To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.751
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.751
- Committer: teddy at recompile
- Date: 2020-02-07 20:53:34 UTC
- mto: This revision was merged to the branch mainline in revision 396.
- Revision ID: teddy@recompile.se-20200207205334-dp41p8c8vw0ytik5
Allow users to more easily alter mandos.service
The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable. This should be supported by the systemd
service, too.
* mandos.service ([Service]/EnvironmentFile): New; set to
"/etc/default/mandos ".
([Service]/ExecStart): Append "$DAEMON_ARGS".
The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable. This should be supported by the systemd
service, too.
* mandos.service ([Service]/EnvironmentFile): New; set to
"/etc/default/mandos ".
([Service]/ExecStart): Append "$DAEMON_ARGS".
- files added:
- bugs.xml
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
73
77
import itertools
74
78
import collections
75
79
import codecs
80
import unittest
81
import random
76
82
77
83
import dbus
78
84
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
85
import gi
86
from gi.repository import GLib
84
87
from dbus.mainloop.glib import DBusGMainLoop
85
88
import ctypes
86
89
import ctypes.util
87
90
import xml.dom.minidom
88
91
import inspect
89
92
90
try:
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
97
# Add collections.abc.Callable if it does not exist
98
try:
99
collections.abc.Callable
100
except AttributeError:
101
class abc:
102
Callable = collections.Callable
103
collections.abc = abc
104
del abc
105
106
# Show warnings by default
107
if not sys.warnoptions:
108
import warnings
109
warnings.simplefilter("default")
110
111
# Try to find the value of SO_BINDTODEVICE:
112
try:
113
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
114
# newer, and it is also the most natural place for it:
91
115
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
116
except AttributeError:
93
117
try:
118
# This is where SO_BINDTODEVICE was up to and including Python
119
# 2.6, and also 3.2:
94
120
from IN import SO_BINDTODEVICE
95
121
except ImportError:
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
122
# In Python 2.7 it seems to have been removed entirely.
123
# Try running the C preprocessor:
124
try:
125
cc = subprocess.Popen(["cc", "--language=c", "-E",
126
"/dev/stdin"],
127
stdin=subprocess.PIPE,
128
stdout=subprocess.PIPE)
129
stdout = cc.communicate(
130
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
131
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
132
except (OSError, ValueError, IndexError):
133
# No value found
134
SO_BINDTODEVICE = None
135
136
if sys.version_info < (3, 2):
137
configparser.Configparser = configparser.SafeConfigParser
138
139
version = "1.8.9"
102
140
stored_state_file = "clients.pickle"
103
141
104
142
logger = logging.getLogger()
143
logging.captureWarnings(True) # Show warnings via the logging system
105
144
syslogger = None
106
145
107
146
try:
108
147
if_nametoindex = ctypes.cdll.LoadLibrary(
109
148
ctypes.util.find_library("c")).if_nametoindex
110
149
except (OSError, AttributeError):
111
150
112
151
def if_nametoindex(interface):
113
152
"Get an interface index the hard way, i.e. using fcntl()"
114
153
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
158
return interface_index
120
159
121
160
161
def copy_function(func):
162
"""Make a copy of a function"""
163
if sys.version_info.major == 2:
164
return types.FunctionType(func.func_code,
165
func.func_globals,
166
func.func_name,
167
func.func_defaults,
168
func.func_closure)
169
else:
170
return types.FunctionType(func.__code__,
171
func.__globals__,
172
func.__name__,
173
func.__defaults__,
174
func.__closure__)
175
176
122
177
def initlogger(debug, level=logging.WARNING):
123
178
"""init logger and add loglevel"""
124
179
125
180
global syslogger
126
181
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
182
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
183
address="/dev/log"))
129
184
syslogger.setFormatter(logging.Formatter
130
185
('Mandos [%(process)d]: %(levelname)s:'
131
186
' %(message)s'))
132
187
logger.addHandler(syslogger)
133
188
134
189
if debug:
135
190
console = logging.StreamHandler()
136
191
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
201
pass
147
202
148
203
149
class PGPEngine(object):
204
class PGPEngine:
150
205
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
206
152
207
def __init__(self):
153
208
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
209
self.gpg = "gpg"
210
try:
211
output = subprocess.check_output(["gpgconf"])
212
for line in output.splitlines():
213
name, text, path = line.split(b":")
214
if name == b"gpg":
215
self.gpg = path
216
break
217
except OSError as e:
218
if e.errno != errno.ENOENT:
219
raise
154
220
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
221
'--homedir', self.tempdir,
156
222
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
223
'--quiet']
224
# Only GPG version 1 has the --no-use-agent option.
225
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
226
self.gnupgargs.append("--no-use-agent")
227
160
228
def __enter__(self):
161
229
return self
162
230
163
231
def __exit__(self, exc_type, exc_value, traceback):
164
232
self._cleanup()
165
233
return False
166
234
167
235
def __del__(self):
168
236
self._cleanup()
169
237
170
238
def _cleanup(self):
171
239
if self.tempdir is not None:
172
240
# Delete contents of tempdir
173
241
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
242
topdown=False):
175
243
for filename in files:
176
244
os.remove(os.path.join(root, filename))
177
245
for dirname in dirs:
179
247
# Remove tempdir
180
248
os.rmdir(self.tempdir)
181
249
self.tempdir = None
182
250
183
251
def password_encode(self, password):
184
252
# Passphrase can not be empty and can not contain newlines or
185
253
# NUL bytes. So we prefix it and hex encode it.
190
258
.replace(b"\n", b"\\n")
191
259
.replace(b"\0", b"\\x00"))
192
260
return encoded
193
261
194
262
def encrypt(self, data, password):
195
263
passphrase = self.password_encode(password)
196
264
with tempfile.NamedTemporaryFile(
197
265
dir=self.tempdir) as passfile:
198
266
passfile.write(passphrase)
199
267
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
268
proc = subprocess.Popen([self.gpg, '--symmetric',
201
269
'--passphrase-file',
202
270
passfile.name]
203
271
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
ciphertext, err = proc.communicate(input=data)
208
276
if proc.returncode != 0:
209
277
raise PGPError(err)
210
278
return ciphertext
211
279
212
280
def decrypt(self, data, password):
213
281
passphrase = self.password_encode(password)
214
282
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
283
dir=self.tempdir) as passfile:
216
284
passfile.write(passphrase)
217
285
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
286
proc = subprocess.Popen([self.gpg, '--decrypt',
219
287
'--passphrase-file',
220
288
passfile.name]
221
289
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
290
stdin=subprocess.PIPE,
291
stdout=subprocess.PIPE,
292
stderr=subprocess.PIPE)
293
decrypted_plaintext, err = proc.communicate(input=data)
226
294
if proc.returncode != 0:
227
295
raise PGPError(err)
228
296
return decrypted_plaintext
229
297
230
298
299
# Pretend that we have an Avahi module
300
class avahi:
301
"""This isn't so much a class as it is a module-like namespace."""
302
IF_UNSPEC = -1 # avahi-common/address.h
303
PROTO_UNSPEC = -1 # avahi-common/address.h
304
PROTO_INET = 0 # avahi-common/address.h
305
PROTO_INET6 = 1 # avahi-common/address.h
306
DBUS_NAME = "org.freedesktop.Avahi"
307
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
308
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
309
DBUS_PATH_SERVER = "/"
310
311
@staticmethod
312
def string_array_to_txt_array(t):
313
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
314
for s in t), signature="ay")
315
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
316
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
317
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
318
SERVER_INVALID = 0 # avahi-common/defs.h
319
SERVER_REGISTERING = 1 # avahi-common/defs.h
320
SERVER_RUNNING = 2 # avahi-common/defs.h
321
SERVER_COLLISION = 3 # avahi-common/defs.h
322
SERVER_FAILURE = 4 # avahi-common/defs.h
323
324
231
325
class AvahiError(Exception):
232
326
def __init__(self, value, *args, **kwargs):
233
327
self.value = value
243
337
pass
244
338
245
339
246
class AvahiService(object):
340
class AvahiService:
247
341
"""An Avahi (Zeroconf) service.
248
342
249
343
Attributes:
250
344
interface: integer; avahi.IF_UNSPEC or an interface index.
251
345
Used to optionally bind to the specified interface.
263
357
server: D-Bus Server
264
358
bus: dbus.SystemBus()
265
359
"""
266
360
267
361
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
362
interface=avahi.IF_UNSPEC,
363
name=None,
364
servicetype=None,
365
port=None,
366
TXT=None,
367
domain="",
368
host="",
369
max_renames=32768,
370
protocol=avahi.PROTO_UNSPEC,
371
bus=None):
278
372
self.interface = interface
279
373
self.name = name
280
374
self.type = servicetype
289
383
self.server = None
290
384
self.bus = bus
291
385
self.entry_group_state_changed_match = None
292
386
293
387
def rename(self, remove=True):
294
388
"""Derived from the Avahi example code"""
295
389
if self.rename_count >= self.max_renames:
315
409
logger.critical("D-Bus Exception", exc_info=error)
316
410
self.cleanup()
317
411
os._exit(1)
318
412
319
413
def remove(self):
320
414
"""Derived from the Avahi example code"""
321
415
if self.entry_group_state_changed_match is not None:
323
417
self.entry_group_state_changed_match = None
324
418
if self.group is not None:
325
419
self.group.Reset()
326
420
327
421
def add(self):
328
422
"""Derived from the Avahi example code"""
329
423
self.remove()
346
440
dbus.UInt16(self.port),
347
441
avahi.string_array_to_txt_array(self.TXT))
348
442
self.group.Commit()
349
443
350
444
def entry_group_state_changed(self, state, error):
351
445
"""Derived from the Avahi example code"""
352
446
logger.debug("Avahi entry group state change: %i", state)
353
447
354
448
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
449
logger.debug("Zeroconf service established.")
356
450
elif state == avahi.ENTRY_GROUP_COLLISION:
360
454
logger.critical("Avahi: Error in group state changed %s",
361
455
str(error))
362
456
raise AvahiGroupError("State changed: {!s}".format(error))
363
457
364
458
def cleanup(self):
365
459
"""Derived from the Avahi example code"""
366
460
if self.group is not None:
371
465
pass
372
466
self.group = None
373
467
self.remove()
374
468
375
469
def server_state_changed(self, state, error=None):
376
470
"""Derived from the Avahi example code"""
377
471
logger.debug("Avahi server state change: %i", state)
406
500
logger.debug("Unknown state: %r", state)
407
501
else:
408
502
logger.debug("Unknown state: %r: %r", state, error)
409
503
410
504
def activate(self):
411
505
"""Derived from the Avahi example code"""
412
506
if self.server is None:
423
517
class AvahiServiceToSyslog(AvahiService):
424
518
def rename(self, *args, **kwargs):
425
519
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
520
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
427
521
syslogger.setFormatter(logging.Formatter(
428
522
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
523
.format(self.name)))
430
524
return ret
431
525
526
432
527
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
528
class gnutls:
529
"""This isn't so much a class as it is a module-like namespace."""
