To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.301
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.301
- Committer: Teddy Hogeborn
- Date: 2015-05-31 16:13:39 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 325.
- Revision ID: teddy@recompile.se-20150531161339-igb3l0ip3c10ejpz
mandos-ctl: Generate better messages in exceptions.
mandos (rfc3339_duration_to_delta): Remove dead code. Adjust white
space.
mandos-ctl (rfc3339_duration_to_delta): Do minor formatting and
whitespace adjustments, and
Generate better message in
exception.
(string_to_delta): Adjust quote character in doc string.
mandos (rfc3339_duration_to_delta): Remove dead code. Adjust white
space.
mandos-ctl (rfc3339_duration_to_delta): Do minor formatting and
whitespace adjustments, and
Generate better message in
exception.
(string_to_delta): Adjust quote character in doc string.
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
48
44
import argparse
49
45
import datetime
50
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
51
53
try:
52
54
import ConfigParser as configparser
53
55
except ImportError:
77
79
import itertools
78
80
import collections
79
81
import codecs
80
import unittest
81
import random
82
import shlex
83
82
84
83
import dbus
85
84
import dbus.service
86
import gi
87
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
88
90
from dbus.mainloop.glib import DBusGMainLoop
89
91
import ctypes
90
92
import ctypes.util
91
93
import xml.dom.minidom
92
94
import inspect
93
95
94
if sys.version_info.major == 2:
95
__metaclass__ = type
96
str = unicode
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
96
try:
122
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
98
except AttributeError:
124
99
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
127
100
from IN import SO_BINDTODEVICE
128
101
except ImportError:
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.12"
102
SO_BINDTODEVICE = None
103
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
147
108
stored_state_file = "clients.pickle"
148
109
149
110
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
151
111
syslogger = None
152
112
153
113
try:
154
114
if_nametoindex = ctypes.cdll.LoadLibrary(
155
115
ctypes.util.find_library("c")).if_nametoindex
156
116
except (OSError, AttributeError):
157
117
158
118
def if_nametoindex(interface):
159
119
"Get an interface index the hard way, i.e. using fcntl()"
160
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
165
125
return interface_index
166
126
167
127
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
184
128
def initlogger(debug, level=logging.WARNING):
185
129
"""init logger and add loglevel"""
186
130
187
131
global syslogger
188
132
syslogger = (logging.handlers.SysLogHandler(
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
191
135
syslogger.setFormatter(logging.Formatter
192
136
('Mandos [%(process)d]: %(levelname)s:'
193
137
' %(message)s'))
194
138
logger.addHandler(syslogger)
195
139
196
140
if debug:
197
141
console = logging.StreamHandler()
198
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
208
152
pass
209
153
210
154
211
class PGPEngine:
155
class PGPEngine(object):
212
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
157
214
158
def __init__(self):
215
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
216
self.gpg = "gpg"
217
try:
218
output = subprocess.check_output(["gpgconf"])
219
for line in output.splitlines():
220
name, text, path = line.split(b":")
221
if name == b"gpg":
222
self.gpg = path
223
break
224
except OSError as e:
225
if e.errno != errno.ENOENT:
226
raise
227
160
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
161
'--home', self.tempdir,
229
162
'--force-mdc',
230
'--quiet']
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
163
'--quiet',
164
'--no-use-agent']
165
235
166
def __enter__(self):
236
167
return self
237
168
238
169
def __exit__(self, exc_type, exc_value, traceback):
239
170
self._cleanup()
240
171
return False
241
172
242
173
def __del__(self):
243
174
self._cleanup()
244
175
245
176
def _cleanup(self):
246
177
if self.tempdir is not None:
247
178
# Delete contents of tempdir
248
179
for root, dirs, files in os.walk(self.tempdir,
249
topdown=False):
180
topdown = False):
250
181
for filename in files:
251
182
os.remove(os.path.join(root, filename))
252
183
for dirname in dirs:
254
185
# Remove tempdir
255
186
os.rmdir(self.tempdir)
256
187
self.tempdir = None
257
188
258
189
def password_encode(self, password):
259
190
# Passphrase can not be empty and can not contain newlines or
260
191
# NUL bytes. So we prefix it and hex encode it.
265
196
.replace(b"\n", b"\\n")
266
197
.replace(b"\0", b"\\x00"))
267
198
return encoded
268
199
269
200
def encrypt(self, data, password):
270
201
passphrase = self.password_encode(password)
271
202
with tempfile.NamedTemporaryFile(
272
203
dir=self.tempdir) as passfile:
273
204
passfile.write(passphrase)
274
205
passfile.flush()
275
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
276
207
'--passphrase-file',
277
208
passfile.name]
278
209
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
283
214
if proc.returncode != 0:
284
215
raise PGPError(err)
285
216
return ciphertext
286
217
287
218
def decrypt(self, data, password):
288
219
passphrase = self.password_encode(password)
289
220
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
221
dir = self.tempdir) as passfile:
291
222
passfile.write(passphrase)
292
223
passfile.flush()
293
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
294
225
'--passphrase-file',
295
226
passfile.name]
296
227
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
301
232
if proc.returncode != 0:
302
233
raise PGPError(err)
303
234
return decrypted_plaintext
304
235
305
236
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
332
237
class AvahiError(Exception):
333
238
def __init__(self, value, *args, **kwargs):
334
239
self.value = value
344
249
pass
345
250
346
251
347
class AvahiService:
252
class AvahiService(object):
348
253
"""An Avahi (Zeroconf) service.
349
254
350
255
Attributes:
351
256
interface: integer; avahi.IF_UNSPEC or an interface index.
352
257
Used to optionally bind to the specified interface.
364
269
server: D-Bus Server
365
270
bus: dbus.SystemBus()
366
271
"""
367
272
368
273
def __init__(self,
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
379
284
self.interface = interface
380
285
self.name = name
381
286
self.type = servicetype
390
295
self.server = None
391
296
self.bus = bus
392
297
self.entry_group_state_changed_match = None
393
298
394
299
def rename(self, remove=True):
395
300
"""Derived from the Avahi example code"""
396
301
if self.rename_count >= self.max_renames:
416
321
logger.critical("D-Bus Exception", exc_info=error)
417
322
self.cleanup()
418
323
os._exit(1)
419
324
420
325
def remove(self):
421
326
"""Derived from the Avahi example code"""
422
327
if self.entry_group_state_changed_match is not None:
424
329
self.entry_group_state_changed_match = None
425
330
if self.group is not None:
426
331
self.group.Reset()
427
332
428
333
def add(self):
429
334
"""Derived from the Avahi example code"""
430
335
self.remove()
447
352
dbus.UInt16(self.port),
448
353
avahi.string_array_to_txt_array(self.TXT))
449
354
self.group.Commit()
450
355
451
356
def entry_group_state_changed(self, state, error):
452
357
"""Derived from the Avahi example code"""
453
358
logger.debug("Avahi entry group state change: %i", state)
454
359
455
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
361
logger.debug("Zeroconf service established.")
457
362
elif state == avahi.ENTRY_GROUP_COLLISION:
461
366
logger.critical("Avahi: Error in group state changed %s",
462
367
str(error))
463
368
raise AvahiGroupError("State changed: {!s}".format(error))
464
369
465
370
def cleanup(self):
466
371
"""Derived from the Avahi example code"""
467
372
if self.group is not None:
472
377
pass
473
378
self.group = None
474
379
self.remove()
475
380
476
381
def server_state_changed(self, state, error=None):
477
382
"""Derived from the Avahi example code"""
478
383
logger.debug("Avahi server state change: %i", state)
490
395
logger.error(bad_states[state] + ": %r", error)
491
396
self.cleanup()
492
397
elif state == avahi.SERVER_RUNNING:
493
try:
494
self.add()
495
except dbus.exceptions.DBusException as error:
496
if (error.get_dbus_name()
497
== "org.freedesktop.Avahi.CollisionError"):
498
logger.info("Local Zeroconf service name"
499
" collision.")
500
return self.rename(remove=False)
501
else:
502
logger.critical("D-Bus Exception", exc_info=error)
503
self.cleanup()
504
os._exit(1)
398
self.add()
505
399
else:
506
400
if error is None:
507
401
logger.debug("Unknown state: %r", state)
508
402
else:
509
403
logger.debug("Unknown state: %r: %r", state, error)
510
404
511
405
def activate(self):
512
406
"""Derived from the Avahi example code"""
513
407
if self.server is None:
524
418
class AvahiServiceToSyslog(AvahiService):
525
419
def rename(self, *args, **kwargs):
526
420
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
**kwargs)
421
ret = AvahiService.rename(self, *args, **kwargs)
529
422
syslogger.setFormatter(logging.Formatter(
530
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
531
424
.format(self.name)))
532
425
return ret
533
426
534
427
535
# Pretend that we have a GnuTLS module
536
class gnutls:
537
"""This isn't so much a class as it is a module-like namespace."""
538
539
library = ctypes.util.find_library("gnutls")
540
if library is None:
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
543
del library
544
545
# Unless otherwise indicated, the constants and types below are
546
# all from the gnutls/gnutls.h C header file.
547
548
# Constants
549
E_SUCCESS = 0
550
E_INTERRUPTED = -52
551
E_AGAIN = -28
552
CRT_OPENPGP = 2
553
CRT_RAWPK = 3
554
CLIENT = 2
555
SHUT_RDWR = 0
556
CRD_CERTIFICATE = 1
557
E_NO_CERTIFICATE_FOUND = -49
558
X509_FMT_DER = 0
559
NO_TICKETS = 1<<10
560
ENABLE_RAWPK = 1<<18
561
CTYPE_PEERS = 3
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
564
565
# Types
566
class session_int(ctypes.Structure):
567
_fields_ = []
568
session_t = ctypes.POINTER(session_int)
569
570
class certificate_credentials_st(ctypes.Structure):
571
_fields_ = []
572
certificate_credentials_t = ctypes.POINTER(
573
certificate_credentials_st)
574
certificate_type_t = ctypes.c_int
575
576
class datum_t(ctypes.Structure):
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
('size', ctypes.c_uint)]
579
580
class openpgp_crt_int(ctypes.Structure):
581
_fields_ = []
582
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
credentials_type_t = ctypes.c_int
586
transport_ptr_t = ctypes.c_void_p
587
close_request_t = ctypes.c_int
588
589
# Exceptions
590
class Error(Exception):
591
def __init__(self, message=None, code=None, args=()):
592
# Default usage is by a message string, but if a return
593
# code is passed, convert it to a string with
594
# gnutls.strerror()
595
self.code = code
596
if message is None and code is not None:
597
message = gnutls.strerror(code)
598
return super(gnutls.Error, self).__init__(
599
message, *args)
600
601
class CertificateSecurityError(Error):
602
pass
603
604
# Classes
605
class Credentials:
606
def __init__(self):
607
self._c_object = gnutls.certificate_credentials_t()
608
gnutls.certificate_allocate_credentials(
609
ctypes.byref(self._c_object))
610
self.type = gnutls.CRD_CERTIFICATE
611
612
def __del__(self):
613
gnutls.certificate_free_credentials(self._c_object)
614
615
class ClientSession:
616
def __init__(self, socket, credentials=None):
617
self._c_object = gnutls.session_t()
618
gnutls_flags = gnutls.CLIENT
619
if gnutls.check_version(b"3.5.6"):
620
gnutls_flags |= gnutls.NO_TICKETS
621
if gnutls.has_rawpk:
622
gnutls_flags |= gnutls.ENABLE_RAWPK
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
624
del gnutls_flags
625
gnutls.set_default_priority(self._c_object)
626
gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
gnutls.handshake_set_private_extensions(self._c_object,
628
True)
629
self.socket = socket
630
if credentials is None:
631
credentials = gnutls.Credentials()
632
gnutls.credentials_set(self._c_object, credentials.type,
633
ctypes.cast(credentials._c_object,
634
ctypes.c_void_p))
635
self.credentials = credentials
636
637
def __del__(self):
638
gnutls.deinit(self._c_object)
639
640
def handshake(self):
641
return gnutls.handshake(self._c_object)
642
643
def send(self, data):
644
data = bytes(data)
645
data_len = len(data)
646
while data_len > 0:
647
data_len -= gnutls.record_send(self._c_object,
648
data[-data_len:],
649
data_len)
650
651
def bye(self):
652
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
653
654
# Error handling functions
655
def _error_code(result):
656
"""A function to raise exceptions on errors, suitable
657
for the 'restype' attribute on ctypes functions"""
658
if result >= 0:
659
return result
660
if result == gnutls.E_NO_CERTIFICATE_FOUND:
661
raise gnutls.CertificateSecurityError(code=result)
662
raise gnutls.Error(code=result)
663
664
def _retry_on_error(result, func, arguments):
665
"""A function to retry on some errors, suitable
666
for the 'errcheck' attribute on ctypes functions"""
667
while result < 0:
668
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
669
return _error_code(result)
670
result = func(*arguments)
