/mandos/release : revision 237.7.349

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

3

#

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

39

try:

48

40

import SocketServer as socketserver

49

41

except ImportError:

50

42

import socketserver

51

43

import socket

44

import argparse

52

45

import datetime

53

46

import errno

54

47

try:

55

48

import ConfigParser as configparser

56

49

except ImportError:

57

50

import configparser

51

import sys

58

52

import re

53

import os

59

54

import signal

60

55

import subprocess

61

56

import atexit

62

57

import stat

58

import logging

63

59

import logging.handlers

64

60

import pwd

65

61

import contextlib

77

73

import itertools

78

74

import collections

79

75

import codecs

80

import random

81

import shlex

82

76

83

77

import dbus

84

78

import dbus.service

85

import gi

86

from gi.repository import GLib

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

83

import avahi

87

84

from dbus.mainloop.glib import DBusGMainLoop

88

85

import ctypes

89

86

import ctypes.util

90

87

import xml.dom.minidom

91

88

import inspect

92

89

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

90

try:

122

91

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

92

except AttributeError:

124

93

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

94

from IN import SO_BINDTODEVICE

128

95

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.16"

96

SO_BINDTODEVICE = None

97

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.1"

147

102

stored_state_file = "clients.pickle"

148

103

149

log = logging.getLogger(os.path.basename(sys.argv[0]))

150

logging.captureWarnings(True) # Show warnings via the logging system

104

logger = logging.getLogger()

151

105

syslogger = None

152

106

153

107

try:

154

108

if_nametoindex = ctypes.cdll.LoadLibrary(

155

109

ctypes.util.find_library("c")).if_nametoindex

156

110

except (OSError, AttributeError):

157

111

158

112

def if_nametoindex(interface):

159

113

"Get an interface index the hard way, i.e. using fcntl()"

160

114

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

165

119

return interface_index

166

120

167

121

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

122

def initlogger(debug, level=logging.WARNING):

185

123

"""init logger and add loglevel"""

186

124

187

125

global syslogger

188

126

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

191

129

syslogger.setFormatter(logging.Formatter

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

194

log.addHandler(syslogger)

195

130

('Mandos [%(process)d]: %(levelname)s:'

131

' %(message)s'))

132

logger.addHandler(syslogger)

133

196

134

if debug:

197

135

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

202

log.addHandler(console)

203

log.setLevel(level)

136

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

137

' [%(process)d]:'

138

' %(levelname)s:'

139

' %(message)s'))

140

logger.addHandler(console)

141

logger.setLevel(level)

204

142

205

143

206

144

class PGPError(Exception):

208

146

pass

209

147

210

148

211

class PGPEngine:

149

class PGPEngine(object):

212

150

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

151

214

152

def __init__(self):

215

153

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

154

self.gnupgargs = ['--batch',

155

'--home', self.tempdir,

156

'--force-mdc',

157

'--quiet',

158

'--no-use-agent']

159

235

160

def __enter__(self):

236

161

return self

237

162

238

163

def __exit__(self, exc_type, exc_value, traceback):

239

164

self._cleanup()

240

165

return False

241

166

242

167

def __del__(self):

243

168

self._cleanup()

244

169

245

170

def _cleanup(self):

246

171

if self.tempdir is not None:

247

172

# Delete contents of tempdir

248

173

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

174

topdown = False):

250

175

for filename in files:

251

176

os.remove(os.path.join(root, filename))

252

177

for dirname in dirs:

254

179

# Remove tempdir

255

180

os.rmdir(self.tempdir)

256

181

self.tempdir = None

257

182

258

183

def password_encode(self, password):

259

184

# Passphrase can not be empty and can not contain newlines or

260

185

# NUL bytes. So we prefix it and hex encode it.

265

190

.replace(b"\n", b"\\n")

266

191

.replace(b"\0", b"\\x00"))

267

192

return encoded

268

193

269

194

def encrypt(self, data, password):

270

195

passphrase = self.password_encode(password)

271

196

with tempfile.NamedTemporaryFile(

272

197

dir=self.tempdir) as passfile:

273

198

passfile.write(passphrase)

274

199

passfile.flush()

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

200

proc = subprocess.Popen(['gpg', '--symmetric',

201

'--passphrase-file',

277

202

passfile.name]

278

203

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

204

stdin = subprocess.PIPE,

205

stdout = subprocess.PIPE,

206

stderr = subprocess.PIPE)

207

ciphertext, err = proc.communicate(input = data)

283

208

if proc.returncode != 0:

284

209

raise PGPError(err)

285

210

return ciphertext

286

211

287

212

def decrypt(self, data, password):

288

213

passphrase = self.password_encode(password)

289

214

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

215

dir = self.tempdir) as passfile:

291

216

passfile.write(passphrase)

292

217

passfile.flush()

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

218

proc = subprocess.Popen(['gpg', '--decrypt',

219

'--passphrase-file',

295

220

passfile.name]

296

221

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

222

stdin = subprocess.PIPE,

223

stdout = subprocess.PIPE,

224

stderr = subprocess.PIPE)

225

decrypted_plaintext, err = proc.communicate(input = data)

301

226

if proc.returncode != 0:

302

227

raise PGPError(err)

303

228

return decrypted_plaintext

304

229

305

230

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

231

class AvahiError(Exception):

333

232

def __init__(self, value, *args, **kwargs):

334

233

self.value = value

344

243

pass

345

244

346

245

347

class AvahiService:

246

class AvahiService(object):

348

247

"""An Avahi (Zeroconf) service.

349

248

350

249

Attributes:

351

250

interface: integer; avahi.IF_UNSPEC or an interface index.

352

251

Used to optionally bind to the specified interface.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

252

name: string; Example: 'Mandos'

253

type: string; Example: '_mandos._tcp'.

355

254

See <https://www.iana.org/assignments/service-names-port-numbers>

356

255

port: integer; what port to announce

357

256

TXT: list of strings; TXT record for the service

364

263

server: D-Bus Server

365

264

bus: dbus.SystemBus()

366

265

"""

367

266

368

267

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

268

interface = avahi.IF_UNSPEC,

269

name = None,

270

servicetype = None,

271

port = None,

272

TXT = None,

273

domain = "",

274

host = "",

275

max_renames = 32768,

276

protocol = avahi.PROTO_UNSPEC,

277

bus = None):

379

278

self.interface = interface

380

279

self.name = name

381

280

self.type = servicetype

390

289

self.server = None

391

290

self.bus = bus

392

291

self.entry_group_state_changed_match = None

393

292

394

293

def rename(self, remove=True):

395

294

"""Derived from the Avahi example code"""

396

295

if self.rename_count >= self.max_renames:

397

log.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

296

logger.critical("No suitable Zeroconf service name found"

297

" after %i retries, exiting.",

298

self.rename_count)

400

299

raise AvahiServiceError("Too many renames")

401

300

self.name = str(

402

301

self.server.GetAlternativeServiceName(self.name))

403

302

self.rename_count += 1

404

log.info("Changing Zeroconf service name to %r ...",

405

self.name)

303

logger.info("Changing Zeroconf service name to %r ...",

304

self.name)

406

305

if remove:

407

306

self.remove()

408

307

try:

410

309

except dbus.exceptions.DBusException as error:

411

310

if (error.get_dbus_name()

412

311

== "org.freedesktop.Avahi.CollisionError"):

413

log.info("Local Zeroconf service name collision.")

312

logger.info("Local Zeroconf service name collision.")

414

313

return self.rename(remove=False)

415

314

else:

416

log.critical("D-Bus Exception", exc_info=error)

315

logger.critical("D-Bus Exception", exc_info=error)

417

316

self.cleanup()

418

317

os._exit(1)

419

318

420

319

def remove(self):

421

320

"""Derived from the Avahi example code"""

422

321

if self.entry_group_state_changed_match is not None:

424

323

self.entry_group_state_changed_match = None

425

324

if self.group is not None:

426

325

self.group.Reset()

427

326

428

327

def add(self):

429

328

"""Derived from the Avahi example code"""

430

329

self.remove()

435

334

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

335

self.entry_group_state_changed_match = (

437

336

self.group.connect_to_signal(

438

"StateChanged", self.entry_group_state_changed))

439

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

337

'StateChanged', self.entry_group_state_changed))

338

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

339

self.name, self.type)

441

340

self.group.AddService(

442

341

self.interface,

443

342

self.protocol,

447

346

dbus.UInt16(self.port),

448

347

avahi.string_array_to_txt_array(self.TXT))

449

348

self.group.Commit()

450

349

451

350

def entry_group_state_changed(self, state, error):

452

351

"""Derived from the Avahi example code"""

453

log.debug("Avahi entry group state change: %i", state)

454

352

logger.debug("Avahi entry group state change: %i", state)

353

455

354

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

log.debug("Zeroconf service established.")

355

logger.debug("Zeroconf service established.")

457

356

elif state == avahi.ENTRY_GROUP_COLLISION:

458

log.info("Zeroconf service name collision.")

357

logger.info("Zeroconf service name collision.")

459

358

self.rename()

460

359

elif state == avahi.ENTRY_GROUP_FAILURE:

461

log.critical("Avahi: Error in group state changed %s",

462

str(error))

360

logger.critical("Avahi: Error in group state changed %s",

361

str(error))

463

362

raise AvahiGroupError("State changed: {!s}".format(error))

464

363

465

364

def cleanup(self):

466

365

"""Derived from the Avahi example code"""

467

366

if self.group is not None:

472

371

pass

473

372

self.group = None

474

373

self.remove()

475

374

476

375

def server_state_changed(self, state, error=None):

477

376

"""Derived from the Avahi example code"""

478

log.debug("Avahi server state change: %i", state)

377

logger.debug("Avahi server state change: %i", state)

479

378

bad_states = {

480

379

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

380

avahi.SERVER_REGISTERING: None,

485

384

if state in bad_states:

486

385

if bad_states[state] is not None:

487

386

if error is None:

488

log.error(bad_states[state])

387

logger.error(bad_states[state])

489

388

else:

490

log.error(bad_states[state] + ": %r", error)

389

logger.error(bad_states[state] + ": %r", error)

491

390

self.cleanup()

492

391

elif state == avahi.SERVER_RUNNING:

493

392

try:

495

394

except dbus.exceptions.DBusException as error:

496

395

if (error.get_dbus_name()

497

396

== "org.freedesktop.Avahi.CollisionError"):

498

log.info("Local Zeroconf service name collision.")

397

logger.info("Local Zeroconf service name"

398

" collision.")

499

399

return self.rename(remove=False)

500

400

else:

501

log.critical("D-Bus Exception", exc_info=error)

401

logger.critical("D-Bus Exception", exc_info=error)

502

402

self.cleanup()

503

403

os._exit(1)

504

404

else:

505

405

if error is None:

506

log.debug("Unknown state: %r", state)

406

logger.debug("Unknown state: %r", state)

507

407

else:

508

log.debug("Unknown state: %r: %r", state, error)

509

408

logger.debug("Unknown state: %r: %r", state, error)

409

510

410

def activate(self):

511

411

"""Derived from the Avahi example code"""

512

412

if self.server is None:

523

423

class AvahiServiceToSyslog(AvahiService):

524

424

def rename(self, *args, **kwargs):

525

425

"""Add the new name to the syslog messages"""

526

ret = super(AvahiServiceToSyslog, self).rename(*args,

527

**kwargs)

426

ret = AvahiService.rename(self, *args, **kwargs)

528

427

syslogger.setFormatter(logging.Formatter(

529

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

428

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

530

429

.format(self.name)))

531

430

return ret

532

431

533

534

432

# Pretend that we have a GnuTLS module

535

class gnutls:

536

"""This isn't so much a class as it is a module-like namespace."""

537

538

library = ctypes.util.find_library("gnutls")

539

if library is None:

540

library = ctypes.util.find_library("gnutls-deb0")

541

_library = ctypes.cdll.LoadLibrary(library)

542

del library

543

433

class GnuTLS(object):

434

"""This isn't so much a class as it is a module-like namespace.

435

It is instantiated once, and simulates having a GnuTLS module."""

436

437

_library = ctypes.cdll.LoadLibrary(

438

ctypes.util.find_library("gnutls"))

439

_need_version = "3.3.0"

440

def __init__(self):

441

# Need to use class name "GnuTLS" here, since this method is

442

# called before the assignment to the "gnutls" global variable

443

# happens.

444

if GnuTLS.check_version(self._need_version) is None:

445

raise GnuTLS.Error("Needs GnuTLS {} or later"

446

.format(self._need_version))

447

544

448

# Unless otherwise indicated, the constants and types below are

545

449

# all from the gnutls/gnutls.h C header file.

546

450

547

451

# Constants

548

452

E_SUCCESS = 0

549

E_INTERRUPTED = -52

550

E_AGAIN = -28

551

453

CRT_OPENPGP = 2

552

CRT_RAWPK = 3

553

454

CLIENT = 2

554

455

SHUT_RDWR = 0

555

456

CRD_CERTIFICATE = 1

556

457

E_NO_CERTIFICATE_FOUND = -49

557

X509_FMT_DER = 0

558

NO_TICKETS = 1<<10

559

ENABLE_RAWPK = 1<<18

560

CTYPE_PEERS = 3

561

KEYID_USE_SHA256 = 1 # gnutls/x509.h

562

458

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

563

459

564

460

# Types

565

class _session_int(ctypes.Structure):

461

class session_int(ctypes.Structure):

566

462

_fields_ = []

567

session_t = ctypes.POINTER(_session_int)

568

463

session_t = ctypes.POINTER(session_int)

569

464

class certificate_credentials_st(ctypes.Structure):

570

465

_fields_ = []

571

466

certificate_credentials_t = ctypes.POINTER(

572

467

certificate_credentials_st)

573

468

certificate_type_t = ctypes.c_int

574

575

469

class datum_t(ctypes.Structure):

576

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

577

("size", ctypes.c_uint)]

578

579

class _openpgp_crt_int(ctypes.Structure):

470

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

471

('size', ctypes.c_uint)]

472

class openpgp_crt_int(ctypes.Structure):

580

473

_fields_ = []

581

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

582

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

474

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

475

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

583

476

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

584

credentials_type_t = ctypes.c_int

477

credentials_type_t = ctypes.c_int #

585

478

transport_ptr_t = ctypes.c_void_p

586

479

close_request_t = ctypes.c_int

587

480

588

481

# Exceptions

589

482

class Error(Exception):

590

def __init__(self, message=None, code=None, args=()):

483

# We need to use the class name "GnuTLS" here, since this

484

# exception might be raised from within GnuTLS.__init__,

485

# which is called before the assignment to the "gnutls"

486

# global variable happens.

487

def __init__(self, message = None, code = None, args=()):

591

488

# Default usage is by a message string, but if a return

592

489

# code is passed, convert it to a string with

593

490

# gnutls.strerror()

594

self.code = code

595

491

if message is None and code is not None:

596

message = gnutls.strerror(code).decode(

597

"utf-8", errors="replace")

598

return super(gnutls.Error, self).__init__(

492

message = GnuTLS.strerror(code)

493

return super(GnuTLS.Error, self).__init__(

599

494

message, *args)

600

495

601

496

class CertificateSecurityError(Error):

602

497

pass

603

604

class PointerTo:

605

def __init__(self, cls):

606

self.cls = cls

607

608

def from_param(self, obj):

609

if not isinstance(obj, self.cls):

610

raise TypeError("Not of type {}: {!r}"

611

.format(self.cls.__name__, obj))

612

return ctypes.byref(obj.from_param(obj))

613

614

class CastToVoidPointer:

615

def __init__(self, cls):

616

self.cls = cls

617

618

def from_param(self, obj):

619

if not isinstance(obj, self.cls):

620

raise TypeError("Not of type {}: {!r}"

621

.format(self.cls.__name__, obj))

622

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

623

624

class With_from_param:

625

@classmethod

626

def from_param(cls, obj):

627

return obj._as_parameter_

628

498

629

499

# Classes

630

class Credentials(With_from_param):

500

class Credentials(object):

631

501

def __init__(self):

632

self._as_parameter_ = gnutls.certificate_credentials_t()

633

gnutls.certificate_allocate_credentials(self)

502

self._c_object = gnutls.certificate_credentials_t()

503

gnutls.certificate_allocate_credentials(

504

ctypes.byref(self._c_object))

634

505

self.type = gnutls.CRD_CERTIFICATE

635

506

636

507

def __del__(self):

637

gnutls.certificate_free_credentials(self)

638

639

class ClientSession(With_from_param):

640

def __init__(self, socket, credentials=None):

641

self._as_parameter_ = gnutls.session_t()

642

gnutls_flags = gnutls.CLIENT

643

if gnutls.check_version(b"3.5.6"):

644

gnutls_flags |= gnutls.NO_TICKETS

645

if gnutls.has_rawpk:

646

gnutls_flags |= gnutls.ENABLE_RAWPK

647

gnutls.init(self, gnutls_flags)

648

del gnutls_flags

649

gnutls.set_default_priority(self)

