/mandos/release : revision 237.7.333

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

3

#

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

39

try:

48

40

import SocketServer as socketserver

49

41

except ImportError:

50

42

import socketserver

51

43

import socket

44

import argparse

52

45

import datetime

53

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

54

53

try:

55

54

import ConfigParser as configparser

56

55

except ImportError:

57

56

import configparser

57

import sys

58

import re

59

import os

59

60

import signal

60

61

import subprocess

61

62

import atexit

62

63

import stat

64

import logging

63

65

import logging.handlers

64

66

import pwd

65

67

import contextlib

77

79

import itertools

78

80

import collections

79

81

import codecs

80

import random

81

import shlex

82

83

import dbus

84

import dbus.service

85

import gi

86

from gi.repository import GLib

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

89

import avahi

87

90

from dbus.mainloop.glib import DBusGMainLoop

88

91

import ctypes

89

92

import ctypes.util

90

93

import xml.dom.minidom

91

94

import inspect

92

95

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

126

# Show warnings by default

127

if not sys.warnoptions:

128

import warnings

129

warnings.simplefilter("default")

130

131

# Try to find the value of SO_BINDTODEVICE:

132

try:

133

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

134

# newer, and it is also the most natural place for it:

96

try:

135

97

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

136

98

except AttributeError:

137

99

try:

138

# This is where SO_BINDTODEVICE was up to and including Python

139

# 2.6, and also 3.2:

140

100

from IN import SO_BINDTODEVICE

141

101

except ImportError:

142

# In Python 2.7 it seems to have been removed entirely.

143

# Try running the C preprocessor:

144

try:

145

cc = subprocess.Popen(["cc", "--language=c", "-E",

146

"/dev/stdin"],

147

stdin=subprocess.PIPE,

148

stdout=subprocess.PIPE)

149

stdout = cc.communicate(

150

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

151

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

152

except (OSError, ValueError, IndexError):

153

# No value found

154

SO_BINDTODEVICE = None

155

156

if sys.version_info < (3, 2):

157

configparser.Configparser = configparser.SafeConfigParser

158

159

version = "1.8.17"

102

SO_BINDTODEVICE = None

103

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

160

108

stored_state_file = "clients.pickle"

161

109

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

163

logging.captureWarnings(True) # Show warnings via the logging system

110

logger = logging.getLogger()

164

111

syslogger = None

165

112

166

113

try:

167

114

if_nametoindex = ctypes.cdll.LoadLibrary(

168

115

ctypes.util.find_library("c")).if_nametoindex

169

116

except (OSError, AttributeError):

170

117

171

118

def if_nametoindex(interface):

172

119

"Get an interface index the hard way, i.e. using fcntl()"

173

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

178

125

return interface_index

179

126

180

127

181

def copy_function(func):

182

"""Make a copy of a function"""

183

if sys.version_info.major == 2:

184

return types.FunctionType(func.func_code,

185

func.func_globals,

186

func.func_name,

187

func.func_defaults,

188

func.func_closure)

189

else:

190

return types.FunctionType(func.__code__,

191

func.__globals__,

192

func.__name__,

193

func.__defaults__,

194

func.__closure__)

195

196

197

128

def initlogger(debug, level=logging.WARNING):

198

129

"""init logger and add loglevel"""

199

130

200

131

global syslogger

201

132

syslogger = (logging.handlers.SysLogHandler(

202

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

address="/dev/log"))

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

204

135

syslogger.setFormatter(logging.Formatter

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

208

136

('Mandos [%(process)d]: %(levelname)s:'

137

' %(message)s'))

138

logger.addHandler(syslogger)

139

209

140

if debug:

210

141

console = logging.StreamHandler()

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

147

logger.setLevel(level)

217

148

218

149

219

150

class PGPError(Exception):

221

152

pass

222

153

223

154

224

class PGPEngine:

155

class PGPEngine(object):

225

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

226

157

227

158

def __init__(self):

228

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

229

self.gpg = "gpg"

230

try:

231

output = subprocess.check_output(["gpgconf"])

232

for line in output.splitlines():

233

name, text, path = line.split(b":")

234

if name == b"gpg":

235

self.gpg = path

236

break

237

except OSError as e:

238

if e.errno != errno.ENOENT:

239

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

244

# Only GPG version 1 has the --no-use-agent option.

245

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

246

self.gnupgargs.append("--no-use-agent")

247

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

165

248

166

def __enter__(self):

249

167

return self

250

168

251

169

def __exit__(self, exc_type, exc_value, traceback):

252

170

self._cleanup()

253

171

return False

254

172

255

173

def __del__(self):

256

174

self._cleanup()

257

175

258

176

def _cleanup(self):

259

177

if self.tempdir is not None:

260

178

# Delete contents of tempdir

261

179

for root, dirs, files in os.walk(self.tempdir,

262

topdown=False):

180

topdown = False):

263

181

for filename in files:

264

182

os.remove(os.path.join(root, filename))

265

183

for dirname in dirs:

267

185

# Remove tempdir

268

186

os.rmdir(self.tempdir)

269

187

self.tempdir = None

270

188

271

189

def password_encode(self, password):

272

190

# Passphrase can not be empty and can not contain newlines or

273

191

# NUL bytes. So we prefix it and hex encode it.

278

196

.replace(b"\n", b"\\n")

279

197

.replace(b"\0", b"\\x00"))

280

198

return encoded

281

199

282

200

def encrypt(self, data, password):

283

201

passphrase = self.password_encode(password)

284

202

with tempfile.NamedTemporaryFile(

285

203

dir=self.tempdir) as passfile:

286

204

passfile.write(passphrase)

287

205

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

290

208

passfile.name]

291

209

+ self.gnupgargs,

292

stdin=subprocess.PIPE,

293

stdout=subprocess.PIPE,

294

stderr=subprocess.PIPE)

295

ciphertext, err = proc.communicate(input=data)

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

296

214

if proc.returncode != 0:

297

215

raise PGPError(err)

298

216

return ciphertext

299

217

300

218

def decrypt(self, data, password):

301

219

passphrase = self.password_encode(password)

302

220

with tempfile.NamedTemporaryFile(

303

dir=self.tempdir) as passfile:

221

dir = self.tempdir) as passfile:

304

222

passfile.write(passphrase)

305

223

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

308

226

passfile.name]

309

227

+ self.gnupgargs,

310

stdin=subprocess.PIPE,

311

stdout=subprocess.PIPE,

312

stderr=subprocess.PIPE)

313

decrypted_plaintext, err = proc.communicate(input=data)

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

314

232

if proc.returncode != 0:

315

233

raise PGPError(err)

316

234

return decrypted_plaintext

317

235

318

236

319

# Pretend that we have an Avahi module

320

class avahi:

321

"""This isn't so much a class as it is a module-like namespace."""

322

IF_UNSPEC = -1 # avahi-common/address.h

323

PROTO_UNSPEC = -1 # avahi-common/address.h

324

PROTO_INET = 0 # avahi-common/address.h

325

PROTO_INET6 = 1 # avahi-common/address.h

326

DBUS_NAME = "org.freedesktop.Avahi"

327

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

328

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

329

DBUS_PATH_SERVER = "/"

330

331

@staticmethod

332

def string_array_to_txt_array(t):

333

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

334

for s in t), signature="ay")

335

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

336

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

337

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

338

SERVER_INVALID = 0 # avahi-common/defs.h

339

SERVER_REGISTERING = 1 # avahi-common/defs.h

340

SERVER_RUNNING = 2 # avahi-common/defs.h

341

SERVER_COLLISION = 3 # avahi-common/defs.h

342

SERVER_FAILURE = 4 # avahi-common/defs.h

343

344

345

237

class AvahiError(Exception):

346

238

def __init__(self, value, *args, **kwargs):

347

239

self.value = value

357

249

pass

358

250

359

251

360

class AvahiService:

252

class AvahiService(object):

361

253

"""An Avahi (Zeroconf) service.

362

254

363

255

Attributes:

364

256

interface: integer; avahi.IF_UNSPEC or an interface index.

365

257

Used to optionally bind to the specified interface.

366

name: string; Example: "Mandos"

367

type: string; Example: "_mandos._tcp".

258

name: string; Example: 'Mandos'

259

type: string; Example: '_mandos._tcp'.

368

260

See <https://www.iana.org/assignments/service-names-port-numbers>

369

261

port: integer; what port to announce

370

262

TXT: list of strings; TXT record for the service

377

269

server: D-Bus Server

378

270

bus: dbus.SystemBus()

379

271

"""

380

272

381

273

def __init__(self,

382

interface=avahi.IF_UNSPEC,

383

name=None,

384

servicetype=None,

385

port=None,

386

TXT=None,

387

domain="",

388

host="",

389

max_renames=32768,

390

protocol=avahi.PROTO_UNSPEC,

391

bus=None):

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

392

284

self.interface = interface

393

285

self.name = name

394

286

self.type = servicetype

403

295

self.server = None

404

296

self.bus = bus

405

297

self.entry_group_state_changed_match = None

406

298

407

299

def rename(self, remove=True):

408

300

"""Derived from the Avahi example code"""

409

301

if self.rename_count >= self.max_renames:

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

302

logger.critical("No suitable Zeroconf service name found"

303

" after %i retries, exiting.",

304

self.rename_count)

413

305

raise AvahiServiceError("Too many renames")

414

306

self.name = str(

415

307

self.server.GetAlternativeServiceName(self.name))

416

308

self.rename_count += 1

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

309

logger.info("Changing Zeroconf service name to %r ...",

310

self.name)

419

311

if remove:

420

312

self.remove()

421

313

try:

423

315

except dbus.exceptions.DBusException as error:

424

316

if (error.get_dbus_name()

425

317

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

318

logger.info("Local Zeroconf service name collision.")

427

319

return self.rename(remove=False)

428

320

else:

429

log.critical("D-Bus Exception", exc_info=error)

321

logger.critical("D-Bus Exception", exc_info=error)

430

322

self.cleanup()

431

323

os._exit(1)

432

324

433

325

def remove(self):

434

326

"""Derived from the Avahi example code"""

435

327

if self.entry_group_state_changed_match is not None:

437

329

self.entry_group_state_changed_match = None

438

330

if self.group is not None:

439

331

self.group.Reset()

440

332

441

333

def add(self):

442

334

"""Derived from the Avahi example code"""

443

335

self.remove()

448

340

avahi.DBUS_INTERFACE_ENTRY_GROUP)

449

341

self.entry_group_state_changed_match = (

450

342

self.group.connect_to_signal(

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

343

'StateChanged', self.entry_group_state_changed))

344

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

345

self.name, self.type)

454

346

self.group.AddService(

455

347

self.interface,

456

348

self.protocol,

460

352

dbus.UInt16(self.port),

461

353

avahi.string_array_to_txt_array(self.TXT))

462

354

self.group.Commit()

463

355

464

356

def entry_group_state_changed(self, state, error):

465

357

"""Derived from the Avahi example code"""

466

log.debug("Avahi entry group state change: %i", state)

467

358

logger.debug("Avahi entry group state change: %i", state)

359

468

360

if state == avahi.ENTRY_GROUP_ESTABLISHED:

469

log.debug("Zeroconf service established.")

361

logger.debug("Zeroconf service established.")

470

362

elif state == avahi.ENTRY_GROUP_COLLISION:

471

log.info("Zeroconf service name collision.")

363

logger.info("Zeroconf service name collision.")

472

364

self.rename()

473

365

elif state == avahi.ENTRY_GROUP_FAILURE:

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

366

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

476

368

raise AvahiGroupError("State changed: {!s}".format(error))

477

369

478

370

def cleanup(self):

479

371

"""Derived from the Avahi example code"""

480

372

if self.group is not None:

485

377

pass

486

378

self.group = None

487

379

self.remove()

488

380

489

381

def server_state_changed(self, state, error=None):

490

382

"""Derived from the Avahi example code"""

491

log.debug("Avahi server state change: %i", state)

383

logger.debug("Avahi server state change: %i", state)

492

384

bad_states = {

493

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

386

avahi.SERVER_REGISTERING: None,

498

390

if state in bad_states:

499

391

if bad_states[state] is not None:

500

392

if error is None:

501

log.error(bad_states[state])

393

logger.error(bad_states[state])

502

394

else:

503

log.error(bad_states[state] + ": %r", error)

395

logger.error(bad_states[state] + ": %r", error)

504

396

self.cleanup()

505

397

elif state == avahi.SERVER_RUNNING:

506

398

try:

508

400

except dbus.exceptions.DBusException as error:

509

401

if (error.get_dbus_name()

510

402

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

403

logger.info("Local Zeroconf service name"

404

" collision.")

512

405

return self.rename(remove=False)

513

406

else:

514

log.critical("D-Bus Exception", exc_info=error)

407

logger.critical("D-Bus Exception", exc_info=error)

515

408

self.cleanup()

516

409

os._exit(1)

517

410

else:

518

411

if error is None:

519

log.debug("Unknown state: %r", state)

412

logger.debug("Unknown state: %r", state)

520

413

else:

521

log.debug("Unknown state: %r: %r", state, error)

522

414

logger.debug("Unknown state: %r: %r", state, error)

415

523

416

def activate(self):

524

417

"""Derived from the Avahi example code"""

525

418

if self.server is None:

536

429

class AvahiServiceToSyslog(AvahiService):

537

430

def rename(self, *args, **kwargs):

538

431

"""Add the new name to the syslog messages"""

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

432

ret = AvahiService.rename(self, *args, **kwargs)

541

433

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

543

435

.format(self.name)))

544

436

return ret

545

437

546

547

# Pretend that we have a GnuTLS module

548

class gnutls:

549

"""This isn't so much a class as it is a module-like namespace."""

