To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.751
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.751
- Committer: teddy at recompile
- Date: 2020-02-07 20:53:34 UTC
- mto: This revision was merged to the branch mainline in revision 396.
- Revision ID: teddy@recompile.se-20200207205334-dp41p8c8vw0ytik5
Allow users to more easily alter mandos.service
The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable. This should be supported by the systemd
service, too.
* mandos.service ([Service]/EnvironmentFile): New; set to
"/etc/default/mandos ".
([Service]/ExecStart): Append "$DAEMON_ARGS".
The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable. This should be supported by the systemd
service, too.
* mandos.service ([Service]/EnvironmentFile): New; set to
"/etc/default/mandos ".
([Service]/ExecStart): Append "$DAEMON_ARGS".
- files added:
- bugs.xml
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
73
77
import itertools
74
78
import collections
75
79
import codecs
80
import unittest
81
import random
76
82
77
83
import dbus
78
84
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
85
import gi
86
from gi.repository import GLib
84
87
from dbus.mainloop.glib import DBusGMainLoop
85
88
import ctypes
86
89
import ctypes.util
87
90
import xml.dom.minidom
88
91
import inspect
89
92
90
try:
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
97
# Add collections.abc.Callable if it does not exist
98
try:
99
collections.abc.Callable
100
except AttributeError:
101
class abc:
102
Callable = collections.Callable
103
collections.abc = abc
104
del abc
105
106
# Show warnings by default
107
if not sys.warnoptions:
108
import warnings
109
warnings.simplefilter("default")
110
111
# Try to find the value of SO_BINDTODEVICE:
112
try:
113
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
114
# newer, and it is also the most natural place for it:
91
115
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
116
except AttributeError:
93
117
try:
118
# This is where SO_BINDTODEVICE was up to and including Python
119
# 2.6, and also 3.2:
94
120
from IN import SO_BINDTODEVICE
95
121
except ImportError:
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.2"
122
# In Python 2.7 it seems to have been removed entirely.
123
# Try running the C preprocessor:
124
try:
125
cc = subprocess.Popen(["cc", "--language=c", "-E",
126
"/dev/stdin"],
127
stdin=subprocess.PIPE,
128
stdout=subprocess.PIPE)
129
stdout = cc.communicate(
130
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
131
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
132
except (OSError, ValueError, IndexError):
133
# No value found
134
SO_BINDTODEVICE = None
135
136
if sys.version_info < (3, 2):
137
configparser.Configparser = configparser.SafeConfigParser
138
139
version = "1.8.9"
102
140
stored_state_file = "clients.pickle"
103
141
104
142
logger = logging.getLogger()
143
logging.captureWarnings(True) # Show warnings via the logging system
105
144
syslogger = None
106
145
107
146
try:
108
147
if_nametoindex = ctypes.cdll.LoadLibrary(
109
148
ctypes.util.find_library("c")).if_nametoindex
110
149
except (OSError, AttributeError):
111
150
112
151
def if_nametoindex(interface):
113
152
"Get an interface index the hard way, i.e. using fcntl()"
114
153
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
158
return interface_index
120
159
121
160
161
def copy_function(func):
162
"""Make a copy of a function"""
163
if sys.version_info.major == 2:
164
return types.FunctionType(func.func_code,
165
func.func_globals,
166
func.func_name,
167
func.func_defaults,
168
func.func_closure)
169
else:
170
return types.FunctionType(func.__code__,
171
func.__globals__,
172
func.__name__,
173
func.__defaults__,
174
func.__closure__)
175
176
122
177
def initlogger(debug, level=logging.WARNING):
123
178
"""init logger and add loglevel"""
124
179
125
180
global syslogger
126
181
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
182
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
183
address="/dev/log"))
129
184
syslogger.setFormatter(logging.Formatter
130
185
('Mandos [%(process)d]: %(levelname)s:'
131
186
' %(message)s'))
132
187
logger.addHandler(syslogger)
133
188
134
189
if debug:
135
190
console = logging.StreamHandler()
136
191
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
201
pass
147
202
148
203
149
class PGPEngine(object):
204
class PGPEngine:
150
205
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
206
152
207
def __init__(self):
153
208
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
209
self.gpg = "gpg"
155
210
try:
156
211
output = subprocess.check_output(["gpgconf"])
157
212
for line in output.splitlines():
158
name, text, path = line.split(":")
159
if name == "gpg":
213
name, text, path = line.split(b":")
214
if name == b"gpg":
160
215
self.gpg = path
161
216
break
162
217
except OSError as e:
165
220
self.gnupgargs = ['--batch',
166
221
'--homedir', self.tempdir,
167
222
'--force-mdc',
168
'--quiet',
169
'--no-use-agent']
170
223
'--quiet']
