To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.392
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.392
- Committer: Teddy Hogeborn
- Date: 2016-03-23 07:11:22 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 343.
- Revision ID: teddy@recompile.se-20160323071122-55srtjdizr21rr7f
Use HTTPS in home page links
Since we have a real certificate now, change all links to the home
page to use HTTPS.
* README: Use HTTPS in home page links
* debian/control (Source: mandos/Homepage): - '' -
* debian/copyright (Source): - '' -
* intro.xml (SEE ALSO): - '' -
* mandos.lsm (Primary-site): - '' -
Since we have a real certificate now, change all links to the home
page to use HTTPS.
* README: Use HTTPS in home page links
* debian/control (Source: mandos/Homepage): - '' -
* debian/copyright (Source): - '' -
* intro.xml (SEE ALSO): - '' -
* mandos.lsm (Primary-site): - '' -
- files modified:
- INSTALL
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
14
# Copyright © 2008-2016 Teddy Hogeborn
15
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
23
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
25
# GNU General Public License for more details.
26
#
26
#
27
27
# You should have received a copy of the GNU General Public License
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
#
30
#
31
31
# Contact the authors at <mandos@recompile.se>.
32
#
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
86
86
import xml.dom.minidom
87
87
import inspect
88
88
89
# Try to find the value of SO_BINDTODEVICE:
90
89
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
90
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
91
except AttributeError:
95
92
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
98
93
from IN import SO_BINDTODEVICE
99
94
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
95
SO_BINDTODEVICE = None
113
96
114
97
if sys.version_info.major == 2:
115
98
str = unicode
116
99
117
version = "1.7.13"
100
version = "1.7.7"
118
101
stored_state_file = "clients.pickle"
119
102
120
103
logger = logging.getLogger()
124
107
if_nametoindex = ctypes.cdll.LoadLibrary(
125
108
ctypes.util.find_library("c")).if_nametoindex
126
109
except (OSError, AttributeError):
127
110
128
111
def if_nametoindex(interface):
129
112
"Get an interface index the hard way, i.e. using fcntl()"
130
113
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
153
136
154
137
def initlogger(debug, level=logging.WARNING):
155
138
"""init logger and add loglevel"""
156
139
157
140
global syslogger
158
141
syslogger = (logging.handlers.SysLogHandler(
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
address="/dev/log"))
142
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
143
address = "/dev/log"))
161
144
syslogger.setFormatter(logging.Formatter
162
145
('Mandos [%(process)d]: %(levelname)s:'
163
146
' %(message)s'))
164
147
logger.addHandler(syslogger)
165
148
166
149
if debug:
167
150
console = logging.StreamHandler()
168
151
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
180
163
181
164
class PGPEngine(object):
182
165
"""A simple class for OpenPGP symmetric encryption & decryption"""
183
166
184
167
def __init__(self):
185
168
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
169
self.gpg = "gpg"
197
180
self.gnupgargs = ['--batch',
198
181
'--homedir', self.tempdir,
199
182
'--force-mdc',
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
204
183
'--quiet',
184
'--no-use-agent']
185
205
186
def __enter__(self):
206
187
return self
207
188
208
189
def __exit__(self, exc_type, exc_value, traceback):
209
190
self._cleanup()
210
191
return False
211
192
212
193
def __del__(self):
213
194
self._cleanup()
214
195
215
196
def _cleanup(self):
216
197
if self.tempdir is not None:
217
198
# Delete contents of tempdir
218
199
for root, dirs, files in os.walk(self.tempdir,
219
topdown=False):
200
topdown = False):
220
201
for filename in files:
221
202
os.remove(os.path.join(root, filename))
222
203
for dirname in dirs:
224
205
# Remove tempdir
225
206
os.rmdir(self.tempdir)
226
207
self.tempdir = None
227
208
228
209
def password_encode(self, password):
229
210
# Passphrase can not be empty and can not contain newlines or
230
211
# NUL bytes. So we prefix it and hex encode it.
235
216
.replace(b"\n", b"\\n")
236
217
.replace(b"\0", b"\\x00"))
237
218
return encoded
238
219
239
220
def encrypt(self, data, password):
240
221
passphrase = self.password_encode(password)
241
222
with tempfile.NamedTemporaryFile(
246
227
'--passphrase-file',
247
228
passfile.name]
248
229
+ self.gnupgargs,
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
230
stdin = subprocess.PIPE,
231
stdout = subprocess.PIPE,
232
stderr = subprocess.PIPE)
233
ciphertext, err = proc.communicate(input = data)
253
234
if proc.returncode != 0:
254
235
raise PGPError(err)
255
236
return ciphertext
256
237
257
238
def decrypt(self, data, password):
258
239
passphrase = self.password_encode(password)
259
240
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
241
dir = self.tempdir) as passfile:
261
242
passfile.write(passphrase)
262
243
passfile.flush()
263
244
proc = subprocess.Popen([self.gpg, '--decrypt',
264
245
'--passphrase-file',
265
246
passfile.name]
266
247
+ self.gnupgargs,
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
248
stdin = subprocess.PIPE,
249
stdout = subprocess.PIPE,
250
stderr = subprocess.PIPE)
251
decrypted_plaintext, err = proc.communicate(input = data)
271
252
if proc.returncode != 0:
272
253
raise PGPError(err)
273
254
return decrypted_plaintext
274
255
275
276
256
# Pretend that we have an Avahi module
277
257
class Avahi(object):
278
258
"""This isn't so much a class as it is a module-like namespace.
279
259
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
284
264
DBUS_NAME = "org.freedesktop.Avahi"
285
265
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
266
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
267
DBUS_PATH_SERVER = "/"
288
289
268
def string_array_to_txt_array(self, t):
290
269
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
270
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
300
279
avahi = Avahi()
301
280
302
303
281
class AvahiError(Exception):
304
282
def __init__(self, value, *args, **kwargs):
305
283
self.value = value
317
295
318
296
class AvahiService(object):
319
297
"""An Avahi (Zeroconf) service.
320
298
321
299
Attributes:
322
300
interface: integer; avahi.IF_UNSPEC or an interface index.
323
301
Used to optionally bind to the specified interface.
335
313
server: D-Bus Server
336
314
bus: dbus.SystemBus()
337
315
"""
338
316
339
317
def __init__(self,
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
318
interface = avahi.IF_UNSPEC,
319
name = None,
320
servicetype = None,
321
port = None,
322
TXT = None,
323
domain = "",
324
host = "",
325
max_renames = 32768,
326
protocol = avahi.PROTO_UNSPEC,
327
bus = None):
350
328
self.interface = interface
351
329
self.name = name
352
330
self.type = servicetype
361
339
self.server = None
362
340
self.bus = bus
363
341
self.entry_group_state_changed_match = None
364
342
365
343
def rename(self, remove=True):
366
344
"""Derived from the Avahi example code"""
367
345
if self.rename_count >= self.max_renames:
387
365
logger.critical("D-Bus Exception", exc_info=error)
388
366
self.cleanup()
389
367
os._exit(1)
390
368
391
369
def remove(self):
392
370
"""Derived from the Avahi example code"""
393
371
if self.entry_group_state_changed_match is not None:
395
373
self.entry_group_state_changed_match = None
396
374
if self.group is not None:
397
375
self.group.Reset()
398
376
399
377
def add(self):
400
378
"""Derived from the Avahi example code"""
401
379
self.remove()
418
396
dbus.UInt16(self.port),
419
397
avahi.string_array_to_txt_array(self.TXT))
420
398
self.group.Commit()
421
399
422
400
def entry_group_state_changed(self, state, error):
423
401
"""Derived from the Avahi example code"""
424
402
logger.debug("Avahi entry group state change: %i", state)
425
403
426
404
if state == avahi.ENTRY_GROUP_ESTABLISHED:
427
405
logger.debug("Zeroconf service established.")
428
406
elif state == avahi.ENTRY_GROUP_COLLISION:
432
410
logger.critical("Avahi: Error in group state changed %s",
433
411
str(error))
434
412
raise AvahiGroupError("State changed: {!s}".format(error))
435
413
436
414
def cleanup(self):
437
415
"""Derived from the Avahi example code"""
438
416
if self.group is not None:
443
421
pass
444
422
self.group = None
445
423
self.remove()
446
424
447
425
def server_state_changed(self, state, error=None):
448
426
"""Derived from the Avahi example code"""
449
427
logger.debug("Avahi server state change: %i", state)
478
456
logger.debug("Unknown state: %r", state)
479
457
else:
480
458
logger.debug("Unknown state: %r: %r", state, error)
481
459
482
460
def activate(self):
483
461
"""Derived from the Avahi example code"""
484
462
if self.server is None:
501
479
.format(self.name)))
502
480
return ret
503
481
504
505
482
# Pretend that we have a GnuTLS module
506
483
class GnuTLS(object):
507
484
"""This isn't so much a class as it is a module-like namespace.
508
485
It is instantiated once, and simulates having a GnuTLS module."""
509
510
library = ctypes.util.find_library("gnutls")
511
if library is None:
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
514
del library
486
487
_library = ctypes.cdll.LoadLibrary(
488
ctypes.util.find_library("gnutls"))
515
489
_need_version = b"3.3.0"
516
517
490
def __init__(self):
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
523
491
# Need to use class name "GnuTLS" here, since this method is
492
# called before the assignment to the "gnutls" global variable
493
# happens.
494
if GnuTLS.check_version(self._need_version) is None:
495
raise GnuTLS.Error("Needs GnuTLS {} or later"
496
.format(self._need_version))
497
524
498
# Unless otherwise indicated, the constants and types below are
525
499
# all from the gnutls/gnutls.h C header file.
526
500
527
501
# Constants
528
502
E_SUCCESS = 0
529
503
E_INTERRUPTED = -52
534
508
CRD_CERTIFICATE = 1
535
509
E_NO_CERTIFICATE_FOUND = -49
536
510
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
537
511
538
512
# Types
539
513
class session_int(ctypes.Structure):
540
514
_fields_ = []
541
515
session_t = ctypes.POINTER(session_int)
542
543
516
class certificate_credentials_st(ctypes.Structure):
544
517
_fields_ = []
545
518
certificate_credentials_t = ctypes.POINTER(
546
519
certificate_credentials_st)
547
520
certificate_type_t = ctypes.c_int
548
549
521
class datum_t(ctypes.Structure):
550
522
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
523
('size', ctypes.c_uint)]
552
553
524
class openpgp_crt_int(ctypes.Structure):
554
525
_fields_ = []
555
526
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
528
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
529
credentials_type_t = ctypes.c_int
559
530
transport_ptr_t = ctypes.c_void_p
560
531
close_request_t = ctypes.c_int
561
532
562
533
# Exceptions
563
534
class Error(Exception):
564
535
# We need to use the class name "GnuTLS" here, since this
565
536
# exception might be raised from within GnuTLS.__init__,
566
537
# which is called before the assignment to the "gnutls"
567
538
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
539
def __init__(self, message = None, code = None, args=()):
569
540
# Default usage is by a message string, but if a return
570
541
# code is passed, convert it to a string with
571
542
# gnutls.strerror()
574
545
message = GnuTLS.strerror(code)
575
546
return super(GnuTLS.Error, self).__init__(
576
547
message, *args)
577
548
578
549
class CertificateSecurityError(Error):
579
550
pass
580
551
581
552
# Classes
582
553
class Credentials(object):
583
554
def __init__(self):
585
556
gnutls.certificate_allocate_credentials(
586
557
ctypes.byref(self._c_object))
587
558
self.type = gnutls.CRD_CERTIFICATE
588
559
589
560
def __del__(self):
590
561
gnutls.certificate_free_credentials(self._c_object)
591
562
592
563
class ClientSession(object):
593
def __init__(self, socket, credentials=None):
564
def __init__(self, socket, credentials = None):
594
565
self._c_object = gnutls.session_t()
595
566
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
567
gnutls.set_default_priority(self._c_object)
604
575
ctypes.cast(credentials._c_object,
605
576
ctypes.c_void_p))
606
577
self.credentials = credentials
607
578
608
579
def __del__(self):
609
580
gnutls.deinit(self._c_object)
610
581
611
582
def handshake(self):
612
583
return gnutls.handshake(self._c_object)
613
584
614
585
def send(self, data):
615
586
data = bytes(data)
616
587
data_len = len(data)
618
589
data_len -= gnutls.record_send(self._c_object,
619
590
data[-data_len:],
620
591
data_len)
621
592
622
593
def bye(self):
623
594
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
595
625
596
# Error handling functions
626
597
def _error_code(result):
627
598
"""A function to raise exceptions on errors, suitable
629
600
if result >= 0:
630
601
return result
631
602
if result == gnutls.E_NO_CERTIFICATE_FOUND:
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
634
603
raise gnutls.CertificateSecurityError(code = result)
604
raise gnutls.Error(code = result)
605
635
606
def _retry_on_error(result, func, arguments):
636
607
"""A function to retry on some errors, suitable
637
608
for the 'errcheck' attribute on ctypes functions"""
640
611
return _error_code(result)
641
612
result = func(*arguments)
