interval') from now. This spreads out

1079

# the startup of checkers over time when the server is

1080

# started.

620

621

def init_checker(self):

622

# Schedule a new checker to be started an 'interval' from now,

623

# and every interval from then on.

1081

624

if self.checker_initiator_tag is not None:

1082

GLib.source_remove(self.checker_initiator_tag)

1083

interval_milliseconds = int(self.interval.total_seconds()

1084

* 1000)

1085

if randomize_start:

1086

delay_milliseconds = random.randrange(

1087

interval_milliseconds + 1)

1088

else:

1089

delay_milliseconds = interval_milliseconds

1090

self.checker_initiator_tag = GLib.timeout_add(

1091

delay_milliseconds, self.start_checker, randomize_start)

1092

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1093

# A checker might take up to an 'interval' of time, so we can

1094

# expire at the soonest one interval after a checker was

1095

# started. Since the initial checker is delayed, the expire

1096

# time might have to be extended.

1097

now = datetime.datetime.utcnow()

1098

self.expires = now + delay + self.interval

1099

# Schedule a disable() at expire time

625

gobject.source_remove(self.checker_initiator_tag)

626

self.checker_initiator_tag = gobject.timeout_add(

627

int(self.interval.total_seconds() * 1000),

628

self.start_checker)

629

# Schedule a disable() when 'timeout' has passed

1100

630

if self.disable_initiator_tag is not None:

1101

GLib.source_remove(self.disable_initiator_tag)

1102

self.disable_initiator_tag = GLib.timeout_add(

1103

int((self.expires - now).total_seconds() * 1000),

1104

self.disable)

1105

1106

def checker_callback(self, source, condition, connection,

1107

command):

631

gobject.source_remove(self.disable_initiator_tag)

632

self.disable_initiator_tag = gobject.timeout_add(

633

int(self.timeout.total_seconds() * 1000), self.disable)

634

# Also start a new checker *right now*.

635

self.start_checker()

636

637

def checker_callback(self, pid, condition, command):

1108

638

"""The checker has completed, so take appropriate actions."""

1109

# Read return code from connection (see call_pipe)

1110

returncode = connection.recv()

1111

connection.close()

1112

if self.checker is not None:

1113

self.checker.join()

1114

639

self.checker_callback_tag = None

1115

640

self.checker = None

1116

1117

if returncode >= 0:

1118

self.last_checker_status = returncode

1119

self.last_checker_signal = None

641

if os.WIFEXITED(condition):

642

self.last_checker_status = os.WEXITSTATUS(condition)

1120

643

if self.last_checker_status == 0:

1121

log.info("Checker for %(name)s succeeded", vars(self))

644

logger.info("Checker for %(name)s succeeded",

645

vars(self))

1122

646

self.checked_ok()

1123

647

else:

1124

log.info("Checker for %(name)s failed", vars(self))

648

logger.info("Checker for %(name)s failed", vars(self))

1125

649

else:

1126

650

self.last_checker_status = -1

1127

self.last_checker_signal = -returncode

1128

log.warning("Checker for %(name)s crashed?", vars(self))

1129

return False

1130

651

logger.warning("Checker for %(name)s crashed?",

652

vars(self))

653

1131

654

def checked_ok(self):

1132

655

"""Assert that the client has been seen, alive and well."""

1133

656

self.last_checked_ok = datetime.datetime.utcnow()

1134

657

self.last_checker_status = 0

1135

self.last_checker_signal = None

1136

658

self.bump_timeout()

1137

659

1138

660

def bump_timeout(self, timeout=None):

1139

661

"""Bump up the timeout for this client."""

1140

662

if timeout is None:

1141

663

timeout = self.timeout

1142

664

if self.disable_initiator_tag is not None:

1143

GLib.source_remove(self.disable_initiator_tag)

665

gobject.source_remove(self.disable_initiator_tag)

1144

666

self.disable_initiator_tag = None

1145

667

if getattr(self, "enabled", False):

1146

self.disable_initiator_tag = GLib.timeout_add(

668

self.disable_initiator_tag = gobject.timeout_add(

1147

669

int(timeout.total_seconds() * 1000), self.disable)

1148

670

self.expires = datetime.datetime.utcnow() + timeout

1149

671

1150

672

def need_approval(self):

1151

673

self.last_approval_request = datetime.datetime.utcnow()

1152

1153

def start_checker(self, start_was_randomized=False):

674

675

def start_checker(self):

1154

676

"""Start a new checker subprocess if one is not running.

1155

677

1156

678

If a checker already exists, leave it running and do

1157

679

nothing."""

1158

680

# The reason for not killing a running checker is that if we

1163

685

# checkers alone, the checker would have to take more time

1164

686

# than 'timeout' for the client to be disabled, which is as it

1165

687

# should be.

1166

1167

if self.checker is not None and not self.checker.is_alive():

1168

log.warning("Checker was not alive; joining")

1169

self.checker.join()

1170

self.checker = None

688

689

# If a checker exists, make sure it is not a zombie

690

try:

691

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

692

except AttributeError:

693

pass

694

except OSError as error:

695

if error.errno != errno.ECHILD:

696

raise

697

else:

698

if pid:

699

logger.warning("Checker was a zombie")

700

gobject.source_remove(self.checker_callback_tag)

701

self.checker_callback(pid, status,

702

self.current_checker_command)

1171

703

# Start a new checker if needed

1172

704

if self.checker is None:

1173

705

# Escape attributes for the shell

1174

706

escaped_attrs = {

1175

attr: shlex.quote(str(getattr(self, attr)))

1176

for attr in self.runtime_expansions}

707

attr: re.escape(str(getattr(self, attr)))

708

for attr in self.runtime_expansions }

1177

709

try:

1178

710

command = self.checker_command % escaped_attrs

1179

711

except TypeError as error:

1180

log.error('Could not format string "%s"',

1181

self.checker_command, exc_info=error)

712

logger.error('Could not format string "%s"',

713

self.checker_command,

714

exc_info=error)

1182

715

return True # Try again later

1183

716

self.current_checker_command = command

1184

log.info("Starting checker %r for %s", command, self.name)

1185

# We don't need to redirect stdout and stderr, since

1186

# in normal mode, that is already done by daemon(),

1187

# and in debug mode we don't want to. (Stdin is

1188

# always replaced by /dev/null.)

1189

# The exception is when not debugging but nevertheless

1190

# running in the foreground; use the previously

1191

# created wnull.

1192

popen_args = {"close_fds": True,

1193

"shell": True,

1194

"cwd": "/"}

1195

if (not self.server_settings["debug"]

1196

and self.server_settings["foreground"]):

1197

popen_args.update({"stdout": wnull,

1198

"stderr": wnull})

1199

pipe = multiprocessing.Pipe(duplex=False)

1200

self.checker = multiprocessing.Process(

1201

target=call_pipe,

1202

args=(pipe[1], subprocess.call, command),

1203

kwargs=popen_args)

1204

self.checker.start()

1205

self.checker_callback_tag = GLib.io_add_watch(

1206

GLib.IOChannel.unix_new(pipe[0].fileno()),

1207

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1208

self.checker_callback, pipe[0], command)

1209

if start_was_randomized:

1210

# We were started after a random delay; Schedule a new

1211

# checker to be started an 'interval' from now, and every

1212

# interval from then on.

1213

now = datetime.datetime.utcnow()

1214

self.checker_initiator_tag = GLib.timeout_add(

1215

int(self.interval.total_seconds() * 1000),

1216

self.start_checker)

1217

self.expires = max(self.expires, now + self.interval)

1218

# Don't start a new checker again after same random delay

1219

return False

1220

# Re-run this periodically if run by GLib.timeout_add

717

try:

718

logger.info("Starting checker %r for %s", command,

719

self.name)

720

# We don't need to redirect stdout and stderr, since

721

# in normal mode, that is already done by daemon(),

722

# and in debug mode we don't want to. (Stdin is

723

# always replaced by /dev/null.)

724

# The exception is when not debugging but nevertheless

725

# running in the foreground; use the previously

726

# created wnull.

727

popen_args = {}

728

if (not self.server_settings["debug"]

729

and self.server_settings["foreground"]):

730

popen_args.update({"stdout": wnull,

731

"stderr": wnull })

732

self.checker = subprocess.Popen(command,

733

close_fds=True,

734

shell=True,

735

cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

739

exc_info=error)

740

return True

741

self.checker_callback_tag = gobject.child_watch_add(

742

self.checker.pid, self.checker_callback, data=command)

743

# The checker may have completed before the gobject

744

# watch was added. Check for this.

745

try:

746

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

747

except OSError as error:

748

if error.errno == errno.ECHILD:

749

# This should never happen

750

logger.error("Child process vanished",

751

exc_info=error)

752

return True

753

raise

754

if pid:

755

gobject.source_remove(self.checker_callback_tag)

756

self.checker_callback(pid, status, command)

757

# Re-run this periodically if run by gobject.timeout_add

1221

758

return True

1222

759

1223

760

def stop_checker(self):

1224

761

"""Force the checker process, if any, to stop."""

1225

762

if self.checker_callback_tag:

1226

GLib.source_remove(self.checker_callback_tag)

763

gobject.source_remove(self.checker_callback_tag)

1227

764

self.checker_callback_tag = None

1228

765

if getattr(self, "checker", None) is None:

1229

766

return

1230

log.debug("Stopping checker for %(name)s", vars(self))

1231

self.checker.terminate()

767

logger.debug("Stopping checker for %(name)s", vars(self))

768

try:

769

self.checker.terminate()

770

#time.sleep(0.5)

771

#if self.checker.poll() is None:

772

# self.checker.kill()

773

except OSError as error:

774

if error.errno != errno.ESRCH: # No such process

775

raise

1232

776

self.checker = None

1233

777

1234

778

1238

782

byte_arrays=False):

1239

783

"""Decorators for marking methods of a DBusObjectWithProperties to

1240

784

become properties on the D-Bus.

1241

785

1242

786

The decorated method will be called with no arguments by "Get"

1243

787

and with one argument by "Set".

1244

788

1245

789

The parameters, where they are supported, are the same as

1246

790

dbus.service.method, except there is only "signature", since the

1247

791

type from Get() and the type sent to Set() is the same.

1251

795

if byte_arrays and signature != "ay":

1252

796

raise ValueError("Byte arrays not supported for non-'ay'"

1253

797

" signature {!r}".format(signature))

1254

798

1255

799

def decorator(func):

1256

800

func._dbus_is_property = True

1257

801

func._dbus_interface = dbus_interface

1260

804

func._dbus_name = func.__name__

1261

805

if func._dbus_name.endswith("_dbus_property"):

1262

806

func._dbus_name = func._dbus_name[:-14]

1263

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1264

808

return func

1265

809

1266

810

return decorator

1267

811

1268

812

1269

813

def dbus_interface_annotations(dbus_interface):

1270

814

"""Decorator for marking functions returning interface annotations

1271

815

1272

816

Usage:

1273

817

1274

818

@dbus_interface_annotations("org.example.Interface")

1275

819

def _foo(self): # Function name does not matter

1276

820

return {"org.freedesktop.DBus.Deprecated": "true",

1277

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1278

822

"false"}

1279

823

"""

1280

824

1281

825

def decorator(func):

1282

826

func._dbus_is_interface = True

1283

827

func._dbus_interface = dbus_interface

1284

828

func._dbus_name = dbus_interface

1285

829

return func

1286

830

1287

831

return decorator

1288

832

1289

833

1290

834

def dbus_annotations(annotations):

1291

835

"""Decorator to annotate D-Bus methods, signals or properties

1292

836

Usage:

1293

837

1294

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1295

839

"org.freedesktop.DBus.Property."

1296

840

"EmitsChangedSignal": "false"})

1298

842

access="r")

1299

843

def Property_dbus_property(self):

1300

844

return dbus.Boolean(False)

1301

1302

See also the DBusObjectWithAnnotations class.

1303

845

"""

1304

846

1305

847

def decorator(func):

1306

848

func._dbus_annotations = annotations

1307

849

return func

1308

850

1309

851

return decorator

1310

852

1311

853

1327

869

pass

1328

870

1329

871

1330

class DBusObjectWithAnnotations(dbus.service.Object):

1331

"""A D-Bus object with annotations.

1332

1333

Classes inheriting from this can use the dbus_annotations

1334

decorator to add annotations to methods or signals.

872

class DBusObjectWithProperties(dbus.service.Object):

873

"""A D-Bus object with properties.

874

875

Classes inheriting from this can use the dbus_service_property

876

decorator to expose methods as D-Bus properties. It exposes the

877

standard Get(), Set(), and GetAll() methods on the D-Bus.

1335

878

"""

1336

879

1337

880

@staticmethod

1338

881

def _is_dbus_thing(thing):

1339

882

"""Returns a function testing if an attribute is a D-Bus thing

1340

883

1341

884

If called like _is_dbus_thing("method") it returns a function

1342

885

suitable for use as predicate to inspect.getmembers().

1343

886

"""

1344

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1345

888

False)

1346

889

1347

890

def _get_all_dbus_things(self, thing):

1348

891

"""Returns a generator of (name, attribute) pairs

1349

892

"""

1352

895

for cls in self.__class__.__mro__

1353

896

for name, athing in

1354

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1355

1356

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1357

out_signature="s",

1358

path_keyword="object_path",

1359

connection_keyword="connection")

1360

def Introspect(self, object_path, connection):

1361

"""Overloading of standard D-Bus method.

1362

1363

Inserts annotation tags on methods and signals.