550

551

library = ctypes.util.find_library("gnutls")

552

if library is None:

553

library = ctypes.util.find_library("gnutls-deb0")

554

_library = ctypes.cdll.LoadLibrary(library)

555

del library

556

557

# Unless otherwise indicated, the constants and types below are

558

# all from the gnutls/gnutls.h C header file.

559

560

# Constants

561

E_SUCCESS = 0

562

E_INTERRUPTED = -52

563

E_AGAIN = -28

564

CRT_OPENPGP = 2

565

CRT_RAWPK = 3

566

CLIENT = 2

567

SHUT_RDWR = 0

568

CRD_CERTIFICATE = 1

569

E_NO_CERTIFICATE_FOUND = -49

570

X509_FMT_DER = 0

571

NO_TICKETS = 1<<10

572

ENABLE_RAWPK = 1<<18

573

CTYPE_PEERS = 3

574

KEYID_USE_SHA256 = 1 # gnutls/x509.h

575

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

577

# Types

578

class _session_int(ctypes.Structure):

579

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

581

582

class certificate_credentials_st(ctypes.Structure):

583

_fields_ = []

584

certificate_credentials_t = ctypes.POINTER(

585

certificate_credentials_st)

586

certificate_type_t = ctypes.c_int

587

588

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

591

592

class _openpgp_crt_int(ctypes.Structure):

593

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

595

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

credentials_type_t = ctypes.c_int

598

transport_ptr_t = ctypes.c_void_p

599

close_request_t = ctypes.c_int

600

601

# Exceptions

602

class Error(Exception):

603

def __init__(self, message=None, code=None, args=()):

604

# Default usage is by a message string, but if a return

605

# code is passed, convert it to a string with

606

# gnutls.strerror()

607

self.code = code

608

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

611

return super(gnutls.Error, self).__init__(

612

message, *args)

613

614

class CertificateSecurityError(Error):

615

pass

616

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

# Classes

643

class Credentials(With_from_param):

644

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

647

self.type = gnutls.CRD_CERTIFICATE

648

649

def __del__(self):

650

gnutls.certificate_free_credentials(self)

651

652

class ClientSession(With_from_param):

653

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

655

gnutls_flags = gnutls.CLIENT

656

if gnutls.check_version(b"3.5.6"):

657

gnutls_flags |= gnutls.NO_TICKETS

658

if gnutls.has_rawpk:

659

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

661

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

665

self.socket = socket

666

if credentials is None:

667

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

670

self.credentials = credentials

671

672

def __del__(self):

673

gnutls.deinit(self)

674

675

def handshake(self):

676

return gnutls.handshake(self)

677

678

def send(self, data):

679

data = bytes(data)

680

data_len = len(data)

681

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

683

data_len)

684

685

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

687

688

# Error handling functions

689

def _error_code(result):

690

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

693

return result

694

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

raise gnutls.CertificateSecurityError(code=result)

696

raise gnutls.Error(code=result)

697

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

700

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

703

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

return _error_code(result)

705

result = func(*arguments)

706

return result

707

708

# Unless otherwise indicated, the function declarations below are

709

# all from the gnutls/gnutls.h C header file.

710

711

# Functions

712

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

714

ctypes.POINTER(ctypes.c_char_p)]

715

priority_set_direct.restype = _error_code

716

717

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

719

init.restype = _error_code

720

721

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

723

set_default_priority.restype = _error_code

724

725

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

727

ctypes.c_size_t]

728

record_send.restype = ctypes.c_ssize_t

729

record_send.errcheck = _retry_on_error

730

731

certificate_allocate_credentials = (

732

_library.gnutls_certificate_allocate_credentials)

733

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

735

certificate_allocate_credentials.restype = _error_code

736

737

certificate_free_credentials = (

738

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

740

certificate_free_credentials.restype = None

741

742

handshake_set_private_extensions = (

743

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

745

ctypes.c_int]

746

handshake_set_private_extensions.restype = None

747

748

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

751

credentials_set.restype = _error_code

752

753

strerror = _library.gnutls_strerror

754

strerror.argtypes = [ctypes.c_int]

755

strerror.restype = ctypes.c_char_p

756

757

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

759

certificate_type_get.restype = _error_code

760

761

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

763

ctypes.POINTER(ctypes.c_uint)]

764

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

766

global_set_log_level = _library.gnutls_global_set_log_level

767

global_set_log_level.argtypes = [ctypes.c_int]

768

global_set_log_level.restype = None

769

770

global_set_log_function = _library.gnutls_global_set_log_function

771

global_set_log_function.argtypes = [log_func]

772

global_set_log_function.restype = None

773

774

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

776

deinit.restype = None

777

778

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

781

handshake.errcheck = _retry_on_error

782

783

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

785

transport_set_ptr.restype = None

786

787

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

790

bye.errcheck = _retry_on_error

791

792

check_version = _library.gnutls_check_version

793

check_version.argtypes = [ctypes.c_char_p]

794

check_version.restype = ctypes.c_char_p

795

796

_need_version = b"3.3.0"

797

if check_version(_need_version) is None:

798

raise self.Error("Needs GnuTLS {} or later"

799

.format(_need_version))

800

801

_tls_rawpk_version = b"3.6.6"

802

has_rawpk = bool(check_version(_tls_rawpk_version))

803

804

if has_rawpk:

805

# Types

806

class pubkey_st(ctypes.Structure):

807

_fields = []

808

pubkey_t = ctypes.POINTER(pubkey_st)

809

810

x509_crt_fmt_t = ctypes.c_int

811

812

# All the function declarations below are from

813

# gnutls/abstract.h

814

pubkey_init = _library.gnutls_pubkey_init

815

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

pubkey_init.restype = _error_code

817

818

pubkey_import = _library.gnutls_pubkey_import

819

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

820

x509_crt_fmt_t]

821

pubkey_import.restype = _error_code

822

823

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

824

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

825

ctypes.POINTER(ctypes.c_ubyte),

826

ctypes.POINTER(ctypes.c_size_t)]

827

pubkey_get_key_id.restype = _error_code

828

829

pubkey_deinit = _library.gnutls_pubkey_deinit

830

pubkey_deinit.argtypes = [pubkey_t]

831

pubkey_deinit.restype = None

832

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

835

836

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

838

openpgp_crt_init.restype = _error_code

839

840

openpgp_crt_import = _library.gnutls_openpgp_crt_import

841

openpgp_crt_import.argtypes = [openpgp_crt_t,

842

ctypes.POINTER(datum_t),

843

openpgp_crt_fmt_t]

844

openpgp_crt_import.restype = _error_code

845

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

853

openpgp_crt_verify_self.restype = _error_code

854

855

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

856

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

857

openpgp_crt_deinit.restype = None

858

859

openpgp_crt_get_fingerprint = (

860

_library.gnutls_openpgp_crt_get_fingerprint)

861

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

862

ctypes.c_void_p,

863

ctypes.POINTER(

864

ctypes.c_size_t)]

865

openpgp_crt_get_fingerprint.restype = _error_code

866

867

if check_version(b"3.6.4"):

868

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

870

certificate_type_get2.restype = _error_code

871

872

# Remove non-public functions

873

del _error_code, _retry_on_error

874

875

876

438

def call_pipe(connection, # : multiprocessing.Connection

877

439

func, *args, **kwargs):

878

440

"""This function is meant to be called by multiprocessing.Process

879

441

880

442

This function runs func(*args, **kwargs), and writes the resulting

881

443

return value on the provided multiprocessing.Connection.

882

444

"""

883

445

connection.send(func(*args, **kwargs))

884

446

connection.close()

885

447

886

887

class Client:

448

class Client(object):

888

449

"""A representation of a client host served by this server.

889

450

890

451

Attributes:

891

approved: bool(); None if not yet approved/disapproved

452

approved: bool(); 'None' if not yet approved/disapproved

892

453

approval_delay: datetime.timedelta(); Time to wait for approval

893

454

approval_duration: datetime.timedelta(); Duration of one approval

894

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

896

running.

897

checker_callback_tag: a GLib event source tag, or None

455

checker: subprocess.Popen(); a running checker process used

456

to see if the client lives.

457

'None' if no process is running.

458

checker_callback_tag: a gobject event source tag, or None

898

459

checker_command: string; External command which is run to check

899

460

if client lives. %() expansions are done at

900

461

runtime with vars(self) as dict, so that for

901

462

instance %(name)s can be used in the command.

902

checker_initiator_tag: a GLib event source tag, or None

463

checker_initiator_tag: a gobject event source tag, or None

903

464

created: datetime.datetime(); (UTC) object creation

904

465

client_structure: Object describing what attributes a client has

905

466

and is used for storing the client at exit

906

467

current_checker_command: string; current running checker_command

907

disable_initiator_tag: a GLib event source tag, or None

468

disable_initiator_tag: a gobject event source tag, or None

908

469

enabled: bool()

909

470

fingerprint: string (40 or 32 hexadecimal digits); used to

910

uniquely identify an OpenPGP client

911

key_id: string (64 hexadecimal digits); used to uniquely identify

912

a client using raw public keys

471

uniquely identify the client

913

472

host: string; available for use by the checker command

914

473

interval: datetime.timedelta(); How often to start a new checker

915

474

last_approval_request: datetime.datetime(); (UTC) or None

931

490

disabled, or None

932

491

server_settings: The server_settings dict from main()

933

492

"""

934

493

935

494

runtime_expansions = ("approval_delay", "approval_duration",

936

"created", "enabled", "expires", "key_id",

495

"created", "enabled", "expires",

937

496

"fingerprint", "host", "interval",

938

497

"last_approval_request", "last_checked_ok",

939

498

"last_enabled", "name", "timeout")

948

507

"approved_by_default": "True",

949

508

"enabled": "True",

950

509

}

951

510

952

511

@staticmethod

953

512

def config_parser(config):

954

513

"""Construct a new dict of client settings of this form:

961

520

for client_name in config.sections():

962

521

section = dict(config.items(client_name))

963

522

client = settings[client_name] = {}

964

523

965

524

client["host"] = section["host"]

966

525

# Reformat values from string types to Python types

967

526

client["approved_by_default"] = config.getboolean(

968

527

client_name, "approved_by_default")

969

528

client["enabled"] = config.getboolean(client_name,

970

529

"enabled")

971

972

# Uppercase and remove spaces from key_id and fingerprint

973

# for later comparison purposes with return value from the

974

# key_id() and fingerprint() functions

975

client["key_id"] = (section.get("key_id", "").upper()

976

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

979

535

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

985

536

if "secret" in section:

986

client["secret"] = codecs.decode(section["secret"]

987

.encode("utf-8"),

988

"base64")

537

client["secret"] = section["secret"].decode("base64")

989

538

elif "secfile" in section:

990

539

with open(os.path.expanduser(os.path.expandvars

991

540

(section["secfile"])),

1006

555

client["last_approval_request"] = None

1007

556

client["last_checked_ok"] = None

1008

557

client["last_checker_status"] = -2

1009

558

1010

559

return settings

1011

1012

def __init__(self, settings, name=None, server_settings=None):

560

561

def __init__(self, settings, name = None, server_settings=None):

1013

562

self.name = name

1014

563

if server_settings is None:

1015

564

server_settings = {}

1017

566

# adding all client settings

1018

567

for setting, value in settings.items():

1019

568

setattr(self, setting, value)

1020

569

1021

570

if self.enabled:

1022

571

if not hasattr(self, "last_enabled"):

1023

572

self.last_enabled = datetime.datetime.utcnow()

1027

576

else:

1028

577

self.last_enabled = None

1029

578

self.expires = None

1030

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

579

580

logger.debug("Creating client %r", self.name)

581

logger.debug(" Fingerprint: %s", self.fingerprint)

1034

582

self.created = settings.get("created",

1035

583

datetime.datetime.utcnow())

1036

584

1037

585

# attributes specific for this server instance

1038

586

self.checker = None

1039

587

self.checker_initiator_tag = None

1045

593

self.changedstate = multiprocessing_manager.Condition(

1046

594

multiprocessing_manager.Lock())

1047

595

self.client_structure = [attr

1048

for attr in self.__dict__.keys()

596

for attr in self.__dict__.iterkeys()

1049

597

if not attr.startswith("_")]

1050

598

self.client_structure.append("client_structure")

1051

599

1052

600

for name, t in inspect.getmembers(

1053

601

type(self), lambda obj: isinstance(obj, property)):

1054

602

if not name.startswith("_"):

1055

603

self.client_structure.append(name)

1056

604

1057

605

# Send notice to process children that client state has changed

1058

606

def send_changedstate(self):

1059

607

with self.changedstate:

1060

608

self.changedstate.notify_all()

1061

609

1062

610

def enable(self):

1063

611

"""Start this client's checker and timeout hooks"""

1064

612

if getattr(self, "enabled", False):

1065

613

# Already enabled

1066

614

return

615

self.expires = datetime.datetime.utcnow() + self.timeout

1067

616

self.enabled = True

1068

617

self.last_enabled = datetime.datetime.utcnow()

1069

618

self.init_checker()

1070

619

self.send_changedstate()

1071

620

1072

621

def disable(self, quiet=True):

1073

622

"""Disable this client."""

1074

623

if not getattr(self, "enabled", False):

1075

624

return False

1076

625

if not quiet:

1077

log.info("Disabling client %s", self.name)

626

logger.info("Disabling client %s", self.name)

1078

627

if getattr(self, "disable_initiator_tag", None) is not None:

1079

GLib.source_remove(self.disable_initiator_tag)

628

gobject.source_remove(self.disable_initiator_tag)

1080

629

self.disable_initiator_tag = None

1081

630

self.expires = None

1082

631

if getattr(self, "checker_initiator_tag", None) is not None:

1083

GLib.source_remove(self.checker_initiator_tag)

632

gobject.source_remove(self.checker_initiator_tag)

1084

633

self.checker_initiator_tag = None

1085

634

self.stop_checker()

1086

635

self.enabled = False

1087

636

if not quiet:

1088

637

self.send_changedstate()

1089

# Do not run this again if called by a GLib.timeout_add

638

# Do not run this again if called by a gobject.timeout_add

1090

639

return False

1091

640

1092

641

def __del__(self):

1093

642

self.disable()

1094

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

643

644

def init_checker(self):

645

# Schedule a new checker to be started an 'interval' from now,

646

# and every interval from then on.

1100

647

if self.checker_initiator_tag is not None:

1101

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

652

# Schedule a disable() when 'timeout' has passed

1119

653

if self.disable_initiator_tag is not None:

1120

GLib.source_remove(self.disable_initiator_tag)

1121

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1124

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

657

# Also start a new checker *right now*.

658

self.start_checker()

659

1125

660

def checker_callback(self, source, condition, connection,

1126

661

command):

1127

662

"""The checker has completed, so take appropriate actions."""

663

self.checker_callback_tag = None

664

self.checker = None

1128

665

# Read return code from connection (see call_pipe)

1129

666

returncode = connection.recv()

1130

667

connection.close()

1131

if self.checker is not None:

1132

self.checker.join()

1133

self.checker_callback_tag = None

1134

self.checker = None

1135

668

1136

669

if returncode >= 0:

1137

670

self.last_checker_status = returncode

1138

671

self.last_checker_signal = None

1139

672

if self.last_checker_status == 0:

1140

log.info("Checker for %(name)s succeeded", vars(self))

673

logger.info("Checker for %(name)s succeeded",

674

vars(self))

1141

675

self.checked_ok()

1142

676

else:

1143

log.info("Checker for %(name)s failed", vars(self))

677

logger.info("Checker for %(name)s failed", vars(self))

1144

678

else:

1145

679

self.last_checker_status = -1

1146

680

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

681

logger.warning("Checker for %(name)s crashed?",

682

vars(self))

1148

683

return False

1149

684

1150

685

def checked_ok(self):

1151

686

"""Assert that the client has been seen, alive and well."""

