/mandos/release : revision 237.7.741

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

19

21

# the Free Software Foundation, either version 3 of the License, or

20

22

# (at your option) any later version.

21

23

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

24

26

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

27

# GNU General Public License for more details.

26

#

28

#

27

29

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

31

32

# Contact the authors at <mandos@recompile.se>.

32

#

33

#

33

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

from future_builtins import *

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

38

42

39

import SocketServer as socketserver

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

40

47

import socket

41

48

import argparse

42

49

import datetime

43

50

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

51

55

import sys

52

56

import re

53

57

import os

62

66

import struct

63

67

import fcntl

64

68

import functools

65

import cPickle as pickle

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

66

73

import multiprocessing

67

74

import types

68

75

import binascii

69

76

import tempfile

70

77

import itertools

71

78

import collections

79

import codecs

80

import unittest

72

81

73

82

import dbus

74

83

import dbus.service

75

import gobject

76

import avahi

84

import gi

85

from gi.repository import GLib

77

86

from dbus.mainloop.glib import DBusGMainLoop

78

87

import ctypes

79

88

import ctypes.util

80

89

import xml.dom.minidom

81

90

import inspect

82

91

92

if sys.version_info.major == 2:

93

__metaclass__ = type

94

str = unicode

95

96

# Show warnings by default

97

if not sys.warnoptions:

98

import warnings

99

warnings.simplefilter("default")

100

101

# Try to find the value of SO_BINDTODEVICE:

83

102

try:

103

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

104

# newer, and it is also the most natural place for it:

84

105

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

106

except AttributeError:

86

107

try:

108

# This is where SO_BINDTODEVICE was up to and including Python

109

# 2.6, and also 3.2:

87

110

from IN import SO_BINDTODEVICE

88

111

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.2"

112

# In Python 2.7 it seems to have been removed entirely.

113

# Try running the C preprocessor:

114

try:

115

cc = subprocess.Popen(["cc", "--language=c", "-E",

116

"/dev/stdin"],

117

stdin=subprocess.PIPE,

118

stdout=subprocess.PIPE)

119

stdout = cc.communicate(

120

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

121

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

122

except (OSError, ValueError, IndexError):

123

# No value found

124

SO_BINDTODEVICE = None

125

126

if sys.version_info < (3, 2):

127

configparser.Configparser = configparser.SafeConfigParser

128

129

version = "1.8.9"

92

130

stored_state_file = "clients.pickle"

93

131

94

132

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

133

logging.captureWarnings(True) # Show warnings via the logging system

134

syslogger = None

98

135

99

136

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

137

if_nametoindex = ctypes.cdll.LoadLibrary(

138

ctypes.util.find_library("c")).if_nametoindex

103

139

except (OSError, AttributeError):

140

104

141

def if_nametoindex(interface):

105

142

"Get an interface index the hard way, i.e. using fcntl()"

106

143

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

144

with contextlib.closing(socket.socket()) as s:

108

145

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

146

struct.pack(b"16s16x", interface))

147

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

148

return interface_index

114

149

115

150

151

def copy_function(func):

152

"""Make a copy of a function"""

153

if sys.version_info.major == 2:

154

return types.FunctionType(func.func_code,

155

func.func_globals,

156

func.func_name,

157

func.func_defaults,

158

func.func_closure)

159

else:

160

return types.FunctionType(func.__code__,

161

func.__globals__,

162

func.__name__,

163

func.__defaults__,

164

func.__closure__)

165

166

116

167

def initlogger(debug, level=logging.WARNING):

117

168

"""init logger and add loglevel"""

118

169

170

global syslogger

171

syslogger = (logging.handlers.SysLogHandler(

172

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

173

address="/dev/log"))

119

174

syslogger.setFormatter(logging.Formatter

120

175

('Mandos [%(process)d]: %(levelname)s:'

121

176

' %(message)s'))

122

177

logger.addHandler(syslogger)

123

178

124

179

if debug:

125

180

console = logging.StreamHandler()

126

181

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

136

191

pass

137

192

138

193

139

class PGPEngine(object):

194

class PGPEngine:

140

195

"""A simple class for OpenPGP symmetric encryption & decryption"""

196

141

197

def __init__(self):

142

198

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

199

self.gpg = "gpg"

200

try:

201

output = subprocess.check_output(["gpgconf"])

202

for line in output.splitlines():

203

name, text, path = line.split(b":")

204

if name == b"gpg":

205

self.gpg = path

206

break

207

except OSError as e:

208

if e.errno != errno.ENOENT:

209

raise

143

210

self.gnupgargs = ['--batch',

144

'--home', self.tempdir,

211

'--homedir', self.tempdir,

145

212

'--force-mdc',

146

'--quiet',

147

'--no-use-agent']

148

213

'--quiet']

214

# Only GPG version 1 has the --no-use-agent option.

215

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

216

self.gnupgargs.append("--no-use-agent")

217

149

218

def __enter__(self):

150

219

return self

151

220

152

221

def __exit__(self, exc_type, exc_value, traceback):

153

222

self._cleanup()

154

223

return False

155

224

156

225

def __del__(self):

157

226

self._cleanup()

158

227

159

228

def _cleanup(self):

160

229

if self.tempdir is not None:

161

230

# Delete contents of tempdir

162

231

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

232

topdown=False):

164

233

for filename in files:

165

234

os.remove(os.path.join(root, filename))

166

235

for dirname in dirs:

168

237

# Remove tempdir

169

238

os.rmdir(self.tempdir)

170

239

self.tempdir = None

171

240

172

241

def password_encode(self, password):

173

242

# Passphrase can not be empty and can not contain newlines or

174

243

# NUL bytes. So we prefix it and hex encode it.

179

248

.replace(b"\n", b"\\n")

180

249

.replace(b"\0", b"\\x00"))

181

250

return encoded

182

251

183

252

def encrypt(self, data, password):

184

253

passphrase = self.password_encode(password)

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

254

with tempfile.NamedTemporaryFile(

255

dir=self.tempdir) as passfile:

187

256

passfile.write(passphrase)

188

257

passfile.flush()

189

proc = subprocess.Popen(['gpg', '--symmetric',

258

proc = subprocess.Popen([self.gpg, '--symmetric',

190

259

'--passphrase-file',

191

260

passfile.name]

192

261

+ self.gnupgargs,

193

stdin = subprocess.PIPE,

194

stdout = subprocess.PIPE,

195

stderr = subprocess.PIPE)

196

ciphertext, err = proc.communicate(input = data)

262

stdin=subprocess.PIPE,

263

stdout=subprocess.PIPE,

264

stderr=subprocess.PIPE)

265

ciphertext, err = proc.communicate(input=data)

197

266

if proc.returncode != 0:

198

267

raise PGPError(err)

199

268

return ciphertext

200

269

201

270

def decrypt(self, data, password):

202

271

passphrase = self.password_encode(password)

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

272

with tempfile.NamedTemporaryFile(

273

dir=self.tempdir) as passfile:

205

274

passfile.write(passphrase)

206

275

passfile.flush()

207

proc = subprocess.Popen(['gpg', '--decrypt',

276

proc = subprocess.Popen([self.gpg, '--decrypt',

208

277

'--passphrase-file',

209

278

passfile.name]

210

279

+ self.gnupgargs,

211

stdin = subprocess.PIPE,

212

stdout = subprocess.PIPE,

213

stderr = subprocess.PIPE)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

280

stdin=subprocess.PIPE,

281

stdout=subprocess.PIPE,

282

stderr=subprocess.PIPE)

283

decrypted_plaintext, err = proc.communicate(input=data)

216

284

if proc.returncode != 0:

217

285

raise PGPError(err)

218

286

return decrypted_plaintext

219

287

220

288

289

# Pretend that we have an Avahi module

290

class avahi:

291

"""This isn't so much a class as it is a module-like namespace."""

292

IF_UNSPEC = -1 # avahi-common/address.h

293

PROTO_UNSPEC = -1 # avahi-common/address.h

294

PROTO_INET = 0 # avahi-common/address.h

295

PROTO_INET6 = 1 # avahi-common/address.h

296

DBUS_NAME = "org.freedesktop.Avahi"

297

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

298

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

299

DBUS_PATH_SERVER = "/"

300

301

@staticmethod

302

def string_array_to_txt_array(t):

303

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

304

for s in t), signature="ay")

305

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

306

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

307

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

308

SERVER_INVALID = 0 # avahi-common/defs.h

309

SERVER_REGISTERING = 1 # avahi-common/defs.h

310

SERVER_RUNNING = 2 # avahi-common/defs.h

311

SERVER_COLLISION = 3 # avahi-common/defs.h

312

SERVER_FAILURE = 4 # avahi-common/defs.h

313

314

221

315

class AvahiError(Exception):

222

316

def __init__(self, value, *args, **kwargs):

223

317

self.value = value

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

318

return super(AvahiError, self).__init__(value, *args,

319

**kwargs)

320

227

321

228

322

class AvahiServiceError(AvahiError):

229

323

pass

230

324

325

231

326

class AvahiGroupError(AvahiError):

232

327

pass

233

328

234

329

235

class AvahiService(object):

330

class AvahiService:

236

331

"""An Avahi (Zeroconf) service.

237

332

238

333

Attributes:

239

334

interface: integer; avahi.IF_UNSPEC or an interface index.

240

335

Used to optionally bind to the specified interface.

252

347

server: D-Bus Server

253

348

bus: dbus.SystemBus()

254

349

"""

255

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

350

351

def __init__(self,

352

interface=avahi.IF_UNSPEC,

353

name=None,

354

servicetype=None,

355

port=None,

356

TXT=None,

357

domain="",

358

host="",

359

max_renames=32768,

360

protocol=avahi.PROTO_UNSPEC,

361

bus=None):

260

362

self.interface = interface

261

363

self.name = name

262

364

self.type = servicetype

271

373

self.server = None

272

374

self.bus = bus

273

375

self.entry_group_state_changed_match = None

274

275

def rename(self):

376

377

def rename(self, remove=True):

276

378

"""Derived from the Avahi example code"""

277

379

if self.rename_count >= self.max_renames:

278

380

logger.critical("No suitable Zeroconf service name found"

279

381

" after %i retries, exiting.",

280

382

self.rename_count)

281

383

raise AvahiServiceError("Too many renames")

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

384

self.name = str(

385

self.server.GetAlternativeServiceName(self.name))

386

self.rename_count += 1

284

387

logger.info("Changing Zeroconf service name to %r ...",

285

388

self.name)

286

self.remove()

389

if remove:

390

self.remove()

287

391

try:

288

392

self.add()

289

393

except dbus.exceptions.DBusException as error:

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

294

394

if (error.get_dbus_name()

395

== "org.freedesktop.Avahi.CollisionError"):

396

logger.info("Local Zeroconf service name collision.")

397

return self.rename(remove=False)

398

else:

399

logger.critical("D-Bus Exception", exc_info=error)

400

self.cleanup()

401

os._exit(1)

402

295

403

def remove(self):

296

404

"""Derived from the Avahi example code"""

297

405

if self.entry_group_state_changed_match is not None:

299

407

self.entry_group_state_changed_match = None

300

408

if self.group is not None:

301

409

self.group.Reset()

302

410

303

411

def add(self):

304

412

"""Derived from the Avahi example code"""

305

413

self.remove()

322

430

dbus.UInt16(self.port),

323

431

avahi.string_array_to_txt_array(self.TXT))

324

432

self.group.Commit()

325

433

326

434

def entry_group_state_changed(self, state, error):

327

435

"""Derived from the Avahi example code"""

328

436

logger.debug("Avahi entry group state change: %i", state)

329

437

330

438

if state == avahi.ENTRY_GROUP_ESTABLISHED:

331

439

logger.debug("Zeroconf service established.")

332

440

elif state == avahi.ENTRY_GROUP_COLLISION:

334

442

self.rename()

335

443

elif state == avahi.ENTRY_GROUP_FAILURE:

336

444

logger.critical("Avahi: Error in group state changed %s",

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

340

445

str(error))

446

raise AvahiGroupError("State changed: {!s}".format(error))

447

341

448

def cleanup(self):

342

449

"""Derived from the Avahi example code"""

343

450

if self.group is not None:

348

455

pass

349

456

self.group = None

350

457

self.remove()

351

458

352

459

def server_state_changed(self, state, error=None):

353

460

"""Derived from the Avahi example code"""

354

461

logger.debug("Avahi server state change: %i", state)

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

462

bad_states = {

463

avahi.SERVER_INVALID: "Zeroconf server invalid",

464

avahi.SERVER_REGISTERING: None,

465

avahi.SERVER_COLLISION: "Zeroconf server name collision",

466

avahi.SERVER_FAILURE: "Zeroconf server failure",

467

}

362

468

if state in bad_states:

363

469

if bad_states[state] is not None:

364

470

if error is None:

367

473

logger.error(bad_states[state] + ": %r", error)

368

474

self.cleanup()

369

475

elif state == avahi.SERVER_RUNNING:

370

self.add()

476

try:

477

self.add()

478

except dbus.exceptions.DBusException as error:

479

if (error.get_dbus_name()

480

== "org.freedesktop.Avahi.CollisionError"):

481

logger.info("Local Zeroconf service name"

482

" collision.")

483

return self.rename(remove=False)

484

else:

485

logger.critical("D-Bus Exception", exc_info=error)

486

self.cleanup()

487

os._exit(1)

371

488

else:

372

489

if error is None:

373

490

logger.debug("Unknown state: %r", state)

374

491

else:

375

492

logger.debug("Unknown state: %r: %r", state, error)

376

493

377

494

def activate(self):

378

495

"""Derived from the Avahi example code"""

379

496

if self.server is None:

383

500

follow_name_owner_changes=True),

384

501

avahi.DBUS_INTERFACE_SERVER)

385

502

self.server.connect_to_signal("StateChanged",

386

self.server_state_changed)

503

self.server_state_changed)

387

504

self.server_state_changed(self.server.GetState())

388

505

389

506

390

507

class AvahiServiceToSyslog(AvahiService):

391

def rename(self):

508

def rename(self, *args, **kwargs):

392

509

"""Add the new name to the syslog messages"""

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

510

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

511

syslogger.setFormatter(logging.Formatter(

512

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

513

.format(self.name)))

398

514

return ret

399

515

400

516

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

407

408

class Client(object):

517

# Pretend that we have a GnuTLS module

518

class gnutls:

519

"""This isn't so much a class as it is a module-like namespace."""

520

521

library = ctypes.util.find_library("gnutls")

522

if library is None:

523

library = ctypes.util.find_library("gnutls-deb0")

524

_library = ctypes.cdll.LoadLibrary(library)

525

del library

526

527

# Unless otherwise indicated, the constants and types below are

528

# all from the gnutls/gnutls.h C header file.

529

530

# Constants

531

E_SUCCESS = 0

532

E_INTERRUPTED = -52

533

E_AGAIN = -28

534

CRT_OPENPGP = 2

535

CRT_RAWPK = 3

536

CLIENT = 2

537

SHUT_RDWR = 0

538

CRD_CERTIFICATE = 1

539

E_NO_CERTIFICATE_FOUND = -49

540

X509_FMT_DER = 0

541

NO_TICKETS = 1<<10

542

ENABLE_RAWPK = 1<<18

543

CTYPE_PEERS = 3

544

KEYID_USE_SHA256 = 1 # gnutls/x509.h

545

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

546

547

# Types

548

class session_int(ctypes.Structure):

549

_fields_ = []

550

session_t = ctypes.POINTER(session_int)

551

552

class certificate_credentials_st(ctypes.Structure):

553

_fields_ = []

554

certificate_credentials_t = ctypes.POINTER(

555

certificate_credentials_st)

556

certificate_type_t = ctypes.c_int

557

558

class datum_t(ctypes.Structure):

559

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

560

('size', ctypes.c_uint)]

561

562

class openpgp_crt_int(ctypes.Structure):

563

_fields_ = []

564

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

565

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

566

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

567

credentials_type_t = ctypes.c_int

568

transport_ptr_t = ctypes.c_void_p

569

close_request_t = ctypes.c_int

570

571

# Exceptions

572

class Error(Exception):

573

def __init__(self, message=None, code=None, args=()):

574

# Default usage is by a message string, but if a return

575

# code is passed, convert it to a string with

576

# gnutls.strerror()

577

self.code = code

578

if message is None and code is not None:

579

message = gnutls.strerror(code)

580

return super(gnutls.Error, self).__init__(

581

message, *args)

582

583

class CertificateSecurityError(Error):

584

pass

585

586

# Classes

587

class Credentials:

588

def __init__(self):

589

self._c_object = gnutls.certificate_credentials_t()

590

gnutls.certificate_allocate_credentials(

591

ctypes.byref(self._c_object))

592

self.type = gnutls.CRD_CERTIFICATE

593

594

def __del__(self):

595

gnutls.certificate_free_credentials(self._c_object)

596

597

class ClientSession:

598

def __init__(self, socket, credentials=None):

599

self._c_object = gnutls.session_t()

600

gnutls_flags = gnutls.CLIENT

601

if gnutls.check_version(b"3.5.6"):

602

gnutls_flags |= gnutls.NO_TICKETS

603

if gnutls.has_rawpk:

604

gnutls_flags |= gnutls.ENABLE_RAWPK

605

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

606

del gnutls_flags

607

gnutls.set_default_priority(self._c_object)

608

gnutls.transport_set_ptr(self._c_object, socket.fileno())

609

gnutls.handshake_set_private_extensions(self._c_object,

610

True)

611

self.socket = socket

612

if credentials is None:

613

credentials = gnutls.Credentials()

614

gnutls.credentials_set(self._c_object, credentials.type,

615

ctypes.cast(credentials._c_object,

616

ctypes.c_void_p))

617

self.credentials = credentials

618

619

def __del__(self):

620

gnutls.deinit(self._c_object)

621

622

def handshake(self):

623

return gnutls.handshake(self._c_object)

624

625

def send(self, data):

626

data = bytes(data)

627

data_len = len(data)

628

while data_len > 0:

629

data_len -= gnutls.record_send(self._c_object,

630

data[-data_len:],

631

data_len)

632

633

def bye(self):

634

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

635

636

# Error handling functions

637

def _error_code(result):

638

"""A function to raise exceptions on errors, suitable

639

for the 'restype' attribute on ctypes functions"""

640

if result >= 0:

641

return result

642

if result == gnutls.E_NO_CERTIFICATE_FOUND:

643

raise gnutls.CertificateSecurityError(code=result)

644

raise gnutls.Error(code=result)

645

646

def _retry_on_error(result, func, arguments):

647

"""A function to retry on some errors, suitable

648

for the 'errcheck' attribute on ctypes functions"""