1364

"""

1365

xmlstring = dbus.service.Object.Introspect(self, object_path,

1366

connection)

1367

try:

1368

document = xml.dom.minidom.parseString(xmlstring)

1369

1370

for if_tag in document.getElementsByTagName("interface"):

1371

# Add annotation tags

1372

for typ in ("method", "signal"):

1373

for tag in if_tag.getElementsByTagName(typ):

1374

annots = dict()

1375

for name, prop in (self.

1376

_get_all_dbus_things(typ)):

1377

if (name == tag.getAttribute("name")

1378

and prop._dbus_interface

1379

== if_tag.getAttribute("name")):

1380

annots.update(getattr(

1381

prop, "_dbus_annotations", {}))

1382

for name, value in annots.items():

1383

ann_tag = document.createElement(

1384

"annotation")

1385

ann_tag.setAttribute("name", name)

1386

ann_tag.setAttribute("value", value)

1387

tag.appendChild(ann_tag)

1388

# Add interface annotation tags

1389

for annotation, value in dict(

1390

itertools.chain.from_iterable(

1391

annotations().items()

1392

for name, annotations

1393

in self._get_all_dbus_things("interface")

1394

if name == if_tag.getAttribute("name")

1395

)).items():

1396

ann_tag = document.createElement("annotation")

1397

ann_tag.setAttribute("name", annotation)

1398

ann_tag.setAttribute("value", value)

1399

if_tag.appendChild(ann_tag)

1400

# Fix argument name for the Introspect method itself

1401

if (if_tag.getAttribute("name")

1402

== dbus.INTROSPECTABLE_IFACE):

1403

for cn in if_tag.getElementsByTagName("method"):

1404

if cn.getAttribute("name") == "Introspect":

1405

for arg in cn.getElementsByTagName("arg"):

1406

if (arg.getAttribute("direction")

1407

== "out"):

1408

arg.setAttribute("name",

1409

"xml_data")

1410

xmlstring = document.toxml("utf-8")

1411

document.unlink()

1412

except (AttributeError, xml.dom.DOMException,

1413

xml.parsers.expat.ExpatError) as error:

1414

log.error("Failed to override Introspection method",

1415

exc_info=error)

1416

return xmlstring

1417

1418

1419

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1420

"""A D-Bus object with properties.

1421

1422

Classes inheriting from this can use the dbus_service_property

1423

decorator to expose methods as D-Bus properties. It exposes the

1424

standard Get(), Set(), and GetAll() methods on the D-Bus.

1425

"""

1426

898

1427

899

def _get_dbus_property(self, interface_name, property_name):

1428

900

"""Returns a bound method if one exists which is a D-Bus

1429

901

property with the specified name and interface.

1434

906

if (value._dbus_name == property_name

1435

907

and value._dbus_interface == interface_name):

1436

908

return value.__get__(self)

1437

909

1438

910

# No such property

1439

911

raise DBusPropertyNotFound("{}:{}.{}".format(

1440

912

self.dbus_object_path, interface_name, property_name))

1441

1442

@classmethod

1443

def _get_all_interface_names(cls):

1444

"""Get a sequence of all interfaces supported by an object"""

1445

return (name for name in set(getattr(getattr(x, attr),

1446

"_dbus_interface", None)

1447

for x in (inspect.getmro(cls))

1448

for attr in dir(x))

1449

if name is not None)

1450

913

1451

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

1452

915

in_signature="ss",

1453

916

out_signature="v")

1461

924

if not hasattr(value, "variant_level"):

1462

925

return value

1463

926

return type(value)(value, variant_level=value.variant_level+1)

1464

927

1465

928

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1466

929

def Set(self, interface_name, property_name, value):

1467

930

"""Standard D-Bus property Set() method, see D-Bus standard.

1476

939

raise ValueError("Byte arrays not supported for non-"

1477

940

"'ay' signature {!r}"

1478

941

.format(prop._dbus_signature))

1479

value = dbus.ByteArray(bytes(value))

942

value = dbus.ByteArray(b''.join(chr(byte)

943

for byte in value))

1480

944

prop(value)

1481

945

1482

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

1483

947

in_signature="s",

1484

948

out_signature="a{sv}")

1485

949

def GetAll(self, interface_name):

1486

950

"""Standard D-Bus property GetAll() method, see D-Bus

1487

951

standard.

1488

952

1489

953

Note: Will not include properties with access="write".

1490

954

"""

1491

955

properties = {}

1502

966

properties[name] = value

1503

967

continue

1504

968

properties[name] = type(value)(

1505

value, variant_level=value.variant_level + 1)

969

value, variant_level = value.variant_level + 1)

1506

970

return dbus.Dictionary(properties, signature="sv")

1507

971

1508

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1509

973

def PropertiesChanged(self, interface_name, changed_properties,

1510

974

invalidated_properties):

1512

976

standard.

1513

977

"""

1514

978

pass

1515

979

1516

980

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1517

981

out_signature="s",

1518

path_keyword="object_path",

1519

connection_keyword="connection")

982

path_keyword='object_path',

983

connection_keyword='connection')

1520

984

def Introspect(self, object_path, connection):

1521

985

"""Overloading of standard D-Bus method.

1522

986

1523

987

Inserts property tags and interface annotation tags.

1524

988

"""

1525

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1526

object_path,

1527

connection)

989

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

connection)

1528

991

try:

1529

992

document = xml.dom.minidom.parseString(xmlstring)

1530

993

1531

994

def make_tag(document, name, prop):

1532

995

e = document.createElement("property")

1533

996

e.setAttribute("name", name)

1534

997

e.setAttribute("type", prop._dbus_signature)

1535

998

e.setAttribute("access", prop._dbus_access)

1536

999

return e

1537

1000

1538

1001

for if_tag in document.getElementsByTagName("interface"):

1539

1002

# Add property tags

1540

1003

for tag in (make_tag(document, name, prop)

1543

1006

if prop._dbus_interface

1544

1007

== if_tag.getAttribute("name")):

1545

1008

if_tag.appendChild(tag)

1546

# Add annotation tags for properties

1547

for tag in if_tag.getElementsByTagName("property"):

1548

annots = dict()

1549

for name, prop in self._get_all_dbus_things(

1550

"property"):

1551

if (name == tag.getAttribute("name")

1552

and prop._dbus_interface

1553

== if_tag.getAttribute("name")):

1554

annots.update(getattr(

1555

prop, "_dbus_annotations", {}))

1556

for name, value in annots.items():

1557

ann_tag = document.createElement(

1558

"annotation")

1559

ann_tag.setAttribute("name", name)

1560

ann_tag.setAttribute("value", value)

1561

tag.appendChild(ann_tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1562

1038

# Add the names to the return values for the

1563

1039

# "org.freedesktop.DBus.Properties" methods

1564

1040

if (if_tag.getAttribute("name")

1578

1054

document.unlink()

1579

1055

except (AttributeError, xml.dom.DOMException,

1580

1056

xml.parsers.expat.ExpatError) as error:

1581

log.error("Failed to override Introspection method",

1582

exc_info=error)

1583

return xmlstring

1584

1585

1586

try:

1587

dbus.OBJECT_MANAGER_IFACE

1588

except AttributeError:

1589

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1590

1591

1592

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1593

"""A D-Bus object with an ObjectManager.

1594

1595

Classes inheriting from this exposes the standard

1596

GetManagedObjects call and the InterfacesAdded and

1597

InterfacesRemoved signals on the standard

1598

"org.freedesktop.DBus.ObjectManager" interface.

1599

1600

Note: No signals are sent automatically; they must be sent

1601

manually.

1602

"""

1603

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1604

out_signature="a{oa{sa{sv}}}")

1605

def GetManagedObjects(self):

1606

"""This function must be overridden"""

1607

raise NotImplementedError()

1608

1609

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1610

signature="oa{sa{sv}}")

1611

def InterfacesAdded(self, object_path, interfaces_and_properties):

1612

pass

1613

1614

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1615

def InterfacesRemoved(self, object_path, interfaces):

1616

pass

1617

1618

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1619

out_signature="s",

1620

path_keyword="object_path",

1621

connection_keyword="connection")

1622

def Introspect(self, object_path, connection):

1623

"""Overloading of standard D-Bus method.

1624

1625

Override return argument name of GetManagedObjects to be

1626

"objpath_interfaces_and_properties"

1627

"""

1628

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1629

object_path,

1630

connection)

1631

try:

1632

document = xml.dom.minidom.parseString(xmlstring)

1633

1634

for if_tag in document.getElementsByTagName("interface"):

1635

# Fix argument name for the GetManagedObjects method

1636

if (if_tag.getAttribute("name")

1637

== dbus.OBJECT_MANAGER_IFACE):

1638

for cn in if_tag.getElementsByTagName("method"):

1639

if (cn.getAttribute("name")

1640

== "GetManagedObjects"):

1641

for arg in cn.getElementsByTagName("arg"):

1642

if (arg.getAttribute("direction")

1643

== "out"):

1644

arg.setAttribute(

1645

"name",

1646

"objpath_interfaces"

1647

"_and_properties")

1648

xmlstring = document.toxml("utf-8")

1649

document.unlink()

1650

except (AttributeError, xml.dom.DOMException,

1651

xml.parsers.expat.ExpatError) as error:

1652

log.error("Failed to override Introspection method",

1653

exc_info=error)

1057

logger.error("Failed to override Introspection method",

1058

exc_info=error)

1654

1059

return xmlstring

1655

1060

1656

1061

1657

1062

def datetime_to_dbus(dt, variant_level=0):

1658

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1659

1064

if dt is None:

1660

return dbus.String("", variant_level=variant_level)

1065

return dbus.String("", variant_level = variant_level)

1661

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1662

1067

1663

1068

1666

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1667

1072

interface names according to the "alt_interface_names" mapping.

1668

1073

Usage:

1669

1074

1670

1075

@alternate_dbus_interfaces({"org.example.Interface":

1671

1076

"net.example.AlternateInterface"})

1672

1077

class SampleDBusObject(dbus.service.Object):

1673

1078

@dbus.service.method("org.example.Interface")

1674

1079

def SampleDBusMethod():

1675

1080

pass

1676

1081

1677

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1678

1083

reachable via two interfaces: "org.example.Interface" and

1679

1084

"net.example.AlternateInterface", the latter of which will have

1680

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1681

1086

"true", unless "deprecate" is passed with a False value.

1682

1087

1683

1088

This works for methods and signals, and also for D-Bus properties

1684

1089

(from DBusObjectWithProperties) and interfaces (from the

1685

1090

dbus_interface_annotations decorator).

1686

1091

"""

1687

1092

1688

1093

def wrapper(cls):

1689

1094

for orig_interface_name, alt_interface_name in (

1690

1095

alt_interface_names.items()):

1707

1112

if getattr(attribute, "_dbus_is_signal", False):

1708

1113

# Extract the original non-method undecorated

1709

1114

# function by black magic

1710

if sys.version_info.major == 2:

1711

nonmethod_func = (dict(

1712

zip(attribute.func_code.co_freevars,

1713

attribute.__closure__))

1714

["func"].cell_contents)

1715

else:

1716

nonmethod_func = (dict(

1717

zip(attribute.__code__.co_freevars,

1718

attribute.__closure__))

1719

["func"].cell_contents)

1115

nonmethod_func = (dict(

1116

zip(attribute.func_code.co_freevars,

1117

attribute.__closure__))

1118

["func"].cell_contents)

1720

1119

# Create a new, but exactly alike, function

1721

1120

# object, and decorate it to be a new D-Bus signal

1722

1121

# with the alternate D-Bus interface name

1723

new_function = copy_function(nonmethod_func)

1724

1122

new_function = (dbus.service.signal(

1725

alt_interface,

1726

attribute._dbus_signature)(new_function))

1123

alt_interface, attribute._dbus_signature)

1124

(types.FunctionType(

1125

nonmethod_func.func_code,

1126

nonmethod_func.func_globals,

1127

nonmethod_func.func_name,

1128

nonmethod_func.func_defaults,

1129

nonmethod_func.func_closure)))

1727

1130

# Copy annotations, if any

1728

1131

try:

1729

1132

new_function._dbus_annotations = dict(

1730

1133

attribute._dbus_annotations)

1731

1134

except AttributeError:

1732

1135

pass

1733

1734

1136

# Define a creator of a function to call both the

1735

1137

# original and alternate functions, so both the

1736

1138

# original and alternate signals gets sent when

1739

1141

"""This function is a scope container to pass

1740

1142

func1 and func2 to the "call_both" function

1741

1143

outside of its arguments"""

1742

1743

@functools.wraps(func2)

1144

1744

1145

def call_both(*args, **kwargs):

1745

1146

"""This function will emit two D-Bus

1746

1147

signals by calling func1 and func2"""

1747

1148

func1(*args, **kwargs)

1748

1149

func2(*args, **kwargs)

1749

# Make wrapper function look like a D-Bus

1750

# signal

1751

for name, attr in inspect.getmembers(func2):

1752

if name.startswith("_dbus_"):

1753

setattr(call_both, name, attr)

1754

1150

1755

1151

return call_both

1756

1152

# Create the "call_both" function and add it to

1757

1153

# the class

1767

1163

alt_interface,

1768

1164

attribute._dbus_in_signature,

1769

1165

attribute._dbus_out_signature)

1770

(copy_function(attribute)))

1166

(types.FunctionType(attribute.func_code,

1167

attribute.func_globals,

1168

attribute.func_name,

1169

attribute.func_defaults,

1170

attribute.func_closure)))