642
613
return result
643
614
644
615
# Unless otherwise indicated, the function declarations below are
645
616
# all from the gnutls/gnutls.h C header file.
646
617
647
618
# Functions
648
619
priority_set_direct = _library.gnutls_priority_set_direct
649
620
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
621
ctypes.POINTER(ctypes.c_char_p)]
651
622
priority_set_direct.restype = _error_code
652
623
653
624
init = _library.gnutls_init
654
625
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
626
init.restype = _error_code
656
627
657
628
set_default_priority = _library.gnutls_set_default_priority
658
629
set_default_priority.argtypes = [session_t]
659
630
set_default_priority.restype = _error_code
660
631
661
632
record_send = _library.gnutls_record_send
662
633
record_send.argtypes = [session_t, ctypes.c_void_p,
663
634
ctypes.c_size_t]
664
635
record_send.restype = ctypes.c_ssize_t
665
636
record_send.errcheck = _retry_on_error
666
637
667
638
certificate_allocate_credentials = (
668
639
_library.gnutls_certificate_allocate_credentials)
669
640
certificate_allocate_credentials.argtypes = [
670
641
ctypes.POINTER(certificate_credentials_t)]
671
642
certificate_allocate_credentials.restype = _error_code
672
643
673
644
certificate_free_credentials = (
674
645
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
677
647
certificate_free_credentials.restype = None
678
648
679
649
handshake_set_private_extensions = (
680
650
_library.gnutls_handshake_set_private_extensions)
681
651
handshake_set_private_extensions.argtypes = [session_t,
682
652
ctypes.c_int]
683
653
handshake_set_private_extensions.restype = None
684
654
685
655
credentials_set = _library.gnutls_credentials_set
686
656
credentials_set.argtypes = [session_t, credentials_type_t,
687
657
ctypes.c_void_p]
688
658
credentials_set.restype = _error_code
689
659
690
660
strerror = _library.gnutls_strerror
691
661
strerror.argtypes = [ctypes.c_int]
692
662
strerror.restype = ctypes.c_char_p
693
663
694
664
certificate_type_get = _library.gnutls_certificate_type_get
695
665
certificate_type_get.argtypes = [session_t]
696
666
certificate_type_get.restype = _error_code
697
667
698
668
certificate_get_peers = _library.gnutls_certificate_get_peers
699
669
certificate_get_peers.argtypes = [session_t,
700
670
ctypes.POINTER(ctypes.c_uint)]
701
671
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
672
703
673
global_set_log_level = _library.gnutls_global_set_log_level
704
674
global_set_log_level.argtypes = [ctypes.c_int]
705
675
global_set_log_level.restype = None
706
676
707
677
global_set_log_function = _library.gnutls_global_set_log_function
708
678
global_set_log_function.argtypes = [log_func]
709
679
global_set_log_function.restype = None
710
680
711
681
deinit = _library.gnutls_deinit
712
682
deinit.argtypes = [session_t]
713
683
deinit.restype = None
714
684
715
685
handshake = _library.gnutls_handshake
716
686
handshake.argtypes = [session_t]
717
687
handshake.restype = _error_code
718
688
handshake.errcheck = _retry_on_error
719
689
720
690
transport_set_ptr = _library.gnutls_transport_set_ptr
721
691
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
692
transport_set_ptr.restype = None
723
693
724
694
bye = _library.gnutls_bye
725
695
bye.argtypes = [session_t, close_request_t]
726
696
bye.restype = _error_code
727
697
bye.errcheck = _retry_on_error
728
698
729
699
check_version = _library.gnutls_check_version
730
700
check_version.argtypes = [ctypes.c_char_p]
731
701
check_version.restype = ctypes.c_char_p
732
702
733
703
# All the function declarations below are from gnutls/openpgp.h
734
704
735
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
707
openpgp_crt_init.restype = _error_code
738
708
739
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
711
ctypes.POINTER(datum_t),
742
712
openpgp_crt_fmt_t]
743
713
openpgp_crt_import.restype = _error_code
744
714
745
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
717
ctypes.POINTER(ctypes.c_uint)]
748
718
openpgp_crt_verify_self.restype = _error_code
749
719
750
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
722
openpgp_crt_deinit.restype = None
753
723
754
724
openpgp_crt_get_fingerprint = (
755
725
_library.gnutls_openpgp_crt_get_fingerprint)
756
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
758
728
ctypes.POINTER(
759
729
ctypes.c_size_t)]
760
730
openpgp_crt_get_fingerprint.restype = _error_code
761
731
762
732
# Remove non-public functions
763
733
del _error_code, _retry_on_error
764
734
# Create the global "gnutls" object, simulating a module
765
735
gnutls = GnuTLS()
766
736
767
768
737
def call_pipe(connection, # : multiprocessing.Connection
769
738
func, *args, **kwargs):
770
739
"""This function is meant to be called by multiprocessing.Process
771
740
772
741
This function runs func(*args, **kwargs), and writes the resulting
773
742
return value on the provided multiprocessing.Connection.
774
743
"""
775
744
connection.send(func(*args, **kwargs))
776
745
connection.close()
777
746
778
779
747
class Client(object):
780
748
"""A representation of a client host served by this server.
781
749
782
750
Attributes:
783
751
approved: bool(); 'None' if not yet approved/disapproved
784
752
approval_delay: datetime.timedelta(); Time to wait for approval
821
789
disabled, or None
822
790
server_settings: The server_settings dict from main()
823
791
"""
824
792
825
793
runtime_expansions = ("approval_delay", "approval_duration",
826
794
"created", "enabled", "expires",
827
795
"fingerprint", "host", "interval",
838
806
"approved_by_default": "True",
839
807
"enabled": "True",
840
808
}
841
809
842
810
@staticmethod
843
811
def config_parser(config):
844
812
"""Construct a new dict of client settings of this form:
851
819
for client_name in config.sections():
852
820
section = dict(config.items(client_name))
853
821
client = settings[client_name] = {}
854
822
855
823
client["host"] = section["host"]
856
824
# Reformat values from string types to Python types
857
825
client["approved_by_default"] = config.getboolean(
858
826
client_name, "approved_by_default")
859
827
client["enabled"] = config.getboolean(client_name,
860
828
"enabled")
861
829
862
830
# Uppercase and remove spaces from fingerprint for later
863
831
# comparison purposes with return value from the
864
832
# fingerprint() function
888
856
client["last_approval_request"] = None
889
857
client["last_checked_ok"] = None
890
858
client["last_checker_status"] = -2
891
859
892
860
return settings
893
894
def __init__(self, settings, name=None, server_settings=None):
861
862
def __init__(self, settings, name = None, server_settings=None):
895
863
self.name = name
896
864
if server_settings is None:
897
865
server_settings = {}
899
867
# adding all client settings
900
868
for setting, value in settings.items():
901
869
setattr(self, setting, value)
902
870
903
871
if self.enabled:
904
872
if not hasattr(self, "last_enabled"):
905
873
self.last_enabled = datetime.datetime.utcnow()
909
877
else:
910
878
self.last_enabled = None
911
879
self.expires = None
912
880
913
881
logger.debug("Creating client %r", self.name)
914
882
logger.debug(" Fingerprint: %s", self.fingerprint)
915
883
self.created = settings.get("created",
916
884
datetime.datetime.utcnow())
917
885
918
886
# attributes specific for this server instance
919
887
self.checker = None
920
888
self.checker_initiator_tag = None
929
897
for attr in self.__dict__.keys()
930
898
if not attr.startswith("_")]
931
899
self.client_structure.append("client_structure")
932
900
933
901
for name, t in inspect.getmembers(
934
902
type(self), lambda obj: isinstance(obj, property)):
935
903
if not name.startswith("_"):
936
904
self.client_structure.append(name)
937
905
938
906
# Send notice to process children that client state has changed
939
907
def send_changedstate(self):
940
908
with self.changedstate:
941
909
self.changedstate.notify_all()
942
910
943
911
def enable(self):
944
912
"""Start this client's checker and timeout hooks"""
945
913
if getattr(self, "enabled", False):
950
918
self.last_enabled = datetime.datetime.utcnow()
951
919
self.init_checker()
952
920
self.send_changedstate()
953
921
954
922
def disable(self, quiet=True):
955
923
"""Disable this client."""
956
924
if not getattr(self, "enabled", False):
970
938
self.send_changedstate()
971
939
# Do not run this again if called by a GLib.timeout_add
972
940
return False
973
941
974
942
def __del__(self):
975
943
self.disable()
976
944
977
945
def init_checker(self):
978
946
# Schedule a new checker to be started an 'interval' from now,
979
947
# and every interval from then on.
989
957
int(self.timeout.total_seconds() * 1000), self.disable)
990
958
# Also start a new checker *right now*.
991
959
self.start_checker()
992
960
993
961
def checker_callback(self, source, condition, connection,
994
962
command):
995
963
"""The checker has completed, so take appropriate actions."""
998
966
# Read return code from connection (see call_pipe)
999
967
returncode = connection.recv()
1000
968
connection.close()
1001
969
1002
970
if returncode >= 0:
1003
971
self.last_checker_status = returncode
1004
972
self.last_checker_signal = None
1014
982
logger.warning("Checker for %(name)s crashed?",
1015
983
vars(self))
1016
984
return False
1017
985
1018
986
def checked_ok(self):
1019
987
"""Assert that the client has been seen, alive and well."""
1020
988
self.last_checked_ok = datetime.datetime.utcnow()
1021
989
self.last_checker_status = 0
1022
990
self.last_checker_signal = None
1023
991
self.bump_timeout()
1024
992
1025
993
def bump_timeout(self, timeout=None):
1026
994
"""Bump up the timeout for this client."""
