To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.751
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.751
- Committer: teddy at recompile
- Date: 2020-02-07 20:53:34 UTC
- mto: This revision was merged to the branch mainline in revision 396.
- Revision ID: teddy@recompile.se-20200207205334-dp41p8c8vw0ytik5
Allow users to more easily alter mandos.service
The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable. This should be supported by the systemd
service, too.
* mandos.service ([Service]/EnvironmentFile): New; set to
"/etc/default/mandos ".
([Service]/ExecStart): Append "$DAEMON_ARGS".
The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable. This should be supported by the systemd
service, too.
* mandos.service ([Service]/EnvironmentFile): New; set to
"/etc/default/mandos ".
([Service]/ExecStart): Append "$DAEMON_ARGS".
- files added:
- bugs.xml
- debian/tests
- dracut-module
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
44
48
import argparse
45
49
import datetime
46
50
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
53
51
try:
54
52
import ConfigParser as configparser
55
53
except ImportError:
78
76
import tempfile
79
77
import itertools
80
78
import collections
79
import codecs
80
import unittest
81
import random
81
82
82
83
import dbus
83
84
import dbus.service
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
88
import avahi
85
import gi
86
from gi.repository import GLib
89
87
from dbus.mainloop.glib import DBusGMainLoop
90
88
import ctypes
91
89
import ctypes.util
92
90
import xml.dom.minidom
93
91
import inspect
94
92
95
try:
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
97
# Add collections.abc.Callable if it does not exist
98
try:
99
collections.abc.Callable
100
except AttributeError:
101
class abc:
102
Callable = collections.Callable
103
collections.abc = abc
104
del abc
105
106
# Show warnings by default
107
if not sys.warnoptions:
108
import warnings
109
warnings.simplefilter("default")
110
111
# Try to find the value of SO_BINDTODEVICE:
112
try:
113
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
114
# newer, and it is also the most natural place for it:
96
115
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
97
116
except AttributeError:
98
117
try:
118
# This is where SO_BINDTODEVICE was up to and including Python
119
# 2.6, and also 3.2:
99
120
from IN import SO_BINDTODEVICE
100
121
except ImportError:
101
SO_BINDTODEVICE = None
102
103
if sys.version_info.major == 2:
104
str = unicode
105
106
version = "1.6.9"
122
# In Python 2.7 it seems to have been removed entirely.
123
# Try running the C preprocessor:
124
try:
125
cc = subprocess.Popen(["cc", "--language=c", "-E",
126
"/dev/stdin"],
127
stdin=subprocess.PIPE,
128
stdout=subprocess.PIPE)
129
stdout = cc.communicate(
130
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
131
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
132
except (OSError, ValueError, IndexError):
133
# No value found
134
SO_BINDTODEVICE = None
135
136
if sys.version_info < (3, 2):
137
configparser.Configparser = configparser.SafeConfigParser
138
139
version = "1.8.9"
107
140
stored_state_file = "clients.pickle"
108
141
109
142
logger = logging.getLogger()
143
logging.captureWarnings(True) # Show warnings via the logging system
110
144
syslogger = None
111
145
112
146
try:
113
147
if_nametoindex = ctypes.cdll.LoadLibrary(
114
148
ctypes.util.find_library("c")).if_nametoindex
115
149
except (OSError, AttributeError):
116
150
117
151
def if_nametoindex(interface):
118
152
"Get an interface index the hard way, i.e. using fcntl()"
119
153
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
124
158
return interface_index
125
159
126
160
161
def copy_function(func):
162
"""Make a copy of a function"""
163
if sys.version_info.major == 2:
164
return types.FunctionType(func.func_code,
165
func.func_globals,
166
func.func_name,
167
func.func_defaults,
168
func.func_closure)
169
else:
170
return types.FunctionType(func.__code__,
171
func.__globals__,
172
func.__name__,
173
func.__defaults__,
174
func.__closure__)
175
176
127
177
def initlogger(debug, level=logging.WARNING):
128
178
"""init logger and add loglevel"""
129
179
130
180
global syslogger
131
181
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
182
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
183
address="/dev/log"))
134
184
syslogger.setFormatter(logging.Formatter
135
185
('Mandos [%(process)d]: %(levelname)s:'
136
186
' %(message)s'))
137
187
logger.addHandler(syslogger)
138
188
139
189
if debug:
140
190
console = logging.StreamHandler()
141
191
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
151
201
pass
152
202
153
203
154
class PGPEngine(object):
204
class PGPEngine:
155
205
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
206
157
207
def __init__(self):
158
208
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
209
self.gpg = "gpg"
210
try:
211
output = subprocess.check_output(["gpgconf"])
212
for line in output.splitlines():
213
name, text, path = line.split(b":")
214
if name == b"gpg":
215
self.gpg = path
216
break
217
except OSError as e:
218
if e.errno != errno.ENOENT:
219
raise
159
220
self.gnupgargs = ['--batch',
160
'--home', self.tempdir,
221
'--homedir', self.tempdir,
161
222
'--force-mdc',
162
'--quiet',
163
'--no-use-agent']
164
223
'--quiet']
224
# Only GPG version 1 has the --no-use-agent option.
225
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
226
self.gnupgargs.append("--no-use-agent")
227
165
228
def __enter__(self):
166
229
return self
167
230
168
231
def __exit__(self, exc_type, exc_value, traceback):
169
232
self._cleanup()
170
233
return False
171
234
172
235
def __del__(self):
173
236
self._cleanup()
174
237
175
238
def _cleanup(self):
176
239
if self.tempdir is not None:
177
240
# Delete contents of tempdir
178
241
for root, dirs, files in os.walk(self.tempdir,
179
topdown = False):
242
topdown=False):
180
243
for filename in files:
181
244
os.remove(os.path.join(root, filename))
182
245
for dirname in dirs:
184
247
# Remove tempdir
185
248
os.rmdir(self.tempdir)
186
249
self.tempdir = None
187
250
188
251
def password_encode(self, password):
189
252
# Passphrase can not be empty and can not contain newlines or
190
253
# NUL bytes. So we prefix it and hex encode it.
195
258
.replace(b"\n", b"\\n")
196
259
.replace(b"\0", b"\\x00"))
197
260
return encoded
198
261
199
262
def encrypt(self, data, password):
200
263
passphrase = self.password_encode(password)
201
264
with tempfile.NamedTemporaryFile(
202
265
dir=self.tempdir) as passfile:
203
266
passfile.write(passphrase)
204
267
passfile.flush()
205
proc = subprocess.Popen(['gpg', '--symmetric',
268
proc = subprocess.Popen([self.gpg, '--symmetric',
206
269
'--passphrase-file',
207
270
passfile.name]
208
271
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
ciphertext, err = proc.communicate(input=data)
213
276
if proc.returncode != 0:
214
277
raise PGPError(err)
215
278
return ciphertext
216
279
217
280
def decrypt(self, data, password):
218
281
passphrase = self.password_encode(password)
219
282
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
283
dir=self.tempdir) as passfile:
221
284
passfile.write(passphrase)
222
285
passfile.flush()
223
proc = subprocess.Popen(['gpg', '--decrypt',
286
proc = subprocess.Popen([self.gpg, '--decrypt',
224
287
'--passphrase-file',
225
288
passfile.name]
226
289
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
290
stdin=subprocess.PIPE,
291
stdout=subprocess.PIPE,
292
stderr=subprocess.PIPE)
293
decrypted_plaintext, err = proc.communicate(input=data)
231
294
if proc.returncode != 0:
232
295
raise PGPError(err)
233
296
return decrypted_plaintext
234
297
235
298
299
# Pretend that we have an Avahi module
300
class avahi:
301
"""This isn't so much a class as it is a module-like namespace."""
302
IF_UNSPEC = -1 # avahi-common/address.h
303
PROTO_UNSPEC = -1 # avahi-common/address.h
304
PROTO_INET = 0 # avahi-common/address.h
305
PROTO_INET6 = 1 # avahi-common/address.h
306
DBUS_NAME = "org.freedesktop.Avahi"
307
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
308
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
309
DBUS_PATH_SERVER = "/"
310
311
@staticmethod
312
def string_array_to_txt_array(t):
313
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
314
for s in t), signature="ay")
315
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
316
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
317
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
318
SERVER_INVALID = 0 # avahi-common/defs.h
319
SERVER_REGISTERING = 1 # avahi-common/defs.h
320
SERVER_RUNNING = 2 # avahi-common/defs.h
321
SERVER_COLLISION = 3 # avahi-common/defs.h
322
SERVER_FAILURE = 4 # avahi-common/defs.h
323
324
236
325
class AvahiError(Exception):
237
326
def __init__(self, value, *args, **kwargs):
238
327
self.value = value
248
337
pass
249
338
250
339
251
class AvahiService(object):
340
class AvahiService:
252
341
"""An Avahi (Zeroconf) service.
253
342
254
343
Attributes:
255
344
interface: integer; avahi.IF_UNSPEC or an interface index.
256
345
Used to optionally bind to the specified interface.
268
357
server: D-Bus Server
269
358
bus: dbus.SystemBus()
270
359
"""
271
360
272
361
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
362
interface=avahi.IF_UNSPEC,
363
name=None,
364
servicetype=None,
365
port=None,
366
TXT=None,
367
domain="",
368
host="",
369
max_renames=32768,
370
protocol=avahi.PROTO_UNSPEC,
371
bus=None):
283
372
self.interface = interface
284
373
self.name = name
285
374
self.type = servicetype
294
383
self.server = None
295
384
self.bus = bus
296
385
self.entry_group_state_changed_match = None
297
386
298
387
def rename(self, remove=True):
299
388
"""Derived from the Avahi example code"""
300
389
if self.rename_count >= self.max_renames:
320
409
logger.critical("D-Bus Exception", exc_info=error)
321
410
self.cleanup()
322
411
os._exit(1)
323
412
324
413
def remove(self):
325
414
"""Derived from the Avahi example code"""
326
415
if self.entry_group_state_changed_match is not None:
328
417
self.entry_group_state_changed_match = None
329
418
if self.group is not None:
330
419
self.group.Reset()
331
420
332
421
def add(self):
333
422
"""Derived from the Avahi example code"""
334
423
self.remove()
351
440
dbus.UInt16(self.port),
352
441
avahi.string_array_to_txt_array(self.TXT))
353
442
self.group.Commit()
354
443
355
444
def entry_group_state_changed(self, state, error):
356
445
"""Derived from the Avahi example code"""
357
446
logger.debug("Avahi entry group state change: %i", state)
358
447
359
448
if state == avahi.ENTRY_GROUP_ESTABLISHED:
360
449
logger.debug("Zeroconf service established.")
361
450
elif state == avahi.ENTRY_GROUP_COLLISION:
365
454
logger.critical("Avahi: Error in group state changed %s",
366
455
str(error))
367
456
raise AvahiGroupError("State changed: {!s}".format(error))
368
457
369
458
def cleanup(self):
370
459
"""Derived from the Avahi example code"""
371
460
if self.group is not None:
376
465
pass
377
466
self.group = None
378
467
self.remove()
379
468
380
469
def server_state_changed(self, state, error=None):
381
470
"""Derived from the Avahi example code"""
382
471
logger.debug("Avahi server state change: %i", state)
394
483
logger.error(bad_states[state] + ": %r", error)
395
484
self.cleanup()
396
485
elif state == avahi.SERVER_RUNNING:
397
self.add()
486
try:
487
self.add()
488
except dbus.exceptions.DBusException as error:
489
if (error.get_dbus_name()
490
== "org.freedesktop.Avahi.CollisionError"):
491
logger.info("Local Zeroconf service name"
492
" collision.")
493
return self.rename(remove=False)
494
else:
495
logger.critical("D-Bus Exception", exc_info=error)
496
self.cleanup()
497
os._exit(1)
398
498
else:
399
499
if error is None:
400
500
logger.debug("Unknown state: %r", state)
401
501
else:
402
502
logger.debug("Unknown state: %r: %r", state, error)
403
503
404
504
def activate(self):
405
505
"""Derived from the Avahi example code"""
406
506
if self.server is None:
417
517
class AvahiServiceToSyslog(AvahiService):
418
518
def rename(self, *args, **kwargs):
419
519
"""Add the new name to the syslog messages"""
420
ret = AvahiService.rename(self, *args, **kwargs)
520
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
421
521
syslogger.setFormatter(logging.Formatter(
422
522
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
523
.format(self.name)))
424
524
return ret
425
525
526
527
# Pretend that we have a GnuTLS module
528
class gnutls:
529
"""This isn't so much a class as it is a module-like namespace."""
530
531
library = ctypes.util.find_library("gnutls")
532
if library is None:
533
library = ctypes.util.find_library("gnutls-deb0")
534
_library = ctypes.cdll.LoadLibrary(library)
535
del library
536
537
# Unless otherwise indicated, the constants and types below are
538
# all from the gnutls/gnutls.h C header file.
539
540
# Constants
541
E_SUCCESS = 0
542
E_INTERRUPTED = -52
543
E_AGAIN = -28
544
CRT_OPENPGP = 2
545
CRT_RAWPK = 3
546
CLIENT = 2
547
SHUT_RDWR = 0
548
CRD_CERTIFICATE = 1
549
E_NO_CERTIFICATE_FOUND = -49
550
X509_FMT_DER = 0
551
NO_TICKETS = 1<<10
552
ENABLE_RAWPK = 1<<18
553
CTYPE_PEERS = 3
554
KEYID_USE_SHA256 = 1 # gnutls/x509.h
555
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
556
557
# Types
558
class session_int(ctypes.Structure):
559
_fields_ = []
560
session_t = ctypes.POINTER(session_int)
561
562
class certificate_credentials_st(ctypes.Structure):
563
_fields_ = []
564
certificate_credentials_t = ctypes.POINTER(
565
certificate_credentials_st)
566
certificate_type_t = ctypes.c_int
567
568
class datum_t(ctypes.Structure):
569
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
570
('size', ctypes.c_uint)]
571
572
class openpgp_crt_int(ctypes.Structure):
573
_fields_ = []
574
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
575
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
576
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
577
credentials_type_t = ctypes.c_int
578
transport_ptr_t = ctypes.c_void_p
579
close_request_t = ctypes.c_int
580
581
# Exceptions
582
class Error(Exception):
583
def __init__(self, message=None, code=None, args=()):
584
# Default usage is by a message string, but if a return
585
# code is passed, convert it to a string with
586
# gnutls.strerror()
587
self.code = code
588
if message is None and code is not None:
589
message = gnutls.strerror(code)
590
return super(gnutls.Error, self).__init__(
591
message, *args)
592
593
class CertificateSecurityError(Error):
594
pass
595
596
# Classes
597
class Credentials:
598
def __init__(self):
599
self._c_object = gnutls.certificate_credentials_t()
600
gnutls.certificate_allocate_credentials(
601
ctypes.byref(self._c_object))
602
self.type = gnutls.CRD_CERTIFICATE
603
604
def __del__(self):
605
gnutls.certificate_free_credentials(self._c_object)
606
607
class ClientSession:
608
def __init__(self, socket, credentials=None):
609
self._c_object = gnutls.session_t()
610
gnutls_flags = gnutls.CLIENT
611
if gnutls.check_version(b"3.5.6"):
612
gnutls_flags |= gnutls.NO_TICKETS
613
if gnutls.has_rawpk:
614
gnutls_flags |= gnutls.ENABLE_RAWPK
615
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
616
del gnutls_flags
617
gnutls.set_default_priority(self._c_object)
618
gnutls.transport_set_ptr(self._c_object, socket.fileno())
619
gnutls.handshake_set_private_extensions(self._c_object,
620
True)
621
self.socket = socket
622
if credentials is None:
623
credentials = gnutls.Credentials()
624
gnutls.credentials_set(self._c_object, credentials.type,
625
ctypes.cast(credentials._c_object,
626
ctypes.c_void_p))
627
self.credentials = credentials
628
629
def __del__(self):
630
gnutls.deinit(self._c_object)
631
632
def handshake(self):
633
return gnutls.handshake(self._c_object)
634
635
def send(self, data):
636
data = bytes(data)
637
data_len = len(data)
638
while data_len > 0:
639
data_len -= gnutls.record_send(self._c_object,
640
data[-data_len:],
641
data_len)
642
643
def bye(self):
644
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
645
646
# Error handling functions
647
def _error_code(result):
648
"""A function to raise exceptions on errors, suitable
649
for the 'restype' attribute on ctypes functions"""
650
if result >= 0:
651
return result
652
if result == gnutls.E_NO_CERTIFICATE_FOUND:
653
raise gnutls.CertificateSecurityError(code=result)
654
raise gnutls.Error(code=result)
655
656
def _retry_on_error(result, func, arguments):
657
"""A function to retry on some errors, suitable
658
for the 'errcheck' attribute on ctypes functions"""
659
while result < 0:
660
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
661
return _error_code(result)
662
result = func(*arguments)