1152

687

self.last_checked_ok = datetime.datetime.utcnow()

1153

688

self.last_checker_status = 0

1154

689

self.last_checker_signal = None

1155

690

self.bump_timeout()

1156

691

1157

692

def bump_timeout(self, timeout=None):

1158

693

"""Bump up the timeout for this client."""

1159

694

if timeout is None:

1160

695

timeout = self.timeout

1161

696

if self.disable_initiator_tag is not None:

1162

GLib.source_remove(self.disable_initiator_tag)

697

gobject.source_remove(self.disable_initiator_tag)

1163

698

self.disable_initiator_tag = None

1164

699

if getattr(self, "enabled", False):

1165

self.disable_initiator_tag = GLib.timeout_add(

700

self.disable_initiator_tag = gobject.timeout_add(

1166

701

int(timeout.total_seconds() * 1000), self.disable)

1167

702

self.expires = datetime.datetime.utcnow() + timeout

1168

703

1169

704

def need_approval(self):

1170

705

self.last_approval_request = datetime.datetime.utcnow()

1171

1172

def start_checker(self, start_was_randomized=False):

706

707

def start_checker(self):

1173

708

"""Start a new checker subprocess if one is not running.

1174

709

1175

710

If a checker already exists, leave it running and do

1176

711

nothing."""

1177

712

# The reason for not killing a running checker is that if we

1182

717

# checkers alone, the checker would have to take more time

1183

718

# than 'timeout' for the client to be disabled, which is as it

1184

719

# should be.

1185

720

1186

721

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

722

logger.warning("Checker was not alive; joining")

1188

723

self.checker.join()

1189

724

self.checker = None

1190

725

# Start a new checker if needed

1191

726

if self.checker is None:

1192

727

# Escape attributes for the shell

1193

728

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1195

for attr in self.runtime_expansions}

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

1196

731

try:

1197

732

command = self.checker_command % escaped_attrs

1198

733

except TypeError as error:

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

1201

737

return True # Try again later

1202

738

self.current_checker_command = command

1203

log.info("Starting checker %r for %s", command, self.name)

739

logger.info("Starting checker %r for %s", command,

740

self.name)

1204

741

# We don't need to redirect stdout and stderr, since

1205

742

# in normal mode, that is already done by daemon(),

1206

743

# and in debug mode we don't want to. (Stdin is

1208

745

# The exception is when not debugging but nevertheless

1209

746

# running in the foreground; use the previously

1210

747

# created wnull.

1211

popen_args = {"close_fds": True,

1212

"shell": True,

1213

"cwd": "/"}

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

1214

751

if (not self.server_settings["debug"]

1215

752

and self.server_settings["foreground"]):

1216

753

popen_args.update({"stdout": wnull,

1217

"stderr": wnull})

1218

pipe = multiprocessing.Pipe(duplex=False)

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

1219

756

self.checker = multiprocessing.Process(

1220

target=call_pipe,

1221

args=(pipe[1], subprocess.call, command),

1222

kwargs=popen_args)

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

1223

760

self.checker.start()

1224

self.checker_callback_tag = GLib.io_add_watch(

1225

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

1227

763

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

# Re-run this periodically if run by GLib.timeout_add

764

# Re-run this periodically if run by gobject.timeout_add

1240

765

return True

1241

766

1242

767

def stop_checker(self):

1243

768

"""Force the checker process, if any, to stop."""

1244

769

if self.checker_callback_tag:

1245

GLib.source_remove(self.checker_callback_tag)

770

gobject.source_remove(self.checker_callback_tag)

1246

771

self.checker_callback_tag = None

1247

772

if getattr(self, "checker", None) is None:

1248

773

return

1249

log.debug("Stopping checker for %(name)s", vars(self))

774

logger.debug("Stopping checker for %(name)s", vars(self))

1250

775

self.checker.terminate()

1251

776

self.checker = None

1252

777

1257

782

byte_arrays=False):

1258

783

"""Decorators for marking methods of a DBusObjectWithProperties to

1259

784

become properties on the D-Bus.

1260

785

1261

786

The decorated method will be called with no arguments by "Get"

1262

787

and with one argument by "Set".

1263

788

1264

789

The parameters, where they are supported, are the same as

1265

790

dbus.service.method, except there is only "signature", since the

1266

791

type from Get() and the type sent to Set() is the same.

1270

795

if byte_arrays and signature != "ay":

1271

796

raise ValueError("Byte arrays not supported for non-'ay'"

1272

797

" signature {!r}".format(signature))

1273

798

1274

799

def decorator(func):

1275

800

func._dbus_is_property = True

1276

801

func._dbus_interface = dbus_interface

1279

804

func._dbus_name = func.__name__

1280

805

if func._dbus_name.endswith("_dbus_property"):

1281

806

func._dbus_name = func._dbus_name[:-14]

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1283

808

return func

1284

809

1285

810

return decorator

1286

811

1287

812

1288

813

def dbus_interface_annotations(dbus_interface):

1289

814

"""Decorator for marking functions returning interface annotations

1290

815

1291

816

Usage:

1292

817

1293

818

@dbus_interface_annotations("org.example.Interface")

1294

819

def _foo(self): # Function name does not matter

1295

820

return {"org.freedesktop.DBus.Deprecated": "true",

1296

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1297

822

"false"}

1298

823

"""

1299

824

1300

825

def decorator(func):

1301

826

func._dbus_is_interface = True

1302

827

func._dbus_interface = dbus_interface

1303

828

func._dbus_name = dbus_interface

1304

829

return func

1305

830

1306

831

return decorator

1307

832

1308

833

1309

834

def dbus_annotations(annotations):

1310

835

"""Decorator to annotate D-Bus methods, signals or properties

1311

836

Usage:

1312

837

1313

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1314

839

"org.freedesktop.DBus.Property."

1315

840

"EmitsChangedSignal": "false"})

1317

842

access="r")

1318

843

def Property_dbus_property(self):

1319

844

return dbus.Boolean(False)

1320

845

1321

846

See also the DBusObjectWithAnnotations class.

1322

847

"""

1323

848

1324

849

def decorator(func):

1325

850

func._dbus_annotations = annotations

1326

851

return func

1327

852

1328

853

return decorator

1329

854

1330

855

1348

873

1349

874

class DBusObjectWithAnnotations(dbus.service.Object):

1350

875

"""A D-Bus object with annotations.

1351

876

1352

877

Classes inheriting from this can use the dbus_annotations

1353

878

decorator to add annotations to methods or signals.

1354

879

"""

1355

880

1356

881

@staticmethod

1357

882

def _is_dbus_thing(thing):

1358

883

"""Returns a function testing if an attribute is a D-Bus thing

1359

884

1360

885

If called like _is_dbus_thing("method") it returns a function

1361

886

suitable for use as predicate to inspect.getmembers().

1362

887

"""

1363

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1364

889

False)

1365

890

1366

891

def _get_all_dbus_things(self, thing):

1367

892

"""Returns a generator of (name, attribute) pairs

1368

893

"""

1371

896

for cls in self.__class__.__mro__

1372

897

for name, athing in

1373

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1374

899

1375

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

1379

904

def Introspect(self, object_path, connection):

1380

905

"""Overloading of standard D-Bus method.

1381

906

1382

907

Inserts annotation tags on methods and signals.

1383

908

"""

1384

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

1385

910

connection)

1386

911

try:

1387

912

document = xml.dom.minidom.parseString(xmlstring)

1388

913

1389

914

for if_tag in document.getElementsByTagName("interface"):

1390

915

# Add annotation tags

1391

916

for typ in ("method", "signal"):

1418

943

if_tag.appendChild(ann_tag)

1419

944

# Fix argument name for the Introspect method itself

1420

945

if (if_tag.getAttribute("name")

1421

== dbus.INTROSPECTABLE_IFACE):

946

== dbus.INTROSPECTABLE_IFACE):

1422

947

for cn in if_tag.getElementsByTagName("method"):

1423

948

if cn.getAttribute("name") == "Introspect":

1424

949

for arg in cn.getElementsByTagName("arg"):

1430

955

document.unlink()

1431

956

except (AttributeError, xml.dom.DOMException,

1432

957

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

1435

960

return xmlstring

1436

961

1437

962

1438

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1439

964

"""A D-Bus object with properties.

1440

965

1441

966

Classes inheriting from this can use the dbus_service_property

1442

967

decorator to expose methods as D-Bus properties. It exposes the

1443

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

1444

969

"""

1445

970

1446

971

def _get_dbus_property(self, interface_name, property_name):

1447

972

"""Returns a bound method if one exists which is a D-Bus

1448

973

property with the specified name and interface.

1453

978

if (value._dbus_name == property_name

1454

979

and value._dbus_interface == interface_name):

1455

980

return value.__get__(self)

1456

981

1457

982

# No such property

1458

983

raise DBusPropertyNotFound("{}:{}.{}".format(

1459

984

self.dbus_object_path, interface_name, property_name))

1460

985

1461

986

@classmethod

1462

987

def _get_all_interface_names(cls):

1463

988

"""Get a sequence of all interfaces supported by an object"""

1466

991

for x in (inspect.getmro(cls))

1467

992

for attr in dir(x))

1468

993

if name is not None)

1469

994

1470

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

1471

996

in_signature="ss",

1472

997

out_signature="v")

1480

1005

if not hasattr(value, "variant_level"):

1481

1006

return value

1482

1007

return type(value)(value, variant_level=value.variant_level+1)

1483

1008

1484

1009

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1485

1010

def Set(self, interface_name, property_name, value):

1486

1011

"""Standard D-Bus property Set() method, see D-Bus standard.

1495

1020

raise ValueError("Byte arrays not supported for non-"

1496

1021

"'ay' signature {!r}"

1497

1022

.format(prop._dbus_signature))

1498

value = dbus.ByteArray(bytes(value))

1023

value = dbus.ByteArray(b''.join(chr(byte)

1024

for byte in value))

1499

1025

prop(value)

1500

1026

1501

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1502

1028

in_signature="s",

1503

1029

out_signature="a{sv}")

1504

1030

def GetAll(self, interface_name):

1505

1031

"""Standard D-Bus property GetAll() method, see D-Bus

1506

1032

standard.

1507

1033

1508

1034

Note: Will not include properties with access="write".

1509

1035

"""

1510

1036

properties = {}

1521

1047

properties[name] = value

1522

1048

continue

1523

1049

properties[name] = type(value)(

1524

value, variant_level=value.variant_level + 1)

1050

value, variant_level = value.variant_level + 1)

1525

1051

return dbus.Dictionary(properties, signature="sv")

1526

1052

1527

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1528

1054

def PropertiesChanged(self, interface_name, changed_properties,

1529

1055

invalidated_properties):

1531

1057

standard.

1532

1058

"""

1533

1059

pass

1534

1060

1535

1061

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1536

1062

out_signature="s",

1537

path_keyword="object_path",

1538

connection_keyword="connection")

1063

path_keyword='object_path',

1064

connection_keyword='connection')

1539

1065

def Introspect(self, object_path, connection):

1540

1066

"""Overloading of standard D-Bus method.

1541

1067

1542

1068

Inserts property tags and interface annotation tags.

1543

1069

"""

1544

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1546

1072

connection)

1547

1073

try:

1548

1074

document = xml.dom.minidom.parseString(xmlstring)

1549

1075

1550

1076

def make_tag(document, name, prop):

1551

1077

e = document.createElement("property")

1552

1078

e.setAttribute("name", name)

1553

1079

e.setAttribute("type", prop._dbus_signature)

1554

1080

e.setAttribute("access", prop._dbus_access)

1555

1081

return e

1556

1082

1557

1083

for if_tag in document.getElementsByTagName("interface"):

1558

1084

# Add property tags

1559

1085

for tag in (make_tag(document, name, prop)

1597

1123

document.unlink()

1598

1124

except (AttributeError, xml.dom.DOMException,

1599

1125

xml.parsers.expat.ExpatError) as error:

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1126

logger.error("Failed to override Introspection method",

1127

exc_info=error)

1602

1128

return xmlstring

1603

1129

1604

1605

1130

try:

1606

1131

dbus.OBJECT_MANAGER_IFACE

1607

1132

except AttributeError:

1608

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1609

1134

1610

1611

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1612

1136

"""A D-Bus object with an ObjectManager.

1613

1137

1614

1138

Classes inheriting from this exposes the standard

1615

1139

GetManagedObjects call and the InterfacesAdded and

1616

1140

InterfacesRemoved signals on the standard

1617

1141

"org.freedesktop.DBus.ObjectManager" interface.

1618

1142

1619

1143

Note: No signals are sent automatically; they must be sent

1620

1144

manually.

1621

1145

"""

1622

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1623

out_signature="a{oa{sa{sv}}}")

1147

out_signature = "a{oa{sa{sv}}}")

1624

1148

def GetManagedObjects(self):

1625

1149

"""This function must be overridden"""

1626

1150

raise NotImplementedError()

1627

1151

1628

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1629

signature="oa{sa{sv}}")

1153

signature = "oa{sa{sv}}")

1630

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1631

1155

pass

1632

1633

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1158

signature = "oas")

1634

1159

def InterfacesRemoved(self, object_path, interfaces):

1635

1160

pass

1636

1161

1637

1162

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1163

out_signature = "s",

1164

path_keyword = 'object_path',

1165

connection_keyword = 'connection')

1641

1166

def Introspect(self, object_path, connection):

1642

1167

"""Overloading of standard D-Bus method.

1643

1168

1644

1169

Override return argument name of GetManagedObjects to be

1645

1170

"objpath_interfaces_and_properties"

1646

1171

"""

1647

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1648

object_path,

1649

connection)

1172

xmlstring = DBusObjectWithAnnotations(self, object_path,

1173

connection)

1650

1174

try:

1651

1175

document = xml.dom.minidom.parseString(xmlstring)

1652

1176

1653

1177

for if_tag in document.getElementsByTagName("interface"):

1654

1178

# Fix argument name for the GetManagedObjects method

1655

1179

if (if_tag.getAttribute("name")

1656

== dbus.OBJECT_MANAGER_IFACE):

1180

== dbus.OBJECT_MANAGER_IFACE):

1657

1181

for cn in if_tag.getElementsByTagName("method"):

1658

1182

if (cn.getAttribute("name")

1659

1183

== "GetManagedObjects"):

1668

1192

document.unlink()

1669

1193

except (AttributeError, xml.dom.DOMException,

1670

1194

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1673

1197

return xmlstring

1674

1198

1675

1676

1199

def datetime_to_dbus(dt, variant_level=0):

1677

1200

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1678

1201

if dt is None:

1679

return dbus.String("", variant_level=variant_level)

1202

return dbus.String("", variant_level = variant_level)

1680

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1681

1204

1682

1205

1685

1208

dbus.service.Object, it will add alternate D-Bus attributes with

1686

1209

interface names according to the "alt_interface_names" mapping.

