/mandos/release : revision 237.7.350

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

39

try:

44

40

import SocketServer as socketserver

77

73

import itertools

78

74

import collections

79

75

import codecs

80

import unittest

81

import random

82

import shlex

83

76

84

77

import dbus

85

78

import dbus.service

86

import gi

87

from gi.repository import GLib

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

83

import avahi

88

84

from dbus.mainloop.glib import DBusGMainLoop

89

85

import ctypes

90

86

import ctypes.util

91

87

import xml.dom.minidom

92

88

import inspect

93

89

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

90

try:

122

91

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

92

except AttributeError:

124

93

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

94

from IN import SO_BINDTODEVICE

128

95

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.14"

96

SO_BINDTODEVICE = None

97

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.1"

147

102

stored_state_file = "clients.pickle"

148

103

149

104

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

105

syslogger = None

152

106

153

107

try:

154

108

if_nametoindex = ctypes.cdll.LoadLibrary(

155

109

ctypes.util.find_library("c")).if_nametoindex

156

110

except (OSError, AttributeError):

157

111

158

112

def if_nametoindex(interface):

159

113

"Get an interface index the hard way, i.e. using fcntl()"

160

114

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

165

119

return interface_index

166

120

167

121

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

122

def initlogger(debug, level=logging.WARNING):

185

123

"""init logger and add loglevel"""

186

124

187

125

global syslogger

188

126

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

191

129

syslogger.setFormatter(logging.Formatter

192

130

('Mandos [%(process)d]: %(levelname)s:'

193

131

' %(message)s'))

194

132

logger.addHandler(syslogger)

195

133

196

134

if debug:

197

135

console = logging.StreamHandler()

198

136

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

208

146

pass

209

147

210

148

211

class PGPEngine:

149

class PGPEngine(object):

212

150

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

151

214

152

def __init__(self):

215

153

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

154

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

155

'--home', self.tempdir,

229

156

'--force-mdc',

230

'--quiet']

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

157

'--quiet',

158

'--no-use-agent']

159

235

160

def __enter__(self):

236

161

return self

237

162

238

163

def __exit__(self, exc_type, exc_value, traceback):

239

164

self._cleanup()

240

165

return False

241

166

242

167

def __del__(self):

243

168

self._cleanup()

244

169

245

170

def _cleanup(self):

246

171

if self.tempdir is not None:

247

172

# Delete contents of tempdir

248

173

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

174

topdown = False):

250

175

for filename in files:

251

176

os.remove(os.path.join(root, filename))

252

177

for dirname in dirs:

254

179

# Remove tempdir

255

180

os.rmdir(self.tempdir)

256

181

self.tempdir = None

257

182

258

183

def password_encode(self, password):

259

184

# Passphrase can not be empty and can not contain newlines or

260

185

# NUL bytes. So we prefix it and hex encode it.

265

190

.replace(b"\n", b"\\n")

266

191

.replace(b"\0", b"\\x00"))

267

192

return encoded

268

193

269

194

def encrypt(self, data, password):

270

195

passphrase = self.password_encode(password)

271

196

with tempfile.NamedTemporaryFile(

272

197

dir=self.tempdir) as passfile:

273

198

passfile.write(passphrase)

274

199

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

200

proc = subprocess.Popen(['gpg', '--symmetric',

276

201

'--passphrase-file',

277

202

passfile.name]

278

203

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

204

stdin = subprocess.PIPE,

205

stdout = subprocess.PIPE,

206

stderr = subprocess.PIPE)

207

ciphertext, err = proc.communicate(input = data)

283

208

if proc.returncode != 0:

284

209

raise PGPError(err)

285

210

return ciphertext

286

211

287

212

def decrypt(self, data, password):

288

213

passphrase = self.password_encode(password)

289

214

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

215

dir = self.tempdir) as passfile:

291

216

passfile.write(passphrase)

292

217

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

218

proc = subprocess.Popen(['gpg', '--decrypt',

294

219

'--passphrase-file',

295

220

passfile.name]

296

221

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

222

stdin = subprocess.PIPE,

223

stdout = subprocess.PIPE,

224

stderr = subprocess.PIPE)

225

decrypted_plaintext, err = proc.communicate(input = data)

301

226

if proc.returncode != 0:

302

227

raise PGPError(err)

303

228

return decrypted_plaintext

304

229

305

230

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

231

class AvahiError(Exception):

333

232

def __init__(self, value, *args, **kwargs):

334

233

self.value = value

344

243

pass

345

244

346

245

347

class AvahiService:

246

class AvahiService(object):

348

247

"""An Avahi (Zeroconf) service.

349

248

350

249

Attributes:

351

250

interface: integer; avahi.IF_UNSPEC or an interface index.

352

251

Used to optionally bind to the specified interface.

364

263

server: D-Bus Server

365

264

bus: dbus.SystemBus()

366

265

"""

367

266

368

267

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

268

interface = avahi.IF_UNSPEC,

269

name = None,

270

servicetype = None,

271

port = None,

272

TXT = None,

273

domain = "",

274

host = "",

275

max_renames = 32768,

276

protocol = avahi.PROTO_UNSPEC,

277

bus = None):

379

278

self.interface = interface

380

279

self.name = name

381

280

self.type = servicetype

390

289

self.server = None

391

290

self.bus = bus

392

291

self.entry_group_state_changed_match = None

393

292

394

293

def rename(self, remove=True):

395

294

"""Derived from the Avahi example code"""

396

295

if self.rename_count >= self.max_renames:

416

315

logger.critical("D-Bus Exception", exc_info=error)

417

316

self.cleanup()

418

317

os._exit(1)

419

318

420

319

def remove(self):

421

320

"""Derived from the Avahi example code"""

422

321

if self.entry_group_state_changed_match is not None:

424

323

self.entry_group_state_changed_match = None

425

324

if self.group is not None:

426

325

self.group.Reset()

427

326

428

327

def add(self):

429

328

"""Derived from the Avahi example code"""

430

329

self.remove()

447

346

dbus.UInt16(self.port),

448

347

avahi.string_array_to_txt_array(self.TXT))

449

348

self.group.Commit()

450

349

451

350

def entry_group_state_changed(self, state, error):

452

351

"""Derived from the Avahi example code"""

453

352

logger.debug("Avahi entry group state change: %i", state)

454

353

455

354

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

355

logger.debug("Zeroconf service established.")

457

356

elif state == avahi.ENTRY_GROUP_COLLISION:

461

360

logger.critical("Avahi: Error in group state changed %s",

462

361

str(error))

463

362

raise AvahiGroupError("State changed: {!s}".format(error))

464

363

465

364

def cleanup(self):

466

365

"""Derived from the Avahi example code"""

467

366

if self.group is not None:

472

371

pass

473

372

self.group = None

474

373

self.remove()

475

374

476

375

def server_state_changed(self, state, error=None):

477

376

"""Derived from the Avahi example code"""

478

377

logger.debug("Avahi server state change: %i", state)

507

406

logger.debug("Unknown state: %r", state)

508

407

else:

509

408

logger.debug("Unknown state: %r: %r", state, error)

510

409

511

410

def activate(self):

512

411

"""Derived from the Avahi example code"""

513

412

if self.server is None:

524

423

class AvahiServiceToSyslog(AvahiService):

525

424

def rename(self, *args, **kwargs):

526

425

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

426

ret = AvahiService.rename(self, *args, **kwargs)

529

427

syslogger.setFormatter(logging.Formatter(

530

428

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

429

.format(self.name)))

532

430

return ret

533

431

534

535

432

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

538

539

library = ctypes.util.find_library("gnutls")

540

if library is None:

541

library = ctypes.util.find_library("gnutls-deb0")

542

_library = ctypes.cdll.LoadLibrary(library)

543

del library

544

433

class GnuTLS(object):

434

"""This isn't so much a class as it is a module-like namespace.

435

It is instantiated once, and simulates having a GnuTLS module."""

436

437

_library = ctypes.cdll.LoadLibrary(

438

ctypes.util.find_library("gnutls"))

439

_need_version = "3.3.0"

440

def __init__(self):

441

# Need to use class name "GnuTLS" here, since this method is

442

# called before the assignment to the "gnutls" global variable

443

# happens.

444

if GnuTLS.check_version(self._need_version) is None:

445

raise GnuTLS.Error("Needs GnuTLS {} or later"

446

.format(self._need_version))

447

545

448

# Unless otherwise indicated, the constants and types below are

546

449

# all from the gnutls/gnutls.h C header file.

547

450

548

451

# Constants

549

452

E_SUCCESS = 0

550

453

E_INTERRUPTED = -52

551

454

E_AGAIN = -28

552

455

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

456

CLIENT = 2

555

457

SHUT_RDWR = 0

556

458

CRD_CERTIFICATE = 1

557

459

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

460

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

461

565

462

# Types

566

463

class session_int(ctypes.Structure):

567

464

_fields_ = []

568

465

session_t = ctypes.POINTER(session_int)

569

570

466

class certificate_credentials_st(ctypes.Structure):

571

467

_fields_ = []

572

468

certificate_credentials_t = ctypes.POINTER(

573

469

certificate_credentials_st)

574

470

certificate_type_t = ctypes.c_int

575

576

471

class datum_t(ctypes.Structure):

577

472

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

578

473

('size', ctypes.c_uint)]

579

580

474

class openpgp_crt_int(ctypes.Structure):

581

475

_fields_ = []

582

476

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

477

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

478

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

credentials_type_t = ctypes.c_int

479

credentials_type_t = ctypes.c_int #

586

480

transport_ptr_t = ctypes.c_void_p

587

481

close_request_t = ctypes.c_int

588

482

589

483

# Exceptions

590

484

class Error(Exception):

591

def __init__(self, message=None, code=None, args=()):

485

# We need to use the class name "GnuTLS" here, since this

486

# exception might be raised from within GnuTLS.__init__,

487

# which is called before the assignment to the "gnutls"

488

# global variable has happened.

489

def __init__(self, message = None, code = None, args=()):

592

490

# Default usage is by a message string, but if a return

593

491

# code is passed, convert it to a string with

594

492

# gnutls.strerror()

595

493

self.code = code

596

494

if message is None and code is not None:

597

message = gnutls.strerror(code)

598

return super(gnutls.Error, self).__init__(

495

message = GnuTLS.strerror(code)

496

return super(GnuTLS.Error, self).__init__(

599

497

message, *args)

600

498

601

499

class CertificateSecurityError(Error):

602

500

pass

603

501

604

502

# Classes

605

class Credentials:

503

class Credentials(object):

606

504

def __init__(self):

607

505

self._c_object = gnutls.certificate_credentials_t()

608

506

gnutls.certificate_allocate_credentials(

609

507

ctypes.byref(self._c_object))

610

508

self.type = gnutls.CRD_CERTIFICATE

611

509

612

510

def __del__(self):

613

511

gnutls.certificate_free_credentials(self._c_object)

614

615

class ClientSession:

616

def __init__(self, socket, credentials=None):

512

513

class ClientSession(object):

514

def __init__(self, socket, credentials = None):

617

515

self._c_object = gnutls.session_t()

618

gnutls_flags = gnutls.CLIENT

619

if gnutls.check_version(b"3.5.6"):

620

gnutls_flags |= gnutls.NO_TICKETS

621

if gnutls.has_rawpk:

622

gnutls_flags |= gnutls.ENABLE_RAWPK

623

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

624

del gnutls_flags

516

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

625

517

gnutls.set_default_priority(self._c_object)

626

518

gnutls.transport_set_ptr(self._c_object, socket.fileno())

627

519

gnutls.handshake_set_private_extensions(self._c_object,

633

525

ctypes.cast(credentials._c_object,

634

526

ctypes.c_void_p))

635

527

self.credentials = credentials

636

528

637

529

def __del__(self):

638

530

gnutls.deinit(self._c_object)

639

531

640

532

def handshake(self):

641

533

return gnutls.handshake(self._c_object)

642

534

643

535

def send(self, data):

644

536

data = bytes(data)

645

537

data_len = len(data)

647

539

data_len -= gnutls.record_send(self._c_object,

648

540

data[-data_len:],

649

541

data_len)

650

542

651

543

def bye(self):

652

544

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

653

545

654

546

# Error handling functions

655

547

def _error_code(result):

656

548

"""A function to raise exceptions on errors, suitable

658

550

if result >= 0:

659

551

return result

660

552

if result == gnutls.E_NO_CERTIFICATE_FOUND:

661

raise gnutls.CertificateSecurityError(code=result)

662

raise gnutls.Error(code=result)

663

553

raise gnutls.CertificateSecurityError(code = result)

554

raise gnutls.Error(code = result)

555

664

556

def _retry_on_error(result, func, arguments):

665

557

"""A function to retry on some errors, suitable

666

558

for the 'errcheck' attribute on ctypes functions"""

669

561

return _error_code(result)

670

562

result = func(*arguments)

671

563

return result

672

564

673

565

# Unless otherwise indicated, the function declarations below are

674

566

# all from the gnutls/gnutls.h C header file.

675

567

676

568

# Functions

677

569

priority_set_direct = _library.gnutls_priority_set_direct

678

570

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

679

571

ctypes.POINTER(ctypes.c_char_p)]

680

572

priority_set_direct.restype = _error_code

681

573

682

574

init = _library.gnutls_init

683

575

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

684

576

init.restype = _error_code

685

577

686

578

set_default_priority = _library.gnutls_set_default_priority

687

579

set_default_priority.argtypes = [session_t]

688

580

set_default_priority.restype = _error_code

689

581

690

582

record_send = _library.gnutls_record_send

691

583

record_send.argtypes = [session_t, ctypes.c_void_p,

692

584

ctypes.c_size_t]

693

585

record_send.restype = ctypes.c_ssize_t

694

586

record_send.errcheck = _retry_on_error

695

587

696

588

certificate_allocate_credentials = (

697

589

_library.gnutls_certificate_allocate_credentials)

698

590

certificate_allocate_credentials.argtypes = [

699

591

ctypes.POINTER(certificate_credentials_t)]

700

592

certificate_allocate_credentials.restype = _error_code

701

593

702

594

certificate_free_credentials = (

703

595

_library.gnutls_certificate_free_credentials)

704

certificate_free_credentials.argtypes = [

705

certificate_credentials_t]