649

while result < 0:

650

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

651

return _error_code(result)

652

result = func(*arguments)

653

return result

654

655

# Unless otherwise indicated, the function declarations below are

656

# all from the gnutls/gnutls.h C header file.

657

658

# Functions

659

priority_set_direct = _library.gnutls_priority_set_direct

660

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

661

ctypes.POINTER(ctypes.c_char_p)]

662

priority_set_direct.restype = _error_code

663

664

init = _library.gnutls_init

665

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

666

init.restype = _error_code

667

668

set_default_priority = _library.gnutls_set_default_priority

669

set_default_priority.argtypes = [session_t]

670

set_default_priority.restype = _error_code

671

672

record_send = _library.gnutls_record_send

673

record_send.argtypes = [session_t, ctypes.c_void_p,

674

ctypes.c_size_t]

675

record_send.restype = ctypes.c_ssize_t

676

record_send.errcheck = _retry_on_error

677

678

certificate_allocate_credentials = (

679

_library.gnutls_certificate_allocate_credentials)

680

certificate_allocate_credentials.argtypes = [

681

ctypes.POINTER(certificate_credentials_t)]

682

certificate_allocate_credentials.restype = _error_code

683

684

certificate_free_credentials = (

685

_library.gnutls_certificate_free_credentials)

686

certificate_free_credentials.argtypes = [

687

certificate_credentials_t]

688

certificate_free_credentials.restype = None

689

690

handshake_set_private_extensions = (

691

_library.gnutls_handshake_set_private_extensions)

692

handshake_set_private_extensions.argtypes = [session_t,

693

ctypes.c_int]

694

handshake_set_private_extensions.restype = None

695

696

credentials_set = _library.gnutls_credentials_set

697

credentials_set.argtypes = [session_t, credentials_type_t,

698

ctypes.c_void_p]

699

credentials_set.restype = _error_code

700

701

strerror = _library.gnutls_strerror

702

strerror.argtypes = [ctypes.c_int]

703

strerror.restype = ctypes.c_char_p

704

705

certificate_type_get = _library.gnutls_certificate_type_get

706

certificate_type_get.argtypes = [session_t]

707

certificate_type_get.restype = _error_code

708

709

certificate_get_peers = _library.gnutls_certificate_get_peers

710

certificate_get_peers.argtypes = [session_t,

711

ctypes.POINTER(ctypes.c_uint)]

712

certificate_get_peers.restype = ctypes.POINTER(datum_t)

713

714

global_set_log_level = _library.gnutls_global_set_log_level

715

global_set_log_level.argtypes = [ctypes.c_int]

716

global_set_log_level.restype = None

717

718

global_set_log_function = _library.gnutls_global_set_log_function

719

global_set_log_function.argtypes = [log_func]

720

global_set_log_function.restype = None

721

722

deinit = _library.gnutls_deinit

723

deinit.argtypes = [session_t]

724

deinit.restype = None

725

726

handshake = _library.gnutls_handshake

727

handshake.argtypes = [session_t]

728

handshake.restype = _error_code

729

handshake.errcheck = _retry_on_error

730

731

transport_set_ptr = _library.gnutls_transport_set_ptr

732

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

733

transport_set_ptr.restype = None

734

735

bye = _library.gnutls_bye

736

bye.argtypes = [session_t, close_request_t]

737

bye.restype = _error_code

738

bye.errcheck = _retry_on_error

739

740

check_version = _library.gnutls_check_version

741

check_version.argtypes = [ctypes.c_char_p]

742

check_version.restype = ctypes.c_char_p

743

744

_need_version = b"3.3.0"

745

if check_version(_need_version) is None:

746

raise self.Error("Needs GnuTLS {} or later"

747

.format(_need_version))

748

749

_tls_rawpk_version = b"3.6.6"

750

has_rawpk = bool(check_version(_tls_rawpk_version))

751

752

if has_rawpk:

753

# Types

754

class pubkey_st(ctypes.Structure):

755

_fields = []

756

pubkey_t = ctypes.POINTER(pubkey_st)

757

758

x509_crt_fmt_t = ctypes.c_int

759

760

# All the function declarations below are from gnutls/abstract.h

761

pubkey_init = _library.gnutls_pubkey_init

762

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

763

pubkey_init.restype = _error_code

764

765

pubkey_import = _library.gnutls_pubkey_import

766

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

767

x509_crt_fmt_t]

768

pubkey_import.restype = _error_code

769

770

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

771

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

772

ctypes.POINTER(ctypes.c_ubyte),

773

ctypes.POINTER(ctypes.c_size_t)]

774

pubkey_get_key_id.restype = _error_code

775

776

pubkey_deinit = _library.gnutls_pubkey_deinit

777

pubkey_deinit.argtypes = [pubkey_t]

778

pubkey_deinit.restype = None

779

else:

780

# All the function declarations below are from gnutls/openpgp.h

781

782

openpgp_crt_init = _library.gnutls_openpgp_crt_init

783

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

784

openpgp_crt_init.restype = _error_code

785

786

openpgp_crt_import = _library.gnutls_openpgp_crt_import

787

openpgp_crt_import.argtypes = [openpgp_crt_t,

788

ctypes.POINTER(datum_t),

789

openpgp_crt_fmt_t]

790

openpgp_crt_import.restype = _error_code

791

792

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

793

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

794

ctypes.POINTER(ctypes.c_uint)]

795

openpgp_crt_verify_self.restype = _error_code

796

797

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

798

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

799

openpgp_crt_deinit.restype = None

800

801

openpgp_crt_get_fingerprint = (

802

_library.gnutls_openpgp_crt_get_fingerprint)

803

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

804

ctypes.c_void_p,

805

ctypes.POINTER(

806

ctypes.c_size_t)]

807

openpgp_crt_get_fingerprint.restype = _error_code

808

809

if check_version(b"3.6.4"):

810

certificate_type_get2 = _library.gnutls_certificate_type_get2

811

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

812

certificate_type_get2.restype = _error_code

813

814

# Remove non-public functions

815

del _error_code, _retry_on_error

816

817

818

def call_pipe(connection, # : multiprocessing.Connection

819

func, *args, **kwargs):

820

"""This function is meant to be called by multiprocessing.Process

821

822

This function runs func(*args, **kwargs), and writes the resulting

823

return value on the provided multiprocessing.Connection.

824

"""

825

connection.send(func(*args, **kwargs))

826

connection.close()

827

828

829

class Client:

409

830

"""A representation of a client host served by this server.

410

831

411

832

Attributes:

412

833

approved: bool(); 'None' if not yet approved/disapproved

413

834

approval_delay: datetime.timedelta(); Time to wait for approval

414

835

approval_duration: datetime.timedelta(); Duration of one approval

415

checker: subprocess.Popen(); a running checker process used

416

to see if the client lives.

417

'None' if no process is running.

418

checker_callback_tag: a gobject event source tag, or None

836

checker: multiprocessing.Process(); a running checker process used

837

to see if the client lives. 'None' if no process is

838

running.

839

checker_callback_tag: a GLib event source tag, or None

419

840

checker_command: string; External command which is run to check

420

841

if client lives. %() expansions are done at

421

842

runtime with vars(self) as dict, so that for

422

843

instance %(name)s can be used in the command.

423

checker_initiator_tag: a gobject event source tag, or None

844

checker_initiator_tag: a GLib event source tag, or None

424

845

created: datetime.datetime(); (UTC) object creation

425

846

client_structure: Object describing what attributes a client has

426

847

and is used for storing the client at exit

427

848

current_checker_command: string; current running checker_command

428

disable_initiator_tag: a gobject event source tag, or None

849

disable_initiator_tag: a GLib event source tag, or None

429

850

enabled: bool()

430

851

fingerprint: string (40 or 32 hexadecimal digits); used to

431

uniquely identify the client

852

uniquely identify an OpenPGP client

853

key_id: string (64 hexadecimal digits); used to uniquely identify

854

a client using raw public keys

432

855

host: string; available for use by the checker command

433

856

interval: datetime.timedelta(); How often to start a new checker

434

857

last_approval_request: datetime.datetime(); (UTC) or None

436

859

last_checker_status: integer between 0 and 255 reflecting exit

437

860

status of last checker. -1 reflects crashed

438

861

checker, -2 means no checker completed yet.

862

last_checker_signal: The signal which killed the last checker, if

863

last_checker_status is -1

439

864

last_enabled: datetime.datetime(); (UTC) or None

440

865

name: string; from the config file, used in log messages and

441

866

D-Bus identifiers

448

873

disabled, or None

449

874

server_settings: The server_settings dict from main()

450

875

"""

451

876

452

877

runtime_expansions = ("approval_delay", "approval_duration",

453

"created", "enabled", "expires",

878

"created", "enabled", "expires", "key_id",

454

879

"fingerprint", "host", "interval",

455

880

"last_approval_request", "last_checked_ok",

456

881

"last_enabled", "name", "timeout")

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

482

882

client_defaults = {

883

"timeout": "PT5M",

884

"extended_timeout": "PT15M",

885

"interval": "PT2M",

886

"checker": "fping -q -- %%(host)s",

887

"host": "",

888

"approval_delay": "PT0S",

889

"approval_duration": "PT1S",

890

"approved_by_default": "True",

891

"enabled": "True",

892

}

893

483

894

@staticmethod

484

895

def config_parser(config):

485

896

"""Construct a new dict of client settings of this form:

492

903

for client_name in config.sections():

493

904

section = dict(config.items(client_name))

494

905

client = settings[client_name] = {}

495

906

496

907

client["host"] = section["host"]

497

908

# Reformat values from string types to Python types

498

909

client["approved_by_default"] = config.getboolean(

499

910

client_name, "approved_by_default")

500

911

client["enabled"] = config.getboolean(client_name,

501

912

"enabled")

502

913

914

# Uppercase and remove spaces from key_id and fingerprint

915

# for later comparison purposes with return value from the

916

# key_id() and fingerprint() functions

917

client["key_id"] = (section.get("key_id", "").upper()

918

.replace(" ", ""))

503

919

client["fingerprint"] = (section["fingerprint"].upper()

504

920

.replace(" ", ""))

505

921

if "secret" in section:

506

client["secret"] = section["secret"].decode("base64")

922

client["secret"] = codecs.decode(section["secret"]

923

.encode("utf-8"),

924

"base64")

507

925

elif "secfile" in section:

508

926

with open(os.path.expanduser(os.path.expandvars

509

927

(section["secfile"])),

510

928

"rb") as secfile:

511

929

client["secret"] = secfile.read()

512

930

else:

513

raise TypeError("No secret or secfile for section {0}"

931

raise TypeError("No secret or secfile for section {}"

514

932

.format(section))

515

933

client["timeout"] = string_to_delta(section["timeout"])

516

934

client["extended_timeout"] = string_to_delta(

524

942

client["last_approval_request"] = None

525

943

client["last_checked_ok"] = None

526

944

client["last_checker_status"] = -2

527

945

528

946

return settings

529

530

def __init__(self, settings, name = None, server_settings=None):

947

948

def __init__(self, settings, name=None, server_settings=None):

531

949

self.name = name

532

950

if server_settings is None:

533

951

server_settings = {}

534

952

self.server_settings = server_settings

535

953

# adding all client settings

536

for setting, value in settings.iteritems():

954

for setting, value in settings.items():

537

955

setattr(self, setting, value)

538

956

539

957

if self.enabled:

540

958

if not hasattr(self, "last_enabled"):

541

959

self.last_enabled = datetime.datetime.utcnow()

545

963

else:

546

964

self.last_enabled = None

547

965

self.expires = None

548

966

549

967

logger.debug("Creating client %r", self.name)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

968

logger.debug(" Key ID: %s", self.key_id)

553

969

logger.debug(" Fingerprint: %s", self.fingerprint)

554

970

self.created = settings.get("created",

555

971

datetime.datetime.utcnow())

556

972

557

973

# attributes specific for this server instance

558

974

self.checker = None

559

975

self.checker_initiator_tag = None

562

978

self.current_checker_command = None

563

979

self.approved = None

564

980

self.approvals_pending = 0

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

981

self.changedstate = multiprocessing_manager.Condition(

982

multiprocessing_manager.Lock())

983

self.client_structure = [attr

984

for attr in self.__dict__.keys()

570

985

if not attr.startswith("_")]

571

986

self.client_structure.append("client_structure")

572

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

987

988

for name, t in inspect.getmembers(

989

type(self), lambda obj: isinstance(obj, property)):

577

990

if not name.startswith("_"):

578

991

self.client_structure.append(name)

579

992

580

993

# Send notice to process children that client state has changed

581

994

def send_changedstate(self):

582

995

with self.changedstate:

583

996

self.changedstate.notify_all()

584

997

585

998

def enable(self):

586

999

"""Start this client's checker and timeout hooks"""

587

1000

if getattr(self, "enabled", False):

592

1005

self.last_enabled = datetime.datetime.utcnow()

593

1006

self.init_checker()

594

1007

self.send_changedstate()

595

1008

596

1009

def disable(self, quiet=True):

597

1010

"""Disable this client."""

598

1011

if not getattr(self, "enabled", False):

600

1013

if not quiet:

601

1014

logger.info("Disabling client %s", self.name)

602

1015

if getattr(self, "disable_initiator_tag", None) is not None:

603

gobject.source_remove(self.disable_initiator_tag)

1016

GLib.source_remove(self.disable_initiator_tag)

604

1017

self.disable_initiator_tag = None

605

1018

self.expires = None

606

1019

if getattr(self, "checker_initiator_tag", None) is not None:

607

gobject.source_remove(self.checker_initiator_tag)

1020

GLib.source_remove(self.checker_initiator_tag)

608

1021

self.checker_initiator_tag = None

609

1022

self.stop_checker()

610

1023

self.enabled = False

611

1024

if not quiet:

612

1025

self.send_changedstate()

613

# Do not run this again if called by a gobject.timeout_add

1026

# Do not run this again if called by a GLib.timeout_add

614

1027

return False

615

1028

616

1029

def __del__(self):

617

1030

self.disable()

618

1031

619

1032

def init_checker(self):

620

1033

# Schedule a new checker to be started an 'interval' from now,

621

1034

# and every interval from then on.

622

1035

if self.checker_initiator_tag is not None:

623

gobject.source_remove(self.checker_initiator_tag)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

1036

GLib.source_remove(self.checker_initiator_tag)

1037

self.checker_initiator_tag = GLib.timeout_add(

1038

int(self.interval.total_seconds() * 1000),

1039

self.start_checker)

627

1040

# Schedule a disable() when 'timeout' has passed

628

1041

if self.disable_initiator_tag is not None:

629

gobject.source_remove(self.disable_initiator_tag)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

1042

GLib.source_remove(self.disable_initiator_tag)

1043

self.disable_initiator_tag = GLib.timeout_add(

1044

int(self.timeout.total_seconds() * 1000), self.disable)

633

1045

# Also start a new checker *right now*.

634

1046

self.start_checker()

635

636

def checker_callback(self, pid, condition, command):

1047

1048

def checker_callback(self, source, condition, connection,

1049

command):

637

1050

"""The checker has completed, so take appropriate actions."""

1051

# Read return code from connection (see call_pipe)

1052

returncode = connection.recv()

1053

connection.close()

1054

if self.checker is not None:

1055

self.checker.join()

638

1056

self.checker_callback_tag = None

639

1057

self.checker = None

640

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

1058

1059

if returncode >= 0:

1060

self.last_checker_status = returncode

1061

self.last_checker_signal = None

642

1062

if self.last_checker_status == 0:

643

1063

logger.info("Checker for %(name)s succeeded",

644

1064

vars(self))

645

1065

self.checked_ok()

646

1066

else:

647

logger.info("Checker for %(name)s failed",

648

vars(self))

1067

logger.info("Checker for %(name)s failed", vars(self))

649

1068

else:

650

1069

self.last_checker_status = -1

1070

self.last_checker_signal = -returncode

651

1071

logger.warning("Checker for %(name)s crashed?",

652

1072

vars(self))

653

1073

return False

1074

654

1075

def checked_ok(self):

655

1076

"""Assert that the client has been seen, alive and well."""

656

1077

self.last_checked_ok = datetime.datetime.utcnow()

657

1078

self.last_checker_status = 0

1079

self.last_checker_signal = None

658

1080

self.bump_timeout()

659

1081

660

1082

def bump_timeout(self, timeout=None):

661

1083

"""Bump up the timeout for this client."""

662

1084

if timeout is None:

663

1085

timeout = self.timeout

664

1086

if self.disable_initiator_tag is not None:

665

gobject.source_remove(self.disable_initiator_tag)

1087

GLib.source_remove(self.disable_initiator_tag)

666

1088

self.disable_initiator_tag = None

667

1089

if getattr(self, "enabled", False):

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

1090

self.disable_initiator_tag = GLib.timeout_add(

1091

int(timeout.total_seconds() * 1000), self.disable)

671

1092

self.expires = datetime.datetime.utcnow() + timeout

672

1093

673

1094

def need_approval(self):

674

1095

self.last_approval_request = datetime.datetime.utcnow()

675

1096

676

1097

def start_checker(self):

677

1098

"""Start a new checker subprocess if one is not running.

678

1099

679

1100

If a checker already exists, leave it running and do

680

1101

nothing."""