1687

1210

Usage:

1688

1211

1689

1212

@alternate_dbus_interfaces({"org.example.Interface":

1690

1213

"net.example.AlternateInterface"})

1691

1214

class SampleDBusObject(dbus.service.Object):

1692

1215

@dbus.service.method("org.example.Interface")

1693

1216

def SampleDBusMethod():

1694

1217

pass

1695

1218

1696

1219

The above "SampleDBusMethod" on "SampleDBusObject" will be

1697

1220

reachable via two interfaces: "org.example.Interface" and

1698

1221

"net.example.AlternateInterface", the latter of which will have

1699

1222

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1700

1223

"true", unless "deprecate" is passed with a False value.

1701

1224

1702

1225

This works for methods and signals, and also for D-Bus properties

1703

1226

(from DBusObjectWithProperties) and interfaces (from the

1704

1227

dbus_interface_annotations decorator).

1705

1228

"""

1706

1229

1707

1230

def wrapper(cls):

1708

1231

for orig_interface_name, alt_interface_name in (

1709

1232

alt_interface_names.items()):

1724

1247

interface_names.add(alt_interface)

1725

1248

# Is this a D-Bus signal?

1726

1249

if getattr(attribute, "_dbus_is_signal", False):

1727

# Extract the original non-method undecorated

1728

# function by black magic

1729

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1730

1253

nonmethod_func = (dict(

1731

1254

zip(attribute.func_code.co_freevars,

1732

1255

attribute.__closure__))

1733

1256

["func"].cell_contents)

1734

1257

else:

1735

nonmethod_func = (dict(

1736

zip(attribute.__code__.co_freevars,

1737

attribute.__closure__))

1738

["func"].cell_contents)

1258

nonmethod_func = attribute

1739

1259

# Create a new, but exactly alike, function

1740

1260

# object, and decorate it to be a new D-Bus signal

1741

1261

# with the alternate D-Bus interface name

1742

new_function = copy_function(nonmethod_func)

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1743

1276

new_function = (dbus.service.signal(

1744

1277

alt_interface,

1745

1278

attribute._dbus_signature)(new_function))

1749

1282

attribute._dbus_annotations)

1750

1283

except AttributeError:

1751

1284

pass

1752

1753

1285

# Define a creator of a function to call both the

1754

1286

# original and alternate functions, so both the

1755

1287

# original and alternate signals gets sent when

1758

1290

"""This function is a scope container to pass

1759

1291

func1 and func2 to the "call_both" function

1760

1292

outside of its arguments"""

1761

1762

@functools.wraps(func2)

1293

1763

1294

def call_both(*args, **kwargs):

1764

1295

"""This function will emit two D-Bus

1765

1296

signals by calling func1 and func2"""

1766

1297

func1(*args, **kwargs)

1767

1298

func2(*args, **kwargs)

1768

# Make wrapper function look like a D-Bus

1769

# signal

1770

for name, attr in inspect.getmembers(func2):

1771

if name.startswith("_dbus_"):

1772

setattr(call_both, name, attr)

1773

1299

1774

1300

return call_both

1775

1301

# Create the "call_both" function and add it to

1776

1302

# the class

1786

1312

alt_interface,

1787

1313

attribute._dbus_in_signature,

1788

1314

attribute._dbus_out_signature)

1789

(copy_function(attribute)))

1315

(types.FunctionType(attribute.func_code,

1316

attribute.func_globals,

1317

attribute.func_name,

1318

attribute.func_defaults,

1319

attribute.func_closure)))

1790

1320

# Copy annotations, if any

1791

1321

try:

1792

1322

attr[attrname]._dbus_annotations = dict(

1804

1334

attribute._dbus_access,

1805

1335

attribute._dbus_get_args_options

1806

1336

["byte_arrays"])

1807

(copy_function(attribute)))

1337

(types.FunctionType(

1338

attribute.func_code,

1339

attribute.func_globals,

1340

attribute.func_name,

1341

attribute.func_defaults,

1342

attribute.func_closure)))

1808

1343

# Copy annotations, if any

1809

1344

try:

1810

1345

attr[attrname]._dbus_annotations = dict(

1819

1354

# to the class.

1820

1355

attr[attrname] = (

1821

1356

dbus_interface_annotations(alt_interface)

1822

(copy_function(attribute)))

1357

(types.FunctionType(attribute.func_code,

1358

attribute.func_globals,

1359

attribute.func_name,

1360

attribute.func_defaults,

1361

attribute.func_closure)))

1823

1362

if deprecate:

1824

1363

# Deprecate all alternate interfaces

1825

iname = "_AlternateDBusNames_interface_annotation{}"

1364

iname="_AlternateDBusNames_interface_annotation{}"

1826

1365

for interface_name in interface_names:

1827

1366

1828

1367

@dbus_interface_annotations(interface_name)

1829

1368

def func(self):

1830

return {"org.freedesktop.DBus.Deprecated":

1831

"true"}

1369

return { "org.freedesktop.DBus.Deprecated":

1370

"true" }

1832

1371

# Find an unused name

1833

1372

for aname in (iname.format(i)

1834

1373

for i in itertools.count()):

1838

1377

if interface_names:

1839

1378

# Replace the class with a new subclass of it with

1840

1379

# methods, signals, etc. as created above.

1841

if sys.version_info.major == 2:

1842

cls = type(b"{}Alternate".format(cls.__name__),

1843

(cls, ), attr)

1844

else:

1845

cls = type("{}Alternate".format(cls.__name__),

1846

(cls, ), attr)

1380

cls = type(b"{}Alternate".format(cls.__name__),

1381

(cls, ), attr)

1847

1382

return cls

1848

1383

1849

1384

return wrapper

1850

1385

1851

1386

1853

1388

"se.bsnet.fukt.Mandos"})

1854

1389

class ClientDBus(Client, DBusObjectWithProperties):

1855

1390

"""A Client class using D-Bus

1856

1391

1857

1392

Attributes:

1858

1393

dbus_object_path: dbus.ObjectPath

1859

1394

bus: dbus.SystemBus()

1860

1395

"""

1861

1396

1862

1397

runtime_expansions = (Client.runtime_expansions

1863

1398

+ ("dbus_object_path", ))

1864

1399

1865

1400

_interface = "se.recompile.Mandos.Client"

1866

1401

1867

1402

# dbus.service.Object doesn't use super(), so we can't either.

1868

1869

def __init__(self, bus=None, *args, **kwargs):

1403

1404

def __init__(self, bus = None, *args, **kwargs):

1870

1405

self.bus = bus

1871

1406

Client.__init__(self, *args, **kwargs)

1872

1407

# Only now, when this client is initialized, can it show up on

1878

1413

"/clients/" + client_object_name)

1879

1414

DBusObjectWithProperties.__init__(self, self.bus,

1880

1415

self.dbus_object_path)

1881

1416

1882

1417

def notifychangeproperty(transform_func, dbus_name,

1883

1418

type_func=lambda x: x,

1884

1419

variant_level=1,

1886

1421

_interface=_interface):

1887

1422

""" Modify a variable so that it's a property which announces

1888

1423

its changes to DBus.

1889

1424

1890

1425

transform_fun: Function that takes a value and a variant_level

1891

1426

and transforms it to a D-Bus type.

1892

1427

dbus_name: D-Bus name of the variable

1895

1430

variant_level: D-Bus variant level. Default: 1

1896

1431

"""

1897

1432

attrname = "_{}".format(dbus_name)

1898

1433

1899

1434

def setter(self, value):

1900

1435

if hasattr(self, "dbus_object_path"):

1901

1436

if (not hasattr(self, attrname) or

1908

1443

else:

1909

1444

dbus_value = transform_func(

1910

1445

type_func(value),

1911

variant_level=variant_level)

1446

variant_level = variant_level)

1912

1447

self.PropertyChanged(dbus.String(dbus_name),

1913

1448

dbus_value)

1914

1449

self.PropertiesChanged(

1915

1450

_interface,

1916

dbus.Dictionary({dbus.String(dbus_name):

1917

dbus_value}),

1451

dbus.Dictionary({ dbus.String(dbus_name):

1452

dbus_value }),

1918

1453

dbus.Array())

1919

1454

setattr(self, attrname, value)

1920

1455

1921

1456

return property(lambda self: getattr(self, attrname), setter)

1922

1457

1923

1458

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1924

1459

approvals_pending = notifychangeproperty(dbus.Boolean,

1925

1460

"ApprovalPending",

1926

type_func=bool)

1461

type_func = bool)

1927

1462

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1928

1463

last_enabled = notifychangeproperty(datetime_to_dbus,

1929

1464

"LastEnabled")

1930

1465

checker = notifychangeproperty(

1931

1466

dbus.Boolean, "CheckerRunning",

1932

type_func=lambda checker: checker is not None)

1467

type_func = lambda checker: checker is not None)

1933

1468

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1934

1469

"LastCheckedOK")

1935

1470

last_checker_status = notifychangeproperty(dbus.Int16,

1940

1475

"ApprovedByDefault")

1941

1476

approval_delay = notifychangeproperty(

1942

1477

dbus.UInt64, "ApprovalDelay",

1943

type_func=lambda td: td.total_seconds() * 1000)

1478

type_func = lambda td: td.total_seconds() * 1000)

1944

1479

approval_duration = notifychangeproperty(

1945

1480

dbus.UInt64, "ApprovalDuration",

1946

type_func=lambda td: td.total_seconds() * 1000)

1481

type_func = lambda td: td.total_seconds() * 1000)

1947

1482

host = notifychangeproperty(dbus.String, "Host")

1948

1483

timeout = notifychangeproperty(

1949

1484

dbus.UInt64, "Timeout",

1950

type_func=lambda td: td.total_seconds() * 1000)

1485

type_func = lambda td: td.total_seconds() * 1000)

1951

1486

extended_timeout = notifychangeproperty(

1952

1487

dbus.UInt64, "ExtendedTimeout",

1953

type_func=lambda td: td.total_seconds() * 1000)

1488

type_func = lambda td: td.total_seconds() * 1000)

1954

1489

interval = notifychangeproperty(

1955

1490

dbus.UInt64, "Interval",

1956

type_func=lambda td: td.total_seconds() * 1000)

1491

type_func = lambda td: td.total_seconds() * 1000)

1957

1492

checker_command = notifychangeproperty(dbus.String, "Checker")

1958

1493

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1959

1494

invalidate_only=True)

1960

1495

1961

1496

del notifychangeproperty

1962

1497

1963

1498

def __del__(self, *args, **kwargs):

1964

1499

try:

1965

1500

self.remove_from_connection()

1968

1503

if hasattr(DBusObjectWithProperties, "__del__"):

1969

1504

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1970

1505

Client.__del__(self, *args, **kwargs)

1971

1506

1972

1507

def checker_callback(self, source, condition,

1973

1508

connection, command, *args, **kwargs):

1974

1509

ret = Client.checker_callback(self, source, condition,

1990

1525

| self.last_checker_signal),

1991

1526

dbus.String(command))

1992

1527

return ret

1993

1528

1994

1529

def start_checker(self, *args, **kwargs):

1995

1530

old_checker_pid = getattr(self.checker, "pid", None)

1996

1531

r = Client.start_checker(self, *args, **kwargs)

2000

1535

# Emit D-Bus signal

2001

1536

self.CheckerStarted(self.current_checker_command)

2002

1537

return r

2003

1538

2004

1539

def _reset_approved(self):

2005

1540

self.approved = None

2006

1541

return False

2007

1542

2008

1543

def approve(self, value=True):

2009

1544

self.approved = value

2010

GLib.timeout_add(int(self.approval_duration.total_seconds()

2011

* 1000), self._reset_approved)

1545

gobject.timeout_add(int(self.approval_duration.total_seconds()

1546

* 1000), self._reset_approved)

2012

1547

self.send_changedstate()

2013

2014

# D-Bus methods, signals & properties

2015

2016

# Interfaces

2017

2018

# Signals

2019

1548

1549

## D-Bus methods, signals & properties

1550

1551

## Interfaces

1552

1553

## Signals

1554

2020

1555

# CheckerCompleted - signal

2021

1556

@dbus.service.signal(_interface, signature="nxs")

2022

1557

def CheckerCompleted(self, exitcode, waitstatus, command):

2023

1558

"D-Bus signal"

2024

1559

pass

2025

1560

2026

1561

# CheckerStarted - signal

2027

1562

@dbus.service.signal(_interface, signature="s")

2028

1563

def CheckerStarted(self, command):

2029

1564

"D-Bus signal"

2030

1565

pass

2031

1566

2032

1567

# PropertyChanged - signal

2033

1568

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2034

1569

@dbus.service.signal(_interface, signature="sv")

2035

1570

def PropertyChanged(self, property, value):

2036

1571

"D-Bus signal"

2037

1572

pass

2038

1573

2039

1574

# GotSecret - signal

2040

1575

@dbus.service.signal(_interface)

2041

1576

def GotSecret(self):

2044

1579

server to mandos-client

2045

1580

"""

2046

1581

pass

2047

1582

2048

1583

# Rejected - signal

2049

1584

@dbus.service.signal(_interface, signature="s")

2050

1585

def Rejected(self, reason):

2051

1586

"D-Bus signal"

2052

1587

pass

2053

1588

2054

1589

# NeedApproval - signal

2055

1590

@dbus.service.signal(_interface, signature="tb")

2056

1591

def NeedApproval(self, timeout, default):

2057

1592

"D-Bus signal"

2058

1593

return self.need_approval()

2059

2060

# Methods

2061

1594

1595

## Methods

1596

2062

1597

# Approve - method

2063

1598

@dbus.service.method(_interface, in_signature="b")

2064

1599

def Approve(self, value):

2065

1600

self.approve(value)

2066

1601

2067

1602

# CheckedOK - method

2068

1603

@dbus.service.method(_interface)

2069

1604

def CheckedOK(self):

2070

1605

self.checked_ok()

2071

1606

2072

1607

# Enable - method

2073

1608

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2074

1609

@dbus.service.method(_interface)

2075

1610

def Enable(self):

2076

1611

"D-Bus method"

2077

1612

self.enable()

2078

1613

2079

1614

# StartChecker - method

2080

1615

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2081

1616

@dbus.service.method(_interface)

2082

1617

def StartChecker(self):

2083

1618

"D-Bus method"

2084

1619

self.start_checker()

2085

1620

2086

1621

# Disable - method

2087

1622

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2088

1623

@dbus.service.method(_interface)

2089

1624

def Disable(self):

2090

1625

"D-Bus method"

2091

1626

self.disable()

2092

1627

2093

1628

# StopChecker - method

2094

1629

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2095

1630

@dbus.service.method(_interface)

