To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.376
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.376
- Committer: Teddy Hogeborn
- Date: 2016-03-09 21:23:21 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 339.
- Revision ID: teddy@recompile.se-20160309212321-2qlkzj9tecepc8xq
Server: Add Python 3 compatibility
Add Python 3 compatibility by not using the python-avahi module. Also
fix miscellaneous things which differs in Python 3. Especially hard
to fix is loading and saving clients data between Python 3 and 2,
since pickle formats have problems with strings.
* INSTALL: Remove python-avahi (and change python-gobject to
python-gi, which is preferred now).
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python-avahi".
* mandos: Wrap future_builtins import in try-except clause. Do not
import avahi module. Use codecs.decode(..., "base64) instead of
.decode("base64). Use .keys(), .values(), and .items() instead of
.iterkeys(), .itervalues(), and .iteritems().
(alternate_dbus_interfaces/wrapper): Python 3 still requires the
"black magic", but luckily it still works. The Python 3 type()
constructor requires first argument to be a string, not a byte
string.
(copy_function): New. Use throughout.
(Avahi, avahi): New class and global variable.
(GnuTLS._need_version): Changed to be a byte string.
(main): Decode byte strings loaded from pickle file.
(main/cleanup): Dump using pickle prototoc 2 which Python 2 can
read.
Add Python 3 compatibility by not using the python-avahi module. Also
fix miscellaneous things which differs in Python 3. Especially hard
to fix is loading and saving clients data between Python 3 and 2,
since pickle formats have problems with strings.
* INSTALL: Remove python-avahi (and change python-gobject to
python-gi, which is preferred now).
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python-avahi".
* mandos: Wrap future_builtins import in try-except clause. Do not
import avahi module. Use codecs.decode(..., "base64) instead of
.decode("base64). Use .keys(), .values(), and .items() instead of
.iterkeys(), .itervalues(), and .iteritems().
(alternate_dbus_interfaces/wrapper): Python 3 still requires the
"black magic", but luckily it still works. The Python 3 type()
constructor requires first argument to be a string, not a byte
string.
(copy_function): New. Use throughout.
(Avahi, avahi): New class and global variable.
(GnuTLS._need_version): Changed to be a byte string.
(main): Decode byte strings loaded from pickle file.
(main/cleanup): Dump using pickle prototoc 2 which Python 2 can
read.
- files removed:
- tmpfiles.d-mandos.conf
- files modified:
- DBUS-API
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2018 Teddy Hogeborn
15
# Copyright © 2008-2018 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
80
79
81
80
import dbus
82
81
import dbus.service
83
from gi.repository import GLib
82
try:
83
from gi.repository import GObject
84
except ImportError:
85
import gobject as GObject
84
86
from dbus.mainloop.glib import DBusGMainLoop
85
87
import ctypes
86
88
import ctypes.util
87
89
import xml.dom.minidom
88
90
import inspect
89
91
90
# Try to find the value of SO_BINDTODEVICE:
91
92
try:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
94
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
94
except AttributeError:
96
95
try:
97
# This is where SO_BINDTODEVICE was up to and including Python
98
# 2.6, and also 3.2:
99
96
from IN import SO_BINDTODEVICE
100
97
except ImportError:
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
103
try:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
"/dev/stdin"],
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
112
# No value found
113
SO_BINDTODEVICE = None
98
SO_BINDTODEVICE = None
114
99
115
100
if sys.version_info.major == 2:
116
101
str = unicode
117
102
118
version = "1.7.19"
103
version = "1.7.5"
119
104
stored_state_file = "clients.pickle"
120
105
121
106
logger = logging.getLogger()
125
110
if_nametoindex = ctypes.cdll.LoadLibrary(
126
111
ctypes.util.find_library("c")).if_nametoindex
127
112
except (OSError, AttributeError):
128
113
129
114
def if_nametoindex(interface):
130
115
"Get an interface index the hard way, i.e. using fcntl()"
131
116
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
154
139
155
140
def initlogger(debug, level=logging.WARNING):
156
141
"""init logger and add loglevel"""
157
142
158
143
global syslogger
159
144
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
address="/dev/log"))
145
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
146
address = "/dev/log"))
162
147
syslogger.setFormatter(logging.Formatter
163
148
('Mandos [%(process)d]: %(levelname)s:'
164
149
' %(message)s'))
165
150
logger.addHandler(syslogger)
166
151
167
152
if debug:
168
153
console = logging.StreamHandler()
169
154
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
181
166
182
167
class PGPEngine(object):
183
168
"""A simple class for OpenPGP symmetric encryption & decryption"""
184
169
185
170
def __init__(self):
186
171
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
187
172
self.gpg = "gpg"
198
183
self.gnupgargs = ['--batch',
199
184
'--homedir', self.tempdir,
200
185
'--force-mdc',
201
'--quiet']
202
# Only GPG version 1 has the --no-use-agent option.
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
self.gnupgargs.append("--no-use-agent")
205
186
'--quiet',
187
'--no-use-agent']
188
206
189
def __enter__(self):
207
190
return self
208
191
209
192
def __exit__(self, exc_type, exc_value, traceback):
210
193
self._cleanup()
211
194
return False
212
195
213
196
def __del__(self):
214
197
self._cleanup()
215
198
216
199
def _cleanup(self):
217
200
if self.tempdir is not None:
218
201
# Delete contents of tempdir
219
202
for root, dirs, files in os.walk(self.tempdir,
220
topdown=False):
203
topdown = False):
221
204
for filename in files:
222
205
os.remove(os.path.join(root, filename))
223
206
for dirname in dirs:
225
208
# Remove tempdir
226
209
os.rmdir(self.tempdir)
227
210
self.tempdir = None
228
211
229
212
def password_encode(self, password):
230
213
# Passphrase can not be empty and can not contain newlines or
231
214
# NUL bytes. So we prefix it and hex encode it.
236
219
.replace(b"\n", b"\\n")
237
220
.replace(b"\0", b"\\x00"))
238
221
return encoded
239
222
240
223
def encrypt(self, data, password):
241
224
passphrase = self.password_encode(password)
242
225
with tempfile.NamedTemporaryFile(
247
230
'--passphrase-file',
248
231
passfile.name]
249
232
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
254
237
if proc.returncode != 0:
255
238
raise PGPError(err)
256
239
return ciphertext
257
240
258
241
def decrypt(self, data, password):
259
242
passphrase = self.password_encode(password)
260
243
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
244
dir = self.tempdir) as passfile:
262
245
passfile.write(passphrase)
263
246
passfile.flush()
264
247
proc = subprocess.Popen([self.gpg, '--decrypt',
265
248
'--passphrase-file',
266
249
passfile.name]
267
250
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
272
255
if proc.returncode != 0:
273
256
raise PGPError(err)
274
257
return decrypted_plaintext
275
258
276
277
259
# Pretend that we have an Avahi module
278
260
class Avahi(object):
279
261
"""This isn't so much a class as it is a module-like namespace.
280
262
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
285
267
DBUS_NAME = "org.freedesktop.Avahi"
286
268
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
269
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
270
DBUS_PATH_SERVER = "/"
289
290
271
def string_array_to_txt_array(self, t):
291
272
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
273
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
301
282
avahi = Avahi()
302
283
303
304
284
class AvahiError(Exception):
305
285
def __init__(self, value, *args, **kwargs):
306
286
self.value = value
318
298
319
299
class AvahiService(object):
320
300
"""An Avahi (Zeroconf) service.
321
301
322
302
Attributes:
323
303
interface: integer; avahi.IF_UNSPEC or an interface index.
324
304
Used to optionally bind to the specified interface.
336
316
server: D-Bus Server
337
317
bus: dbus.SystemBus()
338
318
"""
339
319
340
320
def __init__(self,
341
interface=avahi.IF_UNSPEC,
342
name=None,
343
servicetype=None,
344
port=None,
345
TXT=None,
346
domain="",
347
host="",
348
max_renames=32768,
349
protocol=avahi.PROTO_UNSPEC,
350
bus=None):
321
interface = avahi.IF_UNSPEC,
322
name = None,
323
servicetype = None,
324
port = None,
325
TXT = None,
326
domain = "",
327
host = "",
328
max_renames = 32768,
329
protocol = avahi.PROTO_UNSPEC,
330
bus = None):
351
331
self.interface = interface
352
332
self.name = name
353
333
self.type = servicetype
362
342
self.server = None
363
343
self.bus = bus
364
344
self.entry_group_state_changed_match = None
365
345
366
346
def rename(self, remove=True):
367
347
"""Derived from the Avahi example code"""
368
348
if self.rename_count >= self.max_renames:
388
368
logger.critical("D-Bus Exception", exc_info=error)
389
369
self.cleanup()
390
370
os._exit(1)
391
371
392
372
def remove(self):
393
373
"""Derived from the Avahi example code"""
394
374
if self.entry_group_state_changed_match is not None:
396
376
self.entry_group_state_changed_match = None
397
377
if self.group is not None:
398
378
self.group.Reset()
399
379
400
380
def add(self):
401
381
"""Derived from the Avahi example code"""
402
382
self.remove()
419
399
dbus.UInt16(self.port),
420
400
avahi.string_array_to_txt_array(self.TXT))
421
401
self.group.Commit()
422
402
423
403
def entry_group_state_changed(self, state, error):
424
404
"""Derived from the Avahi example code"""
425
405
logger.debug("Avahi entry group state change: %i", state)
426
406
427
407
if state == avahi.ENTRY_GROUP_ESTABLISHED:
428
408
logger.debug("Zeroconf service established.")
429
409
elif state == avahi.ENTRY_GROUP_COLLISION:
433
413
logger.critical("Avahi: Error in group state changed %s",
434
414
str(error))
435
415
raise AvahiGroupError("State changed: {!s}".format(error))
436
416
437
417
def cleanup(self):
438
418
"""Derived from the Avahi example code"""
439
419
if self.group is not None:
444
424
pass
445
425
self.group = None
446
426
self.remove()
447
427
448
428
def server_state_changed(self, state, error=None):
449
429
"""Derived from the Avahi example code"""
450
430
logger.debug("Avahi server state change: %i", state)
479
459
logger.debug("Unknown state: %r", state)
480
460
else:
481
461
logger.debug("Unknown state: %r: %r", state, error)
482
462
483
463
def activate(self):
484
464
"""Derived from the Avahi example code"""
485
465
if self.server is None:
496
476
class AvahiServiceToSyslog(AvahiService):
497
477
def rename(self, *args, **kwargs):
498
478
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
479
ret = AvahiService.rename(self, *args, **kwargs)
500
480
syslogger.setFormatter(logging.Formatter(
501
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
502
482
.format(self.name)))
503
483
return ret
504
484
505
506
485
# Pretend that we have a GnuTLS module
507
486
class GnuTLS(object):
508
487
"""This isn't so much a class as it is a module-like namespace.
509
488
It is instantiated once, and simulates having a GnuTLS module."""