1771

1171

# Copy annotations, if any

1772

1172

try:

1773

1173

attr[attrname]._dbus_annotations = dict(

1785

1185

attribute._dbus_access,

1786

1186

attribute._dbus_get_args_options

1787

1187

["byte_arrays"])

1788

(copy_function(attribute)))

1188

(types.FunctionType(

1189

attribute.func_code,

1190

attribute.func_globals,

1191

attribute.func_name,

1192

attribute.func_defaults,

1193

attribute.func_closure)))

1789

1194

# Copy annotations, if any

1790

1195

try:

1791

1196

attr[attrname]._dbus_annotations = dict(

1800

1205

# to the class.

1801

1206

attr[attrname] = (

1802

1207

dbus_interface_annotations(alt_interface)

1803

(copy_function(attribute)))

1208

(types.FunctionType(attribute.func_code,

1209

attribute.func_globals,

1210

attribute.func_name,

1211

attribute.func_defaults,

1212

attribute.func_closure)))

1804

1213

if deprecate:

1805

1214

# Deprecate all alternate interfaces

1806

iname = "_AlternateDBusNames_interface_annotation{}"

1215

iname="_AlternateDBusNames_interface_annotation{}"

1807

1216

for interface_name in interface_names:

1808

1217

1809

1218

@dbus_interface_annotations(interface_name)

1810

1219

def func(self):

1811

return {"org.freedesktop.DBus.Deprecated":

1812

"true"}

1220

return { "org.freedesktop.DBus.Deprecated":

1221

"true" }

1813

1222

# Find an unused name

1814

1223

for aname in (iname.format(i)

1815

1224

for i in itertools.count()):

1819

1228

if interface_names:

1820

1229

# Replace the class with a new subclass of it with

1821

1230

# methods, signals, etc. as created above.

1822

if sys.version_info.major == 2:

1823

cls = type(b"{}Alternate".format(cls.__name__),

1824

(cls, ), attr)

1825

else:

1826

cls = type("{}Alternate".format(cls.__name__),

1827

(cls, ), attr)

1231

cls = type(b"{}Alternate".format(cls.__name__),

1232

(cls, ), attr)

1828

1233

return cls

1829

1234

1830

1235

return wrapper

1831

1236

1832

1237

1834

1239

"se.bsnet.fukt.Mandos"})

1835

1240

class ClientDBus(Client, DBusObjectWithProperties):

1836

1241

"""A Client class using D-Bus

1837

1242

1838

1243

Attributes:

1839

1244

dbus_object_path: dbus.ObjectPath

1840

1245

bus: dbus.SystemBus()

1841

1246

"""

1842

1247

1843

1248

runtime_expansions = (Client.runtime_expansions

1844

1249

+ ("dbus_object_path", ))

1845

1250

1846

1251

_interface = "se.recompile.Mandos.Client"

1847

1252

1848

1253

# dbus.service.Object doesn't use super(), so we can't either.

1849

1850

def __init__(self, bus=None, *args, **kwargs):

1254

1255

def __init__(self, bus = None, *args, **kwargs):

1851

1256

self.bus = bus

1852

1257

Client.__init__(self, *args, **kwargs)

1853

1258

# Only now, when this client is initialized, can it show up on

1859

1264

"/clients/" + client_object_name)

1860

1265

DBusObjectWithProperties.__init__(self, self.bus,

1861

1266

self.dbus_object_path)

1862

1267

1863

1268

def notifychangeproperty(transform_func, dbus_name,

1864

1269

type_func=lambda x: x,

1865

1270

variant_level=1,

1867

1272

_interface=_interface):

1868

1273

""" Modify a variable so that it's a property which announces

1869

1274

its changes to DBus.

1870

1275

1871

1276

transform_fun: Function that takes a value and a variant_level

1872

1277

and transforms it to a D-Bus type.

1873

1278

dbus_name: D-Bus name of the variable

1876

1281

variant_level: D-Bus variant level. Default: 1

1877

1282

"""

1878

1283

attrname = "_{}".format(dbus_name)

1879

1284

1880

1285

def setter(self, value):

1881

1286

if hasattr(self, "dbus_object_path"):

1882

1287

if (not hasattr(self, attrname) or

1889

1294

else:

1890

1295

dbus_value = transform_func(

1891

1296

type_func(value),

1892

variant_level=variant_level)

1297

variant_level = variant_level)

1893

1298

self.PropertyChanged(dbus.String(dbus_name),

1894

1299

dbus_value)

1895

1300

self.PropertiesChanged(

1896

1301

_interface,

1897

dbus.Dictionary({dbus.String(dbus_name):

1898

dbus_value}),

1302

dbus.Dictionary({ dbus.String(dbus_name):

1303

dbus_value }),

1899

1304

dbus.Array())

1900

1305

setattr(self, attrname, value)

1901

1306

1902

1307

return property(lambda self: getattr(self, attrname), setter)

1903

1308

1904

1309

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1905

1310

approvals_pending = notifychangeproperty(dbus.Boolean,

1906

1311

"ApprovalPending",

1907

type_func=bool)

1312

type_func = bool)

1908

1313

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1909

1314

last_enabled = notifychangeproperty(datetime_to_dbus,

1910

1315

"LastEnabled")

1911

1316

checker = notifychangeproperty(

1912

1317

dbus.Boolean, "CheckerRunning",

1913

type_func=lambda checker: checker is not None)

1318

type_func = lambda checker: checker is not None)

1914

1319

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1915

1320

"LastCheckedOK")

1916

1321

last_checker_status = notifychangeproperty(dbus.Int16,

1921

1326

"ApprovedByDefault")

1922

1327

approval_delay = notifychangeproperty(

1923

1328

dbus.UInt64, "ApprovalDelay",

1924

type_func=lambda td: td.total_seconds() * 1000)

1329

type_func = lambda td: td.total_seconds() * 1000)

1925

1330

approval_duration = notifychangeproperty(

1926

1331

dbus.UInt64, "ApprovalDuration",

1927

type_func=lambda td: td.total_seconds() * 1000)

1332

type_func = lambda td: td.total_seconds() * 1000)

1928

1333

host = notifychangeproperty(dbus.String, "Host")

1929

1334

timeout = notifychangeproperty(

1930

1335

dbus.UInt64, "Timeout",

1931

type_func=lambda td: td.total_seconds() * 1000)

1336

type_func = lambda td: td.total_seconds() * 1000)

1932

1337

extended_timeout = notifychangeproperty(

1933

1338

dbus.UInt64, "ExtendedTimeout",

1934

type_func=lambda td: td.total_seconds() * 1000)

1339

type_func = lambda td: td.total_seconds() * 1000)

1935

1340

interval = notifychangeproperty(

1936

1341

dbus.UInt64, "Interval",

1937

type_func=lambda td: td.total_seconds() * 1000)

1342

type_func = lambda td: td.total_seconds() * 1000)

1938

1343

checker_command = notifychangeproperty(dbus.String, "Checker")

1939

1344

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1940

1345

invalidate_only=True)

1941

1346

1942

1347

del notifychangeproperty

1943

1348

1944

1349

def __del__(self, *args, **kwargs):

1945

1350

try:

1946

1351

self.remove_from_connection()

1949

1354

if hasattr(DBusObjectWithProperties, "__del__"):

1950

1355

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1951

1356

Client.__del__(self, *args, **kwargs)

1952

1953

def checker_callback(self, source, condition,

1954

connection, command, *args, **kwargs):

1955

ret = Client.checker_callback(self, source, condition,

1956

connection, command, *args,

1957

**kwargs)

1958

exitstatus = self.last_checker_status

1959

if exitstatus >= 0:

1357

1358

def checker_callback(self, pid, condition, command,

1359

*args, **kwargs):

1360

self.checker_callback_tag = None

1361

self.checker = None

1362

if os.WIFEXITED(condition):

1363

exitstatus = os.WEXITSTATUS(condition)

1960

1364

# Emit D-Bus signal

1961

1365

self.CheckerCompleted(dbus.Int16(exitstatus),

1962

# This is specific to GNU libC

1963

dbus.Int64(exitstatus << 8),

1366

dbus.Int64(condition),

1964

1367

dbus.String(command))

1965

1368

else:

1966

1369

# Emit D-Bus signal

1967

1370

self.CheckerCompleted(dbus.Int16(-1),

1968

dbus.Int64(

1969

# This is specific to GNU libC

1970

(exitstatus << 8)

1971

| self.last_checker_signal),

1371

dbus.Int64(condition),

1972

1372

dbus.String(command))

1973

return ret

1974

1373

1374

return Client.checker_callback(self, pid, condition, command,

1375

*args, **kwargs)

1376

1975

1377

def start_checker(self, *args, **kwargs):

1976

1378

old_checker_pid = getattr(self.checker, "pid", None)

1977

1379

r = Client.start_checker(self, *args, **kwargs)

1981

1383

# Emit D-Bus signal

1982

1384

self.CheckerStarted(self.current_checker_command)

1983

1385

return r

1984

1386

1985

1387

def _reset_approved(self):

1986

1388

self.approved = None

1987

1389

return False

1988

1390

1989

1391

def approve(self, value=True):

1990

1392

self.approved = value

1991

GLib.timeout_add(int(self.approval_duration.total_seconds()

1992

* 1000), self._reset_approved)

1393

gobject.timeout_add(int(self.approval_duration.total_seconds()

1394

* 1000), self._reset_approved)

1993

1395

self.send_changedstate()

1994

1995

# D-Bus methods, signals & properties

1996

1997

# Interfaces

1998

1999

# Signals

2000

1396

1397

## D-Bus methods, signals & properties

1398

1399

## Interfaces

1400

1401

## Signals

1402

2001

1403

# CheckerCompleted - signal

2002

1404

@dbus.service.signal(_interface, signature="nxs")

2003

1405

def CheckerCompleted(self, exitcode, waitstatus, command):

2004

1406

"D-Bus signal"

2005

1407

pass

2006

1408

2007

1409

# CheckerStarted - signal

2008

1410

@dbus.service.signal(_interface, signature="s")

2009

1411

def CheckerStarted(self, command):

2010

1412

"D-Bus signal"

2011

1413

pass

2012

1414

2013

1415

# PropertyChanged - signal

2014

1416

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1417

@dbus.service.signal(_interface, signature="sv")

2016

1418

def PropertyChanged(self, property, value):

2017

1419

"D-Bus signal"

2018

1420

pass

2019

1421

2020

1422

# GotSecret - signal

2021

1423

@dbus.service.signal(_interface)

2022

1424

def GotSecret(self):

2025

1427

server to mandos-client

2026

1428

"""

2027

1429

pass

2028

1430

2029

1431

# Rejected - signal

2030

1432

@dbus.service.signal(_interface, signature="s")

2031

1433

def Rejected(self, reason):

2032

1434

"D-Bus signal"

2033

1435

pass

2034

1436

2035

1437

# NeedApproval - signal

2036

1438

@dbus.service.signal(_interface, signature="tb")

2037

1439

def NeedApproval(self, timeout, default):

2038

1440

"D-Bus signal"

2039

1441

return self.need_approval()

2040

2041

# Methods

2042

1442

1443

## Methods

1444

2043

1445

# Approve - method

2044

1446

@dbus.service.method(_interface, in_signature="b")

2045

1447

def Approve(self, value):

2046

1448

self.approve(value)

2047

1449

2048

1450

# CheckedOK - method

2049

1451

@dbus.service.method(_interface)

2050

1452

def CheckedOK(self):

2051

1453

self.checked_ok()

2052

1454

2053

1455

# Enable - method

2054

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2055

1456

@dbus.service.method(_interface)

2056

1457

def Enable(self):

2057

1458

"D-Bus method"

2058

1459

self.enable()

2059

1460

2060

1461

# StartChecker - method

2061

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2062

1462

@dbus.service.method(_interface)

2063

1463

def StartChecker(self):

2064

1464

"D-Bus method"

2065

1465

self.start_checker()

2066

1466

2067

1467

# Disable - method

2068

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2069

1468

@dbus.service.method(_interface)

2070

1469

def Disable(self):

2071

1470

"D-Bus method"

2072

1471

self.disable()

2073

1472

2074

1473

# StopChecker - method

2075

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2076

1474

@dbus.service.method(_interface)

2077

1475

def StopChecker(self):

2078

1476

self.stop_checker()

2079

2080

# Properties

2081

1477

1478

## Properties

1479

2082

1480

# ApprovalPending - property

2083

1481

@dbus_service_property(_interface, signature="b", access="read")

2084

1482

def ApprovalPending_dbus_property(self):

2085

1483

return dbus.Boolean(bool(self.approvals_pending))

2086

1484

2087

1485

# ApprovedByDefault - property

2088

1486

@dbus_service_property(_interface,

2089

1487

signature="b",

2092

1490

if value is None: # get

2093

1491

return dbus.Boolean(self.approved_by_default)

2094

1492

self.approved_by_default = bool(value)

2095

1493

2096

1494

# ApprovalDelay - property

2097

1495

@dbus_service_property(_interface,

2098

1496

signature="t",

2102

1500

return dbus.UInt64(self.approval_delay.total_seconds()

2103

1501

* 1000)

2104

1502

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2105

1503

2106

1504

# ApprovalDuration - property

2107

1505

@dbus_service_property(_interface,

2108

1506

signature="t",

2112

1510

return dbus.UInt64(self.approval_duration.total_seconds()

2113

1511

* 1000)