530
531
library = ctypes.util.find_library("gnutls")
532
if library is None:
533
library = ctypes.util.find_library("gnutls-deb0")
534
_library = ctypes.cdll.LoadLibrary(library)
535
del library
536
448
537
# Unless otherwise indicated, the constants and types below are
449
538
# all from the gnutls/gnutls.h C header file.
450
539
451
540
# Constants
452
541
E_SUCCESS = 0
453
542
E_INTERRUPTED = -52
454
543
E_AGAIN = -28
455
544
CRT_OPENPGP = 2
545
CRT_RAWPK = 3
456
546
CLIENT = 2
457
547
SHUT_RDWR = 0
458
548
CRD_CERTIFICATE = 1
459
549
E_NO_CERTIFICATE_FOUND = -49
550
X509_FMT_DER = 0
551
NO_TICKETS = 1<<10
552
ENABLE_RAWPK = 1<<18
553
CTYPE_PEERS = 3
554
KEYID_USE_SHA256 = 1 # gnutls/x509.h
460
555
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
556
462
557
# Types
463
558
class session_int(ctypes.Structure):
464
559
_fields_ = []
465
560
session_t = ctypes.POINTER(session_int)
561
466
562
class certificate_credentials_st(ctypes.Structure):
467
563
_fields_ = []
468
564
certificate_credentials_t = ctypes.POINTER(
469
565
certificate_credentials_st)
470
566
certificate_type_t = ctypes.c_int
567
471
568
class datum_t(ctypes.Structure):
472
569
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
570
('size', ctypes.c_uint)]
571
474
572
class openpgp_crt_int(ctypes.Structure):
475
573
_fields_ = []
476
574
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
575
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
576
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
577
credentials_type_t = ctypes.c_int
480
578
transport_ptr_t = ctypes.c_void_p
481
579
close_request_t = ctypes.c_int
482
580
483
581
# Exceptions
484
582
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
583
def __init__(self, message=None, code=None, args=()):
490
584
# Default usage is by a message string, but if a return
491
585
# code is passed, convert it to a string with
492
586
# gnutls.strerror()
493
587
self.code = code
494
588
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
589
message = gnutls.strerror(code)
590
return super(gnutls.Error, self).__init__(
497
591
message, *args)
498
592
499
593
class CertificateSecurityError(Error):
500
594
pass
501
595
502
596
# Classes
503
class Credentials(object):
597
class Credentials:
504
598
def __init__(self):
505
599
self._c_object = gnutls.certificate_credentials_t()
506
600
gnutls.certificate_allocate_credentials(
507
601
ctypes.byref(self._c_object))
508
602
self.type = gnutls.CRD_CERTIFICATE
509
603
510
604
def __del__(self):
511
605
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
606
607
class ClientSession:
608
def __init__(self, socket, credentials=None):
515
609
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
610
gnutls_flags = gnutls.CLIENT
611
if gnutls.check_version(b"3.5.6"):
612
gnutls_flags |= gnutls.NO_TICKETS
613
if gnutls.has_rawpk:
614
gnutls_flags |= gnutls.ENABLE_RAWPK
615
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
616
del gnutls_flags
517
617
gnutls.set_default_priority(self._c_object)
518
618
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
619
gnutls.handshake_set_private_extensions(self._c_object,
525
625
ctypes.cast(credentials._c_object,
526
626
ctypes.c_void_p))
527
627
self.credentials = credentials
528
628
529
629
def __del__(self):
530
630
gnutls.deinit(self._c_object)
531
631
532
632
def handshake(self):
533
633
return gnutls.handshake(self._c_object)
534
634
535
635
def send(self, data):
536
636
data = bytes(data)
537
637
data_len = len(data)
539
639
data_len -= gnutls.record_send(self._c_object,
540
640
data[-data_len:],
541
641
data_len)
542
642
543
643
def bye(self):
544
644
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
645
546
646
# Error handling functions
547
647
def _error_code(result):
548
648
"""A function to raise exceptions on errors, suitable
550
650
if result >= 0:
551
651
return result
552
652
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
653
raise gnutls.CertificateSecurityError(code=result)
654
raise gnutls.Error(code=result)
655
556
656
def _retry_on_error(result, func, arguments):
557
657
"""A function to retry on some errors, suitable
558
658
for the 'errcheck' attribute on ctypes functions"""
561
661
return _error_code(result)
562
662
result = func(*arguments)
563
663
return result
564
664
565
665
# Unless otherwise indicated, the function declarations below are
566
666
# all from the gnutls/gnutls.h C header file.
567
667
568
668
# Functions
569
669
priority_set_direct = _library.gnutls_priority_set_direct
570
670
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
671
ctypes.POINTER(ctypes.c_char_p)]
572
672
priority_set_direct.restype = _error_code
573
673
574
674
init = _library.gnutls_init
575
675
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
676
init.restype = _error_code
577
677
578
678
set_default_priority = _library.gnutls_set_default_priority
579
679
set_default_priority.argtypes = [session_t]
580
680
set_default_priority.restype = _error_code
581
681
582
682
record_send = _library.gnutls_record_send
583
683
record_send.argtypes = [session_t, ctypes.c_void_p,
584
684
ctypes.c_size_t]
585
685
record_send.restype = ctypes.c_ssize_t
586
686
record_send.errcheck = _retry_on_error
587
687
588
688
certificate_allocate_credentials = (
589
689
_library.gnutls_certificate_allocate_credentials)
590
690
certificate_allocate_credentials.argtypes = [
591
691
ctypes.POINTER(certificate_credentials_t)]
592
692
certificate_allocate_credentials.restype = _error_code
593
693
594
694
certificate_free_credentials = (
595
695
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
696
certificate_free_credentials.argtypes = [
697
certificate_credentials_t]
597
698
certificate_free_credentials.restype = None
598
699
599
700
handshake_set_private_extensions = (
600
701
_library.gnutls_handshake_set_private_extensions)
601
702
handshake_set_private_extensions.argtypes = [session_t,
602
703
ctypes.c_int]
603
704
handshake_set_private_extensions.restype = None
604
705
605
706
credentials_set = _library.gnutls_credentials_set
606
707
credentials_set.argtypes = [session_t, credentials_type_t,
607
708
ctypes.c_void_p]
608
709
credentials_set.restype = _error_code
609
710
610
711
strerror = _library.gnutls_strerror
611
712
strerror.argtypes = [ctypes.c_int]
612
713
strerror.restype = ctypes.c_char_p
613
714
614
715
certificate_type_get = _library.gnutls_certificate_type_get
615
716
certificate_type_get.argtypes = [session_t]
616
717
certificate_type_get.restype = _error_code
617
718
618
719
certificate_get_peers = _library.gnutls_certificate_get_peers
619
720
certificate_get_peers.argtypes = [session_t,
620
721
ctypes.POINTER(ctypes.c_uint)]
621
722
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
723
623
724
global_set_log_level = _library.gnutls_global_set_log_level
624
725
global_set_log_level.argtypes = [ctypes.c_int]
625
726
global_set_log_level.restype = None
626
727
627
728
global_set_log_function = _library.gnutls_global_set_log_function
628
729
global_set_log_function.argtypes = [log_func]
629
730
global_set_log_function.restype = None
630
731
631
732
deinit = _library.gnutls_deinit
632
733
deinit.argtypes = [session_t]
633
734
deinit.restype = None
634
735
635
736
handshake = _library.gnutls_handshake
636
737
handshake.argtypes = [session_t]
637
738
handshake.restype = _error_code
638
739
handshake.errcheck = _retry_on_error
639
740
640
741
transport_set_ptr = _library.gnutls_transport_set_ptr
641
742
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
743
transport_set_ptr.restype = None
643
744
644
745
bye = _library.gnutls_bye
645
746
bye.argtypes = [session_t, close_request_t]
646
747
bye.restype = _error_code
647
748
bye.errcheck = _retry_on_error
648
749
649
750
check_version = _library.gnutls_check_version
650
751
check_version.argtypes = [ctypes.c_char_p]
651
752
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
753
754
_need_version = b"3.3.0"
755
if check_version(_need_version) is None:
756
raise self.Error("Needs GnuTLS {} or later"
757
.format(_need_version))
758
759
_tls_rawpk_version = b"3.6.6"
760
has_rawpk = bool(check_version(_tls_rawpk_version))
761
762
if has_rawpk:
763
# Types
764
class pubkey_st(ctypes.Structure):
765
_fields = []
766
pubkey_t = ctypes.POINTER(pubkey_st)
767
768
x509_crt_fmt_t = ctypes.c_int
769
770
# All the function declarations below are from gnutls/abstract.h
771
pubkey_init = _library.gnutls_pubkey_init
772
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
773
pubkey_init.restype = _error_code
774
775
pubkey_import = _library.gnutls_pubkey_import
776
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
777
x509_crt_fmt_t]
778
pubkey_import.restype = _error_code
779
780
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
781
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
782
ctypes.POINTER(ctypes.c_ubyte),
783
ctypes.POINTER(ctypes.c_size_t)]
784
pubkey_get_key_id.restype = _error_code
785
786
pubkey_deinit = _library.gnutls_pubkey_deinit
787
pubkey_deinit.argtypes = [pubkey_t]
788
pubkey_deinit.restype = None
789
else:
790
# All the function declarations below are from gnutls/openpgp.h
791
792
openpgp_crt_init = _library.gnutls_openpgp_crt_init
793
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
794
openpgp_crt_init.restype = _error_code
795
796
openpgp_crt_import = _library.gnutls_openpgp_crt_import
797
openpgp_crt_import.argtypes = [openpgp_crt_t,
798
ctypes.POINTER(datum_t),
799
openpgp_crt_fmt_t]
800
openpgp_crt_import.restype = _error_code
801
802
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
803
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
804
ctypes.POINTER(ctypes.c_uint)]
805
openpgp_crt_verify_self.restype = _error_code
806
807
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
808
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
809
openpgp_crt_deinit.restype = None
810
811
openpgp_crt_get_fingerprint = (
812
_library.gnutls_openpgp_crt_get_fingerprint)
813
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
814
ctypes.c_void_p,
815
ctypes.POINTER(
816
ctypes.c_size_t)]
817
openpgp_crt_get_fingerprint.restype = _error_code
818
819
if check_version(b"3.6.4"):
820
certificate_type_get2 = _library.gnutls_certificate_type_get2
821
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
822
certificate_type_get2.restype = _error_code
823
682
824
# Remove non-public functions
683
825
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
826
686
827
687
828
def call_pipe(connection, # : multiprocessing.Connection
688
829
func, *args, **kwargs):
689
830
"""This function is meant to be called by multiprocessing.Process
690
831
691
832
This function runs func(*args, **kwargs), and writes the resulting
692
833
return value on the provided multiprocessing.Connection.
693
834
"""
694
835
connection.send(func(*args, **kwargs))
695
836
connection.close()
696
837
697
class Client(object):
838
839
class Client:
698
840
"""A representation of a client host served by this server.
699
841
700
842
Attributes:
701
843
approved: bool(); 'None' if not yet approved/disapproved
702
844
approval_delay: datetime.timedelta(); Time to wait for approval
703
845
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
846
checker: multiprocessing.Process(); a running checker process used
847
to see if the client lives. 'None' if no process is
848
running.
849
checker_callback_tag: a GLib event source tag, or None
708
850
checker_command: string; External command which is run to check
709
851
if client lives. %() expansions are done at
710
852
runtime with vars(self) as dict, so that for
711
853
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
854
checker_initiator_tag: a GLib event source tag, or None
713
855
created: datetime.datetime(); (UTC) object creation
714
856
client_structure: Object describing what attributes a client has
715
857
and is used for storing the client at exit
716
858
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
859
disable_initiator_tag: a GLib event source tag, or None
718
860
enabled: bool()
719
861
fingerprint: string (40 or 32 hexadecimal digits); used to
720
uniquely identify the client
862
uniquely identify an OpenPGP client
863
key_id: string (64 hexadecimal digits); used to uniquely identify
864
a client using raw public keys
721
865
host: string; available for use by the checker command
722
866
interval: datetime.timedelta(); How often to start a new checker
723
867
last_approval_request: datetime.datetime(); (UTC) or None
739
883
disabled, or None
740
884
server_settings: The server_settings dict from main()
741
885
"""
742
886
743
887
runtime_expansions = ("approval_delay", "approval_duration",
744
"created", "enabled", "expires",
888
"created", "enabled", "expires", "key_id",
745
889
"fingerprint", "host", "interval",
746
890
"last_approval_request", "last_checked_ok",
747
891
"last_enabled", "name", "timeout")
756
900
"approved_by_default": "True",
757
901
"enabled": "True",
758
902
}
759
903
760
904
@staticmethod
761
905
def config_parser(config):
762
906
"""Construct a new dict of client settings of this form:
769
913
for client_name in config.sections():
770
914
section = dict(config.items(client_name))
771
915
client = settings[client_name] = {}
772
916
773
917
client["host"] = section["host"]
774
918
# Reformat values from string types to Python types
775
919
client["approved_by_default"] = config.getboolean(
776
920
client_name, "approved_by_default")
777
921
client["enabled"] = config.getboolean(client_name,
778
922
"enabled")
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
923
924
# Uppercase and remove spaces from key_id and fingerprint
925
# for later comparison purposes with return value from the
926
# key_id() and fingerprint() functions
927
client["key_id"] = (section.get("key_id", "").upper()
928
.replace(" ", ""))
783
929
client["fingerprint"] = (section["fingerprint"].upper()
784
930
.replace(" ", ""))
785
931
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
932
client["secret"] = codecs.decode(section["secret"]
933
.encode("utf-8"),
934
"base64")
787
935
elif "secfile" in section:
788
936
with open(os.path.expanduser(os.path.expandvars
789
937
(section["secfile"])),
804
952
client["last_approval_request"] = None
805
953
client["last_checked_ok"] = None
806
954
client["last_checker_status"] = -2
807
955
808
956
return settings
809
810
def __init__(self, settings, name = None, server_settings=None):
957
958
def __init__(self, settings, name=None, server_settings=None):
811
959
self.name = name
812
960
if server_settings is None:
813
961
server_settings = {}
815
963
# adding all client settings
816
964
for setting, value in settings.items():
817
965
setattr(self, setting, value)
818
966
819
967
if self.enabled:
820
968
if not hasattr(self, "last_enabled"):
821
969
self.last_enabled = datetime.datetime.utcnow()
825
973
else:
826
974
self.last_enabled = None
827
975
self.expires = None
828
976
829
977
logger.debug("Creating client %r", self.name)
978
logger.debug(" Key ID: %s", self.key_id)
830
979
logger.debug(" Fingerprint: %s", self.fingerprint)
831
980
self.created = settings.get("created",
832
981
datetime.datetime.utcnow())
833
982
834
983
# attributes specific for this server instance
835
984
self.checker = None
836
985
self.checker_initiator_tag = None
842
991
self.changedstate = multiprocessing_manager.Condition(
843
992
multiprocessing_manager.Lock())
844
993
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
994
for attr in self.__dict__.keys()
846
995
if not attr.startswith("_")]
847
996
self.client_structure.append("client_structure")
848
997
849
998
for name, t in inspect.getmembers(
850
999
type(self), lambda obj: isinstance(obj, property)):
851
1000
if not name.startswith("_"):
852
1001
self.client_structure.append(name)
853
1002
854
1003
# Send notice to process children that client state has changed
855
1004
def send_changedstate(self):
856
1005
with self.changedstate:
857
1006
self.changedstate.notify_all()
858
1007
859
1008
def enable(self):
860
1009
"""Start this client's checker and timeout hooks"""
861
1010
if getattr(self, "enabled", False):
866
1015
self.last_enabled = datetime.datetime.utcnow()
867
1016
self.init_checker()
868
1017
self.send_changedstate()
869
1018
870
1019
def disable(self, quiet=True):
871
1020
"""Disable this client."""