510
511
library = ctypes.util.find_library("gnutls")
512
if library is None:
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
515
del library
489
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
516
492
_need_version = b"3.3.0"
517
518
493
def __init__(self):
519
# Need to use "self" here, since this method is called before
520
# the assignment to the "gnutls" global variable happens.
521
if self.check_version(self._need_version) is None:
522
raise self.Error("Needs GnuTLS {} or later"
523
.format(self._need_version))
524
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
496
# happens.
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
500
525
501
# Unless otherwise indicated, the constants and types below are
526
502
# all from the gnutls/gnutls.h C header file.
527
503
528
504
# Constants
529
505
E_SUCCESS = 0
530
506
E_INTERRUPTED = -52
535
511
CRD_CERTIFICATE = 1
536
512
E_NO_CERTIFICATE_FOUND = -49
537
513
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
538
514
539
515
# Types
540
516
class session_int(ctypes.Structure):
541
517
_fields_ = []
542
518
session_t = ctypes.POINTER(session_int)
543
544
519
class certificate_credentials_st(ctypes.Structure):
545
520
_fields_ = []
546
521
certificate_credentials_t = ctypes.POINTER(
547
522
certificate_credentials_st)
548
523
certificate_type_t = ctypes.c_int
549
550
524
class datum_t(ctypes.Structure):
551
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
526
('size', ctypes.c_uint)]
553
554
527
class openpgp_crt_int(ctypes.Structure):
555
528
_fields_ = []
556
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
558
531
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
559
532
credentials_type_t = ctypes.c_int
560
533
transport_ptr_t = ctypes.c_void_p
561
534
close_request_t = ctypes.c_int
562
535
563
536
# Exceptions
564
537
class Error(Exception):
565
538
# We need to use the class name "GnuTLS" here, since this
566
539
# exception might be raised from within GnuTLS.__init__,
567
540
# which is called before the assignment to the "gnutls"
568
541
# global variable has happened.
569
def __init__(self, message=None, code=None, args=()):
542
def __init__(self, message = None, code = None, args=()):
570
543
# Default usage is by a message string, but if a return
571
544
# code is passed, convert it to a string with
572
545
# gnutls.strerror()
575
548
message = GnuTLS.strerror(code)
576
549
return super(GnuTLS.Error, self).__init__(
577
550
message, *args)
578
551
579
552
class CertificateSecurityError(Error):
580
553
pass
581
554
582
555
# Classes
583
556
class Credentials(object):
584
557
def __init__(self):
586
559
gnutls.certificate_allocate_credentials(
587
560
ctypes.byref(self._c_object))
588
561
self.type = gnutls.CRD_CERTIFICATE
589
562
590
563
def __del__(self):
591
564
gnutls.certificate_free_credentials(self._c_object)
592
565
593
566
class ClientSession(object):
594
def __init__(self, socket, credentials=None):
567
def __init__(self, socket, credentials = None):
595
568
self._c_object = gnutls.session_t()
596
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
597
570
gnutls.set_default_priority(self._c_object)
605
578
ctypes.cast(credentials._c_object,
606
579
ctypes.c_void_p))
607
580
self.credentials = credentials
608
581
609
582
def __del__(self):
610
583
gnutls.deinit(self._c_object)
611
584
612
585
def handshake(self):
613
586
return gnutls.handshake(self._c_object)
614
587
615
588
def send(self, data):
616
589
data = bytes(data)
617
590
data_len = len(data)
619
592
data_len -= gnutls.record_send(self._c_object,
620
593
data[-data_len:],
621
594
data_len)
622
595
623
596
def bye(self):
624
597
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
625
598
626
599
# Error handling functions
627
600
def _error_code(result):
628
601
"""A function to raise exceptions on errors, suitable
630
603
if result >= 0:
631
604
return result
632
605
if result == gnutls.E_NO_CERTIFICATE_FOUND:
633
raise gnutls.CertificateSecurityError(code=result)
634
raise gnutls.Error(code=result)
635
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
608
636
609
def _retry_on_error(result, func, arguments):
637
610
"""A function to retry on some errors, suitable
638
611
for the 'errcheck' attribute on ctypes functions"""
641
614
return _error_code(result)
642
615
result = func(*arguments)
643
616
return result
644
617
645
618
# Unless otherwise indicated, the function declarations below are
646
619
# all from the gnutls/gnutls.h C header file.
647
620
648
621
# Functions
649
622
priority_set_direct = _library.gnutls_priority_set_direct
650
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
651
624
ctypes.POINTER(ctypes.c_char_p)]
652
625
priority_set_direct.restype = _error_code
653
626
654
627
init = _library.gnutls_init
655
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
656
629
init.restype = _error_code
657
630
658
631
set_default_priority = _library.gnutls_set_default_priority
659
632
set_default_priority.argtypes = [session_t]
660
633
set_default_priority.restype = _error_code
661
634
662
635
record_send = _library.gnutls_record_send
663
636
record_send.argtypes = [session_t, ctypes.c_void_p,
664
637
ctypes.c_size_t]
665
638
record_send.restype = ctypes.c_ssize_t
666
639
record_send.errcheck = _retry_on_error
667
640
668
641
certificate_allocate_credentials = (
669
642
_library.gnutls_certificate_allocate_credentials)
670
643
certificate_allocate_credentials.argtypes = [
671
644
ctypes.POINTER(certificate_credentials_t)]
672
645
certificate_allocate_credentials.restype = _error_code
673
646
674
647
certificate_free_credentials = (
675
648
_library.gnutls_certificate_free_credentials)
676
certificate_free_credentials.argtypes = [
677
certificate_credentials_t]
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
678
650
certificate_free_credentials.restype = None
679
651
680
652
handshake_set_private_extensions = (
681
653
_library.gnutls_handshake_set_private_extensions)
682
654
handshake_set_private_extensions.argtypes = [session_t,
683
655
ctypes.c_int]
684
656
handshake_set_private_extensions.restype = None
685
657
686
658
credentials_set = _library.gnutls_credentials_set
687
659
credentials_set.argtypes = [session_t, credentials_type_t,
688
660
ctypes.c_void_p]
689
661
credentials_set.restype = _error_code
690
662
691
663
strerror = _library.gnutls_strerror
692
664
strerror.argtypes = [ctypes.c_int]
693
665
strerror.restype = ctypes.c_char_p
694
666
695
667
certificate_type_get = _library.gnutls_certificate_type_get
696
668
certificate_type_get.argtypes = [session_t]
697
669
certificate_type_get.restype = _error_code
698
670
699
671
certificate_get_peers = _library.gnutls_certificate_get_peers
700
672
certificate_get_peers.argtypes = [session_t,
701
673
ctypes.POINTER(ctypes.c_uint)]
702
674
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
675
704
676
global_set_log_level = _library.gnutls_global_set_log_level
705
677
global_set_log_level.argtypes = [ctypes.c_int]
706
678
global_set_log_level.restype = None
707
679
708
680
global_set_log_function = _library.gnutls_global_set_log_function
709
681
global_set_log_function.argtypes = [log_func]
710
682
global_set_log_function.restype = None
711
683
712
684
deinit = _library.gnutls_deinit
713
685
deinit.argtypes = [session_t]
714
686
deinit.restype = None
715
687
716
688
handshake = _library.gnutls_handshake
717
689
handshake.argtypes = [session_t]
718
690
handshake.restype = _error_code
719
691
handshake.errcheck = _retry_on_error
720
692
721
693
transport_set_ptr = _library.gnutls_transport_set_ptr
722
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
723
695
transport_set_ptr.restype = None
724
696
725
697
bye = _library.gnutls_bye
726
698
bye.argtypes = [session_t, close_request_t]
727
699
bye.restype = _error_code
728
700
bye.errcheck = _retry_on_error
729
701
730
702
check_version = _library.gnutls_check_version
731
703
check_version.argtypes = [ctypes.c_char_p]
732
704
check_version.restype = ctypes.c_char_p
733
705
734
706
# All the function declarations below are from gnutls/openpgp.h
735
707
736
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
737
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
738
710
openpgp_crt_init.restype = _error_code
739
711
740
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
741
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
742
714
ctypes.POINTER(datum_t),
743
715
openpgp_crt_fmt_t]
744
716
openpgp_crt_import.restype = _error_code
745
717
746
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
747
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
748
720
ctypes.POINTER(ctypes.c_uint)]
749
721
openpgp_crt_verify_self.restype = _error_code
750
722
751
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
752
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
753
725
openpgp_crt_deinit.restype = None
754
726
755
727
openpgp_crt_get_fingerprint = (
756
728
_library.gnutls_openpgp_crt_get_fingerprint)
757
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
759
731
ctypes.POINTER(
760
732
ctypes.c_size_t)]
761
733
openpgp_crt_get_fingerprint.restype = _error_code
762
734
763
735
# Remove non-public functions
764
736
del _error_code, _retry_on_error
765
737
# Create the global "gnutls" object, simulating a module
766
738
gnutls = GnuTLS()
767
739
768
769
740
def call_pipe(connection, # : multiprocessing.Connection
770
741
func, *args, **kwargs):
771
742
"""This function is meant to be called by multiprocessing.Process
772
743
773
744
This function runs func(*args, **kwargs), and writes the resulting
774
745
return value on the provided multiprocessing.Connection.
775
746
"""
776
747
connection.send(func(*args, **kwargs))
777
748
connection.close()
778
749
779
780
750
class Client(object):
781
751
"""A representation of a client host served by this server.
782
752
783
753
Attributes:
784
754
approved: bool(); 'None' if not yet approved/disapproved
785
755
approval_delay: datetime.timedelta(); Time to wait for approval
787
757
checker: subprocess.Popen(); a running checker process used
788
758
to see if the client lives.
789
759
'None' if no process is running.
790
checker_callback_tag: a GLib event source tag, or None
760
checker_callback_tag: a GObject event source tag, or None
791
761
checker_command: string; External command which is run to check
792
762
if client lives. %() expansions are done at
793
763
runtime with vars(self) as dict, so that for
794
764
instance %(name)s can be used in the command.
795
checker_initiator_tag: a GLib event source tag, or None
765
checker_initiator_tag: a GObject event source tag, or None
796
766
created: datetime.datetime(); (UTC) object creation
797
767
client_structure: Object describing what attributes a client has
798
768
and is used for storing the client at exit
799
769
current_checker_command: string; current running checker_command
800
disable_initiator_tag: a GLib event source tag, or None
770
disable_initiator_tag: a GObject event source tag, or None
801
771
enabled: bool()
802
772
fingerprint: string (40 or 32 hexadecimal digits); used to
803
773
uniquely identify the client
822
792
disabled, or None
823
793
server_settings: The server_settings dict from main()
824
794
"""
825
795
826
796
runtime_expansions = ("approval_delay", "approval_duration",
827
797
"created", "enabled", "expires",
828
798
"fingerprint", "host", "interval",
839
809
"approved_by_default": "True",
840
810
"enabled": "True",
841
811
}
842
812
843
813
@staticmethod
844
814
def config_parser(config):
845
815
"""Construct a new dict of client settings of this form:
852
822
for client_name in config.sections():
853
823
section = dict(config.items(client_name))
854
824
client = settings[client_name] = {}
855
825
856
826
client["host"] = section["host"]
857
827
# Reformat values from string types to Python types
858
828
client["approved_by_default"] = config.getboolean(
859
829
client_name, "approved_by_default")
860
830
client["enabled"] = config.getboolean(client_name,
861
831
"enabled")
862
832
863
833
# Uppercase and remove spaces from fingerprint for later
864
834
# comparison purposes with return value from the
865
835
# fingerprint() function
889
859
client["last_approval_request"] = None
890
860
client["last_checked_ok"] = None
891
861
client["last_checker_status"] = -2
892
862
893
863
return settings
894
895
def __init__(self, settings, name=None, server_settings=None):
864
865
def __init__(self, settings, name = None, server_settings=None):
896
866
self.name = name
897
867
if server_settings is None:
898
868
server_settings = {}
900
870
# adding all client settings
901
871
for setting, value in settings.items():
902
872
setattr(self, setting, value)
903
873
904
874
if self.enabled:
905
875
if not hasattr(self, "last_enabled"):
906
876
self.last_enabled = datetime.datetime.utcnow()
910
880
else:
911
881
self.last_enabled = None
912
882
self.expires = None
913
883
914
884
logger.debug("Creating client %r", self.name)
915
885
logger.debug(" Fingerprint: %s", self.fingerprint)
916
886
self.created = settings.get("created",
917
887
datetime.datetime.utcnow())
918
888
919
889
# attributes specific for this server instance
920
890
self.checker = None
921
891
self.checker_initiator_tag = None
930
900
for attr in self.__dict__.keys()
931
901
if not attr.startswith("_")]
932
902
self.client_structure.append("client_structure")
933
903
934
904
for name, t in inspect.getmembers(
935
905
type(self), lambda obj: isinstance(obj, property)):
936
906
if not name.startswith("_"):
937
907
self.client_structure.append(name)
938
908
939
909
# Send notice to process children that client state has changed
940
910
def send_changedstate(self):
941
911
with self.changedstate:
942
912
self.changedstate.notify_all()
943
913
944
914
def enable(self):
945
915
"""Start this client's checker and timeout hooks"""
946
916
if getattr(self, "enabled", False):
951
921
self.last_enabled = datetime.datetime.utcnow()
952
922
self.init_checker()
953
923
self.send_changedstate()
954
924
955
925
def disable(self, quiet=True):
956
926
"""Disable this client."""