596

certificate_free_credentials.argtypes = [certificate_credentials_t]

706

597

certificate_free_credentials.restype = None

707

598

708

599

handshake_set_private_extensions = (

709

600

_library.gnutls_handshake_set_private_extensions)

710

601

handshake_set_private_extensions.argtypes = [session_t,

711

602

ctypes.c_int]

712

603

handshake_set_private_extensions.restype = None

713

604

714

605

credentials_set = _library.gnutls_credentials_set

715

606

credentials_set.argtypes = [session_t, credentials_type_t,

716

607

ctypes.c_void_p]

717

608

credentials_set.restype = _error_code

718

609

719

610

strerror = _library.gnutls_strerror

720

611

strerror.argtypes = [ctypes.c_int]

721

612

strerror.restype = ctypes.c_char_p

722

613

723

614

certificate_type_get = _library.gnutls_certificate_type_get

724

615

certificate_type_get.argtypes = [session_t]

725

616

certificate_type_get.restype = _error_code

726

617

727

618

certificate_get_peers = _library.gnutls_certificate_get_peers

728

619

certificate_get_peers.argtypes = [session_t,

729

620

ctypes.POINTER(ctypes.c_uint)]

730

621

certificate_get_peers.restype = ctypes.POINTER(datum_t)

731

622

732

623

global_set_log_level = _library.gnutls_global_set_log_level

733

624

global_set_log_level.argtypes = [ctypes.c_int]

734

625

global_set_log_level.restype = None

735

626

736

627

global_set_log_function = _library.gnutls_global_set_log_function

737

628

global_set_log_function.argtypes = [log_func]

738

629

global_set_log_function.restype = None

739

630

740

631

deinit = _library.gnutls_deinit

741

632

deinit.argtypes = [session_t]

742

633

deinit.restype = None

743

634

744

635

handshake = _library.gnutls_handshake

745

636

handshake.argtypes = [session_t]

746

637

handshake.restype = _error_code

747

638

handshake.errcheck = _retry_on_error

748

639

749

640

transport_set_ptr = _library.gnutls_transport_set_ptr

750

641

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

751

642

transport_set_ptr.restype = None

752

643

753

644

bye = _library.gnutls_bye

754

645

bye.argtypes = [session_t, close_request_t]

755

646

bye.restype = _error_code

756

647

bye.errcheck = _retry_on_error

757

648

758

649

check_version = _library.gnutls_check_version

759

650

check_version.argtypes = [ctypes.c_char_p]

760

651

check_version.restype = ctypes.c_char_p

761

762

_need_version = b"3.3.0"

763

if check_version(_need_version) is None:

764

raise self.Error("Needs GnuTLS {} or later"

765

.format(_need_version))

766

767

_tls_rawpk_version = b"3.6.6"

768

has_rawpk = bool(check_version(_tls_rawpk_version))

769

770

if has_rawpk:

771

# Types

772

class pubkey_st(ctypes.Structure):

773

_fields = []

774

pubkey_t = ctypes.POINTER(pubkey_st)

775

776

x509_crt_fmt_t = ctypes.c_int

777

778

# All the function declarations below are from

779

# gnutls/abstract.h

780

pubkey_init = _library.gnutls_pubkey_init

781

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

782

pubkey_init.restype = _error_code

783

784

pubkey_import = _library.gnutls_pubkey_import

785

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

786

x509_crt_fmt_t]

787

pubkey_import.restype = _error_code

788

789

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

790

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

791

ctypes.POINTER(ctypes.c_ubyte),

792

ctypes.POINTER(ctypes.c_size_t)]

793

pubkey_get_key_id.restype = _error_code

794

795

pubkey_deinit = _library.gnutls_pubkey_deinit

796

pubkey_deinit.argtypes = [pubkey_t]

797

pubkey_deinit.restype = None

798

else:

799

# All the function declarations below are from

800

# gnutls/openpgp.h

801

802

openpgp_crt_init = _library.gnutls_openpgp_crt_init

803

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

804

openpgp_crt_init.restype = _error_code

805

806

openpgp_crt_import = _library.gnutls_openpgp_crt_import

807

openpgp_crt_import.argtypes = [openpgp_crt_t,

808

ctypes.POINTER(datum_t),

809

openpgp_crt_fmt_t]

810

openpgp_crt_import.restype = _error_code

811

812

openpgp_crt_verify_self = \

813

_library.gnutls_openpgp_crt_verify_self

814

openpgp_crt_verify_self.argtypes = [

815

openpgp_crt_t,

816

ctypes.c_uint,

817

ctypes.POINTER(ctypes.c_uint),

818

]

819

openpgp_crt_verify_self.restype = _error_code

820

821

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

822

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

823

openpgp_crt_deinit.restype = None

824

825

openpgp_crt_get_fingerprint = (

826

_library.gnutls_openpgp_crt_get_fingerprint)

827

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

828

ctypes.c_void_p,

829

ctypes.POINTER(

830

ctypes.c_size_t)]

831

openpgp_crt_get_fingerprint.restype = _error_code

832

833

if check_version(b"3.6.4"):

834

certificate_type_get2 = _library.gnutls_certificate_type_get2

835

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

836

certificate_type_get2.restype = _error_code

837

652

653

# All the function declarations below are from gnutls/openpgp.h

654

655

openpgp_crt_init = _library.gnutls_openpgp_crt_init

656

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

657

openpgp_crt_init.restype = _error_code

658

659

openpgp_crt_import = _library.gnutls_openpgp_crt_import

660

openpgp_crt_import.argtypes = [openpgp_crt_t,

661

ctypes.POINTER(datum_t),

662

openpgp_crt_fmt_t]

663

openpgp_crt_import.restype = _error_code

664

665

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

666

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

667

ctypes.POINTER(ctypes.c_uint)]

668

openpgp_crt_verify_self.restype = _error_code

669

670

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

671

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

672

openpgp_crt_deinit.restype = None

673

674

openpgp_crt_get_fingerprint = (

675

_library.gnutls_openpgp_crt_get_fingerprint)

676

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

677

ctypes.c_void_p,

678

ctypes.POINTER(

679

ctypes.c_size_t)]

680

openpgp_crt_get_fingerprint.restype = _error_code

681

838

682

# Remove non-public functions

839

683

del _error_code, _retry_on_error

840

684

# Create the global "gnutls" object, simulating a module

685

gnutls = GnuTLS()

841

686

842

687

def call_pipe(connection, # : multiprocessing.Connection

843

688

func, *args, **kwargs):

844

689

"""This function is meant to be called by multiprocessing.Process

845

690

846

691

This function runs func(*args, **kwargs), and writes the resulting

847

692

return value on the provided multiprocessing.Connection.

848

693

"""

849

694

connection.send(func(*args, **kwargs))

850

695

connection.close()

851

696

852

853

class Client:

697

class Client(object):

854

698

"""A representation of a client host served by this server.

855

699

856

700

Attributes:

857

701

approved: bool(); 'None' if not yet approved/disapproved

858

702

approval_delay: datetime.timedelta(); Time to wait for approval

859

703

approval_duration: datetime.timedelta(); Duration of one approval

860

checker: multiprocessing.Process(); a running checker process used

861

to see if the client lives. 'None' if no process is

862

running.

863

checker_callback_tag: a GLib event source tag, or None

704

checker: subprocess.Popen(); a running checker process used

705

to see if the client lives.

706

'None' if no process is running.

707

checker_callback_tag: a gobject event source tag, or None

864

708

checker_command: string; External command which is run to check

865

709

if client lives. %() expansions are done at

866

710

runtime with vars(self) as dict, so that for

867

711

instance %(name)s can be used in the command.

868

checker_initiator_tag: a GLib event source tag, or None

712

checker_initiator_tag: a gobject event source tag, or None

869

713

created: datetime.datetime(); (UTC) object creation

870

714

client_structure: Object describing what attributes a client has

871

715

and is used for storing the client at exit

872

716

current_checker_command: string; current running checker_command

873

disable_initiator_tag: a GLib event source tag, or None

717

disable_initiator_tag: a gobject event source tag, or None

874

718

enabled: bool()

875

719

fingerprint: string (40 or 32 hexadecimal digits); used to

876

uniquely identify an OpenPGP client

877

key_id: string (64 hexadecimal digits); used to uniquely identify

878

a client using raw public keys

720

uniquely identify the client

879

721

host: string; available for use by the checker command

880

722

interval: datetime.timedelta(); How often to start a new checker

881

723

last_approval_request: datetime.datetime(); (UTC) or None

897

739

disabled, or None

898

740

server_settings: The server_settings dict from main()

899

741

"""

900

742

901

743

runtime_expansions = ("approval_delay", "approval_duration",

902

"created", "enabled", "expires", "key_id",

744

"created", "enabled", "expires",

903

745

"fingerprint", "host", "interval",

904

746

"last_approval_request", "last_checked_ok",

905

747

"last_enabled", "name", "timeout")

914

756

"approved_by_default": "True",

915

757

"enabled": "True",

916

758

}

917

759

918

760

@staticmethod

919

761

def config_parser(config):

920

762

"""Construct a new dict of client settings of this form:

927

769

for client_name in config.sections():

928

770

section = dict(config.items(client_name))

929

771

client = settings[client_name] = {}

930

772

931

773

client["host"] = section["host"]

932

774

# Reformat values from string types to Python types

933

775

client["approved_by_default"] = config.getboolean(

934

776

client_name, "approved_by_default")

935

777

client["enabled"] = config.getboolean(client_name,

936

778

"enabled")

937

938

# Uppercase and remove spaces from key_id and fingerprint

939

# for later comparison purposes with return value from the

940

# key_id() and fingerprint() functions

941

client["key_id"] = (section.get("key_id", "").upper()

942

.replace(" ", ""))

779

780

# Uppercase and remove spaces from fingerprint for later

781

# comparison purposes with return value from the

782

# fingerprint() function

943

783

client["fingerprint"] = (section["fingerprint"].upper()

944

784

.replace(" ", ""))

945

785

if "secret" in section:

946

client["secret"] = codecs.decode(section["secret"]

947

.encode("utf-8"),

948

"base64")

786

client["secret"] = section["secret"].decode("base64")

949

787

elif "secfile" in section:

950

788

with open(os.path.expanduser(os.path.expandvars

951

789

(section["secfile"])),

966

804

client["last_approval_request"] = None

967

805

client["last_checked_ok"] = None

968

806

client["last_checker_status"] = -2

969

807

970

808

return settings

971

972

def __init__(self, settings, name=None, server_settings=None):

809

810

def __init__(self, settings, name = None, server_settings=None):

973

811

self.name = name

974

812

if server_settings is None:

975

813

server_settings = {}

977

815

# adding all client settings

978

816

for setting, value in settings.items():

979

817

setattr(self, setting, value)

980

818

981

819

if self.enabled:

982

820

if not hasattr(self, "last_enabled"):

983

821

self.last_enabled = datetime.datetime.utcnow()

987

825

else:

988

826

self.last_enabled = None

989

827

self.expires = None

990

828

991

829

logger.debug("Creating client %r", self.name)

992

logger.debug(" Key ID: %s", self.key_id)

993

830

logger.debug(" Fingerprint: %s", self.fingerprint)

994

831

self.created = settings.get("created",

995

832

datetime.datetime.utcnow())

996

833

997

834

# attributes specific for this server instance

998

835

self.checker = None

999

836

self.checker_initiator_tag = None

1005

842

self.changedstate = multiprocessing_manager.Condition(

1006

843

multiprocessing_manager.Lock())

1007

844

self.client_structure = [attr

1008

for attr in self.__dict__.keys()

845

for attr in self.__dict__.iterkeys()

1009

846

if not attr.startswith("_")]

1010

847

self.client_structure.append("client_structure")

1011

848

1012

849

for name, t in inspect.getmembers(

1013

850

type(self), lambda obj: isinstance(obj, property)):

1014

851

if not name.startswith("_"):

1015

852

self.client_structure.append(name)

1016

853

1017

854

# Send notice to process children that client state has changed

1018

855

def send_changedstate(self):

1019

856

with self.changedstate:

1020

857

self.changedstate.notify_all()

1021

858

1022

859

def enable(self):

1023

860

"""Start this client's checker and timeout hooks"""

1024

861

if getattr(self, "enabled", False):

1029

866

self.last_enabled = datetime.datetime.utcnow()

1030

867

self.init_checker()

1031

868

self.send_changedstate()

1032

869

1033

870

def disable(self, quiet=True):

1034

871

"""Disable this client."""

1035

872

if not getattr(self, "enabled", False):

1037

874

if not quiet:

1038

875

logger.info("Disabling client %s", self.name)

1039

876

if getattr(self, "disable_initiator_tag", None) is not None:

1040

GLib.source_remove(self.disable_initiator_tag)

877

gobject.source_remove(self.disable_initiator_tag)

1041

878

self.disable_initiator_tag = None

1042

879

self.expires = None

1043

880

if getattr(self, "checker_initiator_tag", None) is not None:

1044

GLib.source_remove(self.checker_initiator_tag)

881

gobject.source_remove(self.checker_initiator_tag)

1045

882

self.checker_initiator_tag = None

1046

883

self.stop_checker()

1047

884

self.enabled = False

1048

885

if not quiet:

1049

886

self.send_changedstate()

1050

# Do not run this again if called by a GLib.timeout_add

887

# Do not run this again if called by a gobject.timeout_add

1051

888

return False

1052

889

1053

890

def __del__(self):

1054

891

self.disable()

1055

892

1056

893

def init_checker(self):

1057

894

# Schedule a new checker to be started an 'interval' from now,

1058

895

# and every interval from then on.

1059

896

if self.checker_initiator_tag is not None:

1060

GLib.source_remove(self.checker_initiator_tag)

1061

self.checker_initiator_tag = GLib.timeout_add(

1062

random.randrange(int(self.interval.total_seconds() * 1000

1063

+ 1)),

897

gobject.source_remove(self.checker_initiator_tag)

898

self.checker_initiator_tag = gobject.timeout_add(

899

int(self.interval.total_seconds() * 1000),

1064

900

self.start_checker)

1065

901

# Schedule a disable() when 'timeout' has passed

1066

902

if self.disable_initiator_tag is not None:

1067

GLib.source_remove(self.disable_initiator_tag)

1068

self.disable_initiator_tag = GLib.timeout_add(

903

gobject.source_remove(self.disable_initiator_tag)

904

self.disable_initiator_tag = gobject.timeout_add(

1069

905

int(self.timeout.total_seconds() * 1000), self.disable)

1070

906

# Also start a new checker *right now*.

1071

907

self.start_checker()

1072

908

1073

909

def checker_callback(self, source, condition, connection,

1074

910

command):

1075

911

"""The checker has completed, so take appropriate actions."""