2096

1631

def StopChecker(self):

2097

1632

self.stop_checker()

2098

2099

# Properties

2100

1633

1634

## Properties

1635

2101

1636

# ApprovalPending - property

2102

1637

@dbus_service_property(_interface, signature="b", access="read")

2103

1638

def ApprovalPending_dbus_property(self):

2104

1639

return dbus.Boolean(bool(self.approvals_pending))

2105

1640

2106

1641

# ApprovedByDefault - property

2107

1642

@dbus_service_property(_interface,

2108

1643

signature="b",

2111

1646

if value is None: # get

2112

1647

return dbus.Boolean(self.approved_by_default)

2113

1648

self.approved_by_default = bool(value)

2114

1649

2115

1650

# ApprovalDelay - property

2116

1651

@dbus_service_property(_interface,

2117

1652

signature="t",

2121

1656

return dbus.UInt64(self.approval_delay.total_seconds()

2122

1657

* 1000)

2123

1658

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2124

1659

2125

1660

# ApprovalDuration - property

2126

1661

@dbus_service_property(_interface,

2127

1662

signature="t",

2131

1666

return dbus.UInt64(self.approval_duration.total_seconds()

2132

1667

* 1000)

2133

1668

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2134

1669

2135

1670

# Name - property

2136

1671

@dbus_annotations(

2137

1672

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2138

1673

@dbus_service_property(_interface, signature="s", access="read")

2139

1674

def Name_dbus_property(self):

2140

1675

return dbus.String(self.name)

2141

2142

# KeyID - property

2143

@dbus_annotations(

2144

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2145

@dbus_service_property(_interface, signature="s", access="read")

2146

def KeyID_dbus_property(self):

2147

return dbus.String(self.key_id)

2148

1676

2149

1677

# Fingerprint - property

2150

1678

@dbus_annotations(

2151

1679

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2152

1680

@dbus_service_property(_interface, signature="s", access="read")

2153

1681

def Fingerprint_dbus_property(self):

2154

1682

return dbus.String(self.fingerprint)

2155

1683

2156

1684

# Host - property

2157

1685

@dbus_service_property(_interface,

2158

1686

signature="s",

2161

1689

if value is None: # get

2162

1690

return dbus.String(self.host)

2163

1691

self.host = str(value)

2164

1692

2165

1693

# Created - property

2166

1694

@dbus_annotations(

2167

1695

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2168

1696

@dbus_service_property(_interface, signature="s", access="read")

2169

1697

def Created_dbus_property(self):

2170

1698

return datetime_to_dbus(self.created)

2171

1699

2172

1700

# LastEnabled - property

2173

1701

@dbus_service_property(_interface, signature="s", access="read")

2174

1702

def LastEnabled_dbus_property(self):

2175

1703

return datetime_to_dbus(self.last_enabled)

2176

1704

2177

1705

# Enabled - property

2178

1706

@dbus_service_property(_interface,

2179

1707

signature="b",

2185

1713

self.enable()

2186

1714

else:

2187

1715

self.disable()

2188

1716

2189

1717

# LastCheckedOK - property

2190

1718

@dbus_service_property(_interface,

2191

1719

signature="s",

2195

1723

self.checked_ok()

2196

1724

return

2197

1725

return datetime_to_dbus(self.last_checked_ok)

2198

1726

2199

1727

# LastCheckerStatus - property

2200

1728

@dbus_service_property(_interface, signature="n", access="read")

2201

1729

def LastCheckerStatus_dbus_property(self):

2202

1730

return dbus.Int16(self.last_checker_status)

2203

1731

2204

1732

# Expires - property

2205

1733

@dbus_service_property(_interface, signature="s", access="read")

2206

1734

def Expires_dbus_property(self):

2207

1735

return datetime_to_dbus(self.expires)

2208

1736

2209

1737

# LastApprovalRequest - property

2210

1738

@dbus_service_property(_interface, signature="s", access="read")

2211

1739

def LastApprovalRequest_dbus_property(self):

2212

1740

return datetime_to_dbus(self.last_approval_request)

2213

1741

2214

1742

# Timeout - property

2215

1743

@dbus_service_property(_interface,

2216

1744

signature="t",

2231

1759

if (getattr(self, "disable_initiator_tag", None)

2232

1760

is None):

2233

1761

return

2234

GLib.source_remove(self.disable_initiator_tag)

2235

self.disable_initiator_tag = GLib.timeout_add(

1762

gobject.source_remove(self.disable_initiator_tag)

1763

self.disable_initiator_tag = gobject.timeout_add(

2236

1764

int((self.expires - now).total_seconds() * 1000),

2237

1765

self.disable)

2238

1766

2239

1767

# ExtendedTimeout - property

2240

1768

@dbus_service_property(_interface,

2241

1769

signature="t",

2245

1773

return dbus.UInt64(self.extended_timeout.total_seconds()

2246

1774

* 1000)

2247

1775

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2248

1776

2249

1777

# Interval - property

2250

1778

@dbus_service_property(_interface,

2251

1779

signature="t",

2258

1786

return

2259

1787

if self.enabled:

2260

1788

# Reschedule checker run

2261

GLib.source_remove(self.checker_initiator_tag)

2262

self.checker_initiator_tag = GLib.timeout_add(

1789

gobject.source_remove(self.checker_initiator_tag)

1790

self.checker_initiator_tag = gobject.timeout_add(

2263

1791

value, self.start_checker)

2264

self.start_checker() # Start one now, too

2265

1792

self.start_checker() # Start one now, too

1793

2266

1794

# Checker - property

2267

1795

@dbus_service_property(_interface,

2268

1796

signature="s",

2271

1799

if value is None: # get

2272

1800

return dbus.String(self.checker_command)

2273

1801

self.checker_command = str(value)

2274

1802

2275

1803

# CheckerRunning - property

2276

1804

@dbus_service_property(_interface,

2277

1805

signature="b",

2283

1811

self.start_checker()

2284

1812

else:

2285

1813

self.stop_checker()

2286

1814

2287

1815

# ObjectPath - property

2288

1816

@dbus_annotations(

2289

1817

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2290

1818

"org.freedesktop.DBus.Deprecated": "true"})

2291

1819

@dbus_service_property(_interface, signature="o", access="read")

2292

1820

def ObjectPath_dbus_property(self):

2293

return self.dbus_object_path # is already a dbus.ObjectPath

2294

1821

return self.dbus_object_path # is already a dbus.ObjectPath

1822

2295

1823

# Secret = property

2296

1824

@dbus_annotations(

2297

1825

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2302

1830

byte_arrays=True)

2303

1831

def Secret_dbus_property(self, value):

2304

1832

self.secret = bytes(value)

2305

1833

2306

1834

del _interface

2307

1835

2308

1836

2309

class ProxyClient:

2310

def __init__(self, child_pipe, key_id, fpr, address):

1837

class ProxyClient(object):

1838

def __init__(self, child_pipe, fpr, address):

2311

1839

self._pipe = child_pipe

2312

self._pipe.send(("init", key_id, fpr, address))

1840

self._pipe.send(('init', fpr, address))

2313

1841

if not self._pipe.recv():

2314

raise KeyError(key_id or fpr)

2315

1842

raise KeyError(fpr)

1843

2316

1844

def __getattribute__(self, name):

2317

if name == "_pipe":

1845

if name == '_pipe':

2318

1846

return super(ProxyClient, self).__getattribute__(name)

2319

self._pipe.send(("getattr", name))

1847

self._pipe.send(('getattr', name))

2320

1848

data = self._pipe.recv()

2321

if data[0] == "data":

1849

if data[0] == 'data':

2322

1850

return data[1]

2323

if data[0] == "function":

2324

1851

if data[0] == 'function':

1852

2325

1853

def func(*args, **kwargs):

2326

self._pipe.send(("funcall", name, args, kwargs))

1854

self._pipe.send(('funcall', name, args, kwargs))

2327

1855

return self._pipe.recv()[1]

2328

1856

2329

1857

return func

2330

1858

2331

1859

def __setattr__(self, name, value):

2332

if name == "_pipe":

1860

if name == '_pipe':

2333

1861

return super(ProxyClient, self).__setattr__(name, value)

2334

self._pipe.send(("setattr", name, value))

1862

self._pipe.send(('setattr', name, value))

2335

1863

2336

1864

2337

1865

class ClientHandler(socketserver.BaseRequestHandler, object):

2338

1866

"""A class to handle client connections.

2339

1867

2340

1868

Instantiated once for each connection to handle it.

2341

1869

Note: This will run in its own forked process."""

2342

1870

2343

1871

def handle(self):

2344

1872

with contextlib.closing(self.server.child_pipe) as child_pipe:

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2348

2349

session = gnutls.ClientSession(self.request)

2350

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2352

# "+AES-256-CBC", "+SHA1",

2353

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

# "+DHE-DSS"))

1873

logger.info("TCP connection from: %s",

1874

str(self.client_address))

1875

logger.debug("Pipe FD: %d",

1876

self.server.child_pipe.fileno())

1877

1878

session = gnutls.connection.ClientSession(

1879

self.request, gnutls.connection .X509Credentials())

1880

1881

# Note: gnutls.connection.X509Credentials is really a

1882

# generic GnuTLS certificate credentials object so long as

1883

# no X.509 keys are added to it. Therefore, we can use it

1884

# here despite using OpenPGP certificates.

1885

1886

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1887

# "+AES-256-CBC", "+SHA1",

1888

# "+COMP-NULL", "+CTYPE-OPENPGP",

1889

# "+DHE-DSS"))

2355

1890

# Use a fallback default, since this MUST be set.

2356

1891

priority = self.server.gnutls_priority

2357

1892

if priority is None:

2358

1893

priority = "NORMAL"

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2361

1894

gnutls.library.functions.gnutls_priority_set_direct(

1895

session._c_object, priority, None)

1896

2362

1897

# Start communication using the Mandos protocol

2363

1898

# Get protocol number

2364

1899

line = self.request.makefile().readline()

2365

log.debug("Protocol version: %r", line)

1900

logger.debug("Protocol version: %r", line)

2366

1901

try:

2367

1902

if int(line.strip().split()[0]) > 1:

2368

1903

raise RuntimeError(line)

2369

1904

except (ValueError, IndexError, RuntimeError) as error:

2370

log.error("Unknown protocol version: %s", error)

1905

logger.error("Unknown protocol version: %s", error)

2371

1906

return

2372

1907

2373

1908

# Start GnuTLS connection

2374

1909

try:

2375

1910

session.handshake()

2376

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

1911

except gnutls.errors.GNUTLSError as error:

1912

logger.warning("Handshake failed: %s", error)

2378

1913

# Do not run session.bye() here: the session is not

2379

1914

# established. Just abandon the request.

2380

1915

return

2381

log.debug("Handshake succeeded")

2382

1916

logger.debug("Handshake succeeded")

1917

2383

1918

approval_required = False

2384

1919

try:

2385

if gnutls.has_rawpk:

2386

fpr = b""

2387

try:

2388

key_id = self.key_id(

2389

self.peer_certificate(session))

2390

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2392

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2396

2397

else:

2398

key_id = b""

2399

try:

2400

fpr = self.fingerprint(

2401

self.peer_certificate(session))

2402

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2404

return

2405

log.debug("Fingerprint: %s", fpr)

2406

2407

try:

2408

client = ProxyClient(child_pipe, key_id, fpr,

1920

try:

1921

fpr = self.fingerprint(

1922

self.peer_certificate(session))

1923

except (TypeError,

1924

gnutls.errors.GNUTLSError) as error:

1925

logger.warning("Bad certificate: %s", error)

1926

return

1927

logger.debug("Fingerprint: %s", fpr)

1928

1929

try:

1930

client = ProxyClient(child_pipe, fpr,

2409

1931

self.client_address)

2410

1932

except KeyError:

2411

1933

return

2412

1934

2413

1935

if client.approval_delay:

2414

1936

delay = client.approval_delay

2415

1937

client.approvals_pending += 1

2416

1938

approval_required = True

2417

1939

2418

1940

while True:

2419

1941

if not client.enabled:

2420

log.info("Client %s is disabled", client.name)

1942

logger.info("Client %s is disabled",

1943

client.name)

2421

1944

if self.server.use_dbus:

2422

1945

# Emit D-Bus signal

2423

1946

client.Rejected("Disabled")

2424

1947

return

2425

1948

2426

1949

if client.approved or not client.approval_delay:

2427

# We are approved or approval is disabled

1950

#We are approved or approval is disabled

2428

1951

break

2429

1952

elif client.approved is None:

2430

log.info("Client %s needs approval",

2431

client.name)

1953

logger.info("Client %s needs approval",

1954

client.name)

2432

1955

if self.server.use_dbus:

2433

1956

# Emit D-Bus signal

2434

1957

client.NeedApproval(

2435

1958

client.approval_delay.total_seconds()

2436

1959

* 1000, client.approved_by_default)

2437

1960

else:

2438

log.warning("Client %s was not approved",

2439

client.name)

1961

logger.warning("Client %s was not approved",

1962

client.name)

2440

1963

if self.server.use_dbus:

2441

1964

# Emit D-Bus signal

2442

1965

client.Rejected("Denied")

2443

1966

return

2444

2445

# wait until timeout or approved

1967

1968

#wait until timeout or approved

2446

1969

time = datetime.datetime.now()

2447

1970

client.changedstate.acquire()

2448

1971

client.changedstate.wait(delay.total_seconds())

2450

1973

time2 = datetime.datetime.now()

2451

1974

if (time2 - time) >= delay:

2452

1975

if not client.approved_by_default:

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

1976

logger.warning("Client %s timed out while"

1977

" waiting for approval",

1978

client.name)

2456

1979

if self.server.use_dbus:

2457

1980

# Emit D-Bus signal

2458

1981

client.Rejected("Approval timed out")

2461

1984

break

2462

1985

else:

2463

1986

delay -= time2 - time

2464

2465

try:

2466

session.send(client.secret)

2467

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2469

return

2470

2471

log.info("Sending secret to %s", client.name)

1987

1988

sent_size = 0

1989

while sent_size < len(client.secret):

1990

try:

1991

sent = session.send(client.secret[sent_size:])

1992

except gnutls.errors.GNUTLSError as error:

1993

logger.warning("gnutls send failed",

1994

exc_info=error)

1995

return

1996

logger.debug("Sent: %d, remaining: %d", sent,

1997

len(client.secret) - (sent_size

1998

+ sent))

1999

sent_size += sent

2000

2001

logger.info("Sending secret to %s", client.name)

2472

2002

# bump the timeout using extended_timeout

2473

2003

client.bump_timeout(client.extended_timeout)

2474

2004

if self.server.use_dbus:

2475

2005

# Emit D-Bus signal

2476

2006

client.GotSecret()

2477

2007

2478

2008

finally:

