To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.305
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.305
- Committer: Teddy Hogeborn
- Date: 2015-06-02 17:43:53 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 325.
- Revision ID: teddy@recompile.se-20150602174353-tvqw31mgxfapl985
mandos.service ([Service]/KillMode): Changed to "mixed".
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
48
44
import argparse
49
45
import datetime
50
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
51
53
try:
52
54
import ConfigParser as configparser
53
55
except ImportError:
77
79
import itertools
78
80
import collections
79
81
import codecs
80
import unittest
81
import random
82
import shlex
83
82
84
83
import dbus
85
84
import dbus.service
86
import gi
87
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
88
90
from dbus.mainloop.glib import DBusGMainLoop
89
91
import ctypes
90
92
import ctypes.util
91
93
import xml.dom.minidom
92
94
import inspect
93
95
94
if sys.version_info.major == 2:
95
__metaclass__ = type
96
str = unicode
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
96
try:
122
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
98
except AttributeError:
124
99
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
127
100
from IN import SO_BINDTODEVICE
128
101
except ImportError:
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.13"
102
SO_BINDTODEVICE = None
103
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
147
108
stored_state_file = "clients.pickle"
148
109
149
110
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
151
111
syslogger = None
152
112
153
113
try:
154
114
if_nametoindex = ctypes.cdll.LoadLibrary(
155
115
ctypes.util.find_library("c")).if_nametoindex
156
116
except (OSError, AttributeError):
157
117
158
118
def if_nametoindex(interface):
159
119
"Get an interface index the hard way, i.e. using fcntl()"
160
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
165
125
return interface_index
166
126
167
127
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
184
128
def initlogger(debug, level=logging.WARNING):
185
129
"""init logger and add loglevel"""
186
130
187
131
global syslogger
188
132
syslogger = (logging.handlers.SysLogHandler(
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
191
135
syslogger.setFormatter(logging.Formatter
192
136
('Mandos [%(process)d]: %(levelname)s:'
193
137
' %(message)s'))
194
138
logger.addHandler(syslogger)
195
139
196
140
if debug:
197
141
console = logging.StreamHandler()
198
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
208
152
pass
209
153
210
154
211
class PGPEngine:
155
class PGPEngine(object):
212
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
157
214
158
def __init__(self):
215
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
216
self.gpg = "gpg"
217
try:
218
output = subprocess.check_output(["gpgconf"])
219
for line in output.splitlines():
220
name, text, path = line.split(b":")
221
if name == b"gpg":
222
self.gpg = path
223
break
224
except OSError as e:
225
if e.errno != errno.ENOENT:
226
raise
227
160
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
161
'--home', self.tempdir,
229
162
'--force-mdc',
230
'--quiet']
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
163
'--quiet',
164
'--no-use-agent']
165
235
166
def __enter__(self):
236
167
return self
237
168
238
169
def __exit__(self, exc_type, exc_value, traceback):
239
170
self._cleanup()
240
171
return False
241
172
242
173
def __del__(self):
243
174
self._cleanup()
244
175
245
176
def _cleanup(self):
246
177
if self.tempdir is not None:
247
178
# Delete contents of tempdir
248
179
for root, dirs, files in os.walk(self.tempdir,
249
topdown=False):
180
topdown = False):
250
181
for filename in files:
251
182
os.remove(os.path.join(root, filename))
252
183
for dirname in dirs:
254
185
# Remove tempdir
255
186
os.rmdir(self.tempdir)
256
187
self.tempdir = None
257
188
258
189
def password_encode(self, password):
259
190
# Passphrase can not be empty and can not contain newlines or
260
191
# NUL bytes. So we prefix it and hex encode it.
265
196
.replace(b"\n", b"\\n")
266
197
.replace(b"\0", b"\\x00"))
267
198
return encoded
268
199
269
200
def encrypt(self, data, password):
270
201
passphrase = self.password_encode(password)
271
202
with tempfile.NamedTemporaryFile(
272
203
dir=self.tempdir) as passfile:
273
204
passfile.write(passphrase)
274
205
passfile.flush()
275
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
276
207
'--passphrase-file',
277
208
passfile.name]
278
209
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
283
214
if proc.returncode != 0:
284
215
raise PGPError(err)
285
216
return ciphertext
286
217
287
218
def decrypt(self, data, password):
288
219
passphrase = self.password_encode(password)
289
220
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
221
dir = self.tempdir) as passfile:
291
222
passfile.write(passphrase)
292
223
passfile.flush()
293
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
294
225
'--passphrase-file',
295
226
passfile.name]
296
227
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
301
232
if proc.returncode != 0:
302
233
raise PGPError(err)
303
234
return decrypted_plaintext
304
235
305
236
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
332
237
class AvahiError(Exception):
333
238
def __init__(self, value, *args, **kwargs):
334
239
self.value = value
344
249
pass
345
250
346
251
347
class AvahiService:
252
class AvahiService(object):
348
253
"""An Avahi (Zeroconf) service.
349
254
350
255
Attributes:
351
256
interface: integer; avahi.IF_UNSPEC or an interface index.
352
257
Used to optionally bind to the specified interface.
364
269
server: D-Bus Server
365
270
bus: dbus.SystemBus()
366
271
"""
367
272
368
273
def __init__(self,
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
379
284
self.interface = interface
380
285
self.name = name
381
286
self.type = servicetype
390
295
self.server = None
391
296
self.bus = bus
392
297
self.entry_group_state_changed_match = None
393
298
394
299
def rename(self, remove=True):
395
300
"""Derived from the Avahi example code"""
396
301
if self.rename_count >= self.max_renames:
416
321
logger.critical("D-Bus Exception", exc_info=error)
417
322
self.cleanup()
418
323
os._exit(1)
419
324
420
325
def remove(self):
421
326
"""Derived from the Avahi example code"""
422
327
if self.entry_group_state_changed_match is not None:
424
329
self.entry_group_state_changed_match = None
425
330
if self.group is not None:
426
331
self.group.Reset()
427
332
428
333
def add(self):
429
334
"""Derived from the Avahi example code"""
430
335
self.remove()
447
352
dbus.UInt16(self.port),
448
353
avahi.string_array_to_txt_array(self.TXT))
449
354
self.group.Commit()
450
355
451
356
def entry_group_state_changed(self, state, error):
452
357
"""Derived from the Avahi example code"""
453
358
logger.debug("Avahi entry group state change: %i", state)
454
359
455
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
361
logger.debug("Zeroconf service established.")
457
362
elif state == avahi.ENTRY_GROUP_COLLISION:
461
366
logger.critical("Avahi: Error in group state changed %s",
462
367
str(error))
463
368
raise AvahiGroupError("State changed: {!s}".format(error))
464
369
465
370
def cleanup(self):
466
371
"""Derived from the Avahi example code"""
467
372
if self.group is not None:
472
377
pass
473
378
self.group = None
474
379
self.remove()
475
380
476
381
def server_state_changed(self, state, error=None):
477
382
"""Derived from the Avahi example code"""
478
383
logger.debug("Avahi server state change: %i", state)
490
395
logger.error(bad_states[state] + ": %r", error)
491
396
self.cleanup()
492
397
elif state == avahi.SERVER_RUNNING:
493
try:
494
self.add()
495
except dbus.exceptions.DBusException as error:
496
if (error.get_dbus_name()
497
== "org.freedesktop.Avahi.CollisionError"):
498
logger.info("Local Zeroconf service name"
499
" collision.")
500
return self.rename(remove=False)
501
else:
502
logger.critical("D-Bus Exception", exc_info=error)
503
self.cleanup()
504
os._exit(1)
398
self.add()
505
399
else:
506
400
if error is None:
507
401
logger.debug("Unknown state: %r", state)
508
402
else:
509
403
logger.debug("Unknown state: %r: %r", state, error)
510
404
511
405
def activate(self):
512
406
"""Derived from the Avahi example code"""
513
407
if self.server is None:
524
418
class AvahiServiceToSyslog(AvahiService):
525
419
def rename(self, *args, **kwargs):
526
420
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
**kwargs)
421
ret = AvahiService.rename(self, *args, **kwargs)
529
422
syslogger.setFormatter(logging.Formatter(
530
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
531
424
.format(self.name)))
532
425
return ret
533
426
534
535
# Pretend that we have a GnuTLS module
536
class gnutls:
537
"""This isn't so much a class as it is a module-like namespace."""
538
539
library = ctypes.util.find_library("gnutls")
540
if library is None:
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
543
del library
544
545
# Unless otherwise indicated, the constants and types below are
546
# all from the gnutls/gnutls.h C header file.
547
548
# Constants
549
E_SUCCESS = 0
550
E_INTERRUPTED = -52
551
E_AGAIN = -28
552
CRT_OPENPGP = 2
553
CRT_RAWPK = 3
554
CLIENT = 2
555
SHUT_RDWR = 0
556
CRD_CERTIFICATE = 1
557
E_NO_CERTIFICATE_FOUND = -49
558
X509_FMT_DER = 0
559
NO_TICKETS = 1<<10
560
ENABLE_RAWPK = 1<<18
561
CTYPE_PEERS = 3
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
564
565
# Types
566
class session_int(ctypes.Structure):
567
_fields_ = []
568
session_t = ctypes.POINTER(session_int)
569
570
class certificate_credentials_st(ctypes.Structure):
571
_fields_ = []
572
certificate_credentials_t = ctypes.POINTER(
573
certificate_credentials_st)
574
certificate_type_t = ctypes.c_int
575
576
class datum_t(ctypes.Structure):
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
('size', ctypes.c_uint)]
579
580
class openpgp_crt_int(ctypes.Structure):
581
_fields_ = []
582
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
credentials_type_t = ctypes.c_int
586
transport_ptr_t = ctypes.c_void_p
587
close_request_t = ctypes.c_int
588
589
# Exceptions
590
class Error(Exception):
591
def __init__(self, message=None, code=None, args=()):
592
# Default usage is by a message string, but if a return
593
# code is passed, convert it to a string with
594
# gnutls.strerror()
595
self.code = code
596
if message is None and code is not None:
597
message = gnutls.strerror(code)
598
return super(gnutls.Error, self).__init__(
599
message, *args)
600
601
class CertificateSecurityError(Error):
602
pass
603
604
# Classes
605
class Credentials:
606
def __init__(self):
607
self._c_object = gnutls.certificate_credentials_t()
608
gnutls.certificate_allocate_credentials(
609
ctypes.byref(self._c_object))
610
self.type = gnutls.CRD_CERTIFICATE
611
612
def __del__(self):
613
gnutls.certificate_free_credentials(self._c_object)
614
615
class ClientSession:
616
def __init__(self, socket, credentials=None):
617
self._c_object = gnutls.session_t()
618
gnutls_flags = gnutls.CLIENT
619
if gnutls.check_version(b"3.5.6"):
620
gnutls_flags |= gnutls.NO_TICKETS
621
if gnutls.has_rawpk:
622
gnutls_flags |= gnutls.ENABLE_RAWPK
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
624
del gnutls_flags
625
gnutls.set_default_priority(self._c_object)
626
gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
gnutls.handshake_set_private_extensions(self._c_object,
628
True)
629
self.socket = socket
630
if credentials is None:
631
credentials = gnutls.Credentials()
632
gnutls.credentials_set(self._c_object, credentials.type,
633
ctypes.cast(credentials._c_object,
634
ctypes.c_void_p))
635
self.credentials = credentials
636
637
def __del__(self):
638
gnutls.deinit(self._c_object)
639
640
def handshake(self):
641
return gnutls.handshake(self._c_object)
642
643
def send(self, data):
644
data = bytes(data)
645
data_len = len(data)
646
while data_len > 0:
647
data_len -= gnutls.record_send(self._c_object,
648
data[-data_len:],
649
data_len)
650
651
def bye(self):
652
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
653
654
# Error handling functions
655
def _error_code(result):
656
"""A function to raise exceptions on errors, suitable
657
for the 'restype' attribute on ctypes functions"""
658
if result >= 0:
659
return result
660
if result == gnutls.E_NO_CERTIFICATE_FOUND:
661
raise gnutls.CertificateSecurityError(code=result)
662
raise gnutls.Error(code=result)
663
664
def _retry_on_error(result, func, arguments):
665
"""A function to retry on some errors, suitable
666
for the 'errcheck' attribute on ctypes functions"""
667
while result < 0:
668
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
669
return _error_code(result)
670
result = func(*arguments)