912

self.checker_callback_tag = None

913

self.checker = None

1076

914

# Read return code from connection (see call_pipe)

1077

915

returncode = connection.recv()

1078

916

connection.close()

1079

if self.checker is not None:

1080

self.checker.join()

1081

self.checker_callback_tag = None

1082

self.checker = None

1083

917

1084

918

if returncode >= 0:

1085

919

self.last_checker_status = returncode

1086

920

self.last_checker_signal = None

1096

930

logger.warning("Checker for %(name)s crashed?",

1097

931

vars(self))

1098

932

return False

1099

933

1100

934

def checked_ok(self):

1101

935

"""Assert that the client has been seen, alive and well."""

1102

936

self.last_checked_ok = datetime.datetime.utcnow()

1103

937

self.last_checker_status = 0

1104

938

self.last_checker_signal = None

1105

939

self.bump_timeout()

1106

940

1107

941

def bump_timeout(self, timeout=None):

1108

942

"""Bump up the timeout for this client."""

1109

943

if timeout is None:

1110

944

timeout = self.timeout

1111

945

if self.disable_initiator_tag is not None:

1112

GLib.source_remove(self.disable_initiator_tag)

946

gobject.source_remove(self.disable_initiator_tag)

1113

947

self.disable_initiator_tag = None

1114

948

if getattr(self, "enabled", False):

1115

self.disable_initiator_tag = GLib.timeout_add(

949

self.disable_initiator_tag = gobject.timeout_add(

1116

950

int(timeout.total_seconds() * 1000), self.disable)

1117

951

self.expires = datetime.datetime.utcnow() + timeout

1118

952

1119

953

def need_approval(self):

1120

954

self.last_approval_request = datetime.datetime.utcnow()

1121

955

1122

956

def start_checker(self):

1123

957

"""Start a new checker subprocess if one is not running.

1124

958

1125

959

If a checker already exists, leave it running and do

1126

960

nothing."""

1127

961

# The reason for not killing a running checker is that if we

1132

966

# checkers alone, the checker would have to take more time

1133

967

# than 'timeout' for the client to be disabled, which is as it

1134

968

# should be.

1135

969

1136

970

if self.checker is not None and not self.checker.is_alive():

1137

971

logger.warning("Checker was not alive; joining")

1138

972

self.checker.join()

1141

975

if self.checker is None:

1142

976

# Escape attributes for the shell

1143

977

escaped_attrs = {

1144

attr: shlex.quote(str(getattr(self, attr)))

1145

for attr in self.runtime_expansions}

978

attr: re.escape(str(getattr(self, attr)))

979

for attr in self.runtime_expansions }

1146

980

try:

1147

981

command = self.checker_command % escaped_attrs

1148

982

except TypeError as error:

1160

994

# The exception is when not debugging but nevertheless

1161

995

# running in the foreground; use the previously

1162

996

# created wnull.

1163

popen_args = {"close_fds": True,

1164

"shell": True,

1165

"cwd": "/"}

997

popen_args = { "close_fds": True,

998

"shell": True,

999

"cwd": "/" }

1166

1000

if (not self.server_settings["debug"]

1167

1001

and self.server_settings["foreground"]):

1168

1002

popen_args.update({"stdout": wnull,

1169

"stderr": wnull})

1170

pipe = multiprocessing.Pipe(duplex=False)

1003

"stderr": wnull })

1004

pipe = multiprocessing.Pipe(duplex = False)

1171

1005

self.checker = multiprocessing.Process(

1172

target=call_pipe,

1173

args=(pipe[1], subprocess.call, command),

1174

kwargs=popen_args)

1006

target = call_pipe,

1007

args = (pipe[1], subprocess.call, command),

1008

kwargs = popen_args)

1175

1009

self.checker.start()

1176

self.checker_callback_tag = GLib.io_add_watch(

1177

GLib.IOChannel.unix_new(pipe[0].fileno()),

1178

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1010

self.checker_callback_tag = gobject.io_add_watch(

1011

pipe[0].fileno(), gobject.IO_IN,

1179

1012

self.checker_callback, pipe[0], command)

1180

# Re-run this periodically if run by GLib.timeout_add

1013

# Re-run this periodically if run by gobject.timeout_add

1181

1014

return True

1182

1015

1183

1016

def stop_checker(self):

1184

1017

"""Force the checker process, if any, to stop."""

1185

1018

if self.checker_callback_tag:

1186

GLib.source_remove(self.checker_callback_tag)

1019

gobject.source_remove(self.checker_callback_tag)

1187

1020

self.checker_callback_tag = None

1188

1021

if getattr(self, "checker", None) is None:

1189

1022

return

1198

1031

byte_arrays=False):

1199

1032

"""Decorators for marking methods of a DBusObjectWithProperties to

1200

1033

become properties on the D-Bus.

1201

1034

1202

1035

The decorated method will be called with no arguments by "Get"

1203

1036

and with one argument by "Set".

1204

1037

1205

1038

The parameters, where they are supported, are the same as

1206

1039

dbus.service.method, except there is only "signature", since the

1207

1040

type from Get() and the type sent to Set() is the same.

1211

1044

if byte_arrays and signature != "ay":

1212

1045

raise ValueError("Byte arrays not supported for non-'ay'"

1213

1046

" signature {!r}".format(signature))

1214

1047

1215

1048

def decorator(func):

1216

1049

func._dbus_is_property = True

1217

1050

func._dbus_interface = dbus_interface

1220

1053

func._dbus_name = func.__name__

1221

1054

if func._dbus_name.endswith("_dbus_property"):

1222

1055

func._dbus_name = func._dbus_name[:-14]

1223

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1056

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1224

1057

return func

1225

1058

1226

1059

return decorator

1227

1060

1228

1061

1229

1062

def dbus_interface_annotations(dbus_interface):

1230

1063

"""Decorator for marking functions returning interface annotations

1231

1064

1232

1065

Usage:

1233

1066

1234

1067

@dbus_interface_annotations("org.example.Interface")

1235

1068

def _foo(self): # Function name does not matter

1236

1069

return {"org.freedesktop.DBus.Deprecated": "true",

1237

1070

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1238

1071

"false"}

1239

1072

"""

1240

1073

1241

1074

def decorator(func):

1242

1075

func._dbus_is_interface = True

1243

1076

func._dbus_interface = dbus_interface

1244

1077

func._dbus_name = dbus_interface

1245

1078

return func

1246

1079

1247

1080

return decorator

1248

1081

1249

1082

1250

1083

def dbus_annotations(annotations):

1251

1084

"""Decorator to annotate D-Bus methods, signals or properties

1252

1085

Usage:

1253

1086

1254

1087

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1255

1088

"org.freedesktop.DBus.Property."

1256

1089

"EmitsChangedSignal": "false"})

1258

1091

access="r")

1259

1092

def Property_dbus_property(self):

1260

1093

return dbus.Boolean(False)

1261

1094

1262

1095

See also the DBusObjectWithAnnotations class.

1263

1096

"""

1264

1097

1265

1098

def decorator(func):

1266

1099

func._dbus_annotations = annotations

1267

1100

return func

1268

1101

1269

1102

return decorator

1270

1103

1271

1104

1289

1122

1290

1123

class DBusObjectWithAnnotations(dbus.service.Object):

1291

1124

"""A D-Bus object with annotations.

1292

1125

1293

1126

Classes inheriting from this can use the dbus_annotations

1294

1127

decorator to add annotations to methods or signals.

1295

1128

"""

1296

1129

1297

1130

@staticmethod

1298

1131

def _is_dbus_thing(thing):

1299

1132

"""Returns a function testing if an attribute is a D-Bus thing

1300

1133

1301

1134

If called like _is_dbus_thing("method") it returns a function

1302

1135

suitable for use as predicate to inspect.getmembers().

1303

1136

"""

1304

1137

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1305

1138

False)

1306

1139

1307

1140

def _get_all_dbus_things(self, thing):

1308

1141

"""Returns a generator of (name, attribute) pairs

1309

1142

"""

1312

1145

for cls in self.__class__.__mro__

1313

1146

for name, athing in

1314

1147

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1315

1148

1316

1149

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1317

out_signature="s",

1318

path_keyword='object_path',

1319

connection_keyword='connection')

1150

out_signature = "s",

1151

path_keyword = 'object_path',

1152

connection_keyword = 'connection')

1320

1153

def Introspect(self, object_path, connection):

1321

1154

"""Overloading of standard D-Bus method.

1322

1155

1323

1156

Inserts annotation tags on methods and signals.

1324

1157

"""

1325

1158

xmlstring = dbus.service.Object.Introspect(self, object_path,

1326

1159

connection)

1327

1160

try:

1328

1161

document = xml.dom.minidom.parseString(xmlstring)

1329

1162

1330

1163

for if_tag in document.getElementsByTagName("interface"):

1331

1164

# Add annotation tags

1332

1165

for typ in ("method", "signal"):

1359

1192

if_tag.appendChild(ann_tag)

1360

1193

# Fix argument name for the Introspect method itself

1361

1194

if (if_tag.getAttribute("name")

1362

== dbus.INTROSPECTABLE_IFACE):

1195

== dbus.INTROSPECTABLE_IFACE):

1363

1196

for cn in if_tag.getElementsByTagName("method"):

1364

1197

if cn.getAttribute("name") == "Introspect":

1365

1198

for arg in cn.getElementsByTagName("arg"):

1378

1211

1379

1212

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1380

1213

"""A D-Bus object with properties.

1381

1214

1382

1215

Classes inheriting from this can use the dbus_service_property

1383

1216

decorator to expose methods as D-Bus properties. It exposes the

1384

1217

standard Get(), Set(), and GetAll() methods on the D-Bus.

1385

1218

"""

1386

1219

1387

1220

def _get_dbus_property(self, interface_name, property_name):

1388

1221

"""Returns a bound method if one exists which is a D-Bus

1389

1222

property with the specified name and interface.

1394

1227

if (value._dbus_name == property_name

1395

1228

and value._dbus_interface == interface_name):

1396

1229

return value.__get__(self)

1397

1230

1398

1231

# No such property

1399

1232

raise DBusPropertyNotFound("{}:{}.{}".format(

1400

1233

self.dbus_object_path, interface_name, property_name))

1401

1234

1402

1235

@classmethod

1403

1236

def _get_all_interface_names(cls):

1404

1237

"""Get a sequence of all interfaces supported by an object"""

1407

1240

for x in (inspect.getmro(cls))

1408

1241

for attr in dir(x))

1409

1242

if name is not None)

1410

1243

1411

1244

@dbus.service.method(dbus.PROPERTIES_IFACE,

1412

1245

in_signature="ss",

1413

1246

out_signature="v")

1421

1254

if not hasattr(value, "variant_level"):

1422

1255

return value

1423

1256

return type(value)(value, variant_level=value.variant_level+1)

1424

1257

1425

1258

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1426

1259

def Set(self, interface_name, property_name, value):

1427

1260

"""Standard D-Bus property Set() method, see D-Bus standard.

1436

1269

raise ValueError("Byte arrays not supported for non-"

1437

1270

"'ay' signature {!r}"

1438

1271

.format(prop._dbus_signature))

1439

value = dbus.ByteArray(bytes(value))

1272

value = dbus.ByteArray(b''.join(chr(byte)

1273

for byte in value))

1440

1274

prop(value)

1441

1275

1442

1276

@dbus.service.method(dbus.PROPERTIES_IFACE,

1443

1277

in_signature="s",

1444

1278

out_signature="a{sv}")

1445

1279

def GetAll(self, interface_name):

1446

1280

"""Standard D-Bus property GetAll() method, see D-Bus

1447

1281

standard.

1448

1282

1449

1283

Note: Will not include properties with access="write".

1450

1284

"""

1451

1285

properties = {}

1462

1296

properties[name] = value

1463

1297

continue

1464

1298

properties[name] = type(value)(

1465

value, variant_level=value.variant_level + 1)

1299

value, variant_level = value.variant_level + 1)

1466

1300

return dbus.Dictionary(properties, signature="sv")

1467

1301

1468

1302

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1469

1303

def PropertiesChanged(self, interface_name, changed_properties,

1470

1304

invalidated_properties):

1472

1306

standard.

1473

1307

"""

1474

1308

pass

1475

1309

1476

1310

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1477

1311

out_signature="s",

1478

1312

path_keyword='object_path',

1479

1313

connection_keyword='connection')

1480

1314

def Introspect(self, object_path, connection):

1481

1315

"""Overloading of standard D-Bus method.

1482

1316

1483

1317

Inserts property tags and interface annotation tags.

1484

1318

"""

1485

1319

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1487

1321

connection)

1488

1322

try:

1489

1323

document = xml.dom.minidom.parseString(xmlstring)

1490

1324

1491

1325

def make_tag(document, name, prop):

1492

1326

e = document.createElement("property")

1493

1327

e.setAttribute("name", name)

1494

1328

e.setAttribute("type", prop._dbus_signature)

1495

1329

e.setAttribute("access", prop._dbus_access)

1496

1330

return e

1497

1331

1498

1332

for if_tag in document.getElementsByTagName("interface"):

1499

1333

# Add property tags

1500

1334

for tag in (make_tag(document, name, prop)

1542

1376

exc_info=error)

1543

1377

return xmlstring

1544

1378

1545

1546

1379

try:

1547

1380

dbus.OBJECT_MANAGER_IFACE

1548

1381

except AttributeError:

1549

1382

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1550

1383

1551

1552

1384

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1553

1385

"""A D-Bus object with an ObjectManager.

1554

1386

1555

1387

Classes inheriting from this exposes the standard

1556

1388

GetManagedObjects call and the InterfacesAdded and

1557

1389

InterfacesRemoved signals on the standard

1558

1390

"org.freedesktop.DBus.ObjectManager" interface.