2479

2009

if approval_required:

2480

2010

client.approvals_pending -= 1

2481

2011

try:

2482

2012

session.bye()

2483

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2485

2013

except gnutls.errors.GNUTLSError as error:

2014

logger.warning("GnuTLS bye failed",

2015

exc_info=error)

2016

2486

2017

@staticmethod

2487

2018

def peer_certificate(session):

2488

"Return the peer's certificate as a bytestring"

2489

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2492

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2494

if gnutls.has_rawpk:

2495

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

else:

2497

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

# If not a valid certificate type...

2499

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2502

# ...return invalid data

2503

return b""

2019

"Return the peer's OpenPGP certificate as a bytestring"

2020

# If not an OpenPGP certificate...

2021

if (gnutls.library.functions.gnutls_certificate_type_get(

2022

session._c_object)

2023

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

2024

# ...do the normal thing

2025

return session.peer_certificate

2504

2026

list_size = ctypes.c_uint(1)

2505

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

2027

cert_list = (gnutls.library.functions

2028

.gnutls_certificate_get_peers

2029

(session._c_object, ctypes.byref(list_size)))

2507

2030

if not bool(cert_list) and list_size.value != 0:

2508

raise gnutls.Error("error getting peer certificate")

2031

raise gnutls.errors.GNUTLSError("error getting peer"

2032

" certificate")

2509

2033

if list_size.value == 0:

2510

2034

return None

2511

2035

cert = cert_list[0]

2512

2036

return ctypes.string_at(cert.data, cert.size)

2513

2514

@staticmethod

2515

def key_id(certificate):

2516

"Convert a certificate bytestring to a hexdigit key ID"

2517

# New GnuTLS "datum" with the public key

2518

datum = gnutls.datum_t(

2519

ctypes.cast(ctypes.c_char_p(certificate),

2520

ctypes.POINTER(ctypes.c_ubyte)),

2521

ctypes.c_uint(len(certificate)))

2522

# XXX all these need to be created in the gnutls "module"

2523

# New empty GnuTLS certificate

2524

pubkey = gnutls.pubkey_t()

2525

gnutls.pubkey_init(ctypes.byref(pubkey))

2526

# Import the raw public key into the certificate

2527

gnutls.pubkey_import(pubkey,

2528

ctypes.byref(datum),

2529

gnutls.X509_FMT_DER)

2530

# New buffer for the key ID

2531

buf = ctypes.create_string_buffer(32)

2532

buf_len = ctypes.c_size_t(len(buf))

2533

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2540

# Deinit the certificate

2541

gnutls.pubkey_deinit(pubkey)

2542

2543

# Convert the buffer to a Python bytestring

2544

key_id = ctypes.string_at(buf, buf_len.value)

2545

# Convert the bytestring to hexadecimal notation

2546

hex_key_id = binascii.hexlify(key_id).upper()

2547

return hex_key_id

2548

2037

2549

2038

@staticmethod

2550

2039

def fingerprint(openpgp):

2551

2040

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2552

2041

# New GnuTLS "datum" with the OpenPGP public key

2553

datum = gnutls.datum_t(

2042

datum = gnutls.library.types.gnutls_datum_t(

2554

2043

ctypes.cast(ctypes.c_char_p(openpgp),

2555

2044

ctypes.POINTER(ctypes.c_ubyte)),

2556

2045

ctypes.c_uint(len(openpgp)))

2557

2046

# New empty GnuTLS certificate

2558

crt = gnutls.openpgp_crt_t()

2559

gnutls.openpgp_crt_init(ctypes.byref(crt))

2047

crt = gnutls.library.types.gnutls_openpgp_crt_t()

2048

gnutls.library.functions.gnutls_openpgp_crt_init(

2049

ctypes.byref(crt))

2560

2050

# Import the OpenPGP public key into the certificate

2561

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2562

gnutls.OPENPGP_FMT_RAW)

2051

gnutls.library.functions.gnutls_openpgp_crt_import(

2052

crt, ctypes.byref(datum),

2053

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2563

2054

# Verify the self signature in the key

2564

2055

crtverify = ctypes.c_uint()

2565

gnutls.openpgp_crt_verify_self(crt, 0,

2566

ctypes.byref(crtverify))

2056

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2057

crt, 0, ctypes.byref(crtverify))

2567

2058

if crtverify.value != 0:

2568

gnutls.openpgp_crt_deinit(crt)

2569

raise gnutls.CertificateSecurityError(code

2570

=crtverify.value)

2059

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2060

raise gnutls.errors.CertificateSecurityError(

2061

"Verify failed")

2571

2062

# New buffer for the fingerprint

2572

2063

buf = ctypes.create_string_buffer(20)

2573

2064

buf_len = ctypes.c_size_t()

2574

2065

# Get the fingerprint from the certificate into the buffer

2575

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2576

ctypes.byref(buf_len))

2066

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2067

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2577

2068

# Deinit the certificate

2578

gnutls.openpgp_crt_deinit(crt)

2069

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2579

2070

# Convert the buffer to a Python bytestring

2580

2071

fpr = ctypes.string_at(buf, buf_len.value)

2581

2072

# Convert the bytestring to hexadecimal notation

2583

2074

return hex_fpr

2584

2075

2585

2076

2586

class MultiprocessingMixIn:

2077

class MultiprocessingMixIn(object):

2587

2078

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2588

2079

2589

2080

def sub_process_main(self, request, address):

2590

2081

try:

2591

2082

self.finish_request(request, address)

2592

2083

except Exception:

2593

2084

self.handle_error(request, address)

2594

2085

self.close_request(request)

2595

2086

2596

2087

def process_request(self, request, address):

2597

2088

"""Start a new process to process the request."""

2598

proc = multiprocessing.Process(target=self.sub_process_main,

2599

args=(request, address))

2089

proc = multiprocessing.Process(target = self.sub_process_main,

2090

args = (request, address))

2600

2091

proc.start()

2601

2092

return proc

2602

2093

2603

2094

2604

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2095

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2605

2096

""" adds a pipe to the MixIn """

2606

2097

2607

2098

def process_request(self, request, client_address):

2608

2099

"""Overrides and wraps the original process_request().

2609

2100

2610

2101

This function creates a new pipe in self.pipe

2611

2102

"""

2612

2103

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2613

2104

2614

2105

proc = MultiprocessingMixIn.process_request(self, request,

2615

2106

client_address)

2616

2107

self.child_pipe.close()

2617

2108

self.add_pipe(parent_pipe, proc)

2618

2109

2619

2110

def add_pipe(self, parent_pipe, proc):

2620

2111

"""Dummy function; override as necessary"""

2621

2112

raise NotImplementedError()

2622

2113

2623

2114

2624

2115

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2625

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2627

2116

socketserver.TCPServer, object):

2117

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2118

2628

2119

Attributes:

2629

2120

enabled: Boolean; whether this server is activated yet

2630

2121

interface: None or a network interface name (string)

2631

2122

use_ipv6: Boolean; to use IPv6 or not

2632

2123

"""

2633

2124

2634

2125

def __init__(self, server_address, RequestHandlerClass,

2635

2126

interface=None,

2636

2127

use_ipv6=True,

2646

2137

self.socketfd = socketfd

2647

2138

# Save the original socket.socket() function

2648

2139

self.socket_socket = socket.socket

2649

2650

2140

# To implement --socket, we monkey patch socket.socket.

2651

#

2141

#

2652

2142

# (When socketserver.TCPServer is a new-style class, we

2653

2143

# could make self.socket into a property instead of monkey

2654

2144

# patching socket.socket.)

2655

#

2145

#

2656

2146

# Create a one-time-only replacement for socket.socket()

2657

2147

@functools.wraps(socket.socket)

2658

2148

def socket_wrapper(*args, **kwargs):

2670

2160

# socket_wrapper(), if socketfd was set.

2671

2161

socketserver.TCPServer.__init__(self, server_address,

2672

2162

RequestHandlerClass)

2673

2163

2674

2164

def server_bind(self):

2675

2165

"""This overrides the normal server_bind() function

2676

2166

to bind to an interface if one was specified, and also NOT to

2677

2167

bind to an address or port if they were not specified."""

2678

global SO_BINDTODEVICE

2679

2168

if self.interface is not None:

2680

2169

if SO_BINDTODEVICE is None:

2681

# Fall back to a hard-coded value which seems to be

2682

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2684

SO_BINDTODEVICE = 25

2685

try:

2686

self.socket.setsockopt(

2687

socket.SOL_SOCKET, SO_BINDTODEVICE,

2688

(self.interface + "\0").encode("utf-8"))

2689

except socket.error as error:

2690

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2693

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2696

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2699

else:

2700

raise

2170

logger.error("SO_BINDTODEVICE does not exist;"

2171

" cannot bind to interface %s",

2172

self.interface)

2173

else:

2174

try:

2175

self.socket.setsockopt(

2176

socket.SOL_SOCKET, SO_BINDTODEVICE,

2177

(self.interface + "\0").encode("utf-8"))

2178

except socket.error as error:

2179

if error.errno == errno.EPERM:

2180

logger.error("No permission to bind to"

2181

" interface %s", self.interface)

2182

elif error.errno == errno.ENOPROTOOPT:

2183

logger.error("SO_BINDTODEVICE not available;"

2184

" cannot bind to interface %s",

2185

self.interface)

2186

elif error.errno == errno.ENODEV:

2187

logger.error("Interface %s does not exist,"

2188

" cannot bind", self.interface)

2189

else:

2190

raise

2701

2191

# Only bind(2) the socket if we really need to.

2702

2192

if self.server_address[0] or self.server_address[1]:

2703

if self.server_address[1]:

2704

self.allow_reuse_address = True

2705

2193

if not self.server_address[0]:

2706

2194

if self.address_family == socket.AF_INET6:

2707

any_address = "::" # in6addr_any

2195

any_address = "::" # in6addr_any

2708

2196

else:

2709

any_address = "0.0.0.0" # INADDR_ANY

2197

any_address = "0.0.0.0" # INADDR_ANY

2710

2198

self.server_address = (any_address,

2711

2199

self.server_address[1])

2712

2200

elif not self.server_address[1]:

2722

2210

2723

2211

class MandosServer(IPv6_TCPServer):

2724

2212

"""Mandos server.

2725

2213

2726

2214

Attributes:

2727

2215

clients: set of Client objects

2728

2216

gnutls_priority GnuTLS priority string

2729

2217

use_dbus: Boolean; to emit D-Bus signals or not

2730

2731

Assumes a GLib.MainLoop event loop.

2218

2219

Assumes a gobject.MainLoop event loop.

2732

2220

"""

2733

2221

2734

2222

def __init__(self, server_address, RequestHandlerClass,

2735

2223

interface=None,

2736

2224

use_ipv6=True,

2746

2234

self.gnutls_priority = gnutls_priority

2747

2235

IPv6_TCPServer.__init__(self, server_address,

2748

2236

RequestHandlerClass,

2749

interface=interface,

2750

use_ipv6=use_ipv6,

2751

socketfd=socketfd)

2752

2237

interface = interface,

2238

use_ipv6 = use_ipv6,

2239

socketfd = socketfd)

2240

2753

2241

def server_activate(self):

2754

2242

if self.enabled:

2755

2243

return socketserver.TCPServer.server_activate(self)

2756

2244

2757

2245

def enable(self):

2758

2246

self.enabled = True

2759

2247

2760

2248

def add_pipe(self, parent_pipe, proc):

2761

2249

# Call "handle_ipc" for both data and EOF events

2762

GLib.io_add_watch(

2763

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2764

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2250

gobject.io_add_watch(

2251

parent_pipe.fileno(),

2252

gobject.IO_IN | gobject.IO_HUP,

2765

2253

functools.partial(self.handle_ipc,

2766

parent_pipe=parent_pipe,

2767

proc=proc))

2768

2254

parent_pipe = parent_pipe,

2255

proc = proc))

2256

2769

2257

def handle_ipc(self, source, condition,

2770

2258

parent_pipe=None,

2771

proc=None,

2259

proc = None,

2772

2260

client_object=None):

2773

2261

# error, or the other end of multiprocessing.Pipe has closed

2774

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2262

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2775

2263

# Wait for other process to exit

2776

2264

proc.join()

2777

2265

return False

2778

2266

2779

2267

# Read a request from the child

2780

2268

request = parent_pipe.recv()

2781

2269

command = request[0]

2782

2783

if command == "init":

2784

key_id = request[1].decode("ascii")

2785

fpr = request[2].decode("ascii")

2786

address = request[3]

2787

2788

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2791

continue

2792

if key_id and c.key_id == key_id:

2793

client = c

2794

break

2795

if fpr and c.fingerprint == fpr:

2270

2271

if command == 'init':

2272

fpr = request[1]

2273

address = request[2]

2274

2275

for c in self.clients.itervalues():

2276

if c.fingerprint == fpr:

2796

2277

client = c

2797

2278

break

2798

2279

else:

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2280

logger.info("Client not found for fingerprint: %s, ad"

2281

"dress: %s", fpr, address)

2801

2282

if self.use_dbus:

2802

2283

# Emit D-Bus signal

2803

mandos_dbus_service.ClientNotFound(key_id or fpr,

2284

mandos_dbus_service.ClientNotFound(fpr,

2804

2285

address[0])

2805

2286

parent_pipe.send(False)

2806

2287

return False

2807

2808

GLib.io_add_watch(

2809

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2810

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2288

2289

gobject.io_add_watch(

2290

parent_pipe.fileno(),

2291

gobject.IO_IN | gobject.IO_HUP,

2811

2292

functools.partial(self.handle_ipc,

2812

parent_pipe=parent_pipe,

2813

proc=proc,

2814

client_object=client))

2293

parent_pipe = parent_pipe,

2294

proc = proc,

2295

client_object = client))

2815

2296

parent_pipe.send(True)

2816

2297

# remove the old hook in favor of the new above hook on

2817

2298

# same fileno

2818

2299

return False

2819

if command == "funcall":

2300

if command == 'funcall':

2820

2301

funcname = request[1]

2821

2302

args = request[2]

2822

2303

kwargs = request[3]

2823

2824

parent_pipe.send(("data", getattr(client_object,

2304

2305

parent_pipe.send(('data', getattr(client_object,

2825

2306

funcname)(*args,

2826

2307

**kwargs)))

2827

2828

if command == "getattr":

2308

2309

if command == 'getattr':

2829

2310

attrname = request[1]

2830

2311

if isinstance(client_object.__getattribute__(attrname),

2831

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2312

collections.Callable):

2313

parent_pipe.send(('function', ))

2833

2314

else:

2834

2315

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2836

2837

if command == "setattr":

2316

'data', client_object.__getattribute__(attrname)))

2317

2318

if command == 'setattr':

2838

2319

attrname = request[1]