671
return result
672
673
# Unless otherwise indicated, the function declarations below are
674
# all from the gnutls/gnutls.h C header file.
675
676
# Functions
677
priority_set_direct = _library.gnutls_priority_set_direct
678
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
679
ctypes.POINTER(ctypes.c_char_p)]
680
priority_set_direct.restype = _error_code
681
682
init = _library.gnutls_init
683
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
684
init.restype = _error_code
685
686
set_default_priority = _library.gnutls_set_default_priority
687
set_default_priority.argtypes = [session_t]
688
set_default_priority.restype = _error_code
689
690
record_send = _library.gnutls_record_send
691
record_send.argtypes = [session_t, ctypes.c_void_p,
692
ctypes.c_size_t]
693
record_send.restype = ctypes.c_ssize_t
694
record_send.errcheck = _retry_on_error
695
696
certificate_allocate_credentials = (
697
_library.gnutls_certificate_allocate_credentials)
698
certificate_allocate_credentials.argtypes = [
699
ctypes.POINTER(certificate_credentials_t)]
700
certificate_allocate_credentials.restype = _error_code
701
702
certificate_free_credentials = (
703
_library.gnutls_certificate_free_credentials)
704
certificate_free_credentials.argtypes = [
705
certificate_credentials_t]
706
certificate_free_credentials.restype = None
707
708
handshake_set_private_extensions = (
709
_library.gnutls_handshake_set_private_extensions)
710
handshake_set_private_extensions.argtypes = [session_t,
711
ctypes.c_int]
712
handshake_set_private_extensions.restype = None
713
714
credentials_set = _library.gnutls_credentials_set
715
credentials_set.argtypes = [session_t, credentials_type_t,
716
ctypes.c_void_p]
717
credentials_set.restype = _error_code
718
719
strerror = _library.gnutls_strerror
720
strerror.argtypes = [ctypes.c_int]
721
strerror.restype = ctypes.c_char_p
722
723
certificate_type_get = _library.gnutls_certificate_type_get
724
certificate_type_get.argtypes = [session_t]
725
certificate_type_get.restype = _error_code
726
727
certificate_get_peers = _library.gnutls_certificate_get_peers
728
certificate_get_peers.argtypes = [session_t,
729
ctypes.POINTER(ctypes.c_uint)]
730
certificate_get_peers.restype = ctypes.POINTER(datum_t)
731
732
global_set_log_level = _library.gnutls_global_set_log_level
733
global_set_log_level.argtypes = [ctypes.c_int]
734
global_set_log_level.restype = None
735
736
global_set_log_function = _library.gnutls_global_set_log_function
737
global_set_log_function.argtypes = [log_func]
738
global_set_log_function.restype = None
739
740
deinit = _library.gnutls_deinit
741
deinit.argtypes = [session_t]
742
deinit.restype = None
743
744
handshake = _library.gnutls_handshake
745
handshake.argtypes = [session_t]
746
handshake.restype = _error_code
747
handshake.errcheck = _retry_on_error
748
749
transport_set_ptr = _library.gnutls_transport_set_ptr
750
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
751
transport_set_ptr.restype = None
752
753
bye = _library.gnutls_bye
754
bye.argtypes = [session_t, close_request_t]
755
bye.restype = _error_code
756
bye.errcheck = _retry_on_error
757
758
check_version = _library.gnutls_check_version
759
check_version.argtypes = [ctypes.c_char_p]
760
check_version.restype = ctypes.c_char_p
761
762
_need_version = b"3.3.0"
763
if check_version(_need_version) is None:
764
raise self.Error("Needs GnuTLS {} or later"
765
.format(_need_version))
766
767
_tls_rawpk_version = b"3.6.6"
768
has_rawpk = bool(check_version(_tls_rawpk_version))
769
770
if has_rawpk:
771
# Types
772
class pubkey_st(ctypes.Structure):
773
_fields = []
774
pubkey_t = ctypes.POINTER(pubkey_st)
775
776
x509_crt_fmt_t = ctypes.c_int
777
778
# All the function declarations below are from
779
# gnutls/abstract.h
780
pubkey_init = _library.gnutls_pubkey_init
781
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
782
pubkey_init.restype = _error_code
783
784
pubkey_import = _library.gnutls_pubkey_import
785
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
786
x509_crt_fmt_t]
787
pubkey_import.restype = _error_code
788
789
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
790
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
791
ctypes.POINTER(ctypes.c_ubyte),
792
ctypes.POINTER(ctypes.c_size_t)]
793
pubkey_get_key_id.restype = _error_code
794
795
pubkey_deinit = _library.gnutls_pubkey_deinit
796
pubkey_deinit.argtypes = [pubkey_t]
797
pubkey_deinit.restype = None
798
else:
799
# All the function declarations below are from
800
# gnutls/openpgp.h
801
802
openpgp_crt_init = _library.gnutls_openpgp_crt_init
803
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
804
openpgp_crt_init.restype = _error_code
805
806
openpgp_crt_import = _library.gnutls_openpgp_crt_import
807
openpgp_crt_import.argtypes = [openpgp_crt_t,
808
ctypes.POINTER(datum_t),
809
openpgp_crt_fmt_t]
810
openpgp_crt_import.restype = _error_code
811
812
openpgp_crt_verify_self = \
813
_library.gnutls_openpgp_crt_verify_self
814
openpgp_crt_verify_self.argtypes = [
815
openpgp_crt_t,
816
ctypes.c_uint,
817
ctypes.POINTER(ctypes.c_uint),
818
]
819
openpgp_crt_verify_self.restype = _error_code
820
821
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
822
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
823
openpgp_crt_deinit.restype = None
824
825
openpgp_crt_get_fingerprint = (
826
_library.gnutls_openpgp_crt_get_fingerprint)
827
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
828
ctypes.c_void_p,
829
ctypes.POINTER(
830
ctypes.c_size_t)]
831
openpgp_crt_get_fingerprint.restype = _error_code
832
833
if check_version(b"3.6.4"):
834
certificate_type_get2 = _library.gnutls_certificate_type_get2
835
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
836
certificate_type_get2.restype = _error_code
837
838
# Remove non-public functions
839
del _error_code, _retry_on_error
840
841
842
427
def call_pipe(connection, # : multiprocessing.Connection
843
428
func, *args, **kwargs):
844
429
"""This function is meant to be called by multiprocessing.Process
845
430
846
431
This function runs func(*args, **kwargs), and writes the resulting
847
432
return value on the provided multiprocessing.Connection.
848
433
"""
849
434
connection.send(func(*args, **kwargs))
850
435
connection.close()
851
436
852
853
class Client:
437
class Client(object):
854
438
"""A representation of a client host served by this server.
855
439
856
440
Attributes:
857
441
approved: bool(); 'None' if not yet approved/disapproved
858
442
approval_delay: datetime.timedelta(); Time to wait for approval
859
443
approval_duration: datetime.timedelta(); Duration of one approval
860
checker: multiprocessing.Process(); a running checker process used
861
to see if the client lives. 'None' if no process is
862
running.
863
checker_callback_tag: a GLib event source tag, or None
444
checker: subprocess.Popen(); a running checker process used
445
to see if the client lives.
446
'None' if no process is running.
447
checker_callback_tag: a gobject event source tag, or None
864
448
checker_command: string; External command which is run to check
865
449
if client lives. %() expansions are done at
866
450
runtime with vars(self) as dict, so that for
867
451
instance %(name)s can be used in the command.
868
checker_initiator_tag: a GLib event source tag, or None
452
checker_initiator_tag: a gobject event source tag, or None
869
453
created: datetime.datetime(); (UTC) object creation
870
454
client_structure: Object describing what attributes a client has
871
455
and is used for storing the client at exit
872
456
current_checker_command: string; current running checker_command
873
disable_initiator_tag: a GLib event source tag, or None
457
disable_initiator_tag: a gobject event source tag, or None
874
458
enabled: bool()
875
459
fingerprint: string (40 or 32 hexadecimal digits); used to
876
uniquely identify an OpenPGP client
877
key_id: string (64 hexadecimal digits); used to uniquely identify
878
a client using raw public keys
460
uniquely identify the client
879
461
host: string; available for use by the checker command
880
462
interval: datetime.timedelta(); How often to start a new checker
881
463
last_approval_request: datetime.datetime(); (UTC) or None
897
479
disabled, or None
898
480
server_settings: The server_settings dict from main()
899
481
"""
900
482
901
483
runtime_expansions = ("approval_delay", "approval_duration",
902
"created", "enabled", "expires", "key_id",
484
"created", "enabled", "expires",
903
485
"fingerprint", "host", "interval",
904
486
"last_approval_request", "last_checked_ok",
905
487
"last_enabled", "name", "timeout")
914
496
"approved_by_default": "True",
915
497
"enabled": "True",
916
498
}
917
499
918
500
@staticmethod
919
501
def config_parser(config):
920
502
"""Construct a new dict of client settings of this form:
927
509
for client_name in config.sections():
928
510
section = dict(config.items(client_name))
929
511
client = settings[client_name] = {}
930
512
931
513
client["host"] = section["host"]
932
514
# Reformat values from string types to Python types
933
515
client["approved_by_default"] = config.getboolean(
934
516
client_name, "approved_by_default")
935
517
client["enabled"] = config.getboolean(client_name,
936
518
"enabled")
937
938
# Uppercase and remove spaces from key_id and fingerprint
939
# for later comparison purposes with return value from the
940
# key_id() and fingerprint() functions
941
client["key_id"] = (section.get("key_id", "").upper()
942
.replace(" ", ""))
519
520
# Uppercase and remove spaces from fingerprint for later
521
# comparison purposes with return value from the
522
# fingerprint() function
943
523
client["fingerprint"] = (section["fingerprint"].upper()
944
524
.replace(" ", ""))
945
525
if "secret" in section:
946
client["secret"] = codecs.decode(section["secret"]
947
.encode("utf-8"),
948
"base64")
526
client["secret"] = section["secret"].decode("base64")
949
527
elif "secfile" in section:
950
528
with open(os.path.expanduser(os.path.expandvars
951
529
(section["secfile"])),
966
544
client["last_approval_request"] = None
967
545
client["last_checked_ok"] = None
968
546
client["last_checker_status"] = -2
969
547
970
548
return settings
971
972
def __init__(self, settings, name=None, server_settings=None):
549
550
def __init__(self, settings, name = None, server_settings=None):
973
551
self.name = name
974
552
if server_settings is None:
975
553
server_settings = {}
977
555
# adding all client settings
978
556
for setting, value in settings.items():
979
557
setattr(self, setting, value)
980
558
981
559
if self.enabled:
982
560
if not hasattr(self, "last_enabled"):
983
561
self.last_enabled = datetime.datetime.utcnow()
987
565
else:
988
566
self.last_enabled = None
989
567
self.expires = None
990
568
991
569
logger.debug("Creating client %r", self.name)
992
logger.debug(" Key ID: %s", self.key_id)
993
570
logger.debug(" Fingerprint: %s", self.fingerprint)
994
571
self.created = settings.get("created",
995
572
datetime.datetime.utcnow())
996
573
997
574
# attributes specific for this server instance
998
575
self.checker = None
999
576
self.checker_initiator_tag = None
1005
582
self.changedstate = multiprocessing_manager.Condition(
1006
583
multiprocessing_manager.Lock())
1007
584
self.client_structure = [attr
1008
for attr in self.__dict__.keys()
585
for attr in self.__dict__.iterkeys()
1009
586
if not attr.startswith("_")]
1010
587
self.client_structure.append("client_structure")
1011
588
1012
589
for name, t in inspect.getmembers(
1013
590
type(self), lambda obj: isinstance(obj, property)):
1014
591
if not name.startswith("_"):
1015
592
self.client_structure.append(name)
1016
593
1017
594
# Send notice to process children that client state has changed
1018
595
def send_changedstate(self):
1019
596
with self.changedstate:
1020
597
self.changedstate.notify_all()
1021
598
1022
599
def enable(self):
1023
600
"""Start this client's checker and timeout hooks"""
1024
601
if getattr(self, "enabled", False):
1029
606
self.last_enabled = datetime.datetime.utcnow()
1030
607
self.init_checker()
1031
608
self.send_changedstate()
1032
609
1033
610
def disable(self, quiet=True):
1034
611
"""Disable this client."""
1035
612
if not getattr(self, "enabled", False):
1037
614
if not quiet:
1038
615
logger.info("Disabling client %s", self.name)
1039
616
if getattr(self, "disable_initiator_tag", None) is not None:
1040
GLib.source_remove(self.disable_initiator_tag)
617
gobject.source_remove(self.disable_initiator_tag)
1041
618
self.disable_initiator_tag = None
1042
619
self.expires = None
1043
620
if getattr(self, "checker_initiator_tag", None) is not None:
1044
GLib.source_remove(self.checker_initiator_tag)
621
gobject.source_remove(self.checker_initiator_tag)
1045
622
self.checker_initiator_tag = None
1046
623
self.stop_checker()
1047
624
self.enabled = False
1048
625
if not quiet:
1049
626
self.send_changedstate()
1050
# Do not run this again if called by a GLib.timeout_add
627
# Do not run this again if called by a gobject.timeout_add
1051
628
return False
1052
629
1053
630
def __del__(self):
1054
631
self.disable()
1055
632
1056
633
def init_checker(self):
1057
634
# Schedule a new checker to be started an 'interval' from now,
1058
635
# and every interval from then on.
1059
636
if self.checker_initiator_tag is not None:
1060
GLib.source_remove(self.checker_initiator_tag)
1061
self.checker_initiator_tag = GLib.timeout_add(
1062
random.randrange(int(self.interval.total_seconds() * 1000
1063
+ 1)),
637
gobject.source_remove(self.checker_initiator_tag)
638
self.checker_initiator_tag = gobject.timeout_add(
639
int(self.interval.total_seconds() * 1000),
1064
640
self.start_checker)
1065
641
# Schedule a disable() when 'timeout' has passed
1066
642
if self.disable_initiator_tag is not None:
1067
GLib.source_remove(self.disable_initiator_tag)
1068
self.disable_initiator_tag = GLib.timeout_add(
643
gobject.source_remove(self.disable_initiator_tag)
644
self.disable_initiator_tag = gobject.timeout_add(
1069
645
int(self.timeout.total_seconds() * 1000), self.disable)
1070
646
# Also start a new checker *right now*.
1071
647
self.start_checker()
1072
648
1073
649
def checker_callback(self, source, condition, connection,
1074
650
command):
1075
651
"""The checker has completed, so take appropriate actions."""
652
self.checker_callback_tag = None
653
self.checker = None
1076
654
# Read return code from connection (see call_pipe)
1077
655
returncode = connection.recv()
1078
656
connection.close()
1079
if self.checker is not None:
1080
self.checker.join()
1081
self.checker_callback_tag = None
1082
self.checker = None
1083
657
1084
658
if returncode >= 0:
1085
659
self.last_checker_status = returncode
1086
660
self.last_checker_signal = None
1096
670
logger.warning("Checker for %(name)s crashed?",
1097
671
vars(self))
1098
672
return False
1099
673
1100
674
def checked_ok(self):
1101
675
"""Assert that the client has been seen, alive and well."""
1102
676
self.last_checked_ok = datetime.datetime.utcnow()
1103
677
self.last_checker_status = 0
1104
678
self.last_checker_signal = None
1105
679
self.bump_timeout()
1106
680
1107
681
def bump_timeout(self, timeout=None):
1108
682
"""Bump up the timeout for this client."""
1109
683
if timeout is None:
1110
684
timeout = self.timeout
1111
685
if self.disable_initiator_tag is not None:
1112
GLib.source_remove(self.disable_initiator_tag)
686
gobject.source_remove(self.disable_initiator_tag)
1113
687
self.disable_initiator_tag = None
1114
688
if getattr(self, "enabled", False):
1115
self.disable_initiator_tag = GLib.timeout_add(
689
self.disable_initiator_tag = gobject.timeout_add(
1116
690
int(timeout.total_seconds() * 1000), self.disable)
1117
691
self.expires = datetime.datetime.utcnow() + timeout
1118
692
1119
693
def need_approval(self):
1120
694
self.last_approval_request = datetime.datetime.utcnow()
1121
695
1122
696
def start_checker(self):
1123
697
"""Start a new checker subprocess if one is not running.
1124
698
1125
699
If a checker already exists, leave it running and do
1126
700
nothing."""