671
return result
672
673
# Unless otherwise indicated, the function declarations below are
674
# all from the gnutls/gnutls.h C header file.
675
676
# Functions
677
priority_set_direct = _library.gnutls_priority_set_direct
678
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
679
ctypes.POINTER(ctypes.c_char_p)]
680
priority_set_direct.restype = _error_code
681
682
init = _library.gnutls_init
683
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
684
init.restype = _error_code
685
686
set_default_priority = _library.gnutls_set_default_priority
687
set_default_priority.argtypes = [session_t]
688
set_default_priority.restype = _error_code
689
690
record_send = _library.gnutls_record_send
691
record_send.argtypes = [session_t, ctypes.c_void_p,
692
ctypes.c_size_t]
693
record_send.restype = ctypes.c_ssize_t
694
record_send.errcheck = _retry_on_error
695
696
certificate_allocate_credentials = (
697
_library.gnutls_certificate_allocate_credentials)
698
certificate_allocate_credentials.argtypes = [
699
ctypes.POINTER(certificate_credentials_t)]
700
certificate_allocate_credentials.restype = _error_code
701
702
certificate_free_credentials = (
703
_library.gnutls_certificate_free_credentials)
704
certificate_free_credentials.argtypes = [
705
certificate_credentials_t]
706
certificate_free_credentials.restype = None
707
708
handshake_set_private_extensions = (
709
_library.gnutls_handshake_set_private_extensions)
710
handshake_set_private_extensions.argtypes = [session_t,
711
ctypes.c_int]
712
handshake_set_private_extensions.restype = None
713
714
credentials_set = _library.gnutls_credentials_set
715
credentials_set.argtypes = [session_t, credentials_type_t,
716
ctypes.c_void_p]
717
credentials_set.restype = _error_code
718
719
strerror = _library.gnutls_strerror
720
strerror.argtypes = [ctypes.c_int]
721
strerror.restype = ctypes.c_char_p
722
723
certificate_type_get = _library.gnutls_certificate_type_get
724
certificate_type_get.argtypes = [session_t]
725
certificate_type_get.restype = _error_code
726
727
certificate_get_peers = _library.gnutls_certificate_get_peers
728
certificate_get_peers.argtypes = [session_t,
729
ctypes.POINTER(ctypes.c_uint)]
730
certificate_get_peers.restype = ctypes.POINTER(datum_t)
731
732
global_set_log_level = _library.gnutls_global_set_log_level
733
global_set_log_level.argtypes = [ctypes.c_int]
734
global_set_log_level.restype = None
735
736
global_set_log_function = _library.gnutls_global_set_log_function
737
global_set_log_function.argtypes = [log_func]
738
global_set_log_function.restype = None
739
740
deinit = _library.gnutls_deinit
741
deinit.argtypes = [session_t]
742
deinit.restype = None
743
744
handshake = _library.gnutls_handshake
745
handshake.argtypes = [session_t]
746
handshake.restype = _error_code
747
handshake.errcheck = _retry_on_error
748
749
transport_set_ptr = _library.gnutls_transport_set_ptr
750
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
751
transport_set_ptr.restype = None
752
753
bye = _library.gnutls_bye
754
bye.argtypes = [session_t, close_request_t]
755
bye.restype = _error_code
756
bye.errcheck = _retry_on_error
757
758
check_version = _library.gnutls_check_version
759
check_version.argtypes = [ctypes.c_char_p]
760
check_version.restype = ctypes.c_char_p
761
762
_need_version = b"3.3.0"
763
if check_version(_need_version) is None:
764
raise self.Error("Needs GnuTLS {} or later"
765
.format(_need_version))
766
767
_tls_rawpk_version = b"3.6.6"
768
has_rawpk = bool(check_version(_tls_rawpk_version))
769
770
if has_rawpk:
771
# Types
772
class pubkey_st(ctypes.Structure):
773
_fields = []
774
pubkey_t = ctypes.POINTER(pubkey_st)
775
776
x509_crt_fmt_t = ctypes.c_int
777
778
# All the function declarations below are from
779
# gnutls/abstract.h
780
pubkey_init = _library.gnutls_pubkey_init
781
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
782
pubkey_init.restype = _error_code
783
784
pubkey_import = _library.gnutls_pubkey_import
785
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
786
x509_crt_fmt_t]
787
pubkey_import.restype = _error_code
788
789
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
790
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
791
ctypes.POINTER(ctypes.c_ubyte),
792
ctypes.POINTER(ctypes.c_size_t)]
793
pubkey_get_key_id.restype = _error_code
794
795
pubkey_deinit = _library.gnutls_pubkey_deinit
796
pubkey_deinit.argtypes = [pubkey_t]
797
pubkey_deinit.restype = None
798
else:
799
# All the function declarations below are from
800
# gnutls/openpgp.h
801
802
openpgp_crt_init = _library.gnutls_openpgp_crt_init
803
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
804
openpgp_crt_init.restype = _error_code
805
806
openpgp_crt_import = _library.gnutls_openpgp_crt_import
807
openpgp_crt_import.argtypes = [openpgp_crt_t,
808
ctypes.POINTER(datum_t),
809
openpgp_crt_fmt_t]
810
openpgp_crt_import.restype = _error_code
811
812
openpgp_crt_verify_self = \
813
_library.gnutls_openpgp_crt_verify_self
814
openpgp_crt_verify_self.argtypes = [
815
openpgp_crt_t,
816
ctypes.c_uint,
817
ctypes.POINTER(ctypes.c_uint),
818
]
819
openpgp_crt_verify_self.restype = _error_code
820
821
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
822
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
823
openpgp_crt_deinit.restype = None
824
825
openpgp_crt_get_fingerprint = (
826
_library.gnutls_openpgp_crt_get_fingerprint)
827
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
828
ctypes.c_void_p,
829
ctypes.POINTER(
830
ctypes.c_size_t)]
831
openpgp_crt_get_fingerprint.restype = _error_code
832
833
if check_version(b"3.6.4"):
834
certificate_type_get2 = _library.gnutls_certificate_type_get2
835
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
836
certificate_type_get2.restype = _error_code
837
838
# Remove non-public functions
839
del _error_code, _retry_on_error
840
841
842
def call_pipe(connection, # : multiprocessing.Connection
843
func, *args, **kwargs):
844
"""This function is meant to be called by multiprocessing.Process
845
846
This function runs func(*args, **kwargs), and writes the resulting
847
return value on the provided multiprocessing.Connection.
848
"""
849
connection.send(func(*args, **kwargs))
850
connection.close()
851
852
853
class Client:
428
class Client(object):
854
429
"""A representation of a client host served by this server.
855
430
856
431
Attributes:
857
432
approved: bool(); 'None' if not yet approved/disapproved
858
433
approval_delay: datetime.timedelta(); Time to wait for approval
859
434
approval_duration: datetime.timedelta(); Duration of one approval
860
checker: multiprocessing.Process(); a running checker process used
861
to see if the client lives. 'None' if no process is
862
running.
863
checker_callback_tag: a GLib event source tag, or None
435
checker: subprocess.Popen(); a running checker process used
436
to see if the client lives.
437
'None' if no process is running.
438
checker_callback_tag: a gobject event source tag, or None
864
439
checker_command: string; External command which is run to check
865
440
if client lives. %() expansions are done at
866
441
runtime with vars(self) as dict, so that for
867
442
instance %(name)s can be used in the command.
868
checker_initiator_tag: a GLib event source tag, or None
443
checker_initiator_tag: a gobject event source tag, or None
869
444
created: datetime.datetime(); (UTC) object creation
870
445
client_structure: Object describing what attributes a client has
871
446
and is used for storing the client at exit
872
447
current_checker_command: string; current running checker_command
873
disable_initiator_tag: a GLib event source tag, or None
448
disable_initiator_tag: a gobject event source tag, or None
874
449
enabled: bool()
875
450
fingerprint: string (40 or 32 hexadecimal digits); used to
876
uniquely identify an OpenPGP client
877
key_id: string (64 hexadecimal digits); used to uniquely identify
878
a client using raw public keys
451
uniquely identify the client
879
452
host: string; available for use by the checker command
880
453
interval: datetime.timedelta(); How often to start a new checker
881
454
last_approval_request: datetime.datetime(); (UTC) or None
883
456
last_checker_status: integer between 0 and 255 reflecting exit
884
457
status of last checker. -1 reflects crashed
885
458
checker, -2 means no checker completed yet.
886
last_checker_signal: The signal which killed the last checker, if
887
last_checker_status is -1
888
459
last_enabled: datetime.datetime(); (UTC) or None
889
460
name: string; from the config file, used in log messages and
890
461
D-Bus identifiers
897
468
disabled, or None
898
469
server_settings: The server_settings dict from main()
899
470
"""
900
471
901
472
runtime_expansions = ("approval_delay", "approval_duration",
902
"created", "enabled", "expires", "key_id",
473
"created", "enabled", "expires",
903
474
"fingerprint", "host", "interval",
904
475
"last_approval_request", "last_checked_ok",
905
476
"last_enabled", "name", "timeout")
914
485
"approved_by_default": "True",
915
486
"enabled": "True",
916
487
}
917
488
918
489
@staticmethod
919
490
def config_parser(config):
920
491
"""Construct a new dict of client settings of this form:
927
498
for client_name in config.sections():
928
499
section = dict(config.items(client_name))
929
500
client = settings[client_name] = {}
930
501
931
502
client["host"] = section["host"]
932
503
# Reformat values from string types to Python types
933
504
client["approved_by_default"] = config.getboolean(
934
505
client_name, "approved_by_default")
935
506
client["enabled"] = config.getboolean(client_name,
936
507
"enabled")
937
938
# Uppercase and remove spaces from key_id and fingerprint
939
# for later comparison purposes with return value from the
940
# key_id() and fingerprint() functions
941
client["key_id"] = (section.get("key_id", "").upper()
942
.replace(" ", ""))
508
509
# Uppercase and remove spaces from fingerprint for later
510
# comparison purposes with return value from the
511
# fingerprint() function
943
512
client["fingerprint"] = (section["fingerprint"].upper()
944
513
.replace(" ", ""))
945
514
if "secret" in section:
946
client["secret"] = codecs.decode(section["secret"]
947
.encode("utf-8"),
948
"base64")
515
client["secret"] = section["secret"].decode("base64")
949
516
elif "secfile" in section:
950
517
with open(os.path.expanduser(os.path.expandvars
951
518
(section["secfile"])),
966
533
client["last_approval_request"] = None
967
534
client["last_checked_ok"] = None
968
535
client["last_checker_status"] = -2
969
536
970
537
return settings
971
972
def __init__(self, settings, name=None, server_settings=None):
538
539
def __init__(self, settings, name = None, server_settings=None):
973
540
self.name = name
974
541
if server_settings is None:
975
542
server_settings = {}
977
544
# adding all client settings
978
545
for setting, value in settings.items():
979
546
setattr(self, setting, value)
980
547
981
548
if self.enabled:
982
549
if not hasattr(self, "last_enabled"):
983
550
self.last_enabled = datetime.datetime.utcnow()
987
554
else:
988
555
self.last_enabled = None
989
556
self.expires = None
990
557
991
558
logger.debug("Creating client %r", self.name)
992
logger.debug(" Key ID: %s", self.key_id)
993
559
logger.debug(" Fingerprint: %s", self.fingerprint)
994
560
self.created = settings.get("created",
995
561
datetime.datetime.utcnow())
996
562
997
563
# attributes specific for this server instance
998
564
self.checker = None
999
565
self.checker_initiator_tag = None
1005
571
self.changedstate = multiprocessing_manager.Condition(
1006
572
multiprocessing_manager.Lock())
1007
573
self.client_structure = [attr
1008
for attr in self.__dict__.keys()
574
for attr in self.__dict__.iterkeys()
1009
575
if not attr.startswith("_")]
1010
576
self.client_structure.append("client_structure")
1011
577
1012
578
for name, t in inspect.getmembers(
1013
579
type(self), lambda obj: isinstance(obj, property)):
1014
580
if not name.startswith("_"):
1015
581
self.client_structure.append(name)
1016
582
1017
583
# Send notice to process children that client state has changed
1018
584
def send_changedstate(self):
1019
585
with self.changedstate:
1020
586
self.changedstate.notify_all()
1021
587
1022
588
def enable(self):
1023
589
"""Start this client's checker and timeout hooks"""
1024
590
if getattr(self, "enabled", False):
1029
595
self.last_enabled = datetime.datetime.utcnow()
1030
596
self.init_checker()
1031
597
self.send_changedstate()
1032
598
1033
599
def disable(self, quiet=True):
1034
600
"""Disable this client."""
1035
601
if not getattr(self, "enabled", False):
1037
603
if not quiet:
1038
604
logger.info("Disabling client %s", self.name)
1039
605
if getattr(self, "disable_initiator_tag", None) is not None:
1040
GLib.source_remove(self.disable_initiator_tag)
606
gobject.source_remove(self.disable_initiator_tag)
1041
607
self.disable_initiator_tag = None
1042
608
self.expires = None
1043
609
if getattr(self, "checker_initiator_tag", None) is not None:
1044
GLib.source_remove(self.checker_initiator_tag)
610
gobject.source_remove(self.checker_initiator_tag)
1045
611
self.checker_initiator_tag = None
1046
612
self.stop_checker()
1047
613
self.enabled = False
1048
614
if not quiet:
1049
615
self.send_changedstate()
1050
# Do not run this again if called by a GLib.timeout_add
616
# Do not run this again if called by a gobject.timeout_add
1051
617
return False
1052
618
1053
619
def __del__(self):
1054
620
self.disable()
1055
621
1056
622
def init_checker(self):
1057
623
# Schedule a new checker to be started an 'interval' from now,
1058
624
# and every interval from then on.
1059
625
if self.checker_initiator_tag is not None:
1060
GLib.source_remove(self.checker_initiator_tag)
1061
self.checker_initiator_tag = GLib.timeout_add(
1062
random.randrange(int(self.interval.total_seconds() * 1000
1063
+ 1)),
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
1064
629
self.start_checker)
1065
630
# Schedule a disable() when 'timeout' has passed
1066
631
if self.disable_initiator_tag is not None:
1067
GLib.source_remove(self.disable_initiator_tag)
1068
self.disable_initiator_tag = GLib.timeout_add(
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
1069
634
int(self.timeout.total_seconds() * 1000), self.disable)
1070
635
# Also start a new checker *right now*.
1071
636
self.start_checker()
1072
1073
def checker_callback(self, source, condition, connection,
1074
command):
637
638
def checker_callback(self, pid, condition, command):
1075
639
"""The checker has completed, so take appropriate actions."""
1076
# Read return code from connection (see call_pipe)
1077
returncode = connection.recv()
1078
connection.close()
1079
if self.checker is not None:
1080
self.checker.join()
1081
640
self.checker_callback_tag = None
1082
641
self.checker = None
1083
1084
if returncode >= 0:
1085
self.last_checker_status = returncode
1086
self.last_checker_signal = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
1087
644
if self.last_checker_status == 0:
1088
645
logger.info("Checker for %(name)s succeeded",
1089
646
vars(self))
1092
649
logger.info("Checker for %(name)s failed", vars(self))
1093
650
else:
1094
651
self.last_checker_status = -1
1095
self.last_checker_signal = -returncode
1096
652
logger.warning("Checker for %(name)s crashed?",
1097
653
vars(self))
1098
return False
1099
654
1100
655
def checked_ok(self):
1101
656
"""Assert that the client has been seen, alive and well."""
1102
657
self.last_checked_ok = datetime.datetime.utcnow()
1103
658
self.last_checker_status = 0
1104
self.last_checker_signal = None
1105
659
self.bump_timeout()
1106
660
1107
661
def bump_timeout(self, timeout=None):
1108
662
"""Bump up the timeout for this client."""