872
1021
if not getattr(self, "enabled", False):
874
1023
if not quiet:
875
1024
logger.info("Disabling client %s", self.name)
876
1025
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
1026
GLib.source_remove(self.disable_initiator_tag)
878
1027
self.disable_initiator_tag = None
879
1028
self.expires = None
880
1029
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
1030
GLib.source_remove(self.checker_initiator_tag)
882
1031
self.checker_initiator_tag = None
883
1032
self.stop_checker()
884
1033
self.enabled = False
885
1034
if not quiet:
886
1035
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
1036
# Do not run this again if called by a GLib.timeout_add
888
1037
return False
889
1038
890
1039
def __del__(self):
891
1040
self.disable()
892
1041
893
1042
def init_checker(self):
894
1043
# Schedule a new checker to be started an 'interval' from now,
895
1044
# and every interval from then on.
896
1045
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
1046
GLib.source_remove(self.checker_initiator_tag)
1047
self.checker_initiator_tag = GLib.timeout_add(
1048
random.randrange(int(self.interval.total_seconds() * 1000
1049
+ 1)),
900
1050
self.start_checker)
901
1051
# Schedule a disable() when 'timeout' has passed
902
1052
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
1053
GLib.source_remove(self.disable_initiator_tag)
1054
self.disable_initiator_tag = GLib.timeout_add(
905
1055
int(self.timeout.total_seconds() * 1000), self.disable)
906
1056
# Also start a new checker *right now*.
907
1057
self.start_checker()
908
1058
909
1059
def checker_callback(self, source, condition, connection,
910
1060
command):
911
1061
"""The checker has completed, so take appropriate actions."""
912
self.checker_callback_tag = None
913
self.checker = None
914
1062
# Read return code from connection (see call_pipe)
915
1063
returncode = connection.recv()
916
1064
connection.close()
917
1065
if self.checker is not None:
1066
self.checker.join()
1067
self.checker_callback_tag = None
1068
self.checker = None
1069
918
1070
if returncode >= 0:
919
1071
self.last_checker_status = returncode
920
1072
self.last_checker_signal = None
930
1082
logger.warning("Checker for %(name)s crashed?",
931
1083
vars(self))
932
1084
return False
933
1085
934
1086
def checked_ok(self):
935
1087
"""Assert that the client has been seen, alive and well."""
936
1088
self.last_checked_ok = datetime.datetime.utcnow()
937
1089
self.last_checker_status = 0
938
1090
self.last_checker_signal = None
939
1091
self.bump_timeout()
940
1092
941
1093
def bump_timeout(self, timeout=None):
942
1094
"""Bump up the timeout for this client."""
943
1095
if timeout is None:
944
1096
timeout = self.timeout
945
1097
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1098
GLib.source_remove(self.disable_initiator_tag)
947
1099
self.disable_initiator_tag = None
948
1100
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1101
self.disable_initiator_tag = GLib.timeout_add(
950
1102
int(timeout.total_seconds() * 1000), self.disable)
951
1103
self.expires = datetime.datetime.utcnow() + timeout
952
1104
953
1105
def need_approval(self):
954
1106
self.last_approval_request = datetime.datetime.utcnow()
955
1107
956
1108
def start_checker(self):
957
1109
"""Start a new checker subprocess if one is not running.
958
1110
959
1111
If a checker already exists, leave it running and do
960
1112
nothing."""
961
1113
# The reason for not killing a running checker is that if we
966
1118
# checkers alone, the checker would have to take more time
967
1119
# than 'timeout' for the client to be disabled, which is as it
968
1120
# should be.
969
1121
970
1122
if self.checker is not None and not self.checker.is_alive():
971
1123
logger.warning("Checker was not alive; joining")
972
1124
self.checker.join()
976
1128
# Escape attributes for the shell
977
1129
escaped_attrs = {
978
1130
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
1131
for attr in self.runtime_expansions}
980
1132
try:
981
1133
command = self.checker_command % escaped_attrs
982
1134
except TypeError as error:
994
1146
# The exception is when not debugging but nevertheless
995
1147
# running in the foreground; use the previously
996
1148
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1149
popen_args = {"close_fds": True,
1150
"shell": True,
1151
"cwd": "/"}
1000
1152
if (not self.server_settings["debug"]
1001
1153
and self.server_settings["foreground"]):
1002
1154
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1155
"stderr": wnull})
1156
pipe = multiprocessing.Pipe(duplex=False)
1005
1157
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1158
target=call_pipe,
1159
args=(pipe[1], subprocess.call, command),
1160
kwargs=popen_args)
1009
1161
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1162
self.checker_callback_tag = GLib.io_add_watch(
1163
GLib.IOChannel.unix_new(pipe[0].fileno()),
1164
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1012
1165
self.checker_callback, pipe[0], command)
1013
# Re-run this periodically if run by gobject.timeout_add
1166
# Re-run this periodically if run by GLib.timeout_add
1014
1167
return True
1015
1168
1016
1169
def stop_checker(self):
1017
1170
"""Force the checker process, if any, to stop."""
1018
1171
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1172
GLib.source_remove(self.checker_callback_tag)
1020
1173
self.checker_callback_tag = None
1021
1174
if getattr(self, "checker", None) is None:
1022
1175
return
1031
1184
byte_arrays=False):
1032
1185
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
1186
become properties on the D-Bus.
1034
1187
1035
1188
The decorated method will be called with no arguments by "Get"
1036
1189
and with one argument by "Set".
1037
1190
1038
1191
The parameters, where they are supported, are the same as
1039
1192
dbus.service.method, except there is only "signature", since the
1040
1193
type from Get() and the type sent to Set() is the same.
1044
1197
if byte_arrays and signature != "ay":
1045
1198
raise ValueError("Byte arrays not supported for non-'ay'"
1046
1199
" signature {!r}".format(signature))
1047
1200
1048
1201
def decorator(func):
1049
1202
func._dbus_is_property = True
1050
1203
func._dbus_interface = dbus_interface
1053
1206
func._dbus_name = func.__name__
1054
1207
if func._dbus_name.endswith("_dbus_property"):
1055
1208
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1209
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1057
1210
return func
1058
1211
1059
1212
return decorator
1060
1213
1061
1214
1062
1215
def dbus_interface_annotations(dbus_interface):
1063
1216
"""Decorator for marking functions returning interface annotations
1064
1217
1065
1218
Usage:
1066
1219
1067
1220
@dbus_interface_annotations("org.example.Interface")
1068
1221
def _foo(self): # Function name does not matter
1069
1222
return {"org.freedesktop.DBus.Deprecated": "true",
1070
1223
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
1224
"false"}
1072
1225
"""
1073
1226
1074
1227
def decorator(func):
1075
1228
func._dbus_is_interface = True
1076
1229
func._dbus_interface = dbus_interface
1077
1230
func._dbus_name = dbus_interface
1078
1231
return func
1079
1232
1080
1233
return decorator
1081
1234
1082
1235
1083
1236
def dbus_annotations(annotations):
1084
1237
"""Decorator to annotate D-Bus methods, signals or properties
1085
1238
Usage:
1086
1239
1087
1240
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
1241
"org.freedesktop.DBus.Property."
1089
1242
"EmitsChangedSignal": "false"})
1091
1244
access="r")
1092
1245
def Property_dbus_property(self):
1093
1246
return dbus.Boolean(False)
1094
1247
1095
1248
See also the DBusObjectWithAnnotations class.
1096
1249
"""
1097
1250
1098
1251
def decorator(func):
1099
1252
func._dbus_annotations = annotations
1100
1253
return func
1101
1254
1102
1255
return decorator
1103
1256
1104
1257
1122
1275
1123
1276
class DBusObjectWithAnnotations(dbus.service.Object):
1124
1277
"""A D-Bus object with annotations.
1125
1278
1126
1279
Classes inheriting from this can use the dbus_annotations
1127
1280
decorator to add annotations to methods or signals.
1128
1281
"""
1129
1282
1130
1283
@staticmethod
1131
1284
def _is_dbus_thing(thing):
1132
1285
"""Returns a function testing if an attribute is a D-Bus thing
1133
1286
1134
1287
If called like _is_dbus_thing("method") it returns a function
1135
1288
suitable for use as predicate to inspect.getmembers().
1136
1289
"""
1137
1290
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1138
1291
False)
1139
1292
1140
1293
def _get_all_dbus_things(self, thing):
1141
1294
"""Returns a generator of (name, attribute) pairs
1142
1295
"""
1145
1298
for cls in self.__class__.__mro__
1146
1299
for name, athing in
1147
1300
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1301
1149
1302
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1303
out_signature="s",
1304
path_keyword='object_path',
1305
connection_keyword='connection')
1153
1306
def Introspect(self, object_path, connection):
1154
1307
"""Overloading of standard D-Bus method.
1155
1308
1156
1309
Inserts annotation tags on methods and signals.
1157
1310
"""
1158
1311
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
1312
connection)
1160
1313
try:
1161
1314
document = xml.dom.minidom.parseString(xmlstring)
1162
1315
1163
1316
for if_tag in document.getElementsByTagName("interface"):
1164
1317
# Add annotation tags
1165
1318
for typ in ("method", "signal"):
1192
1345
if_tag.appendChild(ann_tag)
1193
1346
# Fix argument name for the Introspect method itself
1194
1347
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1348
== dbus.INTROSPECTABLE_IFACE):
1196
1349
for cn in if_tag.getElementsByTagName("method"):
1197
1350
if cn.getAttribute("name") == "Introspect":
1198
1351
for arg in cn.getElementsByTagName("arg"):
1211
1364
1212
1365
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
1366
"""A D-Bus object with properties.
1214
1367
1215
1368
Classes inheriting from this can use the dbus_service_property
1216
1369
decorator to expose methods as D-Bus properties. It exposes the
1217
1370
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
1371
"""
1219
1372
1220
1373
def _get_dbus_property(self, interface_name, property_name):
1221
1374
"""Returns a bound method if one exists which is a D-Bus
1222
1375
property with the specified name and interface.
1227
1380
if (value._dbus_name == property_name
1228
1381
and value._dbus_interface == interface_name):
1229
1382
return value.__get__(self)
1230
1383
1231
1384
# No such property
1232
1385
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
1386
self.dbus_object_path, interface_name, property_name))
1234
1387
1235
1388
@classmethod
1236
1389
def _get_all_interface_names(cls):
1237
1390
"""Get a sequence of all interfaces supported by an object"""
1240
1393
for x in (inspect.getmro(cls))
1241
1394
for attr in dir(x))
1242
1395
if name is not None)
1243
1396
1244
1397
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
1398
in_signature="ss",
1246
1399
out_signature="v")
1254
1407
if not hasattr(value, "variant_level"):
1255
1408
return value
1256
1409
return type(value)(value, variant_level=value.variant_level+1)
1257
1410
1258
1411
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
1412
def Set(self, interface_name, property_name, value):
1260
1413
"""Standard D-Bus property Set() method, see D-Bus standard.