681

1102

# The reason for not killing a running checker is that if we

686

1107

# checkers alone, the checker would have to take more time

687

1108

# than 'timeout' for the client to be disabled, which is as it

688

1109

# should be.

689

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except (AttributeError, OSError) as error:

694

if (isinstance(error, OSError)

695

and error.errno != errno.ECHILD):

696

raise error

697

else:

698

if pid:

699

logger.warning("Checker was a zombie")

700

gobject.source_remove(self.checker_callback_tag)

701

self.checker_callback(pid, status,

702

self.current_checker_command)

1110

1111

if self.checker is not None and not self.checker.is_alive():

1112

logger.warning("Checker was not alive; joining")

1113

self.checker.join()

1114

self.checker = None

703

1115

# Start a new checker if needed

704

1116

if self.checker is None:

705

1117

# Escape attributes for the shell

706

escaped_attrs = dict(

707

(attr, re.escape(unicode(getattr(self, attr))))

708

for attr in

709

self.runtime_expansions)

1118

escaped_attrs = {

1119

attr: re.escape(str(getattr(self, attr)))

1120

for attr in self.runtime_expansions}

710

1121

try:

711

1122

command = self.checker_command % escaped_attrs

712

1123

except TypeError as error:

713

1124

logger.error('Could not format string "%s"',

714

self.checker_command, exc_info=error)

715

return True # Try again later

1125

self.checker_command,

1126

exc_info=error)

1127

return True # Try again later

716

1128

self.current_checker_command = command

717

try:

718

logger.info("Starting checker %r for %s",

719

command, self.name)

720

# We don't need to redirect stdout and stderr, since

721

# in normal mode, that is already done by daemon(),

722

# and in debug mode we don't want to. (Stdin is

723

# always replaced by /dev/null.)

724

# The exception is when not debugging but nevertheless

725

# running in the foreground; use the previously

726

# created wnull.

727

popen_args = {}

728

if (not self.server_settings["debug"]

729

and self.server_settings["foreground"]):

730

popen_args.update({"stdout": wnull,

731

"stderr": wnull })

732

self.checker = subprocess.Popen(command,

733

close_fds=True,

734

shell=True, cwd="/",

735

**popen_args)

736

except OSError as error:

737

logger.error("Failed to start subprocess",

738

exc_info=error)

739

return True

740

self.checker_callback_tag = (gobject.child_watch_add

741

(self.checker.pid,

742

self.checker_callback,

743

data=command))

744

# The checker may have completed before the gobject

745

# watch was added. Check for this.

746

try:

747

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

748

except OSError as error:

749

if error.errno == errno.ECHILD:

750

# This should never happen

751

logger.error("Child process vanished",

752

exc_info=error)

753

return True

754

raise

755

if pid:

756

gobject.source_remove(self.checker_callback_tag)

757

self.checker_callback(pid, status, command)

758

# Re-run this periodically if run by gobject.timeout_add

1129

logger.info("Starting checker %r for %s", command,

1130

self.name)

1131

# We don't need to redirect stdout and stderr, since

1132

# in normal mode, that is already done by daemon(),

1133

# and in debug mode we don't want to. (Stdin is

1134

# always replaced by /dev/null.)

1135

# The exception is when not debugging but nevertheless

1136

# running in the foreground; use the previously

1137

# created wnull.

1138

popen_args = {"close_fds": True,

1139

"shell": True,

1140

"cwd": "/"}

1141

if (not self.server_settings["debug"]

1142

and self.server_settings["foreground"]):

1143

popen_args.update({"stdout": wnull,

1144

"stderr": wnull})

1145

pipe = multiprocessing.Pipe(duplex=False)

1146

self.checker = multiprocessing.Process(

1147

target=call_pipe,

1148

args=(pipe[1], subprocess.call, command),

1149

kwargs=popen_args)

1150

self.checker.start()

1151

self.checker_callback_tag = GLib.io_add_watch(

1152

GLib.IOChannel.unix_new(pipe[0].fileno()),

1153

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1154

self.checker_callback, pipe[0], command)

1155

# Re-run this periodically if run by GLib.timeout_add

759

1156

return True

760

1157

761

1158

def stop_checker(self):

762

1159

"""Force the checker process, if any, to stop."""

763

1160

if self.checker_callback_tag:

764

gobject.source_remove(self.checker_callback_tag)

1161

GLib.source_remove(self.checker_callback_tag)

765

1162

self.checker_callback_tag = None

766

1163

if getattr(self, "checker", None) is None:

767

1164

return

768

1165

logger.debug("Stopping checker for %(name)s", vars(self))

769

try:

770

self.checker.terminate()

771

#time.sleep(0.5)

772

#if self.checker.poll() is None:

773

# self.checker.kill()

774

except OSError as error:

775

if error.errno != errno.ESRCH: # No such process

776

raise

1166

self.checker.terminate()

777

1167

self.checker = None

778

1168

779

1169

780

def dbus_service_property(dbus_interface, signature="v",

781

access="readwrite", byte_arrays=False):

1170

def dbus_service_property(dbus_interface,

1171

signature="v",

1172

access="readwrite",

1173

byte_arrays=False):

782

1174

"""Decorators for marking methods of a DBusObjectWithProperties to

783

1175

become properties on the D-Bus.

784

1176

785

1177

The decorated method will be called with no arguments by "Get"

786

1178

and with one argument by "Set".

787

1179

788

1180

The parameters, where they are supported, are the same as

789

1181

dbus.service.method, except there is only "signature", since the

790

1182

type from Get() and the type sent to Set() is the same.

793

1185

# "Set" method, so we fail early here:

794

1186

if byte_arrays and signature != "ay":

795

1187

raise ValueError("Byte arrays not supported for non-'ay'"

796

" signature {0!r}".format(signature))

1188

" signature {!r}".format(signature))

1189

797

1190

def decorator(func):

798

1191

func._dbus_is_property = True

799

1192

func._dbus_interface = dbus_interface

802

1195

func._dbus_name = func.__name__

803

1196

if func._dbus_name.endswith("_dbus_property"):

804

1197

func._dbus_name = func._dbus_name[:-14]

805

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1198

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

806

1199

return func

1200

807

1201

return decorator

808

1202

809

1203

810

1204

def dbus_interface_annotations(dbus_interface):

811

1205

"""Decorator for marking functions returning interface annotations

812

1206

813

1207

Usage:

814

1208

815

1209

@dbus_interface_annotations("org.example.Interface")

816

1210

def _foo(self): # Function name does not matter

817

1211

return {"org.freedesktop.DBus.Deprecated": "true",

818

1212

"org.freedesktop.DBus.Property.EmitsChangedSignal":

819

1213

"false"}

820

1214

"""

1215

821

1216

def decorator(func):

822

1217

func._dbus_is_interface = True

823

1218

func._dbus_interface = dbus_interface

824

1219

func._dbus_name = dbus_interface

825

1220

return func

1221

826

1222

return decorator

827

1223

828

1224

829

1225

def dbus_annotations(annotations):

830

1226

"""Decorator to annotate D-Bus methods, signals or properties

831

1227

Usage:

832

1228

1229

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1230

"org.freedesktop.DBus.Property."

1231

"EmitsChangedSignal": "false"})

833

1232

@dbus_service_property("org.example.Interface", signature="b",

834

1233

access="r")

835

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

836

"org.freedesktop.DBus.Property."

837

"EmitsChangedSignal": "false"})

838

1234

def Property_dbus_property(self):

839

1235

return dbus.Boolean(False)

1236

1237

See also the DBusObjectWithAnnotations class.

840

1238

"""

1239

841

1240

def decorator(func):

842

1241

func._dbus_annotations = annotations

843

1242

return func

1243

844

1244

return decorator

845

1245

846

1246

847

1247

class DBusPropertyException(dbus.exceptions.DBusException):

848

1248

"""A base class for D-Bus property-related exceptions

849

1249

"""

850

def __unicode__(self):

851

return unicode(str(self))

1250

pass

852

1251

853

1252

854

1253

class DBusPropertyAccessException(DBusPropertyException):

863

1262

pass

864

1263

865

1264

866

class DBusObjectWithProperties(dbus.service.Object):

867

"""A D-Bus object with properties.

868

869

Classes inheriting from this can use the dbus_service_property

870

decorator to expose methods as D-Bus properties. It exposes the

871

standard Get(), Set(), and GetAll() methods on the D-Bus.

1265

class DBusObjectWithAnnotations(dbus.service.Object):

1266

"""A D-Bus object with annotations.

1267

1268

Classes inheriting from this can use the dbus_annotations

1269

decorator to add annotations to methods or signals.

872

1270

"""

873

1271

874

1272

@staticmethod

875

1273

def _is_dbus_thing(thing):

876

1274

"""Returns a function testing if an attribute is a D-Bus thing

877

1275

878

1276

If called like _is_dbus_thing("method") it returns a function

879

1277

suitable for use as predicate to inspect.getmembers().

880

1278

"""

881

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1279

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

882

1280

False)

883

1281

884

1282

def _get_all_dbus_things(self, thing):

885

1283

"""Returns a generator of (name, attribute) pairs

886

1284

"""

887

return ((getattr(athing.__get__(self), "_dbus_name",

888

name),

1285

return ((getattr(athing.__get__(self), "_dbus_name", name),

889

1286

athing.__get__(self))

890

1287

for cls in self.__class__.__mro__

891

1288

for name, athing in

892

inspect.getmembers(cls,

893

self._is_dbus_thing(thing)))

894

1289

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1290

1291

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1292

out_signature="s",

1293

path_keyword='object_path',

1294

connection_keyword='connection')

1295

def Introspect(self, object_path, connection):

1296

"""Overloading of standard D-Bus method.

1297

1298

Inserts annotation tags on methods and signals.

1299

"""

1300

xmlstring = dbus.service.Object.Introspect(self, object_path,

1301

connection)

1302

try:

1303

document = xml.dom.minidom.parseString(xmlstring)

1304

1305

for if_tag in document.getElementsByTagName("interface"):

1306

# Add annotation tags

1307

for typ in ("method", "signal"):

1308

for tag in if_tag.getElementsByTagName(typ):

1309

annots = dict()

1310

for name, prop in (self.

1311

_get_all_dbus_things(typ)):

1312

if (name == tag.getAttribute("name")

1313

and prop._dbus_interface

1314

== if_tag.getAttribute("name")):

1315

annots.update(getattr(

1316

prop, "_dbus_annotations", {}))

1317

for name, value in annots.items():

1318

ann_tag = document.createElement(

1319

"annotation")

1320

ann_tag.setAttribute("name", name)

1321

ann_tag.setAttribute("value", value)

1322

tag.appendChild(ann_tag)

1323

# Add interface annotation tags

1324

for annotation, value in dict(

1325

itertools.chain.from_iterable(

1326

annotations().items()

1327

for name, annotations

1328

in self._get_all_dbus_things("interface")

1329

if name == if_tag.getAttribute("name")

1330

)).items():

1331

ann_tag = document.createElement("annotation")

1332

ann_tag.setAttribute("name", annotation)

1333

ann_tag.setAttribute("value", value)

1334

if_tag.appendChild(ann_tag)

1335

# Fix argument name for the Introspect method itself

1336

if (if_tag.getAttribute("name")

1337

== dbus.INTROSPECTABLE_IFACE):

1338

for cn in if_tag.getElementsByTagName("method"):

1339

if cn.getAttribute("name") == "Introspect":

1340

for arg in cn.getElementsByTagName("arg"):

1341

if (arg.getAttribute("direction")

1342

== "out"):

1343

arg.setAttribute("name",

1344

"xml_data")

1345

xmlstring = document.toxml("utf-8")

1346

document.unlink()

1347

except (AttributeError, xml.dom.DOMException,

1348

xml.parsers.expat.ExpatError) as error:

1349

logger.error("Failed to override Introspection method",

1350

exc_info=error)

1351

return xmlstring

1352

1353

1354

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1355

"""A D-Bus object with properties.

1356

1357

Classes inheriting from this can use the dbus_service_property

1358

decorator to expose methods as D-Bus properties. It exposes the

1359

standard Get(), Set(), and GetAll() methods on the D-Bus.

1360

"""

1361

895

1362

def _get_dbus_property(self, interface_name, property_name):

896

1363

"""Returns a bound method if one exists which is a D-Bus

897

1364

property with the specified name and interface.

898

1365

"""

899

for cls in self.__class__.__mro__:

900

for name, value in (inspect.getmembers

901

(cls,

902

self._is_dbus_thing("property"))):

1366

for cls in self.__class__.__mro__:

1367

for name, value in inspect.getmembers(

1368

cls, self._is_dbus_thing("property")):

903

1369

if (value._dbus_name == property_name

904

1370

and value._dbus_interface == interface_name):

905

1371

return value.__get__(self)

906

1372

907

1373

# No such property

908

raise DBusPropertyNotFound(self.dbus_object_path + ":"

909

+ interface_name + "."

910

+ property_name)

911

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1374

raise DBusPropertyNotFound("{}:{}.{}".format(

1375

self.dbus_object_path, interface_name, property_name))

1376

1377

@classmethod

1378

def _get_all_interface_names(cls):

1379

"""Get a sequence of all interfaces supported by an object"""

1380

return (name for name in set(getattr(getattr(x, attr),

1381

"_dbus_interface", None)

1382

for x in (inspect.getmro(cls))

1383

for attr in dir(x))

1384

if name is not None)

1385

1386

@dbus.service.method(dbus.PROPERTIES_IFACE,

1387

in_signature="ss",

913

1388

out_signature="v")

914

1389

def Get(self, interface_name, property_name):

915

1390

"""Standard D-Bus property Get() method, see D-Bus standard.

921

1396

if not hasattr(value, "variant_level"):

922

1397

return value

923

1398

return type(value)(value, variant_level=value.variant_level+1)

924

1399

925

1400

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

926

1401

def Set(self, interface_name, property_name, value):

927

1402

"""Standard D-Bus property Set() method, see D-Bus standard.

933

1408

# The byte_arrays option is not supported yet on

934

1409

# signatures other than "ay".

935

1410

if prop._dbus_signature != "ay":

936

raise ValueError

937

value = dbus.ByteArray(b''.join(chr(byte)

938

for byte in value))

1411

raise ValueError("Byte arrays not supported for non-"

1412

"'ay' signature {!r}"

1413

.format(prop._dbus_signature))

1414

value = dbus.ByteArray(bytes(value))

939

1415

prop(value)

940

941

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1416

1417

@dbus.service.method(dbus.PROPERTIES_IFACE,

1418

in_signature="s",

942

1419

out_signature="a{sv}")

943

1420

def GetAll(self, interface_name):

944

1421

"""Standard D-Bus property GetAll() method, see D-Bus

945

1422

standard.

946

1423

947

1424

Note: Will not include properties with access="write".

948

1425

"""

949

1426

properties = {}

959

1436

if not hasattr(value, "variant_level"):

960

1437

properties[name] = value

961

1438

continue

962

properties[name] = type(value)(value, variant_level=

963

value.variant_level+1)

1439

properties[name] = type(value)(

1440

value, variant_level=value.variant_level + 1)

964

1441

return dbus.Dictionary(properties, signature="sv")

965

1442

1443

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1444

def PropertiesChanged(self, interface_name, changed_properties,

1445

invalidated_properties):

1446

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1447

standard.

1448

"""

1449

pass

1450

966

1451

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

967

1452

out_signature="s",

968

1453

path_keyword='object_path',

969

1454

connection_keyword='connection')

970

1455

def Introspect(self, object_path, connection):

971

1456

"""Overloading of standard D-Bus method.

972

1457

973

1458

Inserts property tags and interface annotation tags.

974

1459

"""

975

xmlstring = dbus.service.Object.Introspect(self, object_path,

976

connection)

1460

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1461

object_path,

1462

connection)

977

1463

try:

978

1464

document = xml.dom.minidom.parseString(xmlstring)

1465

979

1466

def make_tag(document, name, prop):

980

1467

e = document.createElement("property")

981

1468

e.setAttribute("name", name)

982

1469

e.setAttribute("type", prop._dbus_signature)

983

1470

e.setAttribute("access", prop._dbus_access)

984

1471

return e

1472

985

1473

for if_tag in document.getElementsByTagName("interface"):

986

1474

# Add property tags

987

1475

for tag in (make_tag(document, name, prop)

990

1478

if prop._dbus_interface

991

1479

== if_tag.getAttribute("name")):

992

1480

if_tag.appendChild(tag)

993

# Add annotation tags

994

for typ in ("method", "signal", "property"):

995

for tag in if_tag.getElementsByTagName(typ):

996

annots = dict()

997

for name, prop in (self.

998

_get_all_dbus_things(typ)):

999

if (name == tag.getAttribute("name")

1000

and prop._dbus_interface

1001

== if_tag.getAttribute("name")):

1002

annots.update(getattr

1003

(prop,

1004

"_dbus_annotations",

1005

{}))

1006

for name, value in annots.iteritems():

1007

ann_tag = document.createElement(

1008

"annotation")

1009

ann_tag.setAttribute("name", name)

1010

ann_tag.setAttribute("value", value)

1011

tag.appendChild(ann_tag)

1012

# Add interface annotation tags

1013

for annotation, value in dict(

1014

itertools.chain.from_iterable(

1015

annotations().iteritems()

1016

for name, annotations in

1017

self._get_all_dbus_things("interface")

1018

if name == if_tag.getAttribute("name")

1019

)).iteritems():

1020

ann_tag = document.createElement("annotation")

1021

ann_tag.setAttribute("name", annotation)

1022

ann_tag.setAttribute("value", value)

1023

if_tag.appendChild(ann_tag)

1481

# Add annotation tags for properties

1482

for tag in if_tag.getElementsByTagName("property"):

1483

annots = dict()

1484

for name, prop in self._get_all_dbus_things(

1485

"property"):

1486

if (name == tag.getAttribute("name")

1487

and prop._dbus_interface

1488

== if_tag.getAttribute("name")):

1489

annots.update(getattr(

1490

prop, "_dbus_annotations", {}))

1491

for name, value in annots.items():

1492

ann_tag = document.createElement(

1493

"annotation")

1494

ann_tag.setAttribute("name", name)

1495

ann_tag.setAttribute("value", value)

1496

tag.appendChild(ann_tag)

1024

1497

# Add the names to the return values for the

1025

1498

# "org.freedesktop.DBus.Properties" methods

1026

1499

if (if_tag.getAttribute("name")

1045

1518

return xmlstring

1046

1519

1047

1520

1521

try:

1522

dbus.OBJECT_MANAGER_IFACE

1523

except AttributeError:

1524

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1525

1526

1527

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1528

"""A D-Bus object with an ObjectManager.

1529

1530

Classes inheriting from this exposes the standard

1531

GetManagedObjects call and the InterfacesAdded and

1532

InterfacesRemoved signals on the standard

1533

"org.freedesktop.DBus.ObjectManager" interface.

1534

1535

Note: No signals are sent automatically; they must be sent

1536

manually.

1537

"""

1538

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1539

out_signature="a{oa{sa{sv}}}")

1540

def GetManagedObjects(self):

1541

"""This function must be overridden"""

1542

raise NotImplementedError()

1543

1544

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1545

signature="oa{sa{sv}}")

1546

def InterfacesAdded(self, object_path, interfaces_and_properties):

1547

pass

1548

1549

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1550

def InterfacesRemoved(self, object_path, interfaces):

1551

pass

1552

1553

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1554

out_signature="s",

1555

path_keyword='object_path',

1556

connection_keyword='connection')

1557

def Introspect(self, object_path, connection):

1558

"""Overloading of standard D-Bus method.