1027
995
if timeout is None:
1033
1001
self.disable_initiator_tag = GLib.timeout_add(
1034
1002
int(timeout.total_seconds() * 1000), self.disable)
1035
1003
self.expires = datetime.datetime.utcnow() + timeout
1036
1004
1037
1005
def need_approval(self):
1038
1006
self.last_approval_request = datetime.datetime.utcnow()
1039
1007
1040
1008
def start_checker(self):
1041
1009
"""Start a new checker subprocess if one is not running.
1042
1010
1043
1011
If a checker already exists, leave it running and do
1044
1012
nothing."""
1045
1013
# The reason for not killing a running checker is that if we
1050
1018
# checkers alone, the checker would have to take more time
1051
1019
# than 'timeout' for the client to be disabled, which is as it
1052
1020
# should be.
1053
1021
1054
1022
if self.checker is not None and not self.checker.is_alive():
1055
1023
logger.warning("Checker was not alive; joining")
1056
1024
self.checker.join()
1060
1028
# Escape attributes for the shell
1061
1029
escaped_attrs = {
1062
1030
attr: re.escape(str(getattr(self, attr)))
1063
for attr in self.runtime_expansions}
1031
for attr in self.runtime_expansions }
1064
1032
try:
1065
1033
command = self.checker_command % escaped_attrs
1066
1034
except TypeError as error:
1078
1046
# The exception is when not debugging but nevertheless
1079
1047
# running in the foreground; use the previously
1080
1048
# created wnull.
1081
popen_args = {"close_fds": True,
1082
"shell": True,
1083
"cwd": "/"}
1049
popen_args = { "close_fds": True,
1050
"shell": True,
1051
"cwd": "/" }
1084
1052
if (not self.server_settings["debug"]
1085
1053
and self.server_settings["foreground"]):
1086
1054
popen_args.update({"stdout": wnull,
1087
"stderr": wnull})
1088
pipe = multiprocessing.Pipe(duplex=False)
1055
"stderr": wnull })
1056
pipe = multiprocessing.Pipe(duplex = False)
1089
1057
self.checker = multiprocessing.Process(
1090
target=call_pipe,
1091
args=(pipe[1], subprocess.call, command),
1092
kwargs=popen_args)
1058
target = call_pipe,
1059
args = (pipe[1], subprocess.call, command),
1060
kwargs = popen_args)
1093
1061
self.checker.start()
1094
1062
self.checker_callback_tag = GLib.io_add_watch(
1095
1063
pipe[0].fileno(), GLib.IO_IN,
1096
1064
self.checker_callback, pipe[0], command)
1097
1065
# Re-run this periodically if run by GLib.timeout_add
1098
1066
return True
1099
1067
1100
1068
def stop_checker(self):
1101
1069
"""Force the checker process, if any, to stop."""
1102
1070
if self.checker_callback_tag:
1115
1083
byte_arrays=False):
1116
1084
"""Decorators for marking methods of a DBusObjectWithProperties to
1117
1085
become properties on the D-Bus.
1118
1086
1119
1087
The decorated method will be called with no arguments by "Get"
1120
1088
and with one argument by "Set".
1121
1089
1122
1090
The parameters, where they are supported, are the same as
1123
1091
dbus.service.method, except there is only "signature", since the
1124
1092
type from Get() and the type sent to Set() is the same.
1128
1096
if byte_arrays and signature != "ay":
1129
1097
raise ValueError("Byte arrays not supported for non-'ay'"
1130
1098
" signature {!r}".format(signature))
1131
1099
1132
1100
def decorator(func):
1133
1101
func._dbus_is_property = True
1134
1102
func._dbus_interface = dbus_interface
1137
1105
func._dbus_name = func.__name__
1138
1106
if func._dbus_name.endswith("_dbus_property"):
1139
1107
func._dbus_name = func._dbus_name[:-14]
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1108
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1141
1109
return func
1142
1110
1143
1111
return decorator
1144
1112
1145
1113
1146
1114
def dbus_interface_annotations(dbus_interface):
1147
1115
"""Decorator for marking functions returning interface annotations
1148
1116
1149
1117
Usage:
1150
1118
1151
1119
@dbus_interface_annotations("org.example.Interface")
1152
1120
def _foo(self): # Function name does not matter
1153
1121
return {"org.freedesktop.DBus.Deprecated": "true",
1154
1122
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1155
1123
"false"}
1156
1124
"""
1157
1125
1158
1126
def decorator(func):
1159
1127
func._dbus_is_interface = True
1160
1128
func._dbus_interface = dbus_interface
1161
1129
func._dbus_name = dbus_interface
1162
1130
return func
1163
1131
1164
1132
return decorator
1165
1133
1166
1134
1167
1135
def dbus_annotations(annotations):
1168
1136
"""Decorator to annotate D-Bus methods, signals or properties
1169
1137
Usage:
1170
1138
1171
1139
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1172
1140
"org.freedesktop.DBus.Property."
1173
1141
"EmitsChangedSignal": "false"})
1175
1143
access="r")
1176
1144
def Property_dbus_property(self):
1177
1145
return dbus.Boolean(False)
1178
1146
1179
1147
See also the DBusObjectWithAnnotations class.
1180
1148
"""
1181
1149
1182
1150
def decorator(func):
1183
1151
func._dbus_annotations = annotations
1184
1152
return func
1185
1153
1186
1154
return decorator
1187
1155
1188
1156
1206
1174
1207
1175
class DBusObjectWithAnnotations(dbus.service.Object):
1208
1176
"""A D-Bus object with annotations.
1209
1177
1210
1178
Classes inheriting from this can use the dbus_annotations
1211
1179
decorator to add annotations to methods or signals.
1212
1180
"""
1213
1181
1214
1182
@staticmethod
1215
1183
def _is_dbus_thing(thing):
1216
1184
"""Returns a function testing if an attribute is a D-Bus thing
1217
1185
1218
1186
If called like _is_dbus_thing("method") it returns a function
1219
1187
suitable for use as predicate to inspect.getmembers().
1220
1188
"""
1221
1189
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1222
1190
False)
1223
1191
1224
1192
def _get_all_dbus_things(self, thing):
1225
1193
"""Returns a generator of (name, attribute) pairs
1226
1194
"""
1229
1197
for cls in self.__class__.__mro__
1230
1198
for name, athing in
1231
1199
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1232
1200
1233
1201
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1234
out_signature="s",
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1202
out_signature = "s",
1203
path_keyword = 'object_path',
1204
connection_keyword = 'connection')
1237
1205
def Introspect(self, object_path, connection):
1238
1206
"""Overloading of standard D-Bus method.
1239
1207
1240
1208
Inserts annotation tags on methods and signals.
1241
1209
"""
1242
1210
xmlstring = dbus.service.Object.Introspect(self, object_path,
1243
1211
connection)
1244
1212
try:
1245
1213
document = xml.dom.minidom.parseString(xmlstring)
1246
1214
1247
1215
for if_tag in document.getElementsByTagName("interface"):
1248
1216
# Add annotation tags
1249
1217
for typ in ("method", "signal"):
1276
1244
if_tag.appendChild(ann_tag)
1277
1245
# Fix argument name for the Introspect method itself
1278
1246
if (if_tag.getAttribute("name")
1279
== dbus.INTROSPECTABLE_IFACE):
1247
== dbus.INTROSPECTABLE_IFACE):
1280
1248
for cn in if_tag.getElementsByTagName("method"):
1281
1249
if cn.getAttribute("name") == "Introspect":
1282
1250
for arg in cn.getElementsByTagName("arg"):
1295
1263
1296
1264
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1297
1265
"""A D-Bus object with properties.
1298
1266
1299
1267
Classes inheriting from this can use the dbus_service_property
1300
1268
decorator to expose methods as D-Bus properties. It exposes the
1301
1269
standard Get(), Set(), and GetAll() methods on the D-Bus.
1302
1270
"""
1303
1271
1304
1272
def _get_dbus_property(self, interface_name, property_name):
1305
1273
"""Returns a bound method if one exists which is a D-Bus
1306
1274
property with the specified name and interface.
1311
1279
if (value._dbus_name == property_name
1312
1280
and value._dbus_interface == interface_name):
1313
1281
return value.__get__(self)
1314
1282
1315
1283
# No such property
1316
1284
raise DBusPropertyNotFound("{}:{}.{}".format(
1317
1285
self.dbus_object_path, interface_name, property_name))
1318
1286
1319
1287
@classmethod
1320
1288
def _get_all_interface_names(cls):
1321
1289
"""Get a sequence of all interfaces supported by an object"""
1324
1292
for x in (inspect.getmro(cls))
1325
1293
for attr in dir(x))
1326
1294
if name is not None)
1327
1295
1328
1296
@dbus.service.method(dbus.PROPERTIES_IFACE,
1329
1297
in_signature="ss",
1330
1298
out_signature="v")
1338
1306
if not hasattr(value, "variant_level"):
1339
1307
return value
1340
1308
return type(value)(value, variant_level=value.variant_level+1)
1341
1309
1342
1310
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1343
1311
def Set(self, interface_name, property_name, value):
1344
1312
"""Standard D-Bus property Set() method, see D-Bus standard.
1356
1324
value = dbus.ByteArray(b''.join(chr(byte)
1357
1325
for byte in value))
1358
1326
prop(value)
1359
1327
1360
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
1361
1329
in_signature="s",
1362
1330
out_signature="a{sv}")
1363
1331
def GetAll(self, interface_name):
1364
1332
"""Standard D-Bus property GetAll() method, see D-Bus
1365
1333
standard.
1366
1334
1367
1335
Note: Will not include properties with access="write".
1368
1336
"""
1369
1337
properties = {}
1380
1348
properties[name] = value
1381
1349
continue
1382
1350
properties[name] = type(value)(
1383
value, variant_level=value.variant_level + 1)
1351
value, variant_level = value.variant_level + 1)
1384
1352
return dbus.Dictionary(properties, signature="sv")
1385
1353
1386
1354
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1387
1355
def PropertiesChanged(self, interface_name, changed_properties,
1388
1356
invalidated_properties):
1390
1358
standard.
1391
1359
"""
1392
1360
pass
1393
1361
1394
1362
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1395
1363
out_signature="s",
1396
1364
path_keyword='object_path',
1397
1365
connection_keyword='connection')
1398
1366
def Introspect(self, object_path, connection):
1399
1367
"""Overloading of standard D-Bus method.
1400
1368
1401
1369
Inserts property tags and interface annotation tags.
1402
1370
"""
1403
1371
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1405
1373
connection)
1406
1374
try:
1407
1375
document = xml.dom.minidom.parseString(xmlstring)
1408
1376
1409
1377
def make_tag(document, name, prop):
1410
1378
e = document.createElement("property")
1411
1379
e.setAttribute("name", name)
1412
1380
e.setAttribute("type", prop._dbus_signature)
1413
1381
e.setAttribute("access", prop._dbus_access)
1414
1382
return e
1415
1383
1416
1384
for if_tag in document.getElementsByTagName("interface"):
1417
1385
# Add property tags
1418
1386
for tag in (make_tag(document, name, prop)
1465
1433
except AttributeError:
1466
1434
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1467
1435
1468
1469
1436
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1470
1437
"""A D-Bus object with an ObjectManager.
1471
1438
1472
1439
Classes inheriting from this exposes the standard
1473
1440
GetManagedObjects call and the InterfacesAdded and
1474
1441
InterfacesRemoved signals on the standard
1475
1442
"org.freedesktop.DBus.ObjectManager" interface.
1476
1443
1477
1444
Note: No signals are sent automatically; they must be sent
1478
1445
manually.