663
return result
664
665
# Unless otherwise indicated, the function declarations below are
666
# all from the gnutls/gnutls.h C header file.
667
668
# Functions
669
priority_set_direct = _library.gnutls_priority_set_direct
670
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
671
ctypes.POINTER(ctypes.c_char_p)]
672
priority_set_direct.restype = _error_code
673
674
init = _library.gnutls_init
675
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
676
init.restype = _error_code
677
678
set_default_priority = _library.gnutls_set_default_priority
679
set_default_priority.argtypes = [session_t]
680
set_default_priority.restype = _error_code
681
682
record_send = _library.gnutls_record_send
683
record_send.argtypes = [session_t, ctypes.c_void_p,
684
ctypes.c_size_t]
685
record_send.restype = ctypes.c_ssize_t
686
record_send.errcheck = _retry_on_error
687
688
certificate_allocate_credentials = (
689
_library.gnutls_certificate_allocate_credentials)
690
certificate_allocate_credentials.argtypes = [
691
ctypes.POINTER(certificate_credentials_t)]
692
certificate_allocate_credentials.restype = _error_code
693
694
certificate_free_credentials = (
695
_library.gnutls_certificate_free_credentials)
696
certificate_free_credentials.argtypes = [
697
certificate_credentials_t]
698
certificate_free_credentials.restype = None
699
700
handshake_set_private_extensions = (
701
_library.gnutls_handshake_set_private_extensions)
702
handshake_set_private_extensions.argtypes = [session_t,
703
ctypes.c_int]
704
handshake_set_private_extensions.restype = None
705
706
credentials_set = _library.gnutls_credentials_set
707
credentials_set.argtypes = [session_t, credentials_type_t,
708
ctypes.c_void_p]
709
credentials_set.restype = _error_code
710
711
strerror = _library.gnutls_strerror
712
strerror.argtypes = [ctypes.c_int]
713
strerror.restype = ctypes.c_char_p
714
715
certificate_type_get = _library.gnutls_certificate_type_get
716
certificate_type_get.argtypes = [session_t]
717
certificate_type_get.restype = _error_code
718
719
certificate_get_peers = _library.gnutls_certificate_get_peers
720
certificate_get_peers.argtypes = [session_t,
721
ctypes.POINTER(ctypes.c_uint)]
722
certificate_get_peers.restype = ctypes.POINTER(datum_t)
723
724
global_set_log_level = _library.gnutls_global_set_log_level
725
global_set_log_level.argtypes = [ctypes.c_int]
726
global_set_log_level.restype = None
727
728
global_set_log_function = _library.gnutls_global_set_log_function
729
global_set_log_function.argtypes = [log_func]
730
global_set_log_function.restype = None
731
732
deinit = _library.gnutls_deinit
733
deinit.argtypes = [session_t]
734
deinit.restype = None
735
736
handshake = _library.gnutls_handshake
737
handshake.argtypes = [session_t]
738
handshake.restype = _error_code
739
handshake.errcheck = _retry_on_error
740
741
transport_set_ptr = _library.gnutls_transport_set_ptr
742
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
743
transport_set_ptr.restype = None
744
745
bye = _library.gnutls_bye
746
bye.argtypes = [session_t, close_request_t]
747
bye.restype = _error_code
748
bye.errcheck = _retry_on_error
749
750
check_version = _library.gnutls_check_version
751
check_version.argtypes = [ctypes.c_char_p]
752
check_version.restype = ctypes.c_char_p
753
754
_need_version = b"3.3.0"
755
if check_version(_need_version) is None:
756
raise self.Error("Needs GnuTLS {} or later"
757
.format(_need_version))
758
759
_tls_rawpk_version = b"3.6.6"
760
has_rawpk = bool(check_version(_tls_rawpk_version))
761
762
if has_rawpk:
763
# Types
764
class pubkey_st(ctypes.Structure):
765
_fields = []
766
pubkey_t = ctypes.POINTER(pubkey_st)
767
768
x509_crt_fmt_t = ctypes.c_int
769
770
# All the function declarations below are from gnutls/abstract.h
771
pubkey_init = _library.gnutls_pubkey_init
772
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
773
pubkey_init.restype = _error_code
774
775
pubkey_import = _library.gnutls_pubkey_import
776
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
777
x509_crt_fmt_t]
778
pubkey_import.restype = _error_code
779
780
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
781
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
782
ctypes.POINTER(ctypes.c_ubyte),
783
ctypes.POINTER(ctypes.c_size_t)]
784
pubkey_get_key_id.restype = _error_code
785
786
pubkey_deinit = _library.gnutls_pubkey_deinit
787
pubkey_deinit.argtypes = [pubkey_t]
788
pubkey_deinit.restype = None
789
else:
790
# All the function declarations below are from gnutls/openpgp.h
791
792
openpgp_crt_init = _library.gnutls_openpgp_crt_init
793
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
794
openpgp_crt_init.restype = _error_code
795
796
openpgp_crt_import = _library.gnutls_openpgp_crt_import
797
openpgp_crt_import.argtypes = [openpgp_crt_t,
798
ctypes.POINTER(datum_t),
799
openpgp_crt_fmt_t]
800
openpgp_crt_import.restype = _error_code
801
802
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
803
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
804
ctypes.POINTER(ctypes.c_uint)]
805
openpgp_crt_verify_self.restype = _error_code
806
807
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
808
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
809
openpgp_crt_deinit.restype = None
810
811
openpgp_crt_get_fingerprint = (
812
_library.gnutls_openpgp_crt_get_fingerprint)
813
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
814
ctypes.c_void_p,
815
ctypes.POINTER(
816
ctypes.c_size_t)]
817
openpgp_crt_get_fingerprint.restype = _error_code
818
819
if check_version(b"3.6.4"):
820
certificate_type_get2 = _library.gnutls_certificate_type_get2
821
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
822
certificate_type_get2.restype = _error_code
823
824
# Remove non-public functions
825
del _error_code, _retry_on_error
826
827
426
828
def call_pipe(connection, # : multiprocessing.Connection
427
829
func, *args, **kwargs):
428
830
"""This function is meant to be called by multiprocessing.Process
429
831
430
832
This function runs func(*args, **kwargs), and writes the resulting
431
833
return value on the provided multiprocessing.Connection.
432
834
"""
433
835
connection.send(func(*args, **kwargs))
434
836
connection.close()
435
837
436
class Client(object):
838
839
class Client:
437
840
"""A representation of a client host served by this server.
438
841
439
842
Attributes:
440
843
approved: bool(); 'None' if not yet approved/disapproved
441
844
approval_delay: datetime.timedelta(); Time to wait for approval
442
845
approval_duration: datetime.timedelta(); Duration of one approval
443
checker: subprocess.Popen(); a running checker process used
444
to see if the client lives.
445
'None' if no process is running.
446
checker_callback_tag: a gobject event source tag, or None
846
checker: multiprocessing.Process(); a running checker process used
847
to see if the client lives. 'None' if no process is
848
running.
849
checker_callback_tag: a GLib event source tag, or None
447
850
checker_command: string; External command which is run to check
448
851
if client lives. %() expansions are done at
449
852
runtime with vars(self) as dict, so that for
450
853
instance %(name)s can be used in the command.
451
checker_initiator_tag: a gobject event source tag, or None
854
checker_initiator_tag: a GLib event source tag, or None
452
855
created: datetime.datetime(); (UTC) object creation
453
856
client_structure: Object describing what attributes a client has
454
857
and is used for storing the client at exit
455
858
current_checker_command: string; current running checker_command
456
disable_initiator_tag: a gobject event source tag, or None
859
disable_initiator_tag: a GLib event source tag, or None
457
860
enabled: bool()
458
861
fingerprint: string (40 or 32 hexadecimal digits); used to
459
uniquely identify the client
862
uniquely identify an OpenPGP client
863
key_id: string (64 hexadecimal digits); used to uniquely identify
864
a client using raw public keys
460
865
host: string; available for use by the checker command
461
866
interval: datetime.timedelta(); How often to start a new checker
462
867
last_approval_request: datetime.datetime(); (UTC) or None
478
883
disabled, or None
479
884
server_settings: The server_settings dict from main()
480
885
"""
481
886
482
887
runtime_expansions = ("approval_delay", "approval_duration",
483
"created", "enabled", "expires",
888
"created", "enabled", "expires", "key_id",
484
889
"fingerprint", "host", "interval",
485
890
"last_approval_request", "last_checked_ok",
486
891
"last_enabled", "name", "timeout")
495
900
"approved_by_default": "True",
496
901
"enabled": "True",
497
902
}
498
903
499
904
@staticmethod
500
905
def config_parser(config):
501
906
"""Construct a new dict of client settings of this form:
508
913
for client_name in config.sections():
509
914
section = dict(config.items(client_name))
510
915
client = settings[client_name] = {}
511
916
512
917
client["host"] = section["host"]
513
918
# Reformat values from string types to Python types
514
919
client["approved_by_default"] = config.getboolean(
515
920
client_name, "approved_by_default")
516
921
client["enabled"] = config.getboolean(client_name,
517
922
"enabled")
518
519
# Uppercase and remove spaces from fingerprint for later
520
# comparison purposes with return value from the
521
# fingerprint() function
923
924
# Uppercase and remove spaces from key_id and fingerprint
925
# for later comparison purposes with return value from the
926
# key_id() and fingerprint() functions
927
client["key_id"] = (section.get("key_id", "").upper()
928
.replace(" ", ""))
522
929
client["fingerprint"] = (section["fingerprint"].upper()
523
930
.replace(" ", ""))
524
931
if "secret" in section:
525
client["secret"] = section["secret"].decode("base64")
932
client["secret"] = codecs.decode(section["secret"]
933
.encode("utf-8"),
934
"base64")
526
935
elif "secfile" in section:
527
936
with open(os.path.expanduser(os.path.expandvars
528
937
(section["secfile"])),
543
952
client["last_approval_request"] = None
544
953
client["last_checked_ok"] = None
545
954
client["last_checker_status"] = -2
546
955
547
956
return settings
548
549
def __init__(self, settings, name = None, server_settings=None):
957
958
def __init__(self, settings, name=None, server_settings=None):
550
959
self.name = name
551
960
if server_settings is None:
552
961
server_settings = {}
554
963
# adding all client settings
555
964
for setting, value in settings.items():
556
965
setattr(self, setting, value)
557
966
558
967
if self.enabled:
559
968
if not hasattr(self, "last_enabled"):
560
969
self.last_enabled = datetime.datetime.utcnow()
564
973
else:
565
974
self.last_enabled = None
566
975
self.expires = None
567
976
568
977
logger.debug("Creating client %r", self.name)
978
logger.debug(" Key ID: %s", self.key_id)
569
979
logger.debug(" Fingerprint: %s", self.fingerprint)
570
980
self.created = settings.get("created",
571
981
datetime.datetime.utcnow())
572
982
573
983
# attributes specific for this server instance
574
984
self.checker = None
575
985
self.checker_initiator_tag = None
581
991
self.changedstate = multiprocessing_manager.Condition(
582
992
multiprocessing_manager.Lock())
583
993
self.client_structure = [attr
584
for attr in self.__dict__.iterkeys()
994
for attr in self.__dict__.keys()
585
995
if not attr.startswith("_")]
586
996
self.client_structure.append("client_structure")
587
997
588
998
for name, t in inspect.getmembers(
589
999
type(self), lambda obj: isinstance(obj, property)):
590
1000
if not name.startswith("_"):
591
1001
self.client_structure.append(name)
592
1002
593
1003
# Send notice to process children that client state has changed
594
1004
def send_changedstate(self):
595
1005
with self.changedstate:
596
1006
self.changedstate.notify_all()
597
1007
598
1008
def enable(self):
599
1009
"""Start this client's checker and timeout hooks"""
600
1010
if getattr(self, "enabled", False):
605
1015
self.last_enabled = datetime.datetime.utcnow()
606
1016
self.init_checker()
607
1017
self.send_changedstate()
608
1018
609
1019
def disable(self, quiet=True):
610
1020
"""Disable this client."""
611
1021
if not getattr(self, "enabled", False):
613
1023
if not quiet:
614
1024
logger.info("Disabling client %s", self.name)
615
1025
if getattr(self, "disable_initiator_tag", None) is not None:
616
gobject.source_remove(self.disable_initiator_tag)
1026
GLib.source_remove(self.disable_initiator_tag)
617
1027
self.disable_initiator_tag = None
618
1028
self.expires = None
619
1029
if getattr(self, "checker_initiator_tag", None) is not None:
620
gobject.source_remove(self.checker_initiator_tag)
1030
GLib.source_remove(self.checker_initiator_tag)
621
1031
self.checker_initiator_tag = None
622
1032
self.stop_checker()
623
1033
self.enabled = False
624
1034
if not quiet:
625
1035
self.send_changedstate()
626
# Do not run this again if called by a gobject.timeout_add
1036
# Do not run this again if called by a GLib.timeout_add
627
1037
return False
628
1038
629
1039
def __del__(self):
630
1040
self.disable()
631
1041
632
1042
def init_checker(self):
633
1043
# Schedule a new checker to be started an 'interval' from now,
634
1044
# and every interval from then on.
635
1045
if self.checker_initiator_tag is not None:
636
gobject.source_remove(self.checker_initiator_tag)
637
self.checker_initiator_tag = gobject.timeout_add(
638
int(self.interval.total_seconds() * 1000),
1046
GLib.source_remove(self.checker_initiator_tag)
1047
self.checker_initiator_tag = GLib.timeout_add(
1048
random.randrange(int(self.interval.total_seconds() * 1000
1049
+ 1)),
639
1050
self.start_checker)
640
1051
# Schedule a disable() when 'timeout' has passed
641
1052
if self.disable_initiator_tag is not None:
642
gobject.source_remove(self.disable_initiator_tag)
643
self.disable_initiator_tag = gobject.timeout_add(
1053
GLib.source_remove(self.disable_initiator_tag)
1054
self.disable_initiator_tag = GLib.timeout_add(
644
1055
int(self.timeout.total_seconds() * 1000), self.disable)
645
1056
# Also start a new checker *right now*.
646
1057
self.start_checker()
647
648
def checker_callback(self, source, condition,
649
(connection, command)):
1058
1059
def checker_callback(self, source, condition, connection,
1060
command):
650
1061
"""The checker has completed, so take appropriate actions."""