650

gnutls.transport_set_ptr(self, socket.fileno())

651

gnutls.handshake_set_private_extensions(self, True)

508

gnutls.certificate_free_credentials(self._c_object)

509

510

class ClientSession(object):

511

def __init__(self, socket, credentials = None):

512

self._c_object = gnutls.session_t()

513

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

514

gnutls.set_default_priority(self._c_object)

515

gnutls.transport_set_ptr(self._c_object, socket.fileno())

516

gnutls.handshake_set_private_extensions(self._c_object,

517

True)

652

518

self.socket = socket

653

519

if credentials is None:

654

520

credentials = gnutls.Credentials()

655

gnutls.credentials_set(self, credentials.type,

656

credentials)

521

gnutls.credentials_set(self._c_object, credentials.type,

522

ctypes.cast(credentials._c_object,

523

ctypes.c_void_p))

657

524

self.credentials = credentials

658

525

659

526

def __del__(self):

660

gnutls.deinit(self)

661

527

gnutls.deinit(self._c_object)

528

662

529

def handshake(self):

663

return gnutls.handshake(self)

664

530

return gnutls.handshake(self._c_object)

531

665

532

def send(self, data):

666

533

data = bytes(data)

667

data_len = len(data)

668

while data_len > 0:

669

data_len -= gnutls.record_send(self, data[-data_len:],

670

data_len)

671

534

if not data:

535

return 0

536

return gnutls.record_send(self._c_object, data, len(data))

537

672

538

def bye(self):

673

return gnutls.bye(self, gnutls.SHUT_RDWR)

674

675

# Error handling functions

539

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

540

541

# Error handling function

676

542

def _error_code(result):

677

543

"""A function to raise exceptions on errors, suitable

678

for the "restype" attribute on ctypes functions"""

679

if result >= gnutls.E_SUCCESS:

544

for the 'restype' attribute on ctypes functions"""

545

if result >= 0:

680

546

return result

681

547

if result == gnutls.E_NO_CERTIFICATE_FOUND:

682

raise gnutls.CertificateSecurityError(code=result)

683

raise gnutls.Error(code=result)

684

685

def _retry_on_error(result, func, arguments,

686

_error_code=_error_code):

687

"""A function to retry on some errors, suitable

688

for the "errcheck" attribute on ctypes functions"""

689

while result < gnutls.E_SUCCESS:

690

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

691

return _error_code(result)

692

result = func(*arguments)

693

return result

694

548

raise gnutls.CertificateSecurityError(code = result)

549

raise gnutls.Error(code = result)

550

695

551

# Unless otherwise indicated, the function declarations below are

696

552

# all from the gnutls/gnutls.h C header file.

697

553

698

554

# Functions

699

555

priority_set_direct = _library.gnutls_priority_set_direct

700

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

556

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

701

557

ctypes.POINTER(ctypes.c_char_p)]

702

558

priority_set_direct.restype = _error_code

703

559

704

560

init = _library.gnutls_init

705

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

561

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

706

562

init.restype = _error_code

707

563

708

564

set_default_priority = _library.gnutls_set_default_priority

709

set_default_priority.argtypes = [ClientSession]

565

set_default_priority.argtypes = [session_t]

710

566

set_default_priority.restype = _error_code

711

567

712

568

record_send = _library.gnutls_record_send

713

record_send.argtypes = [ClientSession, ctypes.c_void_p,

569

record_send.argtypes = [session_t, ctypes.c_void_p,

714

570

ctypes.c_size_t]

715

571

record_send.restype = ctypes.c_ssize_t

716

record_send.errcheck = _retry_on_error

717

572

718

573

certificate_allocate_credentials = (

719

574

_library.gnutls_certificate_allocate_credentials)

720

575

certificate_allocate_credentials.argtypes = [

721

PointerTo(Credentials)]

576

ctypes.POINTER(certificate_credentials_t)]

722

577

certificate_allocate_credentials.restype = _error_code

723

578

724

579

certificate_free_credentials = (

725

580

_library.gnutls_certificate_free_credentials)

726

certificate_free_credentials.argtypes = [Credentials]

581

certificate_free_credentials.argtypes = [certificate_credentials_t]

727

582

certificate_free_credentials.restype = None

728

583

729

584

handshake_set_private_extensions = (

730

585

_library.gnutls_handshake_set_private_extensions)

731

handshake_set_private_extensions.argtypes = [ClientSession,

586

handshake_set_private_extensions.argtypes = [session_t,

732

587

ctypes.c_int]

733

588

handshake_set_private_extensions.restype = None

734

589

735

590

credentials_set = _library.gnutls_credentials_set

736

credentials_set.argtypes = [ClientSession, credentials_type_t,

737

CastToVoidPointer(Credentials)]

591

credentials_set.argtypes = [session_t, credentials_type_t,

592

ctypes.c_void_p]

738

593

credentials_set.restype = _error_code

739

594

740

595

strerror = _library.gnutls_strerror

741

596

strerror.argtypes = [ctypes.c_int]

742

597

strerror.restype = ctypes.c_char_p

743

598

744

599

certificate_type_get = _library.gnutls_certificate_type_get

745

certificate_type_get.argtypes = [ClientSession]

600

certificate_type_get.argtypes = [session_t]

746

601

certificate_type_get.restype = _error_code

747

602

748

603

certificate_get_peers = _library.gnutls_certificate_get_peers

749

certificate_get_peers.argtypes = [ClientSession,

604

certificate_get_peers.argtypes = [session_t,

750

605

ctypes.POINTER(ctypes.c_uint)]

751

606

certificate_get_peers.restype = ctypes.POINTER(datum_t)

752

607

753

608

global_set_log_level = _library.gnutls_global_set_log_level

754

609

global_set_log_level.argtypes = [ctypes.c_int]

755

610

global_set_log_level.restype = None

756

611

757

612

global_set_log_function = _library.gnutls_global_set_log_function

758

613

global_set_log_function.argtypes = [log_func]

759

614

global_set_log_function.restype = None

760

615

761

616

deinit = _library.gnutls_deinit

762

deinit.argtypes = [ClientSession]

617

deinit.argtypes = [session_t]

763

618

deinit.restype = None

764

619

765

620

handshake = _library.gnutls_handshake

766

handshake.argtypes = [ClientSession]

767

handshake.restype = ctypes.c_int

768

handshake.errcheck = _retry_on_error

769

621

handshake.argtypes = [session_t]

622

handshake.restype = _error_code

623

770

624

transport_set_ptr = _library.gnutls_transport_set_ptr

771

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

625

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

772

626

transport_set_ptr.restype = None

773

627

774

628

bye = _library.gnutls_bye

775

bye.argtypes = [ClientSession, close_request_t]

776

bye.restype = ctypes.c_int

777

bye.errcheck = _retry_on_error

778

629

bye.argtypes = [session_t, close_request_t]

630

bye.restype = _error_code

631

779

632

check_version = _library.gnutls_check_version

780

633

check_version.argtypes = [ctypes.c_char_p]

781

634

check_version.restype = ctypes.c_char_p

782

783

_need_version = b"3.3.0"

784

if check_version(_need_version) is None:

785

raise self.Error("Needs GnuTLS {} or later"

786

.format(_need_version))

787

788

_tls_rawpk_version = b"3.6.6"

789

has_rawpk = bool(check_version(_tls_rawpk_version))

790

791

if has_rawpk:

792

# Types

793

class pubkey_st(ctypes.Structure):

794

_fields = []

795

pubkey_t = ctypes.POINTER(pubkey_st)

796

797

x509_crt_fmt_t = ctypes.c_int

798

799

# All the function declarations below are from

800

# gnutls/abstract.h

801

pubkey_init = _library.gnutls_pubkey_init

802

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

803

pubkey_init.restype = _error_code

804

805

pubkey_import = _library.gnutls_pubkey_import

806

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

807

x509_crt_fmt_t]

808

pubkey_import.restype = _error_code

809

810

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

811

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

812

ctypes.POINTER(ctypes.c_ubyte),

813

ctypes.POINTER(ctypes.c_size_t)]

814

pubkey_get_key_id.restype = _error_code

815

816

pubkey_deinit = _library.gnutls_pubkey_deinit

817

pubkey_deinit.argtypes = [pubkey_t]

818

pubkey_deinit.restype = None

819

else:

820

# All the function declarations below are from

821

# gnutls/openpgp.h

822

823

openpgp_crt_init = _library.gnutls_openpgp_crt_init

824

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

825

openpgp_crt_init.restype = _error_code

826

827

openpgp_crt_import = _library.gnutls_openpgp_crt_import

828

openpgp_crt_import.argtypes = [openpgp_crt_t,

829

ctypes.POINTER(datum_t),

830

openpgp_crt_fmt_t]

831

openpgp_crt_import.restype = _error_code

832

833

openpgp_crt_verify_self = \

834

_library.gnutls_openpgp_crt_verify_self

835

openpgp_crt_verify_self.argtypes = [

836

openpgp_crt_t,

837

ctypes.c_uint,

838

ctypes.POINTER(ctypes.c_uint),

839

]

840

openpgp_crt_verify_self.restype = _error_code

841

842

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

843

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

844

openpgp_crt_deinit.restype = None

845

846

openpgp_crt_get_fingerprint = (

847

_library.gnutls_openpgp_crt_get_fingerprint)

848

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

849

ctypes.c_void_p,

850

ctypes.POINTER(

851

ctypes.c_size_t)]

852

openpgp_crt_get_fingerprint.restype = _error_code

853

854

if check_version(b"3.6.4"):

855

certificate_type_get2 = _library.gnutls_certificate_type_get2

856

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

857

certificate_type_get2.restype = _error_code

858

859

# Remove non-public functions

860

del _error_code, _retry_on_error

861

635

636

# All the function declarations below are from gnutls/openpgp.h

637

638

openpgp_crt_init = _library.gnutls_openpgp_crt_init

639

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

640

openpgp_crt_init.restype = _error_code

641

642

openpgp_crt_import = _library.gnutls_openpgp_crt_import

643

openpgp_crt_import.argtypes = [openpgp_crt_t,

644

ctypes.POINTER(datum_t),

645

openpgp_crt_fmt_t]

646

openpgp_crt_import.restype = _error_code

647

648

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

649

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

650

ctypes.POINTER(ctypes.c_uint)]

651

openpgp_crt_verify_self.restype = _error_code

652

653

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

654

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

655

openpgp_crt_deinit.restype = None

656

657

openpgp_crt_get_fingerprint = (

658

_library.gnutls_openpgp_crt_get_fingerprint)

659

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

660

ctypes.c_void_p,

661

ctypes.POINTER(

662

ctypes.c_size_t)]

663

openpgp_crt_get_fingerprint.restype = _error_code

664

665

# Remove non-public function

666

del _error_code

667

# Create the global "gnutls" object, simulating a module

668

gnutls = GnuTLS()

862

669

863

670

def call_pipe(connection, # : multiprocessing.Connection

864

671

func, *args, **kwargs):

865

672

"""This function is meant to be called by multiprocessing.Process

866

673

867

674

This function runs func(*args, **kwargs), and writes the resulting

868

675

return value on the provided multiprocessing.Connection.

869

676

"""

870

677

connection.send(func(*args, **kwargs))

871

678

connection.close()

872

679

873

874

class Client:

680

class Client(object):

875

681

"""A representation of a client host served by this server.

876

682

877

683

Attributes:

878

approved: bool(); None if not yet approved/disapproved

684

approved: bool(); 'None' if not yet approved/disapproved

879

685

approval_delay: datetime.timedelta(); Time to wait for approval

880

686

approval_duration: datetime.timedelta(); Duration of one approval

881

checker: multiprocessing.Process(); a running checker process used

882

to see if the client lives. None if no process is

883

running.

884

checker_callback_tag: a GLib event source tag, or None

687

checker: subprocess.Popen(); a running checker process used

688

to see if the client lives.

689

'None' if no process is running.

690

checker_callback_tag: a gobject event source tag, or None

885

691

checker_command: string; External command which is run to check

886

692

if client lives. %() expansions are done at

887

693

runtime with vars(self) as dict, so that for

888

694

instance %(name)s can be used in the command.

889

checker_initiator_tag: a GLib event source tag, or None

695

checker_initiator_tag: a gobject event source tag, or None

890

696

created: datetime.datetime(); (UTC) object creation

891

697

client_structure: Object describing what attributes a client has

892

698

and is used for storing the client at exit

893

699

current_checker_command: string; current running checker_command

894

disable_initiator_tag: a GLib event source tag, or None

700

disable_initiator_tag: a gobject event source tag, or None

895

701

enabled: bool()

896

702

fingerprint: string (40 or 32 hexadecimal digits); used to

897

uniquely identify an OpenPGP client

898

key_id: string (64 hexadecimal digits); used to uniquely identify

899

a client using raw public keys

703

uniquely identify the client

900

704

host: string; available for use by the checker command

901

705

interval: datetime.timedelta(); How often to start a new checker

902

706

last_approval_request: datetime.datetime(); (UTC) or None

918

722

disabled, or None

919

723

server_settings: The server_settings dict from main()

920

724

"""

921

725

922

726

runtime_expansions = ("approval_delay", "approval_duration",

923

"created", "enabled", "expires", "key_id",

727

"created", "enabled", "expires",

924

728

"fingerprint", "host", "interval",

925

729

"last_approval_request", "last_checked_ok",

926

730

"last_enabled", "name", "timeout")

935

739

"approved_by_default": "True",

936

740

"enabled": "True",

937

741

}

938

742

939

743

@staticmethod

940

744

def config_parser(config):

941

745

"""Construct a new dict of client settings of this form:

948

752

for client_name in config.sections():

949

753

section = dict(config.items(client_name))

950

754

client = settings[client_name] = {}

951

755

952

756

client["host"] = section["host"]

953

757

# Reformat values from string types to Python types

954

758

client["approved_by_default"] = config.getboolean(

955

759

client_name, "approved_by_default")

956

760

client["enabled"] = config.getboolean(client_name,

957

761

"enabled")

958

959

# Uppercase and remove spaces from key_id and fingerprint

960

# for later comparison purposes with return value from the

961

# key_id() and fingerprint() functions

962

client["key_id"] = (section.get("key_id", "").upper()

963

.replace(" ", ""))

762

763

# Uppercase and remove spaces from fingerprint for later

764

# comparison purposes with return value from the

765

# fingerprint() function

964

766

client["fingerprint"] = (section["fingerprint"].upper()

965

767

.replace(" ", ""))

966

768

if "secret" in section:

967

client["secret"] = codecs.decode(section["secret"]

968

.encode("utf-8"),

969

"base64")

769

client["secret"] = section["secret"].decode("base64")

970

770

elif "secfile" in section:

971

771

with open(os.path.expanduser(os.path.expandvars

972

772

(section["secfile"])),

987

787

client["last_approval_request"] = None

988

788

client["last_checked_ok"] = None

989

789

client["last_checker_status"] = -2

990

790

991

791

return settings

992

993

def __init__(self, settings, name=None, server_settings=None):

792

793

def __init__(self, settings, name = None, server_settings=None):

994

794

self.name = name

995

795

if server_settings is None:

996

796

server_settings = {}

998

798

# adding all client settings

999

799

for setting, value in settings.items():

1000

800

setattr(self, setting, value)

1001

801

1002

802

if self.enabled:

1003

803

if not hasattr(self, "last_enabled"):

1004

804

self.last_enabled = datetime.datetime.utcnow()

1008

808

else:

1009

809

self.last_enabled = None

1010

810

self.expires = None

1011

1012

log.debug("Creating client %r", self.name)

1013

log.debug(" Key ID: %s", self.key_id)

1014

log.debug(" Fingerprint: %s", self.fingerprint)

811

812

logger.debug("Creating client %r", self.name)

813

logger.debug(" Fingerprint: %s", self.fingerprint)

1015

814

self.created = settings.get("created",

1016

815

datetime.datetime.utcnow())

1017

816

1018

817

# attributes specific for this server instance

1019

818

self.checker = None

1020

819

self.checker_initiator_tag = None

1026

825

self.changedstate = multiprocessing_manager.Condition(

1027

826

multiprocessing_manager.Lock())

1028

827

self.client_structure = [attr

1029

for attr in self.__dict__.keys()

828

for attr in self.__dict__.iterkeys()

1030

829

if not attr.startswith("_")]

1031

830

self.client_structure.append("client_structure")

1032

831

1033

832

for name, t in inspect.getmembers(

1034

833

type(self), lambda obj: isinstance(obj, property)):

1035

834

if not name.startswith("_"):

1036

835

self.client_structure.append(name)

1037

836

1038

837

# Send notice to process children that client state has changed

1039

838

def send_changedstate(self):

1040

839

with self.changedstate:

1041

840

self.changedstate.notify_all()

1042

841

1043

842

def enable(self):

1044

843

"""Start this client's checker and timeout hooks"""

1045

844

if getattr(self, "enabled", False):

1046

845

# Already enabled

1047

846

return

847

self.expires = datetime.datetime.utcnow() + self.timeout

1048

848

self.enabled = True

1049

849

self.last_enabled = datetime.datetime.utcnow()

1050

850

self.init_checker()

1051

851

self.send_changedstate()

1052

852

1053

853

def disable(self, quiet=True):

1054

854

"""Disable this client."""