1109
663
if timeout is None:
1110
664
timeout = self.timeout
1111
665
if self.disable_initiator_tag is not None:
1112
GLib.source_remove(self.disable_initiator_tag)
666
gobject.source_remove(self.disable_initiator_tag)
1113
667
self.disable_initiator_tag = None
1114
668
if getattr(self, "enabled", False):
1115
self.disable_initiator_tag = GLib.timeout_add(
669
self.disable_initiator_tag = gobject.timeout_add(
1116
670
int(timeout.total_seconds() * 1000), self.disable)
1117
671
self.expires = datetime.datetime.utcnow() + timeout
1118
672
1119
673
def need_approval(self):
1120
674
self.last_approval_request = datetime.datetime.utcnow()
1121
675
1122
676
def start_checker(self):
1123
677
"""Start a new checker subprocess if one is not running.
1124
678
1125
679
If a checker already exists, leave it running and do
1126
680
nothing."""
1127
681
# The reason for not killing a running checker is that if we
1132
686
# checkers alone, the checker would have to take more time
1133
687
# than 'timeout' for the client to be disabled, which is as it
1134
688
# should be.
1135
1136
if self.checker is not None and not self.checker.is_alive():
1137
logger.warning("Checker was not alive; joining")
1138
self.checker.join()
1139
self.checker = None
689
690
# If a checker exists, make sure it is not a zombie
691
try:
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
698
else:
699
if pid:
700
logger.warning("Checker was a zombie")
701
gobject.source_remove(self.checker_callback_tag)
702
self.checker_callback(pid, status,
703
self.current_checker_command)
1140
704
# Start a new checker if needed
1141
705
if self.checker is None:
1142
706
# Escape attributes for the shell
1143
707
escaped_attrs = {
1144
attr: shlex.quote(str(getattr(self, attr)))
1145
for attr in self.runtime_expansions}
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
1146
710
try:
1147
711
command = self.checker_command % escaped_attrs
1148
712
except TypeError as error:
1151
715
exc_info=error)
1152
716
return True # Try again later
1153
717
self.current_checker_command = command
1154
logger.info("Starting checker %r for %s", command,
1155
self.name)
1156
# We don't need to redirect stdout and stderr, since
1157
# in normal mode, that is already done by daemon(),
1158
# and in debug mode we don't want to. (Stdin is
1159
# always replaced by /dev/null.)
1160
# The exception is when not debugging but nevertheless
1161
# running in the foreground; use the previously
1162
# created wnull.
1163
popen_args = {"close_fds": True,
1164
"shell": True,
1165
"cwd": "/"}
1166
if (not self.server_settings["debug"]
1167
and self.server_settings["foreground"]):
1168
popen_args.update({"stdout": wnull,
1169
"stderr": wnull})
1170
pipe = multiprocessing.Pipe(duplex=False)
1171
self.checker = multiprocessing.Process(
1172
target=call_pipe,
1173
args=(pipe[1], subprocess.call, command),
1174
kwargs=popen_args)
1175
self.checker.start()
1176
self.checker_callback_tag = GLib.io_add_watch(
1177
GLib.IOChannel.unix_new(pipe[0].fileno()),
1178
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1179
self.checker_callback, pipe[0], command)
1180
# Re-run this periodically if run by GLib.timeout_add
718
try:
719
logger.info("Starting checker %r for %s", command,
720
self.name)
721
# We don't need to redirect stdout and stderr, since
722
# in normal mode, that is already done by daemon(),
723
# and in debug mode we don't want to. (Stdin is
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
733
self.checker = subprocess.Popen(command,
734
close_fds=True,
735
shell=True,
736
cwd="/",
737
**popen_args)
738
except OSError as error:
739
logger.error("Failed to start subprocess",
740
exc_info=error)
741
return True
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1181
759
return True
1182
760
1183
761
def stop_checker(self):
1184
762
"""Force the checker process, if any, to stop."""
1185
763
if self.checker_callback_tag:
1186
GLib.source_remove(self.checker_callback_tag)
764
gobject.source_remove(self.checker_callback_tag)
1187
765
self.checker_callback_tag = None
1188
766
if getattr(self, "checker", None) is None:
1189
767
return
1190
768
logger.debug("Stopping checker for %(name)s", vars(self))
1191
self.checker.terminate()
769
try:
770
self.checker.terminate()
771
#time.sleep(0.5)
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
776
raise
1192
777
self.checker = None
1193
778
1194
779
1198
783
byte_arrays=False):
1199
784
"""Decorators for marking methods of a DBusObjectWithProperties to
1200
785
become properties on the D-Bus.
1201
786
1202
787
The decorated method will be called with no arguments by "Get"
1203
788
and with one argument by "Set".
1204
789
1205
790
The parameters, where they are supported, are the same as
1206
791
dbus.service.method, except there is only "signature", since the
1207
792
type from Get() and the type sent to Set() is the same.
1211
796
if byte_arrays and signature != "ay":
1212
797
raise ValueError("Byte arrays not supported for non-'ay'"
1213
798
" signature {!r}".format(signature))
1214
799
1215
800
def decorator(func):
1216
801
func._dbus_is_property = True
1217
802
func._dbus_interface = dbus_interface
1220
805
func._dbus_name = func.__name__
1221
806
if func._dbus_name.endswith("_dbus_property"):
1222
807
func._dbus_name = func._dbus_name[:-14]
1223
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1224
809
return func
1225
810
1226
811
return decorator
1227
812
1228
813
1229
814
def dbus_interface_annotations(dbus_interface):
1230
815
"""Decorator for marking functions returning interface annotations
1231
816
1232
817
Usage:
1233
818
1234
819
@dbus_interface_annotations("org.example.Interface")
1235
820
def _foo(self): # Function name does not matter
1236
821
return {"org.freedesktop.DBus.Deprecated": "true",
1237
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1238
823
"false"}
1239
824
"""
1240
825
1241
826
def decorator(func):
1242
827
func._dbus_is_interface = True
1243
828
func._dbus_interface = dbus_interface
1244
829
func._dbus_name = dbus_interface
1245
830
return func
1246
831
1247
832
return decorator
1248
833
1249
834
1250
835
def dbus_annotations(annotations):
1251
836
"""Decorator to annotate D-Bus methods, signals or properties
1252
837
Usage:
1253
838
1254
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1255
840
"org.freedesktop.DBus.Property."
1256
841
"EmitsChangedSignal": "false"})
1258
843
access="r")
1259
844
def Property_dbus_property(self):
1260
845
return dbus.Boolean(False)
1261
1262
See also the DBusObjectWithAnnotations class.
1263
846
"""
1264
847
1265
848
def decorator(func):
1266
849
func._dbus_annotations = annotations
1267
850
return func
1268
851
1269
852
return decorator
1270
853
1271
854
1287
870
pass
1288
871
1289
872
1290
class DBusObjectWithAnnotations(dbus.service.Object):
1291
"""A D-Bus object with annotations.
1292
1293
Classes inheriting from this can use the dbus_annotations
1294
decorator to add annotations to methods or signals.
873
class DBusObjectWithProperties(dbus.service.Object):
874
"""A D-Bus object with properties.
875
876
Classes inheriting from this can use the dbus_service_property
877
decorator to expose methods as D-Bus properties. It exposes the
878
standard Get(), Set(), and GetAll() methods on the D-Bus.
1295
879
"""
1296
880
1297
881
@staticmethod
1298
882
def _is_dbus_thing(thing):
1299
883
"""Returns a function testing if an attribute is a D-Bus thing
1300
884
1301
885
If called like _is_dbus_thing("method") it returns a function
1302
886
suitable for use as predicate to inspect.getmembers().
1303
887
"""
1304
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1305
889
False)
1306
890
1307
891
def _get_all_dbus_things(self, thing):
1308
892
"""Returns a generator of (name, attribute) pairs
1309
893
"""
1312
896
for cls in self.__class__.__mro__
1313
897
for name, athing in
1314
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1315
1316
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1317
out_signature="s",
1318
path_keyword='object_path',
1319
connection_keyword='connection')
1320
def Introspect(self, object_path, connection):
1321
"""Overloading of standard D-Bus method.
1322
1323
Inserts annotation tags on methods and signals.
1324
"""
1325
xmlstring = dbus.service.Object.Introspect(self, object_path,
1326
connection)
1327
try:
1328
document = xml.dom.minidom.parseString(xmlstring)
1329
1330
for if_tag in document.getElementsByTagName("interface"):
1331
# Add annotation tags
1332
for typ in ("method", "signal"):
1333
for tag in if_tag.getElementsByTagName(typ):
1334
annots = dict()
1335
for name, prop in (self.
1336
_get_all_dbus_things(typ)):
1337
if (name == tag.getAttribute("name")
1338
and prop._dbus_interface
1339
== if_tag.getAttribute("name")):
1340
annots.update(getattr(
1341
prop, "_dbus_annotations", {}))
1342
for name, value in annots.items():
1343
ann_tag = document.createElement(
1344
"annotation")
1345
ann_tag.setAttribute("name", name)
1346
ann_tag.setAttribute("value", value)
1347
tag.appendChild(ann_tag)
1348
# Add interface annotation tags
1349
for annotation, value in dict(
1350
itertools.chain.from_iterable(
1351
annotations().items()
1352
for name, annotations
1353
in self._get_all_dbus_things("interface")
1354
if name == if_tag.getAttribute("name")
1355
)).items():
1356
ann_tag = document.createElement("annotation")
1357
ann_tag.setAttribute("name", annotation)
1358
ann_tag.setAttribute("value", value)
1359
if_tag.appendChild(ann_tag)
1360
# Fix argument name for the Introspect method itself
1361
if (if_tag.getAttribute("name")
1362
== dbus.INTROSPECTABLE_IFACE):
1363
for cn in if_tag.getElementsByTagName("method"):
1364
if cn.getAttribute("name") == "Introspect":
1365
for arg in cn.getElementsByTagName("arg"):
1366
if (arg.getAttribute("direction")
1367
== "out"):
1368
arg.setAttribute("name",
1369
"xml_data")
1370
xmlstring = document.toxml("utf-8")
1371
document.unlink()
1372
except (AttributeError, xml.dom.DOMException,
1373
xml.parsers.expat.ExpatError) as error:
1374
logger.error("Failed to override Introspection method",
1375
exc_info=error)
1376
return xmlstring
1377
1378
1379
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1380
"""A D-Bus object with properties.
1381
1382
Classes inheriting from this can use the dbus_service_property
1383
decorator to expose methods as D-Bus properties. It exposes the
1384
standard Get(), Set(), and GetAll() methods on the D-Bus.
1385
"""
1386
899
1387
900
def _get_dbus_property(self, interface_name, property_name):
1388
901
"""Returns a bound method if one exists which is a D-Bus
1389
902
property with the specified name and interface.
1394
907
if (value._dbus_name == property_name
1395
908
and value._dbus_interface == interface_name):
1396
909
return value.__get__(self)
1397
910
1398
911
# No such property
1399
912
raise DBusPropertyNotFound("{}:{}.{}".format(
1400
913
self.dbus_object_path, interface_name, property_name))
1401
1402
@classmethod
1403
def _get_all_interface_names(cls):
1404
"""Get a sequence of all interfaces supported by an object"""
1405
return (name for name in set(getattr(getattr(x, attr),
1406
"_dbus_interface", None)
1407
for x in (inspect.getmro(cls))
1408
for attr in dir(x))
1409
if name is not None)
1410
914
1411
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
1412
916
in_signature="ss",
1413
917
out_signature="v")
1421
925
if not hasattr(value, "variant_level"):
1422
926
return value
1423
927
return type(value)(value, variant_level=value.variant_level+1)
1424
928
1425
929
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1426
930
def Set(self, interface_name, property_name, value):
1427
931
"""Standard D-Bus property Set() method, see D-Bus standard.
1436
940
raise ValueError("Byte arrays not supported for non-"
1437
941
"'ay' signature {!r}"
1438
942
.format(prop._dbus_signature))
1439
value = dbus.ByteArray(bytes(value))
943
value = dbus.ByteArray(b''.join(chr(byte)
944
for byte in value))
1440
945
prop(value)
1441
946
1442
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
1443
948
in_signature="s",
1444
949
out_signature="a{sv}")
1445
950
def GetAll(self, interface_name):
1446
951
"""Standard D-Bus property GetAll() method, see D-Bus
1447
952
standard.
1448
953
1449
954
Note: Will not include properties with access="write".
1450
955
"""
1451
956
properties = {}
1462
967
properties[name] = value
1463
968
continue
1464
969
properties[name] = type(value)(
1465
value, variant_level=value.variant_level + 1)
970
value, variant_level = value.variant_level + 1)
1466
971
return dbus.Dictionary(properties, signature="sv")
1467
972
1468
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1469
974
def PropertiesChanged(self, interface_name, changed_properties,
1470
975
invalidated_properties):
1472
977
standard.
1473
978
"""
1474
979
pass
1475
980
1476
981
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1477
982
out_signature="s",
1478
983
path_keyword='object_path',
1479
984
connection_keyword='connection')
1480
985
def Introspect(self, object_path, connection):
1481
986
"""Overloading of standard D-Bus method.
1482
987
1483
988
Inserts property tags and interface annotation tags.
1484
989
"""
1485
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1486
object_path,
1487
connection)
990
xmlstring = dbus.service.Object.Introspect(self, object_path,
991
connection)
1488
992
try:
1489
993
document = xml.dom.minidom.parseString(xmlstring)
1490
994
1491
995
def make_tag(document, name, prop):
1492
996
e = document.createElement("property")
1493
997
e.setAttribute("name", name)
1494
998
e.setAttribute("type", prop._dbus_signature)
1495
999
e.setAttribute("access", prop._dbus_access)
1496
1000
return e
1497
1001
1498
1002
for if_tag in document.getElementsByTagName("interface"):
1499
1003
# Add property tags
1500
1004
for tag in (make_tag(document, name, prop)
1503
1007
if prop._dbus_interface
1504
1008
== if_tag.getAttribute("name")):
1505
1009
if_tag.appendChild(tag)
1506
# Add annotation tags for properties
1507
for tag in if_tag.getElementsByTagName("property"):
1508
annots = dict()
1509
for name, prop in self._get_all_dbus_things(
1510
"property"):
1511
if (name == tag.getAttribute("name")
1512
and prop._dbus_interface
1513
== if_tag.getAttribute("name")):
1514
annots.update(getattr(
1515
prop, "_dbus_annotations", {}))
1516
for name, value in annots.items():
1517
ann_tag = document.createElement(
1518
"annotation")
1519
ann_tag.setAttribute("name", name)
1520
ann_tag.setAttribute("value", value)
1521
tag.appendChild(ann_tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1013
annots = dict()
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1023
"annotation")
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1034
)).items():
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1522
1039
# Add the names to the return values for the
1523
1040
# "org.freedesktop.DBus.Properties" methods
1524
1041
if (if_tag.getAttribute("name")
1543
1060
return xmlstring
1544
1061
1545
1062
1546
try:
1547
dbus.OBJECT_MANAGER_IFACE
1548
except AttributeError:
1549
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1550
1551
1552
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1553
"""A D-Bus object with an ObjectManager.