651
self.checker_callback_tag = None
652
self.checker = None
653
1062
# Read return code from connection (see call_pipe)
654
1063
returncode = connection.recv()
655
1064
connection.close()
656
1065
if self.checker is not None:
1066
self.checker.join()
1067
self.checker_callback_tag = None
1068
self.checker = None
1069
657
1070
if returncode >= 0:
658
1071
self.last_checker_status = returncode
659
1072
self.last_checker_signal = None
669
1082
logger.warning("Checker for %(name)s crashed?",
670
1083
vars(self))
671
1084
return False
672
1085
673
1086
def checked_ok(self):
674
1087
"""Assert that the client has been seen, alive and well."""
675
1088
self.last_checked_ok = datetime.datetime.utcnow()
676
1089
self.last_checker_status = 0
677
1090
self.last_checker_signal = None
678
1091
self.bump_timeout()
679
1092
680
1093
def bump_timeout(self, timeout=None):
681
1094
"""Bump up the timeout for this client."""
682
1095
if timeout is None:
683
1096
timeout = self.timeout
684
1097
if self.disable_initiator_tag is not None:
685
gobject.source_remove(self.disable_initiator_tag)
1098
GLib.source_remove(self.disable_initiator_tag)
686
1099
self.disable_initiator_tag = None
687
1100
if getattr(self, "enabled", False):
688
self.disable_initiator_tag = gobject.timeout_add(
1101
self.disable_initiator_tag = GLib.timeout_add(
689
1102
int(timeout.total_seconds() * 1000), self.disable)
690
1103
self.expires = datetime.datetime.utcnow() + timeout
691
1104
692
1105
def need_approval(self):
693
1106
self.last_approval_request = datetime.datetime.utcnow()
694
1107
695
1108
def start_checker(self):
696
1109
"""Start a new checker subprocess if one is not running.
697
1110
698
1111
If a checker already exists, leave it running and do
699
1112
nothing."""
700
1113
# The reason for not killing a running checker is that if we
705
1118
# checkers alone, the checker would have to take more time
706
1119
# than 'timeout' for the client to be disabled, which is as it
707
1120
# should be.
708
1121
709
1122
if self.checker is not None and not self.checker.is_alive():
710
1123
logger.warning("Checker was not alive; joining")
711
1124
self.checker.join()
715
1128
# Escape attributes for the shell
716
1129
escaped_attrs = {
717
1130
attr: re.escape(str(getattr(self, attr)))
718
for attr in self.runtime_expansions }
1131
for attr in self.runtime_expansions}
719
1132
try:
720
1133
command = self.checker_command % escaped_attrs
721
1134
except TypeError as error:
733
1146
# The exception is when not debugging but nevertheless
734
1147
# running in the foreground; use the previously
735
1148
# created wnull.
736
popen_args = { "close_fds": True,
737
"shell": True,
738
"cwd": "/" }
1149
popen_args = {"close_fds": True,
1150
"shell": True,
1151
"cwd": "/"}
739
1152
if (not self.server_settings["debug"]
740
1153
and self.server_settings["foreground"]):
741
1154
popen_args.update({"stdout": wnull,
742
"stderr": wnull })
1155
"stderr": wnull})
743
1156
pipe = multiprocessing.Pipe(duplex=False)
744
1157
self.checker = multiprocessing.Process(
745
target = call_pipe,
746
args = (subprocess.call, pipe[1], command),
747
kwargs = popen_args)
1158
target=call_pipe,
1159
args=(pipe[1], subprocess.call, command),
1160
kwargs=popen_args)
748
1161
self.checker.start()
749
self.checker_callback_tag = gobject.io_add_watch(
750
pipe[0].fileno(), gobject.IO_IN,
751
self.checker_callback, (pipe[0], command))
752
# Re-run this periodically if run by gobject.timeout_add
1162
self.checker_callback_tag = GLib.io_add_watch(
1163
GLib.IOChannel.unix_new(pipe[0].fileno()),
1164
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1165
self.checker_callback, pipe[0], command)
1166
# Re-run this periodically if run by GLib.timeout_add
753
1167
return True
754
1168
755
1169
def stop_checker(self):
756
1170
"""Force the checker process, if any, to stop."""
757
1171
if self.checker_callback_tag:
758
gobject.source_remove(self.checker_callback_tag)
1172
GLib.source_remove(self.checker_callback_tag)
759
1173
self.checker_callback_tag = None
760
1174
if getattr(self, "checker", None) is None:
761
1175
return
770
1184
byte_arrays=False):
771
1185
"""Decorators for marking methods of a DBusObjectWithProperties to
772
1186
become properties on the D-Bus.
773
1187
774
1188
The decorated method will be called with no arguments by "Get"
775
1189
and with one argument by "Set".
776
1190
777
1191
The parameters, where they are supported, are the same as
778
1192
dbus.service.method, except there is only "signature", since the
779
1193
type from Get() and the type sent to Set() is the same.
783
1197
if byte_arrays and signature != "ay":
784
1198
raise ValueError("Byte arrays not supported for non-'ay'"
785
1199
" signature {!r}".format(signature))
786
1200
787
1201
def decorator(func):
788
1202
func._dbus_is_property = True
789
1203
func._dbus_interface = dbus_interface
792
1206
func._dbus_name = func.__name__
793
1207
if func._dbus_name.endswith("_dbus_property"):
794
1208
func._dbus_name = func._dbus_name[:-14]
795
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1209
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
796
1210
return func
797
1211
798
1212
return decorator
799
1213
800
1214
801
1215
def dbus_interface_annotations(dbus_interface):
802
1216
"""Decorator for marking functions returning interface annotations
803
1217
804
1218
Usage:
805
1219
806
1220
@dbus_interface_annotations("org.example.Interface")
807
1221
def _foo(self): # Function name does not matter
808
1222
return {"org.freedesktop.DBus.Deprecated": "true",
809
1223
"org.freedesktop.DBus.Property.EmitsChangedSignal":
810
1224
"false"}
811
1225
"""
812
1226
813
1227
def decorator(func):
814
1228
func._dbus_is_interface = True
815
1229
func._dbus_interface = dbus_interface
816
1230
func._dbus_name = dbus_interface
817
1231
return func
818
1232
819
1233
return decorator
820
1234
821
1235
822
1236
def dbus_annotations(annotations):
823
1237
"""Decorator to annotate D-Bus methods, signals or properties
824
1238
Usage:
825
1239
826
1240
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
827
1241
"org.freedesktop.DBus.Property."
828
1242
"EmitsChangedSignal": "false"})
830
1244
access="r")
831
1245
def Property_dbus_property(self):
832
1246
return dbus.Boolean(False)
1247
1248
See also the DBusObjectWithAnnotations class.
833
1249
"""
834
1250
835
1251
def decorator(func):
836
1252
func._dbus_annotations = annotations
837
1253
return func
838
1254
839
1255
return decorator
840
1256
841
1257
857
1273
pass
858
1274
859
1275
860
class DBusObjectWithProperties(dbus.service.Object):
861
"""A D-Bus object with properties.
862
863
Classes inheriting from this can use the dbus_service_property
864
decorator to expose methods as D-Bus properties. It exposes the
865
standard Get(), Set(), and GetAll() methods on the D-Bus.
1276
class DBusObjectWithAnnotations(dbus.service.Object):
1277
"""A D-Bus object with annotations.
1278
1279
Classes inheriting from this can use the dbus_annotations
1280
decorator to add annotations to methods or signals.
866
1281
"""
867
1282
868
1283
@staticmethod
869
1284
def _is_dbus_thing(thing):
870
1285
"""Returns a function testing if an attribute is a D-Bus thing
871
1286
872
1287
If called like _is_dbus_thing("method") it returns a function
873
1288
suitable for use as predicate to inspect.getmembers().
874
1289
"""
875
1290
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
876
1291
False)
877
1292
878
1293
def _get_all_dbus_things(self, thing):
879
1294
"""Returns a generator of (name, attribute) pairs
880
1295
"""
883
1298
for cls in self.__class__.__mro__
884
1299
for name, athing in
885
1300
inspect.getmembers(cls, self._is_dbus_thing(thing)))
886
1301
1302
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1303
out_signature="s",
1304
path_keyword='object_path',
1305
connection_keyword='connection')
1306
def Introspect(self, object_path, connection):
1307
"""Overloading of standard D-Bus method.
1308
1309
Inserts annotation tags on methods and signals.
1310
"""
1311
xmlstring = dbus.service.Object.Introspect(self, object_path,
1312
connection)
1313
try:
1314
document = xml.dom.minidom.parseString(xmlstring)
1315
1316
for if_tag in document.getElementsByTagName("interface"):
1317
# Add annotation tags
1318
for typ in ("method", "signal"):
1319
for tag in if_tag.getElementsByTagName(typ):
1320
annots = dict()
1321
for name, prop in (self.
1322
_get_all_dbus_things(typ)):
1323
if (name == tag.getAttribute("name")
1324
and prop._dbus_interface
1325
== if_tag.getAttribute("name")):
1326
annots.update(getattr(
1327
prop, "_dbus_annotations", {}))
1328
for name, value in annots.items():
1329
ann_tag = document.createElement(
1330
"annotation")
1331
ann_tag.setAttribute("name", name)
1332
ann_tag.setAttribute("value", value)
1333
tag.appendChild(ann_tag)
1334
# Add interface annotation tags
1335
for annotation, value in dict(
1336
itertools.chain.from_iterable(
1337
annotations().items()
1338
for name, annotations
1339
in self._get_all_dbus_things("interface")
1340
if name == if_tag.getAttribute("name")
1341
)).items():
1342
ann_tag = document.createElement("annotation")
1343
ann_tag.setAttribute("name", annotation)
1344
ann_tag.setAttribute("value", value)
1345
if_tag.appendChild(ann_tag)
1346
# Fix argument name for the Introspect method itself
1347
if (if_tag.getAttribute("name")
1348
== dbus.INTROSPECTABLE_IFACE):
1349
for cn in if_tag.getElementsByTagName("method"):
1350
if cn.getAttribute("name") == "Introspect":
1351
for arg in cn.getElementsByTagName("arg"):
1352
if (arg.getAttribute("direction")
1353
== "out"):
1354
arg.setAttribute("name",
1355
"xml_data")
1356
xmlstring = document.toxml("utf-8")
1357
document.unlink()
1358
except (AttributeError, xml.dom.DOMException,
1359
xml.parsers.expat.ExpatError) as error:
1360
logger.error("Failed to override Introspection method",
1361
exc_info=error)
1362
return xmlstring
1363
1364
1365
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1366
"""A D-Bus object with properties.
1367
1368
Classes inheriting from this can use the dbus_service_property
1369
decorator to expose methods as D-Bus properties. It exposes the
1370
standard Get(), Set(), and GetAll() methods on the D-Bus.
1371
"""
1372
887
1373
def _get_dbus_property(self, interface_name, property_name):
888
1374
"""Returns a bound method if one exists which is a D-Bus
889
1375
property with the specified name and interface.
894
1380
if (value._dbus_name == property_name
895
1381
and value._dbus_interface == interface_name):
896
1382
return value.__get__(self)
897
1383
898
1384
# No such property
899
1385
raise DBusPropertyNotFound("{}:{}.{}".format(
900
1386
self.dbus_object_path, interface_name, property_name))
901
1387
1388
@classmethod
1389
def _get_all_interface_names(cls):
1390
"""Get a sequence of all interfaces supported by an object"""
1391
return (name for name in set(getattr(getattr(x, attr),
1392
"_dbus_interface", None)
1393
for x in (inspect.getmro(cls))
1394
for attr in dir(x))
1395
if name is not None)
1396
902
1397
@dbus.service.method(dbus.PROPERTIES_IFACE,
903
1398
in_signature="ss",
904
1399
out_signature="v")
912
1407
if not hasattr(value, "variant_level"):
913
1408
return value
914
1409
return type(value)(value, variant_level=value.variant_level+1)
915
1410
916
1411
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
917
1412
def Set(self, interface_name, property_name, value):
918
1413
"""Standard D-Bus property Set() method, see D-Bus standard.
927
1422
raise ValueError("Byte arrays not supported for non-"
928
1423
"'ay' signature {!r}"
929
1424
.format(prop._dbus_signature))
930
value = dbus.ByteArray(b''.join(chr(byte)
931
for byte in value))
1425
value = dbus.ByteArray(bytes(value))
932
1426
prop(value)
933
1427
934
1428
@dbus.service.method(dbus.PROPERTIES_IFACE,
935
1429
in_signature="s",
936
1430
out_signature="a{sv}")
937
1431
def GetAll(self, interface_name):
938
1432
"""Standard D-Bus property GetAll() method, see D-Bus
939
1433
standard.
940
1434
941
1435
Note: Will not include properties with access="write".
942
1436
"""
943
1437
properties = {}
954
1448
properties[name] = value
955
1449
continue
956
1450
properties[name] = type(value)(
957
value, variant_level = value.variant_level + 1)
1451
value, variant_level=value.variant_level + 1)
958
1452
return dbus.Dictionary(properties, signature="sv")
959
1453
960
1454
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
961
1455
def PropertiesChanged(self, interface_name, changed_properties,
962
1456
invalidated_properties):
964
1458
standard.
965
1459
"""
966
1460
pass
967
1461
968
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
969
1463
out_signature="s",
970
1464
path_keyword='object_path',
971
1465
connection_keyword='connection')
972
1466
def Introspect(self, object_path, connection):
973
1467
"""Overloading of standard D-Bus method.
974
1468
975
1469
Inserts property tags and interface annotation tags.
976
1470
"""
977
xmlstring = dbus.service.Object.Introspect(self, object_path,
978
connection)
1471
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1472
object_path,
1473
connection)
979
1474
try:
980
1475
document = xml.dom.minidom.parseString(xmlstring)
981
1476
982
1477
def make_tag(document, name, prop):
983
1478
e = document.createElement("property")
984
1479
e.setAttribute("name", name)
985
1480
e.setAttribute("type", prop._dbus_signature)
986
1481
e.setAttribute("access", prop._dbus_access)
987
1482
return e
988
1483
989
1484
for if_tag in document.getElementsByTagName("interface"):
990
1485
# Add property tags
991
1486
for tag in (make_tag(document, name, prop)
994
1489
if prop._dbus_interface
995
1490
== if_tag.getAttribute("name")):
996
1491
if_tag.appendChild(tag)
997
# Add annotation tags
998
for typ in ("method", "signal", "property"):
999
for tag in if_tag.getElementsByTagName(typ):
1000
annots = dict()
1001
for name, prop in (self.