1479
1446
"""
1480
1447
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1481
out_signature="a{oa{sa{sv}}}")
1448
out_signature = "a{oa{sa{sv}}}")
1482
1449
def GetManagedObjects(self):
1483
1450
"""This function must be overridden"""
1484
1451
raise NotImplementedError()
1485
1452
1486
1453
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1487
signature="oa{sa{sv}}")
1454
signature = "oa{sa{sv}}")
1488
1455
def InterfacesAdded(self, object_path, interfaces_and_properties):
1489
1456
pass
1490
1491
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1457
1458
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1492
1459
def InterfacesRemoved(self, object_path, interfaces):
1493
1460
pass
1494
1461
1495
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1496
out_signature="s",
1497
path_keyword='object_path',
1498
connection_keyword='connection')
1463
out_signature = "s",
1464
path_keyword = 'object_path',
1465
connection_keyword = 'connection')
1499
1466
def Introspect(self, object_path, connection):
1500
1467
"""Overloading of standard D-Bus method.
1501
1468
1502
1469
Override return argument name of GetManagedObjects to be
1503
1470
"objpath_interfaces_and_properties"
1504
1471
"""
1507
1474
connection)
1508
1475
try:
1509
1476
document = xml.dom.minidom.parseString(xmlstring)
1510
1477
1511
1478
for if_tag in document.getElementsByTagName("interface"):
1512
1479
# Fix argument name for the GetManagedObjects method
1513
1480
if (if_tag.getAttribute("name")
1514
== dbus.OBJECT_MANAGER_IFACE):
1481
== dbus.OBJECT_MANAGER_IFACE):
1515
1482
for cn in if_tag.getElementsByTagName("method"):
1516
1483
if (cn.getAttribute("name")
1517
1484
== "GetManagedObjects"):
1527
1494
except (AttributeError, xml.dom.DOMException,
1528
1495
xml.parsers.expat.ExpatError) as error:
1529
1496
logger.error("Failed to override Introspection method",
1530
exc_info=error)
1497
exc_info = error)
1531
1498
return xmlstring
1532
1499
1533
1534
1500
def datetime_to_dbus(dt, variant_level=0):
1535
1501
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1536
1502
if dt is None:
1537
return dbus.String("", variant_level=variant_level)
1503
return dbus.String("", variant_level = variant_level)
1538
1504
return dbus.String(dt.isoformat(), variant_level=variant_level)
1539
1505
1540
1506
1543
1509
dbus.service.Object, it will add alternate D-Bus attributes with
1544
1510
interface names according to the "alt_interface_names" mapping.
1545
1511
Usage:
1546
1512
1547
1513
@alternate_dbus_interfaces({"org.example.Interface":
1548
1514
"net.example.AlternateInterface"})
1549
1515
class SampleDBusObject(dbus.service.Object):
1550
1516
@dbus.service.method("org.example.Interface")
1551
1517
def SampleDBusMethod():
1552
1518
pass
1553
1519
1554
1520
The above "SampleDBusMethod" on "SampleDBusObject" will be
1555
1521
reachable via two interfaces: "org.example.Interface" and
1556
1522
"net.example.AlternateInterface", the latter of which will have
1557
1523
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1558
1524
"true", unless "deprecate" is passed with a False value.
1559
1525
1560
1526
This works for methods and signals, and also for D-Bus properties
1561
1527
(from DBusObjectWithProperties) and interfaces (from the
1562
1528
dbus_interface_annotations decorator).
1563
1529
"""
1564
1530
1565
1531
def wrapper(cls):
1566
1532
for orig_interface_name, alt_interface_name in (
1567
1533
alt_interface_names.items()):
1607
1573
attribute._dbus_annotations)
1608
1574
except AttributeError:
1609
1575
pass
1610
1611
1576
# Define a creator of a function to call both the
1612
1577
# original and alternate functions, so both the
1613
1578
# original and alternate signals gets sent when
1616
1581
"""This function is a scope container to pass
1617
1582
func1 and func2 to the "call_both" function
1618
1583
outside of its arguments"""
1619
1584
1620
1585
@functools.wraps(func2)
1621
1586
def call_both(*args, **kwargs):
1622
1587
"""This function will emit two D-Bus
1623
1588
signals by calling func1 and func2"""
1624
1589
func1(*args, **kwargs)
1625
1590
func2(*args, **kwargs)
1626
# Make wrapper function look like a D-Bus
1627
# signal
1591
# Make wrapper function look like a D-Bus signal
1628
1592
for name, attr in inspect.getmembers(func2):
1629
1593
if name.startswith("_dbus_"):
1630
1594
setattr(call_both, name, attr)
1631
1595
1632
1596
return call_both
1633
1597
# Create the "call_both" function and add it to
1634
1598
# the class
1680
1644
(copy_function(attribute)))
1681
1645
if deprecate:
1682
1646
# Deprecate all alternate interfaces
1683
iname = "_AlternateDBusNames_interface_annotation{}"
1647
iname="_AlternateDBusNames_interface_annotation{}"
1684
1648
for interface_name in interface_names:
1685
1649
1686
1650
@dbus_interface_annotations(interface_name)
1687
1651
def func(self):
1688
return {"org.freedesktop.DBus.Deprecated":
1689
"true"}
1652
return { "org.freedesktop.DBus.Deprecated":
1653
"true" }
1690
1654
# Find an unused name
1691
1655
for aname in (iname.format(i)
1692
1656
for i in itertools.count()):
1703
1667
cls = type("{}Alternate".format(cls.__name__),
1704
1668
(cls, ), attr)
1705
1669
return cls
1706
1670
1707
1671
return wrapper
1708
1672
1709
1673
1711
1675
"se.bsnet.fukt.Mandos"})
1712
1676
class ClientDBus(Client, DBusObjectWithProperties):
1713
1677
"""A Client class using D-Bus
1714
1678
1715
1679
Attributes:
1716
1680
dbus_object_path: dbus.ObjectPath
1717
1681
bus: dbus.SystemBus()
1718
1682
"""
1719
1683
1720
1684
runtime_expansions = (Client.runtime_expansions
1721
1685
+ ("dbus_object_path", ))
1722
1686
1723
1687
_interface = "se.recompile.Mandos.Client"
1724
1688
1725
1689
# dbus.service.Object doesn't use super(), so we can't either.
1726
1727
def __init__(self, bus=None, *args, **kwargs):
1690
1691
def __init__(self, bus = None, *args, **kwargs):
1728
1692
self.bus = bus
1729
1693
Client.__init__(self, *args, **kwargs)
1730
1694
# Only now, when this client is initialized, can it show up on
1736
1700
"/clients/" + client_object_name)
1737
1701
DBusObjectWithProperties.__init__(self, self.bus,
1738
1702
self.dbus_object_path)
1739
1703
1740
1704
def notifychangeproperty(transform_func, dbus_name,
1741
1705
type_func=lambda x: x,
1742
1706
variant_level=1,
1744
1708
_interface=_interface):
1745
1709
""" Modify a variable so that it's a property which announces
1746
1710
its changes to DBus.
1747
1711
1748
1712
transform_fun: Function that takes a value and a variant_level
1749
1713
and transforms it to a D-Bus type.
1750
1714
dbus_name: D-Bus name of the variable
1753
1717
variant_level: D-Bus variant level. Default: 1
1754
1718
"""
1755
1719
attrname = "_{}".format(dbus_name)
1756
1720
1757
1721
def setter(self, value):
1758
1722
if hasattr(self, "dbus_object_path"):
1759
1723
if (not hasattr(self, attrname) or
1766
1730
else:
1767
1731
dbus_value = transform_func(
1768
1732
type_func(value),
1769
variant_level=variant_level)
1733
variant_level = variant_level)
1770
1734
self.PropertyChanged(dbus.String(dbus_name),
1771
1735
dbus_value)
1772
1736
self.PropertiesChanged(
1773
1737
_interface,
1774
dbus.Dictionary({dbus.String(dbus_name):
1775
dbus_value}),
1738
dbus.Dictionary({ dbus.String(dbus_name):
1739
dbus_value }),
1776
1740
dbus.Array())
1777
1741
setattr(self, attrname, value)
1778
1742
1779
1743
return property(lambda self: getattr(self, attrname), setter)
1780
1744
1781
1745
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1782
1746
approvals_pending = notifychangeproperty(dbus.Boolean,
1783
1747
"ApprovalPending",
1784
type_func=bool)
1748
type_func = bool)
1785
1749
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1786
1750
last_enabled = notifychangeproperty(datetime_to_dbus,
1787
1751
"LastEnabled")
1788
1752
checker = notifychangeproperty(
1789
1753
dbus.Boolean, "CheckerRunning",
1790
type_func=lambda checker: checker is not None)
1754
type_func = lambda checker: checker is not None)
1791
1755
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1792
1756
"LastCheckedOK")
1793
1757
last_checker_status = notifychangeproperty(dbus.Int16,
1798
1762
"ApprovedByDefault")
1799
1763
approval_delay = notifychangeproperty(
1800
1764
dbus.UInt64, "ApprovalDelay",
1801
type_func=lambda td: td.total_seconds() * 1000)
1765
type_func = lambda td: td.total_seconds() * 1000)
1802
1766
approval_duration = notifychangeproperty(
1803
1767
dbus.UInt64, "ApprovalDuration",
1804
type_func=lambda td: td.total_seconds() * 1000)
1768
type_func = lambda td: td.total_seconds() * 1000)
1805
1769
host = notifychangeproperty(dbus.String, "Host")
1806
1770
timeout = notifychangeproperty(
1807
1771
dbus.UInt64, "Timeout",
1808
type_func=lambda td: td.total_seconds() * 1000)
1772
type_func = lambda td: td.total_seconds() * 1000)
1809
1773
extended_timeout = notifychangeproperty(
1810
1774
dbus.UInt64, "ExtendedTimeout",
1811
type_func=lambda td: td.total_seconds() * 1000)
1775
type_func = lambda td: td.total_seconds() * 1000)
1812
1776
interval = notifychangeproperty(
1813
1777
dbus.UInt64, "Interval",
1814
type_func=lambda td: td.total_seconds() * 1000)
1778
type_func = lambda td: td.total_seconds() * 1000)
1815
1779
checker_command = notifychangeproperty(dbus.String, "Checker")
1816
1780
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1817
1781
invalidate_only=True)
1818
1782
1819
1783
del notifychangeproperty
1820
1784
1821
1785
def __del__(self, *args, **kwargs):
1822
1786
try:
1823
1787
self.remove_from_connection()
1826
1790
if hasattr(DBusObjectWithProperties, "__del__"):
1827
1791
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1828
1792
Client.__del__(self, *args, **kwargs)
1829
1793
1830
1794
def checker_callback(self, source, condition,
1831
1795
connection, command, *args, **kwargs):
1832
1796
ret = Client.checker_callback(self, source, condition,
1848