1127
701
# The reason for not killing a running checker is that if we
1132
706
# checkers alone, the checker would have to take more time
1133
707
# than 'timeout' for the client to be disabled, which is as it
1134
708
# should be.
1135
709
1136
710
if self.checker is not None and not self.checker.is_alive():
1137
711
logger.warning("Checker was not alive; joining")
1138
712
self.checker.join()
1141
715
if self.checker is None:
1142
716
# Escape attributes for the shell
1143
717
escaped_attrs = {
1144
attr: shlex.quote(str(getattr(self, attr)))
1145
for attr in self.runtime_expansions}
718
attr: re.escape(str(getattr(self, attr)))
719
for attr in self.runtime_expansions }
1146
720
try:
1147
721
command = self.checker_command % escaped_attrs
1148
722
except TypeError as error:
1160
734
# The exception is when not debugging but nevertheless
1161
735
# running in the foreground; use the previously
1162
736
# created wnull.
1163
popen_args = {"close_fds": True,
1164
"shell": True,
1165
"cwd": "/"}
737
popen_args = { "close_fds": True,
738
"shell": True,
739
"cwd": "/" }
1166
740
if (not self.server_settings["debug"]
1167
741
and self.server_settings["foreground"]):
1168
742
popen_args.update({"stdout": wnull,
1169
"stderr": wnull})
1170
pipe = multiprocessing.Pipe(duplex=False)
743
"stderr": wnull })
744
pipe = multiprocessing.Pipe(duplex = False)
1171
745
self.checker = multiprocessing.Process(
1172
target=call_pipe,
1173
args=(pipe[1], subprocess.call, command),
1174
kwargs=popen_args)
746
target = call_pipe,
747
args = (pipe[1], subprocess.call, command),
748
kwargs = popen_args)
1175
749
self.checker.start()
1176
self.checker_callback_tag = GLib.io_add_watch(
1177
GLib.IOChannel.unix_new(pipe[0].fileno()),
1178
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
750
self.checker_callback_tag = gobject.io_add_watch(
751
pipe[0].fileno(), gobject.IO_IN,
1179
752
self.checker_callback, pipe[0], command)
1180
# Re-run this periodically if run by GLib.timeout_add
753
# Re-run this periodically if run by gobject.timeout_add
1181
754
return True
1182
755
1183
756
def stop_checker(self):
1184
757
"""Force the checker process, if any, to stop."""
1185
758
if self.checker_callback_tag:
1186
GLib.source_remove(self.checker_callback_tag)
759
gobject.source_remove(self.checker_callback_tag)
1187
760
self.checker_callback_tag = None
1188
761
if getattr(self, "checker", None) is None:
1189
762
return
1198
771
byte_arrays=False):
1199
772
"""Decorators for marking methods of a DBusObjectWithProperties to
1200
773
become properties on the D-Bus.
1201
774
1202
775
The decorated method will be called with no arguments by "Get"
1203
776
and with one argument by "Set".
1204
777
1205
778
The parameters, where they are supported, are the same as
1206
779
dbus.service.method, except there is only "signature", since the
1207
780
type from Get() and the type sent to Set() is the same.
1211
784
if byte_arrays and signature != "ay":
1212
785
raise ValueError("Byte arrays not supported for non-'ay'"
1213
786
" signature {!r}".format(signature))
1214
787
1215
788
def decorator(func):
1216
789
func._dbus_is_property = True
1217
790
func._dbus_interface = dbus_interface
1220
793
func._dbus_name = func.__name__
1221
794
if func._dbus_name.endswith("_dbus_property"):
1222
795
func._dbus_name = func._dbus_name[:-14]
1223
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
796
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1224
797
return func
1225
798
1226
799
return decorator
1227
800
1228
801
1229
802
def dbus_interface_annotations(dbus_interface):
1230
803
"""Decorator for marking functions returning interface annotations
1231
804
1232
805
Usage:
1233
806
1234
807
@dbus_interface_annotations("org.example.Interface")
1235
808
def _foo(self): # Function name does not matter
1236
809
return {"org.freedesktop.DBus.Deprecated": "true",
1237
810
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1238
811
"false"}
1239
812
"""
1240
813
1241
814
def decorator(func):
1242
815
func._dbus_is_interface = True
1243
816
func._dbus_interface = dbus_interface
1244
817
func._dbus_name = dbus_interface
1245
818
return func
1246
819
1247
820
return decorator
1248
821
1249
822
1250
823
def dbus_annotations(annotations):
1251
824
"""Decorator to annotate D-Bus methods, signals or properties
1252
825
Usage:
1253
826
1254
827
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1255
828
"org.freedesktop.DBus.Property."
1256
829
"EmitsChangedSignal": "false"})
1258
831
access="r")
1259
832
def Property_dbus_property(self):
1260
833
return dbus.Boolean(False)
1261
1262
See also the DBusObjectWithAnnotations class.
1263
834
"""
1264
835
1265
836
def decorator(func):
1266
837
func._dbus_annotations = annotations
1267
838
return func
1268
839
1269
840
return decorator
1270
841
1271
842
1287
858
pass
1288
859
1289
860
1290
class DBusObjectWithAnnotations(dbus.service.Object):
1291
"""A D-Bus object with annotations.
1292
1293
Classes inheriting from this can use the dbus_annotations
1294
decorator to add annotations to methods or signals.
861
class DBusObjectWithProperties(dbus.service.Object):
862
"""A D-Bus object with properties.
863
864
Classes inheriting from this can use the dbus_service_property
865
decorator to expose methods as D-Bus properties. It exposes the
866
standard Get(), Set(), and GetAll() methods on the D-Bus.
1295
867
"""
1296
868
1297
869
@staticmethod
1298
870
def _is_dbus_thing(thing):
1299
871
"""Returns a function testing if an attribute is a D-Bus thing
1300
872
1301
873
If called like _is_dbus_thing("method") it returns a function
1302
874
suitable for use as predicate to inspect.getmembers().
1303
875
"""
1304
876
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1305
877
False)
1306
878
1307
879
def _get_all_dbus_things(self, thing):
1308
880
"""Returns a generator of (name, attribute) pairs
1309
881
"""
1312
884
for cls in self.__class__.__mro__
1313
885
for name, athing in
1314
886
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1315
1316
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1317
out_signature="s",
1318
path_keyword='object_path',
1319
connection_keyword='connection')
1320
def Introspect(self, object_path, connection):
1321
"""Overloading of standard D-Bus method.
1322
1323
Inserts annotation tags on methods and signals.
1324
"""
1325
xmlstring = dbus.service.Object.Introspect(self, object_path,
1326
connection)
1327
try:
1328
document = xml.dom.minidom.parseString(xmlstring)
1329
1330
for if_tag in document.getElementsByTagName("interface"):
1331
# Add annotation tags
1332
for typ in ("method", "signal"):
1333
for tag in if_tag.getElementsByTagName(typ):
1334
annots = dict()
1335
for name, prop in (self.
1336
_get_all_dbus_things(typ)):
1337
if (name == tag.getAttribute("name")
1338
and prop._dbus_interface
1339
== if_tag.getAttribute("name")):
1340
annots.update(getattr(
1341
prop, "_dbus_annotations", {}))
1342
for name, value in annots.items():
1343
ann_tag = document.createElement(
1344
"annotation")
1345
ann_tag.setAttribute("name", name)
1346
ann_tag.setAttribute("value", value)
1347
tag.appendChild(ann_tag)
1348
# Add interface annotation tags
1349
for annotation, value in dict(
1350
itertools.chain.from_iterable(
1351
annotations().items()
1352
for name, annotations
1353
in self._get_all_dbus_things("interface")
1354
if name == if_tag.getAttribute("name")
1355
)).items():
1356
ann_tag = document.createElement("annotation")
1357
ann_tag.setAttribute("name", annotation)
1358
ann_tag.setAttribute("value", value)
1359
if_tag.appendChild(ann_tag)
1360
# Fix argument name for the Introspect method itself
1361
if (if_tag.getAttribute("name")
1362
== dbus.INTROSPECTABLE_IFACE):
1363
for cn in if_tag.getElementsByTagName("method"):
1364
if cn.getAttribute("name") == "Introspect":
1365
for arg in cn.getElementsByTagName("arg"):
1366
if (arg.getAttribute("direction")
1367
== "out"):
1368
arg.setAttribute("name",
1369
"xml_data")
1370
xmlstring = document.toxml("utf-8")
1371
document.unlink()
1372
except (AttributeError, xml.dom.DOMException,
1373
xml.parsers.expat.ExpatError) as error:
1374
logger.error("Failed to override Introspection method",
1375
exc_info=error)
1376
return xmlstring
1377
1378
1379
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1380
"""A D-Bus object with properties.
1381
1382
Classes inheriting from this can use the dbus_service_property
1383
decorator to expose methods as D-Bus properties. It exposes the
1384
standard Get(), Set(), and GetAll() methods on the D-Bus.
1385
"""
1386
887
1387
888
def _get_dbus_property(self, interface_name, property_name):
1388
889
"""Returns a bound method if one exists which is a D-Bus
1389
890
property with the specified name and interface.
1394
895
if (value._dbus_name == property_name
1395
896
and value._dbus_interface == interface_name):
1396
897
return value.__get__(self)
1397
898
1398
899
# No such property
1399
900
raise DBusPropertyNotFound("{}:{}.{}".format(
1400
901
self.dbus_object_path, interface_name, property_name))
1401
1402
@classmethod
1403
def _get_all_interface_names(cls):
1404
"""Get a sequence of all interfaces supported by an object"""
1405
return (name for name in set(getattr(getattr(x, attr),
1406
"_dbus_interface", None)
1407
for x in (inspect.getmro(cls))
1408
for attr in dir(x))
1409
if name is not None)
1410
902
1411
903
@dbus.service.method(dbus.PROPERTIES_IFACE,
1412
904
in_signature="ss",
1413
905
out_signature="v")
1421
913
if not hasattr(value, "variant_level"):
1422
914
return value
1423
915
return type(value)(value, variant_level=value.variant_level+1)
1424
916
1425
917
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1426
918
def Set(self, interface_name, property_name, value):
1427
919
"""Standard D-Bus property Set() method, see D-Bus standard.
1436
928
raise ValueError("Byte arrays not supported for non-"
1437
929
"'ay' signature {!r}"
1438
930
.format(prop._dbus_signature))
1439
value = dbus.ByteArray(bytes(value))
931
value = dbus.ByteArray(b''.join(chr(byte)
932
for byte in value))
1440
933
prop(value)
1441
934
1442
935
@dbus.service.method(dbus.PROPERTIES_IFACE,
1443
936
in_signature="s",
1444
937
out_signature="a{sv}")
1445
938
def GetAll(self, interface_name):
1446
939
"""Standard D-Bus property GetAll() method, see D-Bus
1447
940
standard.
1448
941
1449
942
Note: Will not include properties with access="write".
1450
943
"""
1451
944
properties = {}
1462
955
properties[name] = value
1463
956
continue
1464
957
properties[name] = type(value)(
1465
value, variant_level=value.variant_level + 1)
958
value, variant_level = value.variant_level + 1)
1466
959
return dbus.Dictionary(properties, signature="sv")
1467
960
1468
961
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1469
962
def PropertiesChanged(self, interface_name, changed_properties,
1470
963
invalidated_properties):
1472
965
standard.
1473
966
"""
1474
967
pass
1475
968
1476
969
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1477
970
out_signature="s",
1478
971
path_keyword='object_path',
1479
972
connection_keyword='connection')
1480
973
def Introspect(self, object_path, connection):
1481
974
"""Overloading of standard D-Bus method.
1482
975
1483
976
Inserts property tags and interface annotation tags.
1484
977
"""
1485
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1486
object_path,
1487
connection)
978
xmlstring = dbus.service.Object.Introspect(self, object_path,
979
connection)
1488
980
try:
1489
981
document = xml.dom.minidom.parseString(xmlstring)
1490
982
1491
983
def make_tag(document, name, prop):
1492
984
e = document.createElement("property")
1493
985
e.setAttribute("name", name)
1494
986
e.setAttribute("type", prop._dbus_signature)
1495
987
e.setAttribute("access", prop._dbus_access)
1496
988
return e
1497
989
1498
990
for if_tag in document.getElementsByTagName("interface"):
1499
991
# Add property tags
1500
992
for tag in (make_tag(document, name, prop)
1503
995
if prop._dbus_interface
1504
996
== if_tag.getAttribute("name")):
1505
997
if_tag.appendChild(tag)
1506
# Add annotation tags for properties
1507
for tag in if_tag.getElementsByTagName("property"):
1508
annots = dict()
1509
for name, prop in self._get_all_dbus_things(
1510
"property"):
1511
if (name == tag.getAttribute("name")
1512
and prop._dbus_interface
1513
== if_tag.getAttribute("name")):
1514
annots.update(getattr(
1515
prop, "_dbus_annotations", {}))
1516
for name, value in annots.items():
1517
ann_tag = document.createElement(
1518
"annotation")
1519
ann_tag.setAttribute("name", name)
1520
ann_tag.setAttribute("value", value)
1521
tag.appendChild(ann_tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr(
1008
prop, "_dbus_annotations", {}))
1009
for name, value in annots.items():
1010
ann_tag = document.createElement(
1011
"annotation")
1012
ann_tag.setAttribute("name", name)
1013
ann_tag.setAttribute("value", value)
1014
tag.appendChild(ann_tag)
1015
# Add interface annotation tags
1016
for annotation, value in dict(
1017
itertools.chain.from_iterable(
1018
annotations().items()
1019
for name, annotations
1020
in self._get_all_dbus_things("interface")
1021
if name == if_tag.getAttribute("name")
1022
)).items():
1023
ann_tag = document.createElement("annotation")
1024
ann_tag.setAttribute("name", annotation)
1025
ann_tag.setAttribute("value", value)
1026
if_tag.appendChild(ann_tag)
1522
1027
# Add the names to the return values for the
1523
1028
# "org.freedesktop.DBus.Properties" methods
1524
1029
if (if_tag.getAttribute("name")
1543
1048
return xmlstring
1544
1049
1545
1050
1546
try:
1547
dbus.OBJECT_MANAGER_IFACE
1548
except AttributeError:
1549
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1550
1551
1552
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1553
"""A D-Bus object with an ObjectManager.
1554
1555
Classes inheriting from this exposes the standard
1556
GetManagedObjects call and the InterfacesAdded and
1557
InterfacesRemoved signals on the standard
1558
"org.freedesktop.DBus.ObjectManager" interface.