1002
_get_all_dbus_things(typ)):
1003
if (name == tag.getAttribute("name")
1004
and prop._dbus_interface
1005
== if_tag.getAttribute("name")):
1006
annots.update(getattr(
1007
prop, "_dbus_annotations", {}))
1008
for name, value in annots.items():
1009
ann_tag = document.createElement(
1010
"annotation")
1011
ann_tag.setAttribute("name", name)
1012
ann_tag.setAttribute("value", value)
1013
tag.appendChild(ann_tag)
1014
# Add interface annotation tags
1015
for annotation, value in dict(
1016
itertools.chain.from_iterable(
1017
annotations().items()
1018
for name, annotations
1019
in self._get_all_dbus_things("interface")
1020
if name == if_tag.getAttribute("name")
1021
)).items():
1022
ann_tag = document.createElement("annotation")
1023
ann_tag.setAttribute("name", annotation)
1024
ann_tag.setAttribute("value", value)
1025
if_tag.appendChild(ann_tag)
1492
# Add annotation tags for properties
1493
for tag in if_tag.getElementsByTagName("property"):
1494
annots = dict()
1495
for name, prop in self._get_all_dbus_things(
1496
"property"):
1497
if (name == tag.getAttribute("name")
1498
and prop._dbus_interface
1499
== if_tag.getAttribute("name")):
1500
annots.update(getattr(
1501
prop, "_dbus_annotations", {}))
1502
for name, value in annots.items():
1503
ann_tag = document.createElement(
1504
"annotation")
1505
ann_tag.setAttribute("name", name)
1506
ann_tag.setAttribute("value", value)
1507
tag.appendChild(ann_tag)
1026
1508
# Add the names to the return values for the
1027
1509
# "org.freedesktop.DBus.Properties" methods
1028
1510
if (if_tag.getAttribute("name")
1047
1529
return xmlstring
1048
1530
1049
1531
1532
try:
1533
dbus.OBJECT_MANAGER_IFACE
1534
except AttributeError:
1535
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1536
1537
1538
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1539
"""A D-Bus object with an ObjectManager.
1540
1541
Classes inheriting from this exposes the standard
1542
GetManagedObjects call and the InterfacesAdded and
1543
InterfacesRemoved signals on the standard
1544
"org.freedesktop.DBus.ObjectManager" interface.
1545
1546
Note: No signals are sent automatically; they must be sent
1547
manually.
1548
"""
1549
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1550
out_signature="a{oa{sa{sv}}}")
1551
def GetManagedObjects(self):
1552
"""This function must be overridden"""
1553
raise NotImplementedError()
1554
1555
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1556
signature="oa{sa{sv}}")
1557
def InterfacesAdded(self, object_path, interfaces_and_properties):
1558
pass
1559
1560
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1561
def InterfacesRemoved(self, object_path, interfaces):
1562
pass
1563
1564
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1565
out_signature="s",
1566
path_keyword='object_path',
1567
connection_keyword='connection')
1568
def Introspect(self, object_path, connection):
1569
"""Overloading of standard D-Bus method.
1570
1571
Override return argument name of GetManagedObjects to be
1572
"objpath_interfaces_and_properties"
1573
"""
1574
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1575
object_path,
1576
connection)
1577
try:
1578
document = xml.dom.minidom.parseString(xmlstring)
1579
1580
for if_tag in document.getElementsByTagName("interface"):
1581
# Fix argument name for the GetManagedObjects method
1582
if (if_tag.getAttribute("name")
1583
== dbus.OBJECT_MANAGER_IFACE):
1584
for cn in if_tag.getElementsByTagName("method"):
1585
if (cn.getAttribute("name")
1586
== "GetManagedObjects"):
1587
for arg in cn.getElementsByTagName("arg"):
1588
if (arg.getAttribute("direction")
1589
== "out"):
1590
arg.setAttribute(
1591
"name",
1592
"objpath_interfaces"
1593
"_and_properties")
1594
xmlstring = document.toxml("utf-8")
1595
document.unlink()
1596
except (AttributeError, xml.dom.DOMException,
1597
xml.parsers.expat.ExpatError) as error:
1598
logger.error("Failed to override Introspection method",
1599
exc_info=error)
1600
return xmlstring
1601
1602
1050
1603
def datetime_to_dbus(dt, variant_level=0):
1051
1604
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1052
1605
if dt is None:
1053
return dbus.String("", variant_level = variant_level)
1606
return dbus.String("", variant_level=variant_level)
1054
1607
return dbus.String(dt.isoformat(), variant_level=variant_level)
1055
1608
1056
1609
1059
1612
dbus.service.Object, it will add alternate D-Bus attributes with
1060
1613
interface names according to the "alt_interface_names" mapping.
1061
1614
Usage:
1062
1615
1063
1616
@alternate_dbus_interfaces({"org.example.Interface":
1064
1617
"net.example.AlternateInterface"})
1065
1618
class SampleDBusObject(dbus.service.Object):
1066
1619
@dbus.service.method("org.example.Interface")
1067
1620
def SampleDBusMethod():
1068
1621
pass
1069
1622
1070
1623
The above "SampleDBusMethod" on "SampleDBusObject" will be
1071
1624
reachable via two interfaces: "org.example.Interface" and
1072
1625
"net.example.AlternateInterface", the latter of which will have
1073
1626
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1074
1627
"true", unless "deprecate" is passed with a False value.
1075
1628
1076
1629
This works for methods and signals, and also for D-Bus properties
1077
1630
(from DBusObjectWithProperties) and interfaces (from the
1078
1631
dbus_interface_annotations decorator).
1079
1632
"""
1080
1633
1081
1634
def wrapper(cls):
1082
1635
for orig_interface_name, alt_interface_name in (
1083
1636
alt_interface_names.items()):
1100
1653
if getattr(attribute, "_dbus_is_signal", False):
1101
1654
# Extract the original non-method undecorated
1102
1655
# function by black magic
1103
nonmethod_func = (dict(
1104
zip(attribute.func_code.co_freevars,
1105
attribute.__closure__))
1106
["func"].cell_contents)
1656
if sys.version_info.major == 2:
1657
nonmethod_func = (dict(
1658
zip(attribute.func_code.co_freevars,
1659
attribute.__closure__))
1660
["func"].cell_contents)
1661
else:
1662
nonmethod_func = (dict(
1663
zip(attribute.__code__.co_freevars,
1664
attribute.__closure__))
1665
["func"].cell_contents)
1107
1666
# Create a new, but exactly alike, function
1108
1667
# object, and decorate it to be a new D-Bus signal
1109
1668
# with the alternate D-Bus interface name
1669
new_function = copy_function(nonmethod_func)
1110
1670
new_function = (dbus.service.signal(
1111
alt_interface, attribute._dbus_signature)
1112
(types.FunctionType(
1113
nonmethod_func.func_code,
1114
nonmethod_func.func_globals,
1115
nonmethod_func.func_name,
1116
nonmethod_func.func_defaults,
1117
nonmethod_func.func_closure)))
1671
alt_interface,
1672
attribute._dbus_signature)(new_function))
1118
1673
# Copy annotations, if any
1119
1674
try:
1120
1675
new_function._dbus_annotations = dict(
1121
1676
attribute._dbus_annotations)
1122
1677
except AttributeError:
1123
1678
pass
1679
1124
1680
# Define a creator of a function to call both the
1125
1681
# original and alternate functions, so both the
1126
1682
# original and alternate signals gets sent when
1129
1685
"""This function is a scope container to pass
1130
1686
func1 and func2 to the "call_both" function
1131
1687
outside of its arguments"""
1132
1688
1689
@functools.wraps(func2)
1133
1690
def call_both(*args, **kwargs):
1134
1691
"""This function will emit two D-Bus
1135
1692
signals by calling func1 and func2"""
1136
1693
func1(*args, **kwargs)
1137
1694
func2(*args, **kwargs)
1138
1695
# Make wrapper function look like a D-Bus
1696
# signal
1697
for name, attr in inspect.getmembers(func2):
1698
if name.startswith("_dbus_"):
1699
setattr(call_both, name, attr)
1700
1139
1701
return call_both
1140
1702
# Create the "call_both" function and add it to
1141
1703
# the class
1151
1713
alt_interface,
1152
1714
attribute._dbus_in_signature,
1153
1715
attribute._dbus_out_signature)
1154
(types.FunctionType(attribute.func_code,
1155
attribute.func_globals,
1156
attribute.func_name,
1157
attribute.func_defaults,
1158
attribute.func_closure)))
1716
(copy_function(attribute)))
1159
1717
# Copy annotations, if any
1160
1718
try:
1161
1719
attr[attrname]._dbus_annotations = dict(
1173
1731
attribute._dbus_access,
1174
1732
attribute._dbus_get_args_options
1175
1733
["byte_arrays"])
1176
(types.FunctionType(
1177
attribute.func_code,
1178
attribute.func_globals,
1179
attribute.func_name,
1180
attribute.func_defaults,
1181
attribute.func_closure)))
1734
(copy_function(attribute)))
1182
1735
# Copy annotations, if any
1183
1736
try:
1184
1737
attr[attrname]._dbus_annotations = dict(
1193
1746
# to the class.
1194
1747
attr[attrname] = (
1195
1748
dbus_interface_annotations(alt_interface)
1196
(types.FunctionType(attribute.func_code,
1197
attribute.func_globals,
1198
attribute.func_name,
1199
attribute.func_defaults,
1200
attribute.func_closure)))
1749
(copy_function(attribute)))
1201
1750
if deprecate:
1202
1751
# Deprecate all alternate interfaces
1203
iname="_AlternateDBusNames_interface_annotation{}"
1752
iname = "_AlternateDBusNames_interface_annotation{}"
1204
1753
for interface_name in interface_names:
1205
1754
1206
1755
@dbus_interface_annotations(interface_name)
1207
1756
def func(self):
1208
return { "org.freedesktop.DBus.Deprecated":
1209
"true" }
1757
return {"org.freedesktop.DBus.Deprecated":
1758
"true"}
1210
1759
# Find an unused name
1211
1760
for aname in (iname.format(i)
1212
1761
for i in itertools.count()):
1216
1765
if interface_names:
1217
1766
# Replace the class with a new subclass of it with
1218
1767
# methods, signals, etc. as created above.
1219
cls = type(b"{}Alternate".format(cls.__name__),
1220
(cls, ), attr)
1768
if sys.version_info.major == 2:
1769
cls = type(b"{}Alternate".format(cls.__name__),
1770
(cls, ), attr)
1771
else:
1772
cls = type("{}Alternate".format(cls.__name__),
1773
(cls, ), attr)
1221
1774
return cls
1222
1775
1223
1776
return wrapper
1224
1777
1225
1778
1227
1780
"se.bsnet.fukt.Mandos"})
1228
1781
class ClientDBus(Client, DBusObjectWithProperties):
1229
1782
"""A Client class using D-Bus
1230
1783
1231
1784
Attributes:
1232
1785
dbus_object_path: dbus.ObjectPath
1233
1786
bus: dbus.SystemBus()
1234
1787
"""
1235
1788
1236
1789
runtime_expansions = (Client.runtime_expansions
1237
1790
+ ("dbus_object_path", ))
1238
1791
1239
1792
_interface = "se.recompile.Mandos.Client"
1240
1793
1241
1794
# dbus.service.Object doesn't use super(), so we can't either.
1242
1243
def __init__(self, bus = None, *args, **kwargs):
1795
1796
def __init__(self, bus=None, *args, **kwargs):
1244
1797
self.bus = bus
1245
1798
Client.__init__(self, *args, **kwargs)
1246
1799
# Only now, when this client is initialized, can it show up on
1252
1805
"/clients/" + client_object_name)
1253
1806
DBusObjectWithProperties.__init__(self, self.bus,
1254
1807
self.dbus_object_path)
1255
1808
1256
1809
def notifychangeproperty(transform_func, dbus_name,
1257
1810
type_func=lambda x: x,
1258
1811
variant_level=1,
1260
1813
_interface=_interface):
1261
1814
""" Modify a variable so that it's a property which announces
1262
1815
its changes to DBus.
1263
1816
1264
1817
transform_fun: Function that takes a value and a variant_level
1265
1818
and transforms it to a D-Bus type.