2839

2320

value = request[2]

2840

2321

setattr(client_object, attrname, value)

2841

2322

2842

2323

return True

2843

2324

2844

2325

2845

2326

def rfc3339_duration_to_delta(duration):

2846

2327

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2328

2329

>>> rfc3339_duration_to_delta("P7D")

2330

datetime.timedelta(7)

2331

>>> rfc3339_duration_to_delta("PT60S")

2332

datetime.timedelta(0, 60)

2333

>>> rfc3339_duration_to_delta("PT60M")

2334

datetime.timedelta(0, 3600)

2335

>>> rfc3339_duration_to_delta("PT24H")

2336

datetime.timedelta(1)

2337

>>> rfc3339_duration_to_delta("P1W")

2338

datetime.timedelta(7)

2339

>>> rfc3339_duration_to_delta("PT5M30S")

2340

datetime.timedelta(0, 330)

2341

>>> rfc3339_duration_to_delta("P1DT3M20S")

2342

datetime.timedelta(1, 200)

2864

2343

"""

2865

2344

2866

2345

# Parsing an RFC 3339 duration with regular expressions is not

2867

2346

# possible - there would have to be multiple places for the same

2868

2347

# values, like seconds. The current code, while more esoteric, is

2869

2348

# cleaner without depending on a parsing library. If Python had a

2870

2349

# built-in library for parsing we would use it, but we'd like to

2871

2350

# avoid excessive use of external libraries.

2872

2351

2873

2352

# New type for defining tokens, syntax, and semantics all-in-one

2874

2353

Token = collections.namedtuple("Token", (

2875

2354

"regexp", # To match token; if "value" is not None, must have

2908

2387

frozenset((token_year, token_month,

2909

2388

token_day, token_time,

2910

2389

token_week)))

2911

# Define starting values:

2912

# Value so far

2913

value = datetime.timedelta()

2390

# Define starting values

2391

value = datetime.timedelta() # Value so far

2914

2392

found_token = None

2915

# Following valid tokens

2916

followers = frozenset((token_duration, ))

2917

# String left to parse

2918

s = duration

2393

followers = frozenset((token_duration, )) # Following valid tokens

2394

s = duration # String left to parse

2919

2395

# Loop until end token is found

2920

2396

while found_token is not token_end:

2921

2397

# Search for any currently valid tokens

2945

2421

2946

2422

def string_to_delta(interval):

2947

2423

"""Parse a string and return a datetime.timedelta

2948

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2960

True

2424

2425

>>> string_to_delta('7d')

2426

datetime.timedelta(7)

2427

>>> string_to_delta('60s')

2428

datetime.timedelta(0, 60)

2429

>>> string_to_delta('60m')

2430

datetime.timedelta(0, 3600)

2431

>>> string_to_delta('24h')

2432

datetime.timedelta(1)

2433

>>> string_to_delta('1w')

2434

datetime.timedelta(7)

2435

>>> string_to_delta('5m 30s')

2436

datetime.timedelta(0, 330)

2961

2437

"""

2962

2438

2963

2439

try:

2964

2440

return rfc3339_duration_to_delta(interval)

2965

2441

except ValueError:

2966

2442

pass

2967

2443

2968

2444

timevalue = datetime.timedelta(0)

2969

2445

for s in interval.split():

2970

2446

try:

2988

2464

return timevalue

2989

2465

2990

2466

2991

def daemon(nochdir=False, noclose=False):

2467

def daemon(nochdir = False, noclose = False):

2992

2468

"""See daemon(3). Standard BSD Unix function.

2993

2469

2994

2470

This should really exist as os.daemon, but it doesn't (yet)."""

2995

2471

if os.fork():

2996

2472

sys.exit()

3014

2490

3015

2491

3016

2492

def main():

3017

2493

3018

2494

##################################################################

3019

2495

# Parsing of options, both command line and config file

3020

2496

3021

2497

parser = argparse.ArgumentParser()

3022

2498

parser.add_argument("-v", "--version", action="version",

3023

version="%(prog)s {}".format(version),

2499

version = "%(prog)s {}".format(version),

3024

2500

help="show version number and exit")

3025

2501

parser.add_argument("-i", "--interface", metavar="IF",

3026

2502

help="Bind to interface IF")

3062

2538

parser.add_argument("--no-zeroconf", action="store_false",

3063

2539

dest="zeroconf", help="Do not use Zeroconf",

3064

2540

default=None)

3065

2541

3066

2542

options = parser.parse_args()

3067

2543

2544

if options.check:

2545

import doctest

2546

fail_count, test_count = doctest.testmod()

2547

sys.exit(os.EX_OK if fail_count == 0 else 1)

2548

3068

2549

# Default values for config file for server-global settings

3069

if gnutls.has_rawpk:

3070

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3071

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3072

else:

3073

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3074

":+SIGN-DSA-SHA256")

3075

server_defaults = {"interface": "",

3076

"address": "",

3077

"port": "",

3078

"debug": "False",

3079

"priority": priority,

3080

"servicename": "Mandos",

3081

"use_dbus": "True",

3082

"use_ipv6": "True",

3083

"debuglevel": "",

3084

"restore": "True",

3085

"socket": "",

3086

"statedir": "/var/lib/mandos",

3087

"foreground": "False",

3088

"zeroconf": "True",

3089

}

3090

del priority

3091

2550

server_defaults = { "interface": "",

2551

"address": "",

2552

"port": "",

2553

"debug": "False",

2554

"priority":

2555

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2556

":+SIGN-DSA-SHA256",

2557

"servicename": "Mandos",

2558

"use_dbus": "True",

2559

"use_ipv6": "True",

2560

"debuglevel": "",

2561

"restore": "True",

2562

"socket": "",

2563

"statedir": "/var/lib/mandos",

2564

"foreground": "False",

2565

"zeroconf": "True",

2566

}

2567

3092

2568

# Parse config file for server-global settings

3093

server_config = configparser.ConfigParser(server_defaults)

2569

server_config = configparser.SafeConfigParser(server_defaults)

3094

2570

del server_defaults

3095

2571

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3096

# Convert the ConfigParser object to a dict

2572

# Convert the SafeConfigParser object to a dict

3097

2573

server_settings = server_config.defaults()

3098

2574

# Use the appropriate methods on the non-string config options

3099

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3100

"foreground", "zeroconf"):

2575

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3101

2576

server_settings[option] = server_config.getboolean("DEFAULT",

3102

2577

option)

3103

2578

if server_settings["port"]:

3109

2584

# Later, stdin will, and stdout and stderr might, be dup'ed

3110

2585

# over with an opened os.devnull. But we don't want this to

3111

2586

# happen with a supplied network socket.

3112

while 0 <= server_settings["socket"] <= 2:

2587

if 0 <= server_settings["socket"] <= 2:

3113

2588

server_settings["socket"] = os.dup(server_settings

3114

2589

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

3116

2590

del server_config

3117

2591

3118

2592

# Override the settings from the config file with command line

3119

2593

# options, if set.

3120

2594

for option in ("interface", "address", "port", "debug",

3138

2612

if server_settings["debug"]:

3139

2613

server_settings["foreground"] = True

3140

2614

# Now we have our good server settings in "server_settings"

3141

2615

3142

2616

##################################################################

3143

2617

3144

2618

if (not server_settings["zeroconf"]

3145

2619

and not (server_settings["port"]

3146

2620

or server_settings["socket"] != "")):

3147

2621

parser.error("Needs port or socket to work without Zeroconf")

3148

2622

3149

2623

# For convenience

3150

2624

debug = server_settings["debug"]

3151

2625

debuglevel = server_settings["debuglevel"]

3155

2629

stored_state_file)

3156

2630

foreground = server_settings["foreground"]

3157

2631

zeroconf = server_settings["zeroconf"]

3158

2632

3159

2633

if debug:

3160

2634

initlogger(debug, logging.DEBUG)

3161

2635

else:

3164

2638

else:

3165

2639

level = getattr(logging, debuglevel.upper())

3166

2640

initlogger(debug, level)

3167

2641

3168

2642

if server_settings["servicename"] != "Mandos":

3169

2643

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

2644

logging.Formatter('Mandos ({}) [%(process)d]:'

2645

' %(levelname)s: %(message)s'.format(

3172

2646

server_settings["servicename"])))

3173

2647

3174

2648

# Parse config file with clients

3175

client_config = configparser.ConfigParser(Client.client_defaults)

2649

client_config = configparser.SafeConfigParser(Client

2650

.client_defaults)

3176

2651

client_config.read(os.path.join(server_settings["configdir"],

3177

2652

"clients.conf"))

3178

2653

3179

2654

global mandos_dbus_service

3180

2655

mandos_dbus_service = None

3181

2656

3182

2657

socketfd = None

3183

2658

if server_settings["socket"] != "":

3184

2659

socketfd = server_settings["socket"]

3198

2673

try:

3199

2674

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3200

2675

except IOError as e:

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3203

3204

for name, group in (("_mandos", "_mandos"),

3205

("mandos", "mandos"),

3206

("nobody", "nogroup")):

2676

logger.error("Could not open file %r", pidfilename,

2677

exc_info=e)

2678

2679

for name in ("_mandos", "mandos", "nobody"):

3207

2680

try:

3208

2681

uid = pwd.getpwnam(name).pw_uid

3209

gid = pwd.getpwnam(group).pw_gid

2682

gid = pwd.getpwnam(name).pw_gid

3210

2683

break

3211

2684

except KeyError:

3212

2685

continue

3216

2689

try:

3217

2690

os.setgid(gid)

3218

2691

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3220

2692

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

3223

2693

if error.errno != errno.EPERM:

3224

2694

raise

3225

2695

3226

2696

if debug:

3227

2697

# Enable all possible GnuTLS debugging

3228

2698

3229

2699

# "Use a log level over 10 to enable all debugging options."

3230

2700

# - GnuTLS manual

3231

gnutls.global_set_log_level(11)

3232

3233

@gnutls.log_func

2701

gnutls.library.functions.gnutls_global_set_log_level(11)

2702

2703

@gnutls.library.types.gnutls_log_func

3234

2704

def debug_gnutls(level, string):

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3237

3238

gnutls.global_set_log_function(debug_gnutls)

3239

2705

logger.debug("GnuTLS: %s", string[:-1])

2706

2707

gnutls.library.functions.gnutls_global_set_log_function(

2708

debug_gnutls)

2709

3240

2710

# Redirect stdin so all checkers get /dev/null

3241

2711

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3242

2712

os.dup2(null, sys.stdin.fileno())

3243

2713

if null > 2:

3244

2714

os.close(null)

3245

2715

3246

2716

# Need to fork before connecting to D-Bus

3247

2717

if not foreground:

3248

2718

# Close all input and output, do double fork, etc.

3249

2719

daemon()

3250

3251

if gi.version_info < (3, 10, 2):

3252

# multiprocessing will use threads, so before we use GLib we

3253

# need to inform GLib that threads will be used.

3254

GLib.threads_init()

3255

2720

2721

# multiprocessing will use threads, so before we use gobject we

2722

# need to inform gobject that threads will be used.

2723

gobject.threads_init()

2724

3256

2725

global main_loop

3257

2726

# From the Avahi example code

3258

2727

DBusGMainLoop(set_as_default=True)

3259

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

2728

main_loop = gobject.MainLoop()

2729

bus = dbus.SystemBus()

3262

2730

# End of Avahi example code

3263

2731

if use_dbus:

3264

2732

try:

3269

2737

"se.bsnet.fukt.Mandos", bus,

3270

2738

do_not_queue=True)

3271

2739

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

2740

logger.error("Disabling D-Bus:", exc_info=e)

3273

2741

use_dbus = False

3274

2742

server_settings["use_dbus"] = False

3275

2743

tcp_server.use_dbus = False

3276

2744

if zeroconf:

3277

2745

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3278

2746

service = AvahiServiceToSyslog(

3279

name=server_settings["servicename"],

3280

servicetype="_mandos._tcp",

3281

protocol=protocol,

3282

bus=bus)

2747

name = server_settings["servicename"],

2748

servicetype = "_mandos._tcp",

2749

protocol = protocol,

2750

bus = bus)

3283

2751

if server_settings["interface"]:

3284

2752

service.interface = if_nametoindex(

3285

2753

server_settings["interface"].encode("utf-8"))

3286

2754

3287

2755

global multiprocessing_manager

3288

2756

multiprocessing_manager = multiprocessing.Manager()

3289

2757

3290

2758

client_class = Client

3291

2759

if use_dbus:

3292

client_class = functools.partial(ClientDBus, bus=bus)

3293

2760

client_class = functools.partial(ClientDBus, bus = bus)

2761

3294

2762

client_settings = Client.config_parser(client_config)

3295

2763

old_client_settings = {}

3296

2764

clients_data = {}

3297

2765

3298

2766

# This is used to redirect stdout and stderr for checker processes

3299

2767

global wnull

3300

wnull = open(os.devnull, "w") # A writable /dev/null

2768

wnull = open(os.devnull, "w") # A writable /dev/null

3301

2769

# Only used if server is running in foreground but not in debug

3302

2770

# mode

3303

2771

if debug or not foreground:

3304

2772

wnull.close()

3305

2773

3306

2774

# Get client data and settings from last running state.

3307

2775

if server_settings["restore"]:

3308

2776

try:

3309

2777

with open(stored_state_path, "rb") as stored_state:

3310

if sys.version_info.major == 2:

3311

clients_data, old_client_settings = pickle.load(

3312

stored_state)

3313

else:

3314

bytes_clients_data, bytes_old_client_settings = (

3315

pickle.load(stored_state, encoding="bytes"))

3316

# Fix bytes to strings

3317

# clients_data

3318

# .keys()

3319

clients_data = {(key.decode("utf-8")

3320

if isinstance(key, bytes)

3321

else key): value

3322

for key, value in

3323

bytes_clients_data.items()}

3324

del bytes_clients_data

3325

for key in clients_data:

3326

value = {(k.decode("utf-8")

3327

if isinstance(k, bytes) else k): v

3328

for k, v in

3329

clients_data[key].items()}

3330

clients_data[key] = value

3331

# .client_structure

3332

value["client_structure"] = [

3333

(s.decode("utf-8")

3334

if isinstance(s, bytes)

3335

else s) for s in

3336

value["client_structure"]]

3337

# .name, .host, and .checker_command

3338

for k in ("name", "host", "checker_command"):

3339

if isinstance(value[k], bytes):

3340

value[k] = value[k].decode("utf-8")

3341

if "key_id" not in value:

3342

value["key_id"] = ""

3343

elif "fingerprint" not in value:

3344

value["fingerprint"] = ""

3345

# old_client_settings

3346

# .keys()

3347

old_client_settings = {

3348

(key.decode("utf-8")

3349

if isinstance(key, bytes)