1269
1422
raise ValueError("Byte arrays not supported for non-"
1270
1423
"'ay' signature {!r}"
1271
1424
.format(prop._dbus_signature))
1272
value = dbus.ByteArray(b''.join(chr(byte)
1273
for byte in value))
1425
value = dbus.ByteArray(bytes(value))
1274
1426
prop(value)
1275
1427
1276
1428
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
1429
in_signature="s",
1278
1430
out_signature="a{sv}")
1279
1431
def GetAll(self, interface_name):
1280
1432
"""Standard D-Bus property GetAll() method, see D-Bus
1281
1433
standard.
1282
1434
1283
1435
Note: Will not include properties with access="write".
1284
1436
"""
1285
1437
properties = {}
1296
1448
properties[name] = value
1297
1449
continue
1298
1450
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1451
value, variant_level=value.variant_level + 1)
1300
1452
return dbus.Dictionary(properties, signature="sv")
1301
1453
1302
1454
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
1455
def PropertiesChanged(self, interface_name, changed_properties,
1304
1456
invalidated_properties):
1306
1458
standard.
1307
1459
"""
1308
1460
pass
1309
1461
1310
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
1463
out_signature="s",
1312
1464
path_keyword='object_path',
1313
1465
connection_keyword='connection')
1314
1466
def Introspect(self, object_path, connection):
1315
1467
"""Overloading of standard D-Bus method.
1316
1468
1317
1469
Inserts property tags and interface annotation tags.
1318
1470
"""
1319
1471
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1321
1473
connection)
1322
1474
try:
1323
1475
document = xml.dom.minidom.parseString(xmlstring)
1324
1476
1325
1477
def make_tag(document, name, prop):
1326
1478
e = document.createElement("property")
1327
1479
e.setAttribute("name", name)
1328
1480
e.setAttribute("type", prop._dbus_signature)
1329
1481
e.setAttribute("access", prop._dbus_access)
1330
1482
return e
1331
1483
1332
1484
for if_tag in document.getElementsByTagName("interface"):
1333
1485
# Add property tags
1334
1486
for tag in (make_tag(document, name, prop)
1376
1528
exc_info=error)
1377
1529
return xmlstring
1378
1530
1531
1379
1532
try:
1380
1533
dbus.OBJECT_MANAGER_IFACE
1381
1534
except AttributeError:
1382
1535
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1536
1537
1384
1538
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1539
"""A D-Bus object with an ObjectManager.
1386
1540
1387
1541
Classes inheriting from this exposes the standard
1388
1542
GetManagedObjects call and the InterfacesAdded and
1389
1543
InterfacesRemoved signals on the standard
1390
1544
"org.freedesktop.DBus.ObjectManager" interface.
1391
1545
1392
1546
Note: No signals are sent automatically; they must be sent
1393
1547
manually.
1394
1548
"""
1395
1549
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1550
out_signature="a{oa{sa{sv}}}")
1397
1551
def GetManagedObjects(self):
1398
1552
"""This function must be overridden"""
1399
1553
raise NotImplementedError()
1400
1554
1401
1555
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1556
signature="oa{sa{sv}}")
1403
1557
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
1558
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1559
1560
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1561
def InterfacesRemoved(self, object_path, interfaces):
1408
1562
pass
1409
1563
1410
1564
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1565
out_signature="s",
1566
path_keyword='object_path',
1567
connection_keyword='connection')
1414
1568
def Introspect(self, object_path, connection):
1415
1569
"""Overloading of standard D-Bus method.
1416
1570
1417
1571
Override return argument name of GetManagedObjects to be
1418
1572
"objpath_interfaces_and_properties"
1419
1573
"""
1422
1576
connection)
1423
1577
try:
1424
1578
document = xml.dom.minidom.parseString(xmlstring)
1425
1579
1426
1580
for if_tag in document.getElementsByTagName("interface"):
1427
1581
# Fix argument name for the GetManagedObjects method
1428
1582
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1583
== dbus.OBJECT_MANAGER_IFACE):
1430
1584
for cn in if_tag.getElementsByTagName("method"):
1431
1585
if (cn.getAttribute("name")
1432
1586
== "GetManagedObjects"):
1442
1596
except (AttributeError, xml.dom.DOMException,
1443
1597
xml.parsers.expat.ExpatError) as error:
1444
1598
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1599
exc_info=error)
1446
1600
return xmlstring
1447
1601
1602
1448
1603
def datetime_to_dbus(dt, variant_level=0):
1449
1604
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1605
if dt is None:
1451
return dbus.String("", variant_level = variant_level)
1606
return dbus.String("", variant_level=variant_level)
1452
1607
return dbus.String(dt.isoformat(), variant_level=variant_level)
1453
1608
1454
1609
1457
1612
dbus.service.Object, it will add alternate D-Bus attributes with
1458
1613
interface names according to the "alt_interface_names" mapping.
1459
1614
Usage:
1460
1615
1461
1616
@alternate_dbus_interfaces({"org.example.Interface":
1462
1617
"net.example.AlternateInterface"})
1463
1618
class SampleDBusObject(dbus.service.Object):
1464
1619
@dbus.service.method("org.example.Interface")
1465
1620
def SampleDBusMethod():
1466
1621
pass
1467
1622
1468
1623
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
1624
reachable via two interfaces: "org.example.Interface" and
1470
1625
"net.example.AlternateInterface", the latter of which will have
1471
1626
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
1627
"true", unless "deprecate" is passed with a False value.
1473
1628
1474
1629
This works for methods and signals, and also for D-Bus properties
1475
1630
(from DBusObjectWithProperties) and interfaces (from the
1476
1631
dbus_interface_annotations decorator).
1477
1632
"""
1478
1633
1479
1634
def wrapper(cls):
1480
1635
for orig_interface_name, alt_interface_name in (
1481
1636
alt_interface_names.items()):
1496
1651
interface_names.add(alt_interface)
1497
1652
# Is this a D-Bus signal?
1498
1653
if getattr(attribute, "_dbus_is_signal", False):
1654
# Extract the original non-method undecorated
1655
# function by black magic
1499
1656
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
1657
nonmethod_func = (dict(
1503
1658
zip(attribute.func_code.co_freevars,
1504
1659
attribute.__closure__))
1505
1660
["func"].cell_contents)
1506
1661
else:
1507
nonmethod_func = attribute
1662
nonmethod_func = (dict(
1663
zip(attribute.__code__.co_freevars,
1664
attribute.__closure__))
1665
["func"].cell_contents)
1508
1666
# Create a new, but exactly alike, function
1509
1667
# object, and decorate it to be a new D-Bus signal
1510
1668
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1669
new_function = copy_function(nonmethod_func)
1525
1670
new_function = (dbus.service.signal(
1526
1671
alt_interface,
1527
1672
attribute._dbus_signature)(new_function))
1531
1676
attribute._dbus_annotations)
1532
1677
except AttributeError:
1533
1678
pass
1679
1534
1680
# Define a creator of a function to call both the
1535
1681
# original and alternate functions, so both the
1536
1682
# original and alternate signals gets sent when
1539
1685
"""This function is a scope container to pass
1540
1686
func1 and func2 to the "call_both" function
1541
1687
outside of its arguments"""
1542
1688
1543
1689
@functools.wraps(func2)
1544
1690
def call_both(*args, **kwargs):
1545
1691
"""This function will emit two D-Bus
1546
1692
signals by calling func1 and func2"""
1547
1693
func1(*args, **kwargs)
1548
1694
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1695
# Make wrapper function look like a D-Bus
1696
# signal
1550
1697
for name, attr in inspect.getmembers(func2):
1551
1698
if name.startswith("_dbus_"):
1552
1699
setattr(call_both, name, attr)
1553
1700
1554
1701
return call_both
1555
1702
# Create the "call_both" function and add it to
1556
1703
# the class
1566
1713
alt_interface,
1567
1714
attribute._dbus_in_signature,
1568
1715
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1716
(copy_function(attribute)))
1574
1717
# Copy annotations, if any
1575
1718
try:
1576
1719
attr[attrname]._dbus_annotations = dict(
1588
1731
attribute._dbus_access,
1589
1732
attribute._dbus_get_args_options
1590
1733
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1734
(copy_function(attribute)))
1597
1735
# Copy annotations, if any
1598
1736
try:
1599
1737
attr[attrname]._dbus_annotations = dict(
1608
1746
# to the class.
1609
1747
attr[attrname] = (
1610
1748
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1749
(copy_function(attribute)))
1616
1750
if deprecate:
1617
1751
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1752
iname = "_AlternateDBusNames_interface_annotation{}"
1619
1753
for interface_name in interface_names:
1620
1754
1621
1755
@dbus_interface_annotations(interface_name)
1622
1756
def func(self):
1623
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1757
return {"org.freedesktop.DBus.Deprecated":
1758
"true"}
1625
1759
# Find an unused name
1626
1760
for aname in (iname.format(i)
1627
1761
for i in itertools.count()):
1631
1765
if interface_names:
1632
1766
# Replace the class with a new subclass of it with
1633
1767
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1768
if sys.version_info.major == 2:
1769
cls = type(b"{}Alternate".format(cls.__name__),
1770
(cls, ), attr)
1771
else:
1772
cls = type("{}Alternate".format(cls.__name__),
1773
(cls, ), attr)
1636
1774
return cls
1637
1775
1638
1776
return wrapper
1639
1777
1640
1778
1642
1780
"se.bsnet.fukt.Mandos"})
1643
1781
class ClientDBus(Client, DBusObjectWithProperties):
1644
1782
"""A Client class using D-Bus
1645
1783
1646
1784
Attributes:
1647
1785
dbus_object_path: dbus.ObjectPath
1648
1786
bus: dbus.SystemBus()
1649
1787
"""
1650
1788
1651
1789
runtime_expansions = (Client.runtime_expansions
1652
1790
+ ("dbus_object_path", ))
1653
1791
1654
1792
_interface = "se.recompile.Mandos.Client"
1655
1793
1656
1794
# dbus.service.Object doesn't use super(), so we can't either.
1657
1658
def __init__(self, bus = None, *args, **kwargs):
1795
1796
def __init__(self, bus=None, *args, **kwargs):
1659
1797
self.bus = bus
1660
1798
Client.__init__(self, *args, **kwargs)
1661
1799
# Only now, when this client is initialized, can it show up on
1667
1805
"/clients/" + client_object_name)
1668
1806
DBusObjectWithProperties.__init__(self, self.bus,
1669
1807
self.dbus_object_path)
1670
1808
1671
1809
def notifychangeproperty(transform_func, dbus_name,
1672
1810
type_func=lambda x: x,
1673
1811
variant_level=1,
1675
1813
_interface=_interface):
1676
1814
""" Modify a variable so that it's a property which announces
1677
1815
its changes to DBus.
1678
1816
1679
1817
transform_fun: Function that takes a value and a variant_level
1680
1818
and transforms it to a D-Bus type.