1266
1819
dbus_name: D-Bus name of the variable
1269
1822
variant_level: D-Bus variant level. Default: 1
1270
1823
"""
1271
1824
attrname = "_{}".format(dbus_name)
1272
1825
1273
1826
def setter(self, value):
1274
1827
if hasattr(self, "dbus_object_path"):
1275
1828
if (not hasattr(self, attrname) or
1282
1835
else:
1283
1836
dbus_value = transform_func(
1284
1837
type_func(value),
1285
variant_level = variant_level)
1838
variant_level=variant_level)
1286
1839
self.PropertyChanged(dbus.String(dbus_name),
1287
1840
dbus_value)
1288
1841
self.PropertiesChanged(
1289
1842
_interface,
1290
dbus.Dictionary({ dbus.String(dbus_name):
1291
dbus_value }),
1843
dbus.Dictionary({dbus.String(dbus_name):
1844
dbus_value}),
1292
1845
dbus.Array())
1293
1846
setattr(self, attrname, value)
1294
1847
1295
1848
return property(lambda self: getattr(self, attrname), setter)
1296
1849
1297
1850
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1298
1851
approvals_pending = notifychangeproperty(dbus.Boolean,
1299
1852
"ApprovalPending",
1300
type_func = bool)
1853
type_func=bool)
1301
1854
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1302
1855
last_enabled = notifychangeproperty(datetime_to_dbus,
1303
1856
"LastEnabled")
1304
1857
checker = notifychangeproperty(
1305
1858
dbus.Boolean, "CheckerRunning",
1306
type_func = lambda checker: checker is not None)
1859
type_func=lambda checker: checker is not None)
1307
1860
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1308
1861
"LastCheckedOK")
1309
1862
last_checker_status = notifychangeproperty(dbus.Int16,
1314
1867
"ApprovedByDefault")
1315
1868
approval_delay = notifychangeproperty(
1316
1869
dbus.UInt64, "ApprovalDelay",
1317
type_func = lambda td: td.total_seconds() * 1000)
1870
type_func=lambda td: td.total_seconds() * 1000)
1318
1871
approval_duration = notifychangeproperty(
1319
1872
dbus.UInt64, "ApprovalDuration",
1320
type_func = lambda td: td.total_seconds() * 1000)
1873
type_func=lambda td: td.total_seconds() * 1000)
1321
1874
host = notifychangeproperty(dbus.String, "Host")
1322
1875
timeout = notifychangeproperty(
1323
1876
dbus.UInt64, "Timeout",
1324
type_func = lambda td: td.total_seconds() * 1000)
1877
type_func=lambda td: td.total_seconds() * 1000)
1325
1878
extended_timeout = notifychangeproperty(
1326
1879
dbus.UInt64, "ExtendedTimeout",
1327
type_func = lambda td: td.total_seconds() * 1000)
1880
type_func=lambda td: td.total_seconds() * 1000)
1328
1881
interval = notifychangeproperty(
1329
1882
dbus.UInt64, "Interval",
1330
type_func = lambda td: td.total_seconds() * 1000)
1883
type_func=lambda td: td.total_seconds() * 1000)
1331
1884
checker_command = notifychangeproperty(dbus.String, "Checker")
1332
1885
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1333
1886
invalidate_only=True)
1334
1887
1335
1888
del notifychangeproperty
1336
1889
1337
1890
def __del__(self, *args, **kwargs):
1338
1891
try:
1339
1892
self.remove_from_connection()
1342
1895
if hasattr(DBusObjectWithProperties, "__del__"):
1343
1896
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1344
1897
Client.__del__(self, *args, **kwargs)
1345
1898
1346
1899
def checker_callback(self, source, condition,
1347
(connection, command), *args, **kwargs):
1900
connection, command, *args, **kwargs):
1348
1901
ret = Client.checker_callback(self, source, condition,
1349
(connection, command), *args,
1902
connection, command, *args,
1350
1903
**kwargs)
1351
1904
exitstatus = self.last_checker_status
1352
1905
if exitstatus >= 0:
1353
1906
# Emit D-Bus signal
1354
1907
self.CheckerCompleted(dbus.Int16(exitstatus),
1355
dbus.Int64(0),
1908
# This is specific to GNU libC
1909
dbus.Int64(exitstatus << 8),
1356
1910
dbus.String(command))
1357
1911
else:
1358
1912
# Emit D-Bus signal
1359
1913
self.CheckerCompleted(dbus.Int16(-1),
1360
1914
dbus.Int64(
1361
self.last_checker_signal),
1915
# This is specific to GNU libC
1916
(exitstatus << 8)
1917
| self.last_checker_signal),
1362
1918
dbus.String(command))
1363
1919
return ret
1364
1920
1365
1921
def start_checker(self, *args, **kwargs):
1366
1922
old_checker_pid = getattr(self.checker, "pid", None)
1367
1923
r = Client.start_checker(self, *args, **kwargs)
1371
1927
# Emit D-Bus signal
1372
1928
self.CheckerStarted(self.current_checker_command)
1373
1929
return r
1374
1930
1375
1931
def _reset_approved(self):
1376
1932
self.approved = None
1377
1933
return False
1378
1934
1379
1935
def approve(self, value=True):
1380
1936
self.approved = value
1381
gobject.timeout_add(int(self.approval_duration.total_seconds()
1382
* 1000), self._reset_approved)
1937
GLib.timeout_add(int(self.approval_duration.total_seconds()
1938
* 1000), self._reset_approved)
1383
1939
self.send_changedstate()
1384
1385
## D-Bus methods, signals & properties
1386
1387
## Interfaces
1388
1389
## Signals
1390
1940
1941
# D-Bus methods, signals & properties
1942
1943
# Interfaces
1944
1945
# Signals
1946
1391
1947
# CheckerCompleted - signal
1392
1948
@dbus.service.signal(_interface, signature="nxs")
1393
1949
def CheckerCompleted(self, exitcode, waitstatus, command):
1394
1950
"D-Bus signal"
1395
1951
pass
1396
1952
1397
1953
# CheckerStarted - signal
1398
1954
@dbus.service.signal(_interface, signature="s")
1399
1955
def CheckerStarted(self, command):
1400
1956
"D-Bus signal"
1401
1957
pass
1402
1958
1403
1959
# PropertyChanged - signal
1404
1960
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1405
1961
@dbus.service.signal(_interface, signature="sv")
1406
1962
def PropertyChanged(self, property, value):
1407
1963
"D-Bus signal"
1408
1964
pass
1409
1965
1410
1966
# GotSecret - signal
1411
1967
@dbus.service.signal(_interface)
1412
1968
def GotSecret(self):
1415
1971
server to mandos-client
1416
1972
"""
1417
1973
pass
1418
1974
1419
1975
# Rejected - signal
1420
1976
@dbus.service.signal(_interface, signature="s")
1421
1977
def Rejected(self, reason):
1422
1978
"D-Bus signal"
1423
1979
pass
1424
1980
1425
1981
# NeedApproval - signal
1426
1982
@dbus.service.signal(_interface, signature="tb")
1427
1983
def NeedApproval(self, timeout, default):
1428
1984
"D-Bus signal"
1429
1985
return self.need_approval()
1430
1431
## Methods
1432
1986
1987
# Methods
1988
1433
1989
# Approve - method
1434
1990
@dbus.service.method(_interface, in_signature="b")
1435
1991
def Approve(self, value):
1436
1992
self.approve(value)
1437
1993
1438
1994
# CheckedOK - method
1439
1995
@dbus.service.method(_interface)
1440
1996
def CheckedOK(self):
1441
1997
self.checked_ok()
1442
1998
1443
1999
# Enable - method
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
2001
@dbus.service.method(_interface)
1445
2002
def Enable(self):
1446
2003
"D-Bus method"
1447
2004
self.enable()
1448
2005
1449
2006
# StartChecker - method
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
2008
@dbus.service.method(_interface)
1451
2009
def StartChecker(self):
1452
2010
"D-Bus method"
1453
2011
self.start_checker()
1454
2012
1455
2013
# Disable - method
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1456
2015
@dbus.service.method(_interface)
1457
2016
def Disable(self):
1458
2017
"D-Bus method"
1459
2018
self.disable()
1460
2019
1461
2020
# StopChecker - method
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1462
2022
@dbus.service.method(_interface)
1463
2023
def StopChecker(self):
1464
2024
self.stop_checker()
1465
1466
## Properties
1467
2025
2026
# Properties
2027
1468
2028
# ApprovalPending - property
1469
2029
@dbus_service_property(_interface, signature="b", access="read")
1470
2030
def ApprovalPending_dbus_property(self):
1471
2031
return dbus.Boolean(bool(self.approvals_pending))
1472
2032
1473
2033
# ApprovedByDefault - property
1474
2034
@dbus_service_property(_interface,
1475
2035
signature="b",
1478
2038
if value is None: # get
1479
2039
return dbus.Boolean(self.approved_by_default)
1480
2040
self.approved_by_default = bool(value)
1481
2041
1482
2042
# ApprovalDelay - property
1483
2043
@dbus_service_property(_interface,
1484
2044
signature="t",
1488
2048
return dbus.UInt64(self.approval_delay.total_seconds()
1489
2049
* 1000)
1490
2050
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1491
2051
1492
2052
# ApprovalDuration - property
1493
2053
@dbus_service_property(_interface,
1494
2054
signature="t",
1498
2058
return dbus.UInt64(self.approval_duration.total_seconds()
1499
2059
* 1000)
1500
2060
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1501
2061
1502
2062
# Name - property
2063
@dbus_annotations(
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1503
2065
@dbus_service_property(_interface, signature="s", access="read")
1504
2066
def Name_dbus_property(self):
1505
2067
return dbus.String(self.name)
1506
2068
2069
# KeyID - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2072
@dbus_service_property(_interface, signature="s", access="read")
2073
def KeyID_dbus_property(self):
2074
return dbus.String(self.key_id)
2075
1507
2076
# Fingerprint - property
2077
@dbus_annotations(
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1508
2079
@dbus_service_property(_interface, signature="s", access="read")
1509
2080
def Fingerprint_dbus_property(self):
1510
2081
return dbus.String(self.fingerprint)
1511
2082
1512
2083
# Host - property
1513
2084
@dbus_service_property(_interface,
1514
2085
signature="s",
1517
2088
if value is None: # get
1518
2089
return dbus.String(self.host)
1519
2090
self.host = str(value)
1520
2091
1521
2092
# Created - property
2093
@dbus_annotations(
2094
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1522
2095
@dbus_service_property(_interface, signature="s", access="read")
1523
2096
def Created_dbus_property(self):
1524
2097
return datetime_to_dbus(self.created)
1525
2098
1526
2099
# LastEnabled - property
1527
2100
@dbus_service_property(_interface, signature="s", access="read")
1528
2101
def LastEnabled_dbus_property(self):
1529
2102
return datetime_to_dbus(self.last_enabled)
1530
2103
1531
2104
# Enabled - property
1532
2105
@dbus_service_property(_interface,
1533
2106
signature="b",
1539
2112
self.enable()
1540
2113
else:
1541
2114
self.disable()
1542
2115
1543
2116
# LastCheckedOK - property
1544
2117
@dbus_service_property(_interface,
1545
2118
signature="s",
1549
2122
self.checked_ok()
1550
2123
return
1551
2124
return datetime_to_dbus(self.last_checked_ok)
1552
2125
1553
2126
# LastCheckerStatus - property
1554
2127
@dbus_service_property(_interface, signature="n", access="read")
1555
2128
def LastCheckerStatus_dbus_property(self):
1556
2129
return dbus.Int16(self.last_checker_status)
1557
2130
1558
2131
# Expires - property
1559
2132
@dbus_service_property(_interface, signature="s", access="read")
1560
2133
def Expires_dbus_property(self):
1561
2134
return datetime_to_dbus(self.expires)
1562
2135
1563
2136
# LastApprovalRequest - property
1564
2137
@dbus_service_property(_interface, signature="s", access="read")
1565
2138
def LastApprovalRequest_dbus_property(self):
1566
2139
return datetime_to_dbus(self.last_approval_request)
1567
2140
1568
2141
# Timeout - property
1569
2142
@dbus_service_property(_interface,
1570
2143
signature="t",
1585
2158
if (getattr(self, "disable_initiator_tag", None)
1586
2159
is None):
1587
2160
return
1588
gobject.source_remove(self.disable_initiator_tag)
1589
self.disable_initiator_tag = gobject.timeout_add(
2161
GLib.source_remove(self.disable_initiator_tag)
2162
self.disable_initiator_tag = GLib.timeout_add(
1590
2163
int((self.expires - now).total_seconds() * 1000),
1591
2164
self.disable)
1592
2165
1593
2166
# ExtendedTimeout - property
1594
2167
@dbus_service_property(_interface,
1595
2168
signature="t",
1599
2172
return dbus.UInt64(self.extended_timeout.total_seconds()
1600
2173
* 1000)
1601
2174
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1602
2175
1603
2176
# Interval - property
1604
2177
@dbus_service_property(_interface,
1605
2178
signature="t",
1612
2185
return
1613
2186
if self.enabled:
1614
2187
# Reschedule checker run
1615
gobject.source_remove(self.checker_initiator_tag)
1616
self.checker_initiator_tag = gobject.timeout_add(
2188
GLib.source_remove(self.checker_initiator_tag)
2189
self.checker_initiator_tag = GLib.timeout_add(
1617
2190
value, self.start_checker)
1618
self.start_checker() # Start one now, too
1619
2191
self.start_checker() # Start one now, too
2192
1620
2193
# Checker - property
1621
2194
@dbus_service_property(_interface,
1622
2195
signature="s",
1625
2198
if value is None: # get
1626
2199
return dbus.String(self.checker_command)
1627
2200
self.checker_command = str(value)
1628
2201
1629
2202
# CheckerRunning - property
1630
2203
@dbus_service_property(_interface,
1631
2204
signature="b",
1637
2210
self.start_checker()
1638
2211
else:
1639
2212
self.stop_checker()
1640
2213
1641
2214
# ObjectPath - property
2215
@dbus_annotations(
2216
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2217
"org.freedesktop.DBus.Deprecated": "true"})
1642
2218
@dbus_service_property(_interface, signature="o", access="read")
1643
2219
def ObjectPath_dbus_property(self):
1644
return self.dbus_object_path # is already a dbus.ObjectPath
1645
2220
return self.dbus_object_path # is already a dbus.ObjectPath
2221
1646
2222
# Secret = property
2223
@dbus_annotations(
2224
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2225
"invalidates"})
1647
2226
@dbus_service_property(_interface,
1648
2227
signature="ay",
1649
2228
access="write",
1650
2229
byte_arrays=True)
1651
2230
def Secret_dbus_property(self, value):
1652
2231
self.secret = bytes(value)
1653
2232
1654
2233
del _interface
1655
2234
1656
2235
1657
class ProxyClient(object):
1658
def __init__(self, child_pipe, fpr, address):
2236
class ProxyClient:
2237
def __init__(self, child_pipe, key_id, fpr, address):
1659
2238
self._pipe = child_pipe
1660
self._pipe.send(('init', fpr, address))
2239
self._pipe.send(('init', key_id, fpr, address))
1661
2240
if not self._pipe.recv():
1662
raise KeyError()
1663
2241
raise KeyError(key_id or fpr)
2242
1664
2243
def __getattribute__(self, name):
1665
2244
if name == '_pipe':
1666
2245
return super(ProxyClient, self).__getattribute__(name)
1669
2248
if data[0] == 'data':
1670
2249
return data[1]
1671
2250
if data[0] == 'function':
1672
2251
1673
2252
def func(*args, **kwargs):
1674
2253
self._pipe.send(('funcall', name, args, kwargs))
1675
2254
return self._pipe.recv()[1]
1676
2255
1677
2256
return func
1678
2257
1679
2258
def __setattr__(self, name, value):
1680
2259
if name == '_pipe':
1681
2260
return super(ProxyClient, self).__setattr__(name, value)
1684
2263
1685
2264
class ClientHandler(socketserver.BaseRequestHandler, object):
1686
2265
"""A class to handle client connections.
1687
2266
1688
2267
Instantiated once for each connection to handle it.
1689
2268
Note: This will run in its own forked process."""
1690
2269
1691
2270
def handle(self):
1692
2271
with contextlib.closing(self.server.child_pipe) as child_pipe:
1693
2272
logger.info("TCP connection from: %s",
1694
2273
str(self.client_address))
1695
2274
logger.debug("Pipe FD: %d",
1696
2275
self.server.child_pipe.fileno())
1697
1698
session = gnutls.connection.ClientSession(
1699
self.request, gnutls.connection .X509Credentials())
1700
1701
# Note: gnutls.connection.X509Credentials is really a
1702
# generic GnuTLS certificate credentials object so long as
1703
# no X.509 keys are added to it. Therefore, we can use it
1704
# here despite using OpenPGP certificates.
1705
1706
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1707
# "+AES-256-CBC", "+SHA1",
1708
# "+COMP-NULL", "+CTYPE-OPENPGP",
1709
# "+DHE-DSS"))
2276
2277
session = gnutls.ClientSession(self.request)
2278
2279
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2280
# "+AES-256-CBC", "+SHA1",
2281
# "+COMP-NULL", "+CTYPE-OPENPGP",
2282
# "+DHE-DSS"))
1710
2283
# Use a fallback default, since this MUST be set.
1711
2284
priority = self.server.gnutls_priority
1712
2285
if priority is None:
1713
2286
priority = "NORMAL"
1714
gnutls.library.functions.gnutls_priority_set_direct(
1715
session._c_object, priority, None)
1716
2287
gnutls.priority_set_direct(session._c_object,
2288
priority.encode("utf-8"),
2289
None)
2290
1717
2291
# Start communication using the Mandos protocol
1718
2292
# Get protocol number
1719
2293
line = self.request.makefile().readline()
1724
2298
except (ValueError, IndexError, RuntimeError) as error:
1725
2299
logger.error("Unknown protocol version: %s", error)
1726
2300
return
1727
2301
1728
2302
# Start GnuTLS connection
1729
2303
try:
1730
2304
session.handshake()
1731
except gnutls.errors.GNUTLSError as error:
2305
except gnutls.Error as error:
1732
2306
logger.warning("Handshake failed: %s", error)