2114

1512

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2115

1513

2116

1514

# Name - property

2117

@dbus_annotations(

2118

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2119

1515

@dbus_service_property(_interface, signature="s", access="read")

2120

1516

def Name_dbus_property(self):

2121

1517

return dbus.String(self.name)

2122

2123

# KeyID - property

2124

@dbus_annotations(

2125

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2126

@dbus_service_property(_interface, signature="s", access="read")

2127

def KeyID_dbus_property(self):

2128

return dbus.String(self.key_id)

2129

1518

2130

1519

# Fingerprint - property

2131

@dbus_annotations(

2132

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2133

1520

@dbus_service_property(_interface, signature="s", access="read")

2134

1521

def Fingerprint_dbus_property(self):

2135

1522

return dbus.String(self.fingerprint)

2136

1523

2137

1524

# Host - property

2138

1525

@dbus_service_property(_interface,

2139

1526

signature="s",

2142

1529

if value is None: # get

2143

1530

return dbus.String(self.host)

2144

1531

self.host = str(value)

2145

1532

2146

1533

# Created - property

2147

@dbus_annotations(

2148

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2149

1534

@dbus_service_property(_interface, signature="s", access="read")

2150

1535

def Created_dbus_property(self):

2151

1536

return datetime_to_dbus(self.created)

2152

1537

2153

1538

# LastEnabled - property

2154

1539

@dbus_service_property(_interface, signature="s", access="read")

2155

1540

def LastEnabled_dbus_property(self):

2156

1541

return datetime_to_dbus(self.last_enabled)

2157

1542

2158

1543

# Enabled - property

2159

1544

@dbus_service_property(_interface,

2160

1545

signature="b",

2166

1551

self.enable()

2167

1552

else:

2168

1553

self.disable()

2169

1554

2170

1555

# LastCheckedOK - property

2171

1556

@dbus_service_property(_interface,

2172

1557

signature="s",

2176

1561

self.checked_ok()

2177

1562

return

2178

1563

return datetime_to_dbus(self.last_checked_ok)

2179

1564

2180

1565

# LastCheckerStatus - property

2181

1566

@dbus_service_property(_interface, signature="n", access="read")

2182

1567

def LastCheckerStatus_dbus_property(self):

2183

1568

return dbus.Int16(self.last_checker_status)

2184

1569

2185

1570

# Expires - property

2186

1571

@dbus_service_property(_interface, signature="s", access="read")

2187

1572

def Expires_dbus_property(self):

2188

1573

return datetime_to_dbus(self.expires)

2189

1574

2190

1575

# LastApprovalRequest - property

2191

1576

@dbus_service_property(_interface, signature="s", access="read")

2192

1577

def LastApprovalRequest_dbus_property(self):

2193

1578

return datetime_to_dbus(self.last_approval_request)

2194

1579

2195

1580

# Timeout - property

2196

1581

@dbus_service_property(_interface,

2197

1582

signature="t",

2212

1597

if (getattr(self, "disable_initiator_tag", None)

2213

1598

is None):

2214

1599

return

2215

GLib.source_remove(self.disable_initiator_tag)

2216

self.disable_initiator_tag = GLib.timeout_add(

1600

gobject.source_remove(self.disable_initiator_tag)

1601

self.disable_initiator_tag = gobject.timeout_add(

2217

1602

int((self.expires - now).total_seconds() * 1000),

2218

1603

self.disable)

2219

1604

2220

1605

# ExtendedTimeout - property

2221

1606

@dbus_service_property(_interface,

2222

1607

signature="t",

2226

1611

return dbus.UInt64(self.extended_timeout.total_seconds()

2227

1612

* 1000)

2228

1613

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2229

1614

2230

1615

# Interval - property

2231

1616

@dbus_service_property(_interface,

2232

1617

signature="t",

2239

1624

return

2240

1625

if self.enabled:

2241

1626

# Reschedule checker run

2242

GLib.source_remove(self.checker_initiator_tag)

2243

self.checker_initiator_tag = GLib.timeout_add(

1627

gobject.source_remove(self.checker_initiator_tag)

1628

self.checker_initiator_tag = gobject.timeout_add(

2244

1629

value, self.start_checker)

2245

self.start_checker() # Start one now, too

2246

1630

self.start_checker() # Start one now, too

1631

2247

1632

# Checker - property

2248

1633

@dbus_service_property(_interface,

2249

1634

signature="s",

2252

1637

if value is None: # get

2253

1638

return dbus.String(self.checker_command)

2254

1639

self.checker_command = str(value)

2255

1640

2256

1641

# CheckerRunning - property

2257

1642

@dbus_service_property(_interface,

2258

1643

signature="b",

2264

1649

self.start_checker()

2265

1650

else:

2266

1651

self.stop_checker()

2267

1652

2268

1653

# ObjectPath - property

2269

@dbus_annotations(

2270

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2271

"org.freedesktop.DBus.Deprecated": "true"})

2272

1654

@dbus_service_property(_interface, signature="o", access="read")

2273

1655

def ObjectPath_dbus_property(self):

2274

return self.dbus_object_path # is already a dbus.ObjectPath

2275

1656

return self.dbus_object_path # is already a dbus.ObjectPath

1657

2276

1658

# Secret = property

2277

@dbus_annotations(

2278

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2279

"invalidates"})

2280

1659

@dbus_service_property(_interface,

2281

1660

signature="ay",

2282

1661

access="write",

2283

1662

byte_arrays=True)

2284

1663

def Secret_dbus_property(self, value):

2285

1664

self.secret = bytes(value)

2286

1665

2287

1666

del _interface

2288

1667

2289

1668

2290

class ProxyClient:

2291

def __init__(self, child_pipe, key_id, fpr, address):

1669

class ProxyClient(object):

1670

def __init__(self, child_pipe, fpr, address):

2292

1671

self._pipe = child_pipe

2293

self._pipe.send(("init", key_id, fpr, address))

1672

self._pipe.send(('init', fpr, address))

2294

1673

if not self._pipe.recv():

2295

raise KeyError(key_id or fpr)

2296

1674

raise KeyError()

1675

2297

1676

def __getattribute__(self, name):

2298

if name == "_pipe":

1677

if name == '_pipe':

2299

1678

return super(ProxyClient, self).__getattribute__(name)

2300

self._pipe.send(("getattr", name))

1679

self._pipe.send(('getattr', name))

2301

1680

data = self._pipe.recv()

2302

if data[0] == "data":

1681

if data[0] == 'data':

2303

1682

return data[1]

2304

if data[0] == "function":

2305

1683

if data[0] == 'function':

1684

2306

1685

def func(*args, **kwargs):

2307

self._pipe.send(("funcall", name, args, kwargs))

1686

self._pipe.send(('funcall', name, args, kwargs))

2308

1687

return self._pipe.recv()[1]

2309

1688

2310

1689

return func

2311

1690

2312

1691

def __setattr__(self, name, value):

2313

if name == "_pipe":

1692

if name == '_pipe':

2314

1693

return super(ProxyClient, self).__setattr__(name, value)

2315

self._pipe.send(("setattr", name, value))

1694

self._pipe.send(('setattr', name, value))

2316

1695

2317

1696

2318

1697

class ClientHandler(socketserver.BaseRequestHandler, object):

2319

1698

"""A class to handle client connections.

2320

1699

2321

1700

Instantiated once for each connection to handle it.

2322

1701

Note: This will run in its own forked process."""

2323

1702

2324

1703

def handle(self):

2325

1704

with contextlib.closing(self.server.child_pipe) as child_pipe:

2326

log.info("TCP connection from: %s",

2327

str(self.client_address))

2328

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2329

2330

session = gnutls.ClientSession(self.request)

2331

2332

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2333

# "+AES-256-CBC", "+SHA1",

2334

# "+COMP-NULL", "+CTYPE-OPENPGP",

2335

# "+DHE-DSS"))

1705

logger.info("TCP connection from: %s",

1706

str(self.client_address))

1707

logger.debug("Pipe FD: %d",

1708

self.server.child_pipe.fileno())

1709

1710

session = gnutls.connection.ClientSession(

1711

self.request, gnutls.connection .X509Credentials())

1712

1713

# Note: gnutls.connection.X509Credentials is really a

1714

# generic GnuTLS certificate credentials object so long as

1715

# no X.509 keys are added to it. Therefore, we can use it

1716

# here despite using OpenPGP certificates.

1717

1718

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1719

# "+AES-256-CBC", "+SHA1",

1720

# "+COMP-NULL", "+CTYPE-OPENPGP",

1721

# "+DHE-DSS"))

2336

1722

# Use a fallback default, since this MUST be set.

2337

1723

priority = self.server.gnutls_priority

2338

1724

if priority is None:

2339

1725

priority = "NORMAL"

2340

gnutls.priority_set_direct(session,

2341

priority.encode("utf-8"), None)

2342

1726

gnutls.library.functions.gnutls_priority_set_direct(

1727

session._c_object, priority, None)

1728

2343

1729

# Start communication using the Mandos protocol

2344

1730

# Get protocol number

2345

1731

line = self.request.makefile().readline()

2346

log.debug("Protocol version: %r", line)

1732

logger.debug("Protocol version: %r", line)

2347

1733

try:

2348

1734

if int(line.strip().split()[0]) > 1:

2349

1735

raise RuntimeError(line)

2350

1736

except (ValueError, IndexError, RuntimeError) as error:

2351

log.error("Unknown protocol version: %s", error)

1737

logger.error("Unknown protocol version: %s", error)

2352

1738

return

2353

1739

2354

1740

# Start GnuTLS connection

2355

1741

try:

2356

1742

session.handshake()

2357

except gnutls.Error as error:

2358

log.warning("Handshake failed: %s", error)

1743

except gnutls.errors.GNUTLSError as error:

1744

logger.warning("Handshake failed: %s", error)

2359

1745

# Do not run session.bye() here: the session is not

2360

1746

# established. Just abandon the request.

2361

1747

return

2362

log.debug("Handshake succeeded")

2363

1748

logger.debug("Handshake succeeded")

1749

2364

1750

approval_required = False

2365

1751

try:

2366

if gnutls.has_rawpk:

2367

fpr = b""

2368

try:

2369

key_id = self.key_id(

2370

self.peer_certificate(session))

2371

except (TypeError, gnutls.Error) as error:

2372

log.warning("Bad certificate: %s", error)

2373

return

2374

log.debug("Key ID: %s",

2375

key_id.decode("utf-8",

2376

errors="replace"))

2377

2378

else:

2379

key_id = b""

2380

try:

2381

fpr = self.fingerprint(

2382

self.peer_certificate(session))

2383

except (TypeError, gnutls.Error) as error:

2384

log.warning("Bad certificate: %s", error)

2385

return

2386

log.debug("Fingerprint: %s", fpr)

2387

2388

try:

2389

client = ProxyClient(child_pipe, key_id, fpr,

1752

try:

1753

fpr = self.fingerprint(

1754

self.peer_certificate(session))

1755

except (TypeError,

1756

gnutls.errors.GNUTLSError) as error:

1757

logger.warning("Bad certificate: %s", error)

1758

return

1759

logger.debug("Fingerprint: %s", fpr)

1760

1761

try:

1762

client = ProxyClient(child_pipe, fpr,

2390

1763

self.client_address)

2391

1764

except KeyError:

2392

1765

return

2393

1766

2394

1767

if client.approval_delay:

2395

1768

delay = client.approval_delay

2396

1769

client.approvals_pending += 1

2397

1770

approval_required = True

2398

1771

2399

1772

while True:

2400

1773

if not client.enabled:

2401

log.info("Client %s is disabled", client.name)

1774

logger.info("Client %s is disabled",

1775

client.name)

2402

1776

if self.server.use_dbus:

2403

1777

# Emit D-Bus signal

2404

1778

client.Rejected("Disabled")

2405

1779

return

2406

1780

2407

1781

if client.approved or not client.approval_delay:

2408

# We are approved or approval is disabled

1782

#We are approved or approval is disabled

2409

1783

break

2410

1784

elif client.approved is None:

2411

log.info("Client %s needs approval",

2412

client.name)

1785

logger.info("Client %s needs approval",

1786

client.name)

2413

1787

if self.server.use_dbus:

2414

1788

# Emit D-Bus signal

2415

1789

client.NeedApproval(

2416

1790

client.approval_delay.total_seconds()

2417

1791

* 1000, client.approved_by_default)

2418

1792

else:

2419

log.warning("Client %s was not approved",

2420

client.name)

1793

logger.warning("Client %s was not approved",

1794

client.name)

2421

1795

if self.server.use_dbus:

2422

1796

# Emit D-Bus signal

2423

1797

client.Rejected("Denied")

2424

1798

return

2425

2426

# wait until timeout or approved

1799

1800

#wait until timeout or approved

2427

1801

time = datetime.datetime.now()

2428

1802

client.changedstate.acquire()

2429

1803

client.changedstate.wait(delay.total_seconds())

2431

1805

time2 = datetime.datetime.now()

2432

1806

if (time2 - time) >= delay:

2433

1807

if not client.approved_by_default:

2434

log.warning("Client %s timed out while"

2435

" waiting for approval",

2436

client.name)

1808

logger.warning("Client %s timed out while"

1809

" waiting for approval",

1810

client.name)

2437

1811

if self.server.use_dbus:

2438

1812

# Emit D-Bus signal

2439

1813

client.Rejected("Approval timed out")

2442

1816

break

2443

1817

else:

2444

1818

delay -= time2 - time

2445

2446

try:

2447

session.send(client.secret)