1554
1555
Classes inheriting from this exposes the standard
1556
GetManagedObjects call and the InterfacesAdded and
1557
InterfacesRemoved signals on the standard
1558
"org.freedesktop.DBus.ObjectManager" interface.
1559
1560
Note: No signals are sent automatically; they must be sent
1561
manually.
1562
"""
1563
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1564
out_signature="a{oa{sa{sv}}}")
1565
def GetManagedObjects(self):
1566
"""This function must be overridden"""
1567
raise NotImplementedError()
1568
1569
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1570
signature="oa{sa{sv}}")
1571
def InterfacesAdded(self, object_path, interfaces_and_properties):
1572
pass
1573
1574
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1575
def InterfacesRemoved(self, object_path, interfaces):
1576
pass
1577
1578
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1579
out_signature="s",
1580
path_keyword='object_path',
1581
connection_keyword='connection')
1582
def Introspect(self, object_path, connection):
1583
"""Overloading of standard D-Bus method.
1584
1585
Override return argument name of GetManagedObjects to be
1586
"objpath_interfaces_and_properties"
1587
"""
1588
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1589
object_path,
1590
connection)
1591
try:
1592
document = xml.dom.minidom.parseString(xmlstring)
1593
1594
for if_tag in document.getElementsByTagName("interface"):
1595
# Fix argument name for the GetManagedObjects method
1596
if (if_tag.getAttribute("name")
1597
== dbus.OBJECT_MANAGER_IFACE):
1598
for cn in if_tag.getElementsByTagName("method"):
1599
if (cn.getAttribute("name")
1600
== "GetManagedObjects"):
1601
for arg in cn.getElementsByTagName("arg"):
1602
if (arg.getAttribute("direction")
1603
== "out"):
1604
arg.setAttribute(
1605
"name",
1606
"objpath_interfaces"
1607
"_and_properties")
1608
xmlstring = document.toxml("utf-8")
1609
document.unlink()
1610
except (AttributeError, xml.dom.DOMException,
1611
xml.parsers.expat.ExpatError) as error:
1612
logger.error("Failed to override Introspection method",
1613
exc_info=error)
1614
return xmlstring
1615
1616
1617
1063
def datetime_to_dbus(dt, variant_level=0):
1618
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1619
1065
if dt is None:
1620
return dbus.String("", variant_level=variant_level)
1066
return dbus.String("", variant_level = variant_level)
1621
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1622
1068
1623
1069
1626
1072
dbus.service.Object, it will add alternate D-Bus attributes with
1627
1073
interface names according to the "alt_interface_names" mapping.
1628
1074
Usage:
1629
1075
1630
1076
@alternate_dbus_interfaces({"org.example.Interface":
1631
1077
"net.example.AlternateInterface"})
1632
1078
class SampleDBusObject(dbus.service.Object):
1633
1079
@dbus.service.method("org.example.Interface")
1634
1080
def SampleDBusMethod():
1635
1081
pass
1636
1082
1637
1083
The above "SampleDBusMethod" on "SampleDBusObject" will be
1638
1084
reachable via two interfaces: "org.example.Interface" and
1639
1085
"net.example.AlternateInterface", the latter of which will have
1640
1086
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1641
1087
"true", unless "deprecate" is passed with a False value.
1642
1088
1643
1089
This works for methods and signals, and also for D-Bus properties
1644
1090
(from DBusObjectWithProperties) and interfaces (from the
1645
1091
dbus_interface_annotations decorator).
1646
1092
"""
1647
1093
1648
1094
def wrapper(cls):
1649
1095
for orig_interface_name, alt_interface_name in (
1650
1096
alt_interface_names.items()):
1667
1113
if getattr(attribute, "_dbus_is_signal", False):
1668
1114
# Extract the original non-method undecorated
1669
1115
# function by black magic
1670
if sys.version_info.major == 2:
1671
nonmethod_func = (dict(
1672
zip(attribute.func_code.co_freevars,
1673
attribute.__closure__))
1674
["func"].cell_contents)
1675
else:
1676
nonmethod_func = (dict(
1677
zip(attribute.__code__.co_freevars,
1678
attribute.__closure__))
1679
["func"].cell_contents)
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1680
1120
# Create a new, but exactly alike, function
1681
1121
# object, and decorate it to be a new D-Bus signal
1682
1122
# with the alternate D-Bus interface name
1683
new_function = copy_function(nonmethod_func)
1684
1123
new_function = (dbus.service.signal(
1685
alt_interface,
1686
attribute._dbus_signature)(new_function))
1124
alt_interface, attribute._dbus_signature)
1125
(types.FunctionType(
1126
nonmethod_func.func_code,
1127
nonmethod_func.func_globals,
1128
nonmethod_func.func_name,
1129
nonmethod_func.func_defaults,
1130
nonmethod_func.func_closure)))
1687
1131
# Copy annotations, if any
1688
1132
try:
1689
1133
new_function._dbus_annotations = dict(
1690
1134
attribute._dbus_annotations)
1691
1135
except AttributeError:
1692
1136
pass
1693
1694
1137
# Define a creator of a function to call both the
1695
1138
# original and alternate functions, so both the
1696
1139
# original and alternate signals gets sent when
1699
1142
"""This function is a scope container to pass
1700
1143
func1 and func2 to the "call_both" function
1701
1144
outside of its arguments"""
1702
1703
@functools.wraps(func2)
1145
1704
1146
def call_both(*args, **kwargs):
1705
1147
"""This function will emit two D-Bus
1706
1148
signals by calling func1 and func2"""
1707
1149
func1(*args, **kwargs)
1708
1150
func2(*args, **kwargs)
1709
# Make wrapper function look like a D-Bus
1710
# signal
1711
for name, attr in inspect.getmembers(func2):
1712
if name.startswith("_dbus_"):
1713
setattr(call_both, name, attr)
1714
1151
1715
1152
return call_both
1716
1153
# Create the "call_both" function and add it to
1717
1154
# the class
1727
1164
alt_interface,
1728
1165
attribute._dbus_in_signature,
1729
1166
attribute._dbus_out_signature)
1730
(copy_function(attribute)))
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1731
1172
# Copy annotations, if any
1732
1173
try:
1733
1174
attr[attrname]._dbus_annotations = dict(
1745
1186
attribute._dbus_access,
1746
1187
attribute._dbus_get_args_options
1747
1188
["byte_arrays"])
1748
(copy_function(attribute)))
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1749
1195
# Copy annotations, if any
1750
1196
try:
1751
1197
attr[attrname]._dbus_annotations = dict(
1760
1206
# to the class.
1761
1207
attr[attrname] = (
1762
1208
dbus_interface_annotations(alt_interface)
1763
(copy_function(attribute)))
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1764
1214
if deprecate:
1765
1215
# Deprecate all alternate interfaces
1766
iname = "_AlternateDBusNames_interface_annotation{}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1767
1217
for interface_name in interface_names:
1768
1218
1769
1219
@dbus_interface_annotations(interface_name)
1770
1220
def func(self):
1771
return {"org.freedesktop.DBus.Deprecated":
1772
"true"}
1221
return { "org.freedesktop.DBus.Deprecated":
1222
"true" }
1773
1223
# Find an unused name
1774
1224
for aname in (iname.format(i)
1775
1225
for i in itertools.count()):
1779
1229
if interface_names:
1780
1230
# Replace the class with a new subclass of it with
1781
1231
# methods, signals, etc. as created above.
1782
if sys.version_info.major == 2:
1783
cls = type(b"{}Alternate".format(cls.__name__),
1784
(cls, ), attr)
1785
else:
1786
cls = type("{}Alternate".format(cls.__name__),
1787
(cls, ), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1788
1234
return cls
1789
1235
1790
1236
return wrapper
1791
1237
1792
1238
1794
1240
"se.bsnet.fukt.Mandos"})
1795
1241
class ClientDBus(Client, DBusObjectWithProperties):
1796
1242
"""A Client class using D-Bus
1797
1243
1798
1244
Attributes:
1799
1245
dbus_object_path: dbus.ObjectPath
1800
1246
bus: dbus.SystemBus()
1801
1247
"""
1802
1248
1803
1249
runtime_expansions = (Client.runtime_expansions
1804
1250
+ ("dbus_object_path", ))
1805
1251
1806
1252
_interface = "se.recompile.Mandos.Client"
1807
1253
1808
1254
# dbus.service.Object doesn't use super(), so we can't either.
1809
1810
def __init__(self, bus=None, *args, **kwargs):
1255
1256
def __init__(self, bus = None, *args, **kwargs):
1811
1257
self.bus = bus
1812
1258
Client.__init__(self, *args, **kwargs)
1813
1259
# Only now, when this client is initialized, can it show up on
1819
1265
"/clients/" + client_object_name)
1820
1266
DBusObjectWithProperties.__init__(self, self.bus,
1821
1267
self.dbus_object_path)
1822
1268
1823
1269
def notifychangeproperty(transform_func, dbus_name,
1824
1270
type_func=lambda x: x,
1825
1271
variant_level=1,
1827
1273
_interface=_interface):
1828
1274
""" Modify a variable so that it's a property which announces
1829
1275
its changes to DBus.
1830
1276
1831
1277
transform_fun: Function that takes a value and a variant_level
1832
1278
and transforms it to a D-Bus type.
1833
1279
dbus_name: D-Bus name of the variable
1836
1282
variant_level: D-Bus variant level. Default: 1
1837
1283
"""
1838
1284
attrname = "_{}".format(dbus_name)
1839
1285
1840
1286
def setter(self, value):
1841
1287
if hasattr(self, "dbus_object_path"):
1842
1288
if (not hasattr(self, attrname) or
1849
1295
else:
1850
1296
dbus_value = transform_func(
1851
1297
type_func(value),
1852
variant_level=variant_level)
1298
variant_level = variant_level)
1853
1299
self.PropertyChanged(dbus.String(dbus_name),
1854
1300
dbus_value)
1855
1301
self.PropertiesChanged(
1856
1302
_interface,
1857
dbus.Dictionary({dbus.String(dbus_name):
1858
dbus_value}),
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1859
1305
dbus.Array())
1860
1306
setattr(self, attrname, value)
1861
1307
1862
1308
return property(lambda self: getattr(self, attrname), setter)
1863
1309
1864
1310
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1865
1311
approvals_pending = notifychangeproperty(dbus.Boolean,
1866
1312
"ApprovalPending",
1867
type_func=bool)
1313
type_func = bool)
1868
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1869
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1870
1316
"LastEnabled")
1871
1317
checker = notifychangeproperty(
1872
1318
dbus.Boolean, "CheckerRunning",
1873
type_func=lambda checker: checker is not None)
1319
type_func = lambda checker: checker is not None)
1874
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1875
1321
"LastCheckedOK")
1876
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1881
1327
"ApprovedByDefault")
1882
1328
approval_delay = notifychangeproperty(
1883
1329
dbus.UInt64, "ApprovalDelay",
1884
type_func=lambda td: td.total_seconds() * 1000)
1330
type_func = lambda td: td.total_seconds() * 1000)
1885
1331
approval_duration = notifychangeproperty(
1886
1332
dbus.UInt64, "ApprovalDuration",
1887
type_func=lambda td: td.total_seconds() * 1000)
1333
type_func = lambda td: td.total_seconds() * 1000)
1888
1334
host = notifychangeproperty(dbus.String, "Host")
1889
1335
timeout = notifychangeproperty(
1890
1336
dbus.UInt64, "Timeout",
1891
type_func=lambda td: td.total_seconds() * 1000)
1337
type_func = lambda td: td.total_seconds() * 1000)
1892
1338
extended_timeout = notifychangeproperty(
1893
1339
dbus.UInt64, "ExtendedTimeout",
1894
type_func=lambda td: td.total_seconds() * 1000)
1340
type_func = lambda td: td.total_seconds() * 1000)
1895
1341
interval = notifychangeproperty(
1896
1342
dbus.UInt64, "Interval",
1897
type_func=lambda td: td.total_seconds() * 1000)
1343
type_func = lambda td: td.total_seconds() * 1000)
1898
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1899
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1900
1346
invalidate_only=True)
1901
1347
1902
1348
del notifychangeproperty
1903
1349
1904
1350
def __del__(self, *args, **kwargs):
1905
1351
try:
1906
1352
self.remove_from_connection()
1909
1355
if hasattr(DBusObjectWithProperties, "__del__"):
1910
1356
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1911
1357
Client.__del__(self, *args, **kwargs)
1912
1913
def checker_callback(self, source, condition,
1914
connection, command, *args, **kwargs):
1915
ret = Client.checker_callback(self, source, condition,
1916
connection, command, *args,
1917
**kwargs)
1918
exitstatus = self.last_checker_status
1919
if exitstatus >= 0:
1358
1359
def checker_callback(self, pid, condition, command,
1360
*args, **kwargs):
1361
self.checker_callback_tag = None
1362
self.checker = None
1363
if os.WIFEXITED(condition):
1364
exitstatus = os.WEXITSTATUS(condition)
1920
1365
# Emit D-Bus signal
1921
1366
self.CheckerCompleted(dbus.Int16(exitstatus),
1922
# This is specific to GNU libC
1923
dbus.Int64(exitstatus << 8),
1367
dbus.Int64(condition),
1924
1368
dbus.String(command))
1925
1369
else:
1926
1370
# Emit D-Bus signal
1927
1371
self.CheckerCompleted(dbus.Int16(-1),
1928
dbus.Int64(
1929