957
927
if not getattr(self, "enabled", False):
959
929
if not quiet:
960
930
logger.info("Disabling client %s", self.name)
961
931
if getattr(self, "disable_initiator_tag", None) is not None:
962
GLib.source_remove(self.disable_initiator_tag)
932
GObject.source_remove(self.disable_initiator_tag)
963
933
self.disable_initiator_tag = None
964
934
self.expires = None
965
935
if getattr(self, "checker_initiator_tag", None) is not None:
966
GLib.source_remove(self.checker_initiator_tag)
936
GObject.source_remove(self.checker_initiator_tag)
967
937
self.checker_initiator_tag = None
968
938
self.stop_checker()
969
939
self.enabled = False
970
940
if not quiet:
971
941
self.send_changedstate()
972
# Do not run this again if called by a GLib.timeout_add
942
# Do not run this again if called by a GObject.timeout_add
973
943
return False
974
944
975
945
def __del__(self):
976
946
self.disable()
977
947
978
948
def init_checker(self):
979
949
# Schedule a new checker to be started an 'interval' from now,
980
950
# and every interval from then on.
981
951
if self.checker_initiator_tag is not None:
982
GLib.source_remove(self.checker_initiator_tag)
983
self.checker_initiator_tag = GLib.timeout_add(
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
984
954
int(self.interval.total_seconds() * 1000),
985
955
self.start_checker)
986
956
# Schedule a disable() when 'timeout' has passed
987
957
if self.disable_initiator_tag is not None:
988
GLib.source_remove(self.disable_initiator_tag)
989
self.disable_initiator_tag = GLib.timeout_add(
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
990
960
int(self.timeout.total_seconds() * 1000), self.disable)
991
961
# Also start a new checker *right now*.
992
962
self.start_checker()
993
963
994
964
def checker_callback(self, source, condition, connection,
995
965
command):
996
966
"""The checker has completed, so take appropriate actions."""
999
969
# Read return code from connection (see call_pipe)
1000
970
returncode = connection.recv()
1001
971
connection.close()
1002
972
1003
973
if returncode >= 0:
1004
974
self.last_checker_status = returncode
1005
975
self.last_checker_signal = None
1015
985
logger.warning("Checker for %(name)s crashed?",
1016
986
vars(self))
1017
987
return False
1018
988
1019
989
def checked_ok(self):
1020
990
"""Assert that the client has been seen, alive and well."""
1021
991
self.last_checked_ok = datetime.datetime.utcnow()
1022
992
self.last_checker_status = 0
1023
993
self.last_checker_signal = None
1024
994
self.bump_timeout()
1025
995
1026
996
def bump_timeout(self, timeout=None):
1027
997
"""Bump up the timeout for this client."""
1028
998
if timeout is None:
1029
999
timeout = self.timeout
1030
1000
if self.disable_initiator_tag is not None:
1031
GLib.source_remove(self.disable_initiator_tag)
1001
GObject.source_remove(self.disable_initiator_tag)
1032
1002
self.disable_initiator_tag = None
1033
1003
if getattr(self, "enabled", False):
1034
self.disable_initiator_tag = GLib.timeout_add(
1004
self.disable_initiator_tag = GObject.timeout_add(
1035
1005
int(timeout.total_seconds() * 1000), self.disable)
1036
1006
self.expires = datetime.datetime.utcnow() + timeout
1037
1007
1038
1008
def need_approval(self):
1039
1009
self.last_approval_request = datetime.datetime.utcnow()
1040
1010
1041
1011
def start_checker(self):
1042
1012
"""Start a new checker subprocess if one is not running.
1043
1013
1044
1014
If a checker already exists, leave it running and do
1045
1015
nothing."""
1046
1016
# The reason for not killing a running checker is that if we
1051
1021
# checkers alone, the checker would have to take more time
1052
1022
# than 'timeout' for the client to be disabled, which is as it
1053
1023
# should be.
1054
1024
1055
1025
if self.checker is not None and not self.checker.is_alive():
1056
1026
logger.warning("Checker was not alive; joining")
1057
1027
self.checker.join()
1061
1031
# Escape attributes for the shell
1062
1032
escaped_attrs = {
1063
1033
attr: re.escape(str(getattr(self, attr)))
1064
for attr in self.runtime_expansions}
1034
for attr in self.runtime_expansions }
1065
1035
try:
1066
1036
command = self.checker_command % escaped_attrs
1067
1037
except TypeError as error:
1079
1049
# The exception is when not debugging but nevertheless
1080
1050
# running in the foreground; use the previously
1081
1051
# created wnull.
1082
popen_args = {"close_fds": True,
1083
"shell": True,
1084
"cwd": "/"}
1052
popen_args = { "close_fds": True,
1053
"shell": True,
1054
"cwd": "/" }
1085
1055
if (not self.server_settings["debug"]
1086
1056
and self.server_settings["foreground"]):
1087
1057
popen_args.update({"stdout": wnull,
1088
"stderr": wnull})
1089
pipe = multiprocessing.Pipe(duplex=False)
1058
"stderr": wnull })
1059
pipe = multiprocessing.Pipe(duplex = False)
1090
1060
self.checker = multiprocessing.Process(
1091
target=call_pipe,
1092
args=(pipe[1], subprocess.call, command),
1093
kwargs=popen_args)
1061
target = call_pipe,
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1094
1064
self.checker.start()
1095
self.checker_callback_tag = GLib.io_add_watch(
1096
pipe[0].fileno(), GLib.IO_IN,
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1097
1067
self.checker_callback, pipe[0], command)
1098
# Re-run this periodically if run by GLib.timeout_add
1068
# Re-run this periodically if run by GObject.timeout_add
1099
1069
return True
1100
1070
1101
1071
def stop_checker(self):
1102
1072
"""Force the checker process, if any, to stop."""
1103
1073
if self.checker_callback_tag:
1104
GLib.source_remove(self.checker_callback_tag)
1074
GObject.source_remove(self.checker_callback_tag)
1105
1075
self.checker_callback_tag = None
1106
1076
if getattr(self, "checker", None) is None:
1107
1077
return
1116
1086
byte_arrays=False):
1117
1087
"""Decorators for marking methods of a DBusObjectWithProperties to
1118
1088
become properties on the D-Bus.
1119
1089
1120
1090
The decorated method will be called with no arguments by "Get"
1121
1091
and with one argument by "Set".
1122
1092
1123
1093
The parameters, where they are supported, are the same as
1124
1094
dbus.service.method, except there is only "signature", since the
1125
1095
type from Get() and the type sent to Set() is the same.
1129
1099
if byte_arrays and signature != "ay":
1130
1100
raise ValueError("Byte arrays not supported for non-'ay'"
1131
1101
" signature {!r}".format(signature))
1132
1102
1133
1103
def decorator(func):
1134
1104
func._dbus_is_property = True
1135
1105
func._dbus_interface = dbus_interface
1138
1108
func._dbus_name = func.__name__
1139
1109
if func._dbus_name.endswith("_dbus_property"):
1140
1110
func._dbus_name = func._dbus_name[:-14]
1141
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1111
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1142
1112
return func
1143
1113
1144
1114
return decorator
1145
1115
1146
1116
1147
1117
def dbus_interface_annotations(dbus_interface):
1148
1118
"""Decorator for marking functions returning interface annotations
1149
1119
1150
1120
Usage:
1151
1121
1152
1122
@dbus_interface_annotations("org.example.Interface")
1153
1123
def _foo(self): # Function name does not matter
1154
1124
return {"org.freedesktop.DBus.Deprecated": "true",
1155
1125
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1156
1126
"false"}
1157
1127
"""
1158
1128
1159
1129
def decorator(func):
1160
1130
func._dbus_is_interface = True
1161
1131
func._dbus_interface = dbus_interface
1162
1132
func._dbus_name = dbus_interface
1163
1133
return func
1164
1134
1165
1135
return decorator
1166
1136
1167
1137
1168
1138
def dbus_annotations(annotations):
1169
1139
"""Decorator to annotate D-Bus methods, signals or properties
1170
1140
Usage:
1171
1141
1172
1142
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1173
1143
"org.freedesktop.DBus.Property."
1174
1144
"EmitsChangedSignal": "false"})
1176
1146
access="r")
1177
1147
def Property_dbus_property(self):
1178
1148
return dbus.Boolean(False)
1179
1149
1180
1150
See also the DBusObjectWithAnnotations class.
1181
1151
"""
1182
1152
1183
1153
def decorator(func):
1184
1154
func._dbus_annotations = annotations
1185
1155
return func
1186
1156
1187
1157
return decorator
1188
1158
1189
1159
1207
1177
1208
1178
class DBusObjectWithAnnotations(dbus.service.Object):
1209
1179
"""A D-Bus object with annotations.
1210
1180
1211
1181
Classes inheriting from this can use the dbus_annotations
1212
1182
decorator to add annotations to methods or signals.
1213
1183
"""
1214
1184
1215
1185
@staticmethod
1216
1186
def _is_dbus_thing(thing):
1217
1187
"""Returns a function testing if an attribute is a D-Bus thing
1218
1188
1219
1189
If called like _is_dbus_thing("method") it returns a function
1220
1190
suitable for use as predicate to inspect.getmembers().
1221
1191
"""
1222
1192
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1223
1193
False)
1224
1194
1225
1195
def _get_all_dbus_things(self, thing):
1226
1196
"""Returns a generator of (name, attribute) pairs
1227
1197
"""
1230
1200
for cls in self.__class__.__mro__
1231
1201
for name, athing in
1232
1202
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
1203
1234
1204
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
out_signature="s",
1236
path_keyword='object_path',
1237
connection_keyword='connection')
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1238
1208
def Introspect(self, object_path, connection):
1239
1209
"""Overloading of standard D-Bus method.
1240
1210
1241
1211
Inserts annotation tags on methods and signals.
1242
1212
"""
1243
1213
xmlstring = dbus.service.Object.Introspect(self, object_path,
1244
1214
connection)
1245
1215
try:
1246
1216
document = xml.dom.minidom.parseString(xmlstring)
1247
1217
1248
1218
for if_tag in document.getElementsByTagName("interface"):
1249
1219
# Add annotation tags
1250
1220
for typ in ("method", "signal"):
1277
1247
if_tag.appendChild(ann_tag)
1278
1248
# Fix argument name for the Introspect method itself
1279
1249
if (if_tag.getAttribute("name")
1280
== dbus.INTROSPECTABLE_IFACE):
1250
== dbus.INTROSPECTABLE_IFACE):
1281
1251
for cn in if_tag.getElementsByTagName("method"):
1282
1252
if cn.getAttribute("name") == "Introspect":
1283
1253
for arg in cn.getElementsByTagName("arg"):
1296
1266
1297
1267
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1298
1268
"""A D-Bus object with properties.
1299
1269
1300
1270
Classes inheriting from this can use the dbus_service_property
1301
1271
decorator to expose methods as D-Bus properties. It exposes the
1302
1272
standard Get(), Set(), and GetAll() methods on the D-Bus.
1303
1273
"""
1304
1274
1305
1275
def _get_dbus_property(self, interface_name, property_name):
1306
1276
"""Returns a bound method if one exists which is a D-Bus
1307
1277
property with the specified name and interface.
1312
1282
if (value._dbus_name == property_name
1313
1283
and value._dbus_interface == interface_name):
1314
1284
return value.__get__(self)
1315
1285
1316
1286
# No such property
1317
1287
raise DBusPropertyNotFound("{}:{}.{}".format(
1318
1288
self.dbus_object_path, interface_name, property_name))
1319
1289
1320
1290
@classmethod
1321
1291
def _get_all_interface_names(cls):
1322
1292
"""Get a sequence of all interfaces supported by an object"""
1325
1295
for x in (inspect.getmro(cls))
1326
1296
for attr in dir(x))
1327
1297
if name is not None)
1328
1298
1329
1299
@dbus.service.method(dbus.PROPERTIES_IFACE,
1330
1300
in_signature="ss",
1331
1301
out_signature="v")
1339
1309
if not hasattr(value, "variant_level"):
1340
1310
return value
1341
1311
return type(value)(value, variant_level=value.variant_level+1)
1342
1312
1343
1313
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1344
1314
def Set(self, interface_name, property_name, value):
1345
1315
"""Standard D-Bus property Set() method, see D-Bus standard.