1559
1560
Note: No signals are sent automatically; they must be sent
1561
manually.
1562
"""
1563
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1564
out_signature="a{oa{sa{sv}}}")
1565
def GetManagedObjects(self):
1566
"""This function must be overridden"""
1567
raise NotImplementedError()
1568
1569
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1570
signature="oa{sa{sv}}")
1571
def InterfacesAdded(self, object_path, interfaces_and_properties):
1572
pass
1573
1574
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1575
def InterfacesRemoved(self, object_path, interfaces):
1576
pass
1577
1578
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1579
out_signature="s",
1580
path_keyword='object_path',
1581
connection_keyword='connection')
1582
def Introspect(self, object_path, connection):
1583
"""Overloading of standard D-Bus method.
1584
1585
Override return argument name of GetManagedObjects to be
1586
"objpath_interfaces_and_properties"
1587
"""
1588
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1589
object_path,
1590
connection)
1591
try:
1592
document = xml.dom.minidom.parseString(xmlstring)
1593
1594
for if_tag in document.getElementsByTagName("interface"):
1595
# Fix argument name for the GetManagedObjects method
1596
if (if_tag.getAttribute("name")
1597
== dbus.OBJECT_MANAGER_IFACE):
1598
for cn in if_tag.getElementsByTagName("method"):
1599
if (cn.getAttribute("name")
1600
== "GetManagedObjects"):
1601
for arg in cn.getElementsByTagName("arg"):
1602
if (arg.getAttribute("direction")
1603
== "out"):
1604
arg.setAttribute(
1605
"name",
1606
"objpath_interfaces"
1607
"_and_properties")
1608
xmlstring = document.toxml("utf-8")
1609
document.unlink()
1610
except (AttributeError, xml.dom.DOMException,
1611
xml.parsers.expat.ExpatError) as error:
1612
logger.error("Failed to override Introspection method",
1613
exc_info=error)
1614
return xmlstring
1615
1616
1617
1051
def datetime_to_dbus(dt, variant_level=0):
1618
1052
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1619
1053
if dt is None:
1620
return dbus.String("", variant_level=variant_level)
1054
return dbus.String("", variant_level = variant_level)
1621
1055
return dbus.String(dt.isoformat(), variant_level=variant_level)
1622
1056
1623
1057
1626
1060
dbus.service.Object, it will add alternate D-Bus attributes with
1627
1061
interface names according to the "alt_interface_names" mapping.
1628
1062
Usage:
1629
1063
1630
1064
@alternate_dbus_interfaces({"org.example.Interface":
1631
1065
"net.example.AlternateInterface"})
1632
1066
class SampleDBusObject(dbus.service.Object):
1633
1067
@dbus.service.method("org.example.Interface")
1634
1068
def SampleDBusMethod():
1635
1069
pass
1636
1070
1637
1071
The above "SampleDBusMethod" on "SampleDBusObject" will be
1638
1072
reachable via two interfaces: "org.example.Interface" and
1639
1073
"net.example.AlternateInterface", the latter of which will have
1640
1074
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1641
1075
"true", unless "deprecate" is passed with a False value.
1642
1076
1643
1077
This works for methods and signals, and also for D-Bus properties
1644
1078
(from DBusObjectWithProperties) and interfaces (from the
1645
1079
dbus_interface_annotations decorator).
1646
1080
"""
1647
1081
1648
1082
def wrapper(cls):
1649
1083
for orig_interface_name, alt_interface_name in (
1650
1084
alt_interface_names.items()):
1665
1099
interface_names.add(alt_interface)
1666
1100
# Is this a D-Bus signal?
1667
1101
if getattr(attribute, "_dbus_is_signal", False):
1668
# Extract the original non-method undecorated
1669
# function by black magic
1670
1102
if sys.version_info.major == 2:
1103
# Extract the original non-method undecorated
1104
# function by black magic
1671
1105
nonmethod_func = (dict(
1672
1106
zip(attribute.func_code.co_freevars,
1673
1107
attribute.__closure__))
1674
1108
["func"].cell_contents)
1675
1109
else:
1676
nonmethod_func = (dict(
1677
zip(attribute.__code__.co_freevars,
1678
attribute.__closure__))
1679
["func"].cell_contents)
1110
nonmethod_func = attribute
1680
1111
# Create a new, but exactly alike, function
1681
1112
# object, and decorate it to be a new D-Bus signal
1682
1113
# with the alternate D-Bus interface name
1683
new_function = copy_function(nonmethod_func)
1114
if sys.version_info.major == 2:
1115
new_function = types.FunctionType(
1116
nonmethod_func.func_code,
1117
nonmethod_func.func_globals,
1118
nonmethod_func.func_name,
1119
nonmethod_func.func_defaults,
1120
nonmethod_func.func_closure)
1121
else:
1122
new_function = types.FunctionType(
1123
nonmethod_func.__code__,
1124
nonmethod_func.__globals__,
1125
nonmethod_func.__name__,
1126
nonmethod_func.__defaults__,
1127
nonmethod_func.__closure__)
1684
1128
new_function = (dbus.service.signal(
1685
1129
alt_interface,
1686
1130
attribute._dbus_signature)(new_function))
1690
1134
attribute._dbus_annotations)
1691
1135
except AttributeError:
1692
1136
pass
1693
1694
1137
# Define a creator of a function to call both the
1695
1138
# original and alternate functions, so both the
1696
1139
# original and alternate signals gets sent when
1699
1142
"""This function is a scope container to pass
1700
1143
func1 and func2 to the "call_both" function
1701
1144
outside of its arguments"""
1702
1703
@functools.wraps(func2)
1145
1704
1146
def call_both(*args, **kwargs):
1705
1147
"""This function will emit two D-Bus
1706
1148
signals by calling func1 and func2"""
1707
1149
func1(*args, **kwargs)
1708
1150
func2(*args, **kwargs)
1709
# Make wrapper function look like a D-Bus
1710
# signal
1711
for name, attr in inspect.getmembers(func2):
1712
if name.startswith("_dbus_"):
1713
setattr(call_both, name, attr)
1714
1151
1715
1152
return call_both
1716
1153
# Create the "call_both" function and add it to
1717
1154
# the class
1727
1164
alt_interface,
1728
1165
attribute._dbus_in_signature,
1729
1166
attribute._dbus_out_signature)
1730
(copy_function(attribute)))
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1731
1172
# Copy annotations, if any
1732
1173
try:
1733
1174
attr[attrname]._dbus_annotations = dict(
1745
1186
attribute._dbus_access,
1746
1187
attribute._dbus_get_args_options
1747
1188
["byte_arrays"])
1748
(copy_function(attribute)))
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1749
1195
# Copy annotations, if any
1750
1196
try:
1751
1197
attr[attrname]._dbus_annotations = dict(
1760
1206
# to the class.
1761
1207
attr[attrname] = (
1762
1208
dbus_interface_annotations(alt_interface)
1763
(copy_function(attribute)))
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1764
1214
if deprecate:
1765
1215
# Deprecate all alternate interfaces
1766
iname = "_AlternateDBusNames_interface_annotation{}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1767
1217
for interface_name in interface_names:
1768
1218
1769
1219
@dbus_interface_annotations(interface_name)
1770
1220
def func(self):
1771
return {"org.freedesktop.DBus.Deprecated":
1772
"true"}
1221
return { "org.freedesktop.DBus.Deprecated":
1222
"true" }
1773
1223
# Find an unused name
1774
1224
for aname in (iname.format(i)
1775
1225
for i in itertools.count()):
1779
1229
if interface_names:
1780
1230
# Replace the class with a new subclass of it with
1781
1231
# methods, signals, etc. as created above.
1782
if sys.version_info.major == 2:
1783
cls = type(b"{}Alternate".format(cls.__name__),
1784
(cls, ), attr)
1785
else:
1786
cls = type("{}Alternate".format(cls.__name__),
1787
(cls, ), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1788
1234
return cls
1789
1235
1790
1236
return wrapper
1791
1237
1792
1238
1794
1240
"se.bsnet.fukt.Mandos"})
1795
1241
class ClientDBus(Client, DBusObjectWithProperties):
1796
1242
"""A Client class using D-Bus
1797
1243
1798
1244
Attributes:
1799
1245
dbus_object_path: dbus.ObjectPath
1800
1246
bus: dbus.SystemBus()
1801
1247
"""
1802
1248
1803
1249
runtime_expansions = (Client.runtime_expansions
1804
1250
+ ("dbus_object_path", ))
1805
1251
1806
1252
_interface = "se.recompile.Mandos.Client"
1807
1253
1808
1254
# dbus.service.Object doesn't use super(), so we can't either.
1809
1810
def __init__(self, bus=None, *args, **kwargs):
1255
1256
def __init__(self, bus = None, *args, **kwargs):
1811
1257
self.bus = bus
1812
1258
Client.__init__(self, *args, **kwargs)
1813
1259
# Only now, when this client is initialized, can it show up on
1819
1265
"/clients/" + client_object_name)
1820
1266
DBusObjectWithProperties.__init__(self, self.bus,
1821
1267
self.dbus_object_path)
1822
1268
1823
1269
def notifychangeproperty(transform_func, dbus_name,
1824
1270
type_func=lambda x: x,
1825
1271
variant_level=1,
1827
1273
_interface=_interface):
1828
1274
""" Modify a variable so that it's a property which announces
1829
1275
its changes to DBus.
1830
1276
1831
1277
transform_fun: Function that takes a value and a variant_level
1832
1278
and transforms it to a D-Bus type.
1833
1279
dbus_name: D-Bus name of the variable
1836
1282
variant_level: D-Bus variant level. Default: 1
1837
1283
"""
1838
1284
attrname = "_{}".format(dbus_name)
1839
1285
1840
1286
def setter(self, value):
1841
1287
if hasattr(self, "dbus_object_path"):
1842
1288
if (not hasattr(self, attrname) or
1849
1295
else:
1850
1296
dbus_value = transform_func(
1851
1297
type_func(value),
1852
variant_level=variant_level)
1298
variant_level = variant_level)
1853
1299
self.PropertyChanged(dbus.String(dbus_name),
1854
1300
dbus_value)
1855
1301
self.PropertiesChanged(
1856
1302
_interface,
1857
dbus.Dictionary({dbus.String(dbus_name):
1858
dbus_value}),
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1859
1305
dbus.Array())
1860
1306
setattr(self, attrname, value)
1861
1307
1862
1308
return property(lambda self: getattr(self, attrname), setter)
1863
1309
1864
1310
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1865
1311
approvals_pending = notifychangeproperty(dbus.Boolean,
1866
1312
"ApprovalPending",
1867
type_func=bool)
1313
type_func = bool)
1868
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1869
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1870
1316
"LastEnabled")
1871
1317
checker = notifychangeproperty(
1872
1318
dbus.Boolean, "CheckerRunning",
1873
type_func=lambda checker: checker is not None)
1319
type_func = lambda checker: checker is not None)
1874
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1875
1321
"LastCheckedOK")
1876
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1881
1327
"ApprovedByDefault")
1882
1328
approval_delay = notifychangeproperty(
1883
1329
dbus.UInt64, "ApprovalDelay",
1884
type_func=lambda td: td.total_seconds() * 1000)
1330
type_func = lambda td: td.total_seconds() * 1000)
1885
1331
approval_duration = notifychangeproperty(
1886
1332
dbus.UInt64, "ApprovalDuration",
1887
type_func=lambda td: td.total_seconds() * 1000)
1333
type_func = lambda td: td.total_seconds() * 1000)
1888
1334
host = notifychangeproperty(dbus.String, "Host")
1889
1335
timeout = notifychangeproperty(
1890
1336
dbus.UInt64, "Timeout",
1891
type_func=lambda td: td.total_seconds() * 1000)
1337
type_func = lambda td: td.total_seconds() * 1000)
1892
1338
extended_timeout = notifychangeproperty(
1893
1339
dbus.UInt64, "ExtendedTimeout",
1894
type_func=lambda td: td.total_seconds() * 1000)
1340
type_func = lambda td: td.total_seconds() * 1000)
1895
1341
interval = notifychangeproperty(
1896
1342
dbus.UInt64, "Interval",
1897
type_func=lambda td: td.total_seconds() * 1000)
1343
type_func = lambda td: td.total_seconds() * 1000)
1898
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1899
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1900
1346
invalidate_only=True)
1901
1347
1902
1348
del notifychangeproperty
1903
1349
1904
1350
def __del__(self, *args, **kwargs):
1905
1351
try:
1906
1352
self.remove_from_connection()
1909
1355
if hasattr(DBusObjectWithProperties, "__del__"):
1910
1356
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1911
1357
Client.__del__(self, *args, **kwargs)
1912
1358
1913
1359
def checker_callback(self, source, condition,
1914
1360
connection, command, *args, **kwargs):
1915
1361
ret = Client.checker_callback(self, source, condition,
1919
1365
if exitstatus >= 0:
1920
1366
# Emit D-Bus signal
1921
1367
self.CheckerCompleted(dbus.Int16(exitstatus),
1922
# This is specific to GNU libC
1923
dbus.Int64(exitstatus << 8),
1368
dbus.Int64(0),
1924
1369
dbus.String(command))
1925
1370
else:
1926
1371
# Emit D-Bus signal
1927
1372
self.CheckerCompleted(dbus.Int16(-1),
1928
1373
dbus.Int64(
1929
# This is specific to GNU libC
1930
(exitstatus << 8)
1931