1559

1391

1560

1392

Note: No signals are sent automatically; they must be sent

1561

1393

manually.

1562

1394

"""

1563

1395

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1564

out_signature="a{oa{sa{sv}}}")

1396

out_signature = "a{oa{sa{sv}}}")

1565

1397

def GetManagedObjects(self):

1566

1398

"""This function must be overridden"""

1567

1399

raise NotImplementedError()

1568

1400

1569

1401

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1570

signature="oa{sa{sv}}")

1402

signature = "oa{sa{sv}}")

1571

1403

def InterfacesAdded(self, object_path, interfaces_and_properties):

1572

1404

pass

1573

1574

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1405

1406

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1575

1407

def InterfacesRemoved(self, object_path, interfaces):

1576

1408

pass

1577

1409

1578

1410

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1579

out_signature="s",

1580

path_keyword='object_path',

1581

connection_keyword='connection')

1411

out_signature = "s",

1412

path_keyword = 'object_path',

1413

connection_keyword = 'connection')

1582

1414

def Introspect(self, object_path, connection):

1583

1415

"""Overloading of standard D-Bus method.

1584

1416

1585

1417

Override return argument name of GetManagedObjects to be

1586

1418

"objpath_interfaces_and_properties"

1587

1419

"""

1590

1422

connection)

1591

1423

try:

1592

1424

document = xml.dom.minidom.parseString(xmlstring)

1593

1425

1594

1426

for if_tag in document.getElementsByTagName("interface"):

1595

1427

# Fix argument name for the GetManagedObjects method

1596

1428

if (if_tag.getAttribute("name")

1597

== dbus.OBJECT_MANAGER_IFACE):

1429

== dbus.OBJECT_MANAGER_IFACE):

1598

1430

for cn in if_tag.getElementsByTagName("method"):

1599

1431

if (cn.getAttribute("name")

1600

1432

== "GetManagedObjects"):

1610

1442

except (AttributeError, xml.dom.DOMException,

1611

1443

xml.parsers.expat.ExpatError) as error:

1612

1444

logger.error("Failed to override Introspection method",

1613

exc_info=error)

1445

exc_info = error)

1614

1446

return xmlstring

1615

1447

1616

1617

1448

def datetime_to_dbus(dt, variant_level=0):

1618

1449

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1619

1450

if dt is None:

1620

return dbus.String("", variant_level=variant_level)

1451

return dbus.String("", variant_level = variant_level)

1621

1452

return dbus.String(dt.isoformat(), variant_level=variant_level)

1622

1453

1623

1454

1626

1457

dbus.service.Object, it will add alternate D-Bus attributes with

1627

1458

interface names according to the "alt_interface_names" mapping.

1628

1459

Usage:

1629

1460

1630

1461

@alternate_dbus_interfaces({"org.example.Interface":

1631

1462

"net.example.AlternateInterface"})

1632

1463

class SampleDBusObject(dbus.service.Object):

1633

1464

@dbus.service.method("org.example.Interface")

1634

1465

def SampleDBusMethod():

1635

1466

pass

1636

1467

1637

1468

The above "SampleDBusMethod" on "SampleDBusObject" will be

1638

1469

reachable via two interfaces: "org.example.Interface" and

1639

1470

"net.example.AlternateInterface", the latter of which will have

1640

1471

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1641

1472

"true", unless "deprecate" is passed with a False value.

1642

1473

1643

1474

This works for methods and signals, and also for D-Bus properties

1644

1475

(from DBusObjectWithProperties) and interfaces (from the

1645

1476

dbus_interface_annotations decorator).

1646

1477

"""

1647

1478

1648

1479

def wrapper(cls):

1649

1480

for orig_interface_name, alt_interface_name in (

1650

1481

alt_interface_names.items()):

1665

1496

interface_names.add(alt_interface)

1666

1497

# Is this a D-Bus signal?

1667

1498

if getattr(attribute, "_dbus_is_signal", False):

1668

# Extract the original non-method undecorated

1669

# function by black magic

1670

1499

if sys.version_info.major == 2:

1500

# Extract the original non-method undecorated

1501

# function by black magic

1671

1502

nonmethod_func = (dict(

1672

1503

zip(attribute.func_code.co_freevars,

1673

1504

attribute.__closure__))

1674

1505

["func"].cell_contents)

1675

1506

else:

1676

nonmethod_func = (dict(

1677

zip(attribute.__code__.co_freevars,

1678

attribute.__closure__))

1679

["func"].cell_contents)

1507

nonmethod_func = attribute

1680

1508

# Create a new, but exactly alike, function

1681

1509

# object, and decorate it to be a new D-Bus signal

1682

1510

# with the alternate D-Bus interface name

1683

new_function = copy_function(nonmethod_func)

1511

if sys.version_info.major == 2:

1512

new_function = types.FunctionType(

1513

nonmethod_func.func_code,

1514

nonmethod_func.func_globals,

1515

nonmethod_func.func_name,

1516

nonmethod_func.func_defaults,

1517

nonmethod_func.func_closure)

1518

else:

1519

new_function = types.FunctionType(

1520

nonmethod_func.__code__,

1521

nonmethod_func.__globals__,

1522

nonmethod_func.__name__,

1523

nonmethod_func.__defaults__,

1524

nonmethod_func.__closure__)

1684

1525

new_function = (dbus.service.signal(

1685

1526

alt_interface,

1686

1527

attribute._dbus_signature)(new_function))

1690

1531

attribute._dbus_annotations)

1691

1532

except AttributeError:

1692

1533

pass

1693

1694

1534

# Define a creator of a function to call both the

1695

1535

# original and alternate functions, so both the

1696

1536

# original and alternate signals gets sent when

1699

1539

"""This function is a scope container to pass

1700

1540

func1 and func2 to the "call_both" function

1701

1541

outside of its arguments"""

1702

1542

1703

1543

@functools.wraps(func2)

1704

1544

def call_both(*args, **kwargs):

1705

1545

"""This function will emit two D-Bus

1706

1546

signals by calling func1 and func2"""

1707

1547

func1(*args, **kwargs)

1708

1548

func2(*args, **kwargs)

1709

# Make wrapper function look like a D-Bus

1710

# signal

1549

# Make wrapper function look like a D-Bus signal

1711

1550

for name, attr in inspect.getmembers(func2):

1712

1551

if name.startswith("_dbus_"):

1713

1552

setattr(call_both, name, attr)

1714

1553

1715

1554

return call_both

1716

1555

# Create the "call_both" function and add it to

1717

1556

# the class

1727

1566

alt_interface,

1728

1567

attribute._dbus_in_signature,

1729

1568

attribute._dbus_out_signature)

1730

(copy_function(attribute)))

1569

(types.FunctionType(attribute.func_code,

1570

attribute.func_globals,

1571

attribute.func_name,

1572

attribute.func_defaults,

1573

attribute.func_closure)))

1731

1574

# Copy annotations, if any

1732

1575

try:

1733

1576

attr[attrname]._dbus_annotations = dict(

1745

1588

attribute._dbus_access,

1746

1589

attribute._dbus_get_args_options

1747

1590

["byte_arrays"])

1748

(copy_function(attribute)))

1591

(types.FunctionType(

1592

attribute.func_code,

1593

attribute.func_globals,

1594

attribute.func_name,

1595

attribute.func_defaults,

1596

attribute.func_closure)))

1749

1597

# Copy annotations, if any

1750

1598

try:

1751

1599

attr[attrname]._dbus_annotations = dict(

1760

1608

# to the class.

1761

1609

attr[attrname] = (

1762

1610

dbus_interface_annotations(alt_interface)

1763

(copy_function(attribute)))

1611

(types.FunctionType(attribute.func_code,

1612

attribute.func_globals,

1613

attribute.func_name,

1614

attribute.func_defaults,

1615

attribute.func_closure)))

1764

1616

if deprecate:

1765

1617

# Deprecate all alternate interfaces

1766

iname = "_AlternateDBusNames_interface_annotation{}"

1618

iname="_AlternateDBusNames_interface_annotation{}"

1767

1619

for interface_name in interface_names:

1768

1620

1769

1621

@dbus_interface_annotations(interface_name)

1770

1622

def func(self):

1771

return {"org.freedesktop.DBus.Deprecated":

1772

"true"}

1623

return { "org.freedesktop.DBus.Deprecated":

1624

"true" }

1773

1625

# Find an unused name

1774

1626

for aname in (iname.format(i)

1775

1627

for i in itertools.count()):

1779

1631

if interface_names:

1780

1632

# Replace the class with a new subclass of it with

1781

1633

# methods, signals, etc. as created above.

1782

if sys.version_info.major == 2:

1783

cls = type(b"{}Alternate".format(cls.__name__),

1784

(cls, ), attr)

1785

else:

1786

cls = type("{}Alternate".format(cls.__name__),

1787

(cls, ), attr)

1634

cls = type(b"{}Alternate".format(cls.__name__),

1635

(cls, ), attr)

1788

1636

return cls

1789

1637

1790

1638

return wrapper

1791

1639

1792

1640

1794

1642

"se.bsnet.fukt.Mandos"})

1795

1643

class ClientDBus(Client, DBusObjectWithProperties):

1796

1644

"""A Client class using D-Bus

1797

1645

1798

1646

Attributes:

1799

1647

dbus_object_path: dbus.ObjectPath

1800

1648

bus: dbus.SystemBus()

1801

1649

"""

1802

1650

1803

1651

runtime_expansions = (Client.runtime_expansions

1804

1652

+ ("dbus_object_path", ))

1805

1653

1806

1654

_interface = "se.recompile.Mandos.Client"

1807

1655

1808

1656

# dbus.service.Object doesn't use super(), so we can't either.

1809

1810

def __init__(self, bus=None, *args, **kwargs):

1657

1658

def __init__(self, bus = None, *args, **kwargs):

1811

1659

self.bus = bus

1812

1660

Client.__init__(self, *args, **kwargs)

1813

1661

# Only now, when this client is initialized, can it show up on

1819

1667

"/clients/" + client_object_name)

1820

1668

DBusObjectWithProperties.__init__(self, self.bus,

1821

1669

self.dbus_object_path)

1822

1670

1823

1671

def notifychangeproperty(transform_func, dbus_name,

1824

1672

type_func=lambda x: x,

1825

1673

variant_level=1,

1827

1675

_interface=_interface):

1828

1676

""" Modify a variable so that it's a property which announces

1829

1677

its changes to DBus.

1830

1678

1831

1679

transform_fun: Function that takes a value and a variant_level

1832

1680

and transforms it to a D-Bus type.

1833

1681

dbus_name: D-Bus name of the variable

1836

1684

variant_level: D-Bus variant level. Default: 1

1837

1685

"""

1838

1686

attrname = "_{}".format(dbus_name)

1839

1687

1840

1688

def setter(self, value):

1841

1689

if hasattr(self, "dbus_object_path"):

1842

1690

if (not hasattr(self, attrname) or

1849

1697

else:

1850

1698

dbus_value = transform_func(

1851

1699

type_func(value),

1852

variant_level=variant_level)

1700

variant_level = variant_level)

1853

1701

self.PropertyChanged(dbus.String(dbus_name),

1854

1702

dbus_value)

1855

1703

self.PropertiesChanged(

1856

1704

_interface,

1857

dbus.Dictionary({dbus.String(dbus_name):

1858

dbus_value}),

1705

dbus.Dictionary({ dbus.String(dbus_name):

1706

dbus_value }),

1859

1707

dbus.Array())

1860

1708

setattr(self, attrname, value)

1861

1709

1862

1710

return property(lambda self: getattr(self, attrname), setter)

1863

1711

1864

1712

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1865

1713

approvals_pending = notifychangeproperty(dbus.Boolean,

1866

1714

"ApprovalPending",

1867

type_func=bool)

1715

type_func = bool)

1868

1716

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1869

1717

last_enabled = notifychangeproperty(datetime_to_dbus,

1870

1718

"LastEnabled")

1871

1719

checker = notifychangeproperty(

1872

1720

dbus.Boolean, "CheckerRunning",

1873

type_func=lambda checker: checker is not None)

1721

type_func = lambda checker: checker is not None)

1874

1722

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1875

1723

"LastCheckedOK")

1876

1724

last_checker_status = notifychangeproperty(dbus.Int16,

1881

1729

"ApprovedByDefault")

1882

1730

approval_delay = notifychangeproperty(

1883

1731

dbus.UInt64, "ApprovalDelay",

1884

type_func=lambda td: td.total_seconds() * 1000)

1732

type_func = lambda td: td.total_seconds() * 1000)

1885

1733

approval_duration = notifychangeproperty(

1886

1734

dbus.UInt64, "ApprovalDuration",

1887

type_func=lambda td: td.total_seconds() * 1000)

1735

type_func = lambda td: td.total_seconds() * 1000)

1888

1736

host = notifychangeproperty(dbus.String, "Host")

1889

1737

timeout = notifychangeproperty(

1890

1738

dbus.UInt64, "Timeout",

1891

type_func=lambda td: td.total_seconds() * 1000)

1739

type_func = lambda td: td.total_seconds() * 1000)

1892

1740

extended_timeout = notifychangeproperty(

1893

1741

dbus.UInt64, "ExtendedTimeout",

1894

type_func=lambda td: td.total_seconds() * 1000)

1742

type_func = lambda td: td.total_seconds() * 1000)

1895

1743

interval = notifychangeproperty(

1896

1744

dbus.UInt64, "Interval",

1897

type_func=lambda td: td.total_seconds() * 1000)

1745

type_func = lambda td: td.total_seconds() * 1000)

1898

1746

checker_command = notifychangeproperty(dbus.String, "Checker")

1899

1747

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1900

1748

invalidate_only=True)

1901

1749

1902

1750

del notifychangeproperty

1903

1751

1904

1752

def __del__(self, *args, **kwargs):

1905

1753

try:

1906

1754

self.remove_from_connection()

1909

1757

if hasattr(DBusObjectWithProperties, "__del__"):

1910

1758

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1911

1759

Client.__del__(self, *args, **kwargs)

1912

1760

1913

1761

def checker_callback(self, source, condition,

1914

1762

connection, command, *args, **kwargs):

1915

1763

ret = Client.checker_callback(self, source, condition,

1931

1779

| self.last_checker_signal),

1932

1780

dbus.String(command))