1357
1327
value = dbus.ByteArray(b''.join(chr(byte)
1358
1328
for byte in value))
1359
1329
prop(value)
1360
1330
1361
1331
@dbus.service.method(dbus.PROPERTIES_IFACE,
1362
1332
in_signature="s",
1363
1333
out_signature="a{sv}")
1364
1334
def GetAll(self, interface_name):
1365
1335
"""Standard D-Bus property GetAll() method, see D-Bus
1366
1336
standard.
1367
1337
1368
1338
Note: Will not include properties with access="write".
1369
1339
"""
1370
1340
properties = {}
1381
1351
properties[name] = value
1382
1352
continue
1383
1353
properties[name] = type(value)(
1384
value, variant_level=value.variant_level + 1)
1354
value, variant_level = value.variant_level + 1)
1385
1355
return dbus.Dictionary(properties, signature="sv")
1386
1356
1387
1357
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1388
1358
def PropertiesChanged(self, interface_name, changed_properties,
1389
1359
invalidated_properties):
1391
1361
standard.
1392
1362
"""
1393
1363
pass
1394
1364
1395
1365
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1396
1366
out_signature="s",
1397
1367
path_keyword='object_path',
1398
1368
connection_keyword='connection')
1399
1369
def Introspect(self, object_path, connection):
1400
1370
"""Overloading of standard D-Bus method.
1401
1371
1402
1372
Inserts property tags and interface annotation tags.
1403
1373
"""
1404
1374
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1406
1376
connection)
1407
1377
try:
1408
1378
document = xml.dom.minidom.parseString(xmlstring)
1409
1379
1410
1380
def make_tag(document, name, prop):
1411
1381
e = document.createElement("property")
1412
1382
e.setAttribute("name", name)
1413
1383
e.setAttribute("type", prop._dbus_signature)
1414
1384
e.setAttribute("access", prop._dbus_access)
1415
1385
return e
1416
1386
1417
1387
for if_tag in document.getElementsByTagName("interface"):
1418
1388
# Add property tags
1419
1389
for tag in (make_tag(document, name, prop)
1461
1431
exc_info=error)
1462
1432
return xmlstring
1463
1433
1464
1465
1434
try:
1466
1435
dbus.OBJECT_MANAGER_IFACE
1467
1436
except AttributeError:
1468
1437
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1469
1438
1470
1471
1439
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1472
1440
"""A D-Bus object with an ObjectManager.
1473
1441
1474
1442
Classes inheriting from this exposes the standard
1475
1443
GetManagedObjects call and the InterfacesAdded and
1476
1444
InterfacesRemoved signals on the standard
1477
1445
"org.freedesktop.DBus.ObjectManager" interface.
1478
1446
1479
1447
Note: No signals are sent automatically; they must be sent
1480
1448
manually.
1481
1449
"""
1482
1450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1483
out_signature="a{oa{sa{sv}}}")
1451
out_signature = "a{oa{sa{sv}}}")
1484
1452
def GetManagedObjects(self):
1485
1453
"""This function must be overridden"""
1486
1454
raise NotImplementedError()
1487
1455
1488
1456
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1489
signature="oa{sa{sv}}")
1457
signature = "oa{sa{sv}}")
1490
1458
def InterfacesAdded(self, object_path, interfaces_and_properties):
1491
1459
pass
1492
1493
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1460
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1494
1462
def InterfacesRemoved(self, object_path, interfaces):
1495
1463
pass
1496
1464
1497
1465
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1498
out_signature="s",
1499
path_keyword='object_path',
1500
connection_keyword='connection')
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1501
1469
def Introspect(self, object_path, connection):
1502
1470
"""Overloading of standard D-Bus method.
1503
1471
1504
1472
Override return argument name of GetManagedObjects to be
1505
1473
"objpath_interfaces_and_properties"
1506
1474
"""
1509
1477
connection)
1510
1478
try:
1511
1479
document = xml.dom.minidom.parseString(xmlstring)
1512
1480
1513
1481
for if_tag in document.getElementsByTagName("interface"):
1514
1482
# Fix argument name for the GetManagedObjects method
1515
1483
if (if_tag.getAttribute("name")
1516
== dbus.OBJECT_MANAGER_IFACE):
1484
== dbus.OBJECT_MANAGER_IFACE):
1517
1485
for cn in if_tag.getElementsByTagName("method"):
1518
1486
if (cn.getAttribute("name")
1519
1487
== "GetManagedObjects"):
1529
1497
except (AttributeError, xml.dom.DOMException,
1530
1498
xml.parsers.expat.ExpatError) as error:
1531
1499
logger.error("Failed to override Introspection method",
1532
exc_info=error)
1500
exc_info = error)
1533
1501
return xmlstring
1534
1502
1535
1536
1503
def datetime_to_dbus(dt, variant_level=0):
1537
1504
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1538
1505
if dt is None:
1539
return dbus.String("", variant_level=variant_level)
1506
return dbus.String("", variant_level = variant_level)
1540
1507
return dbus.String(dt.isoformat(), variant_level=variant_level)
1541
1508
1542
1509
1545
1512
dbus.service.Object, it will add alternate D-Bus attributes with
1546
1513
interface names according to the "alt_interface_names" mapping.
1547
1514
Usage:
1548
1515
1549
1516
@alternate_dbus_interfaces({"org.example.Interface":
1550
1517
"net.example.AlternateInterface"})
1551
1518
class SampleDBusObject(dbus.service.Object):
1552
1519
@dbus.service.method("org.example.Interface")
1553
1520
def SampleDBusMethod():
1554
1521
pass
1555
1522
1556
1523
The above "SampleDBusMethod" on "SampleDBusObject" will be
1557
1524
reachable via two interfaces: "org.example.Interface" and
1558
1525
"net.example.AlternateInterface", the latter of which will have
1559
1526
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1560
1527
"true", unless "deprecate" is passed with a False value.
1561
1528
1562
1529
This works for methods and signals, and also for D-Bus properties
1563
1530
(from DBusObjectWithProperties) and interfaces (from the
1564
1531
dbus_interface_annotations decorator).
1565
1532
"""
1566
1533
1567
1534
def wrapper(cls):
1568
1535
for orig_interface_name, alt_interface_name in (
1569
1536
alt_interface_names.items()):
1609
1576
attribute._dbus_annotations)
1610
1577
except AttributeError:
1611
1578
pass
1612
1613
1579
# Define a creator of a function to call both the
1614
1580
# original and alternate functions, so both the
1615
1581
# original and alternate signals gets sent when
1618
1584
"""This function is a scope container to pass
1619
1585
func1 and func2 to the "call_both" function
1620
1586
outside of its arguments"""
1621
1587
1622
1588
@functools.wraps(func2)
1623
1589
def call_both(*args, **kwargs):
1624
1590
"""This function will emit two D-Bus
1625
1591
signals by calling func1 and func2"""
1626
1592
func1(*args, **kwargs)
1627
1593
func2(*args, **kwargs)
1628
# Make wrapper function look like a D-Bus
1629
# signal
1594
# Make wrapper function look like a D-Bus signal
1630
1595
for name, attr in inspect.getmembers(func2):
1631
1596
if name.startswith("_dbus_"):
1632
1597
setattr(call_both, name, attr)
1633
1598
1634
1599
return call_both
1635
1600
# Create the "call_both" function and add it to
1636
1601
# the class
1682
1647
(copy_function(attribute)))
1683
1648
if deprecate:
1684
1649
# Deprecate all alternate interfaces
1685
iname = "_AlternateDBusNames_interface_annotation{}"
1650
iname="_AlternateDBusNames_interface_annotation{}"
1686
1651
for interface_name in interface_names:
1687
1652
1688
1653
@dbus_interface_annotations(interface_name)
1689
1654
def func(self):
1690
return {"org.freedesktop.DBus.Deprecated":
1691
"true"}
1655
return { "org.freedesktop.DBus.Deprecated":
1656
"true" }
1692
1657
# Find an unused name
1693
1658
for aname in (iname.format(i)
1694
1659
for i in itertools.count()):
1705
1670
cls = type("{}Alternate".format(cls.__name__),
1706
1671
(cls, ), attr)
1707
1672
return cls
1708
1673
1709
1674
return wrapper
1710
1675
1711
1676
1713
1678
"se.bsnet.fukt.Mandos"})
1714
1679
class ClientDBus(Client, DBusObjectWithProperties):
1715
1680
"""A Client class using D-Bus
1716
1681
1717
1682
Attributes:
1718
1683
dbus_object_path: dbus.ObjectPath
1719
1684
bus: dbus.SystemBus()
1720
1685
"""
1721
1686
1722
1687
runtime_expansions = (Client.runtime_expansions
1723
1688
+ ("dbus_object_path", ))
1724
1689
1725
1690
_interface = "se.recompile.Mandos.Client"
1726
1691
1727
1692
# dbus.service.Object doesn't use super(), so we can't either.
1728
1729
def __init__(self, bus=None, *args, **kwargs):
1693
1694
def __init__(self, bus = None, *args, **kwargs):
1730
1695
self.bus = bus
1731
1696
Client.__init__(self, *args, **kwargs)
1732
1697
# Only now, when this client is initialized, can it show up on
1738
1703
"/clients/" + client_object_name)
1739
1704
DBusObjectWithProperties.__init__(self, self.bus,
1740
1705
self.dbus_object_path)
1741
1706
1742
1707
def notifychangeproperty(transform_func, dbus_name,
1743
1708
type_func=lambda x: x,
1744
1709
variant_level=1,
1746
1711
_interface=_interface):
1747
1712
""" Modify a variable so that it's a property which announces
1748
1713
its changes to DBus.
1749
1714
1750
1715
transform_fun: Function that takes a value and a variant_level
1751
1716
and transforms it to a D-Bus type.