1559

1560

Override return argument name of GetManagedObjects to be

1561

"objpath_interfaces_and_properties"

1562

"""

1563

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1564

object_path,

1565

connection)

1566

try:

1567

document = xml.dom.minidom.parseString(xmlstring)

1568

1569

for if_tag in document.getElementsByTagName("interface"):

1570

# Fix argument name for the GetManagedObjects method

1571

if (if_tag.getAttribute("name")

1572

== dbus.OBJECT_MANAGER_IFACE):

1573

for cn in if_tag.getElementsByTagName("method"):

1574

if (cn.getAttribute("name")

1575

== "GetManagedObjects"):

1576

for arg in cn.getElementsByTagName("arg"):

1577

if (arg.getAttribute("direction")

1578

== "out"):

1579

arg.setAttribute(

1580

"name",

1581

"objpath_interfaces"

1582

"_and_properties")

1583

xmlstring = document.toxml("utf-8")

1584

document.unlink()

1585

except (AttributeError, xml.dom.DOMException,

1586

xml.parsers.expat.ExpatError) as error:

1587

logger.error("Failed to override Introspection method",

1588

exc_info=error)

1589

return xmlstring

1590

1591

1048

1592

def datetime_to_dbus(dt, variant_level=0):

1049

1593

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1050

1594

if dt is None:

1051

return dbus.String("", variant_level = variant_level)

1052

return dbus.String(dt.isoformat(),

1053

variant_level=variant_level)

1595

return dbus.String("", variant_level=variant_level)

1596

return dbus.String(dt.isoformat(), variant_level=variant_level)

1054

1597

1055

1598

1056

1599

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1058

1601

dbus.service.Object, it will add alternate D-Bus attributes with

1059

1602

interface names according to the "alt_interface_names" mapping.

1060

1603

Usage:

1061

1604

1062

1605

@alternate_dbus_interfaces({"org.example.Interface":

1063

1606

"net.example.AlternateInterface"})

1064

1607

class SampleDBusObject(dbus.service.Object):

1065

1608

@dbus.service.method("org.example.Interface")

1066

1609

def SampleDBusMethod():

1067

1610

pass

1068

1611

1069

1612

The above "SampleDBusMethod" on "SampleDBusObject" will be

1070

1613

reachable via two interfaces: "org.example.Interface" and

1071

1614

"net.example.AlternateInterface", the latter of which will have

1072

1615

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1073

1616

"true", unless "deprecate" is passed with a False value.

1074

1617

1075

1618

This works for methods and signals, and also for D-Bus properties

1076

1619

(from DBusObjectWithProperties) and interfaces (from the

1077

1620

dbus_interface_annotations decorator).

1078

1621

"""

1622

1079

1623

def wrapper(cls):

1080

1624

for orig_interface_name, alt_interface_name in (

1081

alt_interface_names.iteritems()):

1625

alt_interface_names.items()):

1082

1626

attr = {}

1083

1627

interface_names = set()

1084

1628

# Go though all attributes of the class

1086

1630

# Ignore non-D-Bus attributes, and D-Bus attributes

1087

1631

# with the wrong interface name

1088

1632

if (not hasattr(attribute, "_dbus_interface")

1089

or not attribute._dbus_interface

1090

.startswith(orig_interface_name)):

1633

or not attribute._dbus_interface.startswith(

1634

orig_interface_name)):

1091

1635

continue

1092

1636

# Create an alternate D-Bus interface name based on

1093

1637

# the current name

1094

alt_interface = (attribute._dbus_interface

1095

.replace(orig_interface_name,

1096

alt_interface_name))

1638

alt_interface = attribute._dbus_interface.replace(

1639

orig_interface_name, alt_interface_name)

1097

1640

interface_names.add(alt_interface)

1098

1641

# Is this a D-Bus signal?

1099

1642

if getattr(attribute, "_dbus_is_signal", False):

1100

1643

# Extract the original non-method undecorated

1101

1644

# function by black magic

1102

nonmethod_func = (dict(

1645

if sys.version_info.major == 2:

1646

nonmethod_func = (dict(

1103

1647

zip(attribute.func_code.co_freevars,

1104

attribute.__closure__))["func"]

1105

.cell_contents)

1648

attribute.__closure__))

1649

["func"].cell_contents)

1650

else:

1651

nonmethod_func = (dict(

1652

zip(attribute.__code__.co_freevars,

1653

attribute.__closure__))

1654

["func"].cell_contents)

1106

1655

# Create a new, but exactly alike, function

1107

1656

# object, and decorate it to be a new D-Bus signal

1108

1657

# with the alternate D-Bus interface name

1109

new_function = (dbus.service.signal

1110

(alt_interface,

1111

attribute._dbus_signature)

1112

(types.FunctionType(

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1658

new_function = copy_function(nonmethod_func)

1659

new_function = (dbus.service.signal(

1660

alt_interface,

1661

attribute._dbus_signature)(new_function))

1118

1662

# Copy annotations, if any

1119

1663

try:

1120

new_function._dbus_annotations = (

1121

dict(attribute._dbus_annotations))

1664

new_function._dbus_annotations = dict(

1665

attribute._dbus_annotations)

1122

1666

except AttributeError:

1123

1667

pass

1668

1124

1669

# Define a creator of a function to call both the

1125

1670

# original and alternate functions, so both the

1126

1671

# original and alternate signals gets sent when

1129

1674

"""This function is a scope container to pass

1130

1675

func1 and func2 to the "call_both" function

1131

1676

outside of its arguments"""

1677

1678

@functools.wraps(func2)

1132

1679

def call_both(*args, **kwargs):

1133

1680

"""This function will emit two D-Bus

1134

1681

signals by calling func1 and func2"""

1135

1682

func1(*args, **kwargs)

1136

1683

func2(*args, **kwargs)

1684

# Make wrapper function look like a D-Bus

1685

# signal

1686

for name, attr in inspect.getmembers(func2):

1687

if name.startswith("_dbus_"):

1688

setattr(call_both, name, attr)

1689

1137

1690

return call_both

1138

1691

# Create the "call_both" function and add it to

1139

1692

# the class

1144

1697

# object. Decorate it to be a new D-Bus method

1145

1698

# with the alternate D-Bus interface name. Add it

1146

1699

# to the class.

1147

attr[attrname] = (dbus.service.method

1148

(alt_interface,

1149

attribute._dbus_in_signature,

1150

attribute._dbus_out_signature)

1151

(types.FunctionType

1152

(attribute.func_code,

1153

attribute.func_globals,

1154

attribute.func_name,

1155

attribute.func_defaults,

1156

attribute.func_closure)))

1700

attr[attrname] = (

1701

dbus.service.method(

1702

alt_interface,

1703

attribute._dbus_in_signature,

1704

attribute._dbus_out_signature)

1705

(copy_function(attribute)))

1157

1706

# Copy annotations, if any

1158

1707

try:

1159

attr[attrname]._dbus_annotations = (

1160

dict(attribute._dbus_annotations))

1708

attr[attrname]._dbus_annotations = dict(

1709

attribute._dbus_annotations)

1161

1710

except AttributeError:

1162

1711

pass

1163

1712

# Is this a D-Bus property?

1166

1715

# object, and decorate it to be a new D-Bus

1167

1716

# property with the alternate D-Bus interface

1168

1717

# name. Add it to the class.

1169

attr[attrname] = (dbus_service_property

1170

(alt_interface,

1171

attribute._dbus_signature,

1172

attribute._dbus_access,

1173

attribute

1174

._dbus_get_args_options

1175

["byte_arrays"])

1176

(types.FunctionType

1177

(attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1718

attr[attrname] = (dbus_service_property(

1719

alt_interface, attribute._dbus_signature,

1720

attribute._dbus_access,

1721

attribute._dbus_get_args_options

1722

["byte_arrays"])

1723

(copy_function(attribute)))

1182

1724

# Copy annotations, if any

1183

1725

try:

1184

attr[attrname]._dbus_annotations = (

1185

dict(attribute._dbus_annotations))

1726

attr[attrname]._dbus_annotations = dict(

1727

attribute._dbus_annotations)

1186

1728

except AttributeError:

1187

1729

pass

1188

1730

# Is this a D-Bus interface?

1191

1733

# object. Decorate it to be a new D-Bus interface

1192

1734

# with the alternate D-Bus interface name. Add it

1193

1735

# to the class.

1194

attr[attrname] = (dbus_interface_annotations

1195

(alt_interface)

1196

(types.FunctionType

1197

(attribute.func_code,

1198

attribute.func_globals,

1199

attribute.func_name,

1200

attribute.func_defaults,

1201

attribute.func_closure)))

1736

attr[attrname] = (

1737

dbus_interface_annotations(alt_interface)

1738

(copy_function(attribute)))

1202

1739

if deprecate:

1203

1740

# Deprecate all alternate interfaces

1204

iname="_AlternateDBusNames_interface_annotation{0}"

1741

iname = "_AlternateDBusNames_interface_annotation{}"

1205

1742

for interface_name in interface_names:

1743

1206

1744

@dbus_interface_annotations(interface_name)

1207

1745

def func(self):

1208

return { "org.freedesktop.DBus.Deprecated":

1209

"true" }

1746

return {"org.freedesktop.DBus.Deprecated":

1747

"true"}

1210

1748

# Find an unused name

1211

1749

for aname in (iname.format(i)

1212

1750

for i in itertools.count()):

1216

1754

if interface_names:

1217

1755

# Replace the class with a new subclass of it with

1218

1756

# methods, signals, etc. as created above.

1219

cls = type(b"{0}Alternate".format(cls.__name__),

1220

(cls,), attr)

1757

if sys.version_info.major == 2:

1758

cls = type(b"{}Alternate".format(cls.__name__),

1759

(cls, ), attr)

1760

else:

1761

cls = type("{}Alternate".format(cls.__name__),

1762

(cls, ), attr)

1221

1763

return cls

1764

1222

1765

return wrapper

1223

1766

1224

1767

1225

1768

@alternate_dbus_interfaces({"se.recompile.Mandos":

1226

"se.bsnet.fukt.Mandos"})

1769

"se.bsnet.fukt.Mandos"})

1227

1770

class ClientDBus(Client, DBusObjectWithProperties):

1228

1771

"""A Client class using D-Bus

1229

1772

1230

1773

Attributes:

1231

1774

dbus_object_path: dbus.ObjectPath

1232

1775

bus: dbus.SystemBus()

1233

1776

"""

1234

1777

1235

1778

runtime_expansions = (Client.runtime_expansions

1236

+ ("dbus_object_path",))

1237

1779

+ ("dbus_object_path", ))

1780

1781

_interface = "se.recompile.Mandos.Client"

1782

1238

1783

# dbus.service.Object doesn't use super(), so we can't either.

1239

1240

def __init__(self, bus = None, *args, **kwargs):

1784

1785

def __init__(self, bus=None, *args, **kwargs):

1241

1786

self.bus = bus

1242

1787

Client.__init__(self, *args, **kwargs)

1243

1788

# Only now, when this client is initialized, can it show up on

1244

1789

# the D-Bus

1245

client_object_name = unicode(self.name).translate(

1790

client_object_name = str(self.name).translate(

1246

1791

{ord("."): ord("_"),

1247

1792

ord("-"): ord("_")})

1248

self.dbus_object_path = (dbus.ObjectPath

1249

("/clients/" + client_object_name))

1793

self.dbus_object_path = dbus.ObjectPath(

1794

"/clients/" + client_object_name)

1250

1795

DBusObjectWithProperties.__init__(self, self.bus,

1251

1796

self.dbus_object_path)

1252

1253

def notifychangeproperty(transform_func,

1254

dbus_name, type_func=lambda x: x,

1255

variant_level=1):

1797

1798

def notifychangeproperty(transform_func, dbus_name,

1799

type_func=lambda x: x,

1800

variant_level=1,

1801

invalidate_only=False,

1802

_interface=_interface):

1256

1803

""" Modify a variable so that it's a property which announces

1257

1804

its changes to DBus.

1258

1805

1259

1806

transform_fun: Function that takes a value and a variant_level

1260

1807

and transforms it to a D-Bus type.

1261

1808

dbus_name: D-Bus name of the variable

1263

1810

to the D-Bus. Default: no transform

1264

1811

variant_level: D-Bus variant level. Default: 1

1265

1812

"""

1266

attrname = "_{0}".format(dbus_name)

1813

attrname = "_{}".format(dbus_name)

1814

1267

1815

def setter(self, value):

1268

1816

if hasattr(self, "dbus_object_path"):

1269

1817

if (not hasattr(self, attrname) or

1270

1818

type_func(getattr(self, attrname, None))

1271

1819

!= type_func(value)):

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1275

self.PropertyChanged(dbus.String(dbus_name),

1276

dbus_value)

1820

if invalidate_only:

1821

self.PropertiesChanged(

1822

_interface, dbus.Dictionary(),

1823

dbus.Array((dbus_name, )))

1824

else:

1825

dbus_value = transform_func(

1826

type_func(value),

1827

variant_level=variant_level)

1828

self.PropertyChanged(dbus.String(dbus_name),

1829

dbus_value)

1830

self.PropertiesChanged(

1831

_interface,

1832

dbus.Dictionary({dbus.String(dbus_name):

1833

dbus_value}),

1834

dbus.Array())

1277

1835

setattr(self, attrname, value)

1278

1836

1279

1837

return property(lambda self: getattr(self, attrname), setter)

1280

1838

1281

1839

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1282

1840

approvals_pending = notifychangeproperty(dbus.Boolean,

1283

1841

"ApprovalPending",

1284

type_func = bool)

1842

type_func=bool)

1285

1843

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1286

1844

last_enabled = notifychangeproperty(datetime_to_dbus,

1287

1845

"LastEnabled")

1288

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1289

type_func = lambda checker:

1290

checker is not None)

1846

checker = notifychangeproperty(

1847

dbus.Boolean, "CheckerRunning",

1848

type_func=lambda checker: checker is not None)

1291

1849

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1292

1850

"LastCheckedOK")

1293

1851

last_checker_status = notifychangeproperty(dbus.Int16,

1296

1854

datetime_to_dbus, "LastApprovalRequest")

1297

1855

approved_by_default = notifychangeproperty(dbus.Boolean,

1298

1856

"ApprovedByDefault")

1299

approval_delay = notifychangeproperty(dbus.UInt64,

1300

"ApprovalDelay",

1301

type_func =

1302

timedelta_to_milliseconds)

1857

approval_delay = notifychangeproperty(

1858

dbus.UInt64, "ApprovalDelay",

1859

type_func=lambda td: td.total_seconds() * 1000)

1303

1860

approval_duration = notifychangeproperty(

1304

1861

dbus.UInt64, "ApprovalDuration",

1305

type_func = timedelta_to_milliseconds)

1862

type_func=lambda td: td.total_seconds() * 1000)

1306

1863

host = notifychangeproperty(dbus.String, "Host")

1307

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1308

type_func =

1309

timedelta_to_milliseconds)

1864

timeout = notifychangeproperty(

1865

dbus.UInt64, "Timeout",

1866

type_func=lambda td: td.total_seconds() * 1000)

1310

1867

extended_timeout = notifychangeproperty(

1311

1868

dbus.UInt64, "ExtendedTimeout",

1312

type_func = timedelta_to_milliseconds)

1313

interval = notifychangeproperty(dbus.UInt64,

1314

"Interval",

1315

type_func =

1316

timedelta_to_milliseconds)

1869

type_func=lambda td: td.total_seconds() * 1000)

1870

interval = notifychangeproperty(

1871

dbus.UInt64, "Interval",

1872

type_func=lambda td: td.total_seconds() * 1000)

1317

1873

checker_command = notifychangeproperty(dbus.String, "Checker")

1318

1874

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1875

invalidate_only=True)

1876

1319

1877

del notifychangeproperty

1320

1878

1321

1879

def __del__(self, *args, **kwargs):

1322

1880

try:

1323

1881

self.remove_from_connection()

1326

1884

if hasattr(DBusObjectWithProperties, "__del__"):

1327

1885

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1328

1886

Client.__del__(self, *args, **kwargs)

1329

1330

def checker_callback(self, pid, condition, command,

1331

*args, **kwargs):

1332

self.checker_callback_tag = None

1333

self.checker = None

1334

if os.WIFEXITED(condition):

1335

exitstatus = os.WEXITSTATUS(condition)

1887

1888

def checker_callback(self, source, condition,

1889

connection, command, *args, **kwargs):

1890

ret = Client.checker_callback(self, source, condition,

1891

connection, command, *args,

1892

**kwargs)

1893

exitstatus = self.last_checker_status

1894

if exitstatus >= 0:

1336

1895

# Emit D-Bus signal

1337

1896

self.CheckerCompleted(dbus.Int16(exitstatus),

1338

dbus.Int64(condition),

1897

# This is specific to GNU libC

1898

dbus.Int64(exitstatus << 8),

1339

1899

dbus.String(command))

1340

1900

else:

1341

1901

# Emit D-Bus signal

1342

1902

self.CheckerCompleted(dbus.Int16(-1),

1343

dbus.Int64(condition),

1903

dbus.Int64(

1904

# This is specific to GNU libC

1905

(exitstatus << 8)

1906

| self.last_checker_signal),

1344

1907

dbus.String(command))

1345

1346

return Client.checker_callback(self, pid, condition, command,

1347

*args, **kwargs)

1348

1908

return ret

1909

1349

1910

def start_checker(self, *args, **kwargs):

1350

old_checker = self.checker

1351

if self.checker is not None:

1352

old_checker_pid = self.checker.pid

1353

else:

1354

old_checker_pid = None

1911

old_checker_pid = getattr(self.checker, "pid", None)

1355

1912

r = Client.start_checker(self, *args, **kwargs)

1356

1913

# Only if new checker process was started

1357

1914

if (self.checker is not None

1359

1916

# Emit D-Bus signal

1360

1917

self.CheckerStarted(self.current_checker_command)

1361

1918

return r

1362

1919

1363

1920

def _reset_approved(self):

1364

1921

self.approved = None

1365

1922

return False

1366

1923

1367

1924

def approve(self, value=True):

1368

1925

self.approved = value

1369

gobject.timeout_add(timedelta_to_milliseconds

1370

(self.approval_duration),

1371

self._reset_approved)

1926

GLib.timeout_add(int(self.approval_duration.total_seconds()

1927

* 1000), self._reset_approved)

1372

1928

self.send_changedstate()

1373

1374

## D-Bus methods, signals & properties

1375

_interface = "se.recompile.Mandos.Client"

1376

1377

## Interfaces

1378

1379

@dbus_interface_annotations(_interface)

1380

def _foo(self):

1381

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1382

"false"}

1383

1384

## Signals

1385

1929

1930

# D-Bus methods, signals & properties

1931

1932

# Interfaces

1933

1934

# Signals

1935

1386

1936

# CheckerCompleted - signal

1387

1937

@dbus.service.signal(_interface, signature="nxs")

1388

1938

def CheckerCompleted(self, exitcode, waitstatus, command):

1389

1939

"D-Bus signal"