1733
2307
# Do not run session.bye() here: the session is not
1734
2308
# established. Just abandon the request.
1735
2309
return
1736
2310
logger.debug("Handshake succeeded")
1737
2311
1738
2312
approval_required = False
1739
2313
try:
1740
try:
1741
fpr = self.fingerprint(
1742
self.peer_certificate(session))
1743
except (TypeError,
1744
gnutls.errors.GNUTLSError) as error:
1745
logger.warning("Bad certificate: %s", error)
1746
return
1747
logger.debug("Fingerprint: %s", fpr)
1748
1749
try:
1750
client = ProxyClient(child_pipe, fpr,
2314
if gnutls.has_rawpk:
2315
fpr = b""
2316
try:
2317
key_id = self.key_id(
2318
self.peer_certificate(session))
2319
except (TypeError, gnutls.Error) as error:
2320
logger.warning("Bad certificate: %s", error)
2321
return
2322
logger.debug("Key ID: %s", key_id)
2323
2324
else:
2325
key_id = b""
2326
try:
2327
fpr = self.fingerprint(
2328
self.peer_certificate(session))
2329
except (TypeError, gnutls.Error) as error:
2330
logger.warning("Bad certificate: %s", error)
2331
return
2332
logger.debug("Fingerprint: %s", fpr)
2333
2334
try:
2335
client = ProxyClient(child_pipe, key_id, fpr,
1751
2336
self.client_address)
1752
2337
except KeyError:
1753
2338
return
1754
2339
1755
2340
if client.approval_delay:
1756
2341
delay = client.approval_delay
1757
2342
client.approvals_pending += 1
1758
2343
approval_required = True
1759
2344
1760
2345
while True:
1761
2346
if not client.enabled:
1762
2347
logger.info("Client %s is disabled",
1765
2350
# Emit D-Bus signal
1766
2351
client.Rejected("Disabled")
1767
2352
return
1768
2353
1769
2354
if client.approved or not client.approval_delay:
1770
#We are approved or approval is disabled
2355
# We are approved or approval is disabled
1771
2356
break
1772
2357
elif client.approved is None:
1773
2358
logger.info("Client %s needs approval",
1784
2369
# Emit D-Bus signal
1785
2370
client.Rejected("Denied")
1786
2371
return
1787
1788
#wait until timeout or approved
2372
2373
# wait until timeout or approved
1789
2374
time = datetime.datetime.now()
1790
2375
client.changedstate.acquire()
1791
2376
client.changedstate.wait(delay.total_seconds())
1804
2389
break
1805
2390
else:
1806
2391
delay -= time2 - time
1807
1808
sent_size = 0
1809
while sent_size < len(client.secret):
1810
try:
1811
sent = session.send(client.secret[sent_size:])
1812
except gnutls.errors.GNUTLSError as error:
1813
logger.warning("gnutls send failed",
1814
exc_info=error)
1815
return
1816
logger.debug("Sent: %d, remaining: %d", sent,
1817
len(client.secret) - (sent_size
1818
+ sent))
1819
sent_size += sent
1820
2392
2393
try:
2394
session.send(client.secret)
2395
except gnutls.Error as error:
2396
logger.warning("gnutls send failed",
2397
exc_info=error)
2398
return
2399
1821
2400
logger.info("Sending secret to %s", client.name)
1822
2401
# bump the timeout using extended_timeout
1823
2402
client.bump_timeout(client.extended_timeout)
1824
2403
if self.server.use_dbus:
1825
2404
# Emit D-Bus signal
1826
2405
client.GotSecret()
1827
2406
1828
2407
finally:
1829
2408
if approval_required:
1830
2409
client.approvals_pending -= 1
1831
2410
try:
1832
2411
session.bye()
1833
except gnutls.errors.GNUTLSError as error:
2412
except gnutls.Error as error:
1834
2413
logger.warning("GnuTLS bye failed",
1835
2414
exc_info=error)
1836
2415
1837
2416
@staticmethod
1838
2417
def peer_certificate(session):
1839
"Return the peer's OpenPGP certificate as a bytestring"
1840
# If not an OpenPGP certificate...
1841
if (gnutls.library.functions.gnutls_certificate_type_get(
1842
session._c_object)
1843
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1844
# ...do the normal thing
1845
return session.peer_certificate
2418
"Return the peer's certificate as a bytestring"
2419
try:
2420
cert_type = gnutls.certificate_type_get2(session._c_object,
2421
gnutls.CTYPE_PEERS)
2422
except AttributeError:
2423
cert_type = gnutls.certificate_type_get(session._c_object)
2424
if gnutls.has_rawpk:
2425
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2426
else:
2427
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2428
# If not a valid certificate type...
2429
if cert_type not in valid_cert_types:
2430
logger.info("Cert type %r not in %r", cert_type,
2431
valid_cert_types)
2432
# ...return invalid data
2433
return b""
1846
2434
list_size = ctypes.c_uint(1)
1847
cert_list = (gnutls.library.functions
1848
.gnutls_certificate_get_peers
2435
cert_list = (gnutls.certificate_get_peers
1849
2436
(session._c_object, ctypes.byref(list_size)))
1850
2437
if not bool(cert_list) and list_size.value != 0:
1851
raise gnutls.errors.GNUTLSError("error getting peer"
1852
" certificate")
2438
raise gnutls.Error("error getting peer certificate")
1853
2439
if list_size.value == 0:
1854
2440
return None
1855
2441
cert = cert_list[0]
1856
2442
return ctypes.string_at(cert.data, cert.size)
1857
2443
2444
@staticmethod
2445
def key_id(certificate):
2446
"Convert a certificate bytestring to a hexdigit key ID"
2447
# New GnuTLS "datum" with the public key
2448
datum = gnutls.datum_t(
2449
ctypes.cast(ctypes.c_char_p(certificate),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.c_uint(len(certificate)))
2452
# XXX all these need to be created in the gnutls "module"
2453
# New empty GnuTLS certificate
2454
pubkey = gnutls.pubkey_t()
2455
gnutls.pubkey_init(ctypes.byref(pubkey))
2456
# Import the raw public key into the certificate
2457
gnutls.pubkey_import(pubkey,
2458
ctypes.byref(datum),
2459
gnutls.X509_FMT_DER)
2460
# New buffer for the key ID
2461
buf = ctypes.create_string_buffer(32)
2462
buf_len = ctypes.c_size_t(len(buf))
2463
# Get the key ID from the raw public key into the buffer
2464
gnutls.pubkey_get_key_id(pubkey,
2465
gnutls.KEYID_USE_SHA256,
2466
ctypes.cast(ctypes.byref(buf),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.byref(buf_len))
2469
# Deinit the certificate
2470
gnutls.pubkey_deinit(pubkey)
2471
2472
# Convert the buffer to a Python bytestring
2473
key_id = ctypes.string_at(buf, buf_len.value)
2474
# Convert the bytestring to hexadecimal notation
2475
hex_key_id = binascii.hexlify(key_id).upper()
2476
return hex_key_id
2477
1858
2478
@staticmethod
1859
2479
def fingerprint(openpgp):
1860
2480
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1861
2481
# New GnuTLS "datum" with the OpenPGP public key
1862
datum = gnutls.library.types.gnutls_datum_t(
2482
datum = gnutls.datum_t(
1863
2483
ctypes.cast(ctypes.c_char_p(openpgp),
1864
2484
ctypes.POINTER(ctypes.c_ubyte)),
1865
2485
ctypes.c_uint(len(openpgp)))
1866
2486
# New empty GnuTLS certificate
1867
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1868
gnutls.library.functions.gnutls_openpgp_crt_init(
1869
ctypes.byref(crt))
2487
crt = gnutls.openpgp_crt_t()
2488
gnutls.openpgp_crt_init(ctypes.byref(crt))
1870
2489
# Import the OpenPGP public key into the certificate
1871
gnutls.library.functions.gnutls_openpgp_crt_import(
1872
crt, ctypes.byref(datum),
1873
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2490
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2491
gnutls.OPENPGP_FMT_RAW)
1874
2492
# Verify the self signature in the key
1875
2493
crtverify = ctypes.c_uint()
1876
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1877
crt, 0, ctypes.byref(crtverify))
2494
gnutls.openpgp_crt_verify_self(crt, 0,
2495
ctypes.byref(crtverify))
1878
2496
if crtverify.value != 0:
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1880
raise gnutls.errors.CertificateSecurityError(
1881
"Verify failed")
2497
gnutls.openpgp_crt_deinit(crt)
2498
raise gnutls.CertificateSecurityError(code
2499
=crtverify.value)
1882
2500
# New buffer for the fingerprint
1883
2501
buf = ctypes.create_string_buffer(20)
1884
2502
buf_len = ctypes.c_size_t()
1885
2503
# Get the fingerprint from the certificate into the buffer
1886
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1887
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2504
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2505
ctypes.byref(buf_len))
1888
2506
# Deinit the certificate
1889
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2507
gnutls.openpgp_crt_deinit(crt)
1890
2508
# Convert the buffer to a Python bytestring
1891
2509
fpr = ctypes.string_at(buf, buf_len.value)
1892
2510
# Convert the bytestring to hexadecimal notation
1894
2512
return hex_fpr
1895
2513
1896
2514
1897
class MultiprocessingMixIn(object):
2515
class MultiprocessingMixIn:
1898
2516
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1899
2517
1900
2518
def sub_process_main(self, request, address):
1901
2519
try:
1902
2520
self.finish_request(request, address)
1903
2521
except Exception:
1904
2522
self.handle_error(request, address)
1905
2523
self.close_request(request)
1906
2524
1907
2525
def process_request(self, request, address):
1908
2526
"""Start a new process to process the request."""
1909
proc = multiprocessing.Process(target = self.sub_process_main,
1910
args = (request, address))
2527
proc = multiprocessing.Process(target=self.sub_process_main,
2528
args=(request, address))
1911
2529
proc.start()
1912
2530
return proc
1913
2531
1914
2532
1915
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2533
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1916
2534
""" adds a pipe to the MixIn """
1917
2535
1918
2536
def process_request(self, request, client_address):
1919
2537
"""Overrides and wraps the original process_request().
1920
2538
1921
2539
This function creates a new pipe in self.pipe
1922
2540
"""
1923
2541
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1924
2542
1925
2543
proc = MultiprocessingMixIn.process_request(self, request,
1926
2544
client_address)
1927
2545
self.child_pipe.close()
1928
2546
self.add_pipe(parent_pipe, proc)
1929
2547
1930
2548
def add_pipe(self, parent_pipe, proc):
1931
2549
"""Dummy function; override as necessary"""
1932
2550
raise NotImplementedError()
1933
2551
1934
2552
1935
2553
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1936
socketserver.TCPServer, object):
2554
socketserver.TCPServer):
1937
2555
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1938
2556
1939
2557
Attributes:
1940
2558
enabled: Boolean; whether this server is activated yet
1941
2559
interface: None or a network interface name (string)
1942
2560
use_ipv6: Boolean; to use IPv6 or not
1943
2561
"""
1944
2562
1945
2563
def __init__(self, server_address, RequestHandlerClass,
1946
2564
interface=None,
1947
2565
use_ipv6=True,
1957
2575
self.socketfd = socketfd
1958
2576
# Save the original socket.socket() function
1959
2577
self.socket_socket = socket.socket
2578
1960
2579
# To implement --socket, we monkey patch socket.socket.
1961
#
2580
#
1962
2581
# (When socketserver.TCPServer is a new-style class, we
1963
2582
# could make self.socket into a property instead of monkey
1964
2583
# patching socket.socket.)
1965
#
2584
#
1966
2585
# Create a one-time-only replacement for socket.socket()
1967
2586
@functools.wraps(socket.socket)
1968
2587
def socket_wrapper(*args, **kwargs):
1980
2599
# socket_wrapper(), if socketfd was set.
1981
2600
socketserver.TCPServer.__init__(self, server_address,
1982
2601
RequestHandlerClass)
1983
2602
1984
2603
def server_bind(self):
1985
2604
"""This overrides the normal server_bind() function
1986
2605
to bind to an interface if one was specified, and also NOT to
1987
2606
bind to an address or port if they were not specified."""
2607
global SO_BINDTODEVICE
1988
2608
if self.interface is not None:
1989
2609
if SO_BINDTODEVICE is None:
1990
logger.error("SO_BINDTODEVICE does not exist;"
1991
" cannot bind to interface %s",
1992
self.interface)
1993
else:
1994
try:
1995
self.socket.setsockopt(
1996
socket.SOL_SOCKET, SO_BINDTODEVICE,
1997
(self.interface + "\0").encode("utf-8"))
1998
except socket.error as error:
1999
if error.errno == errno.EPERM:
2000
logger.error("No permission to bind to"
2001
" interface %s", self.interface)
2002
elif error.errno == errno.ENOPROTOOPT:
2003
logger.error("SO_BINDTODEVICE not available;"
2004
" cannot bind to interface %s",
2005
self.interface)
2006
elif error.errno == errno.ENODEV:
2007
logger.error("Interface %s does not exist,"
2008
" cannot bind", self.interface)
2009
else:
2010
raise
2610
# Fall back to a hard-coded value which seems to be
2611
# common enough.
2612
logger.warning("SO_BINDTODEVICE not found, trying 25")
2613
SO_BINDTODEVICE = 25
2614
try:
2615
self.socket.setsockopt(
2616
socket.SOL_SOCKET, SO_BINDTODEVICE,
2617
(self.interface + "\0").encode("utf-8"))
2618
except socket.error as error:
2619
if error.errno == errno.EPERM:
2620
logger.error("No permission to bind to"
2621
" interface %s", self.interface)
2622
elif error.errno == errno.ENOPROTOOPT:
2623
logger.error("SO_BINDTODEVICE not available;"
2624
" cannot bind to interface %s",
2625
self.interface)
2626
elif error.errno == errno.ENODEV:
2627
logger.error("Interface %s does not exist,"
2628
" cannot bind", self.interface)
2629
else:
2630
raise
2011
2631
# Only bind(2) the socket if we really need to.
2012
2632
if self.server_address[0] or self.server_address[1]:
2633
if self.server_address[1]:
2634
self.allow_reuse_address = True
2013
2635
if not self.server_address[0]:
2014
2636
if self.address_family == socket.AF_INET6:
2015
any_address = "::" # in6addr_any
2637
any_address = "::" # in6addr_any
2016
2638
else:
2017
any_address = "0.0.0.0" # INADDR_ANY
2639
any_address = "0.0.0.0" # INADDR_ANY
2018
2640
self.server_address = (any_address,
2019
2641
self.server_address[1])
2020
2642
elif not self.server_address[1]:
2030
2652
2031
2653
class MandosServer(IPv6_TCPServer):
2032
2654
"""Mandos server.
2033
2655
2034
2656
Attributes:
2035
2657
clients: set of Client objects
2036
2658
gnutls_priority GnuTLS priority string
2037
2659
use_dbus: Boolean; to emit D-Bus signals or not
2038
2039
Assumes a gobject.MainLoop event loop.
2660
2661
Assumes a GLib.MainLoop event loop.