2448

except gnutls.Error as error:

2449

log.warning("gnutls send failed", exc_info=error)

2450

return

2451

2452

log.info("Sending secret to %s", client.name)

1819

1820

sent_size = 0

1821

while sent_size < len(client.secret):

1822

try:

1823

sent = session.send(client.secret[sent_size:])

1824

except gnutls.errors.GNUTLSError as error:

1825

logger.warning("gnutls send failed",

1826

exc_info=error)

1827

return

1828

logger.debug("Sent: %d, remaining: %d", sent,

1829

len(client.secret) - (sent_size

1830

+ sent))

1831

sent_size += sent

1832

1833

logger.info("Sending secret to %s", client.name)

2453

1834

# bump the timeout using extended_timeout

2454

1835

client.bump_timeout(client.extended_timeout)

2455

1836

if self.server.use_dbus:

2456

1837

# Emit D-Bus signal

2457

1838

client.GotSecret()

2458

1839

2459

1840

finally:

2460

1841

if approval_required:

2461

1842

client.approvals_pending -= 1

2462

1843

try:

2463

1844

session.bye()

2464

except gnutls.Error as error:

2465

log.warning("GnuTLS bye failed", exc_info=error)

2466

1845

except gnutls.errors.GNUTLSError as error:

1846

logger.warning("GnuTLS bye failed",

1847

exc_info=error)

1848

2467

1849

@staticmethod

2468

1850

def peer_certificate(session):

2469

"Return the peer's certificate as a bytestring"

2470

try:

2471

cert_type = gnutls.certificate_type_get2(

2472

session, gnutls.CTYPE_PEERS)

2473

except AttributeError:

2474

cert_type = gnutls.certificate_type_get(session)

2475

if gnutls.has_rawpk:

2476

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2477

else:

2478

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2479

# If not a valid certificate type...

2480

if cert_type not in valid_cert_types:

2481

log.info("Cert type %r not in %r", cert_type,

2482

valid_cert_types)

2483

# ...return invalid data

2484

return b""

1851

"Return the peer's OpenPGP certificate as a bytestring"

1852

# If not an OpenPGP certificate...

1853

if (gnutls.library.functions.gnutls_certificate_type_get(

1854

session._c_object)

1855

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1856

# ...do the normal thing

1857

return session.peer_certificate

2485

1858

list_size = ctypes.c_uint(1)

2486

cert_list = (gnutls.certificate_get_peers

2487

(session, ctypes.byref(list_size)))

1859

cert_list = (gnutls.library.functions

1860

.gnutls_certificate_get_peers

1861

(session._c_object, ctypes.byref(list_size)))

2488

1862

if not bool(cert_list) and list_size.value != 0:

2489

raise gnutls.Error("error getting peer certificate")

1863

raise gnutls.errors.GNUTLSError("error getting peer"

1864

" certificate")

2490

1865

if list_size.value == 0:

2491

1866

return None

2492

1867

cert = cert_list[0]

2493

1868

return ctypes.string_at(cert.data, cert.size)

2494

2495

@staticmethod

2496

def key_id(certificate):

2497

"Convert a certificate bytestring to a hexdigit key ID"

2498

# New GnuTLS "datum" with the public key

2499

datum = gnutls.datum_t(

2500

ctypes.cast(ctypes.c_char_p(certificate),

2501

ctypes.POINTER(ctypes.c_ubyte)),

2502

ctypes.c_uint(len(certificate)))

2503

# XXX all these need to be created in the gnutls "module"

2504

# New empty GnuTLS certificate

2505

pubkey = gnutls.pubkey_t()

2506

gnutls.pubkey_init(ctypes.byref(pubkey))

2507

# Import the raw public key into the certificate

2508

gnutls.pubkey_import(pubkey,

2509

ctypes.byref(datum),

2510

gnutls.X509_FMT_DER)

2511

# New buffer for the key ID

2512

buf = ctypes.create_string_buffer(32)

2513

buf_len = ctypes.c_size_t(len(buf))

2514

# Get the key ID from the raw public key into the buffer

2515

gnutls.pubkey_get_key_id(

2516

pubkey,

2517

gnutls.KEYID_USE_SHA256,

2518

ctypes.cast(ctypes.byref(buf),

2519

ctypes.POINTER(ctypes.c_ubyte)),

2520

ctypes.byref(buf_len))

2521

# Deinit the certificate

2522

gnutls.pubkey_deinit(pubkey)

2523

2524

# Convert the buffer to a Python bytestring

2525

key_id = ctypes.string_at(buf, buf_len.value)

2526

# Convert the bytestring to hexadecimal notation

2527

hex_key_id = binascii.hexlify(key_id).upper()

2528

return hex_key_id

2529

1869

2530

1870

@staticmethod

2531

1871

def fingerprint(openpgp):

2532

1872

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2533

1873

# New GnuTLS "datum" with the OpenPGP public key

2534

datum = gnutls.datum_t(

1874

datum = gnutls.library.types.gnutls_datum_t(

2535

1875

ctypes.cast(ctypes.c_char_p(openpgp),

2536

1876

ctypes.POINTER(ctypes.c_ubyte)),

2537

1877

ctypes.c_uint(len(openpgp)))

2538

1878

# New empty GnuTLS certificate

2539

crt = gnutls.openpgp_crt_t()

2540

gnutls.openpgp_crt_init(ctypes.byref(crt))

1879

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1880

gnutls.library.functions.gnutls_openpgp_crt_init(

1881

ctypes.byref(crt))

2541

1882

# Import the OpenPGP public key into the certificate

2542

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2543

gnutls.OPENPGP_FMT_RAW)

1883

gnutls.library.functions.gnutls_openpgp_crt_import(

1884

crt, ctypes.byref(datum),

1885

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2544

1886

# Verify the self signature in the key

2545

1887

crtverify = ctypes.c_uint()

2546

gnutls.openpgp_crt_verify_self(crt, 0,

2547

ctypes.byref(crtverify))

1888

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1889

crt, 0, ctypes.byref(crtverify))

2548

1890

if crtverify.value != 0:

2549

gnutls.openpgp_crt_deinit(crt)

2550

raise gnutls.CertificateSecurityError(code

2551

=crtverify.value)

1891

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1892

raise gnutls.errors.CertificateSecurityError(

1893

"Verify failed")

2552

1894

# New buffer for the fingerprint

2553

1895

buf = ctypes.create_string_buffer(20)

2554

1896

buf_len = ctypes.c_size_t()

2555

1897

# Get the fingerprint from the certificate into the buffer

2556

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2557

ctypes.byref(buf_len))

1898

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1899

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2558

1900

# Deinit the certificate

2559

gnutls.openpgp_crt_deinit(crt)

1901

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2560

1902

# Convert the buffer to a Python bytestring

2561

1903

fpr = ctypes.string_at(buf, buf_len.value)

2562

1904

# Convert the bytestring to hexadecimal notation

2564

1906

return hex_fpr

2565

1907

2566

1908

2567

class MultiprocessingMixIn:

1909

class MultiprocessingMixIn(object):

2568

1910

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2569

1911

2570

1912

def sub_process_main(self, request, address):

2571

1913

try:

2572

1914

self.finish_request(request, address)

2573

1915

except Exception:

2574

1916

self.handle_error(request, address)

2575

1917

self.close_request(request)

2576

1918

2577

1919

def process_request(self, request, address):

2578

1920

"""Start a new process to process the request."""

2579

proc = multiprocessing.Process(target=self.sub_process_main,

2580

args=(request, address))

1921

proc = multiprocessing.Process(target = self.sub_process_main,

1922

args = (request, address))

2581

1923

proc.start()

2582

1924

return proc

2583

1925

2584

1926

2585

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1927

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2586

1928

""" adds a pipe to the MixIn """

2587

1929

2588

1930

def process_request(self, request, client_address):

2589

1931

"""Overrides and wraps the original process_request().

2590

1932

2591

1933

This function creates a new pipe in self.pipe

2592

1934

"""

2593

1935

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2594

1936

2595

1937

proc = MultiprocessingMixIn.process_request(self, request,

2596

1938

client_address)

2597

1939

self.child_pipe.close()

2598

1940

self.add_pipe(parent_pipe, proc)

2599

1941

2600

1942

def add_pipe(self, parent_pipe, proc):

2601

1943

"""Dummy function; override as necessary"""

2602

1944

raise NotImplementedError()

2603

1945

2604

1946

2605

1947

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2606

socketserver.TCPServer):

2607

"""IPv6-capable TCP server. Accepts None as address and/or port

2608

1948

socketserver.TCPServer, object):

1949

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1950

2609

1951

Attributes:

2610

1952

enabled: Boolean; whether this server is activated yet

2611

1953

interface: None or a network interface name (string)

2612

1954

use_ipv6: Boolean; to use IPv6 or not

2613

1955

"""

2614

1956

2615

1957

def __init__(self, server_address, RequestHandlerClass,

2616

1958

interface=None,

2617

1959

use_ipv6=True,

2627

1969

self.socketfd = socketfd

2628

1970

# Save the original socket.socket() function

2629

1971

self.socket_socket = socket.socket

2630

2631

1972

# To implement --socket, we monkey patch socket.socket.

2632

#

1973

#

2633

1974

# (When socketserver.TCPServer is a new-style class, we

2634

1975

# could make self.socket into a property instead of monkey

2635

1976

# patching socket.socket.)

2636

#

1977

#

2637

1978

# Create a one-time-only replacement for socket.socket()

2638

1979

@functools.wraps(socket.socket)

2639

1980

def socket_wrapper(*args, **kwargs):

2651

1992

# socket_wrapper(), if socketfd was set.

2652

1993

socketserver.TCPServer.__init__(self, server_address,

2653

1994

RequestHandlerClass)

2654

1995

2655

1996

def server_bind(self):

2656

1997

"""This overrides the normal server_bind() function

2657

1998

to bind to an interface if one was specified, and also NOT to

2658

1999

bind to an address or port if they were not specified."""

2659

global SO_BINDTODEVICE

2660

2000

if self.interface is not None:

2661

2001

if SO_BINDTODEVICE is None:

2662

# Fall back to a hard-coded value which seems to be

2663

# common enough.

2664

log.warning("SO_BINDTODEVICE not found, trying 25")

2665

SO_BINDTODEVICE = 25

2666

try:

2667

self.socket.setsockopt(

2668

socket.SOL_SOCKET, SO_BINDTODEVICE,

2669

(self.interface + "\0").encode("utf-8"))

2670

except socket.error as error:

2671

if error.errno == errno.EPERM:

2672

log.error("No permission to bind to interface %s",

2673

self.interface)

2674

elif error.errno == errno.ENOPROTOOPT:

2675

log.error("SO_BINDTODEVICE not available; cannot"

2676

" bind to interface %s", self.interface)

2677

elif error.errno == errno.ENODEV:

2678

log.error("Interface %s does not exist, cannot"

2679

" bind", self.interface)

2680

else:

2681

raise

2002

logger.error("SO_BINDTODEVICE does not exist;"

2003

" cannot bind to interface %s",

2004

self.interface)

2005

else:

2006

try:

2007

self.socket.setsockopt(

2008

socket.SOL_SOCKET, SO_BINDTODEVICE,

2009

(self.interface + "\0").encode("utf-8"))

2010

except socket.error as error:

2011

if error.errno == errno.EPERM:

2012

logger.error("No permission to bind to"

2013

" interface %s", self.interface)

2014

elif error.errno == errno.ENOPROTOOPT:

2015

logger.error("SO_BINDTODEVICE not available;"

2016

" cannot bind to interface %s",

2017

self.interface)

2018

elif error.errno == errno.ENODEV:

2019

logger.error("Interface %s does not exist,"

2020

" cannot bind", self.interface)

2021

else:

2022

raise

2682

2023

# Only bind(2) the socket if we really need to.

2683

2024

if self.server_address[0] or self.server_address[1]:

2684

if self.server_address[1]:

2685

self.allow_reuse_address = True

2686

2025

if not self.server_address[0]:

2687

2026

if self.address_family == socket.AF_INET6:

2688

any_address = "::" # in6addr_any

2027

any_address = "::" # in6addr_any

2689

2028

else:

2690

any_address = "0.0.0.0" # INADDR_ANY

2029

any_address = "0.0.0.0" # INADDR_ANY

2691

2030

self.server_address = (any_address,

2692

2031

self.server_address[1])

2693

2032

elif not self.server_address[1]:

2703

2042

2704

2043

class MandosServer(IPv6_TCPServer):

2705

2044

"""Mandos server.

2706

2045

2707

2046

Attributes:

2708

2047

clients: set of Client objects

2709

2048

gnutls_priority GnuTLS priority string

2710

2049

use_dbus: Boolean; to emit D-Bus signals or not

2711

2712

Assumes a GLib.MainLoop event loop.

2050

2051

Assumes a gobject.MainLoop event loop.

2713

2052

"""

2714

2053

2715

2054

def __init__(self, server_address, RequestHandlerClass,

2716

2055

interface=None,

2717

2056

use_ipv6=True,

2727

2066

self.gnutls_priority = gnutls_priority

2728

2067

IPv6_TCPServer.__init__(self, server_address,

2729

2068

RequestHandlerClass,

2730

interface=interface,

2731

use_ipv6=use_ipv6,

2732

socketfd=socketfd)

2733

2069

interface = interface,

2070

use_ipv6 = use_ipv6,

2071

socketfd = socketfd)

2072

2734

2073

def server_activate(self):

2735

2074

if self.enabled:

2736

2075

return socketserver.TCPServer.server_activate(self)

2737

2076

2738

2077

def enable(self):

2739

2078

self.enabled = True

2740

2079

2741

2080

def add_pipe(self, parent_pipe, proc):

2742

2081

# Call "handle_ipc" for both data and EOF events

2743

GLib.io_add_watch(

2744

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2745

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2082

gobject.io_add_watch(

2083

parent_pipe.fileno(),

2084

gobject.IO_IN | gobject.IO_HUP,

2746

2085

functools.partial(self.handle_ipc,

2747

parent_pipe=parent_pipe,

2748

proc=proc))

2749

2086

parent_pipe = parent_pipe,

2087

proc = proc))

2088

2750

2089

def handle_ipc(self, source, condition,

2751

2090

parent_pipe=None,

2752

proc=None,

2091

proc = None,

2753

2092

client_object=None):

2754

2093

# error, or the other end of multiprocessing.Pipe has closed

2755

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2094

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2756

2095

# Wait for other process to exit

2757

2096

proc.join()

2758

2097

return False

2759

2098

2760

2099

# Read a request from the child

2761

2100

request = parent_pipe.recv()

2762

2101

command = request[0]

2763

2764

if command == "init":

2765

key_id = request[1].decode("ascii")

2766

fpr = request[2].decode("ascii")

2767

address = request[3]

2768

2769

for c in self.clients.values():

2770

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2771

"27AE41E4649B934CA495991B7852B855"):

2772

continue

2773

if key_id and c.key_id == key_id:

2774

client = c

2775

break

2776

if fpr and c.fingerprint == fpr:

2102

2103

if command == 'init':

2104

fpr = request[1]

2105

address = request[2]

2106

2107

for c in self.clients.itervalues():

2108

if c.fingerprint == fpr:

2777

2109

client = c

2778

2110

break

2779

2111

else:

2780

log.info("Client not found for key ID: %s, address:"

2781

" %s", key_id or fpr, address)

2112

logger.info("Client not found for fingerprint: %s, ad"

2113

"dress: %s", fpr, address)

2782

2114

if self.use_dbus:

2783

2115

# Emit D-Bus signal

2784

mandos_dbus_service.ClientNotFound(key_id or fpr,

2116

mandos_dbus_service.ClientNotFound(fpr,

2785

2117

address[0])

2786

2118

parent_pipe.send(False)

2787

2119

return False

2788

2789

GLib.io_add_watch(

2790

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2791

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2120

2121

gobject.io_add_watch(

2122

parent_pipe.fileno(),

2123

gobject.IO_IN | gobject.IO_HUP,

2792

2124

functools.partial(self.handle_ipc,

2793

parent_pipe=parent_pipe,

2794

proc=proc,

2795

client_object=client))

2125

parent_pipe = parent_pipe,

2126

proc = proc,

2127

client_object = client))

2796

2128

parent_pipe.send(True)

2797

2129

# remove the old hook in favor of the new above hook on

2798

2130

# same fileno

2799

2131

return False

2800

if command == "funcall":

2132

if command == 'funcall':

2801

2133

funcname = request[1]

2802

2134

args = request[2]

2803

2135

kwargs = request[3]

2804

2805

parent_pipe.send(("data", getattr(client_object,

2136

2137

parent_pipe.send(('data', getattr(client_object,

2806

2138

funcname)(*args,

2807

2139

**kwargs)))

2808

2809

if command == "getattr":

2140

2141

if command == 'getattr':

2810

2142

attrname = request[1]

2811

if isinstance(client_object.__getattribute__(attrname),

2812

collections.abc.Callable):

2813

parent_pipe.send(("function", ))

2143

if callable(client_object.__getattribute__(attrname)):

2144

parent_pipe.send(('function', ))

2814

2145

else:

2815

2146

parent_pipe.send((

2816

"data", client_object.__getattribute__(attrname)))

2817

2818

if command == "setattr":

2147

'data', client_object.__getattribute__(attrname)))

2148

2149

if command == 'setattr':

2819

2150

attrname = request[1]

2820

2151

value = request[2]

2821

2152

setattr(client_object, attrname, value)

2822

2153

2823

2154

return True

2824

2155

2825

2156

2826

2157

def rfc3339_duration_to_delta(duration):

2827

2158

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2828

2829

>>> timedelta = datetime.timedelta

2830

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2831

True

2832

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2833

True

2834

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2835

True

2836

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2837

True

2838

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2839

True

2840

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2841

True

2842

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2843

True

2844

>>> del timedelta

2159

2160

>>> rfc3339_duration_to_delta("P7D")

2161

datetime.timedelta(7)

2162

>>> rfc3339_duration_to_delta("PT60S")

2163

datetime.timedelta(0, 60)

2164

>>> rfc3339_duration_to_delta("PT60M")

2165

datetime.timedelta(0, 3600)

2166

>>> rfc3339_duration_to_delta("PT24H")

2167

datetime.timedelta(1)

2168

>>> rfc3339_duration_to_delta("P1W")

2169

datetime.timedelta(7)

2170

>>> rfc3339_duration_to_delta("PT5M30S")

2171

datetime.timedelta(0, 330)

2172

>>> rfc3339_duration_to_delta("P1DT3M20S")

2173

datetime.timedelta(1, 200)

2845

2174

"""

2846

2175

2847

2176

# Parsing an RFC 3339 duration with regular expressions is not

2848

2177

# possible - there would have to be multiple places for the same

2849

2178

# values, like seconds. The current code, while more esoteric, is

2850

2179

# cleaner without depending on a parsing library. If Python had a

2851

2180

# built-in library for parsing we would use it, but we'd like to

2852

2181

# avoid excessive use of external libraries.

2853

2182

2854

2183

# New type for defining tokens, syntax, and semantics all-in-one

2184

Token = collections.namedtuple("Token",

2185

("regexp", # To match token; if

2186

# "value" is not None,

2187

# must have a "group"

2188

# containing digits

2189

"value", # datetime.timedelta or

2190

# None

2191

"followers")) # Tokens valid after

2192

# this token

2855

2193

Token = collections.namedtuple("Token", (

2856

2194

"regexp", # To match token; if "value" is not None, must have

2857

2195

# a "group" containing digits

2889

2227

frozenset((token_year, token_month,

2890

2228

token_day, token_time,

2891

2229

token_week)))

2892

# Define starting values:

2893

# Value so far

2894

value = datetime.timedelta()

2230

# Define starting values

2231

value = datetime.timedelta() # Value so far

2895

2232

found_token = None

2896

# Following valid tokens

2897

followers = frozenset((token_duration, ))

2898

# String left to parse

2899

s = duration

2233

followers = frozenset((token_duration,)) # Following valid tokens

2234

s = duration # String left to parse

2900

2235

# Loop until end token is found

2901

2236

while found_token is not token_end:

2902

2237

# Search for any currently valid tokens

2918

2253

break

2919

2254

else:

2920

2255

# No currently valid tokens were found

2921

raise ValueError("Invalid RFC 3339 duration: {!r}"

2922

.format(duration))

2256

raise ValueError("Invalid RFC 3339 duration")

2923

2257

# End token found

2924

2258

return value

2925

2259

2926

2260

2927

2261

def string_to_delta(interval):

2928

2262

"""Parse a string and return a datetime.timedelta

2929

2930

>>> string_to_delta("7d") == datetime.timedelta(7)

2931

True

2932

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2933

True

2934

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2935

True

2936

>>> string_to_delta("24h") == datetime.timedelta(1)

2937

True

2938

>>> string_to_delta("1w") == datetime.timedelta(7)

2939

True

2940

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2941

True

2263

2264

>>> string_to_delta('7d')

2265

datetime.timedelta(7)

2266

>>> string_to_delta('60s')

2267

datetime.timedelta(0, 60)

2268

>>> string_to_delta('60m')

2269

datetime.timedelta(0, 3600)

2270

>>> string_to_delta('24h')

2271

datetime.timedelta(1)

2272

>>> string_to_delta('1w')

2273

datetime.timedelta(7)

2274

>>> string_to_delta('5m 30s')

2275

datetime.timedelta(0, 330)

2942

2276

"""

2943

2277

2944

2278

try:

2945

2279

return rfc3339_duration_to_delta(interval)

2946

2280

except ValueError:

2947

2281

pass

2948

2282

2949

2283

timevalue = datetime.timedelta(0)

2950

2284

for s in interval.split():

2951

2285

try:

2969

2303

return timevalue

2970

2304

2971

2305

2972

def daemon(nochdir=False, noclose=False):

2306

def daemon(nochdir = False, noclose = False):

2973

2307

"""See daemon(3). Standard BSD Unix function.

2974

2308

2975

2309

This should really exist as os.daemon, but it doesn't (yet)."""

2976

2310

if os.fork():

2977

2311

sys.exit()

2995

2329

2996

2330

2997

2331

def main():

2998

2332

2999

2333

##################################################################

3000

2334

# Parsing of options, both command line and config file

3001

2335

3002

2336

parser = argparse.ArgumentParser()

3003

2337

parser.add_argument("-v", "--version", action="version",

3004

version="%(prog)s {}".format(version),

2338

version = "%(prog)s {}".format(version),

3005

2339

help="show version number and exit")

3006

2340

parser.add_argument("-i", "--interface", metavar="IF",

3007

2341

help="Bind to interface IF")

3043

2377

parser.add_argument("--no-zeroconf", action="store_false",

3044

2378

dest="zeroconf", help="Do not use Zeroconf",

3045

2379

default=None)

3046

2380

3047

2381

options = parser.parse_args()

3048

2382

2383

if options.check:

2384

import doctest

2385

fail_count, test_count = doctest.testmod()

2386

sys.exit(os.EX_OK if fail_count == 0 else 1)

2387

3049

2388

# Default values for config file for server-global settings

3050

if gnutls.has_rawpk:

3051

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3052

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3053

else:

3054

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3055

":+SIGN-DSA-SHA256")

3056

server_defaults = {"interface": "",

3057

"address": "",

3058

"port": "",

3059

"debug": "False",

3060

"priority": priority,

3061

"servicename": "Mandos",

3062

"use_dbus": "True",

3063

"use_ipv6": "True",

3064

"debuglevel": "",

3065

"restore": "True",

3066

"socket": "",

3067

"statedir": "/var/lib/mandos",

3068

"foreground": "False",

3069

"zeroconf": "True",

3070

}

3071

del priority

3072

2389

server_defaults = { "interface": "",

2390

"address": "",

2391

"port": "",

2392

"debug": "False",

2393

"priority":

2394

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2395

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2396

"servicename": "Mandos",

2397

"use_dbus": "True",

2398

"use_ipv6": "True",

2399

"debuglevel": "",

2400

"restore": "True",

2401

"socket": "",

2402

"statedir": "/var/lib/mandos",

2403

"foreground": "False",

2404

"zeroconf": "True",

2405

}

2406

3073

2407

# Parse config file for server-global settings

3074

server_config = configparser.ConfigParser(server_defaults)

2408

server_config = configparser.SafeConfigParser(server_defaults)

3075

2409

del server_defaults

3076

2410

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3077

# Convert the ConfigParser object to a dict

2411

# Convert the SafeConfigParser object to a dict

3078

2412

server_settings = server_config.defaults()

3079

2413

# Use the appropriate methods on the non-string config options

3080

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3081

"foreground", "zeroconf"):

2414

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3082

2415

server_settings[option] = server_config.getboolean("DEFAULT",

3083

2416

option)

3084

2417

if server_settings["port"]:

3094

2427

server_settings["socket"] = os.dup(server_settings

3095

2428

["socket"])

3096

2429

del server_config

3097

2430

3098

2431

# Override the settings from the config file with command line

3099

2432

# options, if set.

3100

2433

for option in ("interface", "address", "port", "debug",

3118

2451

if server_settings["debug"]:

3119

2452

server_settings["foreground"] = True

3120

2453

# Now we have our good server settings in "server_settings"

3121

2454

3122

2455

##################################################################

3123

2456

3124

2457

if (not server_settings["zeroconf"]

3125

2458

and not (server_settings["port"]

3126

2459

or server_settings["socket"] != "")):

3127

2460

parser.error("Needs port or socket to work without Zeroconf")

3128

2461

3129

2462

# For convenience

3130

2463

debug = server_settings["debug"]

3131

2464

debuglevel = server_settings["debuglevel"]

3135

2468

stored_state_file)

3136

2469

foreground = server_settings["foreground"]

3137

2470

zeroconf = server_settings["zeroconf"]

3138

2471

3139

2472

if debug:

3140

2473

initlogger(debug, logging.DEBUG)

3141

2474

else:

3144

2477

else:

3145

2478

level = getattr(logging, debuglevel.upper())

3146

2479

initlogger(debug, level)

3147

2480

3148

2481

if server_settings["servicename"] != "Mandos":

3149

2482

syslogger.setFormatter(

3150

logging.Formatter("Mandos ({}) [%(process)d]:"

3151

" %(levelname)s: %(message)s".format(

2483

logging.Formatter('Mandos ({}) [%(process)d]:'

2484

' %(levelname)s: %(message)s'.format(

3152

2485

server_settings["servicename"])))

3153

2486

3154

2487

# Parse config file with clients

3155

client_config = configparser.ConfigParser(Client.client_defaults)

2488

client_config = configparser.SafeConfigParser(Client

2489

.client_defaults)

3156

2490

client_config.read(os.path.join(server_settings["configdir"],

3157

2491

"clients.conf"))