1390

1940

pass

1391

1941

1392

1942

# CheckerStarted - signal

1393

1943

@dbus.service.signal(_interface, signature="s")

1394

1944

def CheckerStarted(self, command):

1395

1945

"D-Bus signal"

1396

1946

pass

1397

1947

1398

1948

# PropertyChanged - signal

1949

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1399

1950

@dbus.service.signal(_interface, signature="sv")

1400

1951

def PropertyChanged(self, property, value):

1401

1952

"D-Bus signal"

1402

1953

pass

1403

1954

1404

1955

# GotSecret - signal

1405

1956

@dbus.service.signal(_interface)

1406

1957

def GotSecret(self):

1409

1960

server to mandos-client

1410

1961

"""

1411

1962

pass

1412

1963

1413

1964

# Rejected - signal

1414

1965

@dbus.service.signal(_interface, signature="s")

1415

1966

def Rejected(self, reason):

1416

1967

"D-Bus signal"

1417

1968

pass

1418

1969

1419

1970

# NeedApproval - signal

1420

1971

@dbus.service.signal(_interface, signature="tb")

1421

1972

def NeedApproval(self, timeout, default):

1422

1973

"D-Bus signal"

1423

1974

return self.need_approval()

1424

1425

## Methods

1426

1975

1976

# Methods

1977

1427

1978

# Approve - method

1428

1979

@dbus.service.method(_interface, in_signature="b")

1429

1980

def Approve(self, value):

1430

1981

self.approve(value)

1431

1982

1432

1983

# CheckedOK - method

1433

1984

@dbus.service.method(_interface)

1434

1985

def CheckedOK(self):

1435

1986

self.checked_ok()

1436

1987

1437

1988

# Enable - method

1989

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1438

1990

@dbus.service.method(_interface)

1439

1991

def Enable(self):

1440

1992

"D-Bus method"

1441

1993

self.enable()

1442

1994

1443

1995

# StartChecker - method

1996

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1444

1997

@dbus.service.method(_interface)

1445

1998

def StartChecker(self):

1446

1999

"D-Bus method"

1447

2000

self.start_checker()

1448

2001

1449

2002

# Disable - method

2003

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1450

2004

@dbus.service.method(_interface)

1451

2005

def Disable(self):

1452

2006

"D-Bus method"

1453

2007

self.disable()

1454

2008

1455

2009

# StopChecker - method

2010

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1456

2011

@dbus.service.method(_interface)

1457

2012

def StopChecker(self):

1458

2013

self.stop_checker()

1459

1460

## Properties

1461

2014

2015

# Properties

2016

1462

2017

# ApprovalPending - property

1463

2018

@dbus_service_property(_interface, signature="b", access="read")

1464

2019

def ApprovalPending_dbus_property(self):

1465

2020

return dbus.Boolean(bool(self.approvals_pending))

1466

2021

1467

2022

# ApprovedByDefault - property

1468

@dbus_service_property(_interface, signature="b",

2023

@dbus_service_property(_interface,

2024

signature="b",

1469

2025

access="readwrite")

1470

2026

def ApprovedByDefault_dbus_property(self, value=None):

1471

2027

if value is None: # get

1472

2028

return dbus.Boolean(self.approved_by_default)

1473

2029

self.approved_by_default = bool(value)

1474

2030

1475

2031

# ApprovalDelay - property

1476

@dbus_service_property(_interface, signature="t",

2032

@dbus_service_property(_interface,

2033

signature="t",

1477

2034

access="readwrite")

1478

2035

def ApprovalDelay_dbus_property(self, value=None):

1479

2036

if value is None: # get

1480

return dbus.UInt64(self.approval_delay_milliseconds())

2037

return dbus.UInt64(self.approval_delay.total_seconds()

2038

* 1000)

1481

2039

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1482

2040

1483

2041

# ApprovalDuration - property

1484

@dbus_service_property(_interface, signature="t",

2042

@dbus_service_property(_interface,

2043

signature="t",

1485

2044

access="readwrite")

1486

2045

def ApprovalDuration_dbus_property(self, value=None):

1487

2046

if value is None: # get

1488

return dbus.UInt64(timedelta_to_milliseconds(

1489

self.approval_duration))

2047

return dbus.UInt64(self.approval_duration.total_seconds()

2048

* 1000)

1490

2049

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1491

2050

1492

2051

# Name - property

2052

@dbus_annotations(

2053

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1493

2054

@dbus_service_property(_interface, signature="s", access="read")

1494

2055

def Name_dbus_property(self):

1495

2056

return dbus.String(self.name)

1496

2057

2058

# KeyID - property

2059

@dbus_annotations(

2060

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2061

@dbus_service_property(_interface, signature="s", access="read")

2062

def KeyID_dbus_property(self):

2063

return dbus.String(self.key_id)

2064

1497

2065

# Fingerprint - property

2066

@dbus_annotations(

2067

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1498

2068

@dbus_service_property(_interface, signature="s", access="read")

1499

2069

def Fingerprint_dbus_property(self):

1500

2070

return dbus.String(self.fingerprint)

1501

2071

1502

2072

# Host - property

1503

@dbus_service_property(_interface, signature="s",

2073

@dbus_service_property(_interface,

2074

signature="s",

1504

2075

access="readwrite")

1505

2076

def Host_dbus_property(self, value=None):

1506

2077

if value is None: # get

1507

2078

return dbus.String(self.host)

1508

self.host = unicode(value)

1509

2079

self.host = str(value)

2080

1510

2081

# Created - property

2082

@dbus_annotations(

2083

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1511

2084

@dbus_service_property(_interface, signature="s", access="read")

1512

2085

def Created_dbus_property(self):

1513

2086

return datetime_to_dbus(self.created)

1514

2087

1515

2088

# LastEnabled - property

1516

2089

@dbus_service_property(_interface, signature="s", access="read")

1517

2090

def LastEnabled_dbus_property(self):

1518

2091

return datetime_to_dbus(self.last_enabled)

1519

2092

1520

2093

# Enabled - property

1521

@dbus_service_property(_interface, signature="b",

2094

@dbus_service_property(_interface,

2095

signature="b",

1522

2096

access="readwrite")

1523

2097

def Enabled_dbus_property(self, value=None):

1524

2098

if value is None: # get

1527

2101

self.enable()

1528

2102

else:

1529

2103

self.disable()

1530

2104

1531

2105

# LastCheckedOK - property

1532

@dbus_service_property(_interface, signature="s",

2106

@dbus_service_property(_interface,

2107

signature="s",

1533

2108

access="readwrite")

1534

2109

def LastCheckedOK_dbus_property(self, value=None):

1535

2110

if value is not None:

1536

2111

self.checked_ok()

1537

2112

return

1538

2113

return datetime_to_dbus(self.last_checked_ok)

1539

2114

1540

2115

# LastCheckerStatus - property

1541

@dbus_service_property(_interface, signature="n",

1542

access="read")

2116

@dbus_service_property(_interface, signature="n", access="read")

1543

2117

def LastCheckerStatus_dbus_property(self):

1544

2118

return dbus.Int16(self.last_checker_status)

1545

2119

1546

2120

# Expires - property

1547

2121

@dbus_service_property(_interface, signature="s", access="read")

1548

2122

def Expires_dbus_property(self):

1549

2123

return datetime_to_dbus(self.expires)

1550

2124

1551

2125

# LastApprovalRequest - property

1552

2126

@dbus_service_property(_interface, signature="s", access="read")

1553

2127

def LastApprovalRequest_dbus_property(self):

1554

2128

return datetime_to_dbus(self.last_approval_request)

1555

2129

1556

2130

# Timeout - property

1557

@dbus_service_property(_interface, signature="t",

2131

@dbus_service_property(_interface,

2132

signature="t",

1558

2133

access="readwrite")

1559

2134

def Timeout_dbus_property(self, value=None):

1560

2135

if value is None: # get

1561

return dbus.UInt64(self.timeout_milliseconds())

2136

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

2137

old_timeout = self.timeout

1563

2138

self.timeout = datetime.timedelta(0, 0, 0, value)

1564

2139

# Reschedule disabling

1572

2147

if (getattr(self, "disable_initiator_tag", None)

1573

2148

is None):

1574

2149

return

1575

gobject.source_remove(self.disable_initiator_tag)

1576

self.disable_initiator_tag = (

1577

gobject.timeout_add(

1578

timedelta_to_milliseconds(self.expires - now),

1579

self.disable))

1580

2150

GLib.source_remove(self.disable_initiator_tag)

2151

self.disable_initiator_tag = GLib.timeout_add(

2152

int((self.expires - now).total_seconds() * 1000),

2153

self.disable)

2154

1581

2155

# ExtendedTimeout - property

1582

@dbus_service_property(_interface, signature="t",

2156

@dbus_service_property(_interface,

2157

signature="t",

1583

2158

access="readwrite")

1584

2159

def ExtendedTimeout_dbus_property(self, value=None):

1585

2160

if value is None: # get

1586

return dbus.UInt64(self.extended_timeout_milliseconds())

2161

return dbus.UInt64(self.extended_timeout.total_seconds()

2162

* 1000)

1587

2163

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1588

2164

1589

2165

# Interval - property

1590

@dbus_service_property(_interface, signature="t",

2166

@dbus_service_property(_interface,

2167

signature="t",

1591

2168

access="readwrite")

1592

2169

def Interval_dbus_property(self, value=None):

1593

2170

if value is None: # get

1594

return dbus.UInt64(self.interval_milliseconds())

2171

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

2172

self.interval = datetime.timedelta(0, 0, 0, value)

1596

2173

if getattr(self, "checker_initiator_tag", None) is None:

1597

2174

return

1598

2175

if self.enabled:

1599

2176

# Reschedule checker run

1600

gobject.source_remove(self.checker_initiator_tag)

1601

self.checker_initiator_tag = (gobject.timeout_add

1602

(value, self.start_checker))

1603

self.start_checker() # Start one now, too

1604

2177

GLib.source_remove(self.checker_initiator_tag)

2178

self.checker_initiator_tag = GLib.timeout_add(

2179

value, self.start_checker)

2180

self.start_checker() # Start one now, too

2181

1605

2182

# Checker - property

1606

@dbus_service_property(_interface, signature="s",

2183

@dbus_service_property(_interface,

2184

signature="s",

1607

2185

access="readwrite")

1608

2186

def Checker_dbus_property(self, value=None):

1609

2187

if value is None: # get

1610

2188

return dbus.String(self.checker_command)

1611

self.checker_command = unicode(value)

1612

2189

self.checker_command = str(value)

2190

1613

2191

# CheckerRunning - property

1614

@dbus_service_property(_interface, signature="b",

2192

@dbus_service_property(_interface,

2193

signature="b",

1615

2194

access="readwrite")

1616

2195

def CheckerRunning_dbus_property(self, value=None):

1617

2196

if value is None: # get

1620

2199

self.start_checker()

1621

2200

else:

1622

2201

self.stop_checker()

1623

2202

1624

2203

# ObjectPath - property

2204

@dbus_annotations(

2205

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2206

"org.freedesktop.DBus.Deprecated": "true"})

1625

2207

@dbus_service_property(_interface, signature="o", access="read")

1626

2208

def ObjectPath_dbus_property(self):

1627

return self.dbus_object_path # is already a dbus.ObjectPath

1628

2209

return self.dbus_object_path # is already a dbus.ObjectPath

2210

1629

2211

# Secret = property

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

2212

@dbus_annotations(

2213

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2214

"invalidates"})

2215

@dbus_service_property(_interface,

2216

signature="ay",

2217

access="write",

2218

byte_arrays=True)

1632

2219

def Secret_dbus_property(self, value):

1633

self.secret = str(value)

1634

2220

self.secret = bytes(value)

2221

1635

2222

del _interface

1636

2223

1637

2224

1638

class ProxyClient(object):

1639

def __init__(self, child_pipe, fpr, address):

2225

class ProxyClient:

2226

def __init__(self, child_pipe, key_id, fpr, address):

1640

2227

self._pipe = child_pipe

1641

self._pipe.send(('init', fpr, address))

2228

self._pipe.send(('init', key_id, fpr, address))

1642

2229

if not self._pipe.recv():

1643

raise KeyError()

1644

2230

raise KeyError(key_id or fpr)

2231

1645

2232

def __getattribute__(self, name):

1646

2233

if name == '_pipe':

1647

2234

return super(ProxyClient, self).__getattribute__(name)

1650

2237

if data[0] == 'data':

1651

2238

return data[1]

1652

2239

if data[0] == 'function':

2240

1653

2241

def func(*args, **kwargs):

1654

2242

self._pipe.send(('funcall', name, args, kwargs))

1655

2243

return self._pipe.recv()[1]

2244

1656

2245

return func

1657

2246

1658

2247

def __setattr__(self, name, value):

1659

2248

if name == '_pipe':

1660

2249

return super(ProxyClient, self).__setattr__(name, value)

1663

2252

1664

2253

class ClientHandler(socketserver.BaseRequestHandler, object):

1665

2254

"""A class to handle client connections.

1666

2255

1667

2256

Instantiated once for each connection to handle it.

1668

2257

Note: This will run in its own forked process."""

1669

2258

1670

2259

def handle(self):

1671

2260

with contextlib.closing(self.server.child_pipe) as child_pipe:

1672

2261

logger.info("TCP connection from: %s",

1673

unicode(self.client_address))

2262

str(self.client_address))

1674

2263

logger.debug("Pipe FD: %d",

1675

2264

self.server.child_pipe.fileno())

1676

1677

session = (gnutls.connection

1678

.ClientSession(self.request,

1679

gnutls.connection

1680

.X509Credentials()))

1681

1682

# Note: gnutls.connection.X509Credentials is really a

1683

# generic GnuTLS certificate credentials object so long as

1684

# no X.509 keys are added to it. Therefore, we can use it

1685

# here despite using OpenPGP certificates.

1686

1687

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1688

# "+AES-256-CBC", "+SHA1",

1689

# "+COMP-NULL", "+CTYPE-OPENPGP",

1690

# "+DHE-DSS"))

2265

2266

session = gnutls.ClientSession(self.request)

2267

2268

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2269

# "+AES-256-CBC", "+SHA1",

2270

# "+COMP-NULL", "+CTYPE-OPENPGP",

2271

# "+DHE-DSS"))

1691

2272

# Use a fallback default, since this MUST be set.

1692

2273

priority = self.server.gnutls_priority

1693

2274

if priority is None:

1694

2275

priority = "NORMAL"

1695

(gnutls.library.functions

1696

.gnutls_priority_set_direct(session._c_object,

1697

priority, None))

1698

2276

gnutls.priority_set_direct(session._c_object,

2277

priority.encode("utf-8"),

2278

None)

2279

1699

2280

# Start communication using the Mandos protocol

1700

2281

# Get protocol number

1701

2282

line = self.request.makefile().readline()

1702

2283

logger.debug("Protocol version: %r", line)

1703

2284

try:

1704

2285

if int(line.strip().split()[0]) > 1:

1705

raise RuntimeError

2286

raise RuntimeError(line)

1706

2287

except (ValueError, IndexError, RuntimeError) as error:

1707

2288

logger.error("Unknown protocol version: %s", error)

1708

2289

return

1709

2290

1710

2291

# Start GnuTLS connection

1711

2292

try:

1712

2293

session.handshake()

1713

except gnutls.errors.GNUTLSError as error:

2294

except gnutls.Error as error:

1714

2295

logger.warning("Handshake failed: %s", error)

1715

2296

# Do not run session.bye() here: the session is not

1716

2297

# established. Just abandon the request.

1717

2298

return

1718

2299

logger.debug("Handshake succeeded")

1719

2300

1720

2301

approval_required = False

1721

2302

try:

1722

try:

1723

fpr = self.fingerprint(self.peer_certificate

1724

(session))

1725

except (TypeError,

1726

gnutls.errors.GNUTLSError) as error:

1727

logger.warning("Bad certificate: %s", error)

1728

return

1729

logger.debug("Fingerprint: %s", fpr)

1730

1731

try:

1732

client = ProxyClient(child_pipe, fpr,

2303

if gnutls.has_rawpk:

2304

fpr = b""

2305

try:

2306

key_id = self.key_id(

2307

self.peer_certificate(session))

2308

except (TypeError, gnutls.Error) as error:

2309

logger.warning("Bad certificate: %s", error)

2310

return

2311

logger.debug("Key ID: %s", key_id)

2312

2313

else:

2314

key_id = b""

2315

try:

2316

fpr = self.fingerprint(

2317

self.peer_certificate(session))

2318

except (TypeError, gnutls.Error) as error:

2319

logger.warning("Bad certificate: %s", error)

2320

return

2321

logger.debug("Fingerprint: %s", fpr)

2322

2323

try:

2324

client = ProxyClient(child_pipe, key_id, fpr,

1733

2325

self.client_address)

1734

2326

except KeyError:

1735

2327

return

1736

2328

1737

2329

if client.approval_delay:

1738

2330

delay = client.approval_delay

1739

2331

client.approvals_pending += 1

1740

2332

approval_required = True

1741

2333

1742

2334

while True:

1743

2335

if not client.enabled:

1744

2336

logger.info("Client %s is disabled",

1745

client.name)

2337

client.name)

1746

2338

if self.server.use_dbus:

1747

2339

# Emit D-Bus signal

1748

2340

client.Rejected("Disabled")

1749

2341

return

1750

2342

1751

2343

if client.approved or not client.approval_delay:

1752

#We are approved or approval is disabled

2344

# We are approved or approval is disabled

1753

2345

break

1754

2346

elif client.approved is None:

1755

2347

logger.info("Client %s needs approval",

1757

2349

if self.server.use_dbus:

1758

2350

# Emit D-Bus signal

1759

2351

client.NeedApproval(

1760

client.approval_delay_milliseconds(),

1761

client.approved_by_default)

2352

client.approval_delay.total_seconds()

2353

* 1000, client.approved_by_default)

1762

2354

else:

1763

2355

logger.warning("Client %s was not approved",

1764

2356

client.name)

1766

2358

# Emit D-Bus signal

1767

2359

client.Rejected("Denied")

1768

2360

return

1769

1770

#wait until timeout or approved

2361

2362

# wait until timeout or approved

1771

2363

time = datetime.datetime.now()

1772

2364

client.changedstate.acquire()

1773

client.changedstate.wait(

1774

float(timedelta_to_milliseconds(delay)

1775

/ 1000))

2365

client.changedstate.wait(delay.total_seconds())

1776

2366

client.changedstate.release()

1777

2367

time2 = datetime.datetime.now()

1778

2368

if (time2 - time) >= delay:

1788

2378

break

1789

2379

else:

1790

2380

delay -= time2 - time

1791

1792

sent_size = 0

1793

while sent_size < len(client.secret):

1794

try:

1795

sent = session.send(client.secret[sent_size:])

1796

except gnutls.errors.GNUTLSError as error:

1797

logger.warning("gnutls send failed",

1798

exc_info=error)

1799

return

1800

logger.debug("Sent: %d, remaining: %d",

1801

sent, len(client.secret)

1802

- (sent_size + sent))

1803

sent_size += sent

1804

2381

2382

try:

2383

session.send(client.secret)

2384

except gnutls.Error as error:

2385

logger.warning("gnutls send failed",

2386

exc_info=error)

2387

return

2388

1805

2389

logger.info("Sending secret to %s", client.name)

1806

2390

# bump the timeout using extended_timeout

1807

2391

client.bump_timeout(client.extended_timeout)

1808

2392

if self.server.use_dbus:

1809

2393

# Emit D-Bus signal

1810

2394

client.GotSecret()

1811

2395

1812

2396

finally:

1813

2397

if approval_required:

1814

2398

client.approvals_pending -= 1

1815

2399

try:

1816

2400

session.bye()

1817

except gnutls.errors.GNUTLSError as error:

2401

except gnutls.Error as error:

1818

2402

logger.warning("GnuTLS bye failed",

1819

2403

exc_info=error)

1820

2404

1821

2405

@staticmethod

1822

2406

def peer_certificate(session):

1823

"Return the peer's OpenPGP certificate as a bytestring"

1824

# If not an OpenPGP certificate...

1825

if (gnutls.library.functions

1826

.gnutls_certificate_type_get(session._c_object)

1827

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1828

# ...do the normal thing

1829

return session.peer_certificate

2407

"Return the peer's certificate as a bytestring"

2408

try:

2409

cert_type = gnutls.certificate_type_get2(session._c_object,

2410

gnutls.CTYPE_PEERS)

2411

except AttributeError:

2412

cert_type = gnutls.certificate_type_get(session._c_object)

2413

if gnutls.has_rawpk:

2414

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2415

else:

2416

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2417

# If not a valid certificate type...

2418

if cert_type not in valid_cert_types:

2419

logger.info("Cert type %r not in %r", cert_type,

2420

valid_cert_types)

2421

# ...return invalid data

2422

return b""

1830

2423

list_size = ctypes.c_uint(1)

1831

cert_list = (gnutls.library.functions

1832

.gnutls_certificate_get_peers

2424

cert_list = (gnutls.certificate_get_peers

1833

2425

(session._c_object, ctypes.byref(list_size)))

1834

2426

if not bool(cert_list) and list_size.value != 0:

1835

raise gnutls.errors.GNUTLSError("error getting peer"

1836

" certificate")

2427

raise gnutls.Error("error getting peer certificate")

1837

2428

if list_size.value == 0:

1838

2429

return None

1839

2430

cert = cert_list[0]

1840

2431

return ctypes.string_at(cert.data, cert.size)

1841

2432

2433

@staticmethod

2434

def key_id(certificate):

2435

"Convert a certificate bytestring to a hexdigit key ID"

2436

# New GnuTLS "datum" with the public key

2437

datum = gnutls.datum_t(

2438

ctypes.cast(ctypes.c_char_p(certificate),

2439

ctypes.POINTER(ctypes.c_ubyte)),

2440

ctypes.c_uint(len(certificate)))

2441

# XXX all these need to be created in the gnutls "module"

2442

# New empty GnuTLS certificate

2443

pubkey = gnutls.pubkey_t()

2444

gnutls.pubkey_init(ctypes.byref(pubkey))

2445

# Import the raw public key into the certificate

2446

gnutls.pubkey_import(pubkey,

2447

ctypes.byref(datum),

2448

gnutls.X509_FMT_DER)

2449

# New buffer for the key ID

2450

buf = ctypes.create_string_buffer(32)

2451

buf_len = ctypes.c_size_t(len(buf))

2452

# Get the key ID from the raw public key into the buffer

2453

gnutls.pubkey_get_key_id(pubkey,

2454

gnutls.KEYID_USE_SHA256,

2455

ctypes.cast(ctypes.byref(buf),

2456

ctypes.POINTER(ctypes.c_ubyte)),

2457

ctypes.byref(buf_len))

2458

# Deinit the certificate

2459

gnutls.pubkey_deinit(pubkey)

2460

2461

# Convert the buffer to a Python bytestring

2462

key_id = ctypes.string_at(buf, buf_len.value)

2463

# Convert the bytestring to hexadecimal notation

2464

hex_key_id = binascii.hexlify(key_id).upper()

2465

return hex_key_id

2466

1842

2467

@staticmethod

1843

2468

def fingerprint(openpgp):

1844

2469

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1845

2470

# New GnuTLS "datum" with the OpenPGP public key

1846

datum = (gnutls.library.types

1847

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1848

ctypes.POINTER

1849

(ctypes.c_ubyte)),

1850

ctypes.c_uint(len(openpgp))))

2471

datum = gnutls.datum_t(

2472

ctypes.cast(ctypes.c_char_p(openpgp),

2473

ctypes.POINTER(ctypes.c_ubyte)),

2474

ctypes.c_uint(len(openpgp)))

1851

2475

# New empty GnuTLS certificate

1852

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1853

(gnutls.library.functions

1854

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2476

crt = gnutls.openpgp_crt_t()

2477

gnutls.openpgp_crt_init(ctypes.byref(crt))

1855

2478

# Import the OpenPGP public key into the certificate

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1858

gnutls.library.constants

1859

.GNUTLS_OPENPGP_FMT_RAW))

2479

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2480

gnutls.OPENPGP_FMT_RAW)

1860

2481

# Verify the self signature in the key

1861

2482

crtverify = ctypes.c_uint()

1862

(gnutls.library.functions

1863

.gnutls_openpgp_crt_verify_self(crt, 0,

1864

ctypes.byref(crtverify)))

2483

gnutls.openpgp_crt_verify_self(crt, 0,

2484

ctypes.byref(crtverify))

1865

2485

if crtverify.value != 0:

1866

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1867

raise (gnutls.errors.CertificateSecurityError

1868

("Verify failed"))

2486

gnutls.openpgp_crt_deinit(crt)

2487

raise gnutls.CertificateSecurityError(code

2488

=crtverify.value)

1869

2489

# New buffer for the fingerprint

1870

2490

buf = ctypes.create_string_buffer(20)

1871

2491

buf_len = ctypes.c_size_t()

1872

2492

# Get the fingerprint from the certificate into the buffer

1873

(gnutls.library.functions

1874

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1875

ctypes.byref(buf_len)))

2493

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2494

ctypes.byref(buf_len))

1876

2495

# Deinit the certificate

1877

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2496

gnutls.openpgp_crt_deinit(crt)

1878

2497

# Convert the buffer to a Python bytestring

1879

2498

fpr = ctypes.string_at(buf, buf_len.value)

1880

2499

# Convert the bytestring to hexadecimal notation

1882

2501

return hex_fpr

1883

2502

1884

2503

1885

class MultiprocessingMixIn(object):

2504

class MultiprocessingMixIn:

1886

2505

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2506

1887

2507

def sub_process_main(self, request, address):

1888

2508

try:

1889

2509

self.finish_request(request, address)

1890

2510

except Exception:

1891

2511

self.handle_error(request, address)

1892

2512

self.close_request(request)

1893

2513

1894

2514

def process_request(self, request, address):

1895

2515

"""Start a new process to process the request."""

1896

proc = multiprocessing.Process(target = self.sub_process_main,

1897

args = (request, address))

2516

proc = multiprocessing.Process(target=self.sub_process_main,

2517

args=(request, address))

1898

2518

proc.start()

1899

2519

return proc

1900

2520

1901

2521

1902

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2522

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1903

2523

""" adds a pipe to the MixIn """

2524

1904

2525

def process_request(self, request, client_address):

1905

2526

"""Overrides and wraps the original process_request().

1906

2527

1907

2528

This function creates a new pipe in self.pipe

1908

2529

"""

1909

2530

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1910

2531

1911

2532

proc = MultiprocessingMixIn.process_request(self, request,

1912

2533

client_address)

1913

2534

self.child_pipe.close()

1914

2535

self.add_pipe(parent_pipe, proc)

1915

2536

1916

2537

def add_pipe(self, parent_pipe, proc):

1917

2538

"""Dummy function; override as necessary"""

1918

raise NotImplementedError

2539

raise NotImplementedError()

1919

2540

1920

2541

1921

2542

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1922

socketserver.TCPServer, object):

2543

socketserver.TCPServer):

1923

2544

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1924

2545

1925

2546

Attributes:

1926

2547

enabled: Boolean; whether this server is activated yet

1927

2548

interface: None or a network interface name (string)

1928

2549

use_ipv6: Boolean; to use IPv6 or not

1929

2550

"""

2551

1930

2552

def __init__(self, server_address, RequestHandlerClass,

1931

interface=None, use_ipv6=True, socketfd=None):

2553

interface=None,

2554

use_ipv6=True,

2555

socketfd=None):

1932

2556

"""If socketfd is set, use that file descriptor instead of

1933

2557

creating a new one with socket.socket().

1934

2558

"""

1940

2564

self.socketfd = socketfd

1941

2565

# Save the original socket.socket() function

1942

2566

self.socket_socket = socket.socket

2567

1943

2568

# To implement --socket, we monkey patch socket.socket.

1944

#

2569

#

1945

2570

# (When socketserver.TCPServer is a new-style class, we

1946

2571

# could make self.socket into a property instead of monkey

1947

2572

# patching socket.socket.)

1948

#

2573

#

1949

2574

# Create a one-time-only replacement for socket.socket()

1950

2575

@functools.wraps(socket.socket)

1951

2576

def socket_wrapper(*args, **kwargs):

1963

2588

# socket_wrapper(), if socketfd was set.

1964

2589

socketserver.TCPServer.__init__(self, server_address,

1965

2590

RequestHandlerClass)

1966

2591

1967

2592

def server_bind(self):

1968

2593

"""This overrides the normal server_bind() function

1969

2594

to bind to an interface if one was specified, and also NOT to

1970

2595

bind to an address or port if they were not specified."""

2596

global SO_BINDTODEVICE

1971

2597

if self.interface is not None:

1972

2598

if SO_BINDTODEVICE is None:

1973

logger.error("SO_BINDTODEVICE does not exist;"

1974

" cannot bind to interface %s",

1975

self.interface)

1976

else:

1977

try:

1978

self.socket.setsockopt(socket.SOL_SOCKET,

1979

SO_BINDTODEVICE,

1980

str(self.interface + '\0'))

1981

except socket.error as error:

1982

if error.errno == errno.EPERM:

1983

logger.error("No permission to bind to"

1984

" interface %s", self.interface)

1985

elif error.errno == errno.ENOPROTOOPT:

1986

logger.error("SO_BINDTODEVICE not available;"

1987

" cannot bind to interface %s",

1988

self.interface)

1989

elif error.errno == errno.ENODEV:

1990

logger.error("Interface %s does not exist,"

1991

" cannot bind", self.interface)

1992

else:

1993

raise

2599

# Fall back to a hard-coded value which seems to be

2600

# common enough.

2601

logger.warning("SO_BINDTODEVICE not found, trying 25")

2602

SO_BINDTODEVICE = 25

2603

try:

2604

self.socket.setsockopt(

2605

socket.SOL_SOCKET, SO_BINDTODEVICE,

2606

(self.interface + "\0").encode("utf-8"))

2607

except socket.error as error:

2608

if error.errno == errno.EPERM:

2609

logger.error("No permission to bind to"

2610

" interface %s", self.interface)

2611

elif error.errno == errno.ENOPROTOOPT:

2612

logger.error("SO_BINDTODEVICE not available;"

2613

" cannot bind to interface %s",

2614

self.interface)

2615

elif error.errno == errno.ENODEV:

2616

logger.error("Interface %s does not exist,"

2617

" cannot bind", self.interface)

2618

else:

2619

raise

1994

2620

# Only bind(2) the socket if we really need to.

1995

2621

if self.server_address[0] or self.server_address[1]:

2622

if self.server_address[1]:

2623

self.allow_reuse_address = True

1996

2624

if not self.server_address[0]:

1997

2625

if self.address_family == socket.AF_INET6:

1998

any_address = "::" # in6addr_any

2626

any_address = "::" # in6addr_any

1999

2627

else:

2000

any_address = "0.0.0.0" # INADDR_ANY

2628

any_address = "0.0.0.0" # INADDR_ANY

2001

2629

self.server_address = (any_address,

2002

2630

self.server_address[1])

2003

2631

elif not self.server_address[1]:

2004

self.server_address = (self.server_address[0],

2005

0)

2632

self.server_address = (self.server_address[0], 0)

2006

2633

# if self.interface:

2007

2634

# self.server_address = (self.server_address[0],

2008

2635

# 0, # port

2014

2641

2015

2642

class MandosServer(IPv6_TCPServer):

2016

2643

"""Mandos server.

2017

2644

2018

2645

Attributes:

2019

2646

clients: set of Client objects

2020

2647

gnutls_priority GnuTLS priority string

2021

2648

use_dbus: Boolean; to emit D-Bus signals or not

2022

2023

Assumes a gobject.MainLoop event loop.

2649

2650

Assumes a GLib.MainLoop event loop.

2024

2651

"""

2652

2025

2653

def __init__(self, server_address, RequestHandlerClass,

2026

interface=None, use_ipv6=True, clients=None,

2027

gnutls_priority=None, use_dbus=True, socketfd=None):

2654

interface=None,

2655

use_ipv6=True,

2656

clients=None,

2657

gnutls_priority=None,

2658

use_dbus=True,

2659

socketfd=None):

2028

2660

self.enabled = False

2029

2661

self.clients = clients

2030

2662

if self.clients is None:

2033

2665

self.gnutls_priority = gnutls_priority

2034

2666

IPv6_TCPServer.__init__(self, server_address,

2035

2667

RequestHandlerClass,

2036

interface = interface,

2037

use_ipv6 = use_ipv6,

2038

socketfd = socketfd)

2668

interface=interface,

2669

use_ipv6=use_ipv6,

2670

socketfd=socketfd)

2671

2039

2672

def server_activate(self):

2040

2673

if self.enabled:

2041

2674

return socketserver.TCPServer.server_activate(self)

2042

2675

2043

2676

def enable(self):

2044

2677

self.enabled = True

2045

2678

2046

2679

def add_pipe(self, parent_pipe, proc):

2047

2680

# Call "handle_ipc" for both data and EOF events

2048

gobject.io_add_watch(parent_pipe.fileno(),

2049

gobject.IO_IN | gobject.IO_HUP,

2050

functools.partial(self.handle_ipc,

2051

parent_pipe =

2052

parent_pipe,

2053

proc = proc))

2054

2055

def handle_ipc(self, source, condition, parent_pipe=None,

2056

proc = None, client_object=None):

2681

GLib.io_add_watch(

2682

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2683

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2684

functools.partial(self.handle_ipc,

2685

parent_pipe=parent_pipe,

2686

proc=proc))

2687

2688

def handle_ipc(self, source, condition,

2689

parent_pipe=None,

2690

proc=None,

2691

client_object=None):

2057

2692

# error, or the other end of multiprocessing.Pipe has closed

2058

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2693

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2059

2694

# Wait for other process to exit

2060

2695

proc.join()

2061

2696

return False

2062

2697

2063

2698

# Read a request from the child

2064

2699

request = parent_pipe.recv()

2065

2700

command = request[0]

2066

2701

2067

2702

if command == 'init':

2068

fpr = request[1]

2069

address = request[2]

2070

2071

for c in self.clients.itervalues():

2072

if c.fingerprint == fpr:

2703

key_id = request[1].decode("ascii")

2704

fpr = request[2].decode("ascii")

2705

address = request[3]

2706

2707

for c in self.clients.values():

2708

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2709

continue

2710

if key_id and c.key_id == key_id:

2711

client = c

2712

break

2713

if fpr and c.fingerprint == fpr:

2073

2714

client = c

2074

2715

break

2075

2716

else:

2076

logger.info("Client not found for fingerprint: %s, ad"

2077

"dress: %s", fpr, address)

2717

logger.info("Client not found for key ID: %s, address"

2718

": %s", key_id or fpr, address)

2078

2719

if self.use_dbus:

2079

2720

# Emit D-Bus signal

2080

mandos_dbus_service.ClientNotFound(fpr,

2721

mandos_dbus_service.ClientNotFound(key_id or fpr,

2081

2722

address[0])

2082

2723

parent_pipe.send(False)

2083

2724

return False

2084

2085

gobject.io_add_watch(parent_pipe.fileno(),

2086

gobject.IO_IN | gobject.IO_HUP,

2087

functools.partial(self.handle_ipc,

2088

parent_pipe =

2089

parent_pipe,

2090

proc = proc,

2091

client_object =

2092

client))

2725

2726

GLib.io_add_watch(

2727

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2728

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2729

functools.partial(self.handle_ipc,

2730

parent_pipe=parent_pipe,

2731

proc=proc,

2732

client_object=client))

2093

2733

parent_pipe.send(True)

2094

2734

# remove the old hook in favor of the new above hook on

2095

2735

# same fileno

2098

2738

funcname = request[1]

2099

2739

args = request[2]

2100

2740

kwargs = request[3]

2101

2741

2102

2742

parent_pipe.send(('data', getattr(client_object,

2103

2743

funcname)(*args,

2104

**kwargs)))

2105

2744

**kwargs)))

2745

2106

2746

if command == 'getattr':

2107

2747

attrname = request[1]

2108

if callable(client_object.__getattribute__(attrname)):

2109

parent_pipe.send(('function',))

2748

if isinstance(client_object.__getattribute__(attrname),

2749

collections.Callable):

2750

parent_pipe.send(('function', ))

2110

2751

else:

2111

parent_pipe.send(('data', client_object

2112

.__getattribute__(attrname)))

2113

2752

parent_pipe.send((

2753

'data', client_object.__getattribute__(attrname)))

2754

2114

2755

if command == 'setattr':

2115

2756

attrname = request[1]

2116

2757

value = request[2]

2117

2758

setattr(client_object, attrname, value)

2118

2759

2119

2760

return True

2120

2761

2121

2762

2122

2763

def rfc3339_duration_to_delta(duration):

2123

2764

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2124

2125

>>> rfc3339_duration_to_delta("P7D")

2126

datetime.timedelta(7)

2127

>>> rfc3339_duration_to_delta("PT60S")

2128

datetime.timedelta(0, 60)

2129

>>> rfc3339_duration_to_delta("PT60M")