| self.last_checker_signal),
1374
self.last_checker_signal),
1932
1375
dbus.String(command))
1933
1376
return ret
1934
1377
1935
1378
def start_checker(self, *args, **kwargs):
1936
1379
old_checker_pid = getattr(self.checker, "pid", None)
1937
1380
r = Client.start_checker(self, *args, **kwargs)
1941
1384
# Emit D-Bus signal
1942
1385
self.CheckerStarted(self.current_checker_command)
1943
1386
return r
1944
1387
1945
1388
def _reset_approved(self):
1946
1389
self.approved = None
1947
1390
return False
1948
1391
1949
1392
def approve(self, value=True):
1950
1393
self.approved = value
1951
GLib.timeout_add(int(self.approval_duration.total_seconds()
1952
* 1000), self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1953
1396
self.send_changedstate()
1954
1955
# D-Bus methods, signals & properties
1956
1957
# Interfaces
1958
1959
# Signals
1960
1397
1398
## D-Bus methods, signals & properties
1399
1400
## Interfaces
1401
1402
## Signals
1403
1961
1404
# CheckerCompleted - signal
1962
1405
@dbus.service.signal(_interface, signature="nxs")
1963
1406
def CheckerCompleted(self, exitcode, waitstatus, command):
1964
1407
"D-Bus signal"
1965
1408
pass
1966
1409
1967
1410
# CheckerStarted - signal
1968
1411
@dbus.service.signal(_interface, signature="s")
1969
1412
def CheckerStarted(self, command):
1970
1413
"D-Bus signal"
1971
1414
pass
1972
1415
1973
1416
# PropertyChanged - signal
1974
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1975
1418
@dbus.service.signal(_interface, signature="sv")
1976
1419
def PropertyChanged(self, property, value):
1977
1420
"D-Bus signal"
1978
1421
pass
1979
1422
1980
1423
# GotSecret - signal
1981
1424
@dbus.service.signal(_interface)
1982
1425
def GotSecret(self):
1985
1428
server to mandos-client
1986
1429
"""
1987
1430
pass
1988
1431
1989
1432
# Rejected - signal
1990
1433
@dbus.service.signal(_interface, signature="s")
1991
1434
def Rejected(self, reason):
1992
1435
"D-Bus signal"
1993
1436
pass
1994
1437
1995
1438
# NeedApproval - signal
1996
1439
@dbus.service.signal(_interface, signature="tb")
1997
1440
def NeedApproval(self, timeout, default):
1998
1441
"D-Bus signal"
1999
1442
return self.need_approval()
2000
2001
# Methods
2002
1443
1444
## Methods
1445
2003
1446
# Approve - method
2004
1447
@dbus.service.method(_interface, in_signature="b")
2005
1448
def Approve(self, value):
2006
1449
self.approve(value)
2007
1450
2008
1451
# CheckedOK - method
2009
1452
@dbus.service.method(_interface)
2010
1453
def CheckedOK(self):
2011
1454
self.checked_ok()
2012
1455
2013
1456
# Enable - method
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2015
1457
@dbus.service.method(_interface)
2016
1458
def Enable(self):
2017
1459
"D-Bus method"
2018
1460
self.enable()
2019
1461
2020
1462
# StartChecker - method
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2022
1463
@dbus.service.method(_interface)
2023
1464
def StartChecker(self):
2024
1465
"D-Bus method"
2025
1466
self.start_checker()
2026
1467
2027
1468
# Disable - method
2028
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2029
1469
@dbus.service.method(_interface)
2030
1470
def Disable(self):
2031
1471
"D-Bus method"
2032
1472
self.disable()
2033
1473
2034
1474
# StopChecker - method
2035
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2036
1475
@dbus.service.method(_interface)
2037
1476
def StopChecker(self):
2038
1477
self.stop_checker()
2039
2040
# Properties
2041
1478
1479
## Properties
1480
2042
1481
# ApprovalPending - property
2043
1482
@dbus_service_property(_interface, signature="b", access="read")
2044
1483
def ApprovalPending_dbus_property(self):
2045
1484
return dbus.Boolean(bool(self.approvals_pending))
2046
1485
2047
1486
# ApprovedByDefault - property
2048
1487
@dbus_service_property(_interface,
2049
1488
signature="b",
2052
1491
if value is None: # get
2053
1492
return dbus.Boolean(self.approved_by_default)
2054
1493
self.approved_by_default = bool(value)
2055
1494
2056
1495
# ApprovalDelay - property
2057
1496
@dbus_service_property(_interface,
2058
1497
signature="t",
2062
1501
return dbus.UInt64(self.approval_delay.total_seconds()
2063
1502
* 1000)
2064
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2065
1504
2066
1505
# ApprovalDuration - property
2067
1506
@dbus_service_property(_interface,
2068
1507
signature="t",
2072
1511
return dbus.UInt64(self.approval_duration.total_seconds()
2073
1512
* 1000)
2074
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2075
1514
2076
1515
# Name - property
2077
@dbus_annotations(
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2079
1516
@dbus_service_property(_interface, signature="s", access="read")
2080
1517
def Name_dbus_property(self):
2081
1518
return dbus.String(self.name)
2082
2083
# KeyID - property
2084
@dbus_annotations(
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2086
@dbus_service_property(_interface, signature="s", access="read")
2087
def KeyID_dbus_property(self):
2088
return dbus.String(self.key_id)
2089
1519
2090
1520
# Fingerprint - property
2091
@dbus_annotations(
2092
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2093
1521
@dbus_service_property(_interface, signature="s", access="read")
2094
1522
def Fingerprint_dbus_property(self):
2095
1523
return dbus.String(self.fingerprint)
2096
1524
2097
1525
# Host - property
2098
1526
@dbus_service_property(_interface,
2099
1527
signature="s",
2102
1530
if value is None: # get
2103
1531
return dbus.String(self.host)
2104
1532
self.host = str(value)
2105
1533
2106
1534
# Created - property
2107
@dbus_annotations(
2108
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2109
1535
@dbus_service_property(_interface, signature="s", access="read")
2110
1536
def Created_dbus_property(self):
2111
1537
return datetime_to_dbus(self.created)
2112
1538
2113
1539
# LastEnabled - property
2114
1540
@dbus_service_property(_interface, signature="s", access="read")
2115
1541
def LastEnabled_dbus_property(self):
2116
1542
return datetime_to_dbus(self.last_enabled)
2117
1543
2118
1544
# Enabled - property
2119
1545
@dbus_service_property(_interface,
2120
1546
signature="b",
2126
1552
self.enable()
2127
1553
else:
2128
1554
self.disable()
2129
1555
2130
1556
# LastCheckedOK - property
2131
1557
@dbus_service_property(_interface,
2132
1558
signature="s",
2136
1562
self.checked_ok()
2137
1563
return
2138
1564
return datetime_to_dbus(self.last_checked_ok)
2139
1565
2140
1566
# LastCheckerStatus - property
2141
1567
@dbus_service_property(_interface, signature="n", access="read")
2142
1568
def LastCheckerStatus_dbus_property(self):
2143
1569
return dbus.Int16(self.last_checker_status)
2144
1570
2145
1571
# Expires - property
2146
1572
@dbus_service_property(_interface, signature="s", access="read")
2147
1573
def Expires_dbus_property(self):
2148
1574
return datetime_to_dbus(self.expires)
2149
1575
2150
1576
# LastApprovalRequest - property
2151
1577
@dbus_service_property(_interface, signature="s", access="read")
2152
1578
def LastApprovalRequest_dbus_property(self):
2153
1579
return datetime_to_dbus(self.last_approval_request)
2154
1580
2155
1581
# Timeout - property
2156
1582
@dbus_service_property(_interface,
2157
1583
signature="t",
2172
1598
if (getattr(self, "disable_initiator_tag", None)
2173
1599
is None):
2174
1600
return
2175
GLib.source_remove(self.disable_initiator_tag)
2176
self.disable_initiator_tag = GLib.timeout_add(
1601
gobject.source_remove(self.disable_initiator_tag)
1602
self.disable_initiator_tag = gobject.timeout_add(
2177
1603
int((self.expires - now).total_seconds() * 1000),
2178
1604
self.disable)
2179
1605
2180
1606
# ExtendedTimeout - property
2181
1607
@dbus_service_property(_interface,
2182
1608
signature="t",
2186
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
2187
1613
* 1000)
2188
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2189
1615
2190
1616
# Interval - property
2191
1617
@dbus_service_property(_interface,
2192
1618
signature="t",
2199
1625
return
2200
1626
if self.enabled:
2201
1627
# Reschedule checker run
2202
GLib.source_remove(self.checker_initiator_tag)
2203
self.checker_initiator_tag = GLib.timeout_add(
1628
gobject.source_remove(self.checker_initiator_tag)
1629
self.checker_initiator_tag = gobject.timeout_add(
2204
1630
value, self.start_checker)
2205
self.start_checker() # Start one now, too
2206
1631
self.start_checker() # Start one now, too
1632
2207
1633
# Checker - property
2208
1634
@dbus_service_property(_interface,
2209
1635
signature="s",
2212
1638
if value is None: # get
2213
1639
return dbus.String(self.checker_command)
2214
1640
self.checker_command = str(value)
2215
1641
2216
1642
# CheckerRunning - property
2217
1643
@dbus_service_property(_interface,
2218
1644
signature="b",
2224
1650
self.start_checker()
2225
1651
else:
2226
1652
self.stop_checker()
2227
1653
2228
1654
# ObjectPath - property
2229
@dbus_annotations(
2230
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2231
"org.freedesktop.DBus.Deprecated": "true"})
2232
1655
@dbus_service_property(_interface, signature="o", access="read")
2233
1656
def ObjectPath_dbus_property(self):
2234
return self.dbus_object_path # is already a dbus.ObjectPath
2235
1657
return self.dbus_object_path # is already a dbus.ObjectPath
1658
2236
1659
# Secret = property
2237
@dbus_annotations(
2238
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2239
"invalidates"})
2240
1660
@dbus_service_property(_interface,
2241
1661
signature="ay",
2242
1662
access="write",
2243
1663
byte_arrays=True)
2244
1664
def Secret_dbus_property(self, value):
2245
1665
self.secret = bytes(value)
2246
1666
2247
1667
del _interface
2248
1668
2249
1669
2250
class ProxyClient:
2251
def __init__(self, child_pipe, key_id, fpr, address):
1670
class ProxyClient(object):
1671
def __init__(self, child_pipe, fpr, address):
2252
1672
self._pipe = child_pipe
2253
self._pipe.send(('init', key_id, fpr, address))
1673
self._pipe.send(('init', fpr, address))
2254
1674
if not self._pipe.recv():
2255
raise KeyError(key_id or fpr)
2256
1675
raise KeyError(fpr)
1676
2257
1677
def __getattribute__(self, name):
2258
1678
if name == '_pipe':
2259
1679
return super(ProxyClient, self).__getattribute__(name)
2262
1682
if data[0] == 'data':
2263
1683
return data[1]
2264
1684
if data[0] == 'function':
2265
1685
2266
1686
def func(*args, **kwargs):
2267
1687
self._pipe.send(('funcall', name, args, kwargs))
2268
1688
return self._pipe.recv()[1]
2269
1689
2270
1690
return func
2271
1691
2272
1692
def __setattr__(self, name, value):
2273
1693
if name == '_pipe':
2274
1694
return super(ProxyClient, self).__setattr__(name, value)
2277
1697
2278
1698
class ClientHandler(socketserver.BaseRequestHandler, object):
2279
1699
"""A class to handle client connections.
2280
1700
2281
1701
Instantiated once for each connection to handle it.
2282
1702
Note: This will run in its own forked process."""
2283
1703
2284
1704
def handle(self):
2285
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
2286
1706
logger.info("TCP connection from: %s",
2287
1707
str(self.client_address))
2288
1708
logger.debug("Pipe FD: %d",
2289
1709
self.server.child_pipe.fileno())
2290
2291
session = gnutls.ClientSession(self.request)
2292
2293
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2294
# "+AES-256-CBC", "+SHA1",
2295
# "+COMP-NULL", "+CTYPE-OPENPGP",
2296
# "+DHE-DSS"))
1710
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1713
1714
# Note: gnutls.connection.X509Credentials is really a
1715
# generic GnuTLS certificate credentials object so long as
1716
# no X.509 keys are added to it. Therefore, we can use it
1717
# here despite using OpenPGP certificates.
1718
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
# "+AES-256-CBC", "+SHA1",
1721
# "+COMP-NULL", "+CTYPE-OPENPGP",
1722
# "+DHE-DSS"))
2297
1723
# Use a fallback default, since this MUST be set.
2298
1724
priority = self.server.gnutls_priority
2299
1725
if priority is None:
2300
1726
priority = "NORMAL"
2301
gnutls.priority_set_direct(session._c_object,
2302
priority.encode("utf-8"),
2303
None)
2304
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1729
2305
1730
# Start communication using the Mandos protocol
2306
1731
# Get protocol number
2307
1732
line = self.request.makefile().readline()
2312
1737
except (ValueError, IndexError, RuntimeError) as error:
2313
1738
logger.error("Unknown protocol version: %s", error)
2314
1739
return
2315
1740
2316
1741
# Start GnuTLS connection
2317
1742
try:
2318
1743
session.handshake()
2319
except gnutls.Error as error:
1744
except gnutls.errors.GNUTLSError as error:
2320
1745
logger.warning("Handshake failed: %s", error)