1812
| self.last_checker_signal),
1849
1813
dbus.String(command))
1850
1814
return ret
1851
1815
1852
1816
def start_checker(self, *args, **kwargs):
1853
1817
old_checker_pid = getattr(self.checker, "pid", None)
1854
1818
r = Client.start_checker(self, *args, **kwargs)
1858
1822
# Emit D-Bus signal
1859
1823
self.CheckerStarted(self.current_checker_command)
1860
1824
return r
1861
1825
1862
1826
def _reset_approved(self):
1863
1827
self.approved = None
1864
1828
return False
1865
1829
1866
1830
def approve(self, value=True):
1867
1831
self.approved = value
1868
1832
GLib.timeout_add(int(self.approval_duration.total_seconds()
1869
1833
* 1000), self._reset_approved)
1870
1834
self.send_changedstate()
1871
1872
# D-Bus methods, signals & properties
1873
1874
# Interfaces
1875
1876
# Signals
1877
1835
1836
## D-Bus methods, signals & properties
1837
1838
## Interfaces
1839
1840
## Signals
1841
1878
1842
# CheckerCompleted - signal
1879
1843
@dbus.service.signal(_interface, signature="nxs")
1880
1844
def CheckerCompleted(self, exitcode, waitstatus, command):
1881
1845
"D-Bus signal"
1882
1846
pass
1883
1847
1884
1848
# CheckerStarted - signal
1885
1849
@dbus.service.signal(_interface, signature="s")
1886
1850
def CheckerStarted(self, command):
1887
1851
"D-Bus signal"
1888
1852
pass
1889
1853
1890
1854
# PropertyChanged - signal
1891
1855
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1892
1856
@dbus.service.signal(_interface, signature="sv")
1893
1857
def PropertyChanged(self, property, value):
1894
1858
"D-Bus signal"
1895
1859
pass
1896
1860
1897
1861
# GotSecret - signal
1898
1862
@dbus.service.signal(_interface)
1899
1863
def GotSecret(self):
1902
1866
server to mandos-client
1903
1867
"""
1904
1868
pass
1905
1869
1906
1870
# Rejected - signal
1907
1871
@dbus.service.signal(_interface, signature="s")
1908
1872
def Rejected(self, reason):
1909
1873
"D-Bus signal"
1910
1874
pass
1911
1875
1912
1876
# NeedApproval - signal
1913
1877
@dbus.service.signal(_interface, signature="tb")
1914
1878
def NeedApproval(self, timeout, default):
1915
1879
"D-Bus signal"
1916
1880
return self.need_approval()
1917
1918
# Methods
1919
1881
1882
## Methods
1883
1920
1884
# Approve - method
1921
1885
@dbus.service.method(_interface, in_signature="b")
1922
1886
def Approve(self, value):
1923
1887
self.approve(value)
1924
1888
1925
1889
# CheckedOK - method
1926
1890
@dbus.service.method(_interface)
1927
1891
def CheckedOK(self):
1928
1892
self.checked_ok()
1929
1893
1930
1894
# Enable - method
1931
1895
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1932
1896
@dbus.service.method(_interface)
1933
1897
def Enable(self):
1934
1898
"D-Bus method"
1935
1899
self.enable()
1936
1900
1937
1901
# StartChecker - method
1938
1902
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1939
1903
@dbus.service.method(_interface)
1940
1904
def StartChecker(self):
1941
1905
"D-Bus method"
1942
1906
self.start_checker()
1943
1907
1944
1908
# Disable - method
1945
1909
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1946
1910
@dbus.service.method(_interface)
1947
1911
def Disable(self):
1948
1912
"D-Bus method"
1949
1913
self.disable()
1950
1914
1951
1915
# StopChecker - method
1952
1916
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1953
1917
@dbus.service.method(_interface)
1954
1918
def StopChecker(self):
1955
1919
self.stop_checker()
1956
1957
# Properties
1958
1920
1921
## Properties
1922
1959
1923
# ApprovalPending - property
1960
1924
@dbus_service_property(_interface, signature="b", access="read")
1961
1925
def ApprovalPending_dbus_property(self):
1962
1926
return dbus.Boolean(bool(self.approvals_pending))
1963
1927
1964
1928
# ApprovedByDefault - property
1965
1929
@dbus_service_property(_interface,
1966
1930
signature="b",
1969
1933
if value is None: # get
1970
1934
return dbus.Boolean(self.approved_by_default)
1971
1935
self.approved_by_default = bool(value)
1972
1936
1973
1937
# ApprovalDelay - property
1974
1938
@dbus_service_property(_interface,
1975
1939
signature="t",
1979
1943
return dbus.UInt64(self.approval_delay.total_seconds()
1980
1944
* 1000)
1981
1945
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1982
1946
1983
1947
# ApprovalDuration - property
1984
1948
@dbus_service_property(_interface,
1985
1949
signature="t",
1989
1953
return dbus.UInt64(self.approval_duration.total_seconds()
1990
1954
* 1000)
1991
1955
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1992
1956
1993
1957
# Name - property
1994
1958
@dbus_annotations(
1995
1959
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1996
1960
@dbus_service_property(_interface, signature="s", access="read")
1997
1961
def Name_dbus_property(self):
1998
1962
return dbus.String(self.name)
1999
1963
2000
1964
# Fingerprint - property
2001
1965
@dbus_annotations(
2002
1966
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2003
1967
@dbus_service_property(_interface, signature="s", access="read")
2004
1968
def Fingerprint_dbus_property(self):
2005
1969
return dbus.String(self.fingerprint)
2006
1970
2007
1971
# Host - property
2008
1972
@dbus_service_property(_interface,
2009
1973
signature="s",
2012
1976
if value is None: # get
2013
1977
return dbus.String(self.host)
2014
1978
self.host = str(value)
2015
1979
2016
1980
# Created - property
2017
1981
@dbus_annotations(
2018
1982
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2019
1983
@dbus_service_property(_interface, signature="s", access="read")
2020
1984
def Created_dbus_property(self):
2021
1985
return datetime_to_dbus(self.created)
2022
1986
2023
1987
# LastEnabled - property
2024
1988
@dbus_service_property(_interface, signature="s", access="read")
2025
1989
def LastEnabled_dbus_property(self):
2026
1990
return datetime_to_dbus(self.last_enabled)
2027
1991
2028
1992
# Enabled - property
2029
1993
@dbus_service_property(_interface,
2030
1994
signature="b",
2036
2000
self.enable()
2037
2001
else:
2038
2002
self.disable()
2039
2003
2040
2004
# LastCheckedOK - property
2041
2005
@dbus_service_property(_interface,
2042
2006
signature="s",
2046
2010
self.checked_ok()
2047
2011
return
2048
2012
return datetime_to_dbus(self.last_checked_ok)
2049
2013
2050
2014
# LastCheckerStatus - property
2051
2015
@dbus_service_property(_interface, signature="n", access="read")
2052
2016
def LastCheckerStatus_dbus_property(self):
2053
2017
return dbus.Int16(self.last_checker_status)
2054
2018
2055
2019
# Expires - property
2056
2020
@dbus_service_property(_interface, signature="s", access="read")
2057
2021
def Expires_dbus_property(self):
2058
2022
return datetime_to_dbus(self.expires)
2059
2023
2060
2024
# LastApprovalRequest - property
2061
2025
@dbus_service_property(_interface, signature="s", access="read")
2062
2026
def LastApprovalRequest_dbus_property(self):
2063
2027
return datetime_to_dbus(self.last_approval_request)
2064
2028
2065
2029
# Timeout - property
2066
2030
@dbus_service_property(_interface,
2067
2031
signature="t",
2086
2050
self.disable_initiator_tag = GLib.timeout_add(
2087
2051
int((self.expires - now).total_seconds() * 1000),
2088
2052
self.disable)
2089
2053
2090
2054
# ExtendedTimeout - property
2091
2055
@dbus_service_property(_interface,
2092
2056
signature="t",
2096
2060
return dbus.UInt64(self.extended_timeout.total_seconds()
2097
2061
* 1000)
2098
2062
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2099
2063
2100
2064
# Interval - property
2101
2065
@dbus_service_property(_interface,
2102
2066
signature="t",
2112
2076
GLib.source_remove(self.checker_initiator_tag)
2113
2077
self.checker_initiator_tag = GLib.timeout_add(
2114
2078
value, self.start_checker)
2115
self.start_checker() # Start one now, too
2116
2079
self.start_checker() # Start one now, too
2080
2117
2081
# Checker - property
2118
2082
@dbus_service_property(_interface,
2119
2083
signature="s",
2122
2086
if value is None: # get
2123
2087
return dbus.String(self.checker_command)
2124
2088
self.checker_command = str(value)
2125
2089
2126
2090
# CheckerRunning - property
2127
2091
@dbus_service_property(_interface,
2128
2092
signature="b",
2134
2098
self.start_checker()
2135
2099
else:
2136
2100
self.stop_checker()
2137
2101
2138
2102
# ObjectPath - property
2139
2103
@dbus_annotations(
2140
2104
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2141
2105
"org.freedesktop.DBus.Deprecated": "true"})
2142
2106
@dbus_service_property(_interface, signature="o", access="read")
2143
2107
def ObjectPath_dbus_property(self):
2144
return self.dbus_object_path # is already a dbus.ObjectPath
2145
2108
return self.dbus_object_path # is already a dbus.ObjectPath
2109
2146
2110
# Secret = property
2147
2111
@dbus_annotations(
2148
2112
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2153
2117
byte_arrays=True)
2154
2118
def Secret_dbus_property(self, value):
2155
2119
self.secret = bytes(value)
2156
2120
2157
2121
del _interface
2158
2122
2159
2123
2163
2127
self._pipe.send(('init', fpr, address))
2164
2128
if not self._pipe.recv():
2165
2129
raise KeyError(fpr)
2166
2130
2167
2131
def __getattribute__(self, name):
2168
2132
if name == '_pipe':
2169
2133
return super(ProxyClient, self).__getattribute__(name)
2172
2136
if data[0] == 'data':
2173
2137
return data[1]
2174
2138
if data[0] == 'function':
2175
2139
2176
2140
def func(*args, **kwargs):
2177
2141
self._pipe.send(('funcall', name, args, kwargs))
2178
2142
return self._pipe.recv()[1]
2179
2143
2180
2144
return func
2181
2145
2182
2146
def __setattr__(self, name, value):
2183
2147
if name == '_pipe':
2184
2148
return super(ProxyClient, self).__setattr__(name, value)
2187
2151
2188
2152
class ClientHandler(socketserver.BaseRequestHandler, object):
2189
2153
"""A class to handle client connections.
2190
2154
2191
2155
Instantiated once for each connection to handle it.
2192
2156
Note: This will run in its own forked process."""