1055

855

if not getattr(self, "enabled", False):

1056

856

return False

1057

857

if not quiet:

1058

log.info("Disabling client %s", self.name)

858

logger.info("Disabling client %s", self.name)

1059

859

if getattr(self, "disable_initiator_tag", None) is not None:

1060

GLib.source_remove(self.disable_initiator_tag)

860

gobject.source_remove(self.disable_initiator_tag)

1061

861

self.disable_initiator_tag = None

1062

862

self.expires = None

1063

863

if getattr(self, "checker_initiator_tag", None) is not None:

1064

GLib.source_remove(self.checker_initiator_tag)

864

gobject.source_remove(self.checker_initiator_tag)

1065

865

self.checker_initiator_tag = None

1066

866

self.stop_checker()

1067

867

self.enabled = False

1068

868

if not quiet:

1069

869

self.send_changedstate()

1070

# Do not run this again if called by a GLib.timeout_add

870

# Do not run this again if called by a gobject.timeout_add

1071

871

return False

1072

872

1073

873

def __del__(self):

1074

874

self.disable()

1075

1076

def init_checker(self, randomize_start=False):

1077

# Schedule a new checker to be started a randomly selected

1078

# time (a fraction of 'interval') from now. This spreads out

1079

# the startup of checkers over time when the server is

1080

# started.

875

876

def init_checker(self):

877

# Schedule a new checker to be started an 'interval' from now,

878

# and every interval from then on.

1081

879

if self.checker_initiator_tag is not None:

1082

GLib.source_remove(self.checker_initiator_tag)

1083

interval_milliseconds = int(self.interval.total_seconds()

1084

* 1000)

1085

if randomize_start:

1086

delay_milliseconds = random.randrange(

1087

interval_milliseconds + 1)

1088

else:

1089

delay_milliseconds = interval_milliseconds

1090

self.checker_initiator_tag = GLib.timeout_add(

1091

delay_milliseconds, self.start_checker, randomize_start)

1092

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1093

# A checker might take up to an 'interval' of time, so we can

1094

# expire at the soonest one interval after a checker was

1095

# started. Since the initial checker is delayed, the expire

1096

# time might have to be extended.

1097

now = datetime.datetime.utcnow()

1098

self.expires = now + delay + self.interval

1099

# Schedule a disable() at expire time

880

gobject.source_remove(self.checker_initiator_tag)

881

self.checker_initiator_tag = gobject.timeout_add(

882

int(self.interval.total_seconds() * 1000),

883

self.start_checker)

884

# Schedule a disable() when 'timeout' has passed

1100

885

if self.disable_initiator_tag is not None:

1101

GLib.source_remove(self.disable_initiator_tag)

1102

self.disable_initiator_tag = GLib.timeout_add(

1103

int((self.expires - now).total_seconds() * 1000),

1104

self.disable)

1105

886

gobject.source_remove(self.disable_initiator_tag)

887

self.disable_initiator_tag = gobject.timeout_add(

888

int(self.timeout.total_seconds() * 1000), self.disable)

889

# Also start a new checker *right now*.

890

self.start_checker()

891

1106

892

def checker_callback(self, source, condition, connection,

1107

893

command):

1108

894

"""The checker has completed, so take appropriate actions."""

895

self.checker_callback_tag = None

896

self.checker = None

1109

897

# Read return code from connection (see call_pipe)

1110

898

returncode = connection.recv()

1111

899

connection.close()

1112

if self.checker is not None:

1113

self.checker.join()

1114

self.checker_callback_tag = None

1115

self.checker = None

1116

900

1117

901

if returncode >= 0:

1118

902

self.last_checker_status = returncode

1119

903

self.last_checker_signal = None

1120

904

if self.last_checker_status == 0:

1121

log.info("Checker for %(name)s succeeded", vars(self))

905

logger.info("Checker for %(name)s succeeded",

906

vars(self))

1122

907

self.checked_ok()

1123

908

else:

1124

log.info("Checker for %(name)s failed", vars(self))

909

logger.info("Checker for %(name)s failed", vars(self))

1125

910

else:

1126

911

self.last_checker_status = -1

1127

912

self.last_checker_signal = -returncode

1128

log.warning("Checker for %(name)s crashed?", vars(self))

913

logger.warning("Checker for %(name)s crashed?",

914

vars(self))

1129

915

return False

1130

916

1131

917

def checked_ok(self):

1132

918

"""Assert that the client has been seen, alive and well."""

1133

919

self.last_checked_ok = datetime.datetime.utcnow()

1134

920

self.last_checker_status = 0

1135

921

self.last_checker_signal = None

1136

922

self.bump_timeout()

1137

923

1138

924

def bump_timeout(self, timeout=None):

1139

925

"""Bump up the timeout for this client."""

1140

926

if timeout is None:

1141

927

timeout = self.timeout

1142

928

if self.disable_initiator_tag is not None:

1143

GLib.source_remove(self.disable_initiator_tag)

929

gobject.source_remove(self.disable_initiator_tag)

1144

930

self.disable_initiator_tag = None

1145

931

if getattr(self, "enabled", False):

1146

self.disable_initiator_tag = GLib.timeout_add(

932

self.disable_initiator_tag = gobject.timeout_add(

1147

933

int(timeout.total_seconds() * 1000), self.disable)

1148

934

self.expires = datetime.datetime.utcnow() + timeout

1149

935

1150

936

def need_approval(self):

1151

937

self.last_approval_request = datetime.datetime.utcnow()

1152

1153

def start_checker(self, start_was_randomized=False):

938

939

def start_checker(self):

1154

940

"""Start a new checker subprocess if one is not running.

1155

941

1156

942

If a checker already exists, leave it running and do

1157

943

nothing."""

1158

944

# The reason for not killing a running checker is that if we

1163

949

# checkers alone, the checker would have to take more time

1164

950

# than 'timeout' for the client to be disabled, which is as it

1165

951

# should be.

1166

952

1167

953

if self.checker is not None and not self.checker.is_alive():

1168

log.warning("Checker was not alive; joining")

954

logger.warning("Checker was not alive; joining")

1169

955

self.checker.join()

1170

956

self.checker = None

1171

957

# Start a new checker if needed

1172

958

if self.checker is None:

1173

959

# Escape attributes for the shell

1174

960

escaped_attrs = {

1175

attr: shlex.quote(str(getattr(self, attr)))

1176

for attr in self.runtime_expansions}

961

attr: re.escape(str(getattr(self, attr)))

962

for attr in self.runtime_expansions }

1177

963

try:

1178

964

command = self.checker_command % escaped_attrs

1179

965

except TypeError as error:

1180

log.error('Could not format string "%s"',

1181

self.checker_command, exc_info=error)

966

logger.error('Could not format string "%s"',

967

self.checker_command,

968

exc_info=error)

1182

969

return True # Try again later

1183

970

self.current_checker_command = command

1184

log.info("Starting checker %r for %s", command, self.name)

971

logger.info("Starting checker %r for %s", command,

972

self.name)

1185

973

# We don't need to redirect stdout and stderr, since

1186

974

# in normal mode, that is already done by daemon(),

1187

975

# and in debug mode we don't want to. (Stdin is

1189

977

# The exception is when not debugging but nevertheless

1190

978

# running in the foreground; use the previously

1191

979

# created wnull.

1192

popen_args = {"close_fds": True,

1193

"shell": True,

1194

"cwd": "/"}

980

popen_args = { "close_fds": True,

981

"shell": True,

982

"cwd": "/" }

1195

983

if (not self.server_settings["debug"]

1196

984

and self.server_settings["foreground"]):

1197

985

popen_args.update({"stdout": wnull,

1198

"stderr": wnull})

1199

pipe = multiprocessing.Pipe(duplex=False)

986

"stderr": wnull })

987

pipe = multiprocessing.Pipe(duplex = False)

1200

988

self.checker = multiprocessing.Process(

1201

target=call_pipe,

1202

args=(pipe[1], subprocess.call, command),

1203

kwargs=popen_args)

989

target = call_pipe,

990

args = (pipe[1], subprocess.call, command),

991

kwargs = popen_args)

1204

992

self.checker.start()

1205

self.checker_callback_tag = GLib.io_add_watch(

1206

GLib.IOChannel.unix_new(pipe[0].fileno()),

1207

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

993

self.checker_callback_tag = gobject.io_add_watch(

994

pipe[0].fileno(), gobject.IO_IN,

1208

995

self.checker_callback, pipe[0], command)

1209

if start_was_randomized:

1210

# We were started after a random delay; Schedule a new

1211

# checker to be started an 'interval' from now, and every

1212

# interval from then on.

1213

now = datetime.datetime.utcnow()

1214

self.checker_initiator_tag = GLib.timeout_add(

1215

int(self.interval.total_seconds() * 1000),

1216

self.start_checker)

1217

self.expires = max(self.expires, now + self.interval)

1218

# Don't start a new checker again after same random delay

1219

return False

1220

# Re-run this periodically if run by GLib.timeout_add

996

# Re-run this periodically if run by gobject.timeout_add

1221

997

return True

1222

998

1223

999

def stop_checker(self):

1224

1000

"""Force the checker process, if any, to stop."""

1225

1001

if self.checker_callback_tag:

1226

GLib.source_remove(self.checker_callback_tag)

1002

gobject.source_remove(self.checker_callback_tag)

1227

1003

self.checker_callback_tag = None

1228

1004

if getattr(self, "checker", None) is None:

1229

1005

return

1230

log.debug("Stopping checker for %(name)s", vars(self))

1006

logger.debug("Stopping checker for %(name)s", vars(self))

1231

1007

self.checker.terminate()

1232

1008

self.checker = None

1233

1009

1238

1014

byte_arrays=False):

1239

1015

"""Decorators for marking methods of a DBusObjectWithProperties to

1240

1016

become properties on the D-Bus.

1241

1017

1242

1018

The decorated method will be called with no arguments by "Get"

1243

1019

and with one argument by "Set".

1244

1020

1245

1021

The parameters, where they are supported, are the same as

1246

1022

dbus.service.method, except there is only "signature", since the

1247

1023

type from Get() and the type sent to Set() is the same.

1251

1027

if byte_arrays and signature != "ay":

1252

1028

raise ValueError("Byte arrays not supported for non-'ay'"

1253

1029

" signature {!r}".format(signature))

1254

1030

1255

1031

def decorator(func):

1256

1032

func._dbus_is_property = True

1257

1033

func._dbus_interface = dbus_interface

1260

1036

func._dbus_name = func.__name__

1261

1037

if func._dbus_name.endswith("_dbus_property"):

1262

1038

func._dbus_name = func._dbus_name[:-14]

1263

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1039

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1264

1040

return func

1265

1041

1266

1042

return decorator

1267

1043

1268

1044

1269

1045

def dbus_interface_annotations(dbus_interface):

1270

1046

"""Decorator for marking functions returning interface annotations

1271

1047

1272

1048

Usage:

1273

1049

1274

1050

@dbus_interface_annotations("org.example.Interface")

1275

1051

def _foo(self): # Function name does not matter

1276

1052

return {"org.freedesktop.DBus.Deprecated": "true",

1277

1053

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1278

1054

"false"}

1279

1055

"""

1280

1056

1281

1057

def decorator(func):

1282

1058

func._dbus_is_interface = True

1283

1059

func._dbus_interface = dbus_interface

1284

1060

func._dbus_name = dbus_interface

1285

1061

return func

1286

1062

1287

1063

return decorator

1288

1064

1289

1065

1290

1066

def dbus_annotations(annotations):

1291

1067

"""Decorator to annotate D-Bus methods, signals or properties

1292

1068

Usage:

1293

1069

1294

1070

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1295

1071

"org.freedesktop.DBus.Property."

1296

1072

"EmitsChangedSignal": "false"})

1298

1074

access="r")

1299

1075

def Property_dbus_property(self):

1300

1076

return dbus.Boolean(False)

1301

1077

1302

1078

See also the DBusObjectWithAnnotations class.

1303

1079

"""

1304

1080

1305

1081

def decorator(func):

1306

1082

func._dbus_annotations = annotations

1307

1083

return func

1308

1084

1309

1085

return decorator

1310

1086

1311

1087

1329

1105

1330

1106

class DBusObjectWithAnnotations(dbus.service.Object):

1331

1107

"""A D-Bus object with annotations.

1332

1108

1333

1109

Classes inheriting from this can use the dbus_annotations

1334

1110

decorator to add annotations to methods or signals.

1335

1111

"""

1336

1112

1337

1113

@staticmethod

1338

1114

def _is_dbus_thing(thing):

1339

1115

"""Returns a function testing if an attribute is a D-Bus thing

1340

1116

1341

1117

If called like _is_dbus_thing("method") it returns a function

1342

1118

suitable for use as predicate to inspect.getmembers().

1343

1119

"""

1344

1120

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1345

1121

False)

1346

1122

1347

1123

def _get_all_dbus_things(self, thing):

1348

1124

"""Returns a generator of (name, attribute) pairs

1349

1125

"""

1352

1128

for cls in self.__class__.__mro__

1353

1129

for name, athing in

1354

1130

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1355

1131

1356

1132

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1357

out_signature="s",

1358

path_keyword="object_path",

1359

connection_keyword="connection")

1133

out_signature = "s",

1134

path_keyword = 'object_path',

1135

connection_keyword = 'connection')

1360

1136

def Introspect(self, object_path, connection):

1361

1137

"""Overloading of standard D-Bus method.

1362

1138

1363

1139

Inserts annotation tags on methods and signals.

1364

1140

"""

1365

1141

xmlstring = dbus.service.Object.Introspect(self, object_path,

1366

1142

connection)

1367

1143

try:

1368

1144

document = xml.dom.minidom.parseString(xmlstring)

1369

1145

1370

1146

for if_tag in document.getElementsByTagName("interface"):

1371

1147

# Add annotation tags

1372

1148

for typ in ("method", "signal"):

1399

1175

if_tag.appendChild(ann_tag)

1400

1176

# Fix argument name for the Introspect method itself

1401

1177

if (if_tag.getAttribute("name")

1402

== dbus.INTROSPECTABLE_IFACE):

1178

== dbus.INTROSPECTABLE_IFACE):

1403

1179

for cn in if_tag.getElementsByTagName("method"):

1404

1180

if cn.getAttribute("name") == "Introspect":

1405

1181

for arg in cn.getElementsByTagName("arg"):

1411

1187

document.unlink()

1412

1188

except (AttributeError, xml.dom.DOMException,

1413

1189

xml.parsers.expat.ExpatError) as error:

1414

log.error("Failed to override Introspection method",

1415

exc_info=error)

1190

logger.error("Failed to override Introspection method",

1191

exc_info=error)

1416

1192

return xmlstring

1417

1193

1418

1194

1419

1195

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1420

1196

"""A D-Bus object with properties.

1421

1197

1422

1198

Classes inheriting from this can use the dbus_service_property

1423

1199

decorator to expose methods as D-Bus properties. It exposes the

1424

1200

standard Get(), Set(), and GetAll() methods on the D-Bus.

1425

1201

"""

1426

1202

1427

1203

def _get_dbus_property(self, interface_name, property_name):

1428

1204

"""Returns a bound method if one exists which is a D-Bus

1429

1205

property with the specified name and interface.

1434

1210

if (value._dbus_name == property_name

1435

1211

and value._dbus_interface == interface_name):

1436

1212

return value.__get__(self)

1437

1213

1438

1214

# No such property

1439

1215

raise DBusPropertyNotFound("{}:{}.{}".format(

1440

1216

self.dbus_object_path, interface_name, property_name))

1441

1217

1442

1218

@classmethod

1443

1219

def _get_all_interface_names(cls):

1444

1220

"""Get a sequence of all interfaces supported by an object"""

1447

1223

for x in (inspect.getmro(cls))

1448

1224

for attr in dir(x))

1449

1225

if name is not None)

1450

1226

1451

1227

@dbus.service.method(dbus.PROPERTIES_IFACE,

1452

1228

in_signature="ss",

1453

1229

out_signature="v")

1461

1237

if not hasattr(value, "variant_level"):

1462

1238

return value

1463

1239

return type(value)(value, variant_level=value.variant_level+1)

1464

1240

1465

1241

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1466

1242

def Set(self, interface_name, property_name, value):

1467

1243

"""Standard D-Bus property Set() method, see D-Bus standard.

1476

1252

raise ValueError("Byte arrays not supported for non-"

1477

1253

"'ay' signature {!r}"

1478

1254

.format(prop._dbus_signature))

1479

value = dbus.ByteArray(bytes(value))

1255

value = dbus.ByteArray(b''.join(chr(byte)

1256

for byte in value))

1480

1257

prop(value)

1481

1258

1482

1259

@dbus.service.method(dbus.PROPERTIES_IFACE,

1483

1260

in_signature="s",

1484

1261

out_signature="a{sv}")

1485

1262

def GetAll(self, interface_name):

1486

1263

"""Standard D-Bus property GetAll() method, see D-Bus

1487

1264

standard.