2321
1746
# Do not run session.bye() here: the session is not
2322
1747
# established. Just abandon the request.
2323
1748
return
2324
1749
logger.debug("Handshake succeeded")
2325
1750
2326
1751
approval_required = False
2327
1752
try:
2328
if gnutls.has_rawpk:
2329
fpr = b""
2330
try:
2331
key_id = self.key_id(
2332
self.peer_certificate(session))
2333
except (TypeError, gnutls.Error) as error:
2334
logger.warning("Bad certificate: %s", error)
2335
return
2336
logger.debug("Key ID: %s", key_id)
2337
2338
else:
2339
key_id = b""
2340
try:
2341
fpr = self.fingerprint(
2342
self.peer_certificate(session))
2343
except (TypeError, gnutls.Error) as error:
2344
logger.warning("Bad certificate: %s", error)
2345
return
2346
logger.debug("Fingerprint: %s", fpr)
2347
2348
try:
2349
client = ProxyClient(child_pipe, key_id, fpr,
1753
try:
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1756
except (TypeError,
1757
gnutls.errors.GNUTLSError) as error:
1758
logger.warning("Bad certificate: %s", error)
1759
return
1760
logger.debug("Fingerprint: %s", fpr)
1761
1762
try:
1763
client = ProxyClient(child_pipe, fpr,
2350
1764
self.client_address)
2351
1765
except KeyError:
2352
1766
return
2353
1767
2354
1768
if client.approval_delay:
2355
1769
delay = client.approval_delay
2356
1770
client.approvals_pending += 1
2357
1771
approval_required = True
2358
1772
2359
1773
while True:
2360
1774
if not client.enabled:
2361
1775
logger.info("Client %s is disabled",
2364
1778
# Emit D-Bus signal
2365
1779
client.Rejected("Disabled")
2366
1780
return
2367
1781
2368
1782
if client.approved or not client.approval_delay:
2369
# We are approved or approval is disabled
1783
#We are approved or approval is disabled
2370
1784
break
2371
1785
elif client.approved is None:
2372
1786
logger.info("Client %s needs approval",
2383
1797
# Emit D-Bus signal
2384
1798
client.Rejected("Denied")
2385
1799
return
2386
2387
# wait until timeout or approved
1800
1801
#wait until timeout or approved
2388
1802
time = datetime.datetime.now()
2389
1803
client.changedstate.acquire()
2390
1804
client.changedstate.wait(delay.total_seconds())
2403
1817
break
2404
1818
else:
2405
1819
delay -= time2 - time
2406
2407
try:
2408
session.send(client.secret)
2409
except gnutls.Error as error:
2410
logger.warning("gnutls send failed",
2411
exc_info=error)
2412
return
2413
1820
1821
sent_size = 0
1822
while sent_size < len(client.secret):
1823
try:
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1827
exc_info=error)
1828
return
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1832
sent_size += sent
1833
2414
1834
logger.info("Sending secret to %s", client.name)
2415
1835
# bump the timeout using extended_timeout
2416
1836
client.bump_timeout(client.extended_timeout)
2417
1837
if self.server.use_dbus:
2418
1838
# Emit D-Bus signal
2419
1839
client.GotSecret()
2420
1840
2421
1841
finally:
2422
1842
if approval_required:
2423
1843
client.approvals_pending -= 1
2424
1844
try:
2425
1845
session.bye()
2426
except gnutls.Error as error:
1846
except gnutls.errors.GNUTLSError as error:
2427
1847
logger.warning("GnuTLS bye failed",
2428
1848
exc_info=error)
2429
1849
2430
1850
@staticmethod
2431
1851
def peer_certificate(session):
2432
"Return the peer's certificate as a bytestring"
2433
try:
2434
cert_type = gnutls.certificate_type_get2(session._c_object,
2435
gnutls.CTYPE_PEERS)
2436
except AttributeError:
2437
cert_type = gnutls.certificate_type_get(session._c_object)
2438
if gnutls.has_rawpk:
2439
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
else:
2441
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2442
# If not a valid certificate type...
2443
if cert_type not in valid_cert_types:
2444
logger.info("Cert type %r not in %r", cert_type,
2445
valid_cert_types)
2446
# ...return invalid data
2447
return b""
1852
"Return the peer's OpenPGP certificate as a bytestring"
1853
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2448
1859
list_size = ctypes.c_uint(1)
2449
cert_list = (gnutls.certificate_get_peers
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2450
1862
(session._c_object, ctypes.byref(list_size)))
2451
1863
if not bool(cert_list) and list_size.value != 0:
2452
raise gnutls.Error("error getting peer certificate")
1864
raise gnutls.errors.GNUTLSError("error getting peer"
1865
" certificate")
2453
1866
if list_size.value == 0:
2454
1867
return None
2455
1868
cert = cert_list[0]
2456
1869
return ctypes.string_at(cert.data, cert.size)
2457
2458
@staticmethod
2459
def key_id(certificate):
2460
"Convert a certificate bytestring to a hexdigit key ID"
2461
# New GnuTLS "datum" with the public key
2462
datum = gnutls.datum_t(
2463
ctypes.cast(ctypes.c_char_p(certificate),
2464
ctypes.POINTER(ctypes.c_ubyte)),
2465
ctypes.c_uint(len(certificate)))
2466
# XXX all these need to be created in the gnutls "module"
2467
# New empty GnuTLS certificate
2468
pubkey = gnutls.pubkey_t()
2469
gnutls.pubkey_init(ctypes.byref(pubkey))
2470
# Import the raw public key into the certificate
2471
gnutls.pubkey_import(pubkey,
2472
ctypes.byref(datum),
2473
gnutls.X509_FMT_DER)
2474
# New buffer for the key ID
2475
buf = ctypes.create_string_buffer(32)
2476
buf_len = ctypes.c_size_t(len(buf))
2477
# Get the key ID from the raw public key into the buffer
2478
gnutls.pubkey_get_key_id(
2479
pubkey,
2480
gnutls.KEYID_USE_SHA256,
2481
ctypes.cast(ctypes.byref(buf),
2482
ctypes.POINTER(ctypes.c_ubyte)),
2483
ctypes.byref(buf_len))
2484
# Deinit the certificate
2485
gnutls.pubkey_deinit(pubkey)
2486
2487
# Convert the buffer to a Python bytestring
2488
key_id = ctypes.string_at(buf, buf_len.value)
2489
# Convert the bytestring to hexadecimal notation
2490
hex_key_id = binascii.hexlify(key_id).upper()
2491
return hex_key_id
2492
1870
2493
1871
@staticmethod
2494
1872
def fingerprint(openpgp):
2495
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2496
1874
# New GnuTLS "datum" with the OpenPGP public key
2497
datum = gnutls.datum_t(
1875
datum = gnutls.library.types.gnutls_datum_t(
2498
1876
ctypes.cast(ctypes.c_char_p(openpgp),
2499
1877
ctypes.POINTER(ctypes.c_ubyte)),
2500
1878
ctypes.c_uint(len(openpgp)))
2501
1879
# New empty GnuTLS certificate
2502
crt = gnutls.openpgp_crt_t()
2503
gnutls.openpgp_crt_init(ctypes.byref(crt))
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
2504
1883
# Import the OpenPGP public key into the certificate
2505
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2506
gnutls.OPENPGP_FMT_RAW)
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2507
1887
# Verify the self signature in the key
2508
1888
crtverify = ctypes.c_uint()
2509
gnutls.openpgp_crt_verify_self(crt, 0,
2510
ctypes.byref(crtverify))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2511
1891
if crtverify.value != 0:
2512
gnutls.openpgp_crt_deinit(crt)
2513
raise gnutls.CertificateSecurityError(code
2514
=crtverify.value)
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
2515
1895
# New buffer for the fingerprint
2516
1896
buf = ctypes.create_string_buffer(20)
2517
1897
buf_len = ctypes.c_size_t()
2518
1898
# Get the fingerprint from the certificate into the buffer
2519
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2520
ctypes.byref(buf_len))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2521
1901
# Deinit the certificate
2522
gnutls.openpgp_crt_deinit(crt)
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2523
1903
# Convert the buffer to a Python bytestring
2524
1904
fpr = ctypes.string_at(buf, buf_len.value)
2525
1905
# Convert the bytestring to hexadecimal notation
2527
1907
return hex_fpr
2528
1908
2529
1909
2530
class MultiprocessingMixIn:
1910
class MultiprocessingMixIn(object):
2531
1911
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2532
1912
2533
1913
def sub_process_main(self, request, address):
2534
1914
try:
2535
1915
self.finish_request(request, address)
2536
1916
except Exception:
2537
1917
self.handle_error(request, address)
2538
1918
self.close_request(request)
2539
1919
2540
1920
def process_request(self, request, address):
2541
1921
"""Start a new process to process the request."""
2542
proc = multiprocessing.Process(target=self.sub_process_main,
2543
args=(request, address))
1922
proc = multiprocessing.Process(target = self.sub_process_main,
1923
args = (request, address))
2544
1924
proc.start()
2545
1925
return proc
2546
1926
2547
1927
2548
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1928
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2549
1929
""" adds a pipe to the MixIn """
2550
1930
2551
1931
def process_request(self, request, client_address):
2552
1932
"""Overrides and wraps the original process_request().
2553
1933
2554
1934
This function creates a new pipe in self.pipe
2555
1935
"""
2556
1936
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2557
1937
2558
1938
proc = MultiprocessingMixIn.process_request(self, request,
2559
1939
client_address)
2560
1940
self.child_pipe.close()
2561
1941
self.add_pipe(parent_pipe, proc)
2562
1942
2563
1943
def add_pipe(self, parent_pipe, proc):
2564
1944
"""Dummy function; override as necessary"""
2565
1945
raise NotImplementedError()
2566
1946
2567
1947
2568
1948
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2569
socketserver.TCPServer):
1949
socketserver.TCPServer, object):
2570
1950
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2571
1951
2572
1952
Attributes:
2573
1953
enabled: Boolean; whether this server is activated yet
2574
1954
interface: None or a network interface name (string)
2575
1955
use_ipv6: Boolean; to use IPv6 or not
2576
1956
"""
2577
1957
2578
1958
def __init__(self, server_address, RequestHandlerClass,
2579
1959
interface=None,
2580
1960
use_ipv6=True,
2590
1970
self.socketfd = socketfd
2591
1971
# Save the original socket.socket() function
2592
1972
self.socket_socket = socket.socket
2593
2594
1973
# To implement --socket, we monkey patch socket.socket.
2595
#
1974
#
2596
1975
# (When socketserver.TCPServer is a new-style class, we
2597
1976
# could make self.socket into a property instead of monkey
2598
1977
# patching socket.socket.)
2599
#
1978
#
2600
1979
# Create a one-time-only replacement for socket.socket()
2601
1980
@functools.wraps(socket.socket)
2602
1981
def socket_wrapper(*args, **kwargs):
2614
1993
# socket_wrapper(), if socketfd was set.
2615
1994
socketserver.TCPServer.__init__(self, server_address,
2616
1995
RequestHandlerClass)
2617
1996
2618
1997
def server_bind(self):
2619
1998
"""This overrides the normal server_bind() function
2620
1999
to bind to an interface if one was specified, and also NOT to
2621
2000
bind to an address or port if they were not specified."""
2622
global SO_BINDTODEVICE
2623
2001
if self.interface is not None:
2624
2002
if SO_BINDTODEVICE is None:
2625
# Fall back to a hard-coded value which seems to be
2626
# common enough.
2627
logger.warning("SO_BINDTODEVICE not found, trying 25")
2628
SO_BINDTODEVICE = 25
2629
try:
2630
self.socket.setsockopt(
2631
socket.SOL_SOCKET, SO_BINDTODEVICE,
2632
(self.interface + "\0").encode("utf-8"))
2633
except socket.error as error:
2634
if error.errno == errno.EPERM:
2635
logger.error("No permission to bind to"
2636
" interface %s", self.interface)
2637
elif error.errno == errno.ENOPROTOOPT:
2638
logger.error("SO_BINDTODEVICE not available;"
2639
" cannot bind to interface %s",
2640
self.interface)
2641
elif error.errno == errno.ENODEV:
2642
logger.error("Interface %s does not exist,"
2643
" cannot bind", self.interface)
2644
else:
2645
raise
2003
logger.error("SO_BINDTODEVICE does not exist;"
2004
" cannot bind to interface %s",
2005
self.interface)
2006
else:
2007
try:
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
2011
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
2016
logger.error("SO_BINDTODEVICE not available;"
2017
" cannot bind to interface %s",
2018
self.interface)
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2022
else:
2023
raise
2646
2024
# Only bind(2) the socket if we really need to.
2647
2025
if self.server_address[0] or self.server_address[1]:
2648
if self.server_address[1]:
2649
self.allow_reuse_address = True
2650
2026
if not self.server_address[0]:
2651
2027
if self.address_family == socket.AF_INET6:
2652
any_address = "::" # in6addr_any
2028
any_address = "::" # in6addr_any
2653
2029
else:
2654
any_address = "0.0.0.0" # INADDR_ANY
2030
any_address = "0.0.0.0" # INADDR_ANY
2655
2031
self.server_address = (any_address,
2656
2032
self.server_address[1])
2657
2033
elif not self.server_address[1]:
2667
2043
2668
2044
class MandosServer(IPv6_TCPServer):
2669
2045
"""Mandos server.
2670
2046
2671
2047
Attributes:
2672
2048
clients: set of Client objects
2673
2049
gnutls_priority GnuTLS priority string
2674
2050
use_dbus: Boolean; to emit D-Bus signals or not
2675
2676
Assumes a GLib.MainLoop event loop.
2051
2052
Assumes a gobject.MainLoop event loop.