2040
2662
"""
2041
2663
2042
2664
def __init__(self, server_address, RequestHandlerClass,
2043
2665
interface=None,
2044
2666
use_ipv6=True,
2054
2676
self.gnutls_priority = gnutls_priority
2055
2677
IPv6_TCPServer.__init__(self, server_address,
2056
2678
RequestHandlerClass,
2057
interface = interface,
2058
use_ipv6 = use_ipv6,
2059
socketfd = socketfd)
2060
2679
interface=interface,
2680
use_ipv6=use_ipv6,
2681
socketfd=socketfd)
2682
2061
2683
def server_activate(self):
2062
2684
if self.enabled:
2063
2685
return socketserver.TCPServer.server_activate(self)
2064
2686
2065
2687
def enable(self):
2066
2688
self.enabled = True
2067
2689
2068
2690
def add_pipe(self, parent_pipe, proc):
2069
2691
# Call "handle_ipc" for both data and EOF events
2070
gobject.io_add_watch(
2071
parent_pipe.fileno(),
2072
gobject.IO_IN | gobject.IO_HUP,
2692
GLib.io_add_watch(
2693
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2694
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2073
2695
functools.partial(self.handle_ipc,
2074
parent_pipe = parent_pipe,
2075
proc = proc))
2076
2696
parent_pipe=parent_pipe,
2697
proc=proc))
2698
2077
2699
def handle_ipc(self, source, condition,
2078
2700
parent_pipe=None,
2079
proc = None,
2701
proc=None,
2080
2702
client_object=None):
2081
2703
# error, or the other end of multiprocessing.Pipe has closed
2082
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2704
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2083
2705
# Wait for other process to exit
2084
2706
proc.join()
2085
2707
return False
2086
2708
2087
2709
# Read a request from the child
2088
2710
request = parent_pipe.recv()
2089
2711
command = request[0]
2090
2712
2091
2713
if command == 'init':
2092
fpr = request[1]
2093
address = request[2]
2094
2095
for c in self.clients.itervalues():
2096
if c.fingerprint == fpr:
2714
key_id = request[1].decode("ascii")
2715
fpr = request[2].decode("ascii")
2716
address = request[3]
2717
2718
for c in self.clients.values():
2719
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2720
continue
2721
if key_id and c.key_id == key_id:
2722
client = c
2723
break
2724
if fpr and c.fingerprint == fpr:
2097
2725
client = c
2098
2726
break
2099
2727
else:
2100
logger.info("Client not found for fingerprint: %s, ad"
2101
"dress: %s", fpr, address)
2728
logger.info("Client not found for key ID: %s, address"
2729
": %s", key_id or fpr, address)
2102
2730
if self.use_dbus:
2103
2731
# Emit D-Bus signal
2104
mandos_dbus_service.ClientNotFound(fpr,
2732
mandos_dbus_service.ClientNotFound(key_id or fpr,
2105
2733
address[0])
2106
2734
parent_pipe.send(False)
2107
2735
return False
2108
2109
gobject.io_add_watch(
2110
parent_pipe.fileno(),
2111
gobject.IO_IN | gobject.IO_HUP,
2736
2737
GLib.io_add_watch(
2738
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2739
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2112
2740
functools.partial(self.handle_ipc,
2113
parent_pipe = parent_pipe,
2114
proc = proc,
2115
client_object = client))
2741
parent_pipe=parent_pipe,
2742
proc=proc,
2743
client_object=client))
2116
2744
parent_pipe.send(True)
2117
2745
# remove the old hook in favor of the new above hook on
2118
2746
# same fileno
2121
2749
funcname = request[1]
2122
2750
args = request[2]
2123
2751
kwargs = request[3]
2124
2752
2125
2753
parent_pipe.send(('data', getattr(client_object,
2126
2754
funcname)(*args,
2127
2755
**kwargs)))
2128
2756
2129
2757
if command == 'getattr':
2130
2758
attrname = request[1]
2131
if callable(client_object.__getattribute__(attrname)):
2759
if isinstance(client_object.__getattribute__(attrname),
2760
collections.abc.Callable):
2132
2761
parent_pipe.send(('function', ))
2133
2762
else:
2134
2763
parent_pipe.send((
2135
2764
'data', client_object.__getattribute__(attrname)))
2136
2765
2137
2766
if command == 'setattr':
2138
2767
attrname = request[1]
2139
2768
value = request[2]
2140
2769
setattr(client_object, attrname, value)
2141
2770
2142
2771
return True
2143
2772
2144
2773
2145
2774
def rfc3339_duration_to_delta(duration):
2146
2775
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2147
2148
>>> rfc3339_duration_to_delta("P7D")
2149
datetime.timedelta(7)
2150
>>> rfc3339_duration_to_delta("PT60S")
2151
datetime.timedelta(0, 60)
2152
>>> rfc3339_duration_to_delta("PT60M")
2153
datetime.timedelta(0, 3600)
2154
>>> rfc3339_duration_to_delta("PT24H")
2155
datetime.timedelta(1)
2156
>>> rfc3339_duration_to_delta("P1W")
2157
datetime.timedelta(7)
2158
>>> rfc3339_duration_to_delta("PT5M30S")
2159
datetime.timedelta(0, 330)
2160
>>> rfc3339_duration_to_delta("P1DT3M20S")
2161
datetime.timedelta(1, 200)
2776
2777
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2780
True
2781
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2782
True
2783
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2784
True
2785
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2786
True
2787
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2788
True
2789
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2790
True
2162
2791
"""
2163
2792
2164
2793
# Parsing an RFC 3339 duration with regular expressions is not
2165
2794
# possible - there would have to be multiple places for the same
2166
2795
# values, like seconds. The current code, while more esoteric, is
2167
2796
# cleaner without depending on a parsing library. If Python had a
2168
2797
# built-in library for parsing we would use it, but we'd like to
2169
2798
# avoid excessive use of external libraries.
2170
2799
2171
2800
# New type for defining tokens, syntax, and semantics all-in-one
2172
Token = collections.namedtuple("Token",
2173
("regexp", # To match token; if
2174
# "value" is not None,
2175
# must have a "group"
2176
# containing digits
2177
"value", # datetime.timedelta or
2178
# None
2179
"followers")) # Tokens valid after
2180
# this token
2181
2801
Token = collections.namedtuple("Token", (
2182
2802
"regexp", # To match token; if "value" is not None, must have
2183
2803
# a "group" containing digits
2215
2835
frozenset((token_year, token_month,
2216
2836
token_day, token_time,
2217
2837
token_week)))
2218
# Define starting values
2219
value = datetime.timedelta() # Value so far
2838
# Define starting values:
2839
# Value so far
2840
value = datetime.timedelta()
2220
2841
found_token = None
2221
followers = frozenset((token_duration,)) # Following valid tokens
2222
s = duration # String left to parse
2842
# Following valid tokens
2843
followers = frozenset((token_duration, ))
2844
# String left to parse
2845
s = duration
2223
2846
# Loop until end token is found
2224
2847
while found_token is not token_end:
2225
2848
# Search for any currently valid tokens
2241
2864
break
2242
2865
else:
2243
2866
# No currently valid tokens were found
2244
raise ValueError("Invalid RFC 3339 duration")
2867
raise ValueError("Invalid RFC 3339 duration: {!r}"
2868
.format(duration))
2245
2869
# End token found
2246
2870
return value
2247
2871
2248
2872
2249
2873
def string_to_delta(interval):
2250
2874
"""Parse a string and return a datetime.timedelta
2251
2252
>>> string_to_delta('7d')
2253
datetime.timedelta(7)
2254
>>> string_to_delta('60s')
2255
datetime.timedelta(0, 60)
2256
>>> string_to_delta('60m')
2257
datetime.timedelta(0, 3600)
2258
>>> string_to_delta('24h')
2259
datetime.timedelta(1)
2260
>>> string_to_delta('1w')
2261
datetime.timedelta(7)
2262
>>> string_to_delta('5m 30s')
2263
datetime.timedelta(0, 330)
2875
2876
>>> string_to_delta('7d') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2879
True
2880
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2881
True
2882
>>> string_to_delta('24h') == datetime.timedelta(1)
2883
True
2884
>>> string_to_delta('1w') == datetime.timedelta(7)
2885
True
2886
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2887
True
2264
2888
"""
2265
2889
2266
2890
try:
2267
2891
return rfc3339_duration_to_delta(interval)
2268
2892
except ValueError:
2269
2893
pass
2270
2894
2271
2895
timevalue = datetime.timedelta(0)
2272
2896
for s in interval.split():
2273
2897
try:
2291
2915
return timevalue
2292
2916
2293
2917
2294
def daemon(nochdir = False, noclose = False):
2918
def daemon(nochdir=False, noclose=False):
2295
2919
"""See daemon(3). Standard BSD Unix function.
2296
2920
2297
2921
This should really exist as os.daemon, but it doesn't (yet)."""
2298
2922
if os.fork():
2299
2923
sys.exit()
2317
2941
2318
2942
2319
2943
def main():
2320
2944
2321
2945
##################################################################
2322
2946
# Parsing of options, both command line and config file
2323
2947
2324
2948
parser = argparse.ArgumentParser()
2325
2949
parser.add_argument("-v", "--version", action="version",
2326
version = "%(prog)s {}".format(version),
2950
version="%(prog)s {}".format(version),
2327
2951
help="show version number and exit")
2328
2952
parser.add_argument("-i", "--interface", metavar="IF",
2329
2953
help="Bind to interface IF")
2365
2989
parser.add_argument("--no-zeroconf", action="store_false",
2366
2990
dest="zeroconf", help="Do not use Zeroconf",
2367
2991
default=None)
2368
2992
2369
2993
options = parser.parse_args()
2370
2371
if options.check:
2372
import doctest
2373
fail_count, test_count = doctest.testmod()
2374
sys.exit(os.EX_OK if fail_count == 0 else 1)
2375
2994
2376
2995
# Default values for config file for server-global settings
2377
server_defaults = { "interface": "",
2378
"address": "",
2379
"port": "",
2380
"debug": "False",
2381
"priority":
2382
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2383
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2384
"servicename": "Mandos",
2385
"use_dbus": "True",
2386
"use_ipv6": "True",
2387
"debuglevel": "",
2388
"restore": "True",
2389
"socket": "",
2390
"statedir": "/var/lib/mandos",
2391
"foreground": "False",
2392
"zeroconf": "True",
2393
}
2394
2996
if gnutls.has_rawpk:
2997
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2998
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2999
else:
3000
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3001
":+SIGN-DSA-SHA256")
3002
server_defaults = {"interface": "",
3003
"address": "",
3004
"port": "",
3005
"debug": "False",
3006
"priority": priority,
3007
"servicename": "Mandos",
3008
"use_dbus": "True",
3009
"use_ipv6": "True",
3010
"debuglevel": "",
3011
"restore": "True",
3012
"socket": "",
3013
"statedir": "/var/lib/mandos",
3014
"foreground": "False",
3015
"zeroconf": "True",
3016
}
3017
del priority
3018
2395
3019
# Parse config file for server-global settings
2396
server_config = configparser.SafeConfigParser(server_defaults)
3020
server_config = configparser.ConfigParser(server_defaults)
2397
3021
del server_defaults
2398
3022
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2399
# Convert the SafeConfigParser object to a dict
3023
# Convert the ConfigParser object to a dict
2400
3024
server_settings = server_config.defaults()
2401
3025
# Use the appropriate methods on the non-string config options
2402
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3026
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3027
"foreground", "zeroconf"):
2403
3028
server_settings[option] = server_config.getboolean("DEFAULT",
2404
3029
option)
2405
3030
if server_settings["port"]:
2415
3040
server_settings["socket"] = os.dup(server_settings
2416
3041
["socket"])
2417
3042
del server_config
2418
3043
2419
3044
# Override the settings from the config file with command line
2420
3045
# options, if set.
2421
3046
for option in ("interface", "address", "port", "debug",
2439
3064
if server_settings["debug"]:
2440
3065
server_settings["foreground"] = True
2441
3066
# Now we have our good server settings in "server_settings"
2442
3067
2443
3068
##################################################################
2444
3069
2445
3070
if (not server_settings["zeroconf"]
2446
3071
and not (server_settings["port"]
2447
3072
or server_settings["socket"] != "")):
2448
3073
parser.error("Needs port or socket to work without Zeroconf")
2449
3074
2450
3075
# For convenience
2451
3076
debug = server_settings["debug"]
2452
3077
debuglevel = server_settings["debuglevel"]
2456
3081
stored_state_file)
2457
3082
foreground = server_settings["foreground"]
2458
3083
zeroconf = server_settings["zeroconf"]
2459
3084
2460
3085
if debug:
2461
3086
initlogger(debug, logging.DEBUG)
2462
3087
else:
2465
3090
else:
2466
3091
level = getattr(logging, debuglevel.upper())
2467
3092
initlogger(debug, level)
2468
3093
2469
3094
if server_settings["servicename"] != "Mandos":
2470
3095
syslogger.setFormatter(
2471
3096
logging.Formatter('Mandos ({}) [%(process)d]:'
2472
3097
' %(levelname)s: %(message)s'.format(
2473
3098
server_settings["servicename"])))
2474
3099
2475
3100
# Parse config file with clients
2476
client_config = configparser.SafeConfigParser(Client
2477
.client_defaults)
3101
client_config = configparser.ConfigParser(Client.client_defaults)
2478
3102
client_config.read(os.path.join(server_settings["configdir"],
2479
3103
"clients.conf"))
2480
3104
2481
3105
global mandos_dbus_service
2482
3106
mandos_dbus_service = None
2483
3107
2484
3108
socketfd = None
2485
3109
if server_settings["socket"] != "":
2486
3110
socketfd = server_settings["socket"]
2498
3122
pidfilename = "/var/run/mandos.pid"
2499
3123
pidfile = None
2500
3124
try:
2501
pidfile = open(pidfilename, "w")
3125
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2502
3126
except IOError as e:
2503
3127
logger.error("Could not open file %r", pidfilename,
2504
3128
exc_info=e)
2505
2506
for name in ("_mandos", "mandos", "nobody"):
3129
3130
for name, group in (("_mandos", "_mandos"),
3131
("mandos", "mandos"),
3132
("nobody", "nogroup")):
2507
3133
try:
2508
3134
uid = pwd.getpwnam(name).pw_uid
2509
gid = pwd.getpwnam(name).pw_gid
3135
gid = pwd.getpwnam(group).pw_gid
2510
3136
break
2511
3137
except KeyError:
2512
3138
continue
2516
3142
try:
2517
3143
os.setgid(gid)
2518
3144
os.setuid(uid)
3145
if debug:
3146
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3147
gid))
2519
3148
except OSError as error:
3149
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3150
.format(uid, gid, os.strerror(error.errno)))
2520
3151
if error.errno != errno.EPERM:
2521
3152
raise
2522
3153
2523
3154
if debug:
2524
3155
# Enable all possible GnuTLS debugging
2525
3156
2526
3157
# "Use a log level over 10 to enable all debugging options."
2527
3158
# - GnuTLS manual
2528
gnutls.library.functions.gnutls_global_set_log_level(11)
2529
2530
@gnutls.library.types.gnutls_log_func
3159
gnutls.global_set_log_level(11)
3160
3161
@gnutls.log_func
2531
3162
def debug_gnutls(level, string):
2532
3163
logger.debug("GnuTLS: %s", string[:-1])
2533
2534
gnutls.library.functions.gnutls_global_set_log_function(
2535
debug_gnutls)
2536
3164
3165
gnutls.global_set_log_function(debug_gnutls)
3166
2537
3167
# Redirect stdin so all checkers get /dev/null
2538
3168
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2539
3169
os.dup2(null, sys.stdin.fileno())
2540
3170
if null > 2:
2541
3171
os.close(null)
2542
3172
2543
3173
# Need to fork before connecting to D-Bus
2544
3174
if not foreground:
2545
3175
# Close all input and output, do double fork, etc.
2546
3176
daemon()
2547
2548
# multiprocessing will use threads, so before we use gobject we
2549
# need to inform gobject that threads will be used.
2550
gobject.threads_init()
2551
3177
3178
if gi.version_info < (3, 10, 2):
3179
# multiprocessing will use threads, so before we use GLib we
3180
# need to inform GLib that threads will be used.
3181
GLib.threads_init()
3182
2552
3183
global main_loop
2553
3184
# From the Avahi example code
2554
3185
DBusGMainLoop(set_as_default=True)
2555
main_loop = gobject.MainLoop()
3186
main_loop = GLib.MainLoop()
2556
3187
bus = dbus.SystemBus()
2557
3188
# End of Avahi example code
2558
3189
if use_dbus:
2563
3194
old_bus_name = dbus.service.BusName(
2564
3195
"se.bsnet.fukt.Mandos", bus,
2565
3196
do_not_queue=True)
2566
except dbus.exceptions.NameExistsException as e:
3197
except dbus.exceptions.DBusException as e:
2567
3198
logger.error("Disabling D-Bus:", exc_info=e)
2568
3199
use_dbus = False
2569
3200
server_settings["use_dbus"] = False
2571
3202
if zeroconf:
2572
3203
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2573
3204
service = AvahiServiceToSyslog(
2574
name = server_settings["servicename"],
2575
servicetype = "_mandos._tcp",
2576
protocol = protocol,
2577
bus = bus)
3205
name=server_settings["servicename"],
3206
servicetype="_mandos._tcp",
3207
protocol=protocol,
3208
bus=bus)
2578
3209
if server_settings["interface"]:
2579
3210
service.interface = if_nametoindex(
2580
3211
server_settings["interface"].encode("utf-8"))
2581
3212
2582
3213
global multiprocessing_manager
2583
3214
multiprocessing_manager = multiprocessing.Manager()
2584
3215
2585
3216
client_class = Client
2586
3217
if use_dbus:
2587
client_class = functools.partial(ClientDBus, bus = bus)
2588
3218
client_class = functools.partial(ClientDBus, bus=bus)
3219
2589
3220
client_settings = Client.config_parser(client_config)
2590
3221
old_client_settings = {}
2591
3222
clients_data = {}
2592
3223
2593
3224
# This is used to redirect stdout and stderr for checker processes
2594
3225
global wnull
2595
wnull = open(os.devnull, "w") # A writable /dev/null
3226
wnull = open(os.devnull, "w") # A writable /dev/null
2596
3227
# Only used if server is running in foreground but not in debug
2597
3228
# mode
2598
3229
if debug or not foreground:
2599
3230
wnull.close()