1488

1265

1489

1266

Note: Will not include properties with access="write".

1490

1267

"""

1491

1268

properties = {}

1502

1279

properties[name] = value

1503

1280

continue

1504

1281

properties[name] = type(value)(

1505

value, variant_level=value.variant_level + 1)

1282

value, variant_level = value.variant_level + 1)

1506

1283

return dbus.Dictionary(properties, signature="sv")

1507

1284

1508

1285

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1509

1286

def PropertiesChanged(self, interface_name, changed_properties,

1510

1287

invalidated_properties):

1512

1289

standard.

1513

1290

"""

1514

1291

pass

1515

1292

1516

1293

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1517

1294

out_signature="s",

1518

path_keyword="object_path",

1519

connection_keyword="connection")

1295

path_keyword='object_path',

1296

connection_keyword='connection')

1520

1297

def Introspect(self, object_path, connection):

1521

1298

"""Overloading of standard D-Bus method.

1522

1299

1523

1300

Inserts property tags and interface annotation tags.

1524

1301

"""

1525

1302

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1527

1304

connection)

1528

1305

try:

1529

1306

document = xml.dom.minidom.parseString(xmlstring)

1530

1307

1531

1308

def make_tag(document, name, prop):

1532

1309

e = document.createElement("property")

1533

1310

e.setAttribute("name", name)

1534

1311

e.setAttribute("type", prop._dbus_signature)

1535

1312

e.setAttribute("access", prop._dbus_access)

1536

1313

return e

1537

1314

1538

1315

for if_tag in document.getElementsByTagName("interface"):

1539

1316

# Add property tags

1540

1317

for tag in (make_tag(document, name, prop)

1578

1355

document.unlink()

1579

1356

except (AttributeError, xml.dom.DOMException,

1580

1357

xml.parsers.expat.ExpatError) as error:

1581

log.error("Failed to override Introspection method",

1582

exc_info=error)

1358

logger.error("Failed to override Introspection method",

1359

exc_info=error)

1583

1360

return xmlstring

1584

1361

1585

1586

1362

try:

1587

1363

dbus.OBJECT_MANAGER_IFACE

1588

1364

except AttributeError:

1589

1365

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1590

1366

1591

1592

1367

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1593

1368

"""A D-Bus object with an ObjectManager.

1594

1369

1595

1370

Classes inheriting from this exposes the standard

1596

1371

GetManagedObjects call and the InterfacesAdded and

1597

1372

InterfacesRemoved signals on the standard

1598

1373

"org.freedesktop.DBus.ObjectManager" interface.

1599

1374

1600

1375

Note: No signals are sent automatically; they must be sent

1601

1376

manually.

1602

1377

"""

1603

1378

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1604

out_signature="a{oa{sa{sv}}}")

1379

out_signature = "a{oa{sa{sv}}}")

1605

1380

def GetManagedObjects(self):

1606

1381

"""This function must be overridden"""

1607

1382

raise NotImplementedError()

1608

1383

1609

1384

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1610

signature="oa{sa{sv}}")

1385

signature = "oa{sa{sv}}")

1611

1386

def InterfacesAdded(self, object_path, interfaces_and_properties):

1612

1387

pass

1613

1614

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1388

1389

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1615

1390

def InterfacesRemoved(self, object_path, interfaces):

1616

1391

pass

1617

1392

1618

1393

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1619

out_signature="s",

1620

path_keyword="object_path",

1621

connection_keyword="connection")

1394

out_signature = "s",

1395

path_keyword = 'object_path',

1396

connection_keyword = 'connection')

1622

1397

def Introspect(self, object_path, connection):

1623

1398

"""Overloading of standard D-Bus method.

1624

1399

1625

1400

Override return argument name of GetManagedObjects to be

1626

1401

"objpath_interfaces_and_properties"

1627

1402

"""

1630

1405

connection)

1631

1406

try:

1632

1407

document = xml.dom.minidom.parseString(xmlstring)

1633

1408

1634

1409

for if_tag in document.getElementsByTagName("interface"):

1635

1410

# Fix argument name for the GetManagedObjects method

1636

1411

if (if_tag.getAttribute("name")

1637

== dbus.OBJECT_MANAGER_IFACE):

1412

== dbus.OBJECT_MANAGER_IFACE):

1638

1413

for cn in if_tag.getElementsByTagName("method"):

1639

1414

if (cn.getAttribute("name")

1640

1415

== "GetManagedObjects"):

1649

1424

document.unlink()

1650

1425

except (AttributeError, xml.dom.DOMException,

1651

1426

xml.parsers.expat.ExpatError) as error:

1652

log.error("Failed to override Introspection method",

1653

exc_info=error)

1427

logger.error("Failed to override Introspection method",

1428

exc_info = error)

1654

1429

return xmlstring

1655

1430

1656

1657

1431

def datetime_to_dbus(dt, variant_level=0):

1658

1432

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1659

1433

if dt is None:

1660

return dbus.String("", variant_level=variant_level)

1434

return dbus.String("", variant_level = variant_level)

1661

1435

return dbus.String(dt.isoformat(), variant_level=variant_level)

1662

1436

1663

1437

1666

1440

dbus.service.Object, it will add alternate D-Bus attributes with

1667

1441

interface names according to the "alt_interface_names" mapping.

1668

1442

Usage:

1669

1443

1670

1444

@alternate_dbus_interfaces({"org.example.Interface":

1671

1445

"net.example.AlternateInterface"})

1672

1446

class SampleDBusObject(dbus.service.Object):

1673

1447

@dbus.service.method("org.example.Interface")

1674

1448

def SampleDBusMethod():

1675

1449

pass

1676

1450

1677

1451

The above "SampleDBusMethod" on "SampleDBusObject" will be

1678

1452

reachable via two interfaces: "org.example.Interface" and

1679

1453

"net.example.AlternateInterface", the latter of which will have

1680

1454

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1681

1455

"true", unless "deprecate" is passed with a False value.

1682

1456

1683

1457

This works for methods and signals, and also for D-Bus properties

1684

1458

(from DBusObjectWithProperties) and interfaces (from the

1685

1459

dbus_interface_annotations decorator).

1686

1460

"""

1687

1461

1688

1462

def wrapper(cls):

1689

1463

for orig_interface_name, alt_interface_name in (

1690

1464

alt_interface_names.items()):

1705

1479

interface_names.add(alt_interface)

1706

1480

# Is this a D-Bus signal?

1707

1481

if getattr(attribute, "_dbus_is_signal", False):

1708

# Extract the original non-method undecorated

1709

# function by black magic

1710

1482

if sys.version_info.major == 2:

1483

# Extract the original non-method undecorated

1484

# function by black magic

1711

1485

nonmethod_func = (dict(

1712

1486

zip(attribute.func_code.co_freevars,

1713

1487

attribute.__closure__))

1714

1488

["func"].cell_contents)

1715

1489

else:

1716

nonmethod_func = (dict(

1717

zip(attribute.__code__.co_freevars,

1718

attribute.__closure__))

1719

["func"].cell_contents)

1490

nonmethod_func = attribute

1720

1491

# Create a new, but exactly alike, function

1721

1492

# object, and decorate it to be a new D-Bus signal

1722

1493

# with the alternate D-Bus interface name

1723

new_function = copy_function(nonmethod_func)

1494

if sys.version_info.major == 2:

1495

new_function = types.FunctionType(

1496

nonmethod_func.func_code,

1497

nonmethod_func.func_globals,

1498

nonmethod_func.func_name,

1499

nonmethod_func.func_defaults,

1500

nonmethod_func.func_closure)

1501

else:

1502

new_function = types.FunctionType(

1503

nonmethod_func.__code__,

1504

nonmethod_func.__globals__,

1505

nonmethod_func.__name__,

1506

nonmethod_func.__defaults__,

1507

nonmethod_func.__closure__)

1724

1508

new_function = (dbus.service.signal(

1725

1509

alt_interface,

1726

1510

attribute._dbus_signature)(new_function))

1730

1514

attribute._dbus_annotations)

1731

1515

except AttributeError:

1732

1516

pass

1733

1734

1517

# Define a creator of a function to call both the

1735

1518

# original and alternate functions, so both the

1736

1519

# original and alternate signals gets sent when

1739

1522

"""This function is a scope container to pass

1740

1523

func1 and func2 to the "call_both" function

1741

1524

outside of its arguments"""

1742

1525

1743

1526

@functools.wraps(func2)

1744

1527

def call_both(*args, **kwargs):

1745

1528

"""This function will emit two D-Bus

1746

1529

signals by calling func1 and func2"""

1747

1530

func1(*args, **kwargs)

1748

1531

func2(*args, **kwargs)

1749

# Make wrapper function look like a D-Bus

1750

# signal

1532

# Make wrapper function look like a D-Bus signal

1751

1533

for name, attr in inspect.getmembers(func2):

1752

1534

if name.startswith("_dbus_"):

1753

1535

setattr(call_both, name, attr)

1754

1536

1755

1537

return call_both

1756

1538

# Create the "call_both" function and add it to

1757

1539

# the class

1767

1549

alt_interface,

1768

1550

attribute._dbus_in_signature,

1769

1551

attribute._dbus_out_signature)

1770

(copy_function(attribute)))

1552

(types.FunctionType(attribute.func_code,

1553

attribute.func_globals,

1554

attribute.func_name,

1555

attribute.func_defaults,

1556

attribute.func_closure)))

1771

1557

# Copy annotations, if any

1772

1558

try:

1773

1559

attr[attrname]._dbus_annotations = dict(

1785

1571

attribute._dbus_access,

1786

1572

attribute._dbus_get_args_options

1787

1573

["byte_arrays"])

1788

(copy_function(attribute)))

1574

(types.FunctionType(

1575

attribute.func_code,

1576

attribute.func_globals,

1577

attribute.func_name,

1578

attribute.func_defaults,

1579

attribute.func_closure)))

1789

1580

# Copy annotations, if any

1790

1581

try:

1791

1582

attr[attrname]._dbus_annotations = dict(

1800

1591

# to the class.

1801

1592

attr[attrname] = (

1802

1593

dbus_interface_annotations(alt_interface)

1803

(copy_function(attribute)))

1594

(types.FunctionType(attribute.func_code,

1595

attribute.func_globals,

1596

attribute.func_name,

1597

attribute.func_defaults,

1598

attribute.func_closure)))

1804

1599

if deprecate:

1805

1600

# Deprecate all alternate interfaces

1806

iname = "_AlternateDBusNames_interface_annotation{}"

1601

iname="_AlternateDBusNames_interface_annotation{}"

1807

1602

for interface_name in interface_names:

1808

1603

1809

1604

@dbus_interface_annotations(interface_name)

1810

1605

def func(self):

1811

return {"org.freedesktop.DBus.Deprecated":

1812

"true"}

1606

return { "org.freedesktop.DBus.Deprecated":

1607

"true" }

1813

1608

# Find an unused name

1814

1609

for aname in (iname.format(i)

1815

1610

for i in itertools.count()):

1819

1614

if interface_names:

1820

1615

# Replace the class with a new subclass of it with

1821

1616

# methods, signals, etc. as created above.

1822

if sys.version_info.major == 2:

1823

cls = type(b"{}Alternate".format(cls.__name__),

1824

(cls, ), attr)

1825

else:

1826

cls = type("{}Alternate".format(cls.__name__),

1827

(cls, ), attr)

1617

cls = type(b"{}Alternate".format(cls.__name__),

1618

(cls, ), attr)

1828

1619

return cls

1829

1620

1830

1621

return wrapper

1831

1622

1832

1623

1834

1625

"se.bsnet.fukt.Mandos"})

1835

1626

class ClientDBus(Client, DBusObjectWithProperties):

1836

1627

"""A Client class using D-Bus

1837

1628

1838

1629

Attributes:

1839

1630

dbus_object_path: dbus.ObjectPath

1840

1631

bus: dbus.SystemBus()

1841

1632

"""

1842

1633

1843

1634

runtime_expansions = (Client.runtime_expansions

1844

1635

+ ("dbus_object_path", ))

1845

1636

1846

1637

_interface = "se.recompile.Mandos.Client"

1847

1638

1848

1639

# dbus.service.Object doesn't use super(), so we can't either.

1849

1850

def __init__(self, bus=None, *args, **kwargs):

1640

1641

def __init__(self, bus = None, *args, **kwargs):

1851

1642

self.bus = bus

1852

1643

Client.__init__(self, *args, **kwargs)

1853

1644

# Only now, when this client is initialized, can it show up on

1859

1650

"/clients/" + client_object_name)

1860

1651

DBusObjectWithProperties.__init__(self, self.bus,

1861

1652

self.dbus_object_path)

1862

1653

1863

1654

def notifychangeproperty(transform_func, dbus_name,

1864

1655

type_func=lambda x: x,

1865

1656

variant_level=1,

1867

1658

_interface=_interface):

1868

1659

""" Modify a variable so that it's a property which announces

1869

1660

its changes to DBus.

1870

1661

1871

1662

transform_fun: Function that takes a value and a variant_level

1872

1663

and transforms it to a D-Bus type.

1873

1664

dbus_name: D-Bus name of the variable

1876

1667

variant_level: D-Bus variant level. Default: 1

1877

1668

"""

1878

1669

attrname = "_{}".format(dbus_name)

1879

1670

1880

1671

def setter(self, value):

1881

1672

if hasattr(self, "dbus_object_path"):

1882

1673

if (not hasattr(self, attrname) or

1889

1680

else:

1890

1681

dbus_value = transform_func(

1891

1682

type_func(value),

1892

variant_level=variant_level)

1683

variant_level = variant_level)

1893

1684

self.PropertyChanged(dbus.String(dbus_name),

1894

1685

dbus_value)

1895

1686

self.PropertiesChanged(

1896

1687

_interface,

1897

dbus.Dictionary({dbus.String(dbus_name):

1898

dbus_value}),

1688

dbus.Dictionary({ dbus.String(dbus_name):

1689

dbus_value }),

1899

1690

dbus.Array())

1900

1691

setattr(self, attrname, value)

1901

1692

1902

1693

return property(lambda self: getattr(self, attrname), setter)

1903

1694

1904

1695

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1905

1696

approvals_pending = notifychangeproperty(dbus.Boolean,

1906

1697

"ApprovalPending",

1907

type_func=bool)

1698

type_func = bool)

1908

1699

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1909

1700

last_enabled = notifychangeproperty(datetime_to_dbus,

1910

1701

"LastEnabled")

1911

1702

checker = notifychangeproperty(

1912

1703

dbus.Boolean, "CheckerRunning",

1913

type_func=lambda checker: checker is not None)

1704

type_func = lambda checker: checker is not None)

1914

1705

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1915

1706

"LastCheckedOK")

1916

1707

last_checker_status = notifychangeproperty(dbus.Int16,

1921

1712

"ApprovedByDefault")

1922

1713

approval_delay = notifychangeproperty(

1923

1714

dbus.UInt64, "ApprovalDelay",

1924

type_func=lambda td: td.total_seconds() * 1000)

1715

type_func = lambda td: td.total_seconds() * 1000)

1925

1716

approval_duration = notifychangeproperty(

1926

1717

dbus.UInt64, "ApprovalDuration",

1927

type_func=lambda td: td.total_seconds() * 1000)

1718

type_func = lambda td: td.total_seconds() * 1000)

1928

1719

host = notifychangeproperty(dbus.String, "Host")

1929

1720

timeout = notifychangeproperty(

1930

1721

dbus.UInt64, "Timeout",

1931

type_func=lambda td: td.total_seconds() * 1000)

1722

type_func = lambda td: td.total_seconds() * 1000)

1932

1723

extended_timeout = notifychangeproperty(

1933

1724

dbus.UInt64, "ExtendedTimeout",

1934

type_func=lambda td: td.total_seconds() * 1000)

1725

type_func = lambda td: td.total_seconds() * 1000)

1935

1726

interval = notifychangeproperty(

1936

1727

dbus.UInt64, "Interval",

1937

type_func=lambda td: td.total_seconds() * 1000)

1728

type_func = lambda td: td.total_seconds() * 1000)

1938

1729

checker_command = notifychangeproperty(dbus.String, "Checker")

1939

1730

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1940

1731

invalidate_only=True)

1941

1732

1942

1733

del notifychangeproperty

1943

1734

1944

1735

def __del__(self, *args, **kwargs):

1945

1736

try:

1946

1737

self.remove_from_connection()

1949

1740

if hasattr(DBusObjectWithProperties, "__del__"):

1950

1741

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1951

1742

Client.__del__(self, *args, **kwargs)

1952

1743

1953

1744

def checker_callback(self, source, condition,

1954

1745

connection, command, *args, **kwargs):

1955

1746

ret = Client.checker_callback(self, source, condition,

1971

1762

| self.last_checker_signal),

1972

1763

dbus.String(command))