224
# Only GPG version 1 has the --no-use-agent option.
225
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
226
self.gnupgargs.append("--no-use-agent")
227
171
228
def __enter__(self):
172
229
return self
173
230
174
231
def __exit__(self, exc_type, exc_value, traceback):
175
232
self._cleanup()
176
233
return False
177
234
178
235
def __del__(self):
179
236
self._cleanup()
180
237
181
238
def _cleanup(self):
182
239
if self.tempdir is not None:
183
240
# Delete contents of tempdir
184
241
for root, dirs, files in os.walk(self.tempdir,
185
topdown = False):
242
topdown=False):
186
243
for filename in files:
187
244
os.remove(os.path.join(root, filename))
188
245
for dirname in dirs:
190
247
# Remove tempdir
191
248
os.rmdir(self.tempdir)
192
249
self.tempdir = None
193
250
194
251
def password_encode(self, password):
195
252
# Passphrase can not be empty and can not contain newlines or
196
253
# NUL bytes. So we prefix it and hex encode it.
201
258
.replace(b"\n", b"\\n")
202
259
.replace(b"\0", b"\\x00"))
203
260
return encoded
204
261
205
262
def encrypt(self, data, password):
206
263
passphrase = self.password_encode(password)
207
264
with tempfile.NamedTemporaryFile(
212
269
'--passphrase-file',
213
270
passfile.name]
214
271
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
ciphertext, err = proc.communicate(input=data)
219
276
if proc.returncode != 0:
220
277
raise PGPError(err)
221
278
return ciphertext
222
279
223
280
def decrypt(self, data, password):
224
281
passphrase = self.password_encode(password)
225
282
with tempfile.NamedTemporaryFile(
226
dir = self.tempdir) as passfile:
283
dir=self.tempdir) as passfile:
227
284
passfile.write(passphrase)
228
285
passfile.flush()
229
286
proc = subprocess.Popen([self.gpg, '--decrypt',
230
287
'--passphrase-file',
231
288
passfile.name]
232
289
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
290
stdin=subprocess.PIPE,
291
stdout=subprocess.PIPE,
292
stderr=subprocess.PIPE)
293
decrypted_plaintext, err = proc.communicate(input=data)
237
294
if proc.returncode != 0:
238
295
raise PGPError(err)
239
296
return decrypted_plaintext
240
297
241
298
299
# Pretend that we have an Avahi module
300
class avahi:
301
"""This isn't so much a class as it is a module-like namespace."""
302
IF_UNSPEC = -1 # avahi-common/address.h
303
PROTO_UNSPEC = -1 # avahi-common/address.h
304
PROTO_INET = 0 # avahi-common/address.h
305
PROTO_INET6 = 1 # avahi-common/address.h
306
DBUS_NAME = "org.freedesktop.Avahi"
307
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
308
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
309
DBUS_PATH_SERVER = "/"
310
311
@staticmethod
312
def string_array_to_txt_array(t):
313
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
314
for s in t), signature="ay")
315
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
316
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
317
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
318
SERVER_INVALID = 0 # avahi-common/defs.h
319
SERVER_REGISTERING = 1 # avahi-common/defs.h
320
SERVER_RUNNING = 2 # avahi-common/defs.h
321
SERVER_COLLISION = 3 # avahi-common/defs.h
322
SERVER_FAILURE = 4 # avahi-common/defs.h
323
324
242
325
class AvahiError(Exception):
243
326
def __init__(self, value, *args, **kwargs):
244
327
self.value = value
254
337
pass
255
338
256
339
257
class AvahiService(object):
340
class AvahiService:
258
341
"""An Avahi (Zeroconf) service.