1752
1717
dbus_name: D-Bus name of the variable
1755
1720
variant_level: D-Bus variant level. Default: 1
1756
1721
"""
1757
1722
attrname = "_{}".format(dbus_name)
1758
1723
1759
1724
def setter(self, value):
1760
1725
if hasattr(self, "dbus_object_path"):
1761
1726
if (not hasattr(self, attrname) or
1768
1733
else:
1769
1734
dbus_value = transform_func(
1770
1735
type_func(value),
1771
variant_level=variant_level)
1736
variant_level = variant_level)
1772
1737
self.PropertyChanged(dbus.String(dbus_name),
1773
1738
dbus_value)
1774
1739
self.PropertiesChanged(
1775
1740
_interface,
1776
dbus.Dictionary({dbus.String(dbus_name):
1777
dbus_value}),
1741
dbus.Dictionary({ dbus.String(dbus_name):
1742
dbus_value }),
1778
1743
dbus.Array())
1779
1744
setattr(self, attrname, value)
1780
1745
1781
1746
return property(lambda self: getattr(self, attrname), setter)
1782
1747
1783
1748
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1784
1749
approvals_pending = notifychangeproperty(dbus.Boolean,
1785
1750
"ApprovalPending",
1786
type_func=bool)
1751
type_func = bool)
1787
1752
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1788
1753
last_enabled = notifychangeproperty(datetime_to_dbus,
1789
1754
"LastEnabled")
1790
1755
checker = notifychangeproperty(
1791
1756
dbus.Boolean, "CheckerRunning",
1792
type_func=lambda checker: checker is not None)
1757
type_func = lambda checker: checker is not None)
1793
1758
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1794
1759
"LastCheckedOK")
1795
1760
last_checker_status = notifychangeproperty(dbus.Int16,
1800
1765
"ApprovedByDefault")
1801
1766
approval_delay = notifychangeproperty(
1802
1767
dbus.UInt64, "ApprovalDelay",
1803
type_func=lambda td: td.total_seconds() * 1000)
1768
type_func = lambda td: td.total_seconds() * 1000)
1804
1769
approval_duration = notifychangeproperty(
1805
1770
dbus.UInt64, "ApprovalDuration",
1806
type_func=lambda td: td.total_seconds() * 1000)
1771
type_func = lambda td: td.total_seconds() * 1000)
1807
1772
host = notifychangeproperty(dbus.String, "Host")
1808
1773
timeout = notifychangeproperty(
1809
1774
dbus.UInt64, "Timeout",
1810
type_func=lambda td: td.total_seconds() * 1000)
1775
type_func = lambda td: td.total_seconds() * 1000)
1811
1776
extended_timeout = notifychangeproperty(
1812
1777
dbus.UInt64, "ExtendedTimeout",
1813
type_func=lambda td: td.total_seconds() * 1000)
1778
type_func = lambda td: td.total_seconds() * 1000)
1814
1779
interval = notifychangeproperty(
1815
1780
dbus.UInt64, "Interval",
1816
type_func=lambda td: td.total_seconds() * 1000)
1781
type_func = lambda td: td.total_seconds() * 1000)
1817
1782
checker_command = notifychangeproperty(dbus.String, "Checker")
1818
1783
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1819
1784
invalidate_only=True)
1820
1785
1821
1786
del notifychangeproperty
1822
1787
1823
1788
def __del__(self, *args, **kwargs):
1824
1789
try:
1825
1790
self.remove_from_connection()
1828
1793
if hasattr(DBusObjectWithProperties, "__del__"):
1829
1794
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1830
1795
Client.__del__(self, *args, **kwargs)
1831
1796
1832
1797
def checker_callback(self, source, condition,
1833
1798
connection, command, *args, **kwargs):
1834
1799
ret = Client.checker_callback(self, source, condition,
1850
1815
| self.last_checker_signal),
1851
1816
dbus.String(command))
1852
1817
return ret
1853
1818
1854
1819
def start_checker(self, *args, **kwargs):
1855
1820
old_checker_pid = getattr(self.checker, "pid", None)
1856
1821
r = Client.start_checker(self, *args, **kwargs)
1860
1825
# Emit D-Bus signal
1861
1826
self.CheckerStarted(self.current_checker_command)
1862
1827
return r
1863
1828
1864
1829
def _reset_approved(self):
1865
1830
self.approved = None
1866
1831
return False
1867
1832
1868
1833
def approve(self, value=True):
1869
1834
self.approved = value
1870
GLib.timeout_add(int(self.approval_duration.total_seconds()
1871
* 1000), self._reset_approved)
1835
GObject.timeout_add(int(self.approval_duration.total_seconds()
1836
* 1000), self._reset_approved)
1872
1837
self.send_changedstate()
1873
1874
# D-Bus methods, signals & properties
1875
1876
# Interfaces
1877
1878
# Signals
1879
1838
1839
## D-Bus methods, signals & properties
1840
1841
## Interfaces
1842
1843
## Signals
1844
1880
1845
# CheckerCompleted - signal
1881
1846
@dbus.service.signal(_interface, signature="nxs")
1882
1847
def CheckerCompleted(self, exitcode, waitstatus, command):
1883
1848
"D-Bus signal"
1884
1849
pass
1885
1850
1886
1851
# CheckerStarted - signal
1887
1852
@dbus.service.signal(_interface, signature="s")
1888
1853
def CheckerStarted(self, command):
1889
1854
"D-Bus signal"
1890
1855
pass
1891
1856
1892
1857
# PropertyChanged - signal
1893
1858
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1894
1859
@dbus.service.signal(_interface, signature="sv")
1895
1860
def PropertyChanged(self, property, value):
1896
1861
"D-Bus signal"
1897
1862
pass
1898
1863
1899
1864
# GotSecret - signal
1900
1865
@dbus.service.signal(_interface)
1901
1866
def GotSecret(self):
1904
1869
server to mandos-client
1905
1870
"""
1906
1871
pass
1907
1872
1908
1873
# Rejected - signal
1909
1874
@dbus.service.signal(_interface, signature="s")
1910
1875
def Rejected(self, reason):
1911
1876
"D-Bus signal"
1912
1877
pass
1913
1878
1914
1879
# NeedApproval - signal
1915
1880
@dbus.service.signal(_interface, signature="tb")
1916
1881
def NeedApproval(self, timeout, default):
1917
1882
"D-Bus signal"
1918
1883
return self.need_approval()
1919
1920
# Methods
1921
1884
1885
## Methods
1886
1922
1887
# Approve - method
1923
1888
@dbus.service.method(_interface, in_signature="b")
1924
1889
def Approve(self, value):
1925
1890
self.approve(value)
1926
1891
1927
1892
# CheckedOK - method
1928
1893
@dbus.service.method(_interface)
1929
1894
def CheckedOK(self):
1930
1895
self.checked_ok()
1931
1896
1932
1897
# Enable - method
1933
1898
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1934
1899
@dbus.service.method(_interface)
1935
1900
def Enable(self):
1936
1901
"D-Bus method"
1937
1902
self.enable()
1938
1903
1939
1904
# StartChecker - method
1940
1905
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1941
1906
@dbus.service.method(_interface)
1942
1907
def StartChecker(self):
1943
1908
"D-Bus method"
1944
1909
self.start_checker()
1945
1910
1946
1911
# Disable - method
1947
1912
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1948
1913
@dbus.service.method(_interface)
1949
1914
def Disable(self):
1950
1915
"D-Bus method"
1951
1916
self.disable()
1952
1917
1953
1918
# StopChecker - method
1954
1919
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1955
1920
@dbus.service.method(_interface)
1956
1921
def StopChecker(self):
1957
1922
self.stop_checker()
1958
1959
# Properties
1960
1923
1924
## Properties
1925
1961
1926
# ApprovalPending - property
1962
1927
@dbus_service_property(_interface, signature="b", access="read")
1963
1928
def ApprovalPending_dbus_property(self):
1964
1929
return dbus.Boolean(bool(self.approvals_pending))
1965
1930
1966
1931
# ApprovedByDefault - property
1967
1932
@dbus_service_property(_interface,
1968
1933
signature="b",
1971
1936
if value is None: # get
1972
1937
return dbus.Boolean(self.approved_by_default)
1973
1938
self.approved_by_default = bool(value)
1974
1939
1975
1940
# ApprovalDelay - property
1976
1941
@dbus_service_property(_interface,
1977
1942
signature="t",
1981
1946
return dbus.UInt64(self.approval_delay.total_seconds()
1982
1947
* 1000)
1983
1948
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1984
1949
1985
1950
# ApprovalDuration - property
1986
1951
@dbus_service_property(_interface,
1987
1952
signature="t",
1991
1956
return dbus.UInt64(self.approval_duration.total_seconds()
1992
1957
* 1000)
1993
1958
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1994
1959
1995
1960
# Name - property
1996
1961
@dbus_annotations(
1997
1962
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1998
1963
@dbus_service_property(_interface, signature="s", access="read")
1999
1964
def Name_dbus_property(self):
2000
1965
return dbus.String(self.name)
2001
1966
2002
1967
# Fingerprint - property
2003
1968
@dbus_annotations(
2004
1969
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2005
1970
@dbus_service_property(_interface, signature="s", access="read")
2006
1971
def Fingerprint_dbus_property(self):
2007
1972
return dbus.String(self.fingerprint)
2008
1973
2009
1974
# Host - property
2010
1975
@dbus_service_property(_interface,
2011
1976
signature="s",
2014
1979
if value is None: # get
2015
1980
return dbus.String(self.host)
2016
1981
self.host = str(value)
2017
1982
2018
1983
# Created - property
2019
1984
@dbus_annotations(
2020
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2021
1986
@dbus_service_property(_interface, signature="s", access="read")
2022
1987
def Created_dbus_property(self):
2023
1988
return datetime_to_dbus(self.created)
2024
1989
2025
1990
# LastEnabled - property
2026
1991
@dbus_service_property(_interface, signature="s", access="read")
2027
1992
def LastEnabled_dbus_property(self):
2028
1993
return datetime_to_dbus(self.last_enabled)
2029
1994
2030
1995
# Enabled - property
2031
1996
@dbus_service_property(_interface,
2032
1997
signature="b",
2038
2003
self.enable()
2039
2004
else:
2040
2005
self.disable()
2041
2006
2042
2007
# LastCheckedOK - property
2043
2008
@dbus_service_property(_interface,
2044
2009
signature="s",
2048
2013
self.checked_ok()
2049
2014
return
2050
2015
return datetime_to_dbus(self.last_checked_ok)
2051
2016
2052
2017
# LastCheckerStatus - property
2053
2018
@dbus_service_property(_interface, signature="n", access="read")
2054
2019
def LastCheckerStatus_dbus_property(self):
2055
2020
return dbus.Int16(self.last_checker_status)
2056
2021
2057
2022
# Expires - property
2058
2023
@dbus_service_property(_interface, signature="s", access="read")
2059
2024
def Expires_dbus_property(self):
2060
2025
return datetime_to_dbus(self.expires)
2061
2026
2062
2027
# LastApprovalRequest - property
2063
2028
@dbus_service_property(_interface, signature="s", access="read")
2064
2029
def LastApprovalRequest_dbus_property(self):
2065
2030
return datetime_to_dbus(self.last_approval_request)
2066
2031
2067
2032
# Timeout - property
2068
2033
@dbus_service_property(_interface,
2069
2034
signature="t",
2084
2049
if (getattr(self, "disable_initiator_tag", None)
2085
2050
is None):
2086
2051
return
2087
GLib.source_remove(self.disable_initiator_tag)
2088
self.disable_initiator_tag = GLib.timeout_add(
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2089
2054
int((self.expires - now).total_seconds() * 1000),
2090
2055
self.disable)
2091
2056
2092
2057
# ExtendedTimeout - property
2093
2058
@dbus_service_property(_interface,
2094
2059
signature="t",
2098
2063
return dbus.UInt64(self.extended_timeout.total_seconds()
2099
2064
* 1000)
2100
2065
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2101
2066
2102
2067
# Interval - property
2103
2068
@dbus_service_property(_interface,
2104
2069
signature="t",
2111
2076
return
2112
2077
if self.enabled:
2113
2078
# Reschedule checker run
2114
GLib.source_remove(self.checker_initiator_tag)
2115
self.checker_initiator_tag = GLib.timeout_add(
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2116
2081
value, self.start_checker)
2117
self.start_checker() # Start one now, too
2118
2082
self.start_checker() # Start one now, too
2083
2119
2084
# Checker - property
2120
2085
@dbus_service_property(_interface,
2121
2086
signature="s",
2124
2089
if value is None: # get
2125
2090
return dbus.String(self.checker_command)
2126
2091
self.checker_command = str(value)
2127
2092
2128
2093
# CheckerRunning - property
2129
2094
@dbus_service_property(_interface,
2130
2095
signature="b",
2136
2101
self.start_checker()
2137
2102
else:
2138
2103
self.stop_checker()
2139
2104
2140
2105
# ObjectPath - property
2141
2106
@dbus_annotations(
2142
2107
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2143
2108
"org.freedesktop.DBus.Deprecated": "true"})
2144
2109
@dbus_service_property(_interface, signature="o", access="read")
2145
2110
def ObjectPath_dbus_property(self):
2146
return self.dbus_object_path # is already a dbus.ObjectPath
2147
2111
return self.dbus_object_path # is already a dbus.ObjectPath
2112
2148
2113
# Secret = property
2149
2114
@dbus_annotations(
2150
2115
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2155
2120
byte_arrays=True)
2156
2121
def Secret_dbus_property(self, value):
2157
2122
self.secret = bytes(value)
2158
2123
2159
2124
del _interface
2160
2125
2161
2126
2165
2130
self._pipe.send(('init', fpr, address))
2166
2131
if not self._pipe.recv():
2167
2132
raise KeyError(fpr)
2168
2133
2169
2134
def __getattribute__(self, name):
2170
2135
if name == '_pipe':
2171
2136
return super(ProxyClient, self).__getattribute__(name)
2174
2139
if data[0] == 'data':
2175
2140
return data[1]
2176
2141
if data[0] == 'function':
2177
2142
2178
2143
def func(*args, **kwargs):
2179
2144
self._pipe.send(('funcall', name, args, kwargs))
2180
2145
return self._pipe.recv()[1]
2181
2146
2182
2147
return func
2183
2148
2184
2149
def __setattr__(self, name, value):
2185
2150
if name == '_pipe':
2186
2151
return super(ProxyClient, self).__setattr__(name, value)
2189
2154
2190
2155
class ClientHandler(socketserver.BaseRequestHandler, object):
2191
2156
"""A class to handle client connections.