# This is specific to GNU libC
1930
(exitstatus << 8)
1931
| self.last_checker_signal),
1372
dbus.Int64(condition),
1932
1373
dbus.String(command))
1933
return ret
1934
1374
1375
return Client.checker_callback(self, pid, condition, command,
1376
*args, **kwargs)
1377
1935
1378
def start_checker(self, *args, **kwargs):
1936
1379
old_checker_pid = getattr(self.checker, "pid", None)
1937
1380
r = Client.start_checker(self, *args, **kwargs)
1941
1384
# Emit D-Bus signal
1942
1385
self.CheckerStarted(self.current_checker_command)
1943
1386
return r
1944
1387
1945
1388
def _reset_approved(self):
1946
1389
self.approved = None
1947
1390
return False
1948
1391
1949
1392
def approve(self, value=True):
1950
1393
self.approved = value
1951
GLib.timeout_add(int(self.approval_duration.total_seconds()
1952
* 1000), self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1953
1396
self.send_changedstate()
1954
1955
# D-Bus methods, signals & properties
1956
1957
# Interfaces
1958
1959
# Signals
1960
1397
1398
## D-Bus methods, signals & properties
1399
1400
## Interfaces
1401
1402
## Signals
1403
1961
1404
# CheckerCompleted - signal
1962
1405
@dbus.service.signal(_interface, signature="nxs")
1963
1406
def CheckerCompleted(self, exitcode, waitstatus, command):
1964
1407
"D-Bus signal"
1965
1408
pass
1966
1409
1967
1410
# CheckerStarted - signal
1968
1411
@dbus.service.signal(_interface, signature="s")
1969
1412
def CheckerStarted(self, command):
1970
1413
"D-Bus signal"
1971
1414
pass
1972
1415
1973
1416
# PropertyChanged - signal
1974
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1975
1418
@dbus.service.signal(_interface, signature="sv")
1976
1419
def PropertyChanged(self, property, value):
1977
1420
"D-Bus signal"
1978
1421
pass
1979
1422
1980
1423
# GotSecret - signal
1981
1424
@dbus.service.signal(_interface)
1982
1425
def GotSecret(self):
1985
1428
server to mandos-client
1986
1429
"""
1987
1430
pass
1988
1431
1989
1432
# Rejected - signal
1990
1433
@dbus.service.signal(_interface, signature="s")
1991
1434
def Rejected(self, reason):
1992
1435
"D-Bus signal"
1993
1436
pass
1994
1437
1995
1438
# NeedApproval - signal
1996
1439
@dbus.service.signal(_interface, signature="tb")
1997
1440
def NeedApproval(self, timeout, default):
1998
1441
"D-Bus signal"
1999
1442
return self.need_approval()
2000
2001
# Methods
2002
1443
1444
## Methods
1445
2003
1446
# Approve - method
2004
1447
@dbus.service.method(_interface, in_signature="b")
2005
1448
def Approve(self, value):
2006
1449
self.approve(value)
2007
1450
2008
1451
# CheckedOK - method
2009
1452
@dbus.service.method(_interface)
2010
1453
def CheckedOK(self):
2011
1454
self.checked_ok()
2012
1455
2013
1456
# Enable - method
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2015
1457
@dbus.service.method(_interface)
2016
1458
def Enable(self):
2017
1459
"D-Bus method"
2018
1460
self.enable()
2019
1461
2020
1462
# StartChecker - method
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2022
1463
@dbus.service.method(_interface)
2023
1464
def StartChecker(self):
2024
1465
"D-Bus method"
2025
1466
self.start_checker()
2026
1467
2027
1468
# Disable - method
2028
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2029
1469
@dbus.service.method(_interface)
2030
1470
def Disable(self):
2031
1471
"D-Bus method"
2032
1472
self.disable()
2033
1473
2034
1474
# StopChecker - method
2035
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2036
1475
@dbus.service.method(_interface)
2037
1476
def StopChecker(self):
2038
1477
self.stop_checker()
2039
2040
# Properties
2041
1478
1479
## Properties
1480
2042
1481
# ApprovalPending - property
2043
1482
@dbus_service_property(_interface, signature="b", access="read")
2044
1483
def ApprovalPending_dbus_property(self):
2045
1484
return dbus.Boolean(bool(self.approvals_pending))
2046
1485
2047
1486
# ApprovedByDefault - property
2048
1487
@dbus_service_property(_interface,
2049
1488
signature="b",
2052
1491
if value is None: # get
2053
1492
return dbus.Boolean(self.approved_by_default)
2054
1493
self.approved_by_default = bool(value)
2055
1494
2056
1495
# ApprovalDelay - property
2057
1496
@dbus_service_property(_interface,
2058
1497
signature="t",
2062
1501
return dbus.UInt64(self.approval_delay.total_seconds()
2063
1502
* 1000)
2064
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2065
1504
2066
1505
# ApprovalDuration - property
2067
1506
@dbus_service_property(_interface,
2068
1507
signature="t",
2072
1511
return dbus.UInt64(self.approval_duration.total_seconds()
2073
1512
* 1000)
2074
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2075
1514
2076
1515
# Name - property
2077
@dbus_annotations(
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2079
1516
@dbus_service_property(_interface, signature="s", access="read")
2080
1517
def Name_dbus_property(self):
2081
1518
return dbus.String(self.name)
2082
2083
# KeyID - property
2084
@dbus_annotations(
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2086
@dbus_service_property(_interface, signature="s", access="read")
2087
def KeyID_dbus_property(self):
2088
return dbus.String(self.key_id)
2089
1519
2090
1520
# Fingerprint - property
2091
@dbus_annotations(
2092
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2093
1521
@dbus_service_property(_interface, signature="s", access="read")
2094
1522
def Fingerprint_dbus_property(self):
2095
1523
return dbus.String(self.fingerprint)
2096
1524
2097
1525
# Host - property
2098
1526
@dbus_service_property(_interface,
2099
1527
signature="s",
2102
1530
if value is None: # get
2103
1531
return dbus.String(self.host)
2104
1532
self.host = str(value)
2105
1533
2106
1534
# Created - property
2107
@dbus_annotations(
2108
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2109
1535
@dbus_service_property(_interface, signature="s", access="read")
2110
1536
def Created_dbus_property(self):
2111
1537
return datetime_to_dbus(self.created)
2112
1538
2113
1539
# LastEnabled - property
2114
1540
@dbus_service_property(_interface, signature="s", access="read")
2115
1541
def LastEnabled_dbus_property(self):
2116
1542
return datetime_to_dbus(self.last_enabled)
2117
1543
2118
1544
# Enabled - property
2119
1545
@dbus_service_property(_interface,
2120
1546
signature="b",
2126
1552
self.enable()
2127
1553
else:
2128
1554
self.disable()
2129
1555
2130
1556
# LastCheckedOK - property
2131
1557
@dbus_service_property(_interface,
2132
1558
signature="s",
2136
1562
self.checked_ok()
2137
1563
return
2138
1564
return datetime_to_dbus(self.last_checked_ok)
2139
1565
2140
1566
# LastCheckerStatus - property
2141
1567
@dbus_service_property(_interface, signature="n", access="read")
2142
1568
def LastCheckerStatus_dbus_property(self):
2143
1569
return dbus.Int16(self.last_checker_status)
2144
1570
2145
1571
# Expires - property
2146
1572
@dbus_service_property(_interface, signature="s", access="read")
2147
1573
def Expires_dbus_property(self):
2148
1574
return datetime_to_dbus(self.expires)
2149
1575
2150
1576
# LastApprovalRequest - property
2151
1577
@dbus_service_property(_interface, signature="s", access="read")
2152
1578
def LastApprovalRequest_dbus_property(self):
2153
1579
return datetime_to_dbus(self.last_approval_request)
2154
1580
2155
1581
# Timeout - property
2156
1582
@dbus_service_property(_interface,
2157
1583
signature="t",
2172
1598
if (getattr(self, "disable_initiator_tag", None)
2173
1599
is None):
2174
1600
return
2175
GLib.source_remove(self.disable_initiator_tag)
2176
self.disable_initiator_tag = GLib.timeout_add(
1601
gobject.source_remove(self.disable_initiator_tag)
1602
self.disable_initiator_tag = gobject.timeout_add(
2177
1603
int((self.expires - now).total_seconds() * 1000),
2178
1604
self.disable)
2179
1605
2180
1606
# ExtendedTimeout - property
2181
1607
@dbus_service_property(_interface,
2182
1608
signature="t",
2186
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
2187
1613
* 1000)
2188
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2189
1615
2190
1616
# Interval - property
2191
1617
@dbus_service_property(_interface,
2192
1618
signature="t",
2199
1625
return
2200
1626
if self.enabled:
2201
1627
# Reschedule checker run
2202
GLib.source_remove(self.checker_initiator_tag)
2203
self.checker_initiator_tag = GLib.timeout_add(
1628
gobject.source_remove(self.checker_initiator_tag)
1629
self.checker_initiator_tag = gobject.timeout_add(
2204
1630
value, self.start_checker)
2205
self.start_checker() # Start one now, too
2206
1631
self.start_checker() # Start one now, too
1632
2207
1633
# Checker - property
2208
1634
@dbus_service_property(_interface,
2209
1635
signature="s",
2212
1638
if value is None: # get
2213
1639
return dbus.String(self.checker_command)
2214
1640
self.checker_command = str(value)
2215
1641
2216
1642
# CheckerRunning - property
2217
1643
@dbus_service_property(_interface,
2218
1644
signature="b",
2224
1650
self.start_checker()
2225
1651
else:
2226
1652
self.stop_checker()
2227
1653
2228
1654
# ObjectPath - property
2229
@dbus_annotations(
2230
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2231
"org.freedesktop.DBus.Deprecated": "true"})
2232
1655
@dbus_service_property(_interface, signature="o", access="read")
2233
1656
def ObjectPath_dbus_property(self):
2234
return self.dbus_object_path # is already a dbus.ObjectPath
2235
1657
return self.dbus_object_path # is already a dbus.ObjectPath
1658
2236
1659
# Secret = property
2237
@dbus_annotations(
2238
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2239
"invalidates"})
2240
1660
@dbus_service_property(_interface,
2241
1661
signature="ay",
2242
1662
access="write",
2243
1663
byte_arrays=True)
2244
1664
def Secret_dbus_property(self, value):
2245
1665
self.secret = bytes(value)
2246
1666
2247
1667
del _interface
2248
1668
2249
1669
2250
class ProxyClient:
2251
def __init__(self, child_pipe, key_id, fpr, address):
1670
class ProxyClient(object):
1671
def __init__(self, child_pipe, fpr, address):
2252
1672
self._pipe = child_pipe
2253
self._pipe.send(('init', key_id, fpr, address))
1673
self._pipe.send(('init', fpr, address))
2254
1674
if not self._pipe.recv():
2255
raise KeyError(key_id or fpr)
2256
1675
raise KeyError(fpr)
1676
2257
1677
def __getattribute__(self, name):
2258
1678
if name == '_pipe':
2259
1679
return super(ProxyClient, self).__getattribute__(name)
2262
1682
if data[0] == 'data':
2263
1683
return data[1]
2264
1684
if data[0] == 'function':
2265
1685
2266
1686
def func(*args, **kwargs):
2267
1687
self._pipe.send(('funcall', name, args, kwargs))
2268
1688
return self._pipe.recv()[1]
2269
1689
2270
1690
return func
2271
1691
2272
1692
def __setattr__(self, name, value):
2273
1693
if name == '_pipe':
2274
1694
return super(ProxyClient, self).__setattr__(name, value)
2277
1697
2278
1698
class ClientHandler(socketserver.BaseRequestHandler, object):
2279
1699
"""A class to handle client connections.
2280
1700
2281
1701
Instantiated once for each connection to handle it.
2282
1702
Note: This will run in its own forked process."""
2283
1703
2284
1704
def handle(self):
2285
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
2286
1706
logger.info("TCP connection from: %s",
2287
1707
str(self.client_address))
2288
1708
logger.debug("Pipe FD: %d",
2289
1709
self.server.child_pipe.fileno())
2290
2291
session = gnutls.ClientSession(self.request)
2292
2293
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2294
# "+AES-256-CBC", "+SHA1",
2295
# "+COMP-NULL", "+CTYPE-OPENPGP",
2296
# "+DHE-DSS"))
1710
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1713
1714
# Note: gnutls.connection.X509Credentials is really a
1715
# generic GnuTLS certificate credentials object so long as
1716
# no X.509 keys are added to it. Therefore, we can use it
1717
# here despite using OpenPGP certificates.
1718
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
# "+AES-256-CBC", "+SHA1",
1721
# "+COMP-NULL", "+CTYPE-OPENPGP",
1722
# "+DHE-DSS"))
2297
1723
# Use a fallback default, since this MUST be set.
2298
1724
priority = self.server.gnutls_priority
2299
1725
if priority is None:
2300
1726
priority = "NORMAL"
2301
gnutls.priority_set_direct(session._c_object,
2302
priority.encode("utf-8"),
2303
None)
2304
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1729
2305
1730
# Start communication using the Mandos protocol
2306
1731
# Get protocol number
2307
1732
line = self.request.makefile().readline()
2312
1737
except (ValueError, IndexError, RuntimeError) as error:
2313
1738
logger.error("Unknown protocol version: %s", error)
2314
1739
return
2315
1740
2316
1741
# Start GnuTLS connection
2317
1742
try:
2318
1743
session.handshake()
2319
except gnutls.Error as error:
1744
except gnutls.errors.GNUTLSError as error:
2320
1745
logger.warning("Handshake failed: %s", error)