259
342
260
343
Attributes:
261
344
interface: integer; avahi.IF_UNSPEC or an interface index.
262
345
Used to optionally bind to the specified interface.
274
357
server: D-Bus Server
275
358
bus: dbus.SystemBus()
276
359
"""
277
360
278
361
def __init__(self,
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
362
interface=avahi.IF_UNSPEC,
363
name=None,
364
servicetype=None,
365
port=None,
366
TXT=None,
367
domain="",
368
host="",
369
max_renames=32768,
370
protocol=avahi.PROTO_UNSPEC,
371
bus=None):
289
372
self.interface = interface
290
373
self.name = name
291
374
self.type = servicetype
300
383
self.server = None
301
384
self.bus = bus
302
385
self.entry_group_state_changed_match = None
303
386
304
387
def rename(self, remove=True):
305
388
"""Derived from the Avahi example code"""
306
389
if self.rename_count >= self.max_renames:
326
409
logger.critical("D-Bus Exception", exc_info=error)
327
410
self.cleanup()
328
411
os._exit(1)
329
412
330
413
def remove(self):
331
414
"""Derived from the Avahi example code"""
332
415
if self.entry_group_state_changed_match is not None:
334
417
self.entry_group_state_changed_match = None
335
418
if self.group is not None:
336
419
self.group.Reset()
337
420
338
421
def add(self):
339
422
"""Derived from the Avahi example code"""
340
423
self.remove()
357
440
dbus.UInt16(self.port),
358
441
avahi.string_array_to_txt_array(self.TXT))
359
442
self.group.Commit()
360
443
361
444
def entry_group_state_changed(self, state, error):
362
445
"""Derived from the Avahi example code"""
363
446
logger.debug("Avahi entry group state change: %i", state)
364
447
365
448
if state == avahi.ENTRY_GROUP_ESTABLISHED:
366
449
logger.debug("Zeroconf service established.")
367
450
elif state == avahi.ENTRY_GROUP_COLLISION:
371
454
logger.critical("Avahi: Error in group state changed %s",
372
455
str(error))
373
456
raise AvahiGroupError("State changed: {!s}".format(error))
374
457
375
458
def cleanup(self):
376
459
"""Derived from the Avahi example code"""
377
460
if self.group is not None:
382
465
pass
383
466
self.group = None
384
467
self.remove()
385
468
386
469
def server_state_changed(self, state, error=None):
387
470
"""Derived from the Avahi example code"""
388
471
logger.debug("Avahi server state change: %i", state)
417
500
logger.debug("Unknown state: %r", state)
418
501
else:
419
502
logger.debug("Unknown state: %r: %r", state, error)
420
503
421
504
def activate(self):
422
505
"""Derived from the Avahi example code"""
423
506
if self.server is None:
434
517
class AvahiServiceToSyslog(AvahiService):
435
518
def rename(self, *args, **kwargs):
436
519
"""Add the new name to the syslog messages"""
437
ret = AvahiService.rename(self, *args, **kwargs)
520
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
438
521
syslogger.setFormatter(logging.Formatter(
439
522
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
440
523
.format(self.name)))
441
524
return ret
442
525
526
443
527
# Pretend that we have a GnuTLS module
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
528
class gnutls:
529
"""This isn't so much a class as it is a module-like namespace."""