1681
1819
dbus_name: D-Bus name of the variable
1684
1822
variant_level: D-Bus variant level. Default: 1
1685
1823
"""
1686
1824
attrname = "_{}".format(dbus_name)
1687
1825
1688
1826
def setter(self, value):
1689
1827
if hasattr(self, "dbus_object_path"):
1690
1828
if (not hasattr(self, attrname) or
1697
1835
else:
1698
1836
dbus_value = transform_func(
1699
1837
type_func(value),
1700
variant_level = variant_level)
1838
variant_level=variant_level)
1701
1839
self.PropertyChanged(dbus.String(dbus_name),
1702
1840
dbus_value)
1703
1841
self.PropertiesChanged(
1704
1842
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1843
dbus.Dictionary({dbus.String(dbus_name):
1844
dbus_value}),
1707
1845
dbus.Array())
1708
1846
setattr(self, attrname, value)
1709
1847
1710
1848
return property(lambda self: getattr(self, attrname), setter)
1711
1849
1712
1850
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
1851
approvals_pending = notifychangeproperty(dbus.Boolean,
1714
1852
"ApprovalPending",
1715
type_func = bool)
1853
type_func=bool)
1716
1854
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1855
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1856
"LastEnabled")
1719
1857
checker = notifychangeproperty(
1720
1858
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1859
type_func=lambda checker: checker is not None)
1722
1860
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1861
"LastCheckedOK")
1724
1862
last_checker_status = notifychangeproperty(dbus.Int16,
1729
1867
"ApprovedByDefault")
1730
1868
approval_delay = notifychangeproperty(
1731
1869
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1870
type_func=lambda td: td.total_seconds() * 1000)
1733
1871
approval_duration = notifychangeproperty(
1734
1872
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1873
type_func=lambda td: td.total_seconds() * 1000)
1736
1874
host = notifychangeproperty(dbus.String, "Host")
1737
1875
timeout = notifychangeproperty(
1738
1876
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1877
type_func=lambda td: td.total_seconds() * 1000)
1740
1878
extended_timeout = notifychangeproperty(
1741
1879
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1880
type_func=lambda td: td.total_seconds() * 1000)
1743
1881
interval = notifychangeproperty(
1744
1882
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1883
type_func=lambda td: td.total_seconds() * 1000)
1746
1884
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
1885
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
1886
invalidate_only=True)
1749
1887
1750
1888
del notifychangeproperty
1751
1889
1752
1890
def __del__(self, *args, **kwargs):
1753
1891
try:
1754
1892
self.remove_from_connection()
1757
1895
if hasattr(DBusObjectWithProperties, "__del__"):
1758
1896
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1897
Client.__del__(self, *args, **kwargs)
1760
1898
1761
1899
def checker_callback(self, source, condition,
1762
1900
connection, command, *args, **kwargs):
1763
1901
ret = Client.checker_callback(self, source, condition,
1779
1917
| self.last_checker_signal),
1780
1918
dbus.String(command))
1781
1919
return ret
1782
1920
1783
1921
def start_checker(self, *args, **kwargs):
1784
1922
old_checker_pid = getattr(self.checker, "pid", None)
1785
1923
r = Client.start_checker(self, *args, **kwargs)
1789
1927
# Emit D-Bus signal
1790
1928
self.CheckerStarted(self.current_checker_command)
1791
1929
return r
1792
1930
1793
1931
def _reset_approved(self):
1794
1932
self.approved = None
1795
1933
return False
1796
1934
1797
1935
def approve(self, value=True):
1798
1936
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1937
GLib.timeout_add(int(self.approval_duration.total_seconds()
1938
* 1000), self._reset_approved)
1801
1939
self.send_changedstate()
1802
1803
## D-Bus methods, signals & properties
1804
1805
## Interfaces
1806
1807
## Signals
1808
1940
1941
# D-Bus methods, signals & properties
1942
1943
# Interfaces
1944
1945
# Signals
1946
1809
1947
# CheckerCompleted - signal
1810
1948
@dbus.service.signal(_interface, signature="nxs")
1811
1949
def CheckerCompleted(self, exitcode, waitstatus, command):
1812
1950
"D-Bus signal"
1813
1951
pass
1814
1952
1815
1953
# CheckerStarted - signal
1816
1954
@dbus.service.signal(_interface, signature="s")
1817
1955
def CheckerStarted(self, command):
1818
1956
"D-Bus signal"
1819
1957
pass
1820
1958
1821
1959
# PropertyChanged - signal
1822
1960
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
1961
@dbus.service.signal(_interface, signature="sv")
1824
1962
def PropertyChanged(self, property, value):
1825
1963
"D-Bus signal"
1826
1964
pass
1827
1965
1828
1966
# GotSecret - signal
1829
1967
@dbus.service.signal(_interface)
1830
1968
def GotSecret(self):
1833
1971
server to mandos-client
1834
1972
"""
1835
1973
pass
1836
1974
1837
1975
# Rejected - signal
1838
1976
@dbus.service.signal(_interface, signature="s")
1839
1977
def Rejected(self, reason):
1840
1978
"D-Bus signal"
1841
1979
pass
1842
1980
1843
1981
# NeedApproval - signal
1844
1982
@dbus.service.signal(_interface, signature="tb")
1845
1983
def NeedApproval(self, timeout, default):
1846
1984
"D-Bus signal"
1847
1985
return self.need_approval()
1848
1849
## Methods
1850
1986
1987
# Methods
1988
1851
1989
# Approve - method
1852
1990
@dbus.service.method(_interface, in_signature="b")
1853
1991
def Approve(self, value):
1854
1992
self.approve(value)
1855
1993
1856
1994
# CheckedOK - method
1857
1995
@dbus.service.method(_interface)
1858
1996
def CheckedOK(self):
1859
1997
self.checked_ok()
1860
1998
1861
1999
# Enable - method
1862
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
2001
@dbus.service.method(_interface)
1864
2002
def Enable(self):
1865
2003
"D-Bus method"
1866
2004
self.enable()
1867
2005
1868
2006
# StartChecker - method
1869
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
2008
@dbus.service.method(_interface)
1871
2009
def StartChecker(self):
1872
2010
"D-Bus method"
1873
2011
self.start_checker()
1874
2012
1875
2013
# Disable - method
1876
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
2015
@dbus.service.method(_interface)
1878
2016
def Disable(self):
1879
2017
"D-Bus method"
1880
2018
self.disable()
1881
2019
1882
2020
# StopChecker - method
1883
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
2022
@dbus.service.method(_interface)
1885
2023
def StopChecker(self):
1886
2024
self.stop_checker()
1887
1888
## Properties
1889
2025
2026
# Properties
2027
1890
2028
# ApprovalPending - property
1891
2029
@dbus_service_property(_interface, signature="b", access="read")
1892
2030
def ApprovalPending_dbus_property(self):
1893
2031
return dbus.Boolean(bool(self.approvals_pending))
1894
2032
1895
2033
# ApprovedByDefault - property
1896
2034
@dbus_service_property(_interface,
1897
2035
signature="b",
1900
2038
if value is None: # get
1901
2039
return dbus.Boolean(self.approved_by_default)
1902
2040
self.approved_by_default = bool(value)
1903
2041
1904
2042
# ApprovalDelay - property
1905
2043
@dbus_service_property(_interface,
1906
2044
signature="t",
1910
2048
return dbus.UInt64(self.approval_delay.total_seconds()
1911
2049
* 1000)
1912
2050
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
2051
1914
2052
# ApprovalDuration - property
1915
2053
@dbus_service_property(_interface,
1916
2054
signature="t",
1920
2058
return dbus.UInt64(self.approval_duration.total_seconds()
1921
2059
* 1000)
1922
2060
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
2061
1924
2062
# Name - property
1925
2063
@dbus_annotations(
1926
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
2065
@dbus_service_property(_interface, signature="s", access="read")
1928
2066
def Name_dbus_property(self):
1929
2067
return dbus.String(self.name)
1930
2068
2069
# KeyID - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2072
@dbus_service_property(_interface, signature="s", access="read")
2073
def KeyID_dbus_property(self):
2074
return dbus.String(self.key_id)
2075
1931
2076
# Fingerprint - property
1932
2077
@dbus_annotations(
1933
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
2079
@dbus_service_property(_interface, signature="s", access="read")
1935
2080
def Fingerprint_dbus_property(self):
1936
2081
return dbus.String(self.fingerprint)
1937
2082
1938
2083
# Host - property
1939
2084
@dbus_service_property(_interface,
1940
2085
signature="s",
1943
2088
if value is None: # get
1944
2089
return dbus.String(self.host)
1945
2090
self.host = str(value)
1946
2091
1947
2092
# Created - property
1948
2093
@dbus_annotations(
1949
2094
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
2095
@dbus_service_property(_interface, signature="s", access="read")
1951
2096
def Created_dbus_property(self):
1952
2097
return datetime_to_dbus(self.created)
1953
2098
1954
2099
# LastEnabled - property
1955
2100
@dbus_service_property(_interface, signature="s", access="read")
1956
2101
def LastEnabled_dbus_property(self):
1957
2102
return datetime_to_dbus(self.last_enabled)
1958
2103
1959
2104
# Enabled - property
1960
2105
@dbus_service_property(_interface,
1961
2106
signature="b",
1967
2112
self.enable()
1968
2113
else:
1969
2114
self.disable()
1970
2115
1971
2116
# LastCheckedOK - property
1972
2117
@dbus_service_property(_interface,
1973
2118
signature="s",
1977
2122
self.checked_ok()
1978
2123
return
1979
2124
return datetime_to_dbus(self.last_checked_ok)
1980
2125
1981
2126
# LastCheckerStatus - property
1982
2127
@dbus_service_property(_interface, signature="n", access="read")
1983
2128
def LastCheckerStatus_dbus_property(self):
1984
2129
return dbus.Int16(self.last_checker_status)
1985
2130
1986
2131
# Expires - property
1987
2132
@dbus_service_property(_interface, signature="s", access="read")
1988
2133
def Expires_dbus_property(self):
1989
2134
return datetime_to_dbus(self.expires)
1990
2135
1991
2136
# LastApprovalRequest - property
1992
2137
@dbus_service_property(_interface, signature="s", access="read")
1993
2138
def LastApprovalRequest_dbus_property(self):
1994
2139
return datetime_to_dbus(self.last_approval_request)
1995
2140
1996
2141
# Timeout - property
1997
2142
@dbus_service_property(_interface,
1998
2143
signature="t",
2013
2158
if (getattr(self, "disable_initiator_tag", None)
2014
2159
is None):
2015
2160
return
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2161
GLib.source_remove(self.disable_initiator_tag)
2162
self.disable_initiator_tag = GLib.timeout_add(
2018
2163
int((self.expires - now).total_seconds() * 1000),
2019
2164
self.disable)
2020
2165
2021
2166
# ExtendedTimeout - property
2022
2167
@dbus_service_property(_interface,
2023
2168
signature="t",
2027
2172
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
2173
* 1000)
2029
2174
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
2175
2031
2176
# Interval - property
2032
2177
@dbus_service_property(_interface,
2033
2178
signature="t",
2040
2185
return
2041
2186
if self.enabled:
2042
2187
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2188
GLib.source_remove(self.checker_initiator_tag)
2189
self.checker_initiator_tag = GLib.timeout_add(
2045
2190
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2047
2191
self.start_checker() # Start one now, too
2192
2048
2193
# Checker - property
2049
2194
@dbus_service_property(_interface,
2050
2195
signature="s",
2053
2198
if value is None: # get
2054
2199
return dbus.String(self.checker_command)
2055
2200
self.checker_command = str(value)
2056
2201
2057
2202
# CheckerRunning - property
2058
2203
@dbus_service_property(_interface,
2059
2204
signature="b",
2065
2210
self.start_checker()
2066
2211
else:
2067
2212
self.stop_checker()
2068
2213
2069
2214
# ObjectPath - property
2070
2215
@dbus_annotations(
2071
2216
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
2217
"org.freedesktop.DBus.Deprecated": "true"})
2073
2218
@dbus_service_property(_interface, signature="o", access="read")
2074
2219
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2076
2220
return self.dbus_object_path # is already a dbus.ObjectPath
2221
2077
2222
# Secret = property
2078
2223
@dbus_annotations(
2079
2224
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2084
2229
byte_arrays=True)
2085
2230
def Secret_dbus_property(self, value):
2086
2231
self.secret = bytes(value)
2087
2232
2088
2233
del _interface
2089
2234
2090
2235
2091
class ProxyClient(object):
2092
def __init__(self, child_pipe, fpr, address):
2236
class ProxyClient:
2237
def __init__(self, child_pipe, key_id, fpr, address):
2093
2238
self._pipe = child_pipe
2094
self._pipe.send(('init', fpr, address))
2239
self._pipe.send(('init', key_id, fpr, address))
2095
2240
if not self._pipe.recv():
2096
raise KeyError(fpr)
2097
2241
raise KeyError(key_id or fpr)
2242
2098
2243
def __getattribute__(self, name):
2099
2244
if name == '_pipe':
2100
2245
return super(ProxyClient, self).__getattribute__(name)
2103
2248
if data[0] == 'data':
2104
2249
return data[1]
2105
2250
if data[0] == 'function':
2106
2251
2107
2252
def func(*args, **kwargs):
2108
2253
self._pipe.send(('funcall', name, args, kwargs))
2109
2254
return self._pipe.recv()[1]
2110
2255
2111
2256
return func
2112
2257
2113
2258
def __setattr__(self, name, value):
2114
2259
if name == '_pipe':
2115
2260
return super(ProxyClient, self).__setattr__(name, value)
2118
2263
2119
2264
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2265
"""A class to handle client connections.
2121
2266
2122
2267
Instantiated once for each connection to handle it.
2123
2268
Note: This will run in its own forked process."""