2321
1746
# Do not run session.bye() here: the session is not
2322
1747
# established. Just abandon the request.
2323
1748
return
2324
1749
logger.debug("Handshake succeeded")
2325
1750
2326
1751
approval_required = False
2327
1752
try:
2328
if gnutls.has_rawpk:
2329
fpr = b""
2330
try:
2331
key_id = self.key_id(
2332
self.peer_certificate(session))
2333
except (TypeError, gnutls.Error) as error:
2334
logger.warning("Bad certificate: %s", error)
2335
return
2336
logger.debug("Key ID: %s", key_id)
2337
2338
else:
2339
key_id = b""
2340
try:
2341
fpr = self.fingerprint(
2342
self.peer_certificate(session))
2343
except (TypeError, gnutls.Error) as error:
2344
logger.warning("Bad certificate: %s", error)
2345
return
2346
logger.debug("Fingerprint: %s", fpr)
2347
2348
try:
2349
client = ProxyClient(child_pipe, key_id, fpr,
1753
try:
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1756
except (TypeError,
1757
gnutls.errors.GNUTLSError) as error:
1758
logger.warning("Bad certificate: %s", error)
1759
return
1760
logger.debug("Fingerprint: %s", fpr)
1761
1762
try:
1763
client = ProxyClient(child_pipe, fpr,
2350
1764
self.client_address)
2351
1765
except KeyError:
2352
1766
return
2353
1767
2354
1768
if client.approval_delay:
2355
1769
delay = client.approval_delay
2356
1770
client.approvals_pending += 1
2357
1771
approval_required = True
2358
1772
2359
1773
while True:
2360
1774
if not client.enabled:
2361
1775
logger.info("Client %s is disabled",
2364
1778
# Emit D-Bus signal
2365
1779
client.Rejected("Disabled")
2366
1780
return
2367
1781
2368
1782
if client.approved or not client.approval_delay:
2369
# We are approved or approval is disabled
1783
#We are approved or approval is disabled
2370
1784
break
2371
1785
elif client.approved is None:
2372
1786
logger.info("Client %s needs approval",
2383
1797
# Emit D-Bus signal
2384
1798
client.Rejected("Denied")
2385
1799
return
2386
2387
# wait until timeout or approved
1800
1801
#wait until timeout or approved
2388
1802
time = datetime.datetime.now()
2389
1803
client.changedstate.acquire()
2390
1804
client.changedstate.wait(delay.total_seconds())
2403
1817
break
2404
1818
else:
2405
1819
delay -= time2 - time
2406
2407
try:
2408
session.send(client.secret)
2409
except gnutls.Error as error:
2410
logger.warning("gnutls send failed",
2411
exc_info=error)
2412
return
2413
1820
1821
sent_size = 0
1822
while sent_size < len(client.secret):
1823
try:
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1827
exc_info=error)
1828
return
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1832
sent_size += sent
1833
2414
1834
logger.info("Sending secret to %s", client.name)
2415
1835
# bump the timeout using extended_timeout
2416
1836
client.bump_timeout(client.extended_timeout)
2417
1837
if self.server.use_dbus:
2418
1838
# Emit D-Bus signal
2419
1839
client.GotSecret()
2420
1840
2421
1841
finally:
2422
1842
if approval_required:
2423
1843
client.approvals_pending -= 1
2424
1844
try:
2425
1845
session.bye()
2426
except gnutls.Error as error:
1846
except gnutls.errors.GNUTLSError as error:
2427
1847
logger.warning("GnuTLS bye failed",
2428
1848
exc_info=error)
2429
1849
2430
1850
@staticmethod
2431
1851
def peer_certificate(session):
2432
"Return the peer's certificate as a bytestring"
2433
try:
2434
cert_type = gnutls.certificate_type_get2(session._c_object,
2435
gnutls.CTYPE_PEERS)
2436
except AttributeError:
2437
cert_type = gnutls.certificate_type_get(session._c_object)
2438
if gnutls.has_rawpk:
2439
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
else:
2441
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2442
# If not a valid certificate type...
2443
if cert_type not in valid_cert_types:
2444
logger.info("Cert type %r not in %r", cert_type,
2445
valid_cert_types)
2446
# ...return invalid data
2447
return b""
1852
"Return the peer's OpenPGP certificate as a bytestring"
1853
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2448
1859
list_size = ctypes.c_uint(1)
2449
cert_list = (gnutls.certificate_get_peers
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2450
1862
(session._c_object, ctypes.byref(list_size)))
2451
1863
if not bool(cert_list) and list_size.value != 0:
2452
raise gnutls.Error("error getting peer certificate")
1864
raise gnutls.errors.GNUTLSError("error getting peer"
1865
" certificate")
2453
1866
if list_size.value == 0:
2454
1867
return None
2455
1868
cert = cert_list[0]
2456
1869
return ctypes.string_at(cert.data, cert.size)
2457
2458
@staticmethod
2459
def key_id(certificate):
2460
"Convert a certificate bytestring to a hexdigit key ID"
2461
# New GnuTLS "datum" with the public key
2462
datum = gnutls.datum_t(
2463
ctypes.cast(ctypes.c_char_p(certificate),
2464
ctypes.POINTER(ctypes.c_ubyte)),
2465
ctypes.c_uint(len(certificate)))
2466
# XXX all these need to be created in the gnutls "module"
2467
# New empty GnuTLS certificate
2468
pubkey = gnutls.pubkey_t()
2469
gnutls.pubkey_init(ctypes.byref(pubkey))
2470
# Import the raw public key into the certificate
2471
gnutls.pubkey_import(pubkey,
2472
ctypes.byref(datum),
2473
gnutls.X509_FMT_DER)
2474
# New buffer for the key ID
2475
buf = ctypes.create_string_buffer(32)
2476
buf_len = ctypes.c_size_t(len(buf))
2477
# Get the key ID from the raw public key into the buffer
2478
gnutls.pubkey_get_key_id(
2479
pubkey,
2480
gnutls.KEYID_USE_SHA256,
2481
ctypes.cast(ctypes.byref(buf),
2482
ctypes.POINTER(ctypes.c_ubyte)),
2483
ctypes.byref(buf_len))
2484
# Deinit the certificate
2485
gnutls.pubkey_deinit(pubkey)
2486
2487
# Convert the buffer to a Python bytestring
2488
key_id = ctypes.string_at(buf, buf_len.value)
2489
# Convert the bytestring to hexadecimal notation
2490
hex_key_id = binascii.hexlify(key_id).upper()
2491
return hex_key_id
2492
1870
2493
1871
@staticmethod
2494
1872
def fingerprint(openpgp):
2495
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2496
1874
# New GnuTLS "datum" with the OpenPGP public key
2497
datum = gnutls.datum_t(
1875
datum = gnutls.library.types.gnutls_datum_t(
2498
1876
ctypes.cast(ctypes.c_char_p(openpgp),
2499
1877
ctypes.POINTER(ctypes.c_ubyte)),
2500
1878
ctypes.c_uint(len(openpgp)))
2501
1879
# New empty GnuTLS certificate
2502
crt = gnutls.openpgp_crt_t()
2503
gnutls.openpgp_crt_init(ctypes.byref(crt))
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
2504
1883
# Import the OpenPGP public key into the certificate
2505
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2506
gnutls.OPENPGP_FMT_RAW)
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2507
1887
# Verify the self signature in the key
2508
1888
crtverify = ctypes.c_uint()
2509
gnutls.openpgp_crt_verify_self(crt, 0,
2510
ctypes.byref(crtverify))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2511
1891
if crtverify.value != 0:
2512
gnutls.openpgp_crt_deinit(crt)
2513
raise gnutls.CertificateSecurityError(code
2514
=crtverify.value)
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
2515
1895
# New buffer for the fingerprint
2516
1896
buf = ctypes.create_string_buffer(20)
2517
1897
buf_len = ctypes.c_size_t()
2518
1898
# Get the fingerprint from the certificate into the buffer
2519
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2520
ctypes.byref(buf_len))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2521
1901
# Deinit the certificate
2522
gnutls.openpgp_crt_deinit(crt)
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2523
1903
# Convert the buffer to a Python bytestring
2524
1904
fpr = ctypes.string_at(buf, buf_len.value)
2525
1905
# Convert the bytestring to hexadecimal notation
2527
1907
return hex_fpr
2528
1908
2529
1909
2530
class MultiprocessingMixIn:
1910
class MultiprocessingMixIn(object):
2531
1911
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2532
1912
2533
1913
def sub_process_main(self, request, address):
2534
1914
try:
2535
1915
self.finish_request(request, address)
2536
1916
except Exception:
2537
1917
self.handle_error(request, address)
2538
1918
self.close_request(request)
2539
1919
2540
1920
def process_request(self, request, address):
2541
1921
"""Start a new process to process the request."""
2542
proc = multiprocessing.Process(target=self.sub_process_main,
2543
args=(request, address))
1922
proc = multiprocessing.Process(target = self.sub_process_main,
1923
args = (request, address))
2544
1924
proc.start()
2545
1925
return proc
2546
1926
2547
1927
2548
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1928
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2549
1929
""" adds a pipe to the MixIn """
2550
1930
2551
1931
def process_request(self, request, client_address):
2552
1932
"""Overrides and wraps the original process_request().
2553
1933
2554
1934
This function creates a new pipe in self.pipe
2555
1935
"""
2556
1936
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2557
1937
2558
1938
proc = MultiprocessingMixIn.process_request(self, request,
2559
1939
client_address)
2560
1940
self.child_pipe.close()
2561
1941
self.add_pipe(parent_pipe, proc)
2562
1942
2563
1943
def add_pipe(self, parent_pipe, proc):
2564
1944
"""Dummy function; override as necessary"""
2565
1945
raise NotImplementedError()
2566
1946
2567
1947
2568
1948
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2569
socketserver.TCPServer):
1949
socketserver.TCPServer, object):
2570
1950
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2571
1951
2572
1952
Attributes:
2573
1953
enabled: Boolean; whether this server is activated yet
2574
1954
interface: None or a network interface name (string)
2575
1955
use_ipv6: Boolean; to use IPv6 or not
2576
1956
"""
2577
1957
2578
1958
def __init__(self, server_address, RequestHandlerClass,
2579
1959
interface=None,
2580
1960
use_ipv6=True,
2590
1970
self.socketfd = socketfd
2591
1971
# Save the original socket.socket() function
2592
1972
self.socket_socket = socket.socket
2593
2594
1973
# To implement --socket, we monkey patch socket.socket.
2595
#
1974
#
2596
1975
# (When socketserver.TCPServer is a new-style class, we
2597
1976
# could make self.socket into a property instead of monkey
2598
1977
# patching socket.socket.)
2599
#
1978
#
2600
1979
# Create a one-time-only replacement for socket.socket()
2601
1980
@functools.wraps(socket.socket)
2602
1981
def socket_wrapper(*args, **kwargs):
2614
1993
# socket_wrapper(), if socketfd was set.
2615
1994
socketserver.TCPServer.__init__(self, server_address,
2616
1995
RequestHandlerClass)
2617
1996
2618
1997
def server_bind(self):
2619
1998
"""This overrides the normal server_bind() function
2620
1999
to bind to an interface if one was specified, and also NOT to
2621
2000
bind to an address or port if they were not specified."""
2622
global SO_BINDTODEVICE
2623
2001
if self.interface is not None:
2624
2002
if SO_BINDTODEVICE is None:
2625
# Fall back to a hard-coded value which seems to be
2626
# common enough.
2627
logger.warning("SO_BINDTODEVICE not found, trying 25")
2628
SO_BINDTODEVICE = 25
2629
try:
2630
self.socket.setsockopt(
2631
socket.SOL_SOCKET, SO_BINDTODEVICE,
2632
(self.interface + "\0").encode("utf-8"))
2633
except socket.error as error:
2634
if error.errno == errno.EPERM:
2635
logger.error("No permission to bind to"
2636
" interface %s", self.interface)
2637
elif error.errno == errno.ENOPROTOOPT:
2638
logger.error("SO_BINDTODEVICE not available;"
2639
" cannot bind to interface %s",
2640
self.interface)
2641
elif error.errno == errno.ENODEV:
2642
logger.error("Interface %s does not exist,"
2643
" cannot bind", self.interface)
2644
else:
2645
raise
2003
logger.error("SO_BINDTODEVICE does not exist;"
2004
" cannot bind to interface %s",
2005
self.interface)
2006
else:
2007
try:
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
2011
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
2016
logger.error("SO_BINDTODEVICE not available;"
2017
" cannot bind to interface %s",
2018
self.interface)
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2022
else:
2023
raise
2646
2024
# Only bind(2) the socket if we really need to.
2647
2025
if self.server_address[0] or self.server_address[1]:
2648
if self.server_address[1]:
2649
self.allow_reuse_address = True
2650
2026
if not self.server_address[0]:
2651
2027
if self.address_family == socket.AF_INET6:
2652
any_address = "::" # in6addr_any
2028
any_address = "::" # in6addr_any
2653
2029
else:
2654
any_address = "0.0.0.0" # INADDR_ANY
2030
any_address = "0.0.0.0" # INADDR_ANY
2655
2031
self.server_address = (any_address,
2656
2032
self.server_address[1])
2657
2033
elif not self.server_address[1]:
2667
2043
2668
2044
class MandosServer(IPv6_TCPServer):
2669
2045
"""Mandos server.
2670
2046
2671
2047
Attributes:
2672
2048
clients: set of Client objects
2673
2049
gnutls_priority GnuTLS priority string
2674
2050
use_dbus: Boolean; to emit D-Bus signals or not
2675
2676
Assumes a GLib.MainLoop event loop.
2051
2052
Assumes a gobject.MainLoop event loop.