2192
2157
2193
2158
Instantiated once for each connection to handle it.
2194
2159
Note: This will run in its own forked process."""
2195
2160
2196
2161
def handle(self):
2197
2162
with contextlib.closing(self.server.child_pipe) as child_pipe:
2198
2163
logger.info("TCP connection from: %s",
2199
2164
str(self.client_address))
2200
2165
logger.debug("Pipe FD: %d",
2201
2166
self.server.child_pipe.fileno())
2202
2167
2203
2168
session = gnutls.ClientSession(self.request)
2204
2205
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2206
# "+AES-256-CBC", "+SHA1",
2207
# "+COMP-NULL", "+CTYPE-OPENPGP",
2208
# "+DHE-DSS"))
2169
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2173
# "+DHE-DSS"))
2209
2174
# Use a fallback default, since this MUST be set.
2210
2175
priority = self.server.gnutls_priority
2211
2176
if priority is None:
2212
2177
priority = "NORMAL"
2213
gnutls.priority_set_direct(session._c_object,
2214
priority.encode("utf-8"),
2178
gnutls.priority_set_direct(session._c_object, priority,
2215
2179
None)
2216
2180
2217
2181
# Start communication using the Mandos protocol
2218
2182
# Get protocol number
2219
2183
line = self.request.makefile().readline()
2224
2188
except (ValueError, IndexError, RuntimeError) as error:
2225
2189
logger.error("Unknown protocol version: %s", error)
2226
2190
return
2227
2191
2228
2192
# Start GnuTLS connection
2229
2193
try:
2230
2194
session.handshake()
2234
2198
# established. Just abandon the request.
2235
2199
return
2236
2200
logger.debug("Handshake succeeded")
2237
2201
2238
2202
approval_required = False
2239
2203
try:
2240
2204
try:
2244
2208
logger.warning("Bad certificate: %s", error)
2245
2209
return
2246
2210
logger.debug("Fingerprint: %s", fpr)
2247
2211
2248
2212
try:
2249
2213
client = ProxyClient(child_pipe, fpr,
2250
2214
self.client_address)
2251
2215
except KeyError:
2252
2216
return
2253
2217
2254
2218
if client.approval_delay:
2255
2219
delay = client.approval_delay
2256
2220
client.approvals_pending += 1
2257
2221
approval_required = True
2258
2222
2259
2223
while True:
2260
2224
if not client.enabled:
2261
2225
logger.info("Client %s is disabled",
2264
2228
# Emit D-Bus signal
2265
2229
client.Rejected("Disabled")
2266
2230
return
2267
2231
2268
2232
if client.approved or not client.approval_delay:
2269
# We are approved or approval is disabled
2233
#We are approved or approval is disabled
2270
2234
break
2271
2235
elif client.approved is None:
2272
2236
logger.info("Client %s needs approval",
2283
2247
# Emit D-Bus signal
2284
2248
client.Rejected("Denied")
2285
2249
return
2286
2287
# wait until timeout or approved
2250
2251
#wait until timeout or approved
2288
2252
time = datetime.datetime.now()
2289
2253
client.changedstate.acquire()
2290
2254
client.changedstate.wait(delay.total_seconds())
2303
2267
break
2304
2268
else:
2305
2269
delay -= time2 - time
2306
2270
2307
2271
try:
2308
2272
session.send(client.secret)
2309
2273
except gnutls.Error as error:
2310
2274
logger.warning("gnutls send failed",
2311
exc_info=error)
2275
exc_info = error)
2312
2276
return
2313
2277
2314
2278
logger.info("Sending secret to %s", client.name)
2315
2279
# bump the timeout using extended_timeout
2316
2280
client.bump_timeout(client.extended_timeout)
2317
2281
if self.server.use_dbus:
2318
2282
# Emit D-Bus signal
2319
2283
client.GotSecret()
2320
2284
2321
2285
finally:
2322
2286
if approval_required:
2323
2287
client.approvals_pending -= 1
2326
2290
except gnutls.Error as error:
2327
2291
logger.warning("GnuTLS bye failed",
2328
2292
exc_info=error)
2329
2293
2330
2294
@staticmethod
2331
2295
def peer_certificate(session):
2332
2296
"Return the peer's OpenPGP certificate as a bytestring"
2344
2308
return None
2345
2309
cert = cert_list[0]
2346
2310
return ctypes.string_at(cert.data, cert.size)
2347
2311
2348
2312
@staticmethod
2349
2313
def fingerprint(openpgp):
2350
2314
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2365
2329
ctypes.byref(crtverify))
2366
2330
if crtverify.value != 0:
2367
2331
gnutls.openpgp_crt_deinit(crt)
2368
raise gnutls.CertificateSecurityError(code
2369
=crtverify.value)
2332
raise gnutls.CertificateSecurityError("Verify failed")
2370
2333
# New buffer for the fingerprint
2371
2334
buf = ctypes.create_string_buffer(20)
2372
2335
buf_len = ctypes.c_size_t()
2384
2347
2385
2348
class MultiprocessingMixIn(object):
2386
2349
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2387
2350
2388
2351
def sub_process_main(self, request, address):
2389
2352
try:
2390
2353
self.finish_request(request, address)
2391
2354
except Exception:
2392
2355
self.handle_error(request, address)
2393
2356
self.close_request(request)
2394
2357
2395
2358
def process_request(self, request, address):
2396
2359
"""Start a new process to process the request."""
2397
proc = multiprocessing.Process(target=self.sub_process_main,
2398
args=(request, address))
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2399
2362
proc.start()
2400
2363
return proc
2401
2364
2402
2365
2403
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2404
2367
""" adds a pipe to the MixIn """
2405
2368
2406
2369
def process_request(self, request, client_address):
2407
2370
"""Overrides and wraps the original process_request().
2408
2371
2409
2372
This function creates a new pipe in self.pipe
2410
2373
"""
2411
2374
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2412
2375
2413
2376
proc = MultiprocessingMixIn.process_request(self, request,
2414
2377
client_address)
2415
2378
self.child_pipe.close()
2416
2379
self.add_pipe(parent_pipe, proc)
2417
2380
2418
2381
def add_pipe(self, parent_pipe, proc):
2419
2382
"""Dummy function; override as necessary"""
2420
2383
raise NotImplementedError()
2423
2386
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2424
2387
socketserver.TCPServer, object):
2425
2388
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2426
2389
2427
2390
Attributes:
2428
2391
enabled: Boolean; whether this server is activated yet
2429
2392
interface: None or a network interface name (string)
2430
2393
use_ipv6: Boolean; to use IPv6 or not
2431
2394
"""
2432
2395
2433
2396
def __init__(self, server_address, RequestHandlerClass,
2434
2397
interface=None,
2435
2398
use_ipv6=True,
2445
2408
self.socketfd = socketfd
2446
2409
# Save the original socket.socket() function
2447
2410
self.socket_socket = socket.socket
2448
2449
2411
# To implement --socket, we monkey patch socket.socket.
2450
#
2412
#
2451
2413
# (When socketserver.TCPServer is a new-style class, we
2452
2414
# could make self.socket into a property instead of monkey
2453
2415
# patching socket.socket.)
2454
#
2416
#
2455
2417
# Create a one-time-only replacement for socket.socket()
2456
2418
@functools.wraps(socket.socket)
2457
2419
def socket_wrapper(*args, **kwargs):
2469
2431
# socket_wrapper(), if socketfd was set.
2470
2432
socketserver.TCPServer.__init__(self, server_address,
2471
2433
RequestHandlerClass)
2472
2434
2473
2435
def server_bind(self):
2474
2436
"""This overrides the normal server_bind() function
2475
2437
to bind to an interface if one was specified, and also NOT to
2476
2438
bind to an address or port if they were not specified."""
2477
global SO_BINDTODEVICE
2478
2439
if self.interface is not None:
2479
2440
if SO_BINDTODEVICE is None:
2480
# Fall back to a hard-coded value which seems to be
2481
# common enough.
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2483
SO_BINDTODEVICE = 25
2484
try:
2485
self.socket.setsockopt(
2486
socket.SOL_SOCKET, SO_BINDTODEVICE,
2487
(self.interface + "\0").encode("utf-8"))
2488
except socket.error as error:
2489
if error.errno == errno.EPERM:
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2492
elif error.errno == errno.ENOPROTOOPT:
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2495
self.interface)
2496
elif error.errno == errno.ENODEV:
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
2499
else:
2500
raise
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2443
self.interface)
2444
else:
2445
try:
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2456
self.interface)
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2460
else:
2461
raise
2501
2462
# Only bind(2) the socket if we really need to.
2502
2463
if self.server_address[0] or self.server_address[1]:
2503
2464
if not self.server_address[0]:
2504
2465
if self.address_family == socket.AF_INET6:
2505
any_address = "::" # in6addr_any
2466
any_address = "::" # in6addr_any
2506
2467
else:
2507
any_address = "0.0.0.0" # INADDR_ANY
2468
any_address = "0.0.0.0" # INADDR_ANY
2508
2469
self.server_address = (any_address,
2509
2470
self.server_address[1])
2510
2471
elif not self.server_address[1]:
2520
2481
2521
2482
class MandosServer(IPv6_TCPServer):
2522
2483
"""Mandos server.
2523
2484
2524
2485
Attributes:
2525
2486
clients: set of Client objects
2526
2487
gnutls_priority GnuTLS priority string
2527
2488
use_dbus: Boolean; to emit D-Bus signals or not
2528
2529
Assumes a GLib.MainLoop event loop.
2489
2490
Assumes a GObject.MainLoop event loop.