1973

1764

return ret

1974

1765

1975

1766

def start_checker(self, *args, **kwargs):

1976

1767

old_checker_pid = getattr(self.checker, "pid", None)

1977

1768

r = Client.start_checker(self, *args, **kwargs)

1981

1772

# Emit D-Bus signal

1982

1773

self.CheckerStarted(self.current_checker_command)

1983

1774

return r

1984

1775

1985

1776

def _reset_approved(self):

1986

1777

self.approved = None

1987

1778

return False

1988

1779

1989

1780

def approve(self, value=True):

1990

1781

self.approved = value

1991

GLib.timeout_add(int(self.approval_duration.total_seconds()

1992

* 1000), self._reset_approved)

1782

gobject.timeout_add(int(self.approval_duration.total_seconds()

1783

* 1000), self._reset_approved)

1993

1784

self.send_changedstate()

1994

1995

# D-Bus methods, signals & properties

1996

1997

# Interfaces

1998

1999

# Signals

2000

1785

1786

## D-Bus methods, signals & properties

1787

1788

## Interfaces

1789

1790

## Signals

1791

2001

1792

# CheckerCompleted - signal

2002

1793

@dbus.service.signal(_interface, signature="nxs")

2003

1794

def CheckerCompleted(self, exitcode, waitstatus, command):

2004

1795

"D-Bus signal"

2005

1796

pass

2006

1797

2007

1798

# CheckerStarted - signal

2008

1799

@dbus.service.signal(_interface, signature="s")

2009

1800

def CheckerStarted(self, command):

2010

1801

"D-Bus signal"

2011

1802

pass

2012

1803

2013

1804

# PropertyChanged - signal

2014

1805

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1806

@dbus.service.signal(_interface, signature="sv")

2016

1807

def PropertyChanged(self, property, value):

2017

1808

"D-Bus signal"

2018

1809

pass

2019

1810

2020

1811

# GotSecret - signal

2021

1812

@dbus.service.signal(_interface)

2022

1813

def GotSecret(self):

2025

1816

server to mandos-client

2026

1817

"""

2027

1818

pass

2028

1819

2029

1820

# Rejected - signal

2030

1821

@dbus.service.signal(_interface, signature="s")

2031

1822

def Rejected(self, reason):

2032

1823

"D-Bus signal"

2033

1824

pass

2034

1825

2035

1826

# NeedApproval - signal

2036

1827

@dbus.service.signal(_interface, signature="tb")

2037

1828

def NeedApproval(self, timeout, default):

2038

1829

"D-Bus signal"

2039

1830

return self.need_approval()

2040

2041

# Methods

2042

1831

1832

## Methods

1833

2043

1834

# Approve - method

2044

1835

@dbus.service.method(_interface, in_signature="b")

2045

1836

def Approve(self, value):

2046

1837

self.approve(value)

2047

1838

2048

1839

# CheckedOK - method

2049

1840

@dbus.service.method(_interface)

2050

1841

def CheckedOK(self):

2051

1842

self.checked_ok()

2052

1843

2053

1844

# Enable - method

2054

1845

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2055

1846

@dbus.service.method(_interface)

2056

1847

def Enable(self):

2057

1848

"D-Bus method"

2058

1849

self.enable()

2059

1850

2060

1851

# StartChecker - method

2061

1852

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2062

1853

@dbus.service.method(_interface)

2063

1854

def StartChecker(self):

2064

1855

"D-Bus method"

2065

1856

self.start_checker()

2066

1857

2067

1858

# Disable - method

2068

1859

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2069

1860

@dbus.service.method(_interface)

2070

1861

def Disable(self):

2071

1862

"D-Bus method"

2072

1863

self.disable()

2073

1864

2074

1865

# StopChecker - method

2075

1866

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2076

1867

@dbus.service.method(_interface)

2077

1868

def StopChecker(self):

2078

1869

self.stop_checker()

2079

2080

# Properties

2081

1870

1871

## Properties

1872

2082

1873

# ApprovalPending - property

2083

1874

@dbus_service_property(_interface, signature="b", access="read")

2084

1875

def ApprovalPending_dbus_property(self):

2085

1876

return dbus.Boolean(bool(self.approvals_pending))

2086

1877

2087

1878

# ApprovedByDefault - property

2088

1879

@dbus_service_property(_interface,

2089

1880

signature="b",

2092

1883

if value is None: # get

2093

1884

return dbus.Boolean(self.approved_by_default)

2094

1885

self.approved_by_default = bool(value)

2095

1886

2096

1887

# ApprovalDelay - property

2097

1888

@dbus_service_property(_interface,

2098

1889

signature="t",

2102

1893

return dbus.UInt64(self.approval_delay.total_seconds()

2103

1894

* 1000)

2104

1895

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2105

1896

2106

1897

# ApprovalDuration - property

2107

1898

@dbus_service_property(_interface,

2108

1899

signature="t",

2112

1903

return dbus.UInt64(self.approval_duration.total_seconds()

2113

1904

* 1000)

2114

1905

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2115

1906

2116

1907

# Name - property

2117

1908

@dbus_annotations(

2118

1909

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2119

1910

@dbus_service_property(_interface, signature="s", access="read")

2120

1911

def Name_dbus_property(self):

2121

1912

return dbus.String(self.name)

2122

2123

# KeyID - property

2124

@dbus_annotations(

2125

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2126

@dbus_service_property(_interface, signature="s", access="read")

2127

def KeyID_dbus_property(self):

2128

return dbus.String(self.key_id)

2129

1913

2130

1914

# Fingerprint - property

2131

1915

@dbus_annotations(

2132

1916

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2133

1917

@dbus_service_property(_interface, signature="s", access="read")

2134

1918

def Fingerprint_dbus_property(self):

2135

1919

return dbus.String(self.fingerprint)

2136

1920

2137

1921

# Host - property

2138

1922

@dbus_service_property(_interface,

2139

1923

signature="s",

2142

1926

if value is None: # get

2143

1927

return dbus.String(self.host)

2144

1928

self.host = str(value)

2145

1929

2146

1930

# Created - property

2147

1931

@dbus_annotations(

2148

1932

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2149

1933

@dbus_service_property(_interface, signature="s", access="read")

2150

1934

def Created_dbus_property(self):

2151

1935

return datetime_to_dbus(self.created)

2152

1936

2153

1937

# LastEnabled - property

2154

1938

@dbus_service_property(_interface, signature="s", access="read")

2155

1939

def LastEnabled_dbus_property(self):

2156

1940

return datetime_to_dbus(self.last_enabled)

2157

1941

2158

1942

# Enabled - property

2159

1943

@dbus_service_property(_interface,

2160

1944

signature="b",

2166

1950

self.enable()

2167

1951

else:

2168

1952

self.disable()

2169

1953

2170

1954

# LastCheckedOK - property

2171

1955

@dbus_service_property(_interface,

2172

1956

signature="s",

2176

1960

self.checked_ok()

2177

1961

return

2178

1962

return datetime_to_dbus(self.last_checked_ok)

2179

1963

2180

1964

# LastCheckerStatus - property

2181

1965

@dbus_service_property(_interface, signature="n", access="read")

2182

1966

def LastCheckerStatus_dbus_property(self):

2183

1967

return dbus.Int16(self.last_checker_status)

2184

1968

2185

1969

# Expires - property

2186

1970

@dbus_service_property(_interface, signature="s", access="read")

2187

1971

def Expires_dbus_property(self):

2188

1972

return datetime_to_dbus(self.expires)

2189

1973

2190

1974

# LastApprovalRequest - property

2191

1975

@dbus_service_property(_interface, signature="s", access="read")

2192

1976

def LastApprovalRequest_dbus_property(self):

2193

1977

return datetime_to_dbus(self.last_approval_request)

2194

1978

2195

1979

# Timeout - property

2196

1980

@dbus_service_property(_interface,

2197

1981

signature="t",

2212

1996

if (getattr(self, "disable_initiator_tag", None)

2213

1997

is None):

2214

1998

return

2215

GLib.source_remove(self.disable_initiator_tag)

2216

self.disable_initiator_tag = GLib.timeout_add(

1999

gobject.source_remove(self.disable_initiator_tag)

2000

self.disable_initiator_tag = gobject.timeout_add(

2217

2001

int((self.expires - now).total_seconds() * 1000),

2218

2002

self.disable)

2219

2003

2220

2004

# ExtendedTimeout - property

2221

2005

@dbus_service_property(_interface,

2222

2006

signature="t",

2226

2010

return dbus.UInt64(self.extended_timeout.total_seconds()

2227

2011

* 1000)

2228

2012

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2229

2013

2230

2014

# Interval - property

2231

2015

@dbus_service_property(_interface,

2232

2016

signature="t",

2239

2023

return

2240

2024

if self.enabled:

2241

2025

# Reschedule checker run

2242

GLib.source_remove(self.checker_initiator_tag)

2243

self.checker_initiator_tag = GLib.timeout_add(

2026

gobject.source_remove(self.checker_initiator_tag)

2027

self.checker_initiator_tag = gobject.timeout_add(

2244

2028

value, self.start_checker)

2245

self.start_checker() # Start one now, too

2246

2029

self.start_checker() # Start one now, too

2030

2247

2031

# Checker - property

2248

2032

@dbus_service_property(_interface,

2249

2033

signature="s",

2252

2036

if value is None: # get

2253

2037

return dbus.String(self.checker_command)

2254

2038

self.checker_command = str(value)

2255

2039

2256

2040

# CheckerRunning - property

2257

2041

@dbus_service_property(_interface,

2258

2042

signature="b",

2264

2048

self.start_checker()

2265

2049

else:

2266

2050

self.stop_checker()

2267

2051

2268

2052

# ObjectPath - property

2269

2053

@dbus_annotations(

2270

2054

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2271

2055

"org.freedesktop.DBus.Deprecated": "true"})

2272

2056

@dbus_service_property(_interface, signature="o", access="read")

2273

2057

def ObjectPath_dbus_property(self):

2274

return self.dbus_object_path # is already a dbus.ObjectPath

2275

2058

return self.dbus_object_path # is already a dbus.ObjectPath

2059

2276

2060

# Secret = property

2277

2061

@dbus_annotations(

2278

2062

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2283

2067

byte_arrays=True)

2284

2068

def Secret_dbus_property(self, value):

2285

2069

self.secret = bytes(value)

2286

2070

2287

2071

del _interface

2288

2072

2289

2073

2290

class ProxyClient:

2291

def __init__(self, child_pipe, key_id, fpr, address):

2074

class ProxyClient(object):

2075

def __init__(self, child_pipe, fpr, address):

2292

2076

self._pipe = child_pipe

2293

self._pipe.send(("init", key_id, fpr, address))

2077

self._pipe.send(('init', fpr, address))

2294

2078

if not self._pipe.recv():

2295

raise KeyError(key_id or fpr)

2296

2079

raise KeyError(fpr)

2080

2297

2081

def __getattribute__(self, name):

2298

if name == "_pipe":

2082

if name == '_pipe':

2299

2083

return super(ProxyClient, self).__getattribute__(name)

2300

self._pipe.send(("getattr", name))

2084

self._pipe.send(('getattr', name))

2301

2085

data = self._pipe.recv()

2302

if data[0] == "data":

2086

if data[0] == 'data':

2303

2087

return data[1]

2304

if data[0] == "function":

2305

2088

if data[0] == 'function':

2089

2306

2090

def func(*args, **kwargs):

2307

self._pipe.send(("funcall", name, args, kwargs))

2091

self._pipe.send(('funcall', name, args, kwargs))

2308

2092

return self._pipe.recv()[1]

2309

2093

2310

2094

return func

2311

2095

2312

2096

def __setattr__(self, name, value):

2313

if name == "_pipe":

2097

if name == '_pipe':

2314

2098

return super(ProxyClient, self).__setattr__(name, value)

2315

self._pipe.send(("setattr", name, value))

2099

self._pipe.send(('setattr', name, value))

2316

2100

2317

2101

2318

2102

class ClientHandler(socketserver.BaseRequestHandler, object):

2319

2103

"""A class to handle client connections.

2320

2104

2321

2105

Instantiated once for each connection to handle it.

2322

2106

Note: This will run in its own forked process."""

2323

2107

2324

2108

def handle(self):

2325

2109

with contextlib.closing(self.server.child_pipe) as child_pipe:

2326

log.info("TCP connection from: %s",

2327

str(self.client_address))

2328

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2329

2110

logger.info("TCP connection from: %s",

2111

str(self.client_address))

2112

logger.debug("Pipe FD: %d",

2113

self.server.child_pipe.fileno())

2114

2330

2115

session = gnutls.ClientSession(self.request)

2331

2332

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2333

# "+AES-256-CBC", "+SHA1",

2334

# "+COMP-NULL", "+CTYPE-OPENPGP",

2335

# "+DHE-DSS"))

2116

2117

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2118

# "+AES-256-CBC", "+SHA1",

2119

# "+COMP-NULL", "+CTYPE-OPENPGP",

2120

# "+DHE-DSS"))

2336

2121

# Use a fallback default, since this MUST be set.

2337

2122

priority = self.server.gnutls_priority

2338

2123

if priority is None:

2339

2124

priority = "NORMAL"

2340

gnutls.priority_set_direct(session,

2341

priority.encode("utf-8"), None)

2342

2125

gnutls.priority_set_direct(session._c_object, priority,

2126

None)

2127

2343

2128

# Start communication using the Mandos protocol

2344

2129

# Get protocol number

2345

2130

line = self.request.makefile().readline()

2346

log.debug("Protocol version: %r", line)

2131

logger.debug("Protocol version: %r", line)

2347

2132

try:

2348

2133

if int(line.strip().split()[0]) > 1:

2349

2134

raise RuntimeError(line)

2350

2135

except (ValueError, IndexError, RuntimeError) as error:

2351

log.error("Unknown protocol version: %s", error)

2136

logger.error("Unknown protocol version: %s", error)

2352

2137

return

2353

2138

2354

2139

# Start GnuTLS connection

2355

2140

try:

2356

2141

session.handshake()

2357

2142

except gnutls.Error as error:

2358

log.warning("Handshake failed: %s", error)

2143

logger.warning("Handshake failed: %s", error)

2359

2144

# Do not run session.bye() here: the session is not

2360

2145

# established. Just abandon the request.

2361

2146

return

2362

log.debug("Handshake succeeded")

2363

2147

logger.debug("Handshake succeeded")

2148

2364

2149

approval_required = False

2365

2150

try:

2366

if gnutls.has_rawpk:

2367

fpr = b""

2368

try:

2369

key_id = self.key_id(

2370

self.peer_certificate(session))

2371

except (TypeError, gnutls.Error) as error:

2372

log.warning("Bad certificate: %s", error)

2373

return

2374

log.debug("Key ID: %s",

2375

key_id.decode("utf-8",

2376

errors="replace"))

2377

2378

else:

2379

key_id = b""

2380

try:

2381

fpr = self.fingerprint(

2382

self.peer_certificate(session))

2383

except (TypeError, gnutls.Error) as error:

2384

log.warning("Bad certificate: %s", error)

2385

return

2386

log.debug("Fingerprint: %s", fpr)

2387

2388

try:

2389

client = ProxyClient(child_pipe, key_id, fpr,

2151

try:

2152

fpr = self.fingerprint(

2153

self.peer_certificate(session))

2154

except (TypeError, gnutls.Error) as error:

2155

logger.warning("Bad certificate: %s", error)

2156

return

2157

logger.debug("Fingerprint: %s", fpr)

2158

2159

try:

2160

client = ProxyClient(child_pipe, fpr,

2390

2161

self.client_address)

2391

2162

except KeyError:

2392

2163

return

2393

2164

2394

2165

if client.approval_delay:

2395

2166

delay = client.approval_delay

2396

2167

client.approvals_pending += 1

2397

2168

approval_required = True

2398

2169

2399

2170

while True:

2400

2171

if not client.enabled:

2401

log.info("Client %s is disabled", client.name)

2172

logger.info("Client %s is disabled",

2173

client.name)

2402

2174

if self.server.use_dbus:

2403

2175

# Emit D-Bus signal

2404

2176

client.Rejected("Disabled")

2405

2177

return

2406

2178

2407

2179

if client.approved or not client.approval_delay:

2408

# We are approved or approval is disabled

2180

#We are approved or approval is disabled

2409

2181

break

2410

2182

elif client.approved is None:

2411

log.info("Client %s needs approval",

2412

client.name)

2183

logger.info("Client %s needs approval",

2184

client.name)

2413

2185

if self.server.use_dbus:

2414

2186

# Emit D-Bus signal

2415

2187

client.NeedApproval(

2416

2188

client.approval_delay.total_seconds()

2417

2189

* 1000, client.approved_by_default)

2418

2190

else:

2419

log.warning("Client %s was not approved",

2420

client.name)

2191

logger.warning("Client %s was not approved",

2192

client.name)

2421

2193

if self.server.use_dbus:

2422

2194

# Emit D-Bus signal

2423

2195

client.Rejected("Denied")

2424

2196

return

2425

2426

# wait until timeout or approved

2197

2198

#wait until timeout or approved

2427

2199

time = datetime.datetime.now()

2428

2200

client.changedstate.acquire()

2429

2201

client.changedstate.wait(delay.total_seconds())

2431

2203

time2 = datetime.datetime.now()

2432

2204

if (time2 - time) >= delay:

2433

2205

if not client.approved_by_default:

2434

log.warning("Client %s timed out while"

2435

" waiting for approval",

2436

client.name)

2206

logger.warning("Client %s timed out while"

2207

" waiting for approval",

2208

client.name)

2437

2209

if self.server.use_dbus:

2438

2210

# Emit D-Bus signal

2439

2211

client.Rejected("Approval timed out")

2442

2214

break

2443

2215

else:

2444

2216

delay -= time2 - time

2445

2446

try:

2447

session.send(client.secret)

2448

except gnutls.Error as error:

2449

log.warning("gnutls send failed", exc_info=error)

2450

return

2451

2452

log.info("Sending secret to %s", client.name)

2217

2218

sent_size = 0

2219

while sent_size < len(client.secret):

2220

try:

2221

sent = session.send(client.secret[sent_size:])

2222

except gnutls.Error as error:

2223

logger.warning("gnutls send failed",

2224

exc_info=error)

2225

return

2226

logger.debug("Sent: %d, remaining: %d", sent,

2227

len(client.secret) - (sent_size

2228

+ sent))

2229

sent_size += sent

2230

2231

logger.info("Sending secret to %s", client.name)

2453

2232

# bump the timeout using extended_timeout

2454

2233

client.bump_timeout(client.extended_timeout)

2455

2234

if self.server.use_dbus:

2456

2235

# Emit D-Bus signal

2457

2236

client.GotSecret()

2458

2237

2459

2238

finally:

2460

2239

if approval_required:

2461

2240

client.approvals_pending -= 1

2462

2241

try:

2463

2242

session.bye()

2464

2243

except gnutls.Error as error:

2465

log.warning("GnuTLS bye failed", exc_info=error)

2466

2244

logger.warning("GnuTLS bye failed",

2245

exc_info=error)

2246

2467

2247

@staticmethod

2468

2248

def peer_certificate(session):

2469

"Return the peer's certificate as a bytestring"

2470

try:

2471

cert_type = gnutls.certificate_type_get2(

2472

session, gnutls.CTYPE_PEERS)

2473

except AttributeError:

2474

cert_type = gnutls.certificate_type_get(session)

2475

if gnutls.has_rawpk:

2476

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2477

else:

2478

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2479

# If not a valid certificate type...

2480

if cert_type not in valid_cert_types:

2481

log.info("Cert type %r not in %r", cert_type,

2482

valid_cert_types)

2249

"Return the peer's OpenPGP certificate as a bytestring"

2250

# If not an OpenPGP certificate...

2251

if (gnutls.certificate_type_get(session._c_object)

2252

!= gnutls.CRT_OPENPGP):

2483

2253

# ...return invalid data

2484

2254

return b""

2485

2255

list_size = ctypes.c_uint(1)

2486

2256

cert_list = (gnutls.certificate_get_peers

2487

(session, ctypes.byref(list_size)))

2257

(session._c_object, ctypes.byref(list_size)))

2488

2258

if not bool(cert_list) and list_size.value != 0:

2489

2259

raise gnutls.Error("error getting peer certificate")

2490

2260

if list_size.value == 0:

2491

2261

return None

2492

2262

cert = cert_list[0]

2493

2263

return ctypes.string_at(cert.data, cert.size)

2494

2495

@staticmethod

2496

def key_id(certificate):

2497

"Convert a certificate bytestring to a hexdigit key ID"

2498

# New GnuTLS "datum" with the public key

2499

datum = gnutls.datum_t(

2500

ctypes.cast(ctypes.c_char_p(certificate),

2501

ctypes.POINTER(ctypes.c_ubyte)),

2502

ctypes.c_uint(len(certificate)))

2503

# XXX all these need to be created in the gnutls "module"

2504

# New empty GnuTLS certificate

2505

pubkey = gnutls.pubkey_t()

2506

gnutls.pubkey_init(ctypes.byref(pubkey))

2507

# Import the raw public key into the certificate

2508

gnutls.pubkey_import(pubkey,

2509

ctypes.byref(datum),

2510

gnutls.X509_FMT_DER)

2511

# New buffer for the key ID

2512

buf = ctypes.create_string_buffer(32)

2513

buf_len = ctypes.c_size_t(len(buf))

2514

# Get the key ID from the raw public key into the buffer

2515

gnutls.pubkey_get_key_id(

2516

pubkey,

2517

gnutls.KEYID_USE_SHA256,

2518

ctypes.cast(ctypes.byref(buf),

2519

ctypes.POINTER(ctypes.c_ubyte)),

2520

ctypes.byref(buf_len))

2521

# Deinit the certificate

2522

gnutls.pubkey_deinit(pubkey)

2523

2524

# Convert the buffer to a Python bytestring

2525

key_id = ctypes.string_at(buf, buf_len.value)

2526

# Convert the bytestring to hexadecimal notation

2527

hex_key_id = binascii.hexlify(key_id).upper()

2528

return hex_key_id

2529

2264

2530

2265

@staticmethod

2531

2266

def fingerprint(openpgp):

2532

2267

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2547

2282

ctypes.byref(crtverify))

2548

2283

if crtverify.value != 0:

2549

2284

gnutls.openpgp_crt_deinit(crt)

2550

raise gnutls.CertificateSecurityError(code

2551

=crtverify.value)

2285

raise gnutls.CertificateSecurityError("Verify failed")

2552

2286

# New buffer for the fingerprint

2553

2287

buf = ctypes.create_string_buffer(20)

2554

2288

buf_len = ctypes.c_size_t()

2564

2298

return hex_fpr

2565

2299

2566

2300

2567

class MultiprocessingMixIn:

2301

class MultiprocessingMixIn(object):

2568

2302

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2569

2303

2570

2304

def sub_process_main(self, request, address):

2571

2305

try:

2572

2306

self.finish_request(request, address)

2573

2307

except Exception:

2574

2308

self.handle_error(request, address)

2575

2309

self.close_request(request)

2576

2310

2577

2311

def process_request(self, request, address):

2578

2312

"""Start a new process to process the request."""

2579

proc = multiprocessing.Process(target=self.sub_process_main,

2580

args=(request, address))

2313

proc = multiprocessing.Process(target = self.sub_process_main,

2314

args = (request, address))

2581

2315

proc.start()

2582

2316

return proc

2583

2317

2584

2318

2585

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2586

2320

""" adds a pipe to the MixIn """

2587

2321

2588

2322

def process_request(self, request, client_address):

2589

2323

"""Overrides and wraps the original process_request().

2590

2324

2591

2325

This function creates a new pipe in self.pipe

2592

2326

"""

2593

2327

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2594

2328

2595

2329

proc = MultiprocessingMixIn.process_request(self, request,

2596

2330

client_address)

2597

2331

self.child_pipe.close()

2598

2332

self.add_pipe(parent_pipe, proc)

2599

2333

2600

2334

def add_pipe(self, parent_pipe, proc):

2601

2335

"""Dummy function; override as necessary"""

2602

2336

raise NotImplementedError()

2603

2337

2604

2338

2605

2339

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2606

socketserver.TCPServer):

2607

"""IPv6-capable TCP server. Accepts None as address and/or port

2608

2340

socketserver.TCPServer, object):

2341

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2342

2609

2343

Attributes:

2610

2344

enabled: Boolean; whether this server is activated yet

2611

2345

interface: None or a network interface name (string)

2612

2346

use_ipv6: Boolean; to use IPv6 or not

2613

2347

"""

2614

2348

2615

2349

def __init__(self, server_address, RequestHandlerClass,

2616

2350

interface=None,

2617

2351

use_ipv6=True,

2627

2361

self.socketfd = socketfd

2628

2362

# Save the original socket.socket() function

2629

2363

self.socket_socket = socket.socket

2630

2631

2364

# To implement --socket, we monkey patch socket.socket.

2632

#

2365

#

2633

2366

# (When socketserver.TCPServer is a new-style class, we

2634

2367

# could make self.socket into a property instead of monkey

2635

2368

# patching socket.socket.)

2636

#

2369

#

2637

2370

# Create a one-time-only replacement for socket.socket()

2638

2371

@functools.wraps(socket.socket)

2639

2372

def socket_wrapper(*args, **kwargs):

2651

2384

# socket_wrapper(), if socketfd was set.

2652

2385

socketserver.TCPServer.__init__(self, server_address,

2653

2386

RequestHandlerClass)

2654

2387

2655

2388

def server_bind(self):

2656

2389

"""This overrides the normal server_bind() function

2657

2390

to bind to an interface if one was specified, and also NOT to

2658

2391

bind to an address or port if they were not specified."""

2659

global SO_BINDTODEVICE

2660

2392

if self.interface is not None:

2661

2393

if SO_BINDTODEVICE is None:

2662

# Fall back to a hard-coded value which seems to be

2663

# common enough.

2664

log.warning("SO_BINDTODEVICE not found, trying 25")

2665

SO_BINDTODEVICE = 25

2666

try:

2667

self.socket.setsockopt(

2668

socket.SOL_SOCKET, SO_BINDTODEVICE,

2669

(self.interface + "\0").encode("utf-8"))

2670

except socket.error as error:

2671

if error.errno == errno.EPERM:

2672

log.error("No permission to bind to interface %s",

2673

self.interface)

2674

elif error.errno == errno.ENOPROTOOPT:

2675

log.error("SO_BINDTODEVICE not available; cannot"

2676

" bind to interface %s", self.interface)

2677

elif error.errno == errno.ENODEV:

2678

log.error("Interface %s does not exist, cannot"

2679

" bind", self.interface)

2680

else:

2681

raise

2394

logger.error("SO_BINDTODEVICE does not exist;"

2395

" cannot bind to interface %s",

2396

self.interface)

2397

else:

2398

try:

2399

self.socket.setsockopt(

2400

socket.SOL_SOCKET, SO_BINDTODEVICE,

2401

(self.interface + "\0").encode("utf-8"))

2402

except socket.error as error:

2403

if error.errno == errno.EPERM:

2404

logger.error("No permission to bind to"

2405

" interface %s", self.interface)

2406

elif error.errno == errno.ENOPROTOOPT:

2407

logger.error("SO_BINDTODEVICE not available;"

2408

" cannot bind to interface %s",

2409

self.interface)

2410

elif error.errno == errno.ENODEV:

2411

logger.error("Interface %s does not exist,"

2412

" cannot bind", self.interface)

2413

else:

2414

raise

2682

2415

# Only bind(2) the socket if we really need to.

2683

2416

if self.server_address[0] or self.server_address[1]:

2684

if self.server_address[1]:

2685

self.allow_reuse_address = True

2686

2417

if not self.server_address[0]:

2687

2418

if self.address_family == socket.AF_INET6:

2688

any_address = "::" # in6addr_any

2419

any_address = "::" # in6addr_any

2689

2420

else:

2690

any_address = "0.0.0.0" # INADDR_ANY

2421

any_address = "0.0.0.0" # INADDR_ANY

2691

2422

self.server_address = (any_address,

2692

2423

self.server_address[1])

2693

2424

elif not self.server_address[1]:

2703

2434

2704

2435

class MandosServer(IPv6_TCPServer):

2705

2436

"""Mandos server.

2706

2437

2707

2438

Attributes:

2708

2439

clients: set of Client objects

2709

2440

gnutls_priority GnuTLS priority string

2710

2441

use_dbus: Boolean; to emit D-Bus signals or not

2711

2712

Assumes a GLib.MainLoop event loop.

2442

2443

Assumes a gobject.MainLoop event loop.

2713

2444

"""

2714

2445

2715

2446

def __init__(self, server_address, RequestHandlerClass,

2716

2447

interface=None,

2717

2448

use_ipv6=True,

2727

2458

self.gnutls_priority = gnutls_priority

2728

2459

IPv6_TCPServer.__init__(self, server_address,

2729

2460

RequestHandlerClass,

2730

interface=interface,

2731

use_ipv6=use_ipv6,

2732

socketfd=socketfd)

2733

2461

interface = interface,

2462

use_ipv6 = use_ipv6,

2463

socketfd = socketfd)

2464

2734

2465

def server_activate(self):

2735

2466

if self.enabled:

2736

2467

return socketserver.TCPServer.server_activate(self)

2737

2468

2738

2469

def enable(self):

2739

2470

self.enabled = True

2740

2471

2741

2472

def add_pipe(self, parent_pipe, proc):

2742

2473

# Call "handle_ipc" for both data and EOF events

2743

GLib.io_add_watch(

2744

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2745

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2474

gobject.io_add_watch(

2475

parent_pipe.fileno(),

2476

gobject.IO_IN | gobject.IO_HUP,

2746

2477

functools.partial(self.handle_ipc,

2747

parent_pipe=parent_pipe,

2748

proc=proc))

2749

2478

parent_pipe = parent_pipe,

2479

proc = proc))

2480

2750

2481

def handle_ipc(self, source, condition,

2751

2482

parent_pipe=None,

2752

proc=None,

2483

proc = None,

2753

2484

client_object=None):

2754

2485

# error, or the other end of multiprocessing.Pipe has closed

2755

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2486

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2756

2487

# Wait for other process to exit

2757

2488

proc.join()

2758

2489

return False

2759

2490

2760

2491

# Read a request from the child

2761

2492

request = parent_pipe.recv()

2762

2493

command = request[0]

2763

2764

if command == "init":

2765

key_id = request[1].decode("ascii")

2766

fpr = request[2].decode("ascii")

2767

address = request[3]

2768

2769

for c in self.clients.values():

2770

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2771

"27AE41E4649B934CA495991B7852B855"):

2772

continue

2773

if key_id and c.key_id == key_id:

2774

client = c

2775

break

2776

if fpr and c.fingerprint == fpr:

2494

2495

if command == 'init':

2496

fpr = request[1]

2497

address = request[2]

2498

2499

for c in self.clients.itervalues():

2500

if c.fingerprint == fpr:

2777

2501

client = c

2778

2502

break

2779

2503

else:

2780

log.info("Client not found for key ID: %s, address:"

2781

" %s", key_id or fpr, address)

2504

logger.info("Client not found for fingerprint: %s, ad"

2505

"dress: %s", fpr, address)

2782

2506

if self.use_dbus:

2783

2507

# Emit D-Bus signal

2784

mandos_dbus_service.ClientNotFound(key_id or fpr,

2508

mandos_dbus_service.ClientNotFound(fpr,

2785

2509

address[0])

2786

2510

parent_pipe.send(False)

2787

2511

return False

2788

2789

GLib.io_add_watch(

2790

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2791

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2512

2513

gobject.io_add_watch(

2514

parent_pipe.fileno(),

2515

gobject.IO_IN | gobject.IO_HUP,

2792

2516

functools.partial(self.handle_ipc,

2793

parent_pipe=parent_pipe,

2794

proc=proc,

2795

client_object=client))

2517

parent_pipe = parent_pipe,

2518

proc = proc,

2519

client_object = client))

2796

2520

parent_pipe.send(True)

2797

2521

# remove the old hook in favor of the new above hook on

2798

2522

# same fileno

2799

2523

return False

2800

if command == "funcall":

2524

if command == 'funcall':

2801

2525

funcname = request[1]

2802

2526

args = request[2]

2803

2527

kwargs = request[3]

2804

2805

parent_pipe.send(("data", getattr(client_object,

2528

2529

parent_pipe.send(('data', getattr(client_object,

2806

2530

funcname)(*args,

2807

2531

**kwargs)))

2808

2809

if command == "getattr":

2532

2533

if command == 'getattr':

2810

2534

attrname = request[1]

2811

2535

if isinstance(client_object.__getattribute__(attrname),

2812

collections.abc.Callable):

2813

parent_pipe.send(("function", ))

2536

collections.Callable):

2537

parent_pipe.send(('function', ))

2814

2538

else:

2815

2539

parent_pipe.send((

2816

"data", client_object.__getattribute__(attrname)))

2817

2818

if command == "setattr":

2540

'data', client_object.__getattribute__(attrname)))

2541

2542

if command == 'setattr':

2819

2543

attrname = request[1]

2820

2544

value = request[2]

2821

2545

setattr(client_object, attrname, value)

2822

2546

2823

2547

return True

2824

2548

2825

2549

2826

2550

def rfc3339_duration_to_delta(duration):

2827

2551

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2828

2829

>>> timedelta = datetime.timedelta

2830

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2831

True

2832

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2833

True

2834

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2835

True

2836

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2837

True

2838

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2839

True

2840

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2841

True

2842

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2843

True

2844

>>> del timedelta

2552

2553

>>> rfc3339_duration_to_delta("P7D")

2554

datetime.timedelta(7)

2555

>>> rfc3339_duration_to_delta("PT60S")