2193
2157
2194
2158
def handle(self):
2195
2159
with contextlib.closing(self.server.child_pipe) as child_pipe:
2196
2160
logger.info("TCP connection from: %s",
2197
2161
str(self.client_address))
2198
2162
logger.debug("Pipe FD: %d",
2199
2163
self.server.child_pipe.fileno())
2200
2164
2201
2165
session = gnutls.ClientSession(self.request)
2202
2203
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2204
# "+AES-256-CBC", "+SHA1",
2205
# "+COMP-NULL", "+CTYPE-OPENPGP",
2206
# "+DHE-DSS"))
2166
2167
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
# "+AES-256-CBC", "+SHA1",
2169
# "+COMP-NULL", "+CTYPE-OPENPGP",
2170
# "+DHE-DSS"))
2207
2171
# Use a fallback default, since this MUST be set.
2208
2172
priority = self.server.gnutls_priority
2209
2173
if priority is None:
2210
2174
priority = "NORMAL"
2211
gnutls.priority_set_direct(session._c_object,
2212
priority.encode("utf-8"),
2175
gnutls.priority_set_direct(session._c_object, priority,
2213
2176
None)
2214
2177
2215
2178
# Start communication using the Mandos protocol
2216
2179
# Get protocol number
2217
2180
line = self.request.makefile().readline()
2222
2185
except (ValueError, IndexError, RuntimeError) as error:
2223
2186
logger.error("Unknown protocol version: %s", error)
2224
2187
return
2225
2188
2226
2189
# Start GnuTLS connection
2227
2190
try:
2228
2191
session.handshake()
2232
2195
# established. Just abandon the request.
2233
2196
return
2234
2197
logger.debug("Handshake succeeded")
2235
2198
2236
2199
approval_required = False
2237
2200
try:
2238
2201
try:
2242
2205
logger.warning("Bad certificate: %s", error)
2243
2206
return
2244
2207
logger.debug("Fingerprint: %s", fpr)
2245
2208
2246
2209
try:
2247
2210
client = ProxyClient(child_pipe, fpr,
2248
2211
self.client_address)
2249
2212
except KeyError:
2250
2213
return
2251
2214
2252
2215
if client.approval_delay:
2253
2216
delay = client.approval_delay
2254
2217
client.approvals_pending += 1
2255
2218
approval_required = True
2256
2219
2257
2220
while True:
2258
2221
if not client.enabled:
2259
2222
logger.info("Client %s is disabled",
2262
2225
# Emit D-Bus signal
2263
2226
client.Rejected("Disabled")
2264
2227
return
2265
2228
2266
2229
if client.approved or not client.approval_delay:
2267
# We are approved or approval is disabled
2230
#We are approved or approval is disabled
2268
2231
break
2269
2232
elif client.approved is None:
2270
2233
logger.info("Client %s needs approval",
2281
2244
# Emit D-Bus signal
2282
2245
client.Rejected("Denied")
2283
2246
return
2284
2285
# wait until timeout or approved
2247
2248
#wait until timeout or approved
2286
2249
time = datetime.datetime.now()
2287
2250
client.changedstate.acquire()
2288
2251
client.changedstate.wait(delay.total_seconds())
2301
2264
break
2302
2265
else:
2303
2266
delay -= time2 - time
2304
2267
2305
2268
try:
2306
2269
session.send(client.secret)
2307
2270
except gnutls.Error as error:
2308
2271
logger.warning("gnutls send failed",
2309
exc_info=error)
2272
exc_info = error)
2310
2273
return
2311
2274
2312
2275
logger.info("Sending secret to %s", client.name)
2313
2276
# bump the timeout using extended_timeout
2314
2277
client.bump_timeout(client.extended_timeout)
2315
2278
if self.server.use_dbus:
2316
2279
# Emit D-Bus signal
2317
2280
client.GotSecret()
2318
2281
2319
2282
finally:
2320
2283
if approval_required:
2321
2284
client.approvals_pending -= 1
2324
2287
except gnutls.Error as error:
2325
2288
logger.warning("GnuTLS bye failed",
2326
2289
exc_info=error)
2327
2290
2328
2291
@staticmethod
2329
2292
def peer_certificate(session):
2330
2293
"Return the peer's OpenPGP certificate as a bytestring"
2342
2305
return None
2343
2306
cert = cert_list[0]
2344
2307
return ctypes.string_at(cert.data, cert.size)
2345
2308
2346
2309
@staticmethod
2347
2310
def fingerprint(openpgp):
2348
2311
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2381
2344
2382
2345
class MultiprocessingMixIn(object):
2383
2346
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2384
2347
2385
2348
def sub_process_main(self, request, address):
2386
2349
try:
2387
2350
self.finish_request(request, address)
2388
2351
except Exception:
2389
2352
self.handle_error(request, address)
2390
2353
self.close_request(request)
2391
2354
2392
2355
def process_request(self, request, address):
2393
2356
"""Start a new process to process the request."""
2394
proc = multiprocessing.Process(target=self.sub_process_main,
2395
args=(request, address))
2357
proc = multiprocessing.Process(target = self.sub_process_main,
2358
args = (request, address))
2396
2359
proc.start()
2397
2360
return proc
2398
2361
2399
2362
2400
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2401
2364
""" adds a pipe to the MixIn """
2402
2365
2403
2366
def process_request(self, request, client_address):
2404
2367
"""Overrides and wraps the original process_request().
2405
2368
2406
2369
This function creates a new pipe in self.pipe
2407
2370
"""
2408
2371
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2409
2372
2410
2373
proc = MultiprocessingMixIn.process_request(self, request,
2411
2374
client_address)
2412
2375
self.child_pipe.close()
2413
2376
self.add_pipe(parent_pipe, proc)
2414
2377
2415
2378
def add_pipe(self, parent_pipe, proc):
2416
2379
"""Dummy function; override as necessary"""
2417
2380
raise NotImplementedError()
2420
2383
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2421
2384
socketserver.TCPServer, object):
2422
2385
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2423
2386
2424
2387
Attributes:
2425
2388
enabled: Boolean; whether this server is activated yet
2426
2389
interface: None or a network interface name (string)
2427
2390
use_ipv6: Boolean; to use IPv6 or not
2428
2391
"""
2429
2392
2430
2393
def __init__(self, server_address, RequestHandlerClass,
2431
2394
interface=None,
2432
2395
use_ipv6=True,
2442
2405
self.socketfd = socketfd
2443
2406
# Save the original socket.socket() function
2444
2407
self.socket_socket = socket.socket
2445
2446
2408
# To implement --socket, we monkey patch socket.socket.
2447
#
2409
#
2448
2410
# (When socketserver.TCPServer is a new-style class, we
2449
2411
# could make self.socket into a property instead of monkey
2450
2412
# patching socket.socket.)
2451
#
2413
#
2452
2414
# Create a one-time-only replacement for socket.socket()
2453
2415
@functools.wraps(socket.socket)
2454
2416
def socket_wrapper(*args, **kwargs):
2466
2428
# socket_wrapper(), if socketfd was set.
2467
2429
socketserver.TCPServer.__init__(self, server_address,
2468
2430
RequestHandlerClass)
2469
2431
2470
2432
def server_bind(self):
2471
2433
"""This overrides the normal server_bind() function
2472
2434
to bind to an interface if one was specified, and also NOT to
2473
2435
bind to an address or port if they were not specified."""
2474
global SO_BINDTODEVICE
2475
2436
if self.interface is not None:
2476
2437
if SO_BINDTODEVICE is None:
2477
# Fall back to a hard-coded value which seems to be
2478
# common enough.
2479
logger.warning("SO_BINDTODEVICE not found, trying 25")
2480
SO_BINDTODEVICE = 25
2481
try:
2482
self.socket.setsockopt(
2483
socket.SOL_SOCKET, SO_BINDTODEVICE,
2484
(self.interface + "\0").encode("utf-8"))
2485
except socket.error as error:
2486
if error.errno == errno.EPERM:
2487
logger.error("No permission to bind to"
2488
" interface %s", self.interface)
2489
elif error.errno == errno.ENOPROTOOPT:
2490
logger.error("SO_BINDTODEVICE not available;"
2491
" cannot bind to interface %s",
2492
self.interface)
2493
elif error.errno == errno.ENODEV:
2494
logger.error("Interface %s does not exist,"
2495
" cannot bind", self.interface)
2496
else:
2497
raise
2438
logger.error("SO_BINDTODEVICE does not exist;"
2439
" cannot bind to interface %s",
2440
self.interface)
2441
else:
2442
try:
2443
self.socket.setsockopt(
2444
socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
(self.interface + "\0").encode("utf-8"))
2446
except socket.error as error:
2447
if error.errno == errno.EPERM:
2448
logger.error("No permission to bind to"
2449
" interface %s", self.interface)
2450
elif error.errno == errno.ENOPROTOOPT:
2451
logger.error("SO_BINDTODEVICE not available;"
2452
" cannot bind to interface %s",
2453
self.interface)
2454
elif error.errno == errno.ENODEV:
2455
logger.error("Interface %s does not exist,"
2456
" cannot bind", self.interface)
2457
else:
2458
raise
2498
2459
# Only bind(2) the socket if we really need to.
2499
2460
if self.server_address[0] or self.server_address[1]:
2500
2461
if not self.server_address[0]:
2501
2462
if self.address_family == socket.AF_INET6:
2502
any_address = "::" # in6addr_any
2463
any_address = "::" # in6addr_any
2503
2464
else:
2504
any_address = "0.0.0.0" # INADDR_ANY
2465
any_address = "0.0.0.0" # INADDR_ANY
2505
2466
self.server_address = (any_address,
2506
2467
self.server_address[1])
2507
2468
elif not self.server_address[1]:
2517
2478
2518
2479
class MandosServer(IPv6_TCPServer):
2519
2480
"""Mandos server.
2520
2481
2521
2482
Attributes:
2522
2483
clients: set of Client objects
2523
2484
gnutls_priority GnuTLS priority string
2524
2485
use_dbus: Boolean; to emit D-Bus signals or not
2525
2486
2526
2487
Assumes a GLib.MainLoop event loop.
2527
2488
"""
2528
2489
2529
2490
def __init__(self, server_address, RequestHandlerClass,
2530
2491
interface=None,
2531
2492
use_ipv6=True,
2541
2502
self.gnutls_priority = gnutls_priority
2542
2503
IPv6_TCPServer.__init__(self, server_address,
2543
2504
RequestHandlerClass,
2544
interface=interface,
2545
use_ipv6=use_ipv6,
2546
socketfd=socketfd)
2547
2505
interface = interface,
2506
use_ipv6 = use_ipv6,
2507
socketfd = socketfd)
2508
2548
2509
def server_activate(self):
2549
2510
if self.enabled:
2550
2511
return socketserver.TCPServer.server_activate(self)
2551
2512
2552
2513
def enable(self):
2553
2514
self.enabled = True
2554
2515
2555
2516
def add_pipe(self, parent_pipe, proc):
2556
2517
# Call "handle_ipc" for both data and EOF events
2557
2518
GLib.io_add_watch(
2558
2519
parent_pipe.fileno(),
2559
2520
GLib.IO_IN | GLib.IO_HUP,
2560
2521
functools.partial(self.handle_ipc,
2561
parent_pipe=parent_pipe,
2562
proc=proc))
2563
2522
parent_pipe = parent_pipe,
2523
proc = proc))
2524
2564
2525
def handle_ipc(self, source, condition,
2565
2526
parent_pipe=None,
2566
proc=None,
2527
proc = None,
2567
2528
client_object=None):
2568
2529
# error, or the other end of multiprocessing.Pipe has closed
2569
2530
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2570
2531
# Wait for other process to exit
2571
2532
proc.join()
2572
2533
return False
2573
2534
2574
2535
# Read a request from the child
2575
2536
request = parent_pipe.recv()
2576
2537
command = request[0]
2577
2538
2578
2539
if command == 'init':
2579
2540
fpr = request[1]
2580
2541
address = request[2]
2581
2542
2582
2543
for c in self.clients.values():
2583
2544
if c.fingerprint == fpr:
2584
2545
client = c
2592
2553
address[0])
2593
2554
parent_pipe.send(False)
2594
2555
return False
2595
2556
2596
2557
GLib.io_add_watch(
2597
2558
parent_pipe.fileno(),
2598
2559
GLib.IO_IN | GLib.IO_HUP,
2599
2560
functools.partial(self.handle_ipc,
2600
parent_pipe=parent_pipe,
2601
proc=proc,
2602
client_object=client))
2561
parent_pipe = parent_pipe,
2562
proc = proc,
2563
client_object = client))
2603
2564
parent_pipe.send(True)
2604
2565
# remove the old hook in favor of the new above hook on
2605
2566
# same fileno
2608
2569
funcname = request[1]
2609
2570
args = request[2]
2610
2571
kwargs = request[3]
2611
2572
2612
2573
parent_pipe.send(('data', getattr(client_object,
2613
2574
funcname)(*args,
2614
2575
**kwargs)))
2615
2576
2616
2577
if command == 'getattr':
2617
2578
attrname = request[1]
2618
2579
if isinstance(client_object.__getattribute__(attrname),
2621
2582
else:
2622
2583
parent_pipe.send((
2623
2584
'data', client_object.__getattribute__(attrname)))
2624
2585
2625
2586
if command == 'setattr':
2626
2587
attrname = request[1]
2627
2588
value = request[2]
2628
2589
setattr(client_object, attrname, value)
2629
2590
2630
2591
return True
2631
2592
2632
2593
2633
2594
def rfc3339_duration_to_delta(duration):
2634
2595
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2635
2596
2636
2597
>>> rfc3339_duration_to_delta("P7D")
2637
2598
datetime.timedelta(7)
2638
2599
>>> rfc3339_duration_to_delta("PT60S")
2648
2609
>>> rfc3339_duration_to_delta("P1DT3M20S")
2649
2610
datetime.timedelta(1, 200)
2650
2611
"""