1933

1781

return ret

1934

1782

1935

1783

def start_checker(self, *args, **kwargs):

1936

1784

old_checker_pid = getattr(self.checker, "pid", None)

1937

1785

r = Client.start_checker(self, *args, **kwargs)

1941

1789

# Emit D-Bus signal

1942

1790

self.CheckerStarted(self.current_checker_command)

1943

1791

return r

1944

1792

1945

1793

def _reset_approved(self):

1946

1794

self.approved = None

1947

1795

return False

1948

1796

1949

1797

def approve(self, value=True):

1950

1798

self.approved = value

1951

GLib.timeout_add(int(self.approval_duration.total_seconds()

1952

* 1000), self._reset_approved)

1799

gobject.timeout_add(int(self.approval_duration.total_seconds()

1800

* 1000), self._reset_approved)

1953

1801

self.send_changedstate()

1954

1955

# D-Bus methods, signals & properties

1956

1957

# Interfaces

1958

1959

# Signals

1960

1802

1803

## D-Bus methods, signals & properties

1804

1805

## Interfaces

1806

1807

## Signals

1808

1961

1809

# CheckerCompleted - signal

1962

1810

@dbus.service.signal(_interface, signature="nxs")

1963

1811

def CheckerCompleted(self, exitcode, waitstatus, command):

1964

1812

"D-Bus signal"

1965

1813

pass

1966

1814

1967

1815

# CheckerStarted - signal

1968

1816

@dbus.service.signal(_interface, signature="s")

1969

1817

def CheckerStarted(self, command):

1970

1818

"D-Bus signal"

1971

1819

pass

1972

1820

1973

1821

# PropertyChanged - signal

1974

1822

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1975

1823

@dbus.service.signal(_interface, signature="sv")

1976

1824

def PropertyChanged(self, property, value):

1977

1825

"D-Bus signal"

1978

1826

pass

1979

1827

1980

1828

# GotSecret - signal

1981

1829

@dbus.service.signal(_interface)

1982

1830

def GotSecret(self):

1985

1833

server to mandos-client

1986

1834

"""

1987

1835

pass

1988

1836

1989

1837

# Rejected - signal

1990

1838

@dbus.service.signal(_interface, signature="s")

1991

1839

def Rejected(self, reason):

1992

1840

"D-Bus signal"

1993

1841

pass

1994

1842

1995

1843

# NeedApproval - signal

1996

1844

@dbus.service.signal(_interface, signature="tb")

1997

1845

def NeedApproval(self, timeout, default):

1998

1846

"D-Bus signal"

1999

1847

return self.need_approval()

2000

2001

# Methods

2002

1848

1849

## Methods

1850

2003

1851

# Approve - method

2004

1852

@dbus.service.method(_interface, in_signature="b")

2005

1853

def Approve(self, value):

2006

1854

self.approve(value)

2007

1855

2008

1856

# CheckedOK - method

2009

1857

@dbus.service.method(_interface)

2010

1858

def CheckedOK(self):

2011

1859

self.checked_ok()

2012

1860

2013

1861

# Enable - method

2014

1862

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1863

@dbus.service.method(_interface)

2016

1864

def Enable(self):

2017

1865

"D-Bus method"

2018

1866

self.enable()

2019

1867

2020

1868

# StartChecker - method

2021

1869

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2022

1870

@dbus.service.method(_interface)

2023

1871

def StartChecker(self):

2024

1872

"D-Bus method"

2025

1873

self.start_checker()

2026

1874

2027

1875

# Disable - method

2028

1876

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2029

1877

@dbus.service.method(_interface)

2030

1878

def Disable(self):

2031

1879

"D-Bus method"

2032

1880

self.disable()

2033

1881

2034

1882

# StopChecker - method

2035

1883

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2036

1884

@dbus.service.method(_interface)

2037

1885

def StopChecker(self):

2038

1886

self.stop_checker()

2039

2040

# Properties

2041

1887

1888

## Properties

1889

2042

1890

# ApprovalPending - property

2043

1891

@dbus_service_property(_interface, signature="b", access="read")

2044

1892

def ApprovalPending_dbus_property(self):

2045

1893

return dbus.Boolean(bool(self.approvals_pending))

2046

1894

2047

1895

# ApprovedByDefault - property

2048

1896

@dbus_service_property(_interface,

2049

1897

signature="b",

2052

1900

if value is None: # get

2053

1901

return dbus.Boolean(self.approved_by_default)

2054

1902

self.approved_by_default = bool(value)

2055

1903

2056

1904

# ApprovalDelay - property

2057

1905

@dbus_service_property(_interface,

2058

1906

signature="t",

2062

1910

return dbus.UInt64(self.approval_delay.total_seconds()

2063

1911

* 1000)

2064

1912

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2065

1913

2066

1914

# ApprovalDuration - property

2067

1915

@dbus_service_property(_interface,

2068

1916

signature="t",

2072

1920

return dbus.UInt64(self.approval_duration.total_seconds()

2073

1921

* 1000)

2074

1922

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2075

1923

2076

1924

# Name - property

2077

1925

@dbus_annotations(

2078

1926

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2079

1927

@dbus_service_property(_interface, signature="s", access="read")

2080

1928

def Name_dbus_property(self):

2081

1929

return dbus.String(self.name)

2082

2083

# KeyID - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

@dbus_service_property(_interface, signature="s", access="read")

2087

def KeyID_dbus_property(self):

2088

return dbus.String(self.key_id)

2089

1930

2090

1931

# Fingerprint - property

2091

1932

@dbus_annotations(

2092

1933

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2093

1934

@dbus_service_property(_interface, signature="s", access="read")

2094

1935

def Fingerprint_dbus_property(self):

2095

1936

return dbus.String(self.fingerprint)

2096

1937

2097

1938

# Host - property

2098

1939

@dbus_service_property(_interface,

2099

1940

signature="s",

2102

1943

if value is None: # get

2103

1944

return dbus.String(self.host)

2104

1945

self.host = str(value)

2105

1946

2106

1947

# Created - property

2107

1948

@dbus_annotations(

2108

1949

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2109

1950

@dbus_service_property(_interface, signature="s", access="read")

2110

1951

def Created_dbus_property(self):

2111

1952

return datetime_to_dbus(self.created)

2112

1953

2113

1954

# LastEnabled - property

2114

1955

@dbus_service_property(_interface, signature="s", access="read")

2115

1956

def LastEnabled_dbus_property(self):

2116

1957

return datetime_to_dbus(self.last_enabled)

2117

1958

2118

1959

# Enabled - property

2119

1960

@dbus_service_property(_interface,

2120

1961

signature="b",

2126

1967

self.enable()

2127

1968

else:

2128

1969

self.disable()

2129

1970

2130

1971

# LastCheckedOK - property

2131

1972

@dbus_service_property(_interface,

2132

1973

signature="s",

2136

1977

self.checked_ok()

2137

1978

return

2138

1979

return datetime_to_dbus(self.last_checked_ok)

2139

1980

2140

1981

# LastCheckerStatus - property

2141

1982

@dbus_service_property(_interface, signature="n", access="read")

2142

1983

def LastCheckerStatus_dbus_property(self):

2143

1984

return dbus.Int16(self.last_checker_status)

2144

1985

2145

1986

# Expires - property

2146

1987

@dbus_service_property(_interface, signature="s", access="read")

2147

1988

def Expires_dbus_property(self):

2148

1989

return datetime_to_dbus(self.expires)

2149

1990

2150

1991

# LastApprovalRequest - property

2151

1992

@dbus_service_property(_interface, signature="s", access="read")

2152

1993

def LastApprovalRequest_dbus_property(self):

2153

1994

return datetime_to_dbus(self.last_approval_request)

2154

1995

2155

1996

# Timeout - property

2156

1997

@dbus_service_property(_interface,

2157

1998

signature="t",

2172

2013

if (getattr(self, "disable_initiator_tag", None)

2173

2014

is None):

2174

2015

return

2175

GLib.source_remove(self.disable_initiator_tag)

2176

self.disable_initiator_tag = GLib.timeout_add(

2016

gobject.source_remove(self.disable_initiator_tag)

2017

self.disable_initiator_tag = gobject.timeout_add(

2177

2018

int((self.expires - now).total_seconds() * 1000),

2178

2019

self.disable)

2179

2020

2180

2021

# ExtendedTimeout - property

2181

2022

@dbus_service_property(_interface,

2182

2023

signature="t",

2186

2027

return dbus.UInt64(self.extended_timeout.total_seconds()

2187

2028

* 1000)

2188

2029

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2189

2030

2190

2031

# Interval - property

2191

2032

@dbus_service_property(_interface,

2192

2033

signature="t",

2199

2040

return

2200

2041

if self.enabled:

2201

2042

# Reschedule checker run

2202

GLib.source_remove(self.checker_initiator_tag)

2203

self.checker_initiator_tag = GLib.timeout_add(

2043

gobject.source_remove(self.checker_initiator_tag)

2044

self.checker_initiator_tag = gobject.timeout_add(

2204

2045

value, self.start_checker)

2205

self.start_checker() # Start one now, too

2206

2046

self.start_checker() # Start one now, too

2047

2207

2048

# Checker - property

2208

2049

@dbus_service_property(_interface,

2209

2050

signature="s",

2212

2053

if value is None: # get

2213

2054

return dbus.String(self.checker_command)

2214

2055

self.checker_command = str(value)

2215

2056

2216

2057

# CheckerRunning - property

2217

2058

@dbus_service_property(_interface,

2218

2059

signature="b",

2224

2065

self.start_checker()

2225

2066

else:

2226

2067

self.stop_checker()

2227

2068

2228

2069

# ObjectPath - property

2229

2070

@dbus_annotations(

2230

2071

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2231

2072

"org.freedesktop.DBus.Deprecated": "true"})

2232

2073

@dbus_service_property(_interface, signature="o", access="read")

2233

2074

def ObjectPath_dbus_property(self):

2234

return self.dbus_object_path # is already a dbus.ObjectPath

2235

2075

return self.dbus_object_path # is already a dbus.ObjectPath

2076

2236

2077

# Secret = property

2237

2078

@dbus_annotations(

2238

2079

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2243

2084

byte_arrays=True)

2244

2085

def Secret_dbus_property(self, value):

2245

2086

self.secret = bytes(value)

2246

2087

2247

2088

del _interface

2248

2089

2249

2090

2250

class ProxyClient:

2251

def __init__(self, child_pipe, key_id, fpr, address):

2091

class ProxyClient(object):

2092

def __init__(self, child_pipe, fpr, address):

2252

2093

self._pipe = child_pipe

2253

self._pipe.send(('init', key_id, fpr, address))

2094

self._pipe.send(('init', fpr, address))

2254

2095

if not self._pipe.recv():

2255

raise KeyError(key_id or fpr)

2256

2096

raise KeyError(fpr)

2097

2257

2098

def __getattribute__(self, name):

2258

2099

if name == '_pipe':

2259

2100

return super(ProxyClient, self).__getattribute__(name)

2262

2103

if data[0] == 'data':

2263

2104

return data[1]

2264

2105

if data[0] == 'function':

2265

2106

2266

2107

def func(*args, **kwargs):

2267

2108

self._pipe.send(('funcall', name, args, kwargs))

2268

2109

return self._pipe.recv()[1]

2269

2110

2270

2111

return func

2271

2112

2272

2113

def __setattr__(self, name, value):

2273

2114

if name == '_pipe':

2274

2115

return super(ProxyClient, self).__setattr__(name, value)

2277

2118

2278

2119

class ClientHandler(socketserver.BaseRequestHandler, object):

2279

2120

"""A class to handle client connections.

2280

2121

2281

2122

Instantiated once for each connection to handle it.

2282

2123

Note: This will run in its own forked process."""

2283

2124

2284

2125

def handle(self):

2285

2126

with contextlib.closing(self.server.child_pipe) as child_pipe:

2286

2127

logger.info("TCP connection from: %s",

2287

2128

str(self.client_address))

2288

2129

logger.debug("Pipe FD: %d",

2289

2130

self.server.child_pipe.fileno())

2290

2131

2291

2132

session = gnutls.ClientSession(self.request)

2292

2293

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2294

# "+AES-256-CBC", "+SHA1",

2295

# "+COMP-NULL", "+CTYPE-OPENPGP",

2296

# "+DHE-DSS"))

2133

2134

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2135

# "+AES-256-CBC", "+SHA1",

2136

# "+COMP-NULL", "+CTYPE-OPENPGP",

2137

# "+DHE-DSS"))

2297

2138

# Use a fallback default, since this MUST be set.

2298

2139

priority = self.server.gnutls_priority

2299

2140

if priority is None:

2300

2141

priority = "NORMAL"

2301

gnutls.priority_set_direct(session._c_object,

2302

priority.encode("utf-8"),

2142

gnutls.priority_set_direct(session._c_object, priority,

2303

2143

None)

2304

2144

2305

2145

# Start communication using the Mandos protocol

2306

2146

# Get protocol number

2307

2147

line = self.request.makefile().readline()

2312

2152

except (ValueError, IndexError, RuntimeError) as error:

2313

2153

logger.error("Unknown protocol version: %s", error)

2314

2154

return

2315

2155

2316

2156

# Start GnuTLS connection

2317

2157

try:

2318

2158

session.handshake()

2322

2162

# established. Just abandon the request.

2323

2163

return

2324

2164

logger.debug("Handshake succeeded")

2325

2165

2326

2166

approval_required = False

2327

2167

try:

2328

if gnutls.has_rawpk:

2329

fpr = b""

2330

try:

2331

key_id = self.key_id(

2332

self.peer_certificate(session))

2333

except (TypeError, gnutls.Error) as error:

2334

logger.warning("Bad certificate: %s", error)

2335

return

2336

logger.debug("Key ID: %s", key_id)

2337

2338

else:

2339

key_id = b""

2340

try:

2341

fpr = self.fingerprint(

2342

self.peer_certificate(session))

2343

except (TypeError, gnutls.Error) as error:

2344

logger.warning("Bad certificate: %s", error)

2345

return

2346

logger.debug("Fingerprint: %s", fpr)

2347

2348

try:

2349

client = ProxyClient(child_pipe, key_id, fpr,

2168

try:

2169

fpr = self.fingerprint(

2170

self.peer_certificate(session))