3350

else key): value

3351

for key, value in

3352

bytes_old_client_settings.items()}

3353

del bytes_old_client_settings

3354

# .host and .checker_command

3355

for value in old_client_settings.values():

3356

for attribute in ("host", "checker_command"):

3357

if isinstance(value[attribute], bytes):

3358

value[attribute] = (value[attribute]

3359

.decode("utf-8"))

2778

clients_data, old_client_settings = pickle.load(

2779

stored_state)

3360

2780

os.remove(stored_state_path)

3361

2781

except IOError as e:

3362

2782

if e.errno == errno.ENOENT:

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

2783

logger.warning("Could not load persistent state:"

2784

" {}".format(os.strerror(e.errno)))

3365

2785

else:

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

2786

logger.critical("Could not load persistent state:",

2787

exc_info=e)

3368

2788

raise

3369

2789

except EOFError as e:

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3372

2790

logger.warning("Could not load persistent state: "

2791

"EOFError:",

2792

exc_info=e)

2793

3373

2794

with PGPEngine() as pgp:

3374

2795

for client_name, client in clients_data.items():

3375

2796

# Skip removed clients

3376

2797

if client_name not in client_settings:

3377

2798

continue

3378

2799

3379

2800

# Decide which value to use after restoring saved state.

3380

2801

# We have three different values: Old config file,

3381

2802

# new config file, and saved state.

3392

2813

client[name] = value

3393

2814

except KeyError:

3394

2815

pass

3395

2816

3396

2817

# Clients who has passed its expire date can still be

3397

2818

# enabled if its last checker was successful. A Client

3398

2819

# whose checker succeeded before we stored its state is

3401

2822

if client["enabled"]:

3402

2823

if datetime.datetime.utcnow() >= client["expires"]:

3403

2824

if not client["last_checked_ok"]:

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

2825

logger.warning(

2826

"disabling client {} - Client never "

2827

"performed a successful checker".format(

2828

client_name))

3407

2829

client["enabled"] = False

3408

2830

elif client["last_checker_status"] != 0:

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

2831

logger.warning(

2832

"disabling client {} - Client last"

2833

" checker failed with error code"

2834

" {}".format(

2835

client_name,

2836

client["last_checker_status"]))

3413

2837

client["enabled"] = False

3414

2838

else:

3415

2839

client["expires"] = (

3416

2840

datetime.datetime.utcnow()

3417

2841

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

2842

logger.debug("Last checker succeeded,"

2843

" keeping {} enabled".format(

2844

client_name))

3420

2845

try:

3421

2846

client["secret"] = pgp.decrypt(

3422

2847

client["encrypted_secret"],

3423

2848

client_settings[client_name]["secret"])

3424

2849

except PGPError:

3425

2850

# If decryption fails, we use secret from new settings

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

2851

logger.debug("Failed to decrypt {} old secret".format(

2852

client_name))

3428

2853

client["secret"] = (client_settings[client_name]

3429

2854

["secret"])

3430

2855

3431

2856

# Add/remove clients based on new changes made to config

3432

2857

for client_name in (set(old_client_settings)

3433

2858

- set(client_settings)):

3435

2860

for client_name in (set(client_settings)

3436

2861

- set(old_client_settings)):

3437

2862

clients_data[client_name] = client_settings[client_name]

3438

2863

3439

2864

# Create all client objects

3440

2865

for client_name, client in clients_data.items():

3441

2866

tcp_server.clients[client_name] = client_class(

3442

name=client_name,

3443

settings=client,

3444

server_settings=server_settings)

3445

2867

name = client_name,

2868

settings = client,

2869

server_settings = server_settings)

2870

3446

2871

if not tcp_server.clients:

3447

log.warning("No clients defined")

3448

2872

logger.warning("No clients defined")

2873

3449

2874

if not foreground:

3450

2875

if pidfile is not None:

3451

2876

pid = os.getpid()

3453

2878

with pidfile:

3454

2879

print(pid, file=pidfile)

3455

2880

except IOError:

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

2881

logger.error("Could not write to file %r with PID %d",

2882

pidfilename, pid)

3458

2883

del pidfile

3459

2884

del pidfilename

3460

3461

for termsig in (signal.SIGHUP, signal.SIGTERM):

3462

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3463

lambda: main_loop.quit() and False)

3464

2885

2886

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2887

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2888

3465

2889

if use_dbus:

3466

2890

3467

2891

@alternate_dbus_interfaces(

3468

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

2892

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3469

2893

class MandosDBusService(DBusObjectWithObjectManager):

3470

2894

"""A D-Bus proxy object"""

3471

2895

3472

2896

def __init__(self):

3473

2897

dbus.service.Object.__init__(self, bus, "/")

3474

2898

3475

2899

_interface = "se.recompile.Mandos"

3476

2900

3477

2901

@dbus.service.signal(_interface, signature="o")

3478

2902

def ClientAdded(self, objpath):

3479

2903

"D-Bus signal"

3480

2904

pass

3481

2905

3482

2906

@dbus.service.signal(_interface, signature="ss")

3483

def ClientNotFound(self, key_id, address):

2907

def ClientNotFound(self, fingerprint, address):

3484

2908

"D-Bus signal"

3485

2909

pass

3486

2910

3487

2911

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3488

2912

"true"})

3489

2913

@dbus.service.signal(_interface, signature="os")

3490

2914

def ClientRemoved(self, objpath, name):

3491

2915

"D-Bus signal"

3492

2916

pass

3493

2917

3494

2918

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3495

2919

"true"})

3496

2920

@dbus.service.method(_interface, out_signature="ao")

3497

2921

def GetAllClients(self):

3498

2922

"D-Bus method"

3499

2923

return dbus.Array(c.dbus_object_path for c in

3500

tcp_server.clients.values())

3501

2924

tcp_server.clients.itervalues())

2925

3502

2926

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3503

2927

"true"})

3504

2928

@dbus.service.method(_interface,

3506

2930

def GetAllClientsWithProperties(self):

3507

2931

"D-Bus method"

3508

2932

return dbus.Dictionary(

3509

{c.dbus_object_path: c.GetAll(

2933

{ c.dbus_object_path: c.GetAll(

3510

2934

"se.recompile.Mandos.Client")

3511

for c in tcp_server.clients.values()},

2935

for c in tcp_server.clients.itervalues() },

3512

2936

signature="oa{sv}")

3513

2937

3514

2938

@dbus.service.method(_interface, in_signature="o")

3515

2939

def RemoveClient(self, object_path):

3516

2940

"D-Bus method"

3517

for c in tcp_server.clients.values():

2941

for c in tcp_server.clients.itervalues():

3518

2942

if c.dbus_object_path == object_path:

3519

2943

del tcp_server.clients[c.name]

3520

2944

c.remove_from_connection()

3524

2948

self.client_removed_signal(c)

3525

2949

return

3526

2950

raise KeyError(object_path)

3527

2951

3528

2952

del _interface

3529

2953

3530

2954

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3531

out_signature="a{oa{sa{sv}}}")

2955

out_signature = "a{oa{sa{sv}}}")

3532

2956

def GetManagedObjects(self):

3533

2957

"""D-Bus method"""

3534

2958

return dbus.Dictionary(

3535

{client.dbus_object_path:

3536

dbus.Dictionary(

3537

{interface: client.GetAll(interface)

3538

for interface in

3539

client._get_all_interface_names()})

3540

for client in tcp_server.clients.values()})

3541

2959

{ client.dbus_object_path:

2960

dbus.Dictionary(

2961

{ interface: client.GetAll(interface)

2962

for interface in

2963

client._get_all_interface_names()})

2964

for client in tcp_server.clients.values()})

2965

3542

2966

def client_added_signal(self, client):

3543

2967

"""Send the new standard signal and the old signal"""

3544

2968

if use_dbus:

3546

2970

self.InterfacesAdded(

3547

2971

client.dbus_object_path,

3548

2972

dbus.Dictionary(

3549

{interface: client.GetAll(interface)

3550

for interface in

3551

client._get_all_interface_names()}))

2973

{ interface: client.GetAll(interface)

2974

for interface in

2975

client._get_all_interface_names()}))

3552

2976

# Old signal

3553

2977

self.ClientAdded(client.dbus_object_path)

3554

2978

3555

2979

def client_removed_signal(self, client):

3556

2980

"""Send the new standard signal and the old signal"""

3557

2981

if use_dbus:

3562

2986

# Old signal

3563

2987

self.ClientRemoved(client.dbus_object_path,

3564

2988

client.name)

3565

2989

3566

2990

mandos_dbus_service = MandosDBusService()

3567

3568

# Save modules to variables to exempt the modules from being

3569

# unloaded before the function registered with atexit() is run.

3570

mp = multiprocessing

3571

wn = wnull

3572

2991

3573

2992

def cleanup():

3574

2993

"Cleanup function; run on exit"

3575

2994

if zeroconf:

3576

2995

service.cleanup()

3577

3578

mp.active_children()

3579

wn.close()

2996

2997

multiprocessing.active_children()

2998

wnull.close()

3580

2999

if not (tcp_server.clients or client_settings):

3581

3000

return

3582

3001

3583

3002

# Store client before exiting. Secrets are encrypted with key

3584

3003

# based on what config file has. If config file is

3585

3004

# removed/edited, old secret will thus be unrecovable.

3586

3005

clients = {}

3587

3006

with PGPEngine() as pgp:

3588

for client in tcp_server.clients.values():

3007

for client in tcp_server.clients.itervalues():

3589

3008

key = client_settings[client.name]["secret"]

3590

3009

client.encrypted_secret = pgp.encrypt(client.secret,

3591

3010

key)

3592

3011

client_dict = {}

3593

3012

3594

3013

# A list of attributes that can not be pickled

3595

3014

# + secret.

3596

exclude = {"bus", "changedstate", "secret",

3597

"checker", "server_settings"}

3015

exclude = { "bus", "changedstate", "secret",

3016

"checker", "server_settings" }

3598

3017

for name, typ in inspect.getmembers(dbus.service

3599

3018

.Object):

3600

3019

exclude.add(name)

3601

3020

3602

3021

client_dict["encrypted_secret"] = (client

3603

3022

.encrypted_secret)

3604

3023

for attr in client.client_structure:

3605

3024

if attr not in exclude:

3606

3025

client_dict[attr] = getattr(client, attr)

3607

3026

3608

3027

clients[client.name] = client_dict

3609

3028

del client_settings[client.name]["secret"]

3610

3029

3611

3030

try:

3612

3031

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3032

mode='wb',

3614

3033

suffix=".pickle",

3615

prefix="clients-",

3034

prefix='clients-',

3616

3035

dir=os.path.dirname(stored_state_path),

3617

3036

delete=False) as stored_state:

3618

pickle.dump((clients, client_settings), stored_state,

3619

protocol=2)

3037

pickle.dump((clients, client_settings), stored_state)

3620

3038

tempname = stored_state.name

3621

3039

os.rename(tempname, stored_state_path)

3622

3040

except (IOError, OSError) as e:

3626

3044

except NameError:

3627

3045

pass

3628

3046

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

3047

logger.warning("Could not save persistent state: {}"

3048

.format(os.strerror(e.errno)))

3631

3049

else:

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3050

logger.warning("Could not save persistent state:",

3051

exc_info=e)

3634

3052

raise

3635

3053

3636

3054

# Delete all clients, and settings from config

3637

3055

while tcp_server.clients:

3638

3056

name, client = tcp_server.clients.popitem()

3641

3059

# Don't signal the disabling

3642

3060

client.disable(quiet=True)

3643

3061

# Emit D-Bus signal for removal

3644

if use_dbus:

3645

mandos_dbus_service.client_removed_signal(client)

3062

mandos_dbus_service.client_removed_signal(client)

3646

3063

client_settings.clear()

3647

3064

3648

3065

atexit.register(cleanup)

3649

3650

for client in tcp_server.clients.values():

3066

3067

for client in tcp_server.clients.itervalues():

3651

3068

if use_dbus:

3652

3069

# Emit D-Bus signal for adding

3653

3070

mandos_dbus_service.client_added_signal(client)

3654

3071

# Need to initiate checking of clients

3655

3072

if client.enabled:

3656

client.init_checker(randomize_start=True)

3657

3073

client.init_checker()

3074

3658

3075

tcp_server.enable()

3659

3076

tcp_server.server_activate()

3660

3077

3661

3078

# Find out what port we got

3662

3079

if zeroconf:

3663

3080

service.port = tcp_server.socket.getsockname()[1]

3664

3081

if use_ipv6:

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

3082

logger.info("Now listening on address %r, port %d,"

3083

" flowinfo %d, scope_id %d",

3084

*tcp_server.socket.getsockname())

3667

3085

else: # IPv4

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3670

3671

# service.interface = tcp_server.socket.getsockname()[3]

3672

3086

logger.info("Now listening on address %r, port %d",

3087

*tcp_server.socket.getsockname())

3088

3089

#service.interface = tcp_server.socket.getsockname()[3]

3090

3673

3091

try:

3674

3092

if zeroconf:

3675

3093

# From the Avahi example code

3676

3094

try:

3677

3095

service.activate()

3678

3096

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3097

logger.critical("D-Bus Exception", exc_info=error)

3680

3098

cleanup()

3681

3099

sys.exit(1)

3682

3100

# End of Avahi example code

3683

3684

GLib.io_add_watch(

3685

GLib.IOChannel.unix_new(tcp_server.fileno()),

3686

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3687

lambda *args, **kwargs: (tcp_server.handle_request

3688

(*args[2:], **kwargs) or True))

3689

3690

log.debug("Starting main loop")

3101

3102

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3103

lambda *args, **kwargs:

3104

(tcp_server.handle_request

3105

(*args[2:], **kwargs) or True))

3106

3107

logger.debug("Starting main loop")

3691

3108

main_loop.run()

3692

3109

except AvahiError as error:

3693

log.critical("Avahi Error", exc_info=error)

3110

logger.critical("Avahi Error", exc_info=error)

3694

3111

cleanup()

3695

3112

sys.exit(1)

3696

3113

except KeyboardInterrupt:

3697

3114

if debug:

3698

3115

print("", file=sys.stderr)

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

3116

logger.debug("Server received KeyboardInterrupt")

3117

logger.debug("Server exiting")

3701

3118

# Must run before the D-Bus bus name gets deregistered

3702

3119

cleanup()

3703

3120

3704

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3707

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3710

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3713

sys.argv[1:] = unknown_args

3714

return args

3715

3716

# Add all tests from doctest strings

3717

def load_tests(loader, tests, none):

3718

import doctest

3719

tests.addTests(doctest.DocTestSuite())

3720

return tests

3721

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3724

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3737

else:

3738

main()

3739

finally:

3740

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End:

3121

3122

if __name__ == '__main__':

3123

main()