2124
2269
2125
2270
def handle(self):
2126
2271
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
2272
logger.info("TCP connection from: %s",
2128
2273
str(self.client_address))
2129
2274
logger.debug("Pipe FD: %d",
2130
2275
self.server.child_pipe.fileno())
2131
2276
2132
2277
session = gnutls.ClientSession(self.request)
2133
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2137
# "+DHE-DSS"))
2278
2279
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2280
# "+AES-256-CBC", "+SHA1",
2281
# "+COMP-NULL", "+CTYPE-OPENPGP",
2282
# "+DHE-DSS"))
2138
2283
# Use a fallback default, since this MUST be set.
2139
2284
priority = self.server.gnutls_priority
2140
2285
if priority is None:
2141
2286
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2287
gnutls.priority_set_direct(session._c_object,
2288
priority.encode("utf-8"),
2143
2289
None)
2144
2290
2145
2291
# Start communication using the Mandos protocol
2146
2292
# Get protocol number
2147
2293
line = self.request.makefile().readline()
2152
2298
except (ValueError, IndexError, RuntimeError) as error:
2153
2299
logger.error("Unknown protocol version: %s", error)
2154
2300
return
2155
2301
2156
2302
# Start GnuTLS connection
2157
2303
try:
2158
2304
session.handshake()
2162
2308
# established. Just abandon the request.
2163
2309
return
2164
2310
logger.debug("Handshake succeeded")
2165
2311
2166
2312
approval_required = False
2167
2313
try:
2168
try:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
2172
logger.warning("Bad certificate: %s", error)
2173
return
2174
logger.debug("Fingerprint: %s", fpr)
2175
2176
try:
2177
client = ProxyClient(child_pipe, fpr,
2314
if gnutls.has_rawpk:
2315
fpr = b""
2316
try:
2317
key_id = self.key_id(
2318
self.peer_certificate(session))
2319
except (TypeError, gnutls.Error) as error:
2320
logger.warning("Bad certificate: %s", error)
2321
return
2322
logger.debug("Key ID: %s", key_id)
2323
2324
else:
2325
key_id = b""
2326
try:
2327
fpr = self.fingerprint(
2328
self.peer_certificate(session))
2329
except (TypeError, gnutls.Error) as error:
2330
logger.warning("Bad certificate: %s", error)
2331
return
2332
logger.debug("Fingerprint: %s", fpr)
2333
2334
try:
2335
client = ProxyClient(child_pipe, key_id, fpr,
2178
2336
self.client_address)
2179
2337
except KeyError:
2180
2338
return
2181
2339
2182
2340
if client.approval_delay:
2183
2341
delay = client.approval_delay
2184
2342
client.approvals_pending += 1
2185
2343
approval_required = True
2186
2344
2187
2345
while True:
2188
2346
if not client.enabled:
2189
2347
logger.info("Client %s is disabled",
2192
2350
# Emit D-Bus signal
2193
2351
client.Rejected("Disabled")
2194
2352
return
2195
2353
2196
2354
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2355
# We are approved or approval is disabled
2198
2356
break
2199
2357
elif client.approved is None:
2200
2358
logger.info("Client %s needs approval",
2211
2369
# Emit D-Bus signal
2212
2370
client.Rejected("Denied")
2213
2371
return
2214
2215
#wait until timeout or approved
2372
2373
# wait until timeout or approved
2216
2374
time = datetime.datetime.now()
2217
2375
client.changedstate.acquire()
2218
2376
client.changedstate.wait(delay.total_seconds())
2231
2389
break
2232
2390
else:
2233
2391
delay -= time2 - time
2234
2392
2235
2393
try:
2236
2394
session.send(client.secret)
2237
2395
except gnutls.Error as error:
2238
2396
logger.warning("gnutls send failed",
2239
exc_info = error)
2397
exc_info=error)
2240
2398
return
2241
2399
2242
2400
logger.info("Sending secret to %s", client.name)
2243
2401
# bump the timeout using extended_timeout
2244
2402
client.bump_timeout(client.extended_timeout)
2245
2403
if self.server.use_dbus:
2246
2404
# Emit D-Bus signal
2247
2405
client.GotSecret()
2248
2406
2249
2407
finally:
2250
2408
if approval_required:
2251
2409
client.approvals_pending -= 1
2254
2412
except gnutls.Error as error:
2255
2413
logger.warning("GnuTLS bye failed",
2256
2414
exc_info=error)
2257
2415
2258
2416
@staticmethod
2259
2417
def peer_certificate(session):
2260
"Return the peer's OpenPGP certificate as a bytestring"
2261
# If not an OpenPGP certificate...
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2418
"Return the peer's certificate as a bytestring"
2419
try:
2420
cert_type = gnutls.certificate_type_get2(session._c_object,
2421
gnutls.CTYPE_PEERS)
2422
except AttributeError:
2423
cert_type = gnutls.certificate_type_get(session._c_object)
2424
if gnutls.has_rawpk:
2425
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2426
else:
2427
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2428
# If not a valid certificate type...
2429
if cert_type not in valid_cert_types:
2430
logger.info("Cert type %r not in %r", cert_type,
2431
valid_cert_types)
2264
2432
# ...return invalid data
2265
2433
return b""
2266
2434
list_size = ctypes.c_uint(1)
2272
2440
return None
2273
2441
cert = cert_list[0]
2274
2442
return ctypes.string_at(cert.data, cert.size)
2275
2443
2444
@staticmethod
2445
def key_id(certificate):
2446
"Convert a certificate bytestring to a hexdigit key ID"
2447
# New GnuTLS "datum" with the public key
2448
datum = gnutls.datum_t(
2449
ctypes.cast(ctypes.c_char_p(certificate),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.c_uint(len(certificate)))
2452
# XXX all these need to be created in the gnutls "module"
2453
# New empty GnuTLS certificate
2454
pubkey = gnutls.pubkey_t()
2455
gnutls.pubkey_init(ctypes.byref(pubkey))
2456
# Import the raw public key into the certificate
2457
gnutls.pubkey_import(pubkey,
2458
ctypes.byref(datum),
2459
gnutls.X509_FMT_DER)
2460
# New buffer for the key ID
2461
buf = ctypes.create_string_buffer(32)
2462
buf_len = ctypes.c_size_t(len(buf))
2463
# Get the key ID from the raw public key into the buffer
2464
gnutls.pubkey_get_key_id(pubkey,
2465
gnutls.KEYID_USE_SHA256,
2466
ctypes.cast(ctypes.byref(buf),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.byref(buf_len))
2469
# Deinit the certificate
2470
gnutls.pubkey_deinit(pubkey)
2471
2472
# Convert the buffer to a Python bytestring
2473
key_id = ctypes.string_at(buf, buf_len.value)
2474
# Convert the bytestring to hexadecimal notation
2475
hex_key_id = binascii.hexlify(key_id).upper()
2476
return hex_key_id
2477
2276
2478
@staticmethod
2277
2479
def fingerprint(openpgp):
2278
2480
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2293
2495
ctypes.byref(crtverify))
2294
2496
if crtverify.value != 0:
2295
2497
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
2498
raise gnutls.CertificateSecurityError(code
2499
=crtverify.value)
2297
2500
# New buffer for the fingerprint
2298
2501
buf = ctypes.create_string_buffer(20)
2299
2502
buf_len = ctypes.c_size_t()
2309
2512
return hex_fpr
2310
2513
2311
2514
2312
class MultiprocessingMixIn(object):
2515
class MultiprocessingMixIn:
2313
2516
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2517
2315
2518
def sub_process_main(self, request, address):
2316
2519
try:
2317
2520
self.finish_request(request, address)
2318
2521
except Exception:
2319
2522
self.handle_error(request, address)
2320
2523
self.close_request(request)
2321
2524
2322
2525
def process_request(self, request, address):
2323
2526
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2527
proc = multiprocessing.Process(target=self.sub_process_main,
2528
args=(request, address))
2326
2529
proc.start()
2327
2530
return proc
2328
2531
2329
2532
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2533
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2331
2534
""" adds a pipe to the MixIn """
2332
2535
2333
2536
def process_request(self, request, client_address):
2334
2537
"""Overrides and wraps the original process_request().
2335
2538
2336
2539
This function creates a new pipe in self.pipe
2337
2540
"""
2338
2541
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2339
2542
2340
2543
proc = MultiprocessingMixIn.process_request(self, request,
2341
2544
client_address)
2342
2545
self.child_pipe.close()
2343
2546
self.add_pipe(parent_pipe, proc)
2344
2547
2345
2548
def add_pipe(self, parent_pipe, proc):
2346
2549
"""Dummy function; override as necessary"""
2347
2550
raise NotImplementedError()
2348
2551
2349
2552
2350
2553
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
socketserver.TCPServer, object):
2554
socketserver.TCPServer):
2352
2555
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2353
2556
2354
2557
Attributes:
2355
2558
enabled: Boolean; whether this server is activated yet
2356
2559
interface: None or a network interface name (string)
2357
2560
use_ipv6: Boolean; to use IPv6 or not
2358
2561
"""
2359
2562
2360
2563
def __init__(self, server_address, RequestHandlerClass,
2361
2564
interface=None,
2362
2565
use_ipv6=True,
2372
2575
self.socketfd = socketfd
2373
2576
# Save the original socket.socket() function
2374
2577
self.socket_socket = socket.socket
2578
2375
2579
# To implement --socket, we monkey patch socket.socket.
2376
#
2580
#
2377
2581
# (When socketserver.TCPServer is a new-style class, we
2378
2582
# could make self.socket into a property instead of monkey
2379
2583
# patching socket.socket.)
2380
#
2584
#
2381
2585
# Create a one-time-only replacement for socket.socket()
2382
2586
@functools.wraps(socket.socket)
2383
2587
def socket_wrapper(*args, **kwargs):
2395
2599
# socket_wrapper(), if socketfd was set.
2396
2600
socketserver.TCPServer.__init__(self, server_address,
2397
2601
RequestHandlerClass)
2398
2602
2399
2603
def server_bind(self):
2400
2604
"""This overrides the normal server_bind() function
2401
2605
to bind to an interface if one was specified, and also NOT to
2402
2606
bind to an address or port if they were not specified."""
2607
global SO_BINDTODEVICE
2403
2608
if self.interface is not None:
2404
2609
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2407
self.interface)
2408
else:
2409
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2420
self.interface)
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2424
else:
2425
raise
2610
# Fall back to a hard-coded value which seems to be
2611
# common enough.
2612
logger.warning("SO_BINDTODEVICE not found, trying 25")
2613
SO_BINDTODEVICE = 25
2614
try:
2615
self.socket.setsockopt(
2616
socket.SOL_SOCKET, SO_BINDTODEVICE,
2617
(self.interface + "\0").encode("utf-8"))
2618
except socket.error as error:
2619
if error.errno == errno.EPERM:
2620
logger.error("No permission to bind to"
2621
" interface %s", self.interface)
2622
elif error.errno == errno.ENOPROTOOPT:
2623
logger.error("SO_BINDTODEVICE not available;"
2624
" cannot bind to interface %s",
2625
self.interface)
2626
elif error.errno == errno.ENODEV:
2627
logger.error("Interface %s does not exist,"
2628
" cannot bind", self.interface)
2629
else:
2630
raise
2426
2631
# Only bind(2) the socket if we really need to.
2427
2632
if self.server_address[0] or self.server_address[1]:
2633
if self.server_address[1]:
2634
self.allow_reuse_address = True
2428
2635
if not self.server_address[0]:
2429
2636
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2637
any_address = "::" # in6addr_any
2431
2638
else:
2432
any_address = "0.0.0.0" # INADDR_ANY
2639
any_address = "0.0.0.0" # INADDR_ANY
2433
2640
self.server_address = (any_address,
2434
2641
self.server_address[1])
2435
2642
elif not self.server_address[1]:
2445
2652
2446
2653
class MandosServer(IPv6_TCPServer):
2447
2654
"""Mandos server.
2448
2655
2449
2656
Attributes:
2450
2657
clients: set of Client objects
2451
2658
gnutls_priority GnuTLS priority string
2452
2659
use_dbus: Boolean; to emit D-Bus signals or not
2453
2454
Assumes a gobject.MainLoop event loop.
2660
2661
Assumes a GLib.MainLoop event loop.