2171

except (TypeError, gnutls.Error) as error:

2172

logger.warning("Bad certificate: %s", error)

2173

return

2174

logger.debug("Fingerprint: %s", fpr)

2175

2176

try:

2177

client = ProxyClient(child_pipe, fpr,

2350

2178

self.client_address)

2351

2179

except KeyError:

2352

2180

return

2353

2181

2354

2182

if client.approval_delay:

2355

2183

delay = client.approval_delay

2356

2184

client.approvals_pending += 1

2357

2185

approval_required = True

2358

2186

2359

2187

while True:

2360

2188

if not client.enabled:

2361

2189

logger.info("Client %s is disabled",

2364

2192

# Emit D-Bus signal

2365

2193

client.Rejected("Disabled")

2366

2194

return

2367

2195

2368

2196

if client.approved or not client.approval_delay:

2369

# We are approved or approval is disabled

2197

#We are approved or approval is disabled

2370

2198

break

2371

2199

elif client.approved is None:

2372

2200

logger.info("Client %s needs approval",

2383

2211

# Emit D-Bus signal

2384

2212

client.Rejected("Denied")

2385

2213

return

2386

2387

# wait until timeout or approved

2214

2215

#wait until timeout or approved

2388

2216

time = datetime.datetime.now()

2389

2217

client.changedstate.acquire()

2390

2218

client.changedstate.wait(delay.total_seconds())

2403

2231

break

2404

2232

else:

2405

2233

delay -= time2 - time

2406

2234

2407

2235

try:

2408

2236

session.send(client.secret)

2409

2237

except gnutls.Error as error:

2410

2238

logger.warning("gnutls send failed",

2411

exc_info=error)

2239

exc_info = error)

2412

2240

return

2413

2241

2414

2242

logger.info("Sending secret to %s", client.name)

2415

2243

# bump the timeout using extended_timeout

2416

2244

client.bump_timeout(client.extended_timeout)

2417

2245

if self.server.use_dbus:

2418

2246

# Emit D-Bus signal

2419

2247

client.GotSecret()

2420

2248

2421

2249

finally:

2422

2250

if approval_required:

2423

2251

client.approvals_pending -= 1

2426

2254

except gnutls.Error as error:

2427

2255

logger.warning("GnuTLS bye failed",

2428

2256

exc_info=error)

2429

2257

2430

2258

@staticmethod

2431

2259

def peer_certificate(session):

2432

"Return the peer's certificate as a bytestring"

2433

try:

2434

cert_type = gnutls.certificate_type_get2(session._c_object,

2435

gnutls.CTYPE_PEERS)

2436

except AttributeError:

2437

cert_type = gnutls.certificate_type_get(session._c_object)

2438

if gnutls.has_rawpk:

2439

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2440

else:

2441

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2442

# If not a valid certificate type...

2443

if cert_type not in valid_cert_types:

2444

logger.info("Cert type %r not in %r", cert_type,

2445

valid_cert_types)

2260

"Return the peer's OpenPGP certificate as a bytestring"

2261

# If not an OpenPGP certificate...

2262

if (gnutls.certificate_type_get(session._c_object)

2263

!= gnutls.CRT_OPENPGP):

2446

2264

# ...return invalid data

2447

2265

return b""

2448

2266

list_size = ctypes.c_uint(1)

2454

2272

return None

2455

2273

cert = cert_list[0]

2456

2274

return ctypes.string_at(cert.data, cert.size)

2457

2458

@staticmethod

2459

def key_id(certificate):

2460

"Convert a certificate bytestring to a hexdigit key ID"

2461

# New GnuTLS "datum" with the public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(certificate),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(certificate)))

2466

# XXX all these need to be created in the gnutls "module"

2467

# New empty GnuTLS certificate

2468

pubkey = gnutls.pubkey_t()

2469

gnutls.pubkey_init(ctypes.byref(pubkey))

2470

# Import the raw public key into the certificate

2471

gnutls.pubkey_import(pubkey,

2472

ctypes.byref(datum),

2473

gnutls.X509_FMT_DER)

2474

# New buffer for the key ID

2475

buf = ctypes.create_string_buffer(32)

2476

buf_len = ctypes.c_size_t(len(buf))

2477

# Get the key ID from the raw public key into the buffer

2478

gnutls.pubkey_get_key_id(

2479

pubkey,

2480

gnutls.KEYID_USE_SHA256,

2481

ctypes.cast(ctypes.byref(buf),

2482

ctypes.POINTER(ctypes.c_ubyte)),

2483

ctypes.byref(buf_len))

2484

# Deinit the certificate

2485

gnutls.pubkey_deinit(pubkey)

2486

2487

# Convert the buffer to a Python bytestring

2488

key_id = ctypes.string_at(buf, buf_len.value)

2489

# Convert the bytestring to hexadecimal notation

2490

hex_key_id = binascii.hexlify(key_id).upper()

2491

return hex_key_id

2492

2275

2493

2276

@staticmethod

2494

2277

def fingerprint(openpgp):

2495

2278

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2510

2293

ctypes.byref(crtverify))

2511

2294

if crtverify.value != 0:

2512

2295

gnutls.openpgp_crt_deinit(crt)

2513

raise gnutls.CertificateSecurityError(code

2514

=crtverify.value)

2296

raise gnutls.CertificateSecurityError("Verify failed")

2515

2297

# New buffer for the fingerprint

2516

2298

buf = ctypes.create_string_buffer(20)

2517

2299

buf_len = ctypes.c_size_t()

2527

2309

return hex_fpr

2528

2310

2529

2311

2530

class MultiprocessingMixIn:

2312

class MultiprocessingMixIn(object):

2531

2313

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2532

2314

2533

2315

def sub_process_main(self, request, address):

2534

2316

try:

2535

2317

self.finish_request(request, address)

2536

2318

except Exception:

2537

2319

self.handle_error(request, address)

2538

2320

self.close_request(request)

2539

2321

2540

2322

def process_request(self, request, address):

2541

2323

"""Start a new process to process the request."""

2542

proc = multiprocessing.Process(target=self.sub_process_main,

2543

args=(request, address))

2324

proc = multiprocessing.Process(target = self.sub_process_main,

2325

args = (request, address))

2544

2326

proc.start()

2545

2327

return proc

2546

2328

2547

2329

2548

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2330

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2549

2331

""" adds a pipe to the MixIn """

2550

2332

2551

2333

def process_request(self, request, client_address):

2552

2334

"""Overrides and wraps the original process_request().

2553

2335

2554

2336

This function creates a new pipe in self.pipe

2555

2337

"""

2556

2338

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2557

2339

2558

2340

proc = MultiprocessingMixIn.process_request(self, request,

2559

2341

client_address)

2560

2342

self.child_pipe.close()

2561

2343

self.add_pipe(parent_pipe, proc)

2562

2344

2563

2345

def add_pipe(self, parent_pipe, proc):

2564

2346

"""Dummy function; override as necessary"""

2565

2347

raise NotImplementedError()

2566

2348

2567

2349

2568

2350

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2569

socketserver.TCPServer):

2351

socketserver.TCPServer, object):

2570

2352

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2571

2353

2572

2354

Attributes:

2573

2355

enabled: Boolean; whether this server is activated yet

2574

2356

interface: None or a network interface name (string)

2575

2357

use_ipv6: Boolean; to use IPv6 or not

2576

2358

"""

2577

2359

2578

2360

def __init__(self, server_address, RequestHandlerClass,

2579

2361

interface=None,

2580

2362

use_ipv6=True,

2590

2372

self.socketfd = socketfd

2591

2373

# Save the original socket.socket() function

2592

2374

self.socket_socket = socket.socket

2593

2594

2375

# To implement --socket, we monkey patch socket.socket.

2595

#

2376

#

2596

2377

# (When socketserver.TCPServer is a new-style class, we

2597

2378

# could make self.socket into a property instead of monkey

2598

2379

# patching socket.socket.)

2599

#

2380

#

2600

2381

# Create a one-time-only replacement for socket.socket()

2601

2382

@functools.wraps(socket.socket)

2602

2383

def socket_wrapper(*args, **kwargs):

2614

2395

# socket_wrapper(), if socketfd was set.

2615

2396

socketserver.TCPServer.__init__(self, server_address,

2616

2397

RequestHandlerClass)

2617

2398

2618

2399

def server_bind(self):

2619

2400

"""This overrides the normal server_bind() function

2620

2401

to bind to an interface if one was specified, and also NOT to

2621

2402

bind to an address or port if they were not specified."""

2622

global SO_BINDTODEVICE

2623

2403

if self.interface is not None:

2624

2404

if SO_BINDTODEVICE is None:

2625

# Fall back to a hard-coded value which seems to be

2626

# common enough.

2627

logger.warning("SO_BINDTODEVICE not found, trying 25")

2628

SO_BINDTODEVICE = 25

2629

try:

2630

self.socket.setsockopt(

2631

socket.SOL_SOCKET, SO_BINDTODEVICE,

2632

(self.interface + "\0").encode("utf-8"))

2633

except socket.error as error:

2634

if error.errno == errno.EPERM:

2635

logger.error("No permission to bind to"

2636

" interface %s", self.interface)

2637

elif error.errno == errno.ENOPROTOOPT:

2638

logger.error("SO_BINDTODEVICE not available;"

2639

" cannot bind to interface %s",

2640

self.interface)

2641

elif error.errno == errno.ENODEV:

2642

logger.error("Interface %s does not exist,"

2643

" cannot bind", self.interface)

2644

else:

2645

raise

2405

logger.error("SO_BINDTODEVICE does not exist;"

2406

" cannot bind to interface %s",

2407

self.interface)

2408

else:

2409

try:

2410

self.socket.setsockopt(

2411

socket.SOL_SOCKET, SO_BINDTODEVICE,

2412

(self.interface + "\0").encode("utf-8"))

2413

except socket.error as error:

2414

if error.errno == errno.EPERM:

2415

logger.error("No permission to bind to"

2416

" interface %s", self.interface)

2417

elif error.errno == errno.ENOPROTOOPT:

2418

logger.error("SO_BINDTODEVICE not available;"

2419

" cannot bind to interface %s",

2420

self.interface)

2421

elif error.errno == errno.ENODEV:

2422

logger.error("Interface %s does not exist,"

2423

" cannot bind", self.interface)

2424

else:

2425

raise

2646

2426

# Only bind(2) the socket if we really need to.

2647

2427

if self.server_address[0] or self.server_address[1]:

2648

if self.server_address[1]:

2649

self.allow_reuse_address = True

2650

2428

if not self.server_address[0]:

2651

2429

if self.address_family == socket.AF_INET6:

2652

any_address = "::" # in6addr_any

2430

any_address = "::" # in6addr_any

2653

2431

else:

2654

any_address = "0.0.0.0" # INADDR_ANY

2432

any_address = "0.0.0.0" # INADDR_ANY

2655

2433

self.server_address = (any_address,

2656

2434

self.server_address[1])

2657

2435

elif not self.server_address[1]:

2667

2445

2668

2446

class MandosServer(IPv6_TCPServer):

2669

2447

"""Mandos server.

2670

2448

2671

2449

Attributes:

2672

2450

clients: set of Client objects

2673

2451

gnutls_priority GnuTLS priority string

2674

2452

use_dbus: Boolean; to emit D-Bus signals or not

2675

2676

Assumes a GLib.MainLoop event loop.

2453

2454

Assumes a gobject.MainLoop event loop.

2677

2455

"""

2678

2456

2679

2457

def __init__(self, server_address, RequestHandlerClass,

2680

2458

interface=None,

2681

2459

use_ipv6=True,

2691

2469

self.gnutls_priority = gnutls_priority

2692

2470

IPv6_TCPServer.__init__(self, server_address,

2693

2471

RequestHandlerClass,

2694

interface=interface,

2695

use_ipv6=use_ipv6,

2696

socketfd=socketfd)

2697

2472

interface = interface,

2473

use_ipv6 = use_ipv6,

2474

socketfd = socketfd)

2475

2698

2476

def server_activate(self):

2699

2477

if self.enabled:

2700

2478

return socketserver.TCPServer.server_activate(self)

2701

2479

2702

2480

def enable(self):

2703

2481

self.enabled = True

2704

2482

2705

2483

def add_pipe(self, parent_pipe, proc):

2706

2484

# Call "handle_ipc" for both data and EOF events

2707

GLib.io_add_watch(

2708

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2709

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2485

gobject.io_add_watch(

2486

parent_pipe.fileno(),

2487

gobject.IO_IN | gobject.IO_HUP,

2710

2488

functools.partial(self.handle_ipc,

2711

parent_pipe=parent_pipe,

2712

proc=proc))

2713

2489

parent_pipe = parent_pipe,

2490

proc = proc))

2491

2714

2492

def handle_ipc(self, source, condition,

2715

2493

parent_pipe=None,

2716

proc=None,

2494

proc = None,

2717

2495

client_object=None):

2718

2496

# error, or the other end of multiprocessing.Pipe has closed

2719

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2497

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2720

2498

# Wait for other process to exit

2721

2499

proc.join()

2722

2500

return False

2723

2501

2724

2502

# Read a request from the child

2725

2503

request = parent_pipe.recv()

2726

2504

command = request[0]

2727

2505

2728

2506

if command == 'init':

2729

key_id = request[1].decode("ascii")

2730

fpr = request[2].decode("ascii")

2731

address = request[3]

2732

2733

for c in self.clients.values():

2734

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2735

"27AE41E4649B934CA495991B7852B855"):

2736

continue

2737

if key_id and c.key_id == key_id:

2738

client = c

2739

break

2740

if fpr and c.fingerprint == fpr:

2507

fpr = request[1]

2508

address = request[2]

2509

2510

for c in self.clients.itervalues():

2511

if c.fingerprint == fpr:

2741

2512

client = c

2742

2513

break

2743

2514

else:

2744

logger.info("Client not found for key ID: %s, address"

2745

": %s", key_id or fpr, address)

2515

logger.info("Client not found for fingerprint: %s, ad"

2516

"dress: %s", fpr, address)

2746

2517

if self.use_dbus:

2747

2518

# Emit D-Bus signal

2748

mandos_dbus_service.ClientNotFound(key_id or fpr,

2519

mandos_dbus_service.ClientNotFound(fpr,

2749

2520

address[0])