2130

datetime.timedelta(0, 3600)

2131

>>> rfc3339_duration_to_delta("PT24H")

2132

datetime.timedelta(1)

2133

>>> rfc3339_duration_to_delta("P1W")

2134

datetime.timedelta(7)

2135

>>> rfc3339_duration_to_delta("PT5M30S")

2136

datetime.timedelta(0, 330)

2137

>>> rfc3339_duration_to_delta("P1DT3M20S")

2138

datetime.timedelta(1, 200)

2765

2766

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2767

True

2768

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2771

True

2772

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2773

True

2774

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2775

True

2776

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2777

True

2778

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2779

True

2139

2780

"""

2140

2781

2141

2782

# Parsing an RFC 3339 duration with regular expressions is not

2142

2783

# possible - there would have to be multiple places for the same

2143

2784

# values, like seconds. The current code, while more esoteric, is

2144

2785

# cleaner without depending on a parsing library. If Python had a

2145

2786

# built-in library for parsing we would use it, but we'd like to

2146

2787

# avoid excessive use of external libraries.

2147

2788

2148

2789

# New type for defining tokens, syntax, and semantics all-in-one

2149

Token = collections.namedtuple("Token",

2150

("regexp", # To match token; if

2151

# "value" is not None,

2152

# must have a "group"

2153

# containing digits

2154

"value", # datetime.timedelta or

2155

# None

2156

"followers")) # Tokens valid after

2157

# this token

2790

Token = collections.namedtuple("Token", (

2791

"regexp", # To match token; if "value" is not None, must have

2792

# a "group" containing digits

2793

"value", # datetime.timedelta or None

2794

"followers")) # Tokens valid after this token

2158

2795

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2159

2796

# the "duration" ABNF definition in RFC 3339, Appendix A.

2160

2797

token_end = Token(re.compile(r"$"), None, frozenset())

2161

2798

token_second = Token(re.compile(r"(\d+)S"),

2162

2799

datetime.timedelta(seconds=1),

2163

frozenset((token_end,)))

2800

frozenset((token_end, )))

2164

2801

token_minute = Token(re.compile(r"(\d+)M"),

2165

2802

datetime.timedelta(minutes=1),

2166

2803

frozenset((token_second, token_end)))

2182

2819

frozenset((token_month, token_end)))

2183

2820

token_week = Token(re.compile(r"(\d+)W"),

2184

2821

datetime.timedelta(weeks=1),

2185

frozenset((token_end,)))

2822

frozenset((token_end, )))

2186

2823

token_duration = Token(re.compile(r"P"), None,

2187

2824

frozenset((token_year, token_month,

2188

2825

token_day, token_time,

2189

token_week))),

2190

# Define starting values

2191

value = datetime.timedelta() # Value so far

2826

token_week)))

2827

# Define starting values:

2828

# Value so far

2829

value = datetime.timedelta()

2192

2830

found_token = None

2193

followers = frozenset(token_duration,) # Following valid tokens

2194

s = duration # String left to parse

2831

# Following valid tokens

2832

followers = frozenset((token_duration, ))

2833

# String left to parse

2834

s = duration

2195

2835

# Loop until end token is found

2196

2836

while found_token is not token_end:

2197

2837

# Search for any currently valid tokens

2213

2853

break

2214

2854

else:

2215

2855

# No currently valid tokens were found

2216

raise ValueError("Invalid RFC 3339 duration")

2856

raise ValueError("Invalid RFC 3339 duration: {!r}"

2857

.format(duration))

2217

2858

# End token found

2218

2859

return value

2219

2860

2220

2861

2221

2862

def string_to_delta(interval):

2222

2863

"""Parse a string and return a datetime.timedelta

2223

2224

>>> string_to_delta('7d')

2225

datetime.timedelta(7)

2226

>>> string_to_delta('60s')

2227

datetime.timedelta(0, 60)

2228

>>> string_to_delta('60m')

2229

datetime.timedelta(0, 3600)

2230

>>> string_to_delta('24h')

2231

datetime.timedelta(1)

2232

>>> string_to_delta('1w')

2233

datetime.timedelta(7)

2234

>>> string_to_delta('5m 30s')

2235

datetime.timedelta(0, 330)

2864

2865

>>> string_to_delta('7d') == datetime.timedelta(7)

2866

True

2867

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2868

True

2869

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2870

True

2871

>>> string_to_delta('24h') == datetime.timedelta(1)

2872

True

2873

>>> string_to_delta('1w') == datetime.timedelta(7)

2874

True

2875

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2876

True

2236

2877

"""

2237

2878

2238

2879

try:

2239

2880

return rfc3339_duration_to_delta(interval)

2240

2881

except ValueError:

2241

2882

pass

2242

2883

2243

2884

timevalue = datetime.timedelta(0)

2244

2885

for s in interval.split():

2245

2886

try:

2246

suffix = unicode(s[-1])

2887

suffix = s[-1]

2247

2888

value = int(s[:-1])

2248

2889

if suffix == "d":

2249

2890

delta = datetime.timedelta(value)

2256

2897

elif suffix == "w":

2257

2898

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2258

2899

else:

2259

raise ValueError("Unknown suffix {0!r}"

2260

.format(suffix))

2261

except (ValueError, IndexError) as e:

2900

raise ValueError("Unknown suffix {!r}".format(suffix))

2901

except IndexError as e:

2262

2902

raise ValueError(*(e.args))

2263

2903

timevalue += delta

2264

2904

return timevalue

2265

2905

2266

2906

2267

def daemon(nochdir = False, noclose = False):

2907

def daemon(nochdir=False, noclose=False):

2268

2908

"""See daemon(3). Standard BSD Unix function.

2269

2909

2270

2910

This should really exist as os.daemon, but it doesn't (yet)."""

2271

2911

if os.fork():

2272

2912

sys.exit()

2280

2920

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2281

2921

if not stat.S_ISCHR(os.fstat(null).st_mode):

2282

2922

raise OSError(errno.ENODEV,

2283

"{0} not a character device"

2923

"{} not a character device"

2284

2924

.format(os.devnull))

2285

2925

os.dup2(null, sys.stdin.fileno())

2286

2926

os.dup2(null, sys.stdout.fileno())

2290

2930

2291

2931

2292

2932

def main():

2293

2933

2294

2934

##################################################################

2295

2935

# Parsing of options, both command line and config file

2296

2936

2297

2937

parser = argparse.ArgumentParser()

2298

2938

parser.add_argument("-v", "--version", action="version",

2299

version = "%(prog)s {0}".format(version),

2939

version="%(prog)s {}".format(version),

2300

2940

help="show version number and exit")

2301

2941

parser.add_argument("-i", "--interface", metavar="IF",

2302

2942

help="Bind to interface IF")

2335

2975

help="Directory to save/restore state in")

2336

2976

parser.add_argument("--foreground", action="store_true",

2337

2977

help="Run in foreground", default=None)

2338

2978

parser.add_argument("--no-zeroconf", action="store_false",

2979

dest="zeroconf", help="Do not use Zeroconf",

2980

default=None)

2981

2339

2982

options = parser.parse_args()

2340

2341

if options.check:

2342

import doctest

2343

doctest.testmod()

2344

sys.exit()

2345

2983

2346

2984

# Default values for config file for server-global settings

2347

server_defaults = { "interface": "",

2348

"address": "",

2349

"port": "",

2350

"debug": "False",

2351

"priority":

2352

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2353

"servicename": "Mandos",

2354

"use_dbus": "True",

2355

"use_ipv6": "True",

2356

"debuglevel": "",

2357

"restore": "True",

2358

"socket": "",

2359

"statedir": "/var/lib/mandos",

2360

"foreground": "False",

2361

}

2362

2985

if gnutls.has_rawpk:

2986

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2987

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2988

else:

2989

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2990

":+SIGN-DSA-SHA256")

2991

server_defaults = {"interface": "",

2992

"address": "",

2993

"port": "",

2994

"debug": "False",

2995

"priority": priority,

2996

"servicename": "Mandos",

2997

"use_dbus": "True",

2998

"use_ipv6": "True",

2999

"debuglevel": "",

3000

"restore": "True",

3001

"socket": "",

3002

"statedir": "/var/lib/mandos",

3003

"foreground": "False",

3004

"zeroconf": "True",

3005

}

3006

del priority

3007

2363

3008

# Parse config file for server-global settings

2364

server_config = configparser.SafeConfigParser(server_defaults)

3009

server_config = configparser.ConfigParser(server_defaults)

2365

3010

del server_defaults

2366

server_config.read(os.path.join(options.configdir,

2367

"mandos.conf"))

2368

# Convert the SafeConfigParser object to a dict

3011

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3012

# Convert the ConfigParser object to a dict

2369

3013

server_settings = server_config.defaults()

2370

3014

# Use the appropriate methods on the non-string config options

2371

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3015

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3016

"foreground", "zeroconf"):

2372

3017

server_settings[option] = server_config.getboolean("DEFAULT",

2373

3018

option)

2374

3019

if server_settings["port"]:

2384

3029

server_settings["socket"] = os.dup(server_settings

2385

3030

["socket"])

2386

3031

del server_config

2387

3032

2388

3033

# Override the settings from the config file with command line

2389

3034

# options, if set.

2390

3035

for option in ("interface", "address", "port", "debug",

2391

"priority", "servicename", "configdir",

2392

"use_dbus", "use_ipv6", "debuglevel", "restore",

2393

"statedir", "socket", "foreground"):

3036

"priority", "servicename", "configdir", "use_dbus",

3037

"use_ipv6", "debuglevel", "restore", "statedir",

3038

"socket", "foreground", "zeroconf"):

2394

3039

value = getattr(options, option)

2395

3040

if value is not None:

2396

3041

server_settings[option] = value

2397

3042

del options

2398

3043

# Force all strings to be unicode

2399

3044

for option in server_settings.keys():

2400

if type(server_settings[option]) is str:

2401

server_settings[option] = unicode(server_settings[option])

3045

if isinstance(server_settings[option], bytes):

3046

server_settings[option] = (server_settings[option]

3047

.decode("utf-8"))

2402

3048

# Force all boolean options to be boolean

2403

3049

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2404

"foreground"):

3050

"foreground", "zeroconf"):

2405

3051

server_settings[option] = bool(server_settings[option])

2406

3052

# Debug implies foreground

2407

3053

if server_settings["debug"]:

2408

3054

server_settings["foreground"] = True

2409

3055

# Now we have our good server settings in "server_settings"

2410

3056

2411

3057

##################################################################

2412

3058

3059

if (not server_settings["zeroconf"]

3060

and not (server_settings["port"]

3061

or server_settings["socket"] != "")):

3062

parser.error("Needs port or socket to work without Zeroconf")

3063

2413

3064

# For convenience

2414

3065

debug = server_settings["debug"]

2415

3066

debuglevel = server_settings["debuglevel"]

2418

3069

stored_state_path = os.path.join(server_settings["statedir"],

2419

3070

stored_state_file)

2420

3071

foreground = server_settings["foreground"]

2421

3072

zeroconf = server_settings["zeroconf"]

3073

2422

3074

if debug:

2423

3075

initlogger(debug, logging.DEBUG)

2424

3076

else:

2427

3079

else:

2428

3080

level = getattr(logging, debuglevel.upper())

2429

3081

initlogger(debug, level)

2430

3082

2431

3083

if server_settings["servicename"] != "Mandos":

2432

syslogger.setFormatter(logging.Formatter

2433

('Mandos ({0}) [%(process)d]:'

2434

' %(levelname)s: %(message)s'

2435

.format(server_settings

2436

["servicename"])))

2437

3084

syslogger.setFormatter(

3085

logging.Formatter('Mandos ({}) [%(process)d]:'

3086

' %(levelname)s: %(message)s'.format(

3087

server_settings["servicename"])))

3088

2438

3089

# Parse config file with clients

2439

client_config = configparser.SafeConfigParser(Client

2440

.client_defaults)

3090

client_config = configparser.ConfigParser(Client.client_defaults)

2441

3091

client_config.read(os.path.join(server_settings["configdir"],

2442

3092

"clients.conf"))

2443

3093

2444

3094

global mandos_dbus_service

2445

3095

mandos_dbus_service = None

2446

2447

tcp_server = MandosServer((server_settings["address"],

2448

server_settings["port"]),

2449

ClientHandler,

2450

interface=(server_settings["interface"]

2451

or None),

2452

use_ipv6=use_ipv6,

2453

gnutls_priority=

2454

server_settings["priority"],

2455

use_dbus=use_dbus,

2456

socketfd=(server_settings["socket"]

2457

or None))

3096

3097

socketfd = None

3098

if server_settings["socket"] != "":

3099

socketfd = server_settings["socket"]

3100

tcp_server = MandosServer(

3101

(server_settings["address"], server_settings["port"]),

3102

ClientHandler,

3103

interface=(server_settings["interface"] or None),

3104

use_ipv6=use_ipv6,

3105

gnutls_priority=server_settings["priority"],

3106

use_dbus=use_dbus,

3107

socketfd=socketfd)

2458

3108

if not foreground:

2459

3109

pidfilename = "/run/mandos.pid"

2460

3110

if not os.path.isdir("/run/."):

2461

3111

pidfilename = "/var/run/mandos.pid"

2462

3112

pidfile = None

2463

3113

try:

2464

pidfile = open(pidfilename, "w")

3114

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2465

3115

except IOError as e:

2466

3116

logger.error("Could not open file %r", pidfilename,

2467

3117

exc_info=e)

2468

2469

for name in ("_mandos", "mandos", "nobody"):

3118

3119

for name, group in (("_mandos", "_mandos"),

3120

("mandos", "mandos"),

3121

("nobody", "nogroup")):

2470

3122

try:

2471

3123

uid = pwd.getpwnam(name).pw_uid

2472

gid = pwd.getpwnam(name).pw_gid

3124

gid = pwd.getpwnam(group).pw_gid

2473

3125

break

2474

3126

except KeyError:

2475

3127

continue

2479

3131

try:

2480

3132

os.setgid(gid)

2481

3133

os.setuid(uid)

3134

if debug:

3135

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3136

gid))

2482

3137

except OSError as error:

3138

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3139

.format(uid, gid, os.strerror(error.errno)))

2483

3140

if error.errno != errno.EPERM:

2484

raise error

2485

3141

raise

3142

2486

3143

if debug:

2487

3144

# Enable all possible GnuTLS debugging

2488

3145

2489

3146

# "Use a log level over 10 to enable all debugging options."

2490

3147

# - GnuTLS manual

2491

gnutls.library.functions.gnutls_global_set_log_level(11)

2492

2493

@gnutls.library.types.gnutls_log_func

3148

gnutls.global_set_log_level(11)

3149

3150

@gnutls.log_func

2494

3151

def debug_gnutls(level, string):

2495

3152

logger.debug("GnuTLS: %s", string[:-1])

2496

2497

(gnutls.library.functions

2498

.gnutls_global_set_log_function(debug_gnutls))

2499

3153

3154

gnutls.global_set_log_function(debug_gnutls)

3155

2500

3156

# Redirect stdin so all checkers get /dev/null

2501

3157

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2502

3158

os.dup2(null, sys.stdin.fileno())

2503

3159

if null > 2:

2504

3160

os.close(null)

2505

3161

2506

3162

# Need to fork before connecting to D-Bus

2507

3163

if not foreground:

2508

3164

# Close all input and output, do double fork, etc.

2509

3165

daemon()

2510

2511

# multiprocessing will use threads, so before we use gobject we

2512

# need to inform gobject that threads will be used.

2513

gobject.threads_init()

2514

3166

3167

if gi.version_info < (3, 10, 2):

3168

# multiprocessing will use threads, so before we use GLib we

3169

# need to inform GLib that threads will be used.

3170

GLib.threads_init()

3171

2515

3172

global main_loop

2516

3173

# From the Avahi example code

2517

3174

DBusGMainLoop(set_as_default=True)

2518

main_loop = gobject.MainLoop()

3175

main_loop = GLib.MainLoop()

2519

3176

bus = dbus.SystemBus()

2520

3177

# End of Avahi example code

2521

3178

if use_dbus:

2522

3179

try:

2523

3180

bus_name = dbus.service.BusName("se.recompile.Mandos",

2524

bus, do_not_queue=True)

2525

old_bus_name = (dbus.service.BusName

2526

("se.bsnet.fukt.Mandos", bus,

2527

do_not_queue=True))

2528

except dbus.exceptions.NameExistsException as e:

3181

bus,

3182

do_not_queue=True)

3183

old_bus_name = dbus.service.BusName(

3184

"se.bsnet.fukt.Mandos", bus,

3185

do_not_queue=True)

3186

except dbus.exceptions.DBusException as e:

2529

3187

logger.error("Disabling D-Bus:", exc_info=e)

2530

3188

use_dbus = False

2531

3189

server_settings["use_dbus"] = False

2532

3190

tcp_server.use_dbus = False

2533

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2534

service = AvahiServiceToSyslog(name =

2535

server_settings["servicename"],

2536

servicetype = "_mandos._tcp",

2537

protocol = protocol, bus = bus)

2538

if server_settings["interface"]:

2539

service.interface = (if_nametoindex

2540

(str(server_settings["interface"])))

2541

3191

if zeroconf:

3192

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3193

service = AvahiServiceToSyslog(

3194

name=server_settings["servicename"],

3195

servicetype="_mandos._tcp",

3196

protocol=protocol,

3197

bus=bus)

3198

if server_settings["interface"]:

3199

service.interface = if_nametoindex(

3200

server_settings["interface"].encode("utf-8"))

3201

2542

3202

global multiprocessing_manager

2543

3203

multiprocessing_manager = multiprocessing.Manager()

2544

3204

2545

3205

client_class = Client

2546

3206

if use_dbus:

2547

client_class = functools.partial(ClientDBus, bus = bus)

2548

3207

client_class = functools.partial(ClientDBus, bus=bus)

3208

2549

3209

client_settings = Client.config_parser(client_config)

2550

3210

old_client_settings = {}

2551

3211

clients_data = {}

2552

3212

2553

3213

# This is used to redirect stdout and stderr for checker processes

2554

3214

global wnull

2555

wnull = open(os.devnull, "w") # A writable /dev/null

3215

wnull = open(os.devnull, "w") # A writable /dev/null

2556

3216

# Only used if server is running in foreground but not in debug

2557

3217

# mode

2558

3218

if debug or not foreground:

2559

3219

wnull.close()

2560

3220

2561

3221

# Get client data and settings from last running state.

2562

3222

if server_settings["restore"]:

2563

3223

try:

2564

3224

with open(stored_state_path, "rb") as stored_state:

2565

clients_data, old_client_settings = (pickle.load

2566

(stored_state))