2455
2662
"""
2456
2663
2457
2664
def __init__(self, server_address, RequestHandlerClass,
2458
2665
interface=None,
2459
2666
use_ipv6=True,
2469
2676
self.gnutls_priority = gnutls_priority
2470
2677
IPv6_TCPServer.__init__(self, server_address,
2471
2678
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2475
2679
interface=interface,
2680
use_ipv6=use_ipv6,
2681
socketfd=socketfd)
2682
2476
2683
def server_activate(self):
2477
2684
if self.enabled:
2478
2685
return socketserver.TCPServer.server_activate(self)
2479
2686
2480
2687
def enable(self):
2481
2688
self.enabled = True
2482
2689
2483
2690
def add_pipe(self, parent_pipe, proc):
2484
2691
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2692
GLib.io_add_watch(
2693
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2694
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2488
2695
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2491
2696
parent_pipe=parent_pipe,
2697
proc=proc))
2698
2492
2699
def handle_ipc(self, source, condition,
2493
2700
parent_pipe=None,
2494
proc = None,
2701
proc=None,
2495
2702
client_object=None):
2496
2703
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2704
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2705
# Wait for other process to exit
2499
2706
proc.join()
2500
2707
return False
2501
2708
2502
2709
# Read a request from the child
2503
2710
request = parent_pipe.recv()
2504
2711
command = request[0]
2505
2712
2506
2713
if command == 'init':
2507
fpr = request[1]
2508
address = request[2]
2509
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2714
key_id = request[1].decode("ascii")
2715
fpr = request[2].decode("ascii")
2716
address = request[3]
2717
2718
for c in self.clients.values():
2719
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2720
continue
2721
if key_id and c.key_id == key_id:
2722
client = c
2723
break
2724
if fpr and c.fingerprint == fpr:
2512
2725
client = c
2513
2726
break
2514
2727
else:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2728
logger.info("Client not found for key ID: %s, address"
2729
": %s", key_id or fpr, address)
2517
2730
if self.use_dbus:
2518
2731
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
2732
mandos_dbus_service.ClientNotFound(key_id or fpr,
2520
2733
address[0])
2521
2734
parent_pipe.send(False)
2522
2735
return False
2523
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2736
2737
GLib.io_add_watch(
2738
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2739
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2527
2740
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2741
parent_pipe=parent_pipe,
2742
proc=proc,
2743
client_object=client))
2531
2744
parent_pipe.send(True)
2532
2745
# remove the old hook in favor of the new above hook on
2533
2746
# same fileno
2536
2749
funcname = request[1]
2537
2750
args = request[2]
2538
2751
kwargs = request[3]
2539
2752
2540
2753
parent_pipe.send(('data', getattr(client_object,
2541
2754
funcname)(*args,
2542
2755
**kwargs)))
2543
2756
2544
2757
if command == 'getattr':
2545
2758
attrname = request[1]
2546
2759
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2760
collections.abc.Callable):
2548
2761
parent_pipe.send(('function', ))
2549
2762
else:
2550
2763
parent_pipe.send((
2551
2764
'data', client_object.__getattribute__(attrname)))
2552
2765
2553
2766
if command == 'setattr':
2554
2767
attrname = request[1]
2555
2768
value = request[2]
2556
2769
setattr(client_object, attrname, value)
2557
2770
2558
2771
return True
2559
2772
2560
2773
2561
2774
def rfc3339_duration_to_delta(duration):
2562
2775
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2563
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2776
2777
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2780
True
2781
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2782
True
2783
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2784
True
2785
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2786
True
2787
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2788
True
2789
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2790
True
2578
2791
"""
2579
2792
2580
2793
# Parsing an RFC 3339 duration with regular expressions is not
2581
2794
# possible - there would have to be multiple places for the same
2582
2795
# values, like seconds. The current code, while more esoteric, is
2583
2796
# cleaner without depending on a parsing library. If Python had a
2584
2797
# built-in library for parsing we would use it, but we'd like to
2585
2798
# avoid excessive use of external libraries.
2586
2799
2587
2800
# New type for defining tokens, syntax, and semantics all-in-one
2588
2801
Token = collections.namedtuple("Token", (
2589
2802
"regexp", # To match token; if "value" is not None, must have
2622
2835
frozenset((token_year, token_month,
2623
2836
token_day, token_time,
2624
2837
token_week)))
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2838
# Define starting values:
2839
# Value so far
2840
value = datetime.timedelta()
2627
2841
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2842
# Following valid tokens
2843
followers = frozenset((token_duration, ))
2844
# String left to parse
2845
s = duration
2630
2846
# Loop until end token is found
2631
2847
while found_token is not token_end:
2632
2848
# Search for any currently valid tokens
2656
2872
2657
2873
def string_to_delta(interval):
2658
2874
"""Parse a string and return a datetime.timedelta
2659
2660
>>> string_to_delta('7d')
2661
datetime.timedelta(7)
2662
>>> string_to_delta('60s')
2663
datetime.timedelta(0, 60)
2664
>>> string_to_delta('60m')
2665
datetime.timedelta(0, 3600)
2666
>>> string_to_delta('24h')
2667
datetime.timedelta(1)
2668
>>> string_to_delta('1w')
2669
datetime.timedelta(7)
2670
>>> string_to_delta('5m 30s')
2671
datetime.timedelta(0, 330)
2875
2876
>>> string_to_delta('7d') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2879
True
2880
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2881
True
2882
>>> string_to_delta('24h') == datetime.timedelta(1)
2883
True
2884
>>> string_to_delta('1w') == datetime.timedelta(7)
2885
True
2886
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2887
True
2672
2888
"""
2673
2889
2674
2890
try:
2675
2891
return rfc3339_duration_to_delta(interval)
2676
2892
except ValueError:
2677
2893
pass
2678
2894
2679
2895
timevalue = datetime.timedelta(0)
2680
2896
for s in interval.split():
2681
2897
try:
2699
2915
return timevalue
2700
2916
2701
2917
2702
def daemon(nochdir = False, noclose = False):
2918
def daemon(nochdir=False, noclose=False):
2703
2919
"""See daemon(3). Standard BSD Unix function.
2704
2920
2705
2921
This should really exist as os.daemon, but it doesn't (yet)."""
2706
2922
if os.fork():
2707
2923
sys.exit()
2725
2941
2726
2942
2727
2943
def main():
2728
2944
2729
2945
##################################################################
2730
2946
# Parsing of options, both command line and config file
2731
2947
2732
2948
parser = argparse.ArgumentParser()
2733
2949
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2950
version="%(prog)s {}".format(version),
2735
2951
help="show version number and exit")
2736
2952
parser.add_argument("-i", "--interface", metavar="IF",
2737
2953
help="Bind to interface IF")
2773
2989
parser.add_argument("--no-zeroconf", action="store_false",
2774
2990
dest="zeroconf", help="Do not use Zeroconf",
2775
2991
default=None)
2776
2992
2777
2993
options = parser.parse_args()
2778
2779
if options.check:
2780
import doctest
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2783
2994
2784
2995
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2786
"address": "",
2787
"port": "",
2788
"debug": "False",
2789
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2793
"use_dbus": "True",
2794
"use_ipv6": "True",
2795
"debuglevel": "",
2796
"restore": "True",
2797
"socket": "",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2802
2996
if gnutls.has_rawpk:
2997
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2998
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2999
else:
3000
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3001
":+SIGN-DSA-SHA256")
3002
server_defaults = {"interface": "",
3003
"address": "",
3004
"port": "",
3005
"debug": "False",
3006
"priority": priority,
3007
"servicename": "Mandos",
3008
"use_dbus": "True",
3009
"use_ipv6": "True",
3010
"debuglevel": "",
3011
"restore": "True",
3012
"socket": "",
3013
"statedir": "/var/lib/mandos",
3014
"foreground": "False",
3015
"zeroconf": "True",
3016
}
3017
del priority
3018
2803
3019
# Parse config file for server-global settings
2804
server_config = configparser.SafeConfigParser(server_defaults)
3020
server_config = configparser.ConfigParser(server_defaults)
2805
3021
del server_defaults
2806
3022
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2807
# Convert the SafeConfigParser object to a dict
3023
# Convert the ConfigParser object to a dict
2808
3024
server_settings = server_config.defaults()
2809
3025
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3026
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3027
"foreground", "zeroconf"):
2811
3028
server_settings[option] = server_config.getboolean("DEFAULT",
2812
3029
option)
2813
3030
if server_settings["port"]:
2823
3040
server_settings["socket"] = os.dup(server_settings
2824
3041
["socket"])
2825
3042
del server_config
2826
3043
2827
3044
# Override the settings from the config file with command line
2828
3045
# options, if set.
2829
3046
for option in ("interface", "address", "port", "debug",
2847
3064
if server_settings["debug"]:
2848
3065
server_settings["foreground"] = True
2849
3066
# Now we have our good server settings in "server_settings"
2850
3067
2851
3068
##################################################################
2852
3069
2853
3070
if (not server_settings["zeroconf"]
2854
3071
and not (server_settings["port"]
2855
3072
or server_settings["socket"] != "")):
2856
3073
parser.error("Needs port or socket to work without Zeroconf")
2857
3074
2858
3075
# For convenience
2859
3076
debug = server_settings["debug"]
2860
3077
debuglevel = server_settings["debuglevel"]
2864
3081
stored_state_file)
2865
3082
foreground = server_settings["foreground"]
2866
3083
zeroconf = server_settings["zeroconf"]
2867
3084
2868
3085
if debug:
2869
3086
initlogger(debug, logging.DEBUG)
2870
3087
else:
2873
3090
else:
2874
3091
level = getattr(logging, debuglevel.upper())
2875
3092
initlogger(debug, level)
2876
3093
2877
3094
if server_settings["servicename"] != "Mandos":
2878
3095
syslogger.setFormatter(
2879
3096
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
3097
' %(levelname)s: %(message)s'.format(
2881
3098
server_settings["servicename"])))
2882
3099
2883
3100
# Parse config file with clients
2884
client_config = configparser.SafeConfigParser(Client
2885
.client_defaults)
3101
client_config = configparser.ConfigParser(Client.client_defaults)
2886
3102
client_config.read(os.path.join(server_settings["configdir"],
2887
3103
"clients.conf"))
2888
3104
2889
3105
global mandos_dbus_service
2890
3106
mandos_dbus_service = None
2891
3107
2892
3108
socketfd = None
2893
3109
if server_settings["socket"] != "":
2894
3110
socketfd = server_settings["socket"]
2910
3126
except IOError as e:
2911
3127
logger.error("Could not open file %r", pidfilename,
2912
3128
exc_info=e)
2913
2914
for name in ("_mandos", "mandos", "nobody"):
3129
3130
for name, group in (("_mandos", "_mandos"),
3131
("mandos", "mandos"),
3132
("nobody", "nogroup")):
2915
3133
try:
2916
3134
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
3135
gid = pwd.getpwnam(group).pw_gid
2918
3136
break
2919
3137
except KeyError:
2920
3138
continue
2924
3142
try:
2925
3143
os.setgid(gid)
2926
3144
os.setuid(uid)
3145
if debug:
3146
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3147
gid))
2927
3148
except OSError as error:
3149
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3150
.format(uid, gid, os.strerror(error.errno)))
2928
3151
if error.errno != errno.EPERM:
2929
3152
raise
2930
3153
2931
3154
if debug:
2932
3155
# Enable all possible GnuTLS debugging
2933
3156
2934
3157
# "Use a log level over 10 to enable all debugging options."
2935
3158
# - GnuTLS manual
2936
3159
gnutls.global_set_log_level(11)
2937
3160
2938
3161
@gnutls.log_func
2939
3162
def debug_gnutls(level, string):
2940
3163
logger.debug("GnuTLS: %s", string[:-1])
2941
3164
2942
3165
gnutls.global_set_log_function(debug_gnutls)
2943
3166
2944
3167
# Redirect stdin so all checkers get /dev/null
2945
3168
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
3169
os.dup2(null, sys.stdin.fileno())
2947
3170
if null > 2:
2948
3171
os.close(null)
2949
3172
2950
3173
# Need to fork before connecting to D-Bus
2951
3174
if not foreground:
2952
3175
# Close all input and output, do double fork, etc.
2953
3176
daemon()
2954
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2958
3177
3178
if gi.version_info < (3, 10, 2):
3179
# multiprocessing will use threads, so before we use GLib we
3180
# need to inform GLib that threads will be used.
3181
GLib.threads_init()
3182
2959
3183
global main_loop
2960
3184
# From the Avahi example code
2961
3185
DBusGMainLoop(set_as_default=True)
2962
main_loop = gobject.MainLoop()
3186
main_loop = GLib.MainLoop()
2963
3187
bus = dbus.SystemBus()
2964
3188
# End of Avahi example code
2965
3189
if use_dbus:
2978
3202
if zeroconf:
2979
3203
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3204
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
3205
name=server_settings["servicename"],
3206
servicetype="_mandos._tcp",
3207
protocol=protocol,
3208
bus=bus)
2985
3209
if server_settings["interface"]:
2986
3210
service.interface = if_nametoindex(
2987
3211
server_settings["interface"].encode("utf-8"))
2988
3212
2989
3213
global multiprocessing_manager
2990
3214
multiprocessing_manager = multiprocessing.Manager()
2991
3215
2992
3216
client_class = Client
2993
3217
if use_dbus:
2994
client_class = functools.partial(ClientDBus, bus = bus)
2995
3218
client_class = functools.partial(ClientDBus, bus=bus)
3219
2996
3220
client_settings = Client.config_parser(client_config)
2997
3221
old_client_settings = {}
2998
3222
clients_data = {}
2999
3223
3000
3224
# This is used to redirect stdout and stderr for checker processes
3001
3225
global wnull
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3226
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3227
# Only used if server is running in foreground but not in debug
3004
3228
# mode
3005
3229
if debug or not foreground:
3006
3230
wnull.close()