2750

2521

parent_pipe.send(False)

2751

2522

return False

2752

2753

GLib.io_add_watch(

2754

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2755

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2523

2524

gobject.io_add_watch(

2525

parent_pipe.fileno(),

2526

gobject.IO_IN | gobject.IO_HUP,

2756

2527

functools.partial(self.handle_ipc,

2757

parent_pipe=parent_pipe,

2758

proc=proc,

2759

client_object=client))

2528

parent_pipe = parent_pipe,

2529

proc = proc,

2530

client_object = client))

2760

2531

parent_pipe.send(True)

2761

2532

# remove the old hook in favor of the new above hook on

2762

2533

# same fileno

2765

2536

funcname = request[1]

2766

2537

args = request[2]

2767

2538

kwargs = request[3]

2768

2539

2769

2540

parent_pipe.send(('data', getattr(client_object,

2770

2541

funcname)(*args,

2771

2542

**kwargs)))

2772

2543

2773

2544

if command == 'getattr':

2774

2545

attrname = request[1]

2775

2546

if isinstance(client_object.__getattribute__(attrname),

2776

collections.abc.Callable):

2547

collections.Callable):

2777

2548

parent_pipe.send(('function', ))

2778

2549

else:

2779

2550

parent_pipe.send((

2780

2551

'data', client_object.__getattribute__(attrname)))

2781

2552

2782

2553

if command == 'setattr':

2783

2554

attrname = request[1]

2784

2555

value = request[2]

2785

2556

setattr(client_object, attrname, value)

2786

2557

2787

2558

return True

2788

2559

2789

2560

2790

2561

def rfc3339_duration_to_delta(duration):

2791

2562

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2792

2793

>>> timedelta = datetime.timedelta

2794

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2795

True

2796

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2797

True

2798

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2799

True

2800

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2801

True

2802

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2803

True

2804

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2805

True

2806

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2807

True

2808

>>> del timedelta

2563

2564

>>> rfc3339_duration_to_delta("P7D")

2565

datetime.timedelta(7)

2566

>>> rfc3339_duration_to_delta("PT60S")

2567

datetime.timedelta(0, 60)

2568

>>> rfc3339_duration_to_delta("PT60M")

2569

datetime.timedelta(0, 3600)

2570

>>> rfc3339_duration_to_delta("PT24H")

2571

datetime.timedelta(1)

2572

>>> rfc3339_duration_to_delta("P1W")

2573

datetime.timedelta(7)

2574

>>> rfc3339_duration_to_delta("PT5M30S")

2575

datetime.timedelta(0, 330)

2576

>>> rfc3339_duration_to_delta("P1DT3M20S")

2577

datetime.timedelta(1, 200)

2809

2578

"""

2810

2579

2811

2580

# Parsing an RFC 3339 duration with regular expressions is not

2812

2581

# possible - there would have to be multiple places for the same

2813

2582

# values, like seconds. The current code, while more esoteric, is

2814

2583

# cleaner without depending on a parsing library. If Python had a

2815

2584

# built-in library for parsing we would use it, but we'd like to

2816

2585

# avoid excessive use of external libraries.

2817

2586

2818

2587

# New type for defining tokens, syntax, and semantics all-in-one

2819

2588

Token = collections.namedtuple("Token", (

2820

2589

"regexp", # To match token; if "value" is not None, must have

2853

2622

frozenset((token_year, token_month,

2854

2623

token_day, token_time,

2855

2624

token_week)))

2856

# Define starting values:

2857

# Value so far

2858

value = datetime.timedelta()

2625

# Define starting values

2626

value = datetime.timedelta() # Value so far

2859

2627

found_token = None

2860

# Following valid tokens

2861

followers = frozenset((token_duration, ))

2862

# String left to parse

2863

s = duration

2628

followers = frozenset((token_duration, )) # Following valid tokens

2629

s = duration # String left to parse

2864

2630

# Loop until end token is found

2865

2631

while found_token is not token_end:

2866

2632

# Search for any currently valid tokens

2890

2656

2891

2657

def string_to_delta(interval):

2892

2658

"""Parse a string and return a datetime.timedelta

2893

2894

>>> string_to_delta('7d') == datetime.timedelta(7)

2895

True

2896

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2897

True

2898

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2899

True

2900

>>> string_to_delta('24h') == datetime.timedelta(1)

2901

True

2902

>>> string_to_delta('1w') == datetime.timedelta(7)

2903

True

2904

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2905

True

2659

2660

>>> string_to_delta('7d')

2661

datetime.timedelta(7)

2662

>>> string_to_delta('60s')

2663

datetime.timedelta(0, 60)

2664

>>> string_to_delta('60m')

2665

datetime.timedelta(0, 3600)

2666

>>> string_to_delta('24h')

2667

datetime.timedelta(1)

2668

>>> string_to_delta('1w')

2669

datetime.timedelta(7)

2670

>>> string_to_delta('5m 30s')

2671

datetime.timedelta(0, 330)

2906

2672

"""

2907

2673

2908

2674

try:

2909

2675

return rfc3339_duration_to_delta(interval)

2910

2676

except ValueError:

2911

2677

pass

2912

2678

2913

2679

timevalue = datetime.timedelta(0)

2914

2680

for s in interval.split():

2915

2681

try:

2933

2699

return timevalue

2934

2700

2935

2701

2936

def daemon(nochdir=False, noclose=False):

2702

def daemon(nochdir = False, noclose = False):

2937

2703

"""See daemon(3). Standard BSD Unix function.

2938

2704

2939

2705

This should really exist as os.daemon, but it doesn't (yet)."""

2940

2706

if os.fork():

2941

2707

sys.exit()

2959

2725

2960

2726

2961

2727

def main():

2962

2728

2963

2729

##################################################################

2964

2730

# Parsing of options, both command line and config file

2965

2731

2966

2732

parser = argparse.ArgumentParser()

2967

2733

parser.add_argument("-v", "--version", action="version",

2968

version="%(prog)s {}".format(version),

2734

version = "%(prog)s {}".format(version),

2969

2735

help="show version number and exit")

2970

2736

parser.add_argument("-i", "--interface", metavar="IF",

2971

2737

help="Bind to interface IF")

3007

2773

parser.add_argument("--no-zeroconf", action="store_false",

3008

2774

dest="zeroconf", help="Do not use Zeroconf",

3009

2775

default=None)

3010

2776

3011

2777

options = parser.parse_args()

3012

2778

2779

if options.check:

2780

import doctest

2781

fail_count, test_count = doctest.testmod()

2782

sys.exit(os.EX_OK if fail_count == 0 else 1)

2783

3013

2784

# Default values for config file for server-global settings

3014

if gnutls.has_rawpk:

3015

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3016

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3017

else:

3018

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3019

":+SIGN-DSA-SHA256")

3020

server_defaults = {"interface": "",

3021

"address": "",

3022

"port": "",

3023

"debug": "False",

3024

"priority": priority,

3025

"servicename": "Mandos",

3026

"use_dbus": "True",

3027

"use_ipv6": "True",

3028

"debuglevel": "",

3029

"restore": "True",

3030

"socket": "",

3031

"statedir": "/var/lib/mandos",

3032

"foreground": "False",

3033

"zeroconf": "True",

3034

}

3035

del priority

3036

2785

server_defaults = { "interface": "",

2786

"address": "",

2787

"port": "",

2788

"debug": "False",

2789

"priority":

2790

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2791

":+SIGN-DSA-SHA256",

2792

"servicename": "Mandos",

2793

"use_dbus": "True",

2794

"use_ipv6": "True",

2795

"debuglevel": "",

2796

"restore": "True",

2797

"socket": "",

2798

"statedir": "/var/lib/mandos",

2799

"foreground": "False",

2800

"zeroconf": "True",

2801

}

2802

3037

2803

# Parse config file for server-global settings

3038

server_config = configparser.ConfigParser(server_defaults)

2804

server_config = configparser.SafeConfigParser(server_defaults)

3039

2805

del server_defaults

3040

2806

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3041

# Convert the ConfigParser object to a dict

2807

# Convert the SafeConfigParser object to a dict

3042

2808

server_settings = server_config.defaults()

3043

2809

# Use the appropriate methods on the non-string config options

3044

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3045

"foreground", "zeroconf"):

2810

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3046

2811

server_settings[option] = server_config.getboolean("DEFAULT",

3047

2812

option)

3048

2813

if server_settings["port"]:

3058

2823

server_settings["socket"] = os.dup(server_settings

3059

2824

["socket"])

3060

2825

del server_config

3061

2826

3062

2827

# Override the settings from the config file with command line

3063

2828

# options, if set.

3064

2829

for option in ("interface", "address", "port", "debug",

3082

2847

if server_settings["debug"]:

3083

2848

server_settings["foreground"] = True

3084

2849

# Now we have our good server settings in "server_settings"

3085

2850

3086

2851

##################################################################

3087

2852

3088

2853

if (not server_settings["zeroconf"]

3089

2854

and not (server_settings["port"]

3090

2855

or server_settings["socket"] != "")):

3091

2856

parser.error("Needs port or socket to work without Zeroconf")

3092

2857

3093

2858

# For convenience

3094

2859

debug = server_settings["debug"]

3095

2860

debuglevel = server_settings["debuglevel"]

3099

2864

stored_state_file)

3100

2865

foreground = server_settings["foreground"]

3101

2866

zeroconf = server_settings["zeroconf"]

3102

2867

3103

2868

if debug:

3104

2869

initlogger(debug, logging.DEBUG)

3105

2870

else:

3108

2873

else:

3109

2874

level = getattr(logging, debuglevel.upper())

3110

2875

initlogger(debug, level)

3111

2876

3112

2877

if server_settings["servicename"] != "Mandos":

3113

2878

syslogger.setFormatter(

3114

2879

logging.Formatter('Mandos ({}) [%(process)d]:'

3115

2880

' %(levelname)s: %(message)s'.format(

3116

2881

server_settings["servicename"])))

3117

2882

3118

2883

# Parse config file with clients

3119

client_config = configparser.ConfigParser(Client.client_defaults)

2884

client_config = configparser.SafeConfigParser(Client

2885

.client_defaults)

3120

2886

client_config.read(os.path.join(server_settings["configdir"],

3121

2887

"clients.conf"))

3122

2888

3123

2889

global mandos_dbus_service

3124

2890

mandos_dbus_service = None

3125

2891

3126

2892

socketfd = None

3127

2893

if server_settings["socket"] != "":

3128

2894

socketfd = server_settings["socket"]

3144

2910

except IOError as e:

3145

2911

logger.error("Could not open file %r", pidfilename,

3146

2912

exc_info=e)

3147

3148

for name, group in (("_mandos", "_mandos"),

3149

("mandos", "mandos"),

3150

("nobody", "nogroup")):

2913

2914

for name in ("_mandos", "mandos", "nobody"):

3151

2915

try:

3152

2916

uid = pwd.getpwnam(name).pw_uid

3153

gid = pwd.getpwnam(group).pw_gid

2917

gid = pwd.getpwnam(name).pw_gid

3154

2918

break

3155

2919

except KeyError:

3156

2920

continue

3160

2924

try:

3161

2925

os.setgid(gid)

3162

2926

os.setuid(uid)

3163

if debug:

3164

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3165

gid))

3166

2927

except OSError as error:

3167

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3168

.format(uid, gid, os.strerror(error.errno)))

3169

2928

if error.errno != errno.EPERM:

3170

2929

raise

3171

2930

3172

2931

if debug:

3173

2932

# Enable all possible GnuTLS debugging

3174

2933

3175

2934

# "Use a log level over 10 to enable all debugging options."

3176

2935

# - GnuTLS manual

3177

2936

gnutls.global_set_log_level(11)

3178

2937

3179

2938

@gnutls.log_func

3180

2939

def debug_gnutls(level, string):

3181

2940

logger.debug("GnuTLS: %s", string[:-1])

3182

2941

3183

2942

gnutls.global_set_log_function(debug_gnutls)

3184

2943

3185

2944

# Redirect stdin so all checkers get /dev/null

3186

2945

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3187

2946

os.dup2(null, sys.stdin.fileno())

3188

2947

if null > 2:

3189

2948

os.close(null)

3190

2949

3191

2950

# Need to fork before connecting to D-Bus

3192

2951

if not foreground:

3193

2952

# Close all input and output, do double fork, etc.

3194

2953

daemon()

3195

3196

if gi.version_info < (3, 10, 2):

3197

# multiprocessing will use threads, so before we use GLib we

3198

# need to inform GLib that threads will be used.

3199

GLib.threads_init()

3200

2954

2955

# multiprocessing will use threads, so before we use gobject we

2956

# need to inform gobject that threads will be used.

2957

gobject.threads_init()

2958

3201

2959

global main_loop

3202

2960

# From the Avahi example code

3203

2961

DBusGMainLoop(set_as_default=True)

3204

main_loop = GLib.MainLoop()

2962

main_loop = gobject.MainLoop()

3205

2963

bus = dbus.SystemBus()

3206

2964

# End of Avahi example code

3207

2965

if use_dbus:

3220

2978

if zeroconf:

3221

2979

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3222

2980

service = AvahiServiceToSyslog(

3223

name=server_settings["servicename"],

3224

servicetype="_mandos._tcp",

3225

protocol=protocol,

3226

bus=bus)

2981

name = server_settings["servicename"],

2982

servicetype = "_mandos._tcp",

2983

protocol = protocol,

2984

bus = bus)

3227

2985

if server_settings["interface"]:

3228

2986

service.interface = if_nametoindex(

3229

2987

server_settings["interface"].encode("utf-8"))

3230

2988

3231

2989

global multiprocessing_manager

3232

2990

multiprocessing_manager = multiprocessing.Manager()

3233

2991

3234

2992

client_class = Client

3235

2993

if use_dbus:

3236

client_class = functools.partial(ClientDBus, bus=bus)

3237

2994

client_class = functools.partial(ClientDBus, bus = bus)

2995

3238

2996

client_settings = Client.config_parser(client_config)

3239

2997

old_client_settings = {}

3240

2998

clients_data = {}

3241

2999

3242

3000

# This is used to redirect stdout and stderr for checker processes

3243

3001

global wnull

3244

wnull = open(os.devnull, "w") # A writable /dev/null

3002

wnull = open(os.devnull, "w") # A writable /dev/null

3245

3003

# Only used if server is running in foreground but not in debug

3246

3004

# mode

3247

3005

if debug or not foreground:

3248

3006

wnull.close()

3249

3007

3250

3008

# Get client data and settings from last running state.

3251

3009

if server_settings["restore"]:

3252

3010

try:

3253

3011

with open(stored_state_path, "rb") as stored_state:

3254

if sys.version_info.major == 2:

3255

clients_data, old_client_settings = pickle.load(

3256

stored_state)

3257

else:

3258

bytes_clients_data, bytes_old_client_settings = (

3259

pickle.load(stored_state, encoding="bytes"))

3260

# Fix bytes to strings

3261

# clients_data

3262

# .keys()

3263

clients_data = {(key.decode("utf-8")

3264

if isinstance(key, bytes)

3265

else key): value

3266

for key, value in

3267

bytes_clients_data.items()}

3268

del bytes_clients_data

3269

for key in clients_data:

3270

value = {(k.decode("utf-8")

3271

if isinstance(k, bytes) else k): v

3272

for k, v in

3273

clients_data[key].items()}

3274

clients_data[key] = value

3275

# .client_structure

3276

value["client_structure"] = [

3277

(s.decode("utf-8")

3278

if isinstance(s, bytes)

3279

else s) for s in

3280

value["client_structure"]]

3281

# .name, .host, and .checker_command

3282

for k in ("name", "host", "checker_command"):

3283

if isinstance(value[k], bytes):

3284

value[k] = value[k].decode("utf-8")

3285

if "key_id" not in value:

3286

value["key_id"] = ""

3287

elif "fingerprint" not in value:

3288

value["fingerprint"] = ""

3289

# old_client_settings

3290

# .keys()

3291

old_client_settings = {

3292

(key.decode("utf-8")

3293

if isinstance(key, bytes)

3294

else key): value

3295

for key, value in

3296

bytes_old_client_settings.items()}

3297

del bytes_old_client_settings

3298

# .host and .checker_command

3299

for value in old_client_settings.values():

3300

for attribute in ("host", "checker_command"):

3301

if isinstance(value[attribute], bytes):

3302

value[attribute] = (value[attribute]

3303

.decode("utf-8"))

3012

clients_data, old_client_settings = pickle.load(

3013

stored_state)

3304

3014

os.remove(stored_state_path)

3305

3015

except IOError as e:

3306

3016

if e.errno == errno.ENOENT:

3314

3024

logger.warning("Could not load persistent state: "

3315

3025

"EOFError:",

3316

3026

exc_info=e)

3317

3027

3318

3028

with PGPEngine() as pgp:

3319

3029

for client_name, client in clients_data.items():

3320

3030

# Skip removed clients

3321

3031

if client_name not in client_settings:

3322

3032

continue

3323

3033

3324

3034

# Decide which value to use after restoring saved state.

3325

3035

# We have three different values: Old config file,

3326

3036

# new config file, and saved state.

3337

3047

client[name] = value

3338

3048

except KeyError:

3339

3049

pass

3340

3050

3341

3051

# Clients who has passed its expire date can still be

3342

3052

# enabled if its last checker was successful. A Client

3343

3053

# whose checker succeeded before we stored its state is

3376

3086

client_name))

3377

3087

client["secret"] = (client_settings[client_name]

3378

3088

["secret"])

3379

3089

3380

3090

# Add/remove clients based on new changes made to config

3381

3091

for client_name in (set(old_client_settings)

3382

3092

- set(client_settings)):

3384

3094

for client_name in (set(client_settings)

3385

3095

- set(old_client_settings)):

3386

3096

clients_data[client_name] = client_settings[client_name]

3387

3097

3388

3098

# Create all client objects

3389

3099

for client_name, client in clients_data.items():

3390

3100

tcp_server.clients[client_name] = client_class(

3391

name=client_name,

3392

settings=client,

3393

server_settings=server_settings)

3394

3101

name = client_name,

3102

settings = client,

3103

server_settings = server_settings)

3104

3395

3105

if not tcp_server.clients:

3396

3106

logger.warning("No clients defined")

3397

3107

3398

3108

if not foreground:

3399

3109

if pidfile is not None:

3400

3110

pid = os.getpid()

3406

3116

pidfilename, pid)

3407

3117

del pidfile

3408

3118

del pidfilename

3409

3410

for termsig in (signal.SIGHUP, signal.SIGTERM):

3411

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3412

lambda: main_loop.quit() and False)

3413

3119

3120

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

3121

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3122

3414

3123

if use_dbus:

3415

3124

3416

3125

@alternate_dbus_interfaces(

3417

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3126

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3418

3127

class MandosDBusService(DBusObjectWithObjectManager):

3419

3128

"""A D-Bus proxy object"""

3420

3129

3421

3130

def __init__(self):

3422

3131

dbus.service.Object.__init__(self, bus, "/")

3423

3132

3424

3133

_interface = "se.recompile.Mandos"

3425

3134

3426

3135

@dbus.service.signal(_interface, signature="o")

3427

3136

def ClientAdded(self, objpath):

3428

3137

"D-Bus signal"

3429

3138

pass

3430

3139

3431

3140

@dbus.service.signal(_interface, signature="ss")

3432

def ClientNotFound(self, key_id, address):

3141

def ClientNotFound(self, fingerprint, address):

3433

3142

"D-Bus signal"

3434

3143

pass

3435

3144

3436

3145

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3437

3146

"true"})

3438

3147

@dbus.service.signal(_interface, signature="os")

3439

3148

def ClientRemoved(self, objpath, name):

3440

3149

"D-Bus signal"

3441

3150

pass

3442

3151

3443

3152

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3444

3153

"true"})

3445

3154

@dbus.service.method(_interface, out_signature="ao")

3446

3155

def GetAllClients(self):

3447

3156

"D-Bus method"

3448

3157

return dbus.Array(c.dbus_object_path for c in

3449

tcp_server.clients.values())

3450

3158

tcp_server.clients.itervalues())

3159

3451

3160

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3452

3161

"true"})

3453

3162

@dbus.service.method(_interface,

3455

3164

def GetAllClientsWithProperties(self):

3456

3165

"D-Bus method"

3457

3166

return dbus.Dictionary(

3458

{c.dbus_object_path: c.GetAll(

3167

{ c.dbus_object_path: c.GetAll(

3459

3168

"se.recompile.Mandos.Client")

3460

for c in tcp_server.clients.values()},

3169

for c in tcp_server.clients.itervalues() },

3461

3170

signature="oa{sv}")

3462

3171

3463

3172

@dbus.service.method(_interface, in_signature="o")

3464

3173

def RemoveClient(self, object_path):

3465

3174

"D-Bus method"

3466

for c in tcp_server.clients.values():

3175

for c in tcp_server.clients.itervalues():

3467

3176

if c.dbus_object_path == object_path:

3468

3177

del tcp_server.clients[c.name]

3469

3178

c.remove_from_connection()

3473

3182

self.client_removed_signal(c)

3474

3183

return

3475

3184

raise KeyError(object_path)

3476

3185

3477

3186

del _interface

3478

3187

3479

3188

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3480

out_signature="a{oa{sa{sv}}}")

3189

out_signature = "a{oa{sa{sv}}}")

3481

3190

def GetManagedObjects(self):

3482

3191

"""D-Bus method"""

3483

3192

return dbus.Dictionary(

3484

{client.dbus_object_path:

3485

dbus.Dictionary(

3486

{interface: client.GetAll(interface)

3487

for interface in

3488

client._get_all_interface_names()})

3489

for client in tcp_server.clients.values()})

3490

3193

{ client.dbus_object_path:

3194

dbus.Dictionary(

3195

{ interface: client.GetAll(interface)

3196

for interface in

3197

client._get_all_interface_names()})

3198

for client in tcp_server.clients.values()})

3199

3491

3200

def client_added_signal(self, client):

3492

3201

"""Send the new standard signal and the old signal"""

3493

3202

if use_dbus:

3495

3204

self.InterfacesAdded(

3496

3205

client.dbus_object_path,

3497

3206

dbus.Dictionary(

3498

{interface: client.GetAll(interface)

3499

for interface in

3500

client._get_all_interface_names()}))

3207

{ interface: client.GetAll(interface)

3208

for interface in

3209

client._get_all_interface_names()}))

3501

3210

# Old signal

3502

3211

self.ClientAdded(client.dbus_object_path)

3503

3212

3504

3213

def client_removed_signal(self, client):

3505

3214

"""Send the new standard signal and the old signal"""

3506

3215

if use_dbus:

3511

3220

# Old signal

3512

3221

self.ClientRemoved(client.dbus_object_path,

3513

3222

client.name)

3514

3223

3515

3224

mandos_dbus_service = MandosDBusService()

3516

3517

# Save modules to variables to exempt the modules from being

3518

# unloaded before the function registered with atexit() is run.

3519

mp = multiprocessing

3520

wn = wnull

3521

3225

3522

3226

def cleanup():

3523

3227

"Cleanup function; run on exit"

3524

3228

if zeroconf:

3525

3229

service.cleanup()

3526

3527

mp.active_children()

3528

wn.close()

3230

3231

multiprocessing.active_children()

3232

wnull.close()

3529

3233

if not (tcp_server.clients or client_settings):

3530

3234

return

3531

3235

3532

3236

# Store client before exiting. Secrets are encrypted with key

3533

3237

# based on what config file has. If config file is

3534

3238

# removed/edited, old secret will thus be unrecovable.

3535

3239

clients = {}

3536

3240

with PGPEngine() as pgp:

3537

for client in tcp_server.clients.values():

3241

for client in tcp_server.clients.itervalues():

3538

3242

key = client_settings[client.name]["secret"]

3539

3243

client.encrypted_secret = pgp.encrypt(client.secret,

3540

3244

key)

3541

3245

client_dict = {}

3542

3246

3543

3247

# A list of attributes that can not be pickled

3544

3248

# + secret.

3545

exclude = {"bus", "changedstate", "secret",

3546

"checker", "server_settings"}

3249

exclude = { "bus", "changedstate", "secret",

3250

"checker", "server_settings" }

3547

3251

for name, typ in inspect.getmembers(dbus.service

3548

3252

.Object):

3549

3253

exclude.add(name)

3550

3254

3551

3255

client_dict["encrypted_secret"] = (client

3552

3256

.encrypted_secret)

3553

3257

for attr in client.client_structure:

3554

3258

if attr not in exclude:

3555

3259

client_dict[attr] = getattr(client, attr)

3556

3260

3557

3261

clients[client.name] = client_dict

3558

3262

del client_settings[client.name]["secret"]

3559

3263

3560

3264

try:

3561

3265

with tempfile.NamedTemporaryFile(

3562

3266

mode='wb',

3564

3268

prefix='clients-',

3565

3269

dir=os.path.dirname(stored_state_path),

3566

3270

delete=False) as stored_state:

3567

pickle.dump((clients, client_settings), stored_state,

3568

protocol=2)

3271

pickle.dump((clients, client_settings), stored_state)

3569

3272

tempname = stored_state.name

3570

3273

os.rename(tempname, stored_state_path)

3571

3274

except (IOError, OSError) as e:

3581

3284

logger.warning("Could not save persistent state:",

3582

3285

exc_info=e)

3583

3286

raise

3584

3287

3585

3288

# Delete all clients, and settings from config

3586

3289

while tcp_server.clients:

3587

3290

name, client = tcp_server.clients.popitem()

3593

3296

if use_dbus:

3594

3297

mandos_dbus_service.client_removed_signal(client)

3595

3298

client_settings.clear()

3596

3299

3597

3300

atexit.register(cleanup)

3598

3599

for client in tcp_server.clients.values():

3301

3302

for client in tcp_server.clients.itervalues():

3600

3303

if use_dbus:

3601

3304

# Emit D-Bus signal for adding

3602

3305

mandos_dbus_service.client_added_signal(client)

3603

3306

# Need to initiate checking of clients

3604

3307

if client.enabled:

3605

3308

client.init_checker()

3606

3309

3607

3310

tcp_server.enable()

3608

3311

tcp_server.server_activate()

3609

3312

3610

3313

# Find out what port we got

3611

3314

if zeroconf:

3612

3315

service.port = tcp_server.socket.getsockname()[1]

3617

3320

else: # IPv4

3618

3321

logger.info("Now listening on address %r, port %d",

3619

3322

*tcp_server.socket.getsockname())

3620

3621

# service.interface = tcp_server.socket.getsockname()[3]

3622

3323

3324

#service.interface = tcp_server.socket.getsockname()[3]

3325

3623

3326

try:

3624

3327

if zeroconf:

3625

3328

# From the Avahi example code

3630

3333

cleanup()

3631

3334

sys.exit(1)

3632

3335

# End of Avahi example code

3633

3634

GLib.io_add_watch(

3635

GLib.IOChannel.unix_new(tcp_server.fileno()),

3636

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3637

lambda *args, **kwargs: (tcp_server.handle_request

3638

(*args[2:], **kwargs) or True))

3639

3336

3337

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3338

lambda *args, **kwargs:

3339

(tcp_server.handle_request

3340

(*args[2:], **kwargs) or True))

3341

3640

3342

logger.debug("Starting main loop")

3641

3343

main_loop.run()

3642

3344

except AvahiError as error:

3651

3353

# Must run before the D-Bus bus name gets deregistered

3652

3354

cleanup()

3653

3355

3654

3655

def should_only_run_tests():

3656

parser = argparse.ArgumentParser(add_help=False)

3657

parser.add_argument("--check", action='store_true')

3658

args, unknown_args = parser.parse_known_args()

3659

run_tests = args.check

3660

if run_tests:

3661

# Remove --check argument from sys.argv

3662

sys.argv[1:] = unknown_args

3663

return run_tests

3664

3665

# Add all tests from doctest strings

3666

def load_tests(loader, tests, none):

3667

import doctest

3668

tests.addTests(doctest.DocTestSuite())

3669

return tests

3670

3356

3671

3357

if __name__ == '__main__':

3672

try:

3673

if should_only_run_tests():

3674

# Call using ./mandos --check [--verbose]

3675

unittest.main()

3676

else:

3677

main()

3678

finally:

3679

logging.shutdown()

3358

main()