2600
3231
2601
3232
# Get client data and settings from last running state.
2602
3233
if server_settings["restore"]:
2603
3234
try:
2604
3235
with open(stored_state_path, "rb") as stored_state:
2605
clients_data, old_client_settings = pickle.load(
2606
stored_state)
3236
if sys.version_info.major == 2:
3237
clients_data, old_client_settings = pickle.load(
3238
stored_state)
3239
else:
3240
bytes_clients_data, bytes_old_client_settings = (
3241
pickle.load(stored_state, encoding="bytes"))
3242
# Fix bytes to strings
3243
# clients_data
3244
# .keys()
3245
clients_data = {(key.decode("utf-8")
3246
if isinstance(key, bytes)
3247
else key): value
3248
for key, value in
3249
bytes_clients_data.items()}
3250
del bytes_clients_data
3251
for key in clients_data:
3252
value = {(k.decode("utf-8")
3253
if isinstance(k, bytes) else k): v
3254
for k, v in
3255
clients_data[key].items()}
3256
clients_data[key] = value
3257
# .client_structure
3258
value["client_structure"] = [
3259
(s.decode("utf-8")
3260
if isinstance(s, bytes)
3261
else s) for s in
3262
value["client_structure"]]
3263
# .name, .host, and .checker_command
3264
for k in ("name", "host", "checker_command"):
3265
if isinstance(value[k], bytes):
3266
value[k] = value[k].decode("utf-8")
3267
if "key_id" not in value:
3268
value["key_id"] = ""
3269
elif "fingerprint" not in value:
3270
value["fingerprint"] = ""
3271
# old_client_settings
3272
# .keys()
3273
old_client_settings = {
3274
(key.decode("utf-8")
3275
if isinstance(key, bytes)
3276
else key): value
3277
for key, value in
3278
bytes_old_client_settings.items()}
3279
del bytes_old_client_settings
3280
# .host and .checker_command
3281
for value in old_client_settings.values():
3282
for attribute in ("host", "checker_command"):
3283
if isinstance(value[attribute], bytes):
3284
value[attribute] = (value[attribute]
3285
.decode("utf-8"))
2607
3286
os.remove(stored_state_path)
2608
3287
except IOError as e:
2609
3288
if e.errno == errno.ENOENT:
2617
3296
logger.warning("Could not load persistent state: "
2618
3297
"EOFError:",
2619
3298
exc_info=e)
2620
3299
2621
3300
with PGPEngine() as pgp:
2622
3301
for client_name, client in clients_data.items():
2623
3302
# Skip removed clients
2624
3303
if client_name not in client_settings:
2625
3304
continue
2626
3305
2627
3306
# Decide which value to use after restoring saved state.
2628
3307
# We have three different values: Old config file,
2629
3308
# new config file, and saved state.
2640
3319
client[name] = value
2641
3320
except KeyError:
2642
3321
pass
2643
3322
2644
3323
# Clients who has passed its expire date can still be
2645
3324
# enabled if its last checker was successful. A Client
2646
3325
# whose checker succeeded before we stored its state is
2679
3358
client_name))
2680
3359
client["secret"] = (client_settings[client_name]
2681
3360
["secret"])
2682
3361
2683
3362
# Add/remove clients based on new changes made to config
2684
3363
for client_name in (set(old_client_settings)
2685
3364
- set(client_settings)):
2687
3366
for client_name in (set(client_settings)
2688
3367
- set(old_client_settings)):
2689
3368
clients_data[client_name] = client_settings[client_name]
2690
3369
2691
3370
# Create all client objects
2692
3371
for client_name, client in clients_data.items():
2693
3372
tcp_server.clients[client_name] = client_class(
2694
name = client_name,
2695
settings = client,
2696
server_settings = server_settings)
2697
3373
name=client_name,
3374
settings=client,
3375
server_settings=server_settings)
3376
2698
3377
if not tcp_server.clients:
2699
3378
logger.warning("No clients defined")
2700
3379
2701
3380
if not foreground:
2702
3381
if pidfile is not None:
3382
pid = os.getpid()
2703
3383
try:
2704
3384
with pidfile:
2705
pid = os.getpid()
2706
pidfile.write("{}\n".format(pid).encode("utf-8"))
3385
print(pid, file=pidfile)
2707
3386
except IOError:
2708
3387
logger.error("Could not write to file %r with PID %d",
2709
3388
pidfilename, pid)
2710
3389
del pidfile
2711
3390
del pidfilename
2712
2713
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2714
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2715
3391
3392
for termsig in (signal.SIGHUP, signal.SIGTERM):
3393
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3394
lambda: main_loop.quit() and False)
3395
2716
3396
if use_dbus:
2717
3397
2718
3398
@alternate_dbus_interfaces(
2719
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2720
class MandosDBusService(DBusObjectWithProperties):
3399
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3400
class MandosDBusService(DBusObjectWithObjectManager):
2721
3401
"""A D-Bus proxy object"""
2722
3402
2723
3403
def __init__(self):
2724
3404
dbus.service.Object.__init__(self, bus, "/")
2725
3405
2726
3406
_interface = "se.recompile.Mandos"
2727
2728
@dbus_interface_annotations(_interface)
2729
def _foo(self):
2730
return {
2731
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2732
"false" }
2733
3407
2734
3408
@dbus.service.signal(_interface, signature="o")
2735
3409
def ClientAdded(self, objpath):
2736
3410
"D-Bus signal"
2737
3411
pass
2738
3412
2739
3413
@dbus.service.signal(_interface, signature="ss")
2740
def ClientNotFound(self, fingerprint, address):
3414
def ClientNotFound(self, key_id, address):
2741
3415
"D-Bus signal"
2742
3416
pass
2743
3417
3418
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3419
"true"})
2744
3420
@dbus.service.signal(_interface, signature="os")
2745
3421
def ClientRemoved(self, objpath, name):
2746
3422
"D-Bus signal"
2747
3423
pass
2748
3424
3425
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3426
"true"})
2749
3427
@dbus.service.method(_interface, out_signature="ao")
2750
3428
def GetAllClients(self):
2751
3429
"D-Bus method"
2752
3430
return dbus.Array(c.dbus_object_path for c in
2753
tcp_server.clients.itervalues())
2754
3431
tcp_server.clients.values())
3432
3433
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3434
"true"})
2755
3435
@dbus.service.method(_interface,
2756
3436
out_signature="a{oa{sv}}")
2757
3437
def GetAllClientsWithProperties(self):
2758
3438
"D-Bus method"
2759
3439
return dbus.Dictionary(
2760
{ c.dbus_object_path: c.GetAll("")
2761
for c in tcp_server.clients.itervalues() },
3440
{c.dbus_object_path: c.GetAll(
3441
"se.recompile.Mandos.Client")
3442
for c in tcp_server.clients.values()},
2762
3443
signature="oa{sv}")
2763
3444
2764
3445
@dbus.service.method(_interface, in_signature="o")
2765
3446
def RemoveClient(self, object_path):
2766
3447
"D-Bus method"
2767
for c in tcp_server.clients.itervalues():
3448
for c in tcp_server.clients.values():
2768
3449
if c.dbus_object_path == object_path:
2769
3450
del tcp_server.clients[c.name]
2770
3451
c.remove_from_connection()
2771
# Don't signal anything except ClientRemoved
3452
# Don't signal the disabling
2772
3453
c.disable(quiet=True)
2773
# Emit D-Bus signal
2774
self.ClientRemoved(object_path, c.name)
3454
# Emit D-Bus signal for removal
3455
self.client_removed_signal(c)
2775
3456
return
2776
3457
raise KeyError(object_path)
2777
3458
2778
3459
del _interface
2779
3460
3461
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3462
out_signature="a{oa{sa{sv}}}")
3463
def GetManagedObjects(self):
3464
"""D-Bus method"""
3465
return dbus.Dictionary(
3466
{client.dbus_object_path:
3467
dbus.Dictionary(
3468
{interface: client.GetAll(interface)
3469
for interface in
3470
client._get_all_interface_names()})
3471
for client in tcp_server.clients.values()})
3472
3473
def client_added_signal(self, client):
3474
"""Send the new standard signal and the old signal"""
3475
if use_dbus:
3476
# New standard signal
3477
self.InterfacesAdded(
3478
client.dbus_object_path,
3479
dbus.Dictionary(
3480
{interface: client.GetAll(interface)
3481
for interface in
3482
client._get_all_interface_names()}))
3483
# Old signal
3484
self.ClientAdded(client.dbus_object_path)
3485
3486
def client_removed_signal(self, client):
3487
"""Send the new standard signal and the old signal"""
3488
if use_dbus:
3489
# New standard signal
3490
self.InterfacesRemoved(
3491
client.dbus_object_path,
3492
client._get_all_interface_names())
3493
# Old signal
3494
self.ClientRemoved(client.dbus_object_path,
3495
client.name)
3496
2780
3497
mandos_dbus_service = MandosDBusService()
2781
3498
3499
# Save modules to variables to exempt the modules from being
3500
# unloaded before the function registered with atexit() is run.
3501
mp = multiprocessing
3502
wn = wnull
3503
2782
3504
def cleanup():
2783
3505
"Cleanup function; run on exit"
2784
3506
if zeroconf:
2785
3507
service.cleanup()
2786
2787
multiprocessing.active_children()
2788
wnull.close()
3508
3509
mp.active_children()
3510
wn.close()
2789
3511
if not (tcp_server.clients or client_settings):
2790
3512
return
2791
3513
2792
3514
# Store client before exiting. Secrets are encrypted with key
2793
3515
# based on what config file has. If config file is
2794
3516
# removed/edited, old secret will thus be unrecovable.
2795
3517
clients = {}
2796
3518
with PGPEngine() as pgp:
2797
for client in tcp_server.clients.itervalues():
3519
for client in tcp_server.clients.values():
2798
3520
key = client_settings[client.name]["secret"]
2799
3521
client.encrypted_secret = pgp.encrypt(client.secret,
2800
3522
key)
2801
3523
client_dict = {}
2802
3524
2803
3525
# A list of attributes that can not be pickled
2804
3526
# + secret.
2805
exclude = { "bus", "changedstate", "secret",
2806
"checker", "server_settings" }
3527
exclude = {"bus", "changedstate", "secret",
3528
"checker", "server_settings"}
2807
3529
for name, typ in inspect.getmembers(dbus.service
2808
3530
.Object):
2809
3531
exclude.add(name)
2810
3532
2811
3533
client_dict["encrypted_secret"] = (client
2812
3534
.encrypted_secret)
2813
3535
for attr in client.client_structure:
2814
3536
if attr not in exclude:
2815
3537
client_dict[attr] = getattr(client, attr)
2816
3538
2817
3539
clients[client.name] = client_dict
2818
3540
del client_settings[client.name]["secret"]
2819
3541
2820
3542
try:
2821
3543
with tempfile.NamedTemporaryFile(
2822
3544
mode='wb',
2824
3546
prefix='clients-',
2825
3547
dir=os.path.dirname(stored_state_path),
2826
3548
delete=False) as stored_state:
2827
pickle.dump((clients, client_settings), stored_state)
3549
pickle.dump((clients, client_settings), stored_state,
3550
protocol=2)
2828
3551
tempname = stored_state.name
2829
3552
os.rename(tempname, stored_state_path)
2830
3553
except (IOError, OSError) as e:
2840
3563
logger.warning("Could not save persistent state:",
2841
3564
exc_info=e)
2842
3565
raise
2843
3566
2844
3567
# Delete all clients, and settings from config
2845
3568
while tcp_server.clients:
2846
3569
name, client = tcp_server.clients.popitem()
2847
3570
if use_dbus:
2848
3571
client.remove_from_connection()
2849
# Don't signal anything except ClientRemoved
3572
# Don't signal the disabling
2850
3573
client.disable(quiet=True)
3574
# Emit D-Bus signal for removal
2851
3575
if use_dbus:
2852
# Emit D-Bus signal
2853
mandos_dbus_service.ClientRemoved(
2854
client.dbus_object_path, client.name)
3576
mandos_dbus_service.client_removed_signal(client)
2855
3577
client_settings.clear()
2856
3578
2857
3579
atexit.register(cleanup)
2858
2859
for client in tcp_server.clients.itervalues():
3580
3581
for client in tcp_server.clients.values():
2860
3582
if use_dbus:
2861
# Emit D-Bus signal
2862
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3583
# Emit D-Bus signal for adding
3584
mandos_dbus_service.client_added_signal(client)
2863
3585
# Need to initiate checking of clients
2864
3586
if client.enabled:
2865
3587
client.init_checker()
2866
3588
2867
3589
tcp_server.enable()
2868
3590
tcp_server.server_activate()
2869
3591
2870
3592
# Find out what port we got
2871
3593
if zeroconf:
2872
3594
service.port = tcp_server.socket.getsockname()[1]
2877
3599
else: # IPv4
2878
3600
logger.info("Now listening on address %r, port %d",
2879
3601
*tcp_server.socket.getsockname())
2880
2881
#service.interface = tcp_server.socket.getsockname()[3]
2882
3602
3603
# service.interface = tcp_server.socket.getsockname()[3]
3604
2883
3605
try:
2884
3606
if zeroconf:
2885
3607
# From the Avahi example code
2890
3612
cleanup()
2891
3613
sys.exit(1)
2892
3614
# End of Avahi example code
2893
2894
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2895
lambda *args, **kwargs:
2896
(tcp_server.handle_request
2897
(*args[2:], **kwargs) or True))
2898
3615
3616
GLib.io_add_watch(
3617
GLib.IOChannel.unix_new(tcp_server.fileno()),
3618
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3619
lambda *args, **kwargs: (tcp_server.handle_request
3620
(*args[2:], **kwargs) or True))
3621
2899
3622
logger.debug("Starting main loop")
2900
3623
main_loop.run()
2901
3624
except AvahiError as error:
2910
3633
# Must run before the D-Bus bus name gets deregistered
2911
3634
cleanup()
2912
3635
3636
3637
def should_only_run_tests():
3638
parser = argparse.ArgumentParser(add_help=False)
3639
parser.add_argument("--check", action='store_true')
3640
args, unknown_args = parser.parse_known_args()
3641
run_tests = args.check
3642
if run_tests:
3643
# Remove --check argument from sys.argv
3644
sys.argv[1:] = unknown_args
3645
return run_tests
3646
3647
# Add all tests from doctest strings
3648
def load_tests(loader, tests, none):
3649
import doctest
3650
tests.addTests(doctest.DocTestSuite())
3651
return tests
2913
3652
2914
3653
if __name__ == '__main__':
2915
main()
3654
try:
3655
if should_only_run_tests():
3656
# Call using ./mandos --check [--verbose]
3657
unittest.main()
3658
else:
3659
main()
3660
finally:
3661
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0