3225

if sys.version_info.major == 2:

3226

clients_data, old_client_settings = pickle.load(

3227

stored_state)

3228

else:

3229

bytes_clients_data, bytes_old_client_settings = (

3230

pickle.load(stored_state, encoding="bytes"))

3231

# Fix bytes to strings

3232

# clients_data

3233

# .keys()

3234

clients_data = {(key.decode("utf-8")

3235

if isinstance(key, bytes)

3236

else key): value

3237

for key, value in

3238

bytes_clients_data.items()}

3239

del bytes_clients_data

3240

for key in clients_data:

3241

value = {(k.decode("utf-8")

3242

if isinstance(k, bytes) else k): v

3243

for k, v in

3244

clients_data[key].items()}

3245

clients_data[key] = value

3246

# .client_structure

3247

value["client_structure"] = [

3248

(s.decode("utf-8")

3249

if isinstance(s, bytes)

3250

else s) for s in

3251

value["client_structure"]]

3252

# .name, .host, and .checker_command

3253

for k in ("name", "host", "checker_command"):

3254

if isinstance(value[k], bytes):

3255

value[k] = value[k].decode("utf-8")

3256

if "key_id" not in value:

3257

value["key_id"] = ""

3258

elif "fingerprint" not in value:

3259

value["fingerprint"] = ""

3260

# old_client_settings

3261

# .keys()

3262

old_client_settings = {

3263

(key.decode("utf-8")

3264

if isinstance(key, bytes)

3265

else key): value

3266

for key, value in

3267

bytes_old_client_settings.items()}

3268

del bytes_old_client_settings

3269

# .host and .checker_command

3270

for value in old_client_settings.values():

3271

for attribute in ("host", "checker_command"):

3272

if isinstance(value[attribute], bytes):

3273

value[attribute] = (value[attribute]

3274

.decode("utf-8"))

2567

3275

os.remove(stored_state_path)

2568

3276

except IOError as e:

2569

3277

if e.errno == errno.ENOENT:

2570

logger.warning("Could not load persistent state: {0}"

2571

.format(os.strerror(e.errno)))

3278

logger.warning("Could not load persistent state:"

3279

" {}".format(os.strerror(e.errno)))

2572

3280

else:

2573

3281

logger.critical("Could not load persistent state:",

2574

3282

exc_info=e)

2575

3283

raise

2576

3284

except EOFError as e:

2577

3285

logger.warning("Could not load persistent state: "

2578

"EOFError:", exc_info=e)

2579

3286

"EOFError:",

3287

exc_info=e)

3288

2580

3289

with PGPEngine() as pgp:

2581

for client_name, client in clients_data.iteritems():

3290

for client_name, client in clients_data.items():

2582

3291

# Skip removed clients

2583

3292

if client_name not in client_settings:

2584

3293

continue

2585

3294

2586

3295

# Decide which value to use after restoring saved state.

2587

3296

# We have three different values: Old config file,

2588

3297

# new config file, and saved state.

2593

3302

# For each value in new config, check if it

2594

3303

# differs from the old config value (Except for

2595

3304

# the "secret" attribute)

2596

if (name != "secret" and

2597

value != old_client_settings[client_name]

2598

[name]):

3305

if (name != "secret"

3306

and (value !=

3307

old_client_settings[client_name][name])):

2599

3308

client[name] = value

2600

3309

except KeyError:

2601

3310

pass

2602

3311

2603

3312

# Clients who has passed its expire date can still be

2604

# enabled if its last checker was successful. Clients

3313

# enabled if its last checker was successful. A Client

2605

3314

# whose checker succeeded before we stored its state is

2606

3315

# assumed to have successfully run all checkers during

2607

3316

# downtime.

2609

3318

if datetime.datetime.utcnow() >= client["expires"]:

2610

3319

if not client["last_checked_ok"]:

2611

3320

logger.warning(

2612

"disabling client {0} - Client never "

2613

"performed a successful checker"

2614

.format(client_name))

3321

"disabling client {} - Client never "

3322

"performed a successful checker".format(

3323

client_name))

2615

3324

client["enabled"] = False

2616

3325

elif client["last_checker_status"] != 0:

2617

3326

logger.warning(

2618

"disabling client {0} - Client "

2619

"last checker failed with error code {1}"

2620

.format(client_name,

2621

client["last_checker_status"]))

3327

"disabling client {} - Client last"

3328

" checker failed with error code"

3329

" {}".format(

3330

client_name,

3331

client["last_checker_status"]))

2622

3332

client["enabled"] = False

2623

3333

else:

2624

client["expires"] = (datetime.datetime

2625

.utcnow()

2626

+ client["timeout"])

3334

client["expires"] = (

3335

datetime.datetime.utcnow()

3336

+ client["timeout"])

2627

3337

logger.debug("Last checker succeeded,"

2628

" keeping {0} enabled"

2629

.format(client_name))

3338

" keeping {} enabled".format(

3339

client_name))

2630

3340

try:

2631

client["secret"] = (

2632

pgp.decrypt(client["encrypted_secret"],

2633

client_settings[client_name]

2634

["secret"]))

3341

client["secret"] = pgp.decrypt(

3342

client["encrypted_secret"],

3343

client_settings[client_name]["secret"])

2635

3344

except PGPError:

2636

3345

# If decryption fails, we use secret from new settings

2637

logger.debug("Failed to decrypt {0} old secret"

2638

.format(client_name))

2639

client["secret"] = (

2640

client_settings[client_name]["secret"])

2641

3346

logger.debug("Failed to decrypt {} old secret".format(

3347

client_name))

3348

client["secret"] = (client_settings[client_name]

3349

["secret"])

3350

2642

3351

# Add/remove clients based on new changes made to config

2643

3352

for client_name in (set(old_client_settings)

2644

3353

- set(client_settings)):

2646

3355

for client_name in (set(client_settings)

2647

3356

- set(old_client_settings)):

2648

3357

clients_data[client_name] = client_settings[client_name]

2649

3358

2650

3359

# Create all client objects

2651

for client_name, client in clients_data.iteritems():

3360

for client_name, client in clients_data.items():

2652

3361

tcp_server.clients[client_name] = client_class(

2653

name = client_name, settings = client,

2654

server_settings = server_settings)

2655

3362

name=client_name,

3363

settings=client,

3364

server_settings=server_settings)

3365

2656

3366

if not tcp_server.clients:

2657

3367

logger.warning("No clients defined")

2658

3368

2659

3369

if not foreground:

2660

3370

if pidfile is not None:

3371

pid = os.getpid()

2661

3372

try:

2662

3373

with pidfile:

2663

pid = os.getpid()

2664

pidfile.write(str(pid) + "\n".encode("utf-8"))

3374

print(pid, file=pidfile)

2665

3375

except IOError:

2666

3376

logger.error("Could not write to file %r with PID %d",

2667

3377

pidfilename, pid)

2668

3378

del pidfile

2669

3379

del pidfilename

2670

2671

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2672

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2673

3380

3381

for termsig in (signal.SIGHUP, signal.SIGTERM):

3382

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3383

lambda: main_loop.quit() and False)

3384

2674

3385

if use_dbus:

2675

@alternate_dbus_interfaces({"se.recompile.Mandos":

2676

"se.bsnet.fukt.Mandos"})

2677

class MandosDBusService(DBusObjectWithProperties):

3386

3387

@alternate_dbus_interfaces(

3388

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3389

class MandosDBusService(DBusObjectWithObjectManager):

2678

3390

"""A D-Bus proxy object"""

3391

2679

3392

def __init__(self):

2680

3393

dbus.service.Object.__init__(self, bus, "/")

3394

2681

3395

_interface = "se.recompile.Mandos"

2682

2683

@dbus_interface_annotations(_interface)

2684

def _foo(self):

2685

return { "org.freedesktop.DBus.Property"

2686

".EmitsChangedSignal":

2687

"false"}

2688

3396

2689

3397

@dbus.service.signal(_interface, signature="o")

2690

3398

def ClientAdded(self, objpath):

2691

3399

"D-Bus signal"

2692

3400

pass

2693

3401

2694

3402

@dbus.service.signal(_interface, signature="ss")

2695

def ClientNotFound(self, fingerprint, address):

3403

def ClientNotFound(self, key_id, address):

2696

3404

"D-Bus signal"

2697

3405

pass

2698

3406

3407

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3408

"true"})

2699

3409

@dbus.service.signal(_interface, signature="os")

2700

3410

def ClientRemoved(self, objpath, name):

2701

3411

"D-Bus signal"

2702

3412

pass

2703

3413

3414

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3415

"true"})

2704

3416

@dbus.service.method(_interface, out_signature="ao")

2705

3417

def GetAllClients(self):

2706

3418

"D-Bus method"

2707

return dbus.Array(c.dbus_object_path

2708

for c in

2709

tcp_server.clients.itervalues())

2710

3419

return dbus.Array(c.dbus_object_path for c in

3420

tcp_server.clients.values())

3421

3422

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3423

"true"})

2711

3424

@dbus.service.method(_interface,

2712

3425

out_signature="a{oa{sv}}")

2713

3426

def GetAllClientsWithProperties(self):

2714

3427

"D-Bus method"

2715

3428

return dbus.Dictionary(

2716

((c.dbus_object_path, c.GetAll(""))

2717

for c in tcp_server.clients.itervalues()),

3429

{c.dbus_object_path: c.GetAll(

3430

"se.recompile.Mandos.Client")

3431

for c in tcp_server.clients.values()},

2718

3432

signature="oa{sv}")

2719

3433

2720

3434

@dbus.service.method(_interface, in_signature="o")

2721

3435

def RemoveClient(self, object_path):

2722

3436

"D-Bus method"

2723

for c in tcp_server.clients.itervalues():

3437

for c in tcp_server.clients.values():

2724

3438

if c.dbus_object_path == object_path:

2725

3439

del tcp_server.clients[c.name]

2726

3440

c.remove_from_connection()

2727

# Don't signal anything except ClientRemoved

3441

# Don't signal the disabling

2728

3442

c.disable(quiet=True)

2729

# Emit D-Bus signal

2730

self.ClientRemoved(object_path, c.name)

3443

# Emit D-Bus signal for removal

3444

self.client_removed_signal(c)

2731

3445

return

2732

3446

raise KeyError(object_path)

2733

3447

2734

3448

del _interface

2735

3449

3450

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3451

out_signature="a{oa{sa{sv}}}")

3452

def GetManagedObjects(self):

3453

"""D-Bus method"""

3454

return dbus.Dictionary(

3455

{client.dbus_object_path:

3456

dbus.Dictionary(

3457

{interface: client.GetAll(interface)

3458

for interface in

3459

client._get_all_interface_names()})

3460

for client in tcp_server.clients.values()})

3461

3462

def client_added_signal(self, client):

3463

"""Send the new standard signal and the old signal"""

3464

if use_dbus:

3465

# New standard signal

3466

self.InterfacesAdded(

3467

client.dbus_object_path,

3468

dbus.Dictionary(

3469

{interface: client.GetAll(interface)

3470

for interface in

3471

client._get_all_interface_names()}))

3472

# Old signal

3473

self.ClientAdded(client.dbus_object_path)

3474

3475

def client_removed_signal(self, client):

3476

"""Send the new standard signal and the old signal"""

3477

if use_dbus:

3478

# New standard signal

3479

self.InterfacesRemoved(

3480

client.dbus_object_path,

3481

client._get_all_interface_names())

3482

# Old signal

3483

self.ClientRemoved(client.dbus_object_path,

3484

client.name)

3485

2736

3486

mandos_dbus_service = MandosDBusService()

2737

3487

3488

# Save modules to variables to exempt the modules from being

3489

# unloaded before the function registered with atexit() is run.

3490

mp = multiprocessing

3491

wn = wnull

3492

2738

3493

def cleanup():

2739

3494

"Cleanup function; run on exit"

2740

service.cleanup()

2741

2742

multiprocessing.active_children()

2743

wnull.close()

3495

if zeroconf:

3496

service.cleanup()

3497

3498

mp.active_children()

3499

wn.close()

2744

3500

if not (tcp_server.clients or client_settings):

2745

3501

return

2746

3502

2747

3503

# Store client before exiting. Secrets are encrypted with key

2748

3504

# based on what config file has. If config file is

2749

3505

# removed/edited, old secret will thus be unrecovable.

2750

3506

clients = {}

2751

3507

with PGPEngine() as pgp:

2752

for client in tcp_server.clients.itervalues():

3508

for client in tcp_server.clients.values():

2753

3509

key = client_settings[client.name]["secret"]

2754

3510

client.encrypted_secret = pgp.encrypt(client.secret,

2755

3511

key)

2756

3512

client_dict = {}

2757

3513

2758

3514

# A list of attributes that can not be pickled

2759

3515

# + secret.

2760

exclude = set(("bus", "changedstate", "secret",

2761

"checker", "server_settings"))

2762

for name, typ in (inspect.getmembers

2763

(dbus.service.Object)):

3516

exclude = {"bus", "changedstate", "secret",

3517

"checker", "server_settings"}

3518

for name, typ in inspect.getmembers(dbus.service

3519

.Object):

2764

3520

exclude.add(name)

2765

3521

2766

3522

client_dict["encrypted_secret"] = (client

2767

3523

.encrypted_secret)

2768

3524

for attr in client.client_structure:

2769

3525

if attr not in exclude:

2770

3526

client_dict[attr] = getattr(client, attr)

2771

3527

2772

3528

clients[client.name] = client_dict

2773

3529

del client_settings[client.name]["secret"]

2774

3530

2775

3531

try:

2776

with (tempfile.NamedTemporaryFile

2777

(mode='wb', suffix=".pickle", prefix='clients-',

2778

dir=os.path.dirname(stored_state_path),

2779

delete=False)) as stored_state:

2780

pickle.dump((clients, client_settings), stored_state)

2781

tempname=stored_state.name

3532

with tempfile.NamedTemporaryFile(

3533

mode='wb',

3534

suffix=".pickle",

3535

prefix='clients-',

3536

dir=os.path.dirname(stored_state_path),

3537

delete=False) as stored_state:

3538

pickle.dump((clients, client_settings), stored_state,

3539

protocol=2)

3540

tempname = stored_state.name

2782

3541

os.rename(tempname, stored_state_path)

2783

3542

except (IOError, OSError) as e:

2784

3543

if not debug:

2787

3546

except NameError:

2788

3547

pass

2789

3548

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2790

logger.warning("Could not save persistent state: {0}"

3549

logger.warning("Could not save persistent state: {}"

2791

3550

.format(os.strerror(e.errno)))

2792

3551

else:

2793

3552

logger.warning("Could not save persistent state:",

2794

3553

exc_info=e)

2795

raise e

2796

3554

raise

3555

2797

3556

# Delete all clients, and settings from config

2798

3557

while tcp_server.clients:

2799

3558

name, client = tcp_server.clients.popitem()

2800

3559

if use_dbus:

2801

3560

client.remove_from_connection()

2802

# Don't signal anything except ClientRemoved

3561

# Don't signal the disabling

2803

3562

client.disable(quiet=True)

3563

# Emit D-Bus signal for removal

2804

3564

if use_dbus:

2805

# Emit D-Bus signal

2806

mandos_dbus_service.ClientRemoved(client

2807

.dbus_object_path,

2808

client.name)

3565

mandos_dbus_service.client_removed_signal(client)

2809

3566

client_settings.clear()

2810

3567

2811

3568

atexit.register(cleanup)

2812

2813

for client in tcp_server.clients.itervalues():

3569

3570

for client in tcp_server.clients.values():

2814

3571

if use_dbus:

2815

# Emit D-Bus signal

2816

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3572

# Emit D-Bus signal for adding

3573

mandos_dbus_service.client_added_signal(client)

2817

3574

# Need to initiate checking of clients

2818

3575

if client.enabled:

2819

3576

client.init_checker()

2820

3577

2821

3578

tcp_server.enable()

2822

3579

tcp_server.server_activate()

2823

3580

2824

3581

# Find out what port we got

2825

service.port = tcp_server.socket.getsockname()[1]

3582

if zeroconf:

3583

service.port = tcp_server.socket.getsockname()[1]

2826

3584

if use_ipv6:

2827

3585

logger.info("Now listening on address %r, port %d,"

2828

3586

" flowinfo %d, scope_id %d",

2830

3588

else: # IPv4

2831

3589

logger.info("Now listening on address %r, port %d",

2832

3590

*tcp_server.socket.getsockname())

2833

2834

#service.interface = tcp_server.socket.getsockname()[3]

2835

3591

3592

# service.interface = tcp_server.socket.getsockname()[3]

3593

2836

3594

try:

2837

# From the Avahi example code

2838

try:

2839

service.activate()

2840

except dbus.exceptions.DBusException as error:

2841

logger.critical("D-Bus Exception", exc_info=error)

2842

cleanup()

2843

sys.exit(1)

2844

# End of Avahi example code

2845

2846

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2847

lambda *args, **kwargs:

2848

(tcp_server.handle_request

2849

(*args[2:], **kwargs) or True))

2850

3595

if zeroconf:

3596

# From the Avahi example code

3597

try:

3598

service.activate()

3599

except dbus.exceptions.DBusException as error:

3600

logger.critical("D-Bus Exception", exc_info=error)

3601

cleanup()

3602

sys.exit(1)

3603

# End of Avahi example code

3604

3605

GLib.io_add_watch(

3606

GLib.IOChannel.unix_new(tcp_server.fileno()),

3607

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3608

lambda *args, **kwargs: (tcp_server.handle_request

3609

(*args[2:], **kwargs) or True))

3610

2851

3611

logger.debug("Starting main loop")

2852

3612

main_loop.run()

2853

3613

except AvahiError as error:

2862

3622

# Must run before the D-Bus bus name gets deregistered

2863

3623

cleanup()

2864

3624

3625

3626

def should_only_run_tests():

3627

parser = argparse.ArgumentParser(add_help=False)

3628

parser.add_argument("--check", action='store_true')

3629

args, unknown_args = parser.parse_known_args()

3630

run_tests = args.check

3631

if run_tests:

3632

# Remove --check argument from sys.argv

3633

sys.argv[1:] = unknown_args

3634

return run_tests

3635

3636

# Add all tests from doctest strings

3637

def load_tests(loader, tests, none):

3638

import doctest

3639

tests.addTests(doctest.DocTestSuite())

3640

return tests

3641

2865

3642

if __name__ == '__main__':

2866

main()

3643

try:

3644

if should_only_run_tests():

3645

# Call using ./mandos --check [--verbose]

3646

unittest.main()

3647

else:

3648

main()

3649

finally:

3650

logging.shutdown()