2530
2491
"""
2531
2492
2532
2493
def __init__(self, server_address, RequestHandlerClass,
2533
2494
interface=None,
2534
2495
use_ipv6=True,
2544
2505
self.gnutls_priority = gnutls_priority
2545
2506
IPv6_TCPServer.__init__(self, server_address,
2546
2507
RequestHandlerClass,
2547
interface=interface,
2548
use_ipv6=use_ipv6,
2549
socketfd=socketfd)
2550
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2511
2551
2512
def server_activate(self):
2552
2513
if self.enabled:
2553
2514
return socketserver.TCPServer.server_activate(self)
2554
2515
2555
2516
def enable(self):
2556
2517
self.enabled = True
2557
2518
2558
2519
def add_pipe(self, parent_pipe, proc):
2559
2520
# Call "handle_ipc" for both data and EOF events
2560
GLib.io_add_watch(
2521
GObject.io_add_watch(
2561
2522
parent_pipe.fileno(),
2562
GLib.IO_IN | GLib.IO_HUP,
2523
GObject.IO_IN | GObject.IO_HUP,
2563
2524
functools.partial(self.handle_ipc,
2564
parent_pipe=parent_pipe,
2565
proc=proc))
2566
2525
parent_pipe = parent_pipe,
2526
proc = proc))
2527
2567
2528
def handle_ipc(self, source, condition,
2568
2529
parent_pipe=None,
2569
proc=None,
2530
proc = None,
2570
2531
client_object=None):
2571
2532
# error, or the other end of multiprocessing.Pipe has closed
2572
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2573
2534
# Wait for other process to exit
2574
2535
proc.join()
2575
2536
return False
2576
2537
2577
2538
# Read a request from the child
2578
2539
request = parent_pipe.recv()
2579
2540
command = request[0]
2580
2541
2581
2542
if command == 'init':
2582
fpr = request[1].decode("ascii")
2543
fpr = request[1]
2583
2544
address = request[2]
2584
2545
2585
2546
for c in self.clients.values():
2586
2547
if c.fingerprint == fpr:
2587
2548
client = c
2595
2556
address[0])
2596
2557
parent_pipe.send(False)
2597
2558
return False
2598
2599
GLib.io_add_watch(
2559
2560
GObject.io_add_watch(
2600
2561
parent_pipe.fileno(),
2601
GLib.IO_IN | GLib.IO_HUP,
2562
GObject.IO_IN | GObject.IO_HUP,
2602
2563
functools.partial(self.handle_ipc,
2603
parent_pipe=parent_pipe,
2604
proc=proc,
2605
client_object=client))
2564
parent_pipe = parent_pipe,
2565
proc = proc,
2566
client_object = client))
2606
2567
parent_pipe.send(True)
2607
2568
# remove the old hook in favor of the new above hook on
2608
2569
# same fileno
2611
2572
funcname = request[1]
2612
2573
args = request[2]
2613
2574
kwargs = request[3]
2614
2575
2615
2576
parent_pipe.send(('data', getattr(client_object,
2616
2577
funcname)(*args,
2617
2578
**kwargs)))
2618
2579
2619
2580
if command == 'getattr':
2620
2581
attrname = request[1]
2621
2582
if isinstance(client_object.__getattribute__(attrname),
2624
2585
else:
2625
2586
parent_pipe.send((
2626
2587
'data', client_object.__getattribute__(attrname)))
2627
2588
2628
2589
if command == 'setattr':
2629
2590
attrname = request[1]
2630
2591
value = request[2]
2631
2592
setattr(client_object, attrname, value)
2632
2593
2633
2594
return True
2634
2595
2635
2596
2636
2597
def rfc3339_duration_to_delta(duration):
2637
2598
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2638
2599
2639
2600
>>> rfc3339_duration_to_delta("P7D")
2640
2601
datetime.timedelta(7)
2641
2602
>>> rfc3339_duration_to_delta("PT60S")
2651
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2652
2613
datetime.timedelta(1, 200)
2653
2614
"""
2654
2615
2655
2616
# Parsing an RFC 3339 duration with regular expressions is not
2656
2617
# possible - there would have to be multiple places for the same
2657
2618
# values, like seconds. The current code, while more esoteric, is
2658
2619
# cleaner without depending on a parsing library. If Python had a
2659
2620
# built-in library for parsing we would use it, but we'd like to
2660
2621
# avoid excessive use of external libraries.
2661
2622
2662
2623
# New type for defining tokens, syntax, and semantics all-in-one
2663
2624
Token = collections.namedtuple("Token", (
2664
2625
"regexp", # To match token; if "value" is not None, must have
2697
2658
frozenset((token_year, token_month,
2698
2659
token_day, token_time,
2699
2660
token_week)))
2700
# Define starting values:
2701
# Value so far
2702
value = datetime.timedelta()
2661
# Define starting values
2662
value = datetime.timedelta() # Value so far
2703
2663
found_token = None
2704
# Following valid tokens
2705
followers = frozenset((token_duration, ))
2706
# String left to parse
2707
s = duration
2664
followers = frozenset((token_duration, )) # Following valid tokens
2665
s = duration # String left to parse
2708
2666
# Loop until end token is found
2709
2667
while found_token is not token_end:
2710
2668
# Search for any currently valid tokens
2734
2692
2735
2693
def string_to_delta(interval):
2736
2694
"""Parse a string and return a datetime.timedelta
2737
2695
2738
2696
>>> string_to_delta('7d')
2739
2697
datetime.timedelta(7)
2740
2698
>>> string_to_delta('60s')
2748
2706
>>> string_to_delta('5m 30s')
2749
2707
datetime.timedelta(0, 330)
2750
2708
"""
2751
2709
2752
2710
try:
2753
2711
return rfc3339_duration_to_delta(interval)
2754
2712
except ValueError:
2755
2713
pass
2756
2714
2757
2715
timevalue = datetime.timedelta(0)
2758
2716
for s in interval.split():
2759
2717
try:
2777
2735
return timevalue
2778
2736
2779
2737
2780
def daemon(nochdir=False, noclose=False):
2738
def daemon(nochdir = False, noclose = False):
2781
2739
"""See daemon(3). Standard BSD Unix function.
2782
2740
2783
2741
This should really exist as os.daemon, but it doesn't (yet)."""
2784
2742
if os.fork():
2785
2743
sys.exit()
2803
2761
2804
2762
2805
2763
def main():
2806
2764
2807
2765
##################################################################
2808
2766
# Parsing of options, both command line and config file
2809
2767
2810
2768
parser = argparse.ArgumentParser()
2811
2769
parser.add_argument("-v", "--version", action="version",
2812
version="%(prog)s {}".format(version),
2770
version = "%(prog)s {}".format(version),
2813
2771
help="show version number and exit")
2814
2772
parser.add_argument("-i", "--interface", metavar="IF",
2815
2773
help="Bind to interface IF")
2851
2809
parser.add_argument("--no-zeroconf", action="store_false",
2852
2810
dest="zeroconf", help="Do not use Zeroconf",
2853
2811
default=None)
2854
2812
2855
2813
options = parser.parse_args()
2856
2814
2857
2815
if options.check:
2858
2816
import doctest
2859
2817
fail_count, test_count = doctest.testmod()
2860
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2861
2819
2862
2820
# Default values for config file for server-global settings
2863
server_defaults = {"interface": "",
2864
"address": "",
2865
"port": "",
2866
"debug": "False",
2867
"priority":
2868
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2869
":+SIGN-DSA-SHA256",
2870
"servicename": "Mandos",
2871
"use_dbus": "True",
2872
"use_ipv6": "True",
2873
"debuglevel": "",
2874
"restore": "True",
2875
"socket": "",
2876
"statedir": "/var/lib/mandos",
2877
"foreground": "False",
2878
"zeroconf": "True",
2879
}
2880
2821
server_defaults = { "interface": "",
2822
"address": "",
2823
"port": "",
2824
"debug": "False",
2825
"priority":
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2829
"use_dbus": "True",
2830
"use_ipv6": "True",
2831
"debuglevel": "",
2832
"restore": "True",
2833
"socket": "",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2836
"zeroconf": "True",
2837
}
2838
2881
2839
# Parse config file for server-global settings
2882
2840
server_config = configparser.SafeConfigParser(server_defaults)
2883
2841
del server_defaults
2885
2843
# Convert the SafeConfigParser object to a dict
2886
2844
server_settings = server_config.defaults()
2887
2845
# Use the appropriate methods on the non-string config options
2888
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2889
"foreground", "zeroconf"):
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2890
2847
server_settings[option] = server_config.getboolean("DEFAULT",
2891
2848
option)
2892
2849
if server_settings["port"]:
2902
2859
server_settings["socket"] = os.dup(server_settings
2903
2860
["socket"])
2904
2861
del server_config
2905
2862
2906
2863
# Override the settings from the config file with command line
2907
2864
# options, if set.
2908
2865
for option in ("interface", "address", "port", "debug",
2926
2883
if server_settings["debug"]:
2927
2884
server_settings["foreground"] = True
2928
2885
# Now we have our good server settings in "server_settings"
2929
2886
2930
2887
##################################################################
2931
2888
2932
2889
if (not server_settings["zeroconf"]
2933
2890
and not (server_settings["port"]
2934
2891
or server_settings["socket"] != "")):
2935
2892
parser.error("Needs port or socket to work without Zeroconf")
2936
2893
2937
2894
# For convenience
2938
2895
debug = server_settings["debug"]
2939
2896
debuglevel = server_settings["debuglevel"]
2943
2900
stored_state_file)
2944
2901
foreground = server_settings["foreground"]
2945
2902
zeroconf = server_settings["zeroconf"]
2946
2903
2947
2904
if debug:
2948
2905
initlogger(debug, logging.DEBUG)
2949
2906
else:
2952
2909
else:
2953
2910
level = getattr(logging, debuglevel.upper())
2954
2911
initlogger(debug, level)
2955
2912
2956
2913
if server_settings["servicename"] != "Mandos":
2957
2914
syslogger.setFormatter(
2958
2915
logging.Formatter('Mandos ({}) [%(process)d]:'
2959
2916
' %(levelname)s: %(message)s'.format(
2960
2917
server_settings["servicename"])))
2961
2918
2962
2919
# Parse config file with clients
2963
2920
client_config = configparser.SafeConfigParser(Client
2964
2921
.client_defaults)
2965
2922
client_config.read(os.path.join(server_settings["configdir"],
2966
2923
"clients.conf"))
2967
2924
2968
2925
global mandos_dbus_service
2969
2926
mandos_dbus_service = None
2970
2927
2971
2928
socketfd = None
2972
2929
if server_settings["socket"] != "":
2973
2930
socketfd = server_settings["socket"]
2989
2946
except IOError as e:
2990
2947
logger.error("Could not open file %r", pidfilename,
2991
2948
exc_info=e)
2992
2949
2993
2950
for name, group in (("_mandos", "_mandos"),
2994
2951
("mandos", "mandos"),
2995
2952
("nobody", "nogroup")):
3013
2970
.format(uid, gid, os.strerror(error.errno)))
3014
2971
if error.errno != errno.EPERM:
3015
2972
raise
3016
2973
3017
2974
if debug:
3018
2975
# Enable all possible GnuTLS debugging
3019
2976
3020
2977
# "Use a log level over 10 to enable all debugging options."
3021
2978
# - GnuTLS manual
3022
2979
gnutls.global_set_log_level(11)
3023
2980
3024
2981
@gnutls.log_func
3025
2982
def debug_gnutls(level, string):
3026
2983
logger.debug("GnuTLS: %s", string[:-1])
3027
2984
3028
2985
gnutls.global_set_log_function(debug_gnutls)
3029
2986
3030
2987
# Redirect stdin so all checkers get /dev/null
3031
2988
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3032
2989
os.dup2(null, sys.stdin.fileno())
3033
2990
if null > 2:
3034
2991
os.close(null)
3035
2992
3036
2993
# Need to fork before connecting to D-Bus
3037
2994
if not foreground:
3038
2995
# Close all input and output, do double fork, etc.
3039
2996
daemon()
3040
3041
# multiprocessing will use threads, so before we use GLib we need
3042
# to inform GLib that threads will be used.
3043
GLib.threads_init()
3044
2997
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
3001
3045
3002
global main_loop
3046
3003
# From the Avahi example code
3047
3004
DBusGMainLoop(set_as_default=True)
3048
main_loop = GLib.MainLoop()
3005
main_loop = GObject.MainLoop()
3049
3006
bus = dbus.SystemBus()
3050
3007
# End of Avahi example code
3051
3008
if use_dbus:
3064
3021
if zeroconf:
3065
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3066
3023
service = AvahiServiceToSyslog(
3067
name=server_settings["servicename"],
3068
servicetype="_mandos._tcp",
3069
protocol=protocol,
3070
bus=bus)
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3027
bus = bus)
3071
3028
if server_settings["interface"]:
3072
3029
service.interface = if_nametoindex(
3073
3030
server_settings["interface"].encode("utf-8"))
3074
3031
3075
3032
global multiprocessing_manager
3076
3033
multiprocessing_manager = multiprocessing.Manager()
3077
3034
3078
3035
client_class = Client
3079
3036
if use_dbus:
3080
client_class = functools.partial(ClientDBus, bus=bus)
3081
3037
client_class = functools.partial(ClientDBus, bus = bus)
3038
3082
3039
client_settings = Client.config_parser(client_config)
3083
3040
old_client_settings = {}
3084
3041
clients_data = {}
3085
3042
3086
3043
# This is used to redirect stdout and stderr for checker processes
3087
3044
global wnull
3088
wnull = open(os.devnull, "w") # A writable /dev/null
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3089
3046
# Only used if server is running in foreground but not in debug
3090
3047
# mode
3091
3048
if debug or not foreground:
3092
3049
wnull.close()