2677
2053
"""
2678
2054
2679
2055
def __init__(self, server_address, RequestHandlerClass,
2680
2056
interface=None,
2681
2057
use_ipv6=True,
2691
2067
self.gnutls_priority = gnutls_priority
2692
2068
IPv6_TCPServer.__init__(self, server_address,
2693
2069
RequestHandlerClass,
2694
interface=interface,
2695
use_ipv6=use_ipv6,
2696
socketfd=socketfd)
2697
2070
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2073
2698
2074
def server_activate(self):
2699
2075
if self.enabled:
2700
2076
return socketserver.TCPServer.server_activate(self)
2701
2077
2702
2078
def enable(self):
2703
2079
self.enabled = True
2704
2080
2705
2081
def add_pipe(self, parent_pipe, proc):
2706
2082
# Call "handle_ipc" for both data and EOF events
2707
GLib.io_add_watch(
2708
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2709
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2710
2086
functools.partial(self.handle_ipc,
2711
parent_pipe=parent_pipe,
2712
proc=proc))
2713
2087
parent_pipe = parent_pipe,
2088
proc = proc))
2089
2714
2090
def handle_ipc(self, source, condition,
2715
2091
parent_pipe=None,
2716
proc=None,
2092
proc = None,
2717
2093
client_object=None):
2718
2094
# error, or the other end of multiprocessing.Pipe has closed
2719
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2720
2096
# Wait for other process to exit
2721
2097
proc.join()
2722
2098
return False
2723
2099
2724
2100
# Read a request from the child
2725
2101
request = parent_pipe.recv()
2726
2102
command = request[0]
2727
2103
2728
2104
if command == 'init':
2729
key_id = request[1].decode("ascii")
2730
fpr = request[2].decode("ascii")
2731
address = request[3]
2732
2733
for c in self.clients.values():
2734
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2735
"27AE41E4649B934CA495991B7852B855"):
2736
continue
2737
if key_id and c.key_id == key_id:
2738
client = c
2739
break
2740
if fpr and c.fingerprint == fpr:
2105
fpr = request[1]
2106
address = request[2]
2107
2108
for c in self.clients.itervalues():
2109
if c.fingerprint == fpr:
2741
2110
client = c
2742
2111
break
2743
2112
else:
2744
logger.info("Client not found for key ID: %s, address"
2745
": %s", key_id or fpr, address)
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
2746
2115
if self.use_dbus:
2747
2116
# Emit D-Bus signal
2748
mandos_dbus_service.ClientNotFound(key_id or fpr,
2117
mandos_dbus_service.ClientNotFound(fpr,
2749
2118
address[0])
2750
2119
parent_pipe.send(False)
2751
2120
return False
2752
2753
GLib.io_add_watch(
2754
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2755
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2121
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2756
2125
functools.partial(self.handle_ipc,
2757
parent_pipe=parent_pipe,
2758
proc=proc,
2759
client_object=client))
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
2760
2129
parent_pipe.send(True)
2761
2130
# remove the old hook in favor of the new above hook on
2762
2131
# same fileno
2765
2134
funcname = request[1]
2766
2135
args = request[2]
2767
2136
kwargs = request[3]
2768
2137
2769
2138
parent_pipe.send(('data', getattr(client_object,
2770
2139
funcname)(*args,
2771
2140
**kwargs)))
2772
2141
2773
2142
if command == 'getattr':
2774
2143
attrname = request[1]
2775
2144
if isinstance(client_object.__getattribute__(attrname),
2776
collections.abc.Callable):
2145
collections.Callable):
2777
2146
parent_pipe.send(('function', ))
2778
2147
else:
2779
2148
parent_pipe.send((
2780
2149
'data', client_object.__getattribute__(attrname)))
2781
2150
2782
2151
if command == 'setattr':
2783
2152
attrname = request[1]
2784
2153
value = request[2]
2785
2154
setattr(client_object, attrname, value)
2786
2155
2787
2156
return True
2788
2157
2789
2158
2790
2159
def rfc3339_duration_to_delta(duration):
2791
2160
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2792
2793
>>> timedelta = datetime.timedelta
2794
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2795
True
2796
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2797
True
2798
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2799
True
2800
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2801
True
2802
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2803
True
2804
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2805
True
2806
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2807
True
2808
>>> del timedelta
2161
2162
>>> rfc3339_duration_to_delta("P7D")
2163
datetime.timedelta(7)
2164
>>> rfc3339_duration_to_delta("PT60S")
2165
datetime.timedelta(0, 60)
2166
>>> rfc3339_duration_to_delta("PT60M")
2167
datetime.timedelta(0, 3600)
2168
>>> rfc3339_duration_to_delta("PT24H")
2169
datetime.timedelta(1)
2170
>>> rfc3339_duration_to_delta("P1W")
2171
datetime.timedelta(7)
2172
>>> rfc3339_duration_to_delta("PT5M30S")
2173
datetime.timedelta(0, 330)
2174
>>> rfc3339_duration_to_delta("P1DT3M20S")
2175
datetime.timedelta(1, 200)
2809
2176
"""
2810
2177
2811
2178
# Parsing an RFC 3339 duration with regular expressions is not
2812
2179
# possible - there would have to be multiple places for the same
2813
2180
# values, like seconds. The current code, while more esoteric, is
2814
2181
# cleaner without depending on a parsing library. If Python had a
2815
2182
# built-in library for parsing we would use it, but we'd like to
2816
2183
# avoid excessive use of external libraries.
2817
2184
2818
2185
# New type for defining tokens, syntax, and semantics all-in-one
2819
2186
Token = collections.namedtuple("Token", (
2820
2187
"regexp", # To match token; if "value" is not None, must have
2853
2220
frozenset((token_year, token_month,
2854
2221
token_day, token_time,
2855
2222
token_week)))
2856
# Define starting values:
2857
# Value so far
2858
value = datetime.timedelta()
2223
# Define starting values
2224
value = datetime.timedelta() # Value so far
2859
2225
found_token = None
2860
# Following valid tokens
2861
followers = frozenset((token_duration, ))
2862
# String left to parse
2863
s = duration
2226
followers = frozenset((token_duration, )) # Following valid tokens
2227
s = duration # String left to parse
2864
2228
# Loop until end token is found
2865
2229
while found_token is not token_end:
2866
2230
# Search for any currently valid tokens
2890
2254
2891
2255
def string_to_delta(interval):
2892
2256
"""Parse a string and return a datetime.timedelta
2893
2894
>>> string_to_delta('7d') == datetime.timedelta(7)
2895
True
2896
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
True
2898
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
True
2900
>>> string_to_delta('24h') == datetime.timedelta(1)
2901
True
2902
>>> string_to_delta('1w') == datetime.timedelta(7)
2903
True
2904
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2905
True
2257
2258
>>> string_to_delta('7d')
2259
datetime.timedelta(7)
2260
>>> string_to_delta('60s')
2261
datetime.timedelta(0, 60)
2262
>>> string_to_delta('60m')
2263
datetime.timedelta(0, 3600)
2264
>>> string_to_delta('24h')
2265
datetime.timedelta(1)
2266
>>> string_to_delta('1w')
2267
datetime.timedelta(7)
2268
>>> string_to_delta('5m 30s')
2269
datetime.timedelta(0, 330)
2906
2270
"""
2907
2271
2908
2272
try:
2909
2273
return rfc3339_duration_to_delta(interval)
2910
2274
except ValueError:
2911
2275
pass
2912
2276
2913
2277
timevalue = datetime.timedelta(0)
2914
2278
for s in interval.split():
2915
2279
try:
2933
2297
return timevalue
2934
2298
2935
2299
2936
def daemon(nochdir=False, noclose=False):
2300
def daemon(nochdir = False, noclose = False):
2937
2301
"""See daemon(3). Standard BSD Unix function.
2938
2302
2939
2303
This should really exist as os.daemon, but it doesn't (yet)."""
2940
2304
if os.fork():
2941
2305
sys.exit()
2959
2323
2960
2324
2961
2325
def main():
2962
2326
2963
2327
##################################################################
2964
2328
# Parsing of options, both command line and config file
2965
2329
2966
2330
parser = argparse.ArgumentParser()
2967
2331
parser.add_argument("-v", "--version", action="version",
2968
version="%(prog)s {}".format(version),
2332
version = "%(prog)s {}".format(version),
2969
2333
help="show version number and exit")
2970
2334
parser.add_argument("-i", "--interface", metavar="IF",
2971
2335
help="Bind to interface IF")
3007
2371
parser.add_argument("--no-zeroconf", action="store_false",
3008
2372
dest="zeroconf", help="Do not use Zeroconf",
3009
2373
default=None)
3010
2374
3011
2375
options = parser.parse_args()
3012
2376
2377
if options.check:
2378
import doctest
2379
fail_count, test_count = doctest.testmod()
2380
sys.exit(os.EX_OK if fail_count == 0 else 1)
2381
3013
2382
# Default values for config file for server-global settings
3014
if gnutls.has_rawpk:
3015
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3016
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3017
else:
3018
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3019
":+SIGN-DSA-SHA256")
3020
server_defaults = {"interface": "",
3021
"address": "",
3022
"port": "",
3023
"debug": "False",
3024
"priority": priority,
3025
"servicename": "Mandos",
3026
"use_dbus": "True",
3027
"use_ipv6": "True",
3028
"debuglevel": "",
3029
"restore": "True",
3030
"socket": "",
3031
"statedir": "/var/lib/mandos",
3032
"foreground": "False",
3033
"zeroconf": "True",
3034
}
3035
del priority
3036
2383
server_defaults = { "interface": "",
2384
"address": "",
2385
"port": "",
2386
"debug": "False",
2387
"priority":
2388
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2389
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2390
"servicename": "Mandos",
2391
"use_dbus": "True",
2392
"use_ipv6": "True",
2393
"debuglevel": "",
2394
"restore": "True",
2395
"socket": "",
2396
"statedir": "/var/lib/mandos",
2397
"foreground": "False",
2398
"zeroconf": "True",
2399
}
2400
3037
2401
# Parse config file for server-global settings
3038
server_config = configparser.ConfigParser(server_defaults)
2402
server_config = configparser.SafeConfigParser(server_defaults)
3039
2403
del server_defaults
3040
2404
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3041
# Convert the ConfigParser object to a dict
2405
# Convert the SafeConfigParser object to a dict
3042
2406
server_settings = server_config.defaults()
3043
2407
# Use the appropriate methods on the non-string config options
3044
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3045
"foreground", "zeroconf"):
2408
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3046
2409
server_settings[option] = server_config.getboolean("DEFAULT",
3047
2410
option)
3048
2411
if server_settings["port"]:
3058
2421
server_settings["socket"] = os.dup(server_settings
3059
2422
["socket"])
3060
2423
del server_config
3061
2424
3062
2425
# Override the settings from the config file with command line
3063
2426
# options, if set.
3064
2427
for option in ("interface", "address", "port", "debug",
3082
2445
if server_settings["debug"]:
3083
2446
server_settings["foreground"] = True
3084
2447
# Now we have our good server settings in "server_settings"
3085
2448
3086
2449
##################################################################
3087
2450
3088
2451
if (not server_settings["zeroconf"]
3089
2452
and not (server_settings["port"]
3090
2453
or server_settings["socket"] != "")):
3091
2454
parser.error("Needs port or socket to work without Zeroconf")
3092
2455
3093
2456
# For convenience
3094
2457
debug = server_settings["debug"]
3095
2458
debuglevel = server_settings["debuglevel"]
3099
2462
stored_state_file)
3100
2463
foreground = server_settings["foreground"]
3101
2464
zeroconf = server_settings["zeroconf"]
3102
2465
3103
2466
if debug:
3104
2467
initlogger(debug, logging.DEBUG)
3105
2468
else:
3108
2471
else:
3109
2472
level = getattr(logging, debuglevel.upper())
3110
2473
initlogger(debug, level)
3111
2474
3112
2475
if server_settings["servicename"] != "Mandos":
3113
2476
syslogger.setFormatter(
3114
2477
logging.Formatter('Mandos ({}) [%(process)d]:'
3115
2478
' %(levelname)s: %(message)s'.format(
3116
2479
server_settings["servicename"])))
3117
2480
3118
2481
# Parse config file with clients
3119
client_config = configparser.ConfigParser(Client.client_defaults)
2482
client_config = configparser.SafeConfigParser(Client
2483
.client_defaults)
3120
2484
client_config.read(os.path.join(server_settings["configdir"],
3121
2485
"clients.conf"))
3122
2486
3123
2487
global mandos_dbus_service
3124
2488
mandos_dbus_service = None
3125
2489
3126
2490
socketfd = None
3127
2491
if server_settings["socket"] != "":
3128
2492
socketfd = server_settings["socket"]
3144
2508
except IOError as e:
3145
2509
logger.error("Could not open file %r", pidfilename,
3146
2510
exc_info=e)
3147
3148
for name, group in (("_mandos", "_mandos"),
3149
("mandos", "mandos"),
3150
("nobody", "nogroup")):
2511
2512
for name in ("_mandos", "mandos", "nobody"):
3151
2513
try:
3152
2514
uid = pwd.getpwnam(name).pw_uid
3153
gid = pwd.getpwnam(group).pw_gid
2515
gid = pwd.getpwnam(name).pw_gid
3154
2516
break
3155
2517
except KeyError:
3156
2518
continue
3160
2522
try:
3161
2523
os.setgid(gid)
3162
2524
os.setuid(uid)
3163
if debug:
3164
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3165
gid))
3166
2525
except OSError as error:
3167
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3168
.format(uid, gid, os.strerror(error.errno)))
3169
2526
if error.errno != errno.EPERM:
3170
2527
raise
3171
2528
3172
2529
if debug:
3173
2530
# Enable all possible GnuTLS debugging
3174
2531
3175
2532
# "Use a log level over 10 to enable all debugging options."
3176
2533
# - GnuTLS manual
3177
gnutls.global_set_log_level(11)
3178
3179
@gnutls.log_func
2534
gnutls.library.functions.gnutls_global_set_log_level(11)
2535
2536
@gnutls.library.types.gnutls_log_func
3180
2537
def debug_gnutls(level, string):
3181
2538
logger.debug("GnuTLS: %s", string[:-1])
3182
3183
gnutls.global_set_log_function(debug_gnutls)
3184
2539
2540
gnutls.library.functions.gnutls_global_set_log_function(
2541
debug_gnutls)
2542
3185
2543
# Redirect stdin so all checkers get /dev/null
3186
2544
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3187
2545
os.dup2(null, sys.stdin.fileno())
3188
2546
if null > 2:
3189
2547
os.close(null)
3190
2548
3191
2549
# Need to fork before connecting to D-Bus
3192
2550
if not foreground:
3193
2551
# Close all input and output, do double fork, etc.
3194
2552
daemon()
3195
3196
if gi.version_info < (3, 10, 2):
3197
# multiprocessing will use threads, so before we use GLib we
3198
# need to inform GLib that threads will be used.
3199
GLib.threads_init()
3200
2553
2554
# multiprocessing will use threads, so before we use gobject we
2555
# need to inform gobject that threads will be used.
2556
gobject.threads_init()
2557
3201
2558
global main_loop
3202
2559
# From the Avahi example code
3203
2560
DBusGMainLoop(set_as_default=True)
3204
main_loop = GLib.MainLoop()
2561
main_loop = gobject.MainLoop()
3205
2562
bus = dbus.SystemBus()
3206
2563
# End of Avahi example code
3207
2564
if use_dbus:
3220
2577
if zeroconf:
3221
2578
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3222
2579
service = AvahiServiceToSyslog(
3223
name=server_settings["servicename"],
3224
servicetype="_mandos._tcp",
3225
protocol=protocol,
3226
bus=bus)
2580
name = server_settings["servicename"],
2581
servicetype = "_mandos._tcp",
2582
protocol = protocol,
2583
bus = bus)
3227
2584
if server_settings["interface"]:
3228
2585
service.interface = if_nametoindex(
3229
2586
server_settings["interface"].encode("utf-8"))
3230
2587
3231
2588
global multiprocessing_manager
3232
2589
multiprocessing_manager = multiprocessing.Manager()
3233
2590
3234
2591
client_class = Client
3235
2592
if use_dbus:
3236
client_class = functools.partial(ClientDBus, bus=bus)
3237
2593
client_class = functools.partial(ClientDBus, bus = bus)
2594
3238
2595
client_settings = Client.config_parser(client_config)
3239
2596
old_client_settings = {}
3240
2597
clients_data = {}
3241
2598
3242
2599
# This is used to redirect stdout and stderr for checker processes
3243
2600
global wnull
3244
wnull = open(os.devnull, "w") # A writable /dev/null
2601
wnull = open(os.devnull, "w") # A writable /dev/null
3245
2602
# Only used if server is running in foreground but not in debug
3246
2603
# mode
3247
2604
if debug or not foreground:
3248
2605
wnull.close()