530
531
library = ctypes.util.find_library("gnutls")
532
if library is None:
533
library = ctypes.util.find_library("gnutls-deb0")
534
_library = ctypes.cdll.LoadLibrary(library)
535
del library
536
459
537
# Unless otherwise indicated, the constants and types below are
460
538
# all from the gnutls/gnutls.h C header file.
461
539
462
540
# Constants
463
541
E_SUCCESS = 0
464
542
E_INTERRUPTED = -52
465
543
E_AGAIN = -28
466
544
CRT_OPENPGP = 2
545
CRT_RAWPK = 3
467
546
CLIENT = 2
468
547
SHUT_RDWR = 0
469
548
CRD_CERTIFICATE = 1
470
549
E_NO_CERTIFICATE_FOUND = -49
550
X509_FMT_DER = 0
551
NO_TICKETS = 1<<10
552
ENABLE_RAWPK = 1<<18
553
CTYPE_PEERS = 3
554
KEYID_USE_SHA256 = 1 # gnutls/x509.h
471
555
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
472
556
473
557
# Types
474
558
class session_int(ctypes.Structure):
475
559
_fields_ = []
476
560
session_t = ctypes.POINTER(session_int)
561
477
562
class certificate_credentials_st(ctypes.Structure):
478
563
_fields_ = []
479
564
certificate_credentials_t = ctypes.POINTER(
480
565
certificate_credentials_st)
481
566
certificate_type_t = ctypes.c_int
567
482
568
class datum_t(ctypes.Structure):
483
569
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
570
('size', ctypes.c_uint)]
571
485
572
class openpgp_crt_int(ctypes.Structure):
486
573
_fields_ = []
487
574
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
575
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
576
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
credentials_type_t = ctypes.c_int #
577
credentials_type_t = ctypes.c_int
491
578
transport_ptr_t = ctypes.c_void_p
492
579
close_request_t = ctypes.c_int
493
580
494
581
# Exceptions
495
582
class Error(Exception):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
583
def __init__(self, message=None, code=None, args=()):
501
584
# Default usage is by a message string, but if a return
502
585
# code is passed, convert it to a string with
503
586
# gnutls.strerror()
504
587
self.code = code
505
588
if message is None and code is not None:
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
589
message = gnutls.strerror(code)
590
return super(gnutls.Error, self).__init__(
508
591
message, *args)
509
592
510
593
class CertificateSecurityError(Error):
511
594
pass
512
595
513
596
# Classes
514
class Credentials(object):
597
class Credentials:
515
598
def __init__(self):
516
599
self._c_object = gnutls.certificate_credentials_t()
517
600
gnutls.certificate_allocate_credentials(
518
601
ctypes.byref(self._c_object))
519
602
self.type = gnutls.CRD_CERTIFICATE
520
603
521
604
def __del__(self):
522
605
gnutls.certificate_free_credentials(self._c_object)
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
606
607
class ClientSession:
608
def __init__(self, socket, credentials=None):
526
609
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
610
gnutls_flags = gnutls.CLIENT
611
if gnutls.check_version(b"3.5.6"):
612
gnutls_flags |= gnutls.NO_TICKETS
613
if gnutls.has_rawpk:
614
gnutls_flags |= gnutls.ENABLE_RAWPK
615
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
616
del gnutls_flags
528
617
gnutls.set_default_priority(self._c_object)
529
618
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
619
gnutls.handshake_set_private_extensions(self._c_object,
536
625
ctypes.cast(credentials._c_object,
537
626
ctypes.c_void_p))
538
627
self.credentials = credentials
539
628
540
629
def __del__(self):
541
630
gnutls.deinit(self._c_object)
542
631
543
632
def handshake(self):
544
633
return gnutls.handshake(self._c_object)
545
634
546
635
def send(self, data):
547
636
data = bytes(data)
548
637
data_len = len(data)
550
639
data_len -= gnutls.record_send(self._c_object,
551
640
data[-data_len:],
552
641
data_len)
553
642
554
643
def bye(self):
555
644
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
645
557
646
# Error handling functions
558
647
def _error_code(result):
559
648
"""A function to raise exceptions on errors, suitable
561
650
if result >= 0:
562
651
return result
563
652
if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
653
raise gnutls.CertificateSecurityError(code=result)
654
raise gnutls.Error(code=result)
655
567
656
def _retry_on_error(result, func, arguments):
568
657
"""A function to retry on some errors, suitable
569
658
for