2651
2612
2652
2613
# Parsing an RFC 3339 duration with regular expressions is not
2653
2614
# possible - there would have to be multiple places for the same
2654
2615
# values, like seconds. The current code, while more esoteric, is
2655
2616
# cleaner without depending on a parsing library. If Python had a
2656
2617
# built-in library for parsing we would use it, but we'd like to
2657
2618
# avoid excessive use of external libraries.
2658
2619
2659
2620
# New type for defining tokens, syntax, and semantics all-in-one
2660
2621
Token = collections.namedtuple("Token", (
2661
2622
"regexp", # To match token; if "value" is not None, must have
2694
2655
frozenset((token_year, token_month,
2695
2656
token_day, token_time,
2696
2657
token_week)))
2697
# Define starting values:
2698
# Value so far
2699
value = datetime.timedelta()
2658
# Define starting values
2659
value = datetime.timedelta() # Value so far
2700
2660
found_token = None
2701
# Following valid tokens
2702
followers = frozenset((token_duration, ))
2703
# String left to parse
2704
s = duration
2661
followers = frozenset((token_duration, )) # Following valid tokens
2662
s = duration # String left to parse
2705
2663
# Loop until end token is found
2706
2664
while found_token is not token_end:
2707
2665
# Search for any currently valid tokens
2731
2689
2732
2690
def string_to_delta(interval):
2733
2691
"""Parse a string and return a datetime.timedelta
2734
2692
2735
2693
>>> string_to_delta('7d')
2736
2694
datetime.timedelta(7)
2737
2695
>>> string_to_delta('60s')
2745
2703
>>> string_to_delta('5m 30s')
2746
2704
datetime.timedelta(0, 330)
2747
2705
"""
2748
2706
2749
2707
try:
2750
2708
return rfc3339_duration_to_delta(interval)
2751
2709
except ValueError:
2752
2710
pass
2753
2711
2754
2712
timevalue = datetime.timedelta(0)
2755
2713
for s in interval.split():
2756
2714
try:
2774
2732
return timevalue
2775
2733
2776
2734
2777
def daemon(nochdir=False, noclose=False):
2735
def daemon(nochdir = False, noclose = False):
2778
2736
"""See daemon(3). Standard BSD Unix function.
2779
2737
2780
2738
This should really exist as os.daemon, but it doesn't (yet)."""
2781
2739
if os.fork():
2782
2740
sys.exit()
2800
2758
2801
2759
2802
2760
def main():
2803
2761
2804
2762
##################################################################
2805
2763
# Parsing of options, both command line and config file
2806
2764
2807
2765
parser = argparse.ArgumentParser()
2808
2766
parser.add_argument("-v", "--version", action="version",
2809
version="%(prog)s {}".format(version),
2767
version = "%(prog)s {}".format(version),
2810
2768
help="show version number and exit")
2811
2769
parser.add_argument("-i", "--interface", metavar="IF",
2812
2770
help="Bind to interface IF")
2848
2806
parser.add_argument("--no-zeroconf", action="store_false",
2849
2807
dest="zeroconf", help="Do not use Zeroconf",
2850
2808
default=None)
2851
2809
2852
2810
options = parser.parse_args()
2853
2811
2854
2812
if options.check:
2855
2813
import doctest
2856
2814
fail_count, test_count = doctest.testmod()
2857
2815
sys.exit(os.EX_OK if fail_count == 0 else 1)
2858
2816
2859
2817
# Default values for config file for server-global settings
2860
server_defaults = {"interface": "",
2861
"address": "",
2862
"port": "",
2863
"debug": "False",
2864
"priority":
2865
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2866
":+SIGN-DSA-SHA256",
2867
"servicename": "Mandos",
2868
"use_dbus": "True",
2869
"use_ipv6": "True",
2870
"debuglevel": "",
2871
"restore": "True",
2872
"socket": "",
2873
"statedir": "/var/lib/mandos",
2874
"foreground": "False",
2875
"zeroconf": "True",
2876
}
2877
2818
server_defaults = { "interface": "",
2819
"address": "",
2820
"port": "",
2821
"debug": "False",
2822
"priority":
2823
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2824
":+SIGN-DSA-SHA256",
2825
"servicename": "Mandos",
2826
"use_dbus": "True",
2827
"use_ipv6": "True",
2828
"debuglevel": "",
2829
"restore": "True",
2830
"socket": "",
2831
"statedir": "/var/lib/mandos",
2832
"foreground": "False",
2833
"zeroconf": "True",
2834
}
2835
2878
2836
# Parse config file for server-global settings
2879
2837
server_config = configparser.SafeConfigParser(server_defaults)
2880
2838
del server_defaults
2898
2856
server_settings["socket"] = os.dup(server_settings
2899
2857
["socket"])
2900
2858
del server_config
2901
2859
2902
2860
# Override the settings from the config file with command line
2903
2861
# options, if set.
2904
2862
for option in ("interface", "address", "port", "debug",
2922
2880
if server_settings["debug"]:
2923
2881
server_settings["foreground"] = True
2924
2882
# Now we have our good server settings in "server_settings"
2925
2883
2926
2884
##################################################################
2927
2885
2928
2886
if (not server_settings["zeroconf"]
2929
2887
and not (server_settings["port"]
2930
2888
or server_settings["socket"] != "")):
2931
2889
parser.error("Needs port or socket to work without Zeroconf")
2932
2890
2933
2891
# For convenience
2934
2892
debug = server_settings["debug"]
2935
2893
debuglevel = server_settings["debuglevel"]
2939
2897
stored_state_file)
2940
2898
foreground = server_settings["foreground"]
2941
2899
zeroconf = server_settings["zeroconf"]
2942
2900
2943
2901
if debug:
2944
2902
initlogger(debug, logging.DEBUG)
2945
2903
else:
2948
2906
else:
2949
2907
level = getattr(logging, debuglevel.upper())
2950
2908
initlogger(debug, level)
2951
2909
2952
2910
if server_settings["servicename"] != "Mandos":
2953
2911
syslogger.setFormatter(
2954
2912
logging.Formatter('Mandos ({}) [%(process)d]:'
2955
2913
' %(levelname)s: %(message)s'.format(
2956
2914
server_settings["servicename"])))
2957
2915
2958
2916
# Parse config file with clients
2959
2917
client_config = configparser.SafeConfigParser(Client
2960
2918
.client_defaults)
2961
2919
client_config.read(os.path.join(server_settings["configdir"],
2962
2920
"clients.conf"))
2963
2921
2964
2922
global mandos_dbus_service
2965
2923
mandos_dbus_service = None
2966
2924
2967
2925
socketfd = None
2968
2926
if server_settings["socket"] != "":
2969
2927
socketfd = server_settings["socket"]
2985
2943
except IOError as e:
2986
2944
logger.error("Could not open file %r", pidfilename,
2987
2945
exc_info=e)
2988
2946
2989
2947
for name, group in (("_mandos", "_mandos"),
2990
2948
("mandos", "mandos"),
2991
2949
("nobody", "nogroup")):
3009
2967
.format(uid, gid, os.strerror(error.errno)))
3010
2968
if error.errno != errno.EPERM:
3011
2969
raise
3012
2970
3013
2971
if debug:
3014
2972
# Enable all possible GnuTLS debugging
3015
2973
3016
2974
# "Use a log level over 10 to enable all debugging options."
3017
2975
# - GnuTLS manual
3018
2976
gnutls.global_set_log_level(11)
3019
2977
3020
2978
@gnutls.log_func
3021
2979
def debug_gnutls(level, string):
3022
2980
logger.debug("GnuTLS: %s", string[:-1])
3023
2981
3024
2982
gnutls.global_set_log_function(debug_gnutls)
3025
2983
3026
2984
# Redirect stdin so all checkers get /dev/null
3027
2985
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3028
2986
os.dup2(null, sys.stdin.fileno())
3029
2987
if null > 2:
3030
2988
os.close(null)
3031
2989
3032
2990
# Need to fork before connecting to D-Bus
3033
2991
if not foreground:
3034
2992
# Close all input and output, do double fork, etc.
3035
2993
daemon()
3036
2994
3037
2995
# multiprocessing will use threads, so before we use GLib we need
3038
2996
# to inform GLib that threads will be used.
3039
2997
GLib.threads_init()
3040
2998
3041
2999
global main_loop
3042
3000
# From the Avahi example code
3043
3001
DBusGMainLoop(set_as_default=True)
3060
3018
if zeroconf:
3061
3019
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3062
3020
service = AvahiServiceToSyslog(
3063
name=server_settings["servicename"],
3064
servicetype="_mandos._tcp",
3065
protocol=protocol,
3066
bus=bus)
3021
name = server_settings["servicename"],
3022
servicetype = "_mandos._tcp",
3023
protocol = protocol,
3024
bus = bus)
3067
3025
if server_settings["interface"]:
3068
3026
service.interface = if_nametoindex(
3069
3027
server_settings["interface"].encode("utf-8"))
3070
3028
3071
3029
global multiprocessing_manager
3072
3030
multiprocessing_manager = multiprocessing.Manager()
3073
3031
3074
3032
client_class = Client
3075
3033
if use_dbus:
3076
client_class = functools.partial(ClientDBus, bus=bus)
3077
3034
client_class = functools.partial(ClientDBus, bus = bus)
3035
3078
3036
client_settings = Client.config_parser(client_config)
3079
3037
old_client_settings = {}
3080
3038
clients_data = {}
3081
3039
3082
3040
# This is used to redirect stdout and stderr for checker processes
3083
3041
global wnull
3084
wnull = open(os.devnull, "w") # A writable /dev/null
3042
wnull = open(os.devnull, "w") # A writable /dev/null
3085
3043
# Only used if server is running in foreground but not in debug
3086
3044
# mode
3087
3045
if debug or not foreground:
3088
3046
wnull.close()