3249
2606
3250
2607
# Get client data and settings from last running state.
3251
2608
if server_settings["restore"]:
3252
2609
try:
3253
2610
with open(stored_state_path, "rb") as stored_state:
3254
if sys.version_info.major == 2:
3255
clients_data, old_client_settings = pickle.load(
3256
stored_state)
3257
else:
3258
bytes_clients_data, bytes_old_client_settings = (
3259
pickle.load(stored_state, encoding="bytes"))
3260
# Fix bytes to strings
3261
# clients_data
3262
# .keys()
3263
clients_data = {(key.decode("utf-8")
3264
if isinstance(key, bytes)
3265
else key): value
3266
for key, value in
3267
bytes_clients_data.items()}
3268
del bytes_clients_data
3269
for key in clients_data:
3270
value = {(k.decode("utf-8")
3271
if isinstance(k, bytes) else k): v
3272
for k, v in
3273
clients_data[key].items()}
3274
clients_data[key] = value
3275
# .client_structure
3276
value["client_structure"] = [
3277
(s.decode("utf-8")
3278
if isinstance(s, bytes)
3279
else s) for s in
3280
value["client_structure"]]
3281
# .name, .host, and .checker_command
3282
for k in ("name", "host", "checker_command"):
3283
if isinstance(value[k], bytes):
3284
value[k] = value[k].decode("utf-8")
3285
if "key_id" not in value:
3286
value["key_id"] = ""
3287
elif "fingerprint" not in value:
3288
value["fingerprint"] = ""
3289
# old_client_settings
3290
# .keys()
3291
old_client_settings = {
3292
(key.decode("utf-8")
3293
if isinstance(key, bytes)
3294
else key): value
3295
for key, value in
3296
bytes_old_client_settings.items()}
3297
del bytes_old_client_settings
3298
# .host and .checker_command
3299
for value in old_client_settings.values():
3300
for attribute in ("host", "checker_command"):
3301
if isinstance(value[attribute], bytes):
3302
value[attribute] = (value[attribute]
3303
.decode("utf-8"))
2611
clients_data, old_client_settings = pickle.load(
2612
stored_state)
3304
2613
os.remove(stored_state_path)
3305
2614
except IOError as e:
3306
2615
if e.errno == errno.ENOENT:
3314
2623
logger.warning("Could not load persistent state: "
3315
2624
"EOFError:",
3316
2625
exc_info=e)
3317
2626
3318
2627
with PGPEngine() as pgp:
3319
2628
for client_name, client in clients_data.items():
3320
2629
# Skip removed clients
3321
2630
if client_name not in client_settings:
3322
2631
continue
3323
2632
3324
2633
# Decide which value to use after restoring saved state.
3325
2634
# We have three different values: Old config file,
3326
2635
# new config file, and saved state.
3337
2646
client[name] = value
3338
2647
except KeyError:
3339
2648
pass
3340
2649
3341
2650
# Clients who has passed its expire date can still be
3342
2651
# enabled if its last checker was successful. A Client
3343
2652
# whose checker succeeded before we stored its state is
3376
2685
client_name))
3377
2686
client["secret"] = (client_settings[client_name]
3378
2687
["secret"])
3379
2688
3380
2689
# Add/remove clients based on new changes made to config
3381
2690
for client_name in (set(old_client_settings)
3382
2691
- set(client_settings)):
3384
2693
for client_name in (set(client_settings)
3385
2694
- set(old_client_settings)):
3386
2695
clients_data[client_name] = client_settings[client_name]
3387
2696
3388
2697
# Create all client objects
3389
2698
for client_name, client in clients_data.items():
3390
2699
tcp_server.clients[client_name] = client_class(
3391
name=client_name,
3392
settings=client,
3393
server_settings=server_settings)
3394
2700
name = client_name,
2701
settings = client,
2702
server_settings = server_settings)
2703
3395
2704
if not tcp_server.clients:
3396
2705
logger.warning("No clients defined")
3397
2706
3398
2707
if not foreground:
3399
2708
if pidfile is not None:
3400
2709
pid = os.getpid()
3406
2715
pidfilename, pid)
3407
2716
del pidfile
3408
2717
del pidfilename
3409
3410
for termsig in (signal.SIGHUP, signal.SIGTERM):
3411
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3412
lambda: main_loop.quit() and False)
3413
2718
2719
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2720
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2721
3414
2722
if use_dbus:
3415
2723
3416
2724
@alternate_dbus_interfaces(
3417
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3418
class MandosDBusService(DBusObjectWithObjectManager):
2725
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2726
class MandosDBusService(DBusObjectWithProperties):
3419
2727
"""A D-Bus proxy object"""
3420
2728
3421
2729
def __init__(self):
3422
2730
dbus.service.Object.__init__(self, bus, "/")
3423
2731
3424
2732
_interface = "se.recompile.Mandos"
3425
2733
2734
@dbus_interface_annotations(_interface)
2735
def _foo(self):
2736
return {
2737
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2738
"false" }
2739
3426
2740
@dbus.service.signal(_interface, signature="o")
3427
2741
def ClientAdded(self, objpath):
3428
2742
"D-Bus signal"
3429
2743
pass
3430
2744
3431
2745
@dbus.service.signal(_interface, signature="ss")
3432
def ClientNotFound(self, key_id, address):
2746
def ClientNotFound(self, fingerprint, address):
3433
2747
"D-Bus signal"
3434
2748
pass
3435
3436
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3437
"true"})
2749
3438
2750
@dbus.service.signal(_interface, signature="os")
3439
2751
def ClientRemoved(self, objpath, name):
3440
2752
"D-Bus signal"
3441
2753
pass
3442
3443
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3444
"true"})
2754
3445
2755
@dbus.service.method(_interface, out_signature="ao")
3446
2756
def GetAllClients(self):
3447
2757
"D-Bus method"
3448
2758
return dbus.Array(c.dbus_object_path for c in
3449
tcp_server.clients.values())
3450
3451
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3452
"true"})
2759
tcp_server.clients.itervalues())
2760
3453
2761
@dbus.service.method(_interface,
3454
2762
out_signature="a{oa{sv}}")
3455
2763
def GetAllClientsWithProperties(self):
3456
2764
"D-Bus method"
3457
2765
return dbus.Dictionary(
3458
{c.dbus_object_path: c.GetAll(
3459
"se.recompile.Mandos.Client")
3460
for c in tcp_server.clients.values()},
2766
{ c.dbus_object_path: c.GetAll("")
2767
for c in tcp_server.clients.itervalues() },
3461
2768
signature="oa{sv}")
3462
2769
3463
2770
@dbus.service.method(_interface, in_signature="o")
3464
2771
def RemoveClient(self, object_path):
3465
2772
"D-Bus method"
3466
for c in tcp_server.clients.values():
2773
for c in tcp_server.clients.itervalues():
3467
2774
if c.dbus_object_path == object_path:
3468
2775
del tcp_server.clients[c.name]
3469
2776
c.remove_from_connection()
3470
# Don't signal the disabling
2777
# Don't signal anything except ClientRemoved
3471
2778
c.disable(quiet=True)
3472
# Emit D-Bus signal for removal
3473
self.client_removed_signal(c)
2779
# Emit D-Bus signal
2780
self.ClientRemoved(object_path, c.name)
3474
2781
return
3475
2782
raise KeyError(object_path)
3476
2783
3477
2784
del _interface
3478
3479
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3480
out_signature="a{oa{sa{sv}}}")
3481
def GetManagedObjects(self):
3482
"""D-Bus method"""
3483
return dbus.Dictionary(
3484
{client.dbus_object_path:
3485
dbus.Dictionary(
3486
{interface: client.GetAll(interface)
3487
for interface in
3488
client._get_all_interface_names()})
3489
for client in tcp_server.clients.values()})
3490
3491
def client_added_signal(self, client):
3492
"""Send the new standard signal and the old signal"""
3493
if use_dbus:
3494
# New standard signal
3495
self.InterfacesAdded(
3496
client.dbus_object_path,
3497
dbus.Dictionary(
3498
{interface: client.GetAll(interface)
3499
for interface in
3500
client._get_all_interface_names()}))
3501
# Old signal
3502
self.ClientAdded(client.dbus_object_path)
3503
3504
def client_removed_signal(self, client):
3505
"""Send the new standard signal and the old signal"""
3506
if use_dbus:
3507
# New standard signal
3508
self.InterfacesRemoved(
3509
client.dbus_object_path,
3510
client._get_all_interface_names())
3511
# Old signal
3512
self.ClientRemoved(client.dbus_object_path,
3513
client.name)
3514
2785
3515
2786
mandos_dbus_service = MandosDBusService()
3516
3517
# Save modules to variables to exempt the modules from being
3518
# unloaded before the function registered with atexit() is run.
3519
mp = multiprocessing
3520
wn = wnull
3521
2787
3522
2788
def cleanup():
3523
2789
"Cleanup function; run on exit"
3524
2790
if zeroconf:
3525
2791
service.cleanup()
3526
3527
mp.active_children()
3528
wn.close()
2792
2793
multiprocessing.active_children()
2794
wnull.close()
3529
2795
if not (tcp_server.clients or client_settings):
3530
2796
return
3531
2797
3532
2798
# Store client before exiting. Secrets are encrypted with key
3533
2799
# based on what config file has. If config file is
3534
2800
# removed/edited, old secret will thus be unrecovable.
3535
2801
clients = {}
3536
2802
with PGPEngine() as pgp:
3537
for client in tcp_server.clients.values():
2803
for client in tcp_server.clients.itervalues():
3538
2804
key = client_settings[client.name]["secret"]
3539
2805
client.encrypted_secret = pgp.encrypt(client.secret,
3540
2806
key)
3541
2807
client_dict = {}
3542
2808
3543
2809
# A list of attributes that can not be pickled
3544
2810
# + secret.
3545
exclude = {"bus", "changedstate", "secret",
3546
"checker", "server_settings"}
2811
exclude = { "bus", "changedstate", "secret",
2812
"checker", "server_settings" }
3547
2813
for name, typ in inspect.getmembers(dbus.service
3548
2814
.Object):
3549
2815
exclude.add(name)
3550
2816
3551
2817
client_dict["encrypted_secret"] = (client
3552
2818
.encrypted_secret)
3553
2819
for attr in client.client_structure:
3554
2820
if attr not in exclude:
3555
2821
client_dict[attr] = getattr(client, attr)
3556
2822
3557
2823
clients[client.name] = client_dict
3558
2824
del client_settings[client.name]["secret"]
3559
2825
3560
2826
try:
3561
2827
with tempfile.NamedTemporaryFile(
3562
2828
mode='wb',
3564
2830
prefix='clients-',
3565
2831
dir=os.path.dirname(stored_state_path),
3566
2832
delete=False) as stored_state:
3567
pickle.dump((clients, client_settings), stored_state,
3568
protocol=2)
2833
pickle.dump((clients, client_settings), stored_state)
3569
2834
tempname = stored_state.name
3570
2835
os.rename(tempname, stored_state_path)
3571
2836
except (IOError, OSError) as e:
3581
2846
logger.warning("Could not save persistent state:",
3582
2847
exc_info=e)
3583
2848
raise
3584
2849
3585
2850
# Delete all clients, and settings from config
3586
2851
while tcp_server.clients:
3587
2852
name, client = tcp_server.clients.popitem()
3588
2853
if use_dbus:
3589
2854
client.remove_from_connection()
3590
# Don't signal the disabling
2855
# Don't signal anything except ClientRemoved
3591
2856
client.disable(quiet=True)
3592
# Emit D-Bus signal for removal
3593
2857
if use_dbus:
3594
mandos_dbus_service.client_removed_signal(client)
2858
# Emit D-Bus signal
2859
mandos_dbus_service.ClientRemoved(
2860
client.dbus_object_path, client.name)
3595
2861
client_settings.clear()
3596
2862
3597
2863
atexit.register(cleanup)
3598
3599
for client in tcp_server.clients.values():
2864
2865
for client in tcp_server.clients.itervalues():
3600
2866
if use_dbus:
3601
# Emit D-Bus signal for adding
3602
mandos_dbus_service.client_added_signal(client)
2867
# Emit D-Bus signal
2868
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3603
2869
# Need to initiate checking of clients
3604
2870
if client.enabled:
3605
2871
client.init_checker()
3606
2872
3607
2873
tcp_server.enable()
3608
2874
tcp_server.server_activate()
3609
2875
3610
2876
# Find out what port we got
3611
2877
if zeroconf:
3612
2878
service.port = tcp_server.socket.getsockname()[1]
3617
2883
else: # IPv4
3618
2884
logger.info("Now listening on address %r, port %d",
3619
2885
*tcp_server.socket.getsockname())
3620
3621
# service.interface = tcp_server.socket.getsockname()[3]
3622
2886
2887
#service.interface = tcp_server.socket.getsockname()[3]
2888
3623
2889
try:
3624
2890
if zeroconf:
3625
2891
# From the Avahi example code
3630
2896
cleanup()
3631
2897
sys.exit(1)
3632
2898
# End of Avahi example code
3633
3634
GLib.io_add_watch(
3635
GLib.IOChannel.unix_new(tcp_server.fileno()),
3636
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3637
lambda *args, **kwargs: (tcp_server.handle_request
3638
(*args[2:], **kwargs) or True))
3639
2899
2900
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2901
lambda *args, **kwargs:
2902
(tcp_server.handle_request
2903
(*args[2:], **kwargs) or True))
2904
3640
2905
logger.debug("Starting main loop")
3641
2906
main_loop.run()
3642
2907
except AvahiError as error:
3651
2916
# Must run before the D-Bus bus name gets deregistered
3652
2917
cleanup()
3653
2918
3654
3655
def should_only_run_tests():
3656
parser = argparse.ArgumentParser(add_help=False)
3657
parser.add_argument("--check", action='store_true')
3658
args, unknown_args = parser.parse_known_args()
3659
run_tests = args.check
3660
if run_tests:
3661
# Remove --check argument from sys.argv
3662
sys.argv[1:] = unknown_args
3663
return run_tests
3664
3665
# Add all tests from doctest strings
3666
def load_tests(loader, tests, none):
3667
import doctest
3668
tests.addTests(doctest.DocTestSuite())
3669
return tests
3670
2919
3671
2920
if __name__ == '__main__':
3672
try:
3673
if should_only_run_tests():
3674
# Call using ./mandos --check [--verbose]
3675
unittest.main()
3676
else:
3677
main()
3678
finally:
3679
logging.shutdown()
2921
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0