3093
3050
3094
3051
# Get client data and settings from last running state.
3095
3052
if server_settings["restore"]:
3096
3053
try:
3097
3054
with open(stored_state_path, "rb") as stored_state:
3098
if sys.version_info.major == 2:
3055
if sys.version_info.major == 2:
3099
3056
clients_data, old_client_settings = pickle.load(
3100
3057
stored_state)
3101
3058
else:
3102
3059
bytes_clients_data, bytes_old_client_settings = (
3103
pickle.load(stored_state, encoding="bytes"))
3104
# Fix bytes to strings
3105
# clients_data
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3062
## clients_data
3106
3063
# .keys()
3107
clients_data = {(key.decode("utf-8")
3108
if isinstance(key, bytes)
3109
else key): value
3110
for key, value in
3111
bytes_clients_data.items()}
3112
del bytes_clients_data
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3066
else key): value
3067
for key, value in
3068
bytes_clients_data.items() }
3113
3069
for key in clients_data:
3114
value = {(k.decode("utf-8")
3115
if isinstance(k, bytes) else k): v
3116
for k, v in
3117
clients_data[key].items()}
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3118
3074
clients_data[key] = value
3119
3075
# .client_structure
3120
3076
value["client_structure"] = [
3121
3077
(s.decode("utf-8")
3122
3078
if isinstance(s, bytes)
3123
3079
else s) for s in
3124
value["client_structure"]]
3080
value["client_structure"] ]
3125
3081
# .name & .host
3126
3082
for k in ("name", "host"):
3127
3083
if isinstance(value[k], bytes):
3128
3084
value[k] = value[k].decode("utf-8")
3129
# old_client_settings
3130
# .keys()
3085
## old_client_settings
3086
# .keys
3131
3087
old_client_settings = {
3132
3088
(key.decode("utf-8")
3133
3089
if isinstance(key, bytes)
3134
3090
else key): value
3135
3091
for key, value in
3136
bytes_old_client_settings.items()}
3137
del bytes_old_client_settings
3092
bytes_old_client_settings.items() }
3138
3093
# .host
3139
3094
for value in old_client_settings.values():
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
3142
.decode("utf-8"))
3095
value["host"] = value["host"].decode("utf-8")
3143
3096
os.remove(stored_state_path)
3144
3097
except IOError as e:
3145
3098
if e.errno == errno.ENOENT:
3153
3106
logger.warning("Could not load persistent state: "
3154
3107
"EOFError:",
3155
3108
exc_info=e)
3156
3109
3157
3110
with PGPEngine() as pgp:
3158
3111
for client_name, client in clients_data.items():
3159
3112
# Skip removed clients
3160
3113
if client_name not in client_settings:
3161
3114
continue
3162
3115
3163
3116
# Decide which value to use after restoring saved state.
3164
3117
# We have three different values: Old config file,
3165
3118
# new config file, and saved state.
3176
3129
client[name] = value
3177
3130
except KeyError:
3178
3131
pass
3179
3132
3180
3133
# Clients who has passed its expire date can still be
3181
3134
# enabled if its last checker was successful. A Client
3182
3135
# whose checker succeeded before we stored its state is
3215
3168
client_name))
3216
3169
client["secret"] = (client_settings[client_name]
3217
3170
["secret"])
3218
3171
3219
3172
# Add/remove clients based on new changes made to config
3220
3173
for client_name in (set(old_client_settings)
3221
3174
- set(client_settings)):
3223
3176
for client_name in (set(client_settings)
3224
3177
- set(old_client_settings)):
3225
3178
clients_data[client_name] = client_settings[client_name]
3226
3179
3227
3180
# Create all client objects
3228
3181
for client_name, client in clients_data.items():
3229
3182
tcp_server.clients[client_name] = client_class(
3230
name=client_name,
3231
settings=client,
3232
server_settings=server_settings)
3233
3183
name = client_name,
3184
settings = client,
3185
server_settings = server_settings)
3186
3234
3187
if not tcp_server.clients:
3235
3188
logger.warning("No clients defined")
3236
3189
3237
3190
if not foreground:
3238
3191
if pidfile is not None:
3239
3192
pid = os.getpid()
3245
3198
pidfilename, pid)
3246
3199
del pidfile
3247
3200
del pidfilename
3248
3249
for termsig in (signal.SIGHUP, signal.SIGTERM):
3250
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3251
lambda: main_loop.quit() and False)
3252
3201
3202
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3203
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3204
3253
3205
if use_dbus:
3254
3206
3255
3207
@alternate_dbus_interfaces(
3256
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3208
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3257
3209
class MandosDBusService(DBusObjectWithObjectManager):
3258
3210
"""A D-Bus proxy object"""
3259
3211
3260
3212
def __init__(self):
3261
3213
dbus.service.Object.__init__(self, bus, "/")
3262
3214
3263
3215
_interface = "se.recompile.Mandos"
3264
3216
3265
3217
@dbus.service.signal(_interface, signature="o")
3266
3218
def ClientAdded(self, objpath):
3267
3219
"D-Bus signal"
3268
3220
pass
3269
3221
3270
3222
@dbus.service.signal(_interface, signature="ss")
3271
3223
def ClientNotFound(self, fingerprint, address):
3272
3224
"D-Bus signal"
3273
3225
pass
3274
3226
3275
3227
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3276
3228
"true"})
3277
3229
@dbus.service.signal(_interface, signature="os")
3278
3230
def ClientRemoved(self, objpath, name):
3279
3231
"D-Bus signal"
3280
3232
pass
3281
3233
3282
3234
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3283
3235
"true"})
3284
3236
@dbus.service.method(_interface, out_signature="ao")
3286
3238
"D-Bus method"
3287
3239
return dbus.Array(c.dbus_object_path for c in
3288
3240
tcp_server.clients.values())
3289
3241
3290
3242
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3291
3243
"true"})
3292
3244
@dbus.service.method(_interface,
3294
3246
def GetAllClientsWithProperties(self):
3295
3247
"D-Bus method"
3296
3248
return dbus.Dictionary(
3297
{c.dbus_object_path: c.GetAll(
3249
{ c.dbus_object_path: c.GetAll(
3298
3250
"se.recompile.Mandos.Client")
3299
for c in tcp_server.clients.values()},
3251
for c in tcp_server.clients.values() },
3300
3252
signature="oa{sv}")
3301
3253
3302
3254
@dbus.service.method(_interface, in_signature="o")
3303
3255
def RemoveClient(self, object_path):
3304
3256
"D-Bus method"
3312
3264
self.client_removed_signal(c)
3313
3265
return
3314
3266
raise KeyError(object_path)
3315
3267
3316
3268
del _interface
3317
3269
3318
3270
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3319
out_signature="a{oa{sa{sv}}}")
3271
out_signature = "a{oa{sa{sv}}}")
3320
3272
def GetManagedObjects(self):
3321
3273
"""D-Bus method"""
3322
3274
return dbus.Dictionary(
3323
{client.dbus_object_path:
3324
dbus.Dictionary(
3325
{interface: client.GetAll(interface)
3326
for interface in
3327
client._get_all_interface_names()})
3328
for client in tcp_server.clients.values()})
3329
3275
{ client.dbus_object_path:
3276
dbus.Dictionary(
3277
{ interface: client.GetAll(interface)
3278
for interface in
3279
client._get_all_interface_names()})
3280
for client in tcp_server.clients.values()})
3281
3330
3282
def client_added_signal(self, client):
3331
3283
"""Send the new standard signal and the old signal"""
3332
3284
if use_dbus:
3334
3286
self.InterfacesAdded(
3335
3287
client.dbus_object_path,
3336
3288
dbus.Dictionary(
3337
{interface: client.GetAll(interface)
3338
for interface in
3339
client._get_all_interface_names()}))
3289
{ interface: client.GetAll(interface)
3290
for interface in
3291
client._get_all_interface_names()}))
3340
3292
# Old signal
3341
3293
self.ClientAdded(client.dbus_object_path)
3342
3294
3343
3295
def client_removed_signal(self, client):
3344
3296
"""Send the new standard signal and the old signal"""
3345
3297
if use_dbus:
3350
3302
# Old signal
3351
3303
self.ClientRemoved(client.dbus_object_path,
3352
3304
client.name)
3353
3305
3354
3306
mandos_dbus_service = MandosDBusService()
3355
3356
# Save modules to variables to exempt the modules from being
3357
# unloaded before the function registered with atexit() is run.
3358
mp = multiprocessing
3359
wn = wnull
3360
3307
3361
3308
def cleanup():
3362
3309
"Cleanup function; run on exit"
3363
3310
if zeroconf:
3364
3311
service.cleanup()
3365
3366
mp.active_children()
3367
wn.close()
3312
3313
multiprocessing.active_children()
3314
wnull.close()
3368
3315
if not (tcp_server.clients or client_settings):
3369
3316
return
3370
3317
3371
3318
# Store client before exiting. Secrets are encrypted with key
3372
3319
# based on what config file has. If config file is
3373
3320
# removed/edited, old secret will thus be unrecovable.
3378
3325
client.encrypted_secret = pgp.encrypt(client.secret,
3379
3326
key)
3380
3327
client_dict = {}
3381
3328
3382
3329
# A list of attributes that can not be pickled
3383
3330
# + secret.
3384
exclude = {"bus", "changedstate", "secret",
3385
"checker", "server_settings"}
3331
exclude = { "bus", "changedstate", "secret",
3332
"checker", "server_settings" }
3386
3333
for name, typ in inspect.getmembers(dbus.service
3387
3334
.Object):
3388
3335
exclude.add(name)
3389
3336
3390
3337
client_dict["encrypted_secret"] = (client
3391
3338
.encrypted_secret)
3392
3339
for attr in client.client_structure:
3393
3340
if attr not in exclude:
3394
3341
client_dict[attr] = getattr(client, attr)
3395
3342
3396
3343
clients[client.name] = client_dict
3397
3344
del client_settings[client.name]["secret"]
3398
3345
3399
3346
try:
3400
3347
with tempfile.NamedTemporaryFile(
3401
3348
mode='wb',
3404
3351
dir=os.path.dirname(stored_state_path),
3405
3352
delete=False) as stored_state:
3406
3353
pickle.dump((clients, client_settings), stored_state,
3407
protocol=2)
3354
protocol = 2)
3408
3355
tempname = stored_state.name
3409
3356
os.rename(tempname, stored_state_path)
3410
3357
except (IOError, OSError) as e:
3420
3367
logger.warning("Could not save persistent state:",
3421
3368
exc_info=e)
3422
3369
raise
3423
3370
3424
3371
# Delete all clients, and settings from config
3425
3372
while tcp_server.clients:
3426
3373
name, client = tcp_server.clients.popitem()
3432
3379
if use_dbus:
3433
3380
mandos_dbus_service.client_removed_signal(client)
3434
3381
client_settings.clear()
3435
3382
3436
3383
atexit.register(cleanup)
3437
3384
3438
3385
for client in tcp_server.clients.values():
3439
3386
if use_dbus:
3440
3387
# Emit D-Bus signal for adding
3442
3389
# Need to initiate checking of clients
3443
3390
if client.enabled:
3444
3391
client.init_checker()
3445
3392
3446
3393
tcp_server.enable()
3447
3394
tcp_server.server_activate()
3448
3395
3449
3396
# Find out what port we got
3450
3397
if zeroconf:
3451
3398
service.port = tcp_server.socket.getsockname()[1]
3456
3403
else: # IPv4
3457
3404
logger.info("Now listening on address %r, port %d",
3458
3405
*tcp_server.socket.getsockname())
3459
3460
# service.interface = tcp_server.socket.getsockname()[3]
3461
3406
3407
#service.interface = tcp_server.socket.getsockname()[3]
3408
3462
3409
try:
3463
3410
if zeroconf:
3464
3411
# From the Avahi example code
3469
3416
cleanup()
3470
3417
sys.exit(1)
3471
3418
# End of Avahi example code
3472
3473
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3474
lambda *args, **kwargs:
3475
(tcp_server.handle_request
3476
(*args[2:], **kwargs) or True))
3477
3419
3420
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3421
lambda *args, **kwargs:
3422
(tcp_server.handle_request
3423
(*args[2:], **kwargs) or True))
3424
3478
3425
logger.debug("Starting main loop")
3479
3426
main_loop.run()
3480
3427
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0