3089
3047
3090
3048
# Get client data and settings from last running state.
3091
3049
if server_settings["restore"]:
3092
3050
try:
3093
3051
with open(stored_state_path, "rb") as stored_state:
3094
if sys.version_info.major == 2:
3052
if sys.version_info.major == 2:
3095
3053
clients_data, old_client_settings = pickle.load(
3096
3054
stored_state)
3097
3055
else:
3098
3056
bytes_clients_data, bytes_old_client_settings = (
3099
pickle.load(stored_state, encoding="bytes"))
3100
# Fix bytes to strings
3101
# clients_data
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3059
## clients_data
3102
3060
# .keys()
3103
clients_data = {(key.decode("utf-8")
3104
if isinstance(key, bytes)
3105
else key): value
3106
for key, value in
3107
bytes_clients_data.items()}
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3063
else key): value
3064
for key, value in
3065
bytes_clients_data.items() }
3108
3066
del bytes_clients_data
3109
3067
for key in clients_data:
3110
value = {(k.decode("utf-8")
3111
if isinstance(k, bytes) else k): v
3112
for k, v in
3113
clients_data[key].items()}
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3070
for k, v in
3071
clients_data[key].items() }
3114
3072
clients_data[key] = value
3115
3073
# .client_structure
3116
3074
value["client_structure"] = [
3117
3075
(s.decode("utf-8")
3118
3076
if isinstance(s, bytes)
3119
3077
else s) for s in
3120
value["client_structure"]]
3078
value["client_structure"] ]
3121
3079
# .name & .host
3122
3080
for k in ("name", "host"):
3123
3081
if isinstance(value[k], bytes):
3124
3082
value[k] = value[k].decode("utf-8")
3125
# old_client_settings
3083
## old_client_settings
3126
3084
# .keys()
3127
3085
old_client_settings = {
3128
3086
(key.decode("utf-8")
3129
3087
if isinstance(key, bytes)
3130
3088
else key): value
3131
3089
for key, value in
3132
bytes_old_client_settings.items()}
3090
bytes_old_client_settings.items() }
3133
3091
del bytes_old_client_settings
3134
3092
# .host
3135
3093
for value in old_client_settings.values():
3149
3107
logger.warning("Could not load persistent state: "
3150
3108
"EOFError:",
3151
3109
exc_info=e)
3152
3110
3153
3111
with PGPEngine() as pgp:
3154
3112
for client_name, client in clients_data.items():
3155
3113
# Skip removed clients
3156
3114
if client_name not in client_settings:
3157
3115
continue
3158
3116
3159
3117
# Decide which value to use after restoring saved state.
3160
3118
# We have three different values: Old config file,
3161
3119
# new config file, and saved state.
3172
3130
client[name] = value
3173
3131
except KeyError:
3174
3132
pass
3175
3133
3176
3134
# Clients who has passed its expire date can still be
3177
3135
# enabled if its last checker was successful. A Client
3178
3136
# whose checker succeeded before we stored its state is
3211
3169
client_name))
3212
3170
client["secret"] = (client_settings[client_name]
3213
3171
["secret"])
3214
3172
3215
3173
# Add/remove clients based on new changes made to config
3216
3174
for client_name in (set(old_client_settings)
3217
3175
- set(client_settings)):
3219
3177
for client_name in (set(client_settings)
3220
3178
- set(old_client_settings)):
3221
3179
clients_data[client_name] = client_settings[client_name]
3222
3180
3223
3181
# Create all client objects
3224
3182
for client_name, client in clients_data.items():
3225
3183
tcp_server.clients[client_name] = client_class(
3226
name=client_name,
3227
settings=client,
3228
server_settings=server_settings)
3229
3184
name = client_name,
3185
settings = client,
3186
server_settings = server_settings)
3187
3230
3188
if not tcp_server.clients:
3231
3189
logger.warning("No clients defined")
3232
3190
3233
3191
if not foreground:
3234
3192
if pidfile is not None:
3235
3193
pid = os.getpid()
3241
3199
pidfilename, pid)
3242
3200
del pidfile
3243
3201
del pidfilename
3244
3202
3245
3203
for termsig in (signal.SIGHUP, signal.SIGTERM):
3246
3204
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3247
3205
lambda: main_loop.quit() and False)
3248
3206
3249
3207
if use_dbus:
3250
3208
3251
3209
@alternate_dbus_interfaces(
3252
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3210
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3253
3211
class MandosDBusService(DBusObjectWithObjectManager):
3254
3212
"""A D-Bus proxy object"""
3255
3213
3256
3214
def __init__(self):
3257
3215
dbus.service.Object.__init__(self, bus, "/")
3258
3216
3259
3217
_interface = "se.recompile.Mandos"
3260
3218
3261
3219
@dbus.service.signal(_interface, signature="o")
3262
3220
def ClientAdded(self, objpath):
3263
3221
"D-Bus signal"
3264
3222
pass
3265
3223
3266
3224
@dbus.service.signal(_interface, signature="ss")
3267
3225
def ClientNotFound(self, fingerprint, address):
3268
3226
"D-Bus signal"
3269
3227
pass
3270
3228
3271
3229
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3272
3230
"true"})
3273
3231
@dbus.service.signal(_interface, signature="os")
3274
3232
def ClientRemoved(self, objpath, name):
3275
3233
"D-Bus signal"
3276
3234
pass
3277
3235
3278
3236
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3279
3237
"true"})
3280
3238
@dbus.service.method(_interface, out_signature="ao")
3282
3240
"D-Bus method"
3283
3241
return dbus.Array(c.dbus_object_path for c in
3284
3242
tcp_server.clients.values())
3285
3243
3286
3244
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3287
3245
"true"})
3288
3246
@dbus.service.method(_interface,
3290
3248
def GetAllClientsWithProperties(self):
3291
3249
"D-Bus method"
3292
3250
return dbus.Dictionary(
3293
{c.dbus_object_path: c.GetAll(
3251
{ c.dbus_object_path: c.GetAll(
3294
3252
"se.recompile.Mandos.Client")
3295
for c in tcp_server.clients.values()},
3253
for c in tcp_server.clients.values() },
3296
3254
signature="oa{sv}")
3297
3255
3298
3256
@dbus.service.method(_interface, in_signature="o")
3299
3257
def RemoveClient(self, object_path):
3300
3258
"D-Bus method"
3308
3266
self.client_removed_signal(c)
3309
3267
return
3310
3268
raise KeyError(object_path)
3311
3269
3312
3270
del _interface
3313
3271
3314
3272
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3315
out_signature="a{oa{sa{sv}}}")
3273
out_signature = "a{oa{sa{sv}}}")
3316
3274
def GetManagedObjects(self):
3317
3275
"""D-Bus method"""
3318
3276
return dbus.Dictionary(
3319
{client.dbus_object_path:
3320
dbus.Dictionary(
3321
{interface: client.GetAll(interface)
3322
for interface in
3323
client._get_all_interface_names()})
3324
for client in tcp_server.clients.values()})
3325
3277
{ client.dbus_object_path:
3278
dbus.Dictionary(
3279
{ interface: client.GetAll(interface)
3280
for interface in
3281
client._get_all_interface_names()})
3282
for client in tcp_server.clients.values()})
3283
3326
3284
def client_added_signal(self, client):
3327
3285
"""Send the new standard signal and the old signal"""
3328
3286
if use_dbus:
3330
3288
self.InterfacesAdded(
3331
3289
client.dbus_object_path,
3332
3290
dbus.Dictionary(
3333
{interface: client.GetAll(interface)
3334
for interface in
3335
client._get_all_interface_names()}))
3291
{ interface: client.GetAll(interface)
3292
for interface in
3293
client._get_all_interface_names()}))
3336
3294
# Old signal
3337
3295
self.ClientAdded(client.dbus_object_path)
3338
3296
3339
3297
def client_removed_signal(self, client):
3340
3298
"""Send the new standard signal and the old signal"""
3341
3299
if use_dbus:
3346
3304
# Old signal
3347
3305
self.ClientRemoved(client.dbus_object_path,
3348
3306
client.name)
3349
3307
3350
3308
mandos_dbus_service = MandosDBusService()
3351
3352
# Save modules to variables to exempt the modules from being
3353
# unloaded before the function registered with atexit() is run.
3354
mp = multiprocessing
3355
wn = wnull
3356
3309
3357
3310
def cleanup():
3358
3311
"Cleanup function; run on exit"
3359
3312
if zeroconf:
3360
3313
service.cleanup()
3361
3362
mp.active_children()
3363
wn.close()
3314
3315
multiprocessing.active_children()
3316
wnull.close()
3364
3317
if not (tcp_server.clients or client_settings):
3365
3318
return
3366
3319
3367
3320
# Store client before exiting. Secrets are encrypted with key
3368
3321
# based on what config file has. If config file is
3369
3322
# removed/edited, old secret will thus be unrecovable.
3374
3327
client.encrypted_secret = pgp.encrypt(client.secret,
3375
3328
key)
3376
3329
client_dict = {}
3377
3330
3378
3331
# A list of attributes that can not be pickled
3379
3332
# + secret.
3380
exclude = {"bus", "changedstate", "secret",
3381
"checker", "server_settings"}
3333
exclude = { "bus", "changedstate", "secret",
3334
"checker", "server_settings" }
3382
3335
for name, typ in inspect.getmembers(dbus.service
3383
3336
.Object):
3384
3337
exclude.add(name)
3385
3338
3386
3339
client_dict["encrypted_secret"] = (client
3387
3340
.encrypted_secret)
3388
3341
for attr in client.client_structure:
3389
3342
if attr not in exclude:
3390
3343
client_dict[attr] = getattr(client, attr)
3391
3344
3392
3345
clients[client.name] = client_dict
3393
3346
del client_settings[client.name]["secret"]
3394
3347
3395
3348
try:
3396
3349
with tempfile.NamedTemporaryFile(
3397
3350
mode='wb',
3400
3353
dir=os.path.dirname(stored_state_path),
3401
3354
delete=False) as stored_state:
3402
3355
pickle.dump((clients, client_settings), stored_state,
3403
protocol=2)
3356
protocol = 2)
3404
3357
tempname = stored_state.name
3405
3358
os.rename(tempname, stored_state_path)
3406
3359
except (IOError, OSError) as e:
3416
3369
logger.warning("Could not save persistent state:",
3417
3370
exc_info=e)
3418
3371
raise
3419
3372
3420
3373
# Delete all clients, and settings from config
3421
3374
while tcp_server.clients:
3422
3375
name, client = tcp_server.clients.popitem()
3428
3381
if use_dbus:
3429
3382
mandos_dbus_service.client_removed_signal(client)
3430
3383
client_settings.clear()
3431
3384
3432
3385
atexit.register(cleanup)
3433
3386
3434
3387
for client in tcp_server.clients.values():
3435
3388
if use_dbus:
3436
3389
# Emit D-Bus signal for adding
3438
3391
# Need to initiate checking of clients
3439
3392
if client.enabled:
3440
3393
client.init_checker()
3441
3394
3442
3395
tcp_server.enable()
3443
3396
tcp_server.server_activate()
3444
3397
3445
3398
# Find out what port we got
3446
3399
if zeroconf:
3447
3400
service.port = tcp_server.socket.getsockname()[1]
3452
3405
else: # IPv4
3453
3406
logger.info("Now listening on address %r, port %d",
3454
3407
*tcp_server.socket.getsockname())
3455
3456
# service.interface = tcp_server.socket.getsockname()[3]
3457
3408
3409
#service.interface = tcp_server.socket.getsockname()[3]
3410
3458
3411
try:
3459
3412
if zeroconf:
3460
3413
# From the Avahi example code
3465
3418
cleanup()
3466
3419
sys.exit(1)
3467
3420
# End of Avahi example code
3468
3421
3469
3422
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3470
3423
lambda *args, **kwargs:
3471
3424
(tcp_server.handle_request
3472
3425
(*args[2:], **kwargs) or True))
3473
3426
3474
3427
logger.debug("Starting main loop")
3475
3428
main_loop.run()
3476
3429
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0