3007
3231
3008
3232
# Get client data and settings from last running state.
3009
3233
if server_settings["restore"]:
3010
3234
try:
3011
3235
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
3236
if sys.version_info.major == 2:
3237
clients_data, old_client_settings = pickle.load(
3238
stored_state)
3239
else:
3240
bytes_clients_data, bytes_old_client_settings = (
3241
pickle.load(stored_state, encoding="bytes"))
3242
# Fix bytes to strings
3243
# clients_data
3244
# .keys()
3245
clients_data = {(key.decode("utf-8")
3246
if isinstance(key, bytes)
3247
else key): value
3248
for key, value in
3249
bytes_clients_data.items()}
3250
del bytes_clients_data
3251
for key in clients_data:
3252
value = {(k.decode("utf-8")
3253
if isinstance(k, bytes) else k): v
3254
for k, v in
3255
clients_data[key].items()}
3256
clients_data[key] = value
3257
# .client_structure
3258
value["client_structure"] = [
3259
(s.decode("utf-8")
3260
if isinstance(s, bytes)
3261
else s) for s in
3262
value["client_structure"]]
3263
# .name, .host, and .checker_command
3264
for k in ("name", "host", "checker_command"):
3265
if isinstance(value[k], bytes):
3266
value[k] = value[k].decode("utf-8")
3267
if "key_id" not in value:
3268
value["key_id"] = ""
3269
elif "fingerprint" not in value:
3270
value["fingerprint"] = ""
3271
# old_client_settings
3272
# .keys()
3273
old_client_settings = {
3274
(key.decode("utf-8")
3275
if isinstance(key, bytes)
3276
else key): value
3277
for key, value in
3278
bytes_old_client_settings.items()}
3279
del bytes_old_client_settings
3280
# .host and .checker_command
3281
for value in old_client_settings.values():
3282
for attribute in ("host", "checker_command"):
3283
if isinstance(value[attribute], bytes):
3284
value[attribute] = (value[attribute]
3285
.decode("utf-8"))
3014
3286
os.remove(stored_state_path)
3015
3287
except IOError as e:
3016
3288
if e.errno == errno.ENOENT:
3024
3296
logger.warning("Could not load persistent state: "
3025
3297
"EOFError:",
3026
3298
exc_info=e)
3027
3299
3028
3300
with PGPEngine() as pgp:
3029
3301
for client_name, client in clients_data.items():
3030
3302
# Skip removed clients
3031
3303
if client_name not in client_settings:
3032
3304
continue
3033
3305
3034
3306
# Decide which value to use after restoring saved state.
3035
3307
# We have three different values: Old config file,
3036
3308
# new config file, and saved state.
3047
3319
client[name] = value
3048
3320
except KeyError:
3049
3321
pass
3050
3322
3051
3323
# Clients who has passed its expire date can still be
3052
3324
# enabled if its last checker was successful. A Client
3053
3325
# whose checker succeeded before we stored its state is
3086
3358
client_name))
3087
3359
client["secret"] = (client_settings[client_name]
3088
3360
["secret"])
3089
3361
3090
3362
# Add/remove clients based on new changes made to config
3091
3363
for client_name in (set(old_client_settings)
3092
3364
- set(client_settings)):
3094
3366
for client_name in (set(client_settings)
3095
3367
- set(old_client_settings)):
3096
3368
clients_data[client_name] = client_settings[client_name]
3097
3369
3098
3370
# Create all client objects
3099
3371
for client_name, client in clients_data.items():
3100
3372
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
3103
server_settings = server_settings)
3104
3373
name=client_name,
3374
settings=client,
3375
server_settings=server_settings)
3376
3105
3377
if not tcp_server.clients:
3106
3378
logger.warning("No clients defined")
3107
3379
3108
3380
if not foreground:
3109
3381
if pidfile is not None:
3110
3382
pid = os.getpid()
3116
3388
pidfilename, pid)
3117
3389
del pidfile
3118
3390
del pidfilename
3119
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
3391
3392
for termsig in (signal.SIGHUP, signal.SIGTERM):
3393
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3394
lambda: main_loop.quit() and False)
3395
3123
3396
if use_dbus:
3124
3397
3125
3398
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3399
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3400
class MandosDBusService(DBusObjectWithObjectManager):
3128
3401
"""A D-Bus proxy object"""
3129
3402
3130
3403
def __init__(self):
3131
3404
dbus.service.Object.__init__(self, bus, "/")
3132
3405
3133
3406
_interface = "se.recompile.Mandos"
3134
3407
3135
3408
@dbus.service.signal(_interface, signature="o")
3136
3409
def ClientAdded(self, objpath):
3137
3410
"D-Bus signal"
3138
3411
pass
3139
3412
3140
3413
@dbus.service.signal(_interface, signature="ss")
3141
def ClientNotFound(self, fingerprint, address):
3414
def ClientNotFound(self, key_id, address):
3142
3415
"D-Bus signal"
3143
3416
pass
3144
3417
3145
3418
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
3419
"true"})
3147
3420
@dbus.service.signal(_interface, signature="os")
3148
3421
def ClientRemoved(self, objpath, name):
3149
3422
"D-Bus signal"
3150
3423
pass
3151
3424
3152
3425
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
3426
"true"})
3154
3427
@dbus.service.method(_interface, out_signature="ao")
3155
3428
def GetAllClients(self):
3156
3429
"D-Bus method"
3157
3430
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3159
3431
tcp_server.clients.values())
3432
3160
3433
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
3434
"true"})
3162
3435
@dbus.service.method(_interface,
3164
3437
def GetAllClientsWithProperties(self):
3165
3438
"D-Bus method"
3166
3439
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3440
{c.dbus_object_path: c.GetAll(
3168
3441
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3442
for c in tcp_server.clients.values()},
3170
3443
signature="oa{sv}")
3171
3444
3172
3445
@dbus.service.method(_interface, in_signature="o")
3173
3446
def RemoveClient(self, object_path):
3174
3447
"D-Bus method"
3175
for c in tcp_server.clients.itervalues():
3448
for c in tcp_server.clients.values():
3176
3449
if c.dbus_object_path == object_path:
3177
3450
del tcp_server.clients[c.name]
3178
3451
c.remove_from_connection()
3182
3455
self.client_removed_signal(c)
3183
3456
return
3184
3457
raise KeyError(object_path)
3185
3458
3186
3459
del _interface
3187
3460
3188
3461
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3462
out_signature="a{oa{sa{sv}}}")
3190
3463
def GetManagedObjects(self):
3191
3464
"""D-Bus method"""
3192
3465
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3466
{client.dbus_object_path:
3467
dbus.Dictionary(
3468
{interface: client.GetAll(interface)
3469
for interface in
3470
client._get_all_interface_names()})
3471
for client in tcp_server.clients.values()})
3472
3200
3473
def client_added_signal(self, client):
3201
3474
"""Send the new standard signal and the old signal"""
3202
3475
if use_dbus:
3204
3477
self.InterfacesAdded(
3205
3478
client.dbus_object_path,
3206
3479
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3480
{interface: client.GetAll(interface)
3481
for interface in
3482
client._get_all_interface_names()}))
3210
3483
# Old signal
3211
3484
self.ClientAdded(client.dbus_object_path)
3212
3485
3213
3486
def client_removed_signal(self, client):
3214
3487
"""Send the new standard signal and the old signal"""
3215
3488
if use_dbus:
3220
3493
# Old signal
3221
3494
self.ClientRemoved(client.dbus_object_path,
3222
3495
client.name)
3223
3496
3224
3497
mandos_dbus_service = MandosDBusService()
3225
3498
3499
# Save modules to variables to exempt the modules from being
3500
# unloaded before the function registered with atexit() is run.
3501
mp = multiprocessing
3502
wn = wnull
3503
3226
3504
def cleanup():
3227
3505
"Cleanup function; run on exit"
3228
3506
if zeroconf:
3229
3507
service.cleanup()
3230
3231
multiprocessing.active_children()
3232
wnull.close()
3508
3509
mp.active_children()
3510
wn.close()
3233
3511
if not (tcp_server.clients or client_settings):
3234
3512
return
3235
3513
3236
3514
# Store client before exiting. Secrets are encrypted with key
3237
3515
# based on what config file has. If config file is
3238
3516
# removed/edited, old secret will thus be unrecovable.
3239
3517
clients = {}
3240
3518
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3519
for client in tcp_server.clients.values():
3242
3520
key = client_settings[client.name]["secret"]
3243
3521
client.encrypted_secret = pgp.encrypt(client.secret,
3244
3522
key)
3245
3523
client_dict = {}
3246
3524
3247
3525
# A list of attributes that can not be pickled
3248
3526
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3527
exclude = {"bus", "changedstate", "secret",
3528
"checker", "server_settings"}
3251
3529
for name, typ in inspect.getmembers(dbus.service
3252
3530
.Object):
3253
3531
exclude.add(name)
3254
3532
3255
3533
client_dict["encrypted_secret"] = (client
3256
3534
.encrypted_secret)
3257
3535
for attr in client.client_structure:
3258
3536
if attr not in exclude:
3259
3537
client_dict[attr] = getattr(client, attr)
3260
3538
3261
3539
clients[client.name] = client_dict
3262
3540
del client_settings[client.name]["secret"]
3263
3541
3264
3542
try:
3265
3543
with tempfile.NamedTemporaryFile(
3266
3544
mode='wb',
3268
3546
prefix='clients-',
3269
3547
dir=os.path.dirname(stored_state_path),
3270
3548
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3549
pickle.dump((clients, client_settings), stored_state,
3550
protocol=2)
3272
3551
tempname = stored_state.name
3273
3552
os.rename(tempname, stored_state_path)
3274
3553
except (IOError, OSError) as e:
3284
3563
logger.warning("Could not save persistent state:",
3285
3564
exc_info=e)
3286
3565
raise
3287
3566
3288
3567
# Delete all clients, and settings from config
3289
3568
while tcp_server.clients:
3290
3569
name, client = tcp_server.clients.popitem()
3296
3575
if use_dbus:
3297
3576
mandos_dbus_service.client_removed_signal(client)
3298
3577
client_settings.clear()
3299
3578
3300
3579
atexit.register(cleanup)
3301
3302
for client in tcp_server.clients.itervalues():
3580
3581
for client in tcp_server.clients.values():
3303
3582
if use_dbus:
3304
3583
# Emit D-Bus signal for adding
3305
3584
mandos_dbus_service.client_added_signal(client)
3306
3585
# Need to initiate checking of clients
3307
3586
if client.enabled:
3308
3587
client.init_checker()
3309
3588
3310
3589
tcp_server.enable()
3311
3590
tcp_server.server_activate()
3312
3591
3313
3592
# Find out what port we got
3314
3593
if zeroconf:
3315
3594
service.port = tcp_server.socket.getsockname()[1]
3320
3599
else: # IPv4
3321
3600
logger.info("Now listening on address %r, port %d",
3322
3601
*tcp_server.socket.getsockname())
3323
3324
#service.interface = tcp_server.socket.getsockname()[3]
3325
3602
3603
# service.interface = tcp_server.socket.getsockname()[3]
3604
3326
3605
try:
3327
3606
if zeroconf:
3328
3607
# From the Avahi example code
3333
3612
cleanup()
3334
3613
sys.exit(1)
3335
3614
# End of Avahi example code
3336
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3341
3615
3616
GLib.io_add_watch(
3617
GLib.IOChannel.unix_new(tcp_server.fileno()),
3618
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3619
lambda *args, **kwargs: (tcp_server.handle_request
3620
(*args[2:], **kwargs) or True))
3621
3342
3622
logger.debug("Starting main loop")
3343
3623
main_loop.run()
3344
3624
except AvahiError as error:
3353
3633
# Must run before the D-Bus bus name gets deregistered
3354
3634
cleanup()
3355
3635
3636
3637
def should_only_run_tests():
3638
parser = argparse.ArgumentParser(add_help=False)
3639
parser.add_argument("--check", action='store_true')
3640
args, unknown_args = parser.parse_known_args()
3641
run_tests = args.check
3642
if run_tests:
3643
# Remove --check argument from sys.argv
3644
sys.argv[1:] = unknown_args
3645
return run_tests
3646
3647
# Add all tests from doctest strings
3648
def load_tests(loader, tests, none):
3649
import doctest
3650
tests.addTests(doctest.DocTestSuite())
3651
return tests
3356
3652
3357
3653
if __name__ == '__main__':
3358
main()
3654
try:
3655
if should_only_run_tests():
3656
# Call using ./mandos --check [--verbose]
3657
unittest.main()
3658
else:
3659
main()
3660
finally:
3661
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0