2556

datetime.timedelta(0, 60)

2557

>>> rfc3339_duration_to_delta("PT60M")

2558

datetime.timedelta(0, 3600)

2559

>>> rfc3339_duration_to_delta("PT24H")

2560

datetime.timedelta(1)

2561

>>> rfc3339_duration_to_delta("P1W")

2562

datetime.timedelta(7)

2563

>>> rfc3339_duration_to_delta("PT5M30S")

2564

datetime.timedelta(0, 330)

2565

>>> rfc3339_duration_to_delta("P1DT3M20S")

2566

datetime.timedelta(1, 200)

2845

2567

"""

2846

2568

2847

2569

# Parsing an RFC 3339 duration with regular expressions is not

2848

2570

# possible - there would have to be multiple places for the same

2849

2571

# values, like seconds. The current code, while more esoteric, is

2850

2572

# cleaner without depending on a parsing library. If Python had a

2851

2573

# built-in library for parsing we would use it, but we'd like to

2852

2574

# avoid excessive use of external libraries.

2853

2575

2854

2576

# New type for defining tokens, syntax, and semantics all-in-one

2855

2577

Token = collections.namedtuple("Token", (

2856

2578

"regexp", # To match token; if "value" is not None, must have

2889

2611

frozenset((token_year, token_month,

2890

2612

token_day, token_time,

2891

2613

token_week)))

2892

# Define starting values:

2893

# Value so far

2894

value = datetime.timedelta()

2614

# Define starting values

2615

value = datetime.timedelta() # Value so far

2895

2616

found_token = None

2896

# Following valid tokens

2897

followers = frozenset((token_duration, ))

2898

# String left to parse

2899

s = duration

2617

followers = frozenset((token_duration, )) # Following valid tokens

2618

s = duration # String left to parse

2900

2619

# Loop until end token is found

2901

2620

while found_token is not token_end:

2902

2621

# Search for any currently valid tokens

2926

2645

2927

2646

def string_to_delta(interval):

2928

2647

"""Parse a string and return a datetime.timedelta

2929

2930

>>> string_to_delta("7d") == datetime.timedelta(7)

2931

True

2932

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2933

True

2934

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2935

True

2936

>>> string_to_delta("24h") == datetime.timedelta(1)

2937

True

2938

>>> string_to_delta("1w") == datetime.timedelta(7)

2939

True

2940

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2941

True

2648

2649

>>> string_to_delta('7d')

2650

datetime.timedelta(7)

2651

>>> string_to_delta('60s')

2652

datetime.timedelta(0, 60)

2653

>>> string_to_delta('60m')

2654

datetime.timedelta(0, 3600)

2655

>>> string_to_delta('24h')

2656

datetime.timedelta(1)

2657

>>> string_to_delta('1w')

2658

datetime.timedelta(7)

2659

>>> string_to_delta('5m 30s')

2660

datetime.timedelta(0, 330)

2942

2661

"""

2943

2662

2944

2663

try:

2945

2664

return rfc3339_duration_to_delta(interval)

2946

2665

except ValueError:

2947

2666

pass

2948

2667

2949

2668

timevalue = datetime.timedelta(0)

2950

2669

for s in interval.split():

2951

2670

try:

2969

2688

return timevalue

2970

2689

2971

2690

2972

def daemon(nochdir=False, noclose=False):

2691

def daemon(nochdir = False, noclose = False):

2973

2692

"""See daemon(3). Standard BSD Unix function.

2974

2693

2975

2694

This should really exist as os.daemon, but it doesn't (yet)."""

2976

2695

if os.fork():

2977

2696

sys.exit()

2995

2714

2996

2715

2997

2716

def main():

2998

2717

2999

2718

##################################################################

3000

2719

# Parsing of options, both command line and config file

3001

2720

3002

2721

parser = argparse.ArgumentParser()

3003

2722

parser.add_argument("-v", "--version", action="version",

3004

version="%(prog)s {}".format(version),

2723

version = "%(prog)s {}".format(version),

3005

2724

help="show version number and exit")

3006

2725

parser.add_argument("-i", "--interface", metavar="IF",

3007

2726

help="Bind to interface IF")

3043

2762

parser.add_argument("--no-zeroconf", action="store_false",

3044

2763

dest="zeroconf", help="Do not use Zeroconf",

3045

2764

default=None)

3046

2765

3047

2766

options = parser.parse_args()

3048

2767

2768

if options.check:

2769

import doctest

2770

fail_count, test_count = doctest.testmod()

2771

sys.exit(os.EX_OK if fail_count == 0 else 1)

2772

3049

2773

# Default values for config file for server-global settings

3050

if gnutls.has_rawpk:

3051

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3052

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3053

else:

3054

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3055

":+SIGN-DSA-SHA256")

3056

server_defaults = {"interface": "",

3057

"address": "",

3058

"port": "",

3059

"debug": "False",

3060

"priority": priority,

3061

"servicename": "Mandos",

3062

"use_dbus": "True",

3063

"use_ipv6": "True",

3064

"debuglevel": "",

3065

"restore": "True",

3066

"socket": "",

3067

"statedir": "/var/lib/mandos",

3068

"foreground": "False",

3069

"zeroconf": "True",

3070

}

3071

del priority

3072

2774

server_defaults = { "interface": "",

2775

"address": "",

2776

"port": "",

2777

"debug": "False",

2778

"priority":

2779

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2780

":+SIGN-DSA-SHA256",

2781

"servicename": "Mandos",

2782

"use_dbus": "True",

2783

"use_ipv6": "True",

2784

"debuglevel": "",

2785

"restore": "True",

2786

"socket": "",

2787

"statedir": "/var/lib/mandos",

2788

"foreground": "False",

2789

"zeroconf": "True",

2790

}

2791

3073

2792

# Parse config file for server-global settings

3074

server_config = configparser.ConfigParser(server_defaults)

2793

server_config = configparser.SafeConfigParser(server_defaults)

3075

2794

del server_defaults

3076

2795

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3077

# Convert the ConfigParser object to a dict

2796

# Convert the SafeConfigParser object to a dict

3078

2797

server_settings = server_config.defaults()

3079

2798

# Use the appropriate methods on the non-string config options

3080

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3081

"foreground", "zeroconf"):

2799

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3082

2800

server_settings[option] = server_config.getboolean("DEFAULT",

3083

2801

option)

3084

2802

if server_settings["port"]:

3094

2812

server_settings["socket"] = os.dup(server_settings

3095

2813

["socket"])

3096

2814

del server_config

3097

2815

3098

2816

# Override the settings from the config file with command line

3099

2817

# options, if set.

3100

2818

for option in ("interface", "address", "port", "debug",

3118

2836

if server_settings["debug"]:

3119

2837

server_settings["foreground"] = True

3120

2838

# Now we have our good server settings in "server_settings"

3121

2839

3122

2840

##################################################################

3123

2841

3124

2842

if (not server_settings["zeroconf"]

3125

2843

and not (server_settings["port"]

3126

2844

or server_settings["socket"] != "")):

3127

2845

parser.error("Needs port or socket to work without Zeroconf")

3128

2846

3129

2847

# For convenience

3130

2848

debug = server_settings["debug"]

3131

2849

debuglevel = server_settings["debuglevel"]

3135

2853

stored_state_file)

3136

2854

foreground = server_settings["foreground"]

3137

2855

zeroconf = server_settings["zeroconf"]

3138

2856

3139

2857

if debug:

3140

2858

initlogger(debug, logging.DEBUG)

3141

2859

else:

3144

2862

else:

3145

2863

level = getattr(logging, debuglevel.upper())

3146

2864

initlogger(debug, level)

3147

2865

3148

2866

if server_settings["servicename"] != "Mandos":

3149

2867

syslogger.setFormatter(

3150

logging.Formatter("Mandos ({}) [%(process)d]:"

3151

" %(levelname)s: %(message)s".format(

2868

logging.Formatter('Mandos ({}) [%(process)d]:'

2869

' %(levelname)s: %(message)s'.format(

3152

2870

server_settings["servicename"])))

3153

2871

3154

2872

# Parse config file with clients

3155

client_config = configparser.ConfigParser(Client.client_defaults)

2873

client_config = configparser.SafeConfigParser(Client

2874

.client_defaults)

3156

2875

client_config.read(os.path.join(server_settings["configdir"],

3157

2876

"clients.conf"))

3158

2877

3159

2878

global mandos_dbus_service

3160

2879

mandos_dbus_service = None

3161

2880

3162

2881

socketfd = None

3163

2882

if server_settings["socket"] != "":

3164

2883

socketfd = server_settings["socket"]

3178

2897

try:

3179

2898

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3180

2899

except IOError as e:

3181

log.error("Could not open file %r", pidfilename,

3182

exc_info=e)

3183

3184

for name, group in (("_mandos", "_mandos"),

3185

("mandos", "mandos"),

3186

("nobody", "nogroup")):

2900

logger.error("Could not open file %r", pidfilename,

2901

exc_info=e)

2902

2903

for name in ("_mandos", "mandos", "nobody"):

3187

2904

try:

3188

2905

uid = pwd.getpwnam(name).pw_uid

3189

gid = pwd.getpwnam(group).pw_gid

2906

gid = pwd.getpwnam(name).pw_gid

3190

2907

break

3191

2908

except KeyError:

3192

2909

continue

3196

2913

try:

3197

2914

os.setgid(gid)

3198

2915

os.setuid(uid)

3199

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3200

2916

except OSError as error:

3201

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3202

os.strerror(error.errno))

3203

2917

if error.errno != errno.EPERM:

3204

2918

raise

3205

2919

3206

2920

if debug:

3207

2921

# Enable all possible GnuTLS debugging

3208

2922

3209

2923

# "Use a log level over 10 to enable all debugging options."

3210

2924

# - GnuTLS manual

3211

2925

gnutls.global_set_log_level(11)

3212

2926

3213

2927

@gnutls.log_func

3214

2928

def debug_gnutls(level, string):

3215

log.debug("GnuTLS: %s",

3216

string[:-1].decode("utf-8", errors="replace"))

3217

2929

logger.debug("GnuTLS: %s", string[:-1])

2930

3218

2931

gnutls.global_set_log_function(debug_gnutls)

3219

2932

3220

2933

# Redirect stdin so all checkers get /dev/null

3221

2934

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3222

2935

os.dup2(null, sys.stdin.fileno())

3223

2936

if null > 2:

3224

2937

os.close(null)

3225

2938

3226

2939

# Need to fork before connecting to D-Bus

3227

2940

if not foreground:

3228

2941

# Close all input and output, do double fork, etc.

3229

2942

daemon()

3230

3231

if gi.version_info < (3, 10, 2):

3232

# multiprocessing will use threads, so before we use GLib we

3233

# need to inform GLib that threads will be used.

3234

GLib.threads_init()

3235

2943

2944

# multiprocessing will use threads, so before we use gobject we

2945

# need to inform gobject that threads will be used.

2946

gobject.threads_init()

2947

3236

2948

global main_loop

3237

2949

# From the Avahi example code

3238

2950

DBusGMainLoop(set_as_default=True)

3239

main_loop = GLib.MainLoop()

2951

main_loop = gobject.MainLoop()

3240

2952

bus = dbus.SystemBus()

3241

2953

# End of Avahi example code

3242

2954

if use_dbus:

3248

2960

"se.bsnet.fukt.Mandos", bus,

3249

2961

do_not_queue=True)

3250

2962

except dbus.exceptions.DBusException as e:

3251

log.error("Disabling D-Bus:", exc_info=e)

2963

logger.error("Disabling D-Bus:", exc_info=e)

3252

2964

use_dbus = False

3253

2965

server_settings["use_dbus"] = False

3254

2966

tcp_server.use_dbus = False

3255

2967

if zeroconf:

3256

2968

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3257

2969

service = AvahiServiceToSyslog(

3258

name=server_settings["servicename"],

3259

servicetype="_mandos._tcp",

3260

protocol=protocol,

3261

bus=bus)

2970

name = server_settings["servicename"],

2971

servicetype = "_mandos._tcp",

2972

protocol = protocol,

2973

bus = bus)

3262

2974

if server_settings["interface"]:

3263

2975

service.interface = if_nametoindex(

3264

2976

server_settings["interface"].encode("utf-8"))

3265

2977

3266

2978

global multiprocessing_manager

3267

2979

multiprocessing_manager = multiprocessing.Manager()

3268

2980

3269

2981

client_class = Client

3270

2982

if use_dbus:

3271

client_class = functools.partial(ClientDBus, bus=bus)

3272

2983

client_class = functools.partial(ClientDBus, bus = bus)

2984

3273

2985

client_settings = Client.config_parser(client_config)

3274

2986

old_client_settings = {}

3275

2987

clients_data = {}

3276

2988

3277

2989

# This is used to redirect stdout and stderr for checker processes

3278

2990

global wnull

3279

wnull = open(os.devnull, "w") # A writable /dev/null

2991

wnull = open(os.devnull, "w") # A writable /dev/null

3280

2992

# Only used if server is running in foreground but not in debug

3281

2993

# mode

3282

2994

if debug or not foreground:

3283

2995

wnull.close()

3284

2996

3285

2997

# Get client data and settings from last running state.

3286

2998

if server_settings["restore"]:

3287

2999

try:

3288

3000

with open(stored_state_path, "rb") as stored_state:

3289

if sys.version_info.major == 2:

3290

clients_data, old_client_settings = pickle.load(

3291

stored_state)

3292

else:

3293

bytes_clients_data, bytes_old_client_settings = (

3294

pickle.load(stored_state, encoding="bytes"))

3295

# Fix bytes to strings

3296

# clients_data

3297

# .keys()

3298

clients_data = {(key.decode("utf-8")

3299

if isinstance(key, bytes)

3300

else key): value

3301

for key, value in

3302

bytes_clients_data.items()}

3303

del bytes_clients_data

3304

for key in clients_data:

3305

value = {(k.decode("utf-8")

3306

if isinstance(k, bytes) else k): v

3307

for k, v in

3308

clients_data[key].items()}

3309

clients_data[key] = value

3310

# .client_structure

3311

value["client_structure"] = [

3312

(s.decode("utf-8")

3313

if isinstance(s, bytes)

3314

else s) for s in

3315

value["client_structure"]]

3316

# .name, .host, and .checker_command

3317

for k in ("name", "host", "checker_command"):

3318

if isinstance(value[k], bytes):

3319

value[k] = value[k].decode("utf-8")

3320

if "key_id" not in value:

3321

value["key_id"] = ""

3322

elif "fingerprint" not in value:

3323

value["fingerprint"] = ""

3324

# old_client_settings

3325

# .keys()

3326

old_client_settings = {

3327

(key.decode("utf-8")

3328

if isinstance(key, bytes)

3329

else key): value

3330

for key, value in

3331

bytes_old_client_settings.items()}

3332

del bytes_old_client_settings

3333

# .host and .checker_command

3334

for value in old_client_settings.values():

3335

for attribute in ("host", "checker_command"):

3336

if isinstance(value[attribute], bytes):

3337

value[attribute] = (value[attribute]

3338

.decode("utf-8"))

3001

clients_data, old_client_settings = pickle.load(

3002

stored_state)

3339

3003

os.remove(stored_state_path)

3340

3004

except IOError as e:

3341

3005

if e.errno == errno.ENOENT:

3342

log.warning("Could not load persistent state:"

3343

" %s", os.strerror(e.errno))

3006

logger.warning("Could not load persistent state:"

3007

" {}".format(os.strerror(e.errno)))

3344

3008

else:

3345

log.critical("Could not load persistent state:",

3346

exc_info=e)

3009

logger.critical("Could not load persistent state:",

3010

exc_info=e)

3347

3011

raise

3348

3012

except EOFError as e:

3349

log.warning("Could not load persistent state: EOFError:",

3350

exc_info=e)

3351

3013

logger.warning("Could not load persistent state: "

3014

"EOFError:",

3015

exc_info=e)

3016

3352

3017

with PGPEngine() as pgp:

3353

3018

for client_name, client in clients_data.items():

3354

3019

# Skip removed clients

3355

3020

if client_name not in client_settings:

3356

3021

continue

3357

3022

3358

3023

# Decide which value to use after restoring saved state.

3359

3024

# We have three different values: Old config file,

3360

3025

# new config file, and saved state.

3371

3036

client[name] = value

3372

3037

except KeyError:

3373

3038

pass

3374

3039

3375

3040

# Clients who has passed its expire date can still be

3376

3041

# enabled if its last checker was successful. A Client

3377

3042

# whose checker succeeded before we stored its state is

3380

3045

if client["enabled"]:

3381

3046

if datetime.datetime.utcnow() >= client["expires"]:

3382

3047

if not client["last_checked_ok"]:

3383

log.warning("disabling client %s - Client"

3384

" never performed a successful"

3385

" checker", client_name)

3048

logger.warning(

3049

"disabling client {} - Client never "

3050

"performed a successful checker".format(

3051

client_name))

3386

3052

client["enabled"] = False

3387

3053

elif client["last_checker_status"] != 0:

3388

log.warning("disabling client %s - Client"

3389

" last checker failed with error"

3390

" code %s", client_name,

3391

client["last_checker_status"])

3054

logger.warning(

3055

"disabling client {} - Client last"

3056

" checker failed with error code"

3057

" {}".format(

3058

client_name,

3059

client["last_checker_status"]))

3392

3060

client["enabled"] = False

3393

3061

else:

3394

3062

client["expires"] = (

3395

3063

datetime.datetime.utcnow()

3396

3064

+ client["timeout"])

3397

log.debug("Last checker succeeded, keeping %s"

3398

" enabled", client_name)

3065

logger.debug("Last checker succeeded,"

3066

" keeping {} enabled".format(

3067

client_name))

3399

3068

try:

3400

3069

client["secret"] = pgp.decrypt(

3401

3070

client["encrypted_secret"],

3402

3071

client_settings[client_name]["secret"])

3403

3072

except PGPError:

3404

3073

# If decryption fails, we use secret from new settings

3405

log.debug("Failed to decrypt %s old secret",

3406

client_name)

3074

logger.debug("Failed to decrypt {} old secret".format(

3075

client_name))

3407

3076

client["secret"] = (client_settings[client_name]

3408

3077

["secret"])

3409

3078

3410

3079

# Add/remove clients based on new changes made to config

3411

3080

for client_name in (set(old_client_settings)

3412

3081

- set(client_settings)):

3414

3083

for client_name in (set(client_settings)

3415

3084

- set(old_client_settings)):

3416

3085

clients_data[client_name] = client_settings[client_name]

3417

3086

3418

3087

# Create all client objects

3419

3088

for client_name, client in clients_data.items():

3420

3089

tcp_server.clients[client_name] = client_class(

3421

name=client_name,

3422

settings=client,

3423

server_settings=server_settings)

3424

3090

name = client_name,

3091

settings = client,

3092

server_settings = server_settings)

3093

3425

3094

if not tcp_server.clients:

3426

log.warning("No clients defined")

3427

3095

logger.warning("No clients defined")

3096

3428

3097

if not foreground:

3429

3098

if pidfile is not None:

3430

3099

pid = os.getpid()

3432

3101

with pidfile:

3433

3102

print(pid, file=pidfile)

3434

3103

except IOError:

3435

log.error("Could not write to file %r with PID %d",

3436

pidfilename, pid)

3104

logger.error("Could not write to file %r with PID %d",

3105

pidfilename, pid)

3437

3106

del pidfile

3438

3107

del pidfilename

3439

3440

for termsig in (signal.SIGHUP, signal.SIGTERM):

3441

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3442

lambda: main_loop.quit() and False)

3443

3108

3109

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

3110

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3111

3444

3112

if use_dbus:

3445

3113

3446

3114

@alternate_dbus_interfaces(

3447

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3115

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3448

3116

class MandosDBusService(DBusObjectWithObjectManager):

3449

3117

"""A D-Bus proxy object"""

3450

3118

3451

3119

def __init__(self):

3452

3120

dbus.service.Object.__init__(self, bus, "/")

3453

3121

3454

3122

_interface = "se.recompile.Mandos"

3455

3123

3456

3124

@dbus.service.signal(_interface, signature="o")

3457

3125

def ClientAdded(self, objpath):

3458

3126

"D-Bus signal"

3459

3127

pass

3460

3128

3461

3129

@dbus.service.signal(_interface, signature="ss")

3462

def ClientNotFound(self, key_id, address):

3130

def ClientNotFound(self, fingerprint, address):

3463

3131

"D-Bus signal"

3464

3132

pass

3465

3133

3466

3134

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3467

3135

"true"})

3468

3136

@dbus.service.signal(_interface, signature="os")

3469

3137

def ClientRemoved(self, objpath, name):

3470

3138

"D-Bus signal"

3471

3139

pass

3472

3140

3473

3141

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3474

3142

"true"})

3475

3143

@dbus.service.method(_interface, out_signature="ao")

3476

3144

def GetAllClients(self):

3477

3145

"D-Bus method"

3478

3146

return dbus.Array(c.dbus_object_path for c in

3479

tcp_server.clients.values())

3480

3147

tcp_server.clients.itervalues())

3148

3481

3149

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3482

3150

"true"})

3483

3151

@dbus.service.method(_interface,

3485

3153

def GetAllClientsWithProperties(self):

3486

3154

"D-Bus method"

3487

3155

return dbus.Dictionary(

3488

{c.dbus_object_path: c.GetAll(

3156

{ c.dbus_object_path: c.GetAll(

3489

3157

"se.recompile.Mandos.Client")

3490

for c in tcp_server.clients.values()},

3158

for c in tcp_server.clients.itervalues() },

3491

3159

signature="oa{sv}")

3492

3160

3493

3161

@dbus.service.method(_interface, in_signature="o")

3494

3162

def RemoveClient(self, object_path):

3495

3163

"D-Bus method"

3496

for c in tcp_server.clients.values():

3164

for c in tcp_server.clients.itervalues():

3497

3165

if c.dbus_object_path == object_path:

3498

3166

del tcp_server.clients[c.name]

3499

3167

c.remove_from_connection()

3503

3171

self.client_removed_signal(c)

3504

3172

return

3505

3173

raise KeyError(object_path)

3506

3174

3507

3175

del _interface

3508

3176

3509

3177

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3510

out_signature="a{oa{sa{sv}}}")

3178

out_signature = "a{oa{sa{sv}}}")

3511

3179

def GetManagedObjects(self):

3512

3180

"""D-Bus method"""

3513

3181

return dbus.Dictionary(

3514

{client.dbus_object_path:

3515

dbus.Dictionary(

3516

{interface: client.GetAll(interface)

3517

for interface in

3518

client._get_all_interface_names()})

3519

for client in tcp_server.clients.values()})

3520

3182

{ client.dbus_object_path:

3183

dbus.Dictionary(

3184

{ interface: client.GetAll(interface)

3185

for interface in

3186

client._get_all_interface_names()})

3187

for client in tcp_server.clients.values()})

3188

3521

3189

def client_added_signal(self, client):

3522

3190

"""Send the new standard signal and the old signal"""

3523

3191

if use_dbus:

3525

3193

self.InterfacesAdded(

3526

3194

client.dbus_object_path,

3527

3195

dbus.Dictionary(

3528

{interface: client.GetAll(interface)

3529

for interface in

3530

client._get_all_interface_names()}))

3196

{ interface: client.GetAll(interface)

3197

for interface in

3198

client._get_all_interface_names()}))

3531

3199

# Old signal

3532

3200

self.ClientAdded(client.dbus_object_path)

3533

3201

3534

3202

def client_removed_signal(self, client):

3535

3203

"""Send the new standard signal and the old signal"""

3536

3204

if use_dbus:

3541

3209

# Old signal

3542

3210

self.ClientRemoved(client.dbus_object_path,

3543

3211

client.name)

3544

3212

3545

3213

mandos_dbus_service = MandosDBusService()

3546

3547

# Save modules to variables to exempt the modules from being

3548

# unloaded before the function registered with atexit() is run.

3549

mp = multiprocessing

3550

wn = wnull

3551

3214

3552

3215

def cleanup():

3553

3216

"Cleanup function; run on exit"

3554

3217

if zeroconf:

3555

3218

service.cleanup()

3556

3557

mp.active_children()

3558

wn.close()

3219

3220

multiprocessing.active_children()

3221

wnull.close()

3559

3222

if not (tcp_server.clients or client_settings):

3560

3223

return

3561

3224

3562

3225

# Store client before exiting. Secrets are encrypted with key

3563

3226

# based on what config file has. If config file is

3564

3227

# removed/edited, old secret will thus be unrecovable.

3565

3228

clients = {}

3566

3229

with PGPEngine() as pgp:

3567

for client in tcp_server.clients.values():

3230

for client in tcp_server.clients.itervalues():

3568

3231

key = client_settings[client.name]["secret"]

3569

3232

client.encrypted_secret = pgp.encrypt(client.secret,

3570

3233

key)

3571

3234

client_dict = {}

3572

3235

3573

3236

# A list of attributes that can not be pickled

3574

3237

# + secret.

3575

exclude = {"bus", "changedstate", "secret",

3576

"checker", "server_settings"}

3238

exclude = { "bus", "changedstate", "secret",

3239

"checker", "server_settings" }

3577

3240

for name, typ in inspect.getmembers(dbus.service

3578

3241

.Object):

3579

3242

exclude.add(name)

3580

3243

3581

3244

client_dict["encrypted_secret"] = (client

3582

3245

.encrypted_secret)

3583

3246

for attr in client.client_structure:

3584

3247

if attr not in exclude:

3585

3248

client_dict[attr] = getattr(client, attr)

3586

3249

3587

3250

clients[client.name] = client_dict

3588

3251

del client_settings[client.name]["secret"]

3589

3252

3590

3253

try:

3591

3254

with tempfile.NamedTemporaryFile(

3592

mode="wb",

3255

mode='wb',

3593

3256

suffix=".pickle",

3594

prefix="clients-",

3257

prefix='clients-',

3595

3258

dir=os.path.dirname(stored_state_path),

3596

3259

delete=False) as stored_state:

3597

pickle.dump((clients, client_settings), stored_state,

3598

protocol=2)

3260

pickle.dump((clients, client_settings), stored_state)

3599

3261

tempname = stored_state.name

3600

3262

os.rename(tempname, stored_state_path)

3601

3263

except (IOError, OSError) as e:

3605

3267

except NameError:

3606

3268

pass

3607

3269

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3608

log.warning("Could not save persistent state: %s",

3609

os.strerror(e.errno))

3270

logger.warning("Could not save persistent state: {}"

3271

.format(os.strerror(e.errno)))

3610

3272

else:

3611

log.warning("Could not save persistent state:",

3612

exc_info=e)

3273

logger.warning("Could not save persistent state:",

3274

exc_info=e)

3613

3275

raise

3614

3276

3615

3277

# Delete all clients, and settings from config

3616

3278

while tcp_server.clients:

3617

3279

name, client = tcp_server.clients.popitem()

3623

3285

if use_dbus:

3624

3286

mandos_dbus_service.client_removed_signal(client)

3625

3287

client_settings.clear()

3626

3288

3627

3289

atexit.register(cleanup)

3628

3629

for client in tcp_server.clients.values():

3290

3291

for client in tcp_server.clients.itervalues():

3630

3292

if use_dbus:

3631

3293

# Emit D-Bus signal for adding

3632

3294

mandos_dbus_service.client_added_signal(client)

3633

3295

# Need to initiate checking of clients

3634

3296

if client.enabled:

3635

client.init_checker(randomize_start=True)

3636

3297

client.init_checker()

3298

3637

3299

tcp_server.enable()

3638

3300

tcp_server.server_activate()

3639

3301

3640

3302

# Find out what port we got

3641

3303

if zeroconf:

3642

3304

service.port = tcp_server.socket.getsockname()[1]

3643

3305

if use_ipv6:

3644

log.info("Now listening on address %r, port %d, flowinfo %d,"

3645

" scope_id %d", *tcp_server.socket.getsockname())

3306

logger.info("Now listening on address %r, port %d,"

3307

" flowinfo %d, scope_id %d",

3308

*tcp_server.socket.getsockname())

3646

3309

else: # IPv4

3647

log.info("Now listening on address %r, port %d",

3648

*tcp_server.socket.getsockname())

3649

3650

# service.interface = tcp_server.socket.getsockname()[3]

3651

3310

logger.info("Now listening on address %r, port %d",

3311

*tcp_server.socket.getsockname())

3312

3313

#service.interface = tcp_server.socket.getsockname()[3]

3314

3652

3315

try:

3653

3316

if zeroconf:

3654

3317

# From the Avahi example code

3655

3318

try:

3656

3319

service.activate()

3657

3320

except dbus.exceptions.DBusException as error:

3658

log.critical("D-Bus Exception", exc_info=error)

3321

logger.critical("D-Bus Exception", exc_info=error)

3659

3322

cleanup()

3660

3323

sys.exit(1)

3661

3324

# End of Avahi example code

3662

3663

GLib.io_add_watch(

3664

GLib.IOChannel.unix_new(tcp_server.fileno()),

3665

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3666

lambda *args, **kwargs: (tcp_server.handle_request

3667

(*args[2:], **kwargs) or True))

3668

3669

log.debug("Starting main loop")

3325

3326

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3327

lambda *args, **kwargs:

3328

(tcp_server.handle_request

3329

(*args[2:], **kwargs) or True))

3330

3331

logger.debug("Starting main loop")

3670

3332

main_loop.run()

3671

3333

except AvahiError as error:

3672

log.critical("Avahi Error", exc_info=error)

3334

logger.critical("Avahi Error", exc_info=error)

3673

3335

cleanup()

3674

3336

sys.exit(1)

3675

3337

except KeyboardInterrupt:

3676

3338

if debug:

3677

3339

print("", file=sys.stderr)

3678

log.debug("Server received KeyboardInterrupt")

3679

log.debug("Server exiting")

3340

logger.debug("Server received KeyboardInterrupt")

3341

logger.debug("Server exiting")

3680

3342

# Must run before the D-Bus bus name gets deregistered

3681

3343

cleanup()

3682

3344

3683

3684

def parse_test_args():

3685

# type: () -> argparse.Namespace

3686

parser = argparse.ArgumentParser(add_help=False)

3687

parser.add_argument("--check", action="store_true")

3688

parser.add_argument("--prefix", )

3689

args, unknown_args = parser.parse_known_args()

3690

if args.check:

3691

# Remove test options from sys.argv

3692

sys.argv[1:] = unknown_args

3693

return args

3694

3695

# Add all tests from doctest strings

3696

def load_tests(loader, tests, none):

3697

import doctest

3698

tests.addTests(doctest.DocTestSuite())

3699

return tests

3700

3701

if __name__ == "__main__":

3702

options = parse_test_args()

3703

try:

3704

if options.check:

3705

extra_test_prefix = options.prefix

3706

if extra_test_prefix is not None:

3707

if not (unittest.main(argv=[""], exit=False)

3708

.result.wasSuccessful()):

3709

sys.exit(1)

3710

class ExtraTestLoader(unittest.TestLoader):

3711

testMethodPrefix = extra_test_prefix

3712

# Call using ./scriptname --test [--verbose]

3713

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3714

else:

3715

unittest.main(argv=[""])

3716

else:

3717

main()

3718

finally:

3719

logging.shutdown()

3720

3721

# Local Variables:

3722

# run-tests:

3723

# (lambda (&optional extra)

3724

# (if (not (funcall run-tests-in-test-buffer default-directory

3725

# extra))

3726

# (funcall show-test-buffer-in-test-window)

3727

# (funcall remove-test-window)

3728

# (if extra (message "Extra tests run successfully!"))))

3729

# run-tests-in-test-buffer:

3730

# (lambda (dir &optional extra)

3731

# (with-current-buffer (get-buffer-create "*Test*")

3732

# (setq buffer-read-only nil

3733

# default-directory dir)

3734

# (erase-buffer)

3735

# (compilation-mode))

3736

# (let ((process-result

3737

# (let ((inhibit-read-only t))

3738

# (process-file-shell-command

3739

# (funcall get-command-line extra) nil "*Test*"))))

3740

# (and (numberp process-result)

3741

# (= process-result 0))))

3742

# get-command-line:

3743

# (lambda (&optional extra)

3744

# (let ((quoted-script

3745

# (shell-quote-argument (funcall get-script-name))))

3746

# (format

3747

# (concat "%s --check" (if extra " --prefix=atest" ""))

3748

# quoted-script)))

3749

# get-script-name:

3750

# (lambda ()

3751

# (if (fboundp 'file-local-name)

3752

# (file-local-name (buffer-file-name))

3753

# (or (file-remote-p (buffer-file-name) 'localname)

3754

# (buffer-file-name))))

3755

# remove-test-window:

3756

# (lambda ()

3757

# (let ((test-window (get-buffer-window "*Test*")))

3758

# (if test-window (delete-window test-window))))

3759

# show-test-buffer-in-test-window:

3760

# (lambda ()

3761

# (when (not (get-buffer-window-list "*Test*"))

3762

# (setq next-error-last-buffer (get-buffer "*Test*"))

3763

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3764

# (display-buffer-overriding-action

3765

# `((display-buffer-in-side-window) (side . ,side)

3766

# (window-height . fit-window-to-buffer)

3767

# (window-width . fit-window-to-buffer))))

3768

# (display-buffer "*Test*"))))

3769

# eval:

3770

# (progn

3771

# (let* ((run-extra-tests (lambda () (interactive)

3772

# (funcall run-tests t)))

3773

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3774

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3775

# (setq minor-mode-overriding-map-alist

3776

# (cons `(run-tests . ,outer-keymap)

3777

# minor-mode-overriding-map-alist)))

3778

# (add-hook 'after-save-hook run-tests 90 t))

3779

# End:

3345

3346

if __name__ == '__main__':

3347

main()