2677
2053
"""
2678
2054
2679
2055
def __init__(self, server_address, RequestHandlerClass,
2680
2056
interface=None,
2681
2057
use_ipv6=True,
2691
2067
self.gnutls_priority = gnutls_priority
2692
2068
IPv6_TCPServer.__init__(self, server_address,
2693
2069
RequestHandlerClass,
2694
interface=interface,
2695
use_ipv6=use_ipv6,
2696
socketfd=socketfd)
2697
2070
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2073
2698
2074
def server_activate(self):
2699
2075
if self.enabled:
2700
2076
return socketserver.TCPServer.server_activate(self)
2701
2077
2702
2078
def enable(self):
2703
2079
self.enabled = True
2704
2080
2705
2081
def add_pipe(self, parent_pipe, proc):
2706
2082
# Call "handle_ipc" for both data and EOF events
2707
GLib.io_add_watch(
2708
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2709
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2710
2086
functools.partial(self.handle_ipc,
2711
parent_pipe=parent_pipe,
2712
proc=proc))
2713
2087
parent_pipe = parent_pipe,
2088
proc = proc))
2089
2714
2090
def handle_ipc(self, source, condition,
2715
2091
parent_pipe=None,
2716
proc=None,
2092
proc = None,
2717
2093
client_object=None):
2718
2094
# error, or the other end of multiprocessing.Pipe has closed
2719
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2720
2096
# Wait for other process to exit
2721
2097
proc.join()
2722
2098
return False
2723
2099
2724
2100
# Read a request from the child
2725
2101
request = parent_pipe.recv()
2726
2102
command = request[0]
2727
2103
2728
2104
if command == 'init':
2729
key_id = request[1].decode("ascii")
2730
fpr = request[2].decode("ascii")
2731
address = request[3]
2732
2733
for c in self.clients.values():
2734
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2735
"27AE41E4649B934CA495991B7852B855"):
2736
continue
2737
if key_id and c.key_id == key_id:
2738
client = c
2739
break
2740
if fpr and c.fingerprint == fpr:
2105
fpr = request[1]
2106
address = request[2]
2107
2108
for c in self.clients.itervalues():
2109
if c.fingerprint == fpr:
2741
2110
client = c
2742
2111
break
2743
2112
else:
2744
logger.info("Client not found for key ID: %s, address"
2745
": %s", key_id or fpr, address)
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
2746
2115
if self.use_dbus:
2747
2116
# Emit D-Bus signal
2748
mandos_dbus_service.ClientNotFound(key_id or fpr,
2117
mandos_dbus_service.ClientNotFound(fpr,
2749
2118
address[0])
2750
2119
parent_pipe.send(False)
2751
2120
return False
2752
2753
GLib.io_add_watch(
2754
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2755
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2121
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2756
2125
functools.partial(self.handle_ipc,
2757
parent_pipe=parent_pipe,
2758
proc=proc,
2759
client_object=client))
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
2760
2129
parent_pipe.send(True)
2761
2130
# remove the old hook in favor of the new above hook on
2762
2131
# same fileno
2765
2134
funcname = request[1]
2766
2135
args = request[2]
2767
2136
kwargs = request[3]
2768
2137
2769
2138
parent_pipe.send(('data', getattr(client_object,
2770
2139
funcname)(*args,
2771
2140
**kwargs)))
2772
2141
2773
2142
if command == 'getattr':
2774
2143
attrname = request[1]
2775
if isinstance(client_object.__getattribute__(attrname),
2776
collections.abc.Callable):
2144
if callable(client_object.__getattribute__(attrname)):
2777
2145
parent_pipe.send(('function', ))
2778
2146
else:
2779
2147
parent_pipe.send((
2780
2148
'data', client_object.__getattribute__(attrname)))
2781
2149
2782
2150
if command == 'setattr':
2783
2151
attrname = request[1]
2784
2152
value = request[2]
2785
2153
setattr(client_object, attrname, value)
2786
2154
2787
2155
return True
2788
2156
2789
2157
2790
2158
def rfc3339_duration_to_delta(duration):
2791
2159
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2792
2793
>>> timedelta = datetime.timedelta
2794
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2795
True
2796
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2797
True
2798
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2799
True
2800
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2801
True
2802
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2803
True
2804
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2805
True
2806
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2807
True
2808
>>> del timedelta
2160
2161
>>> rfc3339_duration_to_delta("P7D")
2162
datetime.timedelta(7)
2163
>>> rfc3339_duration_to_delta("PT60S")
2164
datetime.timedelta(0, 60)
2165
>>> rfc3339_duration_to_delta("PT60M")
2166
datetime.timedelta(0, 3600)
2167
>>> rfc3339_duration_to_delta("PT24H")
2168
datetime.timedelta(1)
2169
>>> rfc3339_duration_to_delta("P1W")
2170
datetime.timedelta(7)
2171
>>> rfc3339_duration_to_delta("PT5M30S")
2172
datetime.timedelta(0, 330)
2173
>>> rfc3339_duration_to_delta("P1DT3M20S")
2174
datetime.timedelta(1, 200)
2809
2175
"""
2810
2176
2811
2177
# Parsing an RFC 3339 duration with regular expressions is not
2812
2178
# possible - there would have to be multiple places for the same
2813
2179
# values, like seconds. The current code, while more esoteric, is
2814
2180
# cleaner without depending on a parsing library. If Python had a
2815
2181
# built-in library for parsing we would use it, but we'd like to
2816
2182
# avoid excessive use of external libraries.
2817
2183
2818
2184
# New type for defining tokens, syntax, and semantics all-in-one
2819
2185
Token = collections.namedtuple("Token", (
2820
2186
"regexp", # To match token; if "value" is not None, must have
2853
2219
frozenset((token_year, token_month,
2854
2220
token_day, token_time,
2855
2221
token_week)))
2856
# Define starting values:
2857
# Value so far
2858
value = datetime.timedelta()
2222
# Define starting values
2223
value = datetime.timedelta() # Value so far
2859
2224
found_token = None
2860
# Following valid tokens
2861
followers = frozenset((token_duration, ))
2862
# String left to parse
2863
s = duration
2225
followers = frozenset((token_duration, )) # Following valid tokens
2226
s = duration # String left to parse
2864
2227
# Loop until end token is found
2865
2228
while found_token is not token_end:
2866
2229
# Search for any currently valid tokens
2890
2253
2891
2254
def string_to_delta(interval):
2892
2255
"""Parse a string and return a datetime.timedelta
2893
2894
>>> string_to_delta('7d') == datetime.timedelta(7)
2895
True
2896
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
True
2898
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
True
2900
>>> string_to_delta('24h') == datetime.timedelta(1)
2901
True
2902
>>> string_to_delta('1w') == datetime.timedelta(7)
2903
True
2904
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2905
True
2256
2257
>>> string_to_delta('7d')
2258
datetime.timedelta(7)
2259
>>> string_to_delta('60s')
2260
datetime.timedelta(0, 60)
2261
>>> string_to_delta('60m')
2262
datetime.timedelta(0, 3600)
2263
>>> string_to_delta('24h')
2264
datetime.timedelta(1)
2265
>>> string_to_delta('1w')
2266
datetime.timedelta(7)
2267
>>> string_to_delta('5m 30s')
2268
datetime.timedelta(0, 330)
2906
2269
"""
2907
2270
2908
2271
try:
2909
2272
return rfc3339_duration_to_delta(interval)
2910
2273
except ValueError:
2911
2274
pass
2912
2275
2913
2276
timevalue = datetime.timedelta(0)
2914
2277
for s in interval.split():
2915
2278
try:
2933
2296
return timevalue
2934
2297
2935
2298
2936
def daemon(nochdir=False, noclose=False):
2299
def daemon(nochdir = False, noclose = False):
2937
2300
"""See daemon(3). Standard BSD Unix function.
2938
2301
2939
2302
This should really exist as os.daemon, but it doesn't (yet)."""
2940
2303
if os.fork():
2941
2304
sys.exit()
2959
2322
2960
2323
2961
2324
def main():
2962
2325
2963
2326
##################################################################
2964
2327
# Parsing of options, both command line and config file
2965
2328
2966
2329
parser = argparse.ArgumentParser()
2967
2330
parser.add_argument("-v", "--version", action="version",
2968
version="%(prog)s {}".format(version),
2331
version = "%(prog)s {}".format(version),
2969
2332
help="show version number and exit")
2970
2333
parser.add_argument("-i", "--interface", metavar="IF",
2971
2334
help="Bind to interface IF")
3007
2370
parser.add_argument("--no-zeroconf", action="store_false",
3008
2371
dest="zeroconf", help="Do not use Zeroconf",
3009
2372
default=None)
3010
2373
3011
2374
options = parser.parse_args()
3012
2375
2376
if options.check:
2377
import doctest
2378
fail_count, test_count = doctest.testmod()
2379
sys.exit(os.EX_OK if fail_count == 0 else 1)
2380
3013
2381
# Default values for config file for server-global settings
3014
if gnutls.has_rawpk:
3015
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3016
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3017
else:
3018
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3019
":+SIGN-DSA-SHA256")
3020
server_defaults = {"interface": "",
3021
"address": "",
3022
"port": "",
3023
"debug": "False",
3024
"priority": priority,
3025
"servicename": "Mandos",
3026
"use_dbus": "True",
3027
"use_ipv6": "True",
3028
"debuglevel": "",
3029
"restore": "True",
3030
"socket": "",
3031
"statedir": "/var/lib/mandos",
3032
"foreground": "False",
3033
"zeroconf": "True",
3034
}
3035
del priority
3036
2382
server_defaults = { "interface": "",
2383
"address": "",
2384
"port": "",
2385
"debug": "False",
2386
"priority":
2387
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2388
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2389
"servicename": "Mandos",
2390
"use_dbus": "True",
2391
"use_ipv6": "True",
2392
"debuglevel": "",
2393
"restore": "True",
2394
"socket": "",
2395
"statedir": "/var/lib/mandos",
2396
"foreground": "False",
2397
"zeroconf": "True",
2398
}
2399
3037
2400
# Parse config file for server-global settings
3038
server_config = configparser.ConfigParser(server_defaults)
2401
server_config = configparser.SafeConfigParser(server_defaults)
3039
2402
del server_defaults
3040
2403
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3041
# Convert the ConfigParser object to a dict
2404
# Convert the SafeConfigParser object to a dict
3042
2405
server_settings = server_config.defaults()
3043
2406
# Use the appropriate methods on the non-string config options
3044
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3045
"foreground", "zeroconf"):
2407
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3046
2408
server_settings[option] = server_config.getboolean("DEFAULT",
3047
2409
option)
3048
2410
if server_settings["port"]:
3058
2420
server_settings["socket"] = os.dup(server_settings
3059
2421
["socket"])
3060
2422
del server_config
3061
2423
3062
2424
# Override the settings from the config file with command line
3063
2425
# options, if set.
3064
2426
for option in ("interface", "address", "port", "debug",
3082
2444
if server_settings["debug"]:
3083
2445
server_settings["foreground"] = True
3084
2446
# Now we have our good server settings in "server_settings"
3085
2447
3086
2448
##################################################################
3087
2449
3088
2450
if (not server_settings["zeroconf"]
3089
2451
and not (server_settings["port"]
3090
2452
or server_settings["socket"] != "")):
3091
2453
parser.error("Needs port or socket to work without Zeroconf")
3092
2454
3093
2455
# For convenience
3094
2456
debug = server_settings["debug"]
3095
2457
debuglevel = server_settings["debuglevel"]
3099
2461
stored_state_file)
3100
2462
foreground = server_settings["foreground"]
3101
2463
zeroconf = server_settings["zeroconf"]
3102
2464
3103
2465
if debug:
3104
2466
initlogger(debug, logging.DEBUG)
3105
2467
else:
3108
2470
else:
3109
2471
level = getattr(logging, debuglevel.upper())
3110
2472
initlogger(debug, level)
3111
2473
3112
2474
if server_settings["servicename"] != "Mandos":
3113
2475
syslogger.setFormatter(
3114
2476
logging.Formatter('Mandos ({}) [%(process)d]:'
3115
2477
' %(levelname)s: %(message)s'.format(
3116
2478
server_settings["servicename"])))
3117
2479
3118
2480
# Parse config file with clients
3119
client_config = configparser.ConfigParser(Client.client_defaults)
2481
client_config = configparser.SafeConfigParser(Client
2482
.client_defaults)
3120
2483
client_config.read(os.path.join(server_settings["configdir"],
3121
2484
"clients.conf"))
3122
2485
3123
2486
global mandos_dbus_service
3124
2487
mandos_dbus_service = None
3125
2488
3126
2489
socketfd = None
3127
2490
if server_settings["socket"] != "":
3128
2491
socketfd = server_settings["socket"]
3144
2507
except IOError as e:
3145
2508
logger.error("Could not open file %r", pidfilename,
3146
2509
exc_info=e)
3147
3148
for name, group in (("_mandos", "_mandos"),
3149
("mandos", "mandos"),
3150
("nobody", "nogroup")):
2510
2511
for name in ("_mandos", "mandos", "nobody"):
3151
2512
try:
3152
2513
uid = pwd.getpwnam(name).pw_uid
3153
gid = pwd.getpwnam(group).pw_gid
2514
gid = pwd.getpwnam(name).pw_gid
3154
2515
break
3155
2516
except KeyError:
3156
2517
continue
3160
2521
try:
3161
2522
os.setgid(gid)
3162
2523
os.setuid(uid)
3163
if debug:
3164
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3165
gid))
3166
2524
except OSError as error:
3167
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3168
.format(uid, gid, os.strerror(error.errno)))
3169
2525
if error.errno != errno.EPERM:
3170
2526
raise
3171
2527
3172
2528
if debug:
3173
2529
# Enable all possible GnuTLS debugging
3174
2530
3175
2531
# "Use a log level over 10 to enable all debugging options."
3176
2532
# - GnuTLS manual
3177
gnutls.global_set_log_level(11)
3178
3179
@gnutls.log_func
2533
gnutls.library.functions.gnutls_global_set_log_level(11)
2534
2535
@gnutls.library.types.gnutls_log_func
3180
2536
def debug_gnutls(level, string):
3181
2537
logger.debug("GnuTLS: %s", string[:-1])
3182
3183
gnutls.global_set_log_function(debug_gnutls)
3184
2538
2539
gnutls.library.functions.gnutls_global_set_log_function(
2540
debug_gnutls)
2541
3185
2542
# Redirect stdin so all checkers get /dev/null
3186
2543
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3187
2544
os.dup2(null, sys.stdin.fileno())
3188
2545
if null > 2:
3189
2546
os.close(null)
3190
2547
3191
2548
# Need to fork before connecting to D-Bus
3192
2549
if not foreground:
3193
2550
# Close all input and output, do double fork, etc.
3194
2551
daemon()
3195
3196
if gi.version_info < (3, 10, 2):
3197
# multiprocessing will use threads, so before we use GLib we
3198
# need to inform GLib that threads will be used.
3199
GLib.threads_init()
3200
2552
2553
# multiprocessing will use threads, so before we use gobject we
2554
# need to inform gobject that threads will be used.
2555
gobject.threads_init()
2556
3201
2557
global main_loop
3202
2558
# From the Avahi example code
3203
2559
DBusGMainLoop(set_as_default=True)
3204
main_loop = GLib.MainLoop()
2560
main_loop = gobject.MainLoop()
3205
2561
bus = dbus.SystemBus()
3206
2562
# End of Avahi example code
3207
2563
if use_dbus:
3220
2576
if zeroconf:
3221
2577
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3222
2578
service = AvahiServiceToSyslog(
3223
name=server_settings["servicename"],
3224
servicetype="_mandos._tcp",
3225
protocol=protocol,
3226
bus=bus)
2579
name = server_settings["servicename"],
2580
servicetype = "_mandos._tcp",
2581
protocol = protocol,
2582
bus = bus)
3227
2583
if server_settings["interface"]:
3228
2584
service.interface = if_nametoindex(
3229
2585
server_settings["interface"].encode("utf-8"))
3230
2586
3231
2587
global multiprocessing_manager
3232
2588
multiprocessing_manager = multiprocessing.Manager()
3233
2589
3234
2590
client_class = Client
3235
2591
if use_dbus:
3236
client_class = functools.partial(ClientDBus, bus=bus)
3237
2592
client_class = functools.partial(ClientDBus, bus = bus)
2593
3238
2594
client_settings = Client.config_parser(client_config)
3239
2595
old_client_settings = {}
3240
2596
clients_data = {}
3241
2597
3242
2598
# This is used to redirect stdout and stderr for checker processes
3243
2599
global wnull
3244
wnull = open(os.devnull, "w") # A writable /dev/null
2600
wnull = open(os.devnull, "w") # A writable /dev/null
3245
2601
# Only used if server is running in foreground but not in debug
3246
2602
# mode
3247
2603
if debug or not foreground:
3248
2604
wnull.close()