3158

2492

3159

2493

global mandos_dbus_service

3160

2494

mandos_dbus_service = None

3161

2495

3162

2496

socketfd = None

3163

2497

if server_settings["socket"] != "":

3164

2498

socketfd = server_settings["socket"]

3176

2510

pidfilename = "/var/run/mandos.pid"

3177

2511

pidfile = None

3178

2512

try:

3179

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2513

pidfile = open(pidfilename, "w")

3180

2514

except IOError as e:

3181

log.error("Could not open file %r", pidfilename,

3182

exc_info=e)

3183

3184

for name, group in (("_mandos", "_mandos"),

3185

("mandos", "mandos"),

3186

("nobody", "nogroup")):

2515

logger.error("Could not open file %r", pidfilename,

2516

exc_info=e)

2517

2518

for name in ("_mandos", "mandos", "nobody"):

3187

2519

try:

3188

2520

uid = pwd.getpwnam(name).pw_uid

3189

gid = pwd.getpwnam(group).pw_gid

2521

gid = pwd.getpwnam(name).pw_gid

3190

2522

break

3191

2523

except KeyError:

3192

2524

continue

3196

2528

try:

3197

2529

os.setgid(gid)

3198

2530

os.setuid(uid)

3199

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3200

2531

except OSError as error:

3201

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3202

os.strerror(error.errno))

3203

2532

if error.errno != errno.EPERM:

3204

2533

raise

3205

2534

3206

2535

if debug:

3207

2536

# Enable all possible GnuTLS debugging

3208

2537

3209

2538

# "Use a log level over 10 to enable all debugging options."

3210

2539

# - GnuTLS manual

3211

gnutls.global_set_log_level(11)

3212

3213

@gnutls.log_func

2540

gnutls.library.functions.gnutls_global_set_log_level(11)

2541

2542

@gnutls.library.types.gnutls_log_func

3214

2543

def debug_gnutls(level, string):

3215

log.debug("GnuTLS: %s",

3216

string[:-1].decode("utf-8", errors="replace"))

3217

3218

gnutls.global_set_log_function(debug_gnutls)

3219

2544

logger.debug("GnuTLS: %s", string[:-1])

2545

2546

gnutls.library.functions.gnutls_global_set_log_function(

2547

debug_gnutls)

2548

3220

2549

# Redirect stdin so all checkers get /dev/null

3221

2550

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3222

2551

os.dup2(null, sys.stdin.fileno())

3223

2552

if null > 2:

3224

2553

os.close(null)

3225

2554

3226

2555

# Need to fork before connecting to D-Bus

3227

2556

if not foreground:

3228

2557

# Close all input and output, do double fork, etc.

3229

2558

daemon()

3230

3231

if gi.version_info < (3, 10, 2):

3232

# multiprocessing will use threads, so before we use GLib we

3233

# need to inform GLib that threads will be used.

3234

GLib.threads_init()

3235

2559

2560

# multiprocessing will use threads, so before we use gobject we

2561

# need to inform gobject that threads will be used.

2562

gobject.threads_init()

2563

3236

2564

global main_loop

3237

2565

# From the Avahi example code

3238

2566

DBusGMainLoop(set_as_default=True)

3239

main_loop = GLib.MainLoop()

2567

main_loop = gobject.MainLoop()

3240

2568

bus = dbus.SystemBus()

3241

2569

# End of Avahi example code

3242

2570

if use_dbus:

3247

2575

old_bus_name = dbus.service.BusName(

3248

2576

"se.bsnet.fukt.Mandos", bus,

3249

2577

do_not_queue=True)

3250

except dbus.exceptions.DBusException as e:

3251

log.error("Disabling D-Bus:", exc_info=e)

2578

except dbus.exceptions.NameExistsException as e:

2579

logger.error("Disabling D-Bus:", exc_info=e)

3252

2580

use_dbus = False

3253

2581

server_settings["use_dbus"] = False

3254

2582

tcp_server.use_dbus = False

3255

2583

if zeroconf:

3256

2584

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3257

2585

service = AvahiServiceToSyslog(

3258

name=server_settings["servicename"],

3259

servicetype="_mandos._tcp",

3260

protocol=protocol,

3261

bus=bus)

2586

name = server_settings["servicename"],

2587

servicetype = "_mandos._tcp",

2588

protocol = protocol,

2589

bus = bus)

3262

2590

if server_settings["interface"]:

3263

2591

service.interface = if_nametoindex(

3264

2592

server_settings["interface"].encode("utf-8"))

3265

2593

3266

2594

global multiprocessing_manager

3267

2595

multiprocessing_manager = multiprocessing.Manager()

3268

2596

3269

2597

client_class = Client

3270

2598

if use_dbus:

3271

client_class = functools.partial(ClientDBus, bus=bus)

3272

2599

client_class = functools.partial(ClientDBus, bus = bus)

2600

3273

2601

client_settings = Client.config_parser(client_config)

3274

2602

old_client_settings = {}

3275

2603

clients_data = {}

3276

2604

3277

2605

# This is used to redirect stdout and stderr for checker processes

3278

2606

global wnull

3279

wnull = open(os.devnull, "w") # A writable /dev/null

2607

wnull = open(os.devnull, "w") # A writable /dev/null

3280

2608

# Only used if server is running in foreground but not in debug

3281

2609

# mode

3282

2610

if debug or not foreground:

3283

2611

wnull.close()

3284

2612

3285

2613

# Get client data and settings from last running state.

3286

2614

if server_settings["restore"]:

3287

2615

try:

3288

2616

with open(stored_state_path, "rb") as stored_state:

3289

if sys.version_info.major == 2:

3290

clients_data, old_client_settings = pickle.load(

3291

stored_state)

3292

else:

3293

bytes_clients_data, bytes_old_client_settings = (

3294

pickle.load(stored_state, encoding="bytes"))

3295

# Fix bytes to strings

3296

# clients_data

3297

# .keys()

3298

clients_data = {(key.decode("utf-8")

3299

if isinstance(key, bytes)

3300

else key): value

3301

for key, value in

3302

bytes_clients_data.items()}

3303

del bytes_clients_data

3304

for key in clients_data:

3305

value = {(k.decode("utf-8")

3306

if isinstance(k, bytes) else k): v

3307

for k, v in

3308

clients_data[key].items()}

3309

clients_data[key] = value

3310

# .client_structure

3311

value["client_structure"] = [

3312

(s.decode("utf-8")

3313

if isinstance(s, bytes)

3314

else s) for s in

3315

value["client_structure"]]

3316

# .name, .host, and .checker_command

3317

for k in ("name", "host", "checker_command"):

3318

if isinstance(value[k], bytes):

3319

value[k] = value[k].decode("utf-8")

3320

if "key_id" not in value:

3321

value["key_id"] = ""

3322

elif "fingerprint" not in value:

3323

value["fingerprint"] = ""

3324

# old_client_settings

3325

# .keys()

3326

old_client_settings = {

3327

(key.decode("utf-8")

3328

if isinstance(key, bytes)

3329

else key): value

3330

for key, value in

3331

bytes_old_client_settings.items()}

3332

del bytes_old_client_settings

3333

# .host and .checker_command

3334

for value in old_client_settings.values():

3335

for attribute in ("host", "checker_command"):

3336

if isinstance(value[attribute], bytes):

3337

value[attribute] = (value[attribute]

3338

.decode("utf-8"))

2617

clients_data, old_client_settings = pickle.load(

2618

stored_state)

3339

2619

os.remove(stored_state_path)

3340

2620

except IOError as e:

3341

2621

if e.errno == errno.ENOENT:

3342

log.warning("Could not load persistent state:"

3343

" %s", os.strerror(e.errno))

2622

logger.warning("Could not load persistent state:"

2623

" {}".format(os.strerror(e.errno)))

3344

2624

else:

3345

log.critical("Could not load persistent state:",

3346

exc_info=e)

2625

logger.critical("Could not load persistent state:",

2626

exc_info=e)

3347

2627

raise

3348

2628

except EOFError as e:

3349

log.warning("Could not load persistent state: EOFError:",

3350

exc_info=e)

3351

2629

logger.warning("Could not load persistent state: "

2630

"EOFError:",

2631

exc_info=e)

2632

3352

2633

with PGPEngine() as pgp:

3353

2634

for client_name, client in clients_data.items():

3354

2635

# Skip removed clients

3355

2636

if client_name not in client_settings:

3356

2637

continue

3357

2638

3358

2639

# Decide which value to use after restoring saved state.

3359

2640

# We have three different values: Old config file,

3360

2641

# new config file, and saved state.

3371

2652

client[name] = value

3372

2653

except KeyError:

3373

2654

pass

3374

2655

3375

2656

# Clients who has passed its expire date can still be

3376

# enabled if its last checker was successful. A Client

2657

# enabled if its last checker was successful. Clients

3377

2658

# whose checker succeeded before we stored its state is

3378

2659

# assumed to have successfully run all checkers during

3379

2660

# downtime.

3380

2661

if client["enabled"]:

3381

2662

if datetime.datetime.utcnow() >= client["expires"]:

3382

2663

if not client["last_checked_ok"]:

3383

log.warning("disabling client %s - Client"

3384

" never performed a successful"

3385

" checker", client_name)

2664

logger.warning(

2665

"disabling client {} - Client never "

2666

"performed a successful checker".format(

2667

client_name))

3386

2668

client["enabled"] = False

3387

2669

elif client["last_checker_status"] != 0:

3388

log.warning("disabling client %s - Client"

3389

" last checker failed with error"

3390

" code %s", client_name,

3391

client["last_checker_status"])

2670

logger.warning(

2671

"disabling client {} - Client last"

2672

" checker failed with error code"

2673

" {}".format(

2674

client_name,

2675

client["last_checker_status"]))

3392

2676

client["enabled"] = False

3393

2677

else:

3394

2678

client["expires"] = (

3395

2679

datetime.datetime.utcnow()

3396

2680

+ client["timeout"])

3397

log.debug("Last checker succeeded, keeping %s"

3398

" enabled", client_name)

2681

logger.debug("Last checker succeeded,"

2682

" keeping {} enabled".format(

2683

client_name))

3399

2684

try:

3400

2685

client["secret"] = pgp.decrypt(

3401

2686

client["encrypted_secret"],

3402

2687

client_settings[client_name]["secret"])

3403

2688

except PGPError:

3404

2689

# If decryption fails, we use secret from new settings

3405

log.debug("Failed to decrypt %s old secret",

3406

client_name)

2690

logger.debug("Failed to decrypt {} old secret".format(

2691

client_name))

3407

2692

client["secret"] = (client_settings[client_name]

3408

2693

["secret"])

3409

2694

3410

2695

# Add/remove clients based on new changes made to config

3411

2696

for client_name in (set(old_client_settings)

3412

2697

- set(client_settings)):

3414

2699

for client_name in (set(client_settings)

3415

2700

- set(old_client_settings)):

3416

2701

clients_data[client_name] = client_settings[client_name]

3417

2702

3418

2703

# Create all client objects

3419

2704

for client_name, client in clients_data.items():

3420

2705

tcp_server.clients[client_name] = client_class(

3421

name=client_name,

3422

settings=client,

3423

server_settings=server_settings)

3424

2706

name = client_name,

2707

settings = client,

2708

server_settings = server_settings)

2709

3425

2710

if not tcp_server.clients:

3426

log.warning("No clients defined")

3427

2711

logger.warning("No clients defined")

2712

3428

2713

if not foreground:

3429

2714

if pidfile is not None:

3430

pid = os.getpid()

3431

2715

try:

3432

2716

with pidfile:

3433

print(pid, file=pidfile)

2717

pid = os.getpid()

2718

pidfile.write("{}\n".format(pid).encode("utf-8"))

3434

2719

except IOError:

3435

log.error("Could not write to file %r with PID %d",

3436

pidfilename, pid)

2720

logger.error("Could not write to file %r with PID %d",

2721

pidfilename, pid)

3437

2722

del pidfile

3438

2723

del pidfilename

3439

3440

for termsig in (signal.SIGHUP, signal.SIGTERM):

3441

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3442

lambda: main_loop.quit() and False)

3443

2724

2725

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2726

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2727

3444

2728

if use_dbus:

3445

2729

3446

2730

@alternate_dbus_interfaces(

3447

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3448

class MandosDBusService(DBusObjectWithObjectManager):

2731

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2732

class MandosDBusService(DBusObjectWithProperties):

3449

2733

"""A D-Bus proxy object"""

3450

2734

3451

2735

def __init__(self):

3452

2736

dbus.service.Object.__init__(self, bus, "/")

3453

2737

3454

2738

_interface = "se.recompile.Mandos"

3455

2739

2740

@dbus_interface_annotations(_interface)

2741

def _foo(self):

2742

return {

2743

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2744

"false" }

2745

3456

2746

@dbus.service.signal(_interface, signature="o")

3457

2747

def ClientAdded(self, objpath):

3458

2748

"D-Bus signal"

3459

2749

pass

3460

2750

3461

2751

@dbus.service.signal(_interface, signature="ss")

3462

def ClientNotFound(self, key_id, address):

2752

def ClientNotFound(self, fingerprint, address):

3463

2753

"D-Bus signal"

3464

2754

pass

3465

3466

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3467

"true"})

2755

3468

2756

@dbus.service.signal(_interface, signature="os")

3469

2757

def ClientRemoved(self, objpath, name):

3470

2758

"D-Bus signal"

3471

2759

pass

3472

3473

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3474

"true"})

2760

3475

2761

@dbus.service.method(_interface, out_signature="ao")

3476

2762

def GetAllClients(self):

3477

2763

"D-Bus method"

3478

2764

return dbus.Array(c.dbus_object_path for c in

3479

tcp_server.clients.values())

3480

3481

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3482

"true"})

2765

tcp_server.clients.itervalues())

2766

3483

2767

@dbus.service.method(_interface,

3484

2768

out_signature="a{oa{sv}}")

3485

2769

def GetAllClientsWithProperties(self):

3486

2770

"D-Bus method"

3487

2771

return dbus.Dictionary(

3488

{c.dbus_object_path: c.GetAll(

3489

"se.recompile.Mandos.Client")

3490

for c in tcp_server.clients.values()},

2772

{ c.dbus_object_path: c.GetAll("")

2773

for c in tcp_server.clients.itervalues() },

3491

2774

signature="oa{sv}")

3492

2775

3493

2776

@dbus.service.method(_interface, in_signature="o")

3494

2777

def RemoveClient(self, object_path):

3495

2778

"D-Bus method"

3496

for c in tcp_server.clients.values():

2779

for c in tcp_server.clients.itervalues():

3497

2780

if c.dbus_object_path == object_path:

3498

2781

del tcp_server.clients[c.name]

3499

2782

c.remove_from_connection()

3500

# Don't signal the disabling

2783

# Don't signal anything except ClientRemoved

3501

2784

c.disable(quiet=True)

3502

# Emit D-Bus signal for removal

3503

self.client_removed_signal(c)

2785

# Emit D-Bus signal

2786

self.ClientRemoved(object_path, c.name)

3504

2787

return

3505

2788

raise KeyError(object_path)

3506

2789

3507

2790

del _interface

3508

3509

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3510

out_signature="a{oa{sa{sv}}}")

3511

def GetManagedObjects(self):

3512

"""D-Bus method"""

3513

return dbus.Dictionary(

3514

{client.dbus_object_path:

3515

dbus.Dictionary(

3516

{interface: client.GetAll(interface)

3517

for interface in

3518

client._get_all_interface_names()})

3519

for client in tcp_server.clients.values()})

3520

3521

def client_added_signal(self, client):

3522

"""Send the new standard signal and the old signal"""

3523

if use_dbus:

3524

# New standard signal

3525

self.InterfacesAdded(

3526

client.dbus_object_path,

3527

dbus.Dictionary(

3528

{interface: client.GetAll(interface)

3529

for interface in

3530

client._get_all_interface_names()}))

3531

# Old signal

3532

self.ClientAdded(client.dbus_object_path)

3533

3534

def client_removed_signal(self, client):

3535

"""Send the new standard signal and the old signal"""

3536

if use_dbus:

3537

# New standard signal

3538

self.InterfacesRemoved(

3539

client.dbus_object_path,

3540

client._get_all_interface_names())

3541

# Old signal

3542

self.ClientRemoved(client.dbus_object_path,

3543

client.name)

3544

2791

3545

2792

mandos_dbus_service = MandosDBusService()

3546

3547

# Save modules to variables to exempt the modules from being

3548

# unloaded before the function registered with atexit() is run.

3549

mp = multiprocessing

3550

wn = wnull

3551

2793

3552

2794

def cleanup():

3553

2795

"Cleanup function; run on exit"

3554

2796

if zeroconf:

3555

2797

service.cleanup()

3556

3557

mp.active_children()

3558

wn.close()

2798

2799

multiprocessing.active_children()

2800

wnull.close()

3559

2801

if not (tcp_server.clients or client_settings):

3560

2802

return

3561

2803

3562

2804

# Store client before exiting. Secrets are encrypted with key

3563

2805

# based on what config file has. If config file is

3564

2806

# removed/edited, old secret will thus be unrecovable.

3565

2807

clients = {}

3566

2808

with PGPEngine() as pgp:

3567

for client in tcp_server.clients.values():

2809

for client in tcp_server.clients.itervalues():

3568

2810

key = client_settings[client.name]["secret"]

3569

2811

client.encrypted_secret = pgp.encrypt(client.secret,

3570

2812

key)

3571

2813

client_dict = {}

3572

2814

3573

2815

# A list of attributes that can not be pickled

3574

2816

# + secret.

3575

exclude = {"bus", "changedstate", "secret",

3576

"checker", "server_settings"}

2817

exclude = { "bus", "changedstate", "secret",

2818

"checker", "server_settings" }

3577

2819

for name, typ in inspect.getmembers(dbus.service

3578

2820

.Object):

3579

2821

exclude.add(name)

3580

2822

3581

2823

client_dict["encrypted_secret"] = (client

3582

2824

.encrypted_secret)

3583

2825

for attr in client.client_structure:

3584

2826

if attr not in exclude:

3585

2827

client_dict[attr] = getattr(client, attr)

3586

2828

3587

2829

clients[client.name] = client_dict

3588

2830

del client_settings[client.name]["secret"]

3589

2831

3590

2832

try:

3591

2833

with tempfile.NamedTemporaryFile(

3592

mode="wb",

2834

mode='wb',

3593

2835

suffix=".pickle",

3594

prefix="clients-",

2836

prefix='clients-',

3595

2837

dir=os.path.dirname(stored_state_path),

3596

2838

delete=False) as stored_state:

3597

pickle.dump((clients, client_settings), stored_state,

3598

protocol=2)

2839

pickle.dump((clients, client_settings), stored_state)

3599

2840

tempname = stored_state.name

3600

2841

os.rename(tempname, stored_state_path)

3601

2842

except (IOError, OSError) as e:

3605

2846

except NameError:

3606

2847

pass

3607

2848

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3608

log.warning("Could not save persistent state: %s",

3609

os.strerror(e.errno))

2849

logger.warning("Could not save persistent state: {}"

2850

.format(os.strerror(e.errno)))

3610

2851

else:

3611

log.warning("Could not save persistent state:",

3612

exc_info=e)

2852

logger.warning("Could not save persistent state:",

2853

exc_info=e)

3613

2854

raise

3614

2855

3615

2856

# Delete all clients, and settings from config

3616

2857

while tcp_server.clients:

3617

2858

name, client = tcp_server.clients.popitem()

3618

2859

if use_dbus:

3619

2860

client.remove_from_connection()

3620

# Don't signal the disabling

2861

# Don't signal anything except ClientRemoved

3621

2862

client.disable(quiet=True)

3622

# Emit D-Bus signal for removal

3623

2863

if use_dbus:

3624

mandos_dbus_service.client_removed_signal(client)

2864

# Emit D-Bus signal

2865

mandos_dbus_service.ClientRemoved(

2866

client.dbus_object_path, client.name)

3625

2867

client_settings.clear()

3626

2868

3627

2869

atexit.register(cleanup)

3628

3629

for client in tcp_server.clients.values():

2870

2871

for client in tcp_server.clients.itervalues():

3630

2872

if use_dbus:

3631

# Emit D-Bus signal for adding

3632

mandos_dbus_service.client_added_signal(client)

2873

# Emit D-Bus signal

2874

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3633

2875

# Need to initiate checking of clients

3634

2876

if client.enabled:

3635

client.init_checker(randomize_start=True)

3636

2877

client.init_checker()

2878

3637

2879

tcp_server.enable()

3638

2880

tcp_server.server_activate()

3639

2881

3640

2882

# Find out what port we got

3641

2883

if zeroconf:

3642

2884

service.port = tcp_server.socket.getsockname()[1]

3643

2885

if use_ipv6:

3644

log.info("Now listening on address %r, port %d, flowinfo %d,"

3645

" scope_id %d", *tcp_server.socket.getsockname())

2886

logger.info("Now listening on address %r, port %d,"

2887

" flowinfo %d, scope_id %d",

2888

*tcp_server.socket.getsockname())

3646

2889

else: # IPv4

3647

log.info("Now listening on address %r, port %d",

3648

*tcp_server.socket.getsockname())

3649

3650

# service.interface = tcp_server.socket.getsockname()[3]

3651

2890

logger.info("Now listening on address %r, port %d",

2891

*tcp_server.socket.getsockname())

2892

2893

#service.interface = tcp_server.socket.getsockname()[3]

2894

3652

2895

try:

3653

2896

if zeroconf:

3654

2897

# From the Avahi example code

3655

2898

try:

3656

2899

service.activate()

3657

2900

except dbus.exceptions.DBusException as error:

3658

log.critical("D-Bus Exception", exc_info=error)

2901

logger.critical("D-Bus Exception", exc_info=error)

3659

2902

cleanup()

3660

2903

sys.exit(1)

3661

2904

# End of Avahi example code

3662

3663

GLib.io_add_watch(

3664

GLib.IOChannel.unix_new(tcp_server.fileno()),

3665

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3666

lambda *args, **kwargs: (tcp_server.handle_request

3667

(*args[2:], **kwargs) or True))

3668

3669

log.debug("Starting main loop")

2905

2906

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2907

lambda *args, **kwargs:

2908

(tcp_server.handle_request

2909

(*args[2:], **kwargs) or True))

2910

2911

logger.debug("Starting main loop")

3670

2912

main_loop.run()

3671

2913

except AvahiError as error:

3672

log.critical("Avahi Error", exc_info=error)

2914

logger.critical("Avahi Error", exc_info=error)

3673

2915

cleanup()

3674

2916

sys.exit(1)

3675

2917

except KeyboardInterrupt:

3676

2918

if debug:

3677

2919

print("", file=sys.stderr)

3678

log.debug("Server received KeyboardInterrupt")

3679

log.debug("Server exiting")

2920

logger.debug("Server received KeyboardInterrupt")

2921

logger.debug("Server exiting")

3680

2922

# Must run before the D-Bus bus name gets deregistered

3681

2923

cleanup()

3682

2924

3683

3684

def parse_test_args():

3685

# type: () -> argparse.Namespace

3686

parser = argparse.ArgumentParser(add_help=False)

3687

parser.add_argument("--check", action="store_true")

3688

parser.add_argument("--prefix", )

3689

args, unknown_args = parser.parse_known_args()

3690

if args.check:

3691

# Remove test options from sys.argv

3692

sys.argv[1:] = unknown_args

3693

return args

3694

3695

# Add all tests from doctest strings

3696

def load_tests(loader, tests, none):

3697

import doctest

3698

tests.addTests(doctest.DocTestSuite())

3699

return tests

3700

3701

if __name__ == "__main__":

3702

options = parse_test_args()

3703

try:

3704

if options.check:

3705

extra_test_prefix = options.prefix

3706

if extra_test_prefix is not None:

3707

if not (unittest.main(argv=[""], exit=False)

3708

.result.wasSuccessful()):

3709

sys.exit(1)

3710

class ExtraTestLoader(unittest.TestLoader):

3711

testMethodPrefix = extra_test_prefix

3712

# Call using ./scriptname --test [--verbose]

3713

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3714

else:

3715

unittest.main(argv=[""])

3716

else:

3717

main()

3718

finally:

3719

logging.shutdown()

3720

3721

# Local Variables:

3722

# run-tests:

3723

# (lambda (&optional extra)

3724

# (if (not (funcall run-tests-in-test-buffer default-directory

3725

# extra))

3726

# (funcall show-test-buffer-in-test-window)

3727

# (funcall remove-test-window)

3728

# (if extra (message "Extra tests run successfully!"))))

3729

# run-tests-in-test-buffer:

3730

# (lambda (dir &optional extra)

3731

# (with-current-buffer (get-buffer-create "*Test*")

3732

# (setq buffer-read-only nil

3733

# default-directory dir)

3734

# (erase-buffer)

3735

# (compilation-mode))

3736

# (let ((process-result

3737

# (let ((inhibit-read-only t))

3738

# (process-file-shell-command

3739

# (funcall get-command-line extra) nil "*Test*"))))

3740

# (and (numberp process-result)

3741

# (= process-result 0))))

3742

# get-command-line:

3743

# (lambda (&optional extra)

3744

# (let ((quoted-script

3745

# (shell-quote-argument (funcall get-script-name))))

3746

# (format

3747

# (concat "%s --check" (if extra " --prefix=atest" ""))

3748

# quoted-script)))

3749

# get-script-name:

3750

# (lambda ()

3751

# (if (fboundp 'file-local-name)

3752

# (file-local-name (buffer-file-name))

3753

# (or (file-remote-p (buffer-file-name) 'localname)

3754

# (buffer-file-name))))

3755

# remove-test-window:

3756

# (lambda ()

3757

# (let ((test-window (get-buffer-window "*Test*")))

3758

# (if test-window (delete-window test-window))))

3759

# show-test-buffer-in-test-window:

3760

# (lambda ()

3761

# (when (not (get-buffer-window-list "*Test*"))

3762

# (setq next-error-last-buffer (get-buffer "*Test*"))

3763

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3764

# (display-buffer-overriding-action

3765

# `((display-buffer-in-side-window) (side . ,side)

3766

# (window-height . fit-window-to-buffer)

3767

# (window-width . fit-window-to-buffer))))

3768

# (display-buffer "*Test*"))))

3769

# eval:

3770

# (progn

3771

# (let* ((run-extra-tests (lambda () (interactive)

3772

# (funcall run-tests t)))

3773

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3774

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3775

# (setq minor-mode-overriding-map-alist

3776

# (cons `(run-tests . ,outer-keymap)

3777

# minor-mode-overriding-map-alist)))

3778

# (add-hook 'after-save-hook run-tests 90 t))

3779

# End:

2925

2926

if __name__ == '__main__':

2927

main()