3249
2605
3250
2606
# Get client data and settings from last running state.
3251
2607
if server_settings["restore"]:
3252
2608
try:
3253
2609
with open(stored_state_path, "rb") as stored_state:
3254
if sys.version_info.major == 2:
3255
clients_data, old_client_settings = pickle.load(
3256
stored_state)
3257
else:
3258
bytes_clients_data, bytes_old_client_settings = (
3259
pickle.load(stored_state, encoding="bytes"))
3260
# Fix bytes to strings
3261
# clients_data
3262
# .keys()
3263
clients_data = {(key.decode("utf-8")
3264
if isinstance(key, bytes)
3265
else key): value
3266
for key, value in
3267
bytes_clients_data.items()}
3268
del bytes_clients_data
3269
for key in clients_data:
3270
value = {(k.decode("utf-8")
3271
if isinstance(k, bytes) else k): v
3272
for k, v in
3273
clients_data[key].items()}
3274
clients_data[key] = value
3275
# .client_structure
3276
value["client_structure"] = [
3277
(s.decode("utf-8")
3278
if isinstance(s, bytes)
3279
else s) for s in
3280
value["client_structure"]]
3281
# .name, .host, and .checker_command
3282
for k in ("name", "host", "checker_command"):
3283
if isinstance(value[k], bytes):
3284
value[k] = value[k].decode("utf-8")
3285
if "key_id" not in value:
3286
value["key_id"] = ""
3287
elif "fingerprint" not in value:
3288
value["fingerprint"] = ""
3289
# old_client_settings
3290
# .keys()
3291
old_client_settings = {
3292
(key.decode("utf-8")
3293
if isinstance(key, bytes)
3294
else key): value
3295
for key, value in
3296
bytes_old_client_settings.items()}
3297
del bytes_old_client_settings
3298
# .host and .checker_command
3299
for value in old_client_settings.values():
3300
for attribute in ("host", "checker_command"):
3301
if isinstance(value[attribute], bytes):
3302
value[attribute] = (value[attribute]
3303
.decode("utf-8"))
2610
clients_data, old_client_settings = pickle.load(
2611
stored_state)
3304
2612
os.remove(stored_state_path)
3305
2613
except IOError as e:
3306
2614
if e.errno == errno.ENOENT:
3314
2622
logger.warning("Could not load persistent state: "
3315
2623
"EOFError:",
3316
2624
exc_info=e)
3317
2625
3318
2626
with PGPEngine() as pgp:
3319
2627
for client_name, client in clients_data.items():
3320
2628
# Skip removed clients
3321
2629
if client_name not in client_settings:
3322
2630
continue
3323
2631
3324
2632
# Decide which value to use after restoring saved state.
3325
2633
# We have three different values: Old config file,
3326
2634
# new config file, and saved state.
3337
2645
client[name] = value
3338
2646
except KeyError:
3339
2647
pass
3340
2648
3341
2649
# Clients who has passed its expire date can still be
3342
# enabled if its last checker was successful. A Client
2650
# enabled if its last checker was successful. Clients
3343
2651
# whose checker succeeded before we stored its state is
3344
2652
# assumed to have successfully run all checkers during
3345
2653
# downtime.
3376
2684
client_name))
3377
2685
client["secret"] = (client_settings[client_name]
3378
2686
["secret"])
3379
2687
3380
2688
# Add/remove clients based on new changes made to config
3381
2689
for client_name in (set(old_client_settings)
3382
2690
- set(client_settings)):
3384
2692
for client_name in (set(client_settings)
3385
2693
- set(old_client_settings)):
3386
2694
clients_data[client_name] = client_settings[client_name]
3387
2695
3388
2696
# Create all client objects
3389
2697
for client_name, client in clients_data.items():
3390
2698
tcp_server.clients[client_name] = client_class(
3391
name=client_name,
3392
settings=client,
3393
server_settings=server_settings)
3394
2699
name = client_name,
2700
settings = client,
2701
server_settings = server_settings)
2702
3395
2703
if not tcp_server.clients:
3396
2704
logger.warning("No clients defined")
3397
2705
3398
2706
if not foreground:
3399
2707
if pidfile is not None:
3400
2708
pid = os.getpid()
3406
2714
pidfilename, pid)
3407
2715
del pidfile
3408
2716
del pidfilename
3409
3410
for termsig in (signal.SIGHUP, signal.SIGTERM):
3411
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3412
lambda: main_loop.quit() and False)
3413
2717
2718
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2719
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2720
3414
2721
if use_dbus:
3415
2722
3416
2723
@alternate_dbus_interfaces(
3417
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3418
class MandosDBusService(DBusObjectWithObjectManager):
2724
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2725
class MandosDBusService(DBusObjectWithProperties):
3419
2726
"""A D-Bus proxy object"""
3420
2727
3421
2728
def __init__(self):
3422
2729
dbus.service.Object.__init__(self, bus, "/")
3423
2730
3424
2731
_interface = "se.recompile.Mandos"
3425
2732
2733
@dbus_interface_annotations(_interface)
2734
def _foo(self):
2735
return {
2736
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2737
"false" }
2738
3426
2739
@dbus.service.signal(_interface, signature="o")
3427
2740
def ClientAdded(self, objpath):
3428
2741
"D-Bus signal"
3429
2742
pass
3430
2743
3431
2744
@dbus.service.signal(_interface, signature="ss")
3432
def ClientNotFound(self, key_id, address):
2745
def ClientNotFound(self, fingerprint, address):
3433
2746
"D-Bus signal"
3434
2747
pass
3435
3436
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3437
"true"})
2748
3438
2749
@dbus.service.signal(_interface, signature="os")
3439
2750
def ClientRemoved(self, objpath, name):
3440
2751
"D-Bus signal"
3441
2752
pass
3442
3443
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3444
"true"})
2753
3445
2754
@dbus.service.method(_interface, out_signature="ao")
3446
2755
def GetAllClients(self):
3447
2756
"D-Bus method"
3448
2757
return dbus.Array(c.dbus_object_path for c in
3449
tcp_server.clients.values())
3450
3451
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3452
"true"})
2758
tcp_server.clients.itervalues())
2759
3453
2760
@dbus.service.method(_interface,
3454
2761
out_signature="a{oa{sv}}")
3455
2762
def GetAllClientsWithProperties(self):
3456
2763
"D-Bus method"
3457
2764
return dbus.Dictionary(
3458
{c.dbus_object_path: c.GetAll(
3459
"se.recompile.Mandos.Client")
3460
for c in tcp_server.clients.values()},
2765
{ c.dbus_object_path: c.GetAll("")
2766
for c in tcp_server.clients.itervalues() },
3461
2767
signature="oa{sv}")
3462
2768
3463
2769
@dbus.service.method(_interface, in_signature="o")
3464
2770
def RemoveClient(self, object_path):
3465
2771
"D-Bus method"
3466
for c in tcp_server.clients.values():
2772
for c in tcp_server.clients.itervalues():
3467
2773
if c.dbus_object_path == object_path:
3468
2774
del tcp_server.clients[c.name]
3469
2775
c.remove_from_connection()
3470
# Don't signal the disabling
2776
# Don't signal anything except ClientRemoved
3471
2777
c.disable(quiet=True)
3472
# Emit D-Bus signal for removal
3473
self.client_removed_signal(c)
2778
# Emit D-Bus signal
2779
self.ClientRemoved(object_path, c.name)
3474
2780
return
3475
2781
raise KeyError(object_path)
3476
2782
3477
2783
del _interface
3478
3479
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3480
out_signature="a{oa{sa{sv}}}")
3481
def GetManagedObjects(self):
3482
"""D-Bus method"""
3483
return dbus.Dictionary(
3484
{client.dbus_object_path:
3485
dbus.Dictionary(
3486
{interface: client.GetAll(interface)
3487
for interface in
3488
client._get_all_interface_names()})
3489
for client in tcp_server.clients.values()})
3490
3491
def client_added_signal(self, client):
3492
"""Send the new standard signal and the old signal"""
3493
if use_dbus:
3494
# New standard signal
3495
self.InterfacesAdded(
3496
client.dbus_object_path,
3497
dbus.Dictionary(
3498
{interface: client.GetAll(interface)
3499
for interface in
3500
client._get_all_interface_names()}))
3501
# Old signal
3502
self.ClientAdded(client.dbus_object_path)
3503
3504
def client_removed_signal(self, client):
3505
"""Send the new standard signal and the old signal"""
3506
if use_dbus:
3507
# New standard signal
3508
self.InterfacesRemoved(
3509
client.dbus_object_path,
3510
client._get_all_interface_names())
3511
# Old signal
3512
self.ClientRemoved(client.dbus_object_path,
3513
client.name)
3514
2784
3515
2785
mandos_dbus_service = MandosDBusService()
3516
3517
# Save modules to variables to exempt the modules from being
3518
# unloaded before the function registered with atexit() is run.
3519
mp = multiprocessing
3520
wn = wnull
3521
2786
3522
2787
def cleanup():
3523
2788
"Cleanup function; run on exit"
3524
2789
if zeroconf:
3525
2790
service.cleanup()
3526
3527
mp.active_children()
3528
wn.close()
2791
2792
multiprocessing.active_children()
2793
wnull.close()
3529
2794
if not (tcp_server.clients or client_settings):
3530
2795
return
3531
2796
3532
2797
# Store client before exiting. Secrets are encrypted with key
3533
2798
# based on what config file has. If config file is
3534
2799
# removed/edited, old secret will thus be unrecovable.
3535
2800
clients = {}
3536
2801
with PGPEngine() as pgp:
3537
for client in tcp_server.clients.values():
2802
for client in tcp_server.clients.itervalues():
3538
2803
key = client_settings[client.name]["secret"]
3539
2804
client.encrypted_secret = pgp.encrypt(client.secret,
3540
2805
key)
3541
2806
client_dict = {}
3542
2807
3543
2808
# A list of attributes that can not be pickled
3544
2809
# + secret.
3545
exclude = {"bus", "changedstate", "secret",
3546
"checker", "server_settings"}
2810
exclude = { "bus", "changedstate", "secret",
2811
"checker", "server_settings" }
3547
2812
for name, typ in inspect.getmembers(dbus.service
3548
2813
.Object):
3549
2814
exclude.add(name)
3550
2815
3551
2816
client_dict["encrypted_secret"] = (client
3552
2817
.encrypted_secret)
3553
2818
for attr in client.client_structure:
3554
2819
if attr not in exclude:
3555
2820
client_dict[attr] = getattr(client, attr)
3556
2821
3557
2822
clients[client.name] = client_dict
3558
2823
del client_settings[client.name]["secret"]
3559
2824
3560
2825
try:
3561
2826
with tempfile.NamedTemporaryFile(
3562
2827
mode='wb',
3564
2829
prefix='clients-',
3565
2830
dir=os.path.dirname(stored_state_path),
3566
2831
delete=False) as stored_state:
3567
pickle.dump((clients, client_settings), stored_state,
3568
protocol=2)
2832
pickle.dump((clients, client_settings), stored_state)
3569
2833
tempname = stored_state.name
3570
2834
os.rename(tempname, stored_state_path)
3571
2835
except (IOError, OSError) as e:
3581
2845
logger.warning("Could not save persistent state:",
3582
2846
exc_info=e)
3583
2847
raise
3584
2848
3585
2849
# Delete all clients, and settings from config
3586
2850
while tcp_server.clients:
3587
2851
name, client = tcp_server.clients.popitem()
3588
2852
if use_dbus:
3589
2853
client.remove_from_connection()
3590
# Don't signal the disabling
2854
# Don't signal anything except ClientRemoved
3591
2855
client.disable(quiet=True)
3592
# Emit D-Bus signal for removal
3593
2856
if use_dbus:
3594
mandos_dbus_service.client_removed_signal(client)
2857
# Emit D-Bus signal
2858
mandos_dbus_service.ClientRemoved(
2859
client.dbus_object_path, client.name)
3595
2860
client_settings.clear()
3596
2861
3597
2862
atexit.register(cleanup)
3598
3599
for client in tcp_server.clients.values():
2863
2864
for client in tcp_server.clients.itervalues():
3600
2865
if use_dbus:
3601
# Emit D-Bus signal for adding
3602
mandos_dbus_service.client_added_signal(client)
2866
# Emit D-Bus signal
2867
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3603
2868
# Need to initiate checking of clients
3604
2869
if client.enabled:
3605
2870
client.init_checker()
3606
2871
3607
2872
tcp_server.enable()
3608
2873
tcp_server.server_activate()
3609
2874
3610
2875
# Find out what port we got
3611
2876
if zeroconf:
3612
2877
service.port = tcp_server.socket.getsockname()[1]
3617
2882
else: # IPv4
3618
2883
logger.info("Now listening on address %r, port %d",
3619
2884
*tcp_server.socket.getsockname())
3620
3621
# service.interface = tcp_server.socket.getsockname()[3]
3622
2885
2886
#service.interface = tcp_server.socket.getsockname()[3]
2887
3623
2888
try:
3624
2889
if zeroconf:
3625
2890
# From the Avahi example code
3630
2895
cleanup()
3631
2896
sys.exit(1)
3632
2897
# End of Avahi example code
3633
3634
GLib.io_add_watch(
3635
GLib.IOChannel.unix_new(tcp_server.fileno()),
3636
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3637
lambda *args, **kwargs: (tcp_server.handle_request
3638
(*args[2:], **kwargs) or True))
3639
2898
2899
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2900
lambda *args, **kwargs:
2901
(tcp_server.handle_request
2902
(*args[2:], **kwargs) or True))
2903
3640
2904
logger.debug("Starting main loop")
3641
2905
main_loop.run()
3642
2906
except AvahiError as error:
3651
2915
# Must run before the D-Bus bus name gets deregistered
3652
2916
cleanup()
3653
2917
3654
3655
def should_only_run_tests():
3656
parser = argparse.ArgumentParser(add_help=False)
3657
parser.add_argument("--check", action='store_true')
3658
args, unknown_args = parser.parse_known_args()
3659
run_tests = args.check
3660
if run_tests:
3661
# Remove --check argument from sys.argv
3662
sys.argv[1:] = unknown_args
3663
return run_tests
3664
3665
# Add all tests from doctest strings
3666
def load_tests(loader, tests, none):
3667
import doctest
3668
tests.addTests(doctest.DocTestSuite())
3669
return tests
3670
2918
3671
2919
if __name__ == '__main__':
3672
try:
3673
if should_only_run_tests():
3674
# Call using ./mandos --check [--verbose]
3675
unittest.main()
3676
else:
3677
main()
3678
finally:
3679
logging.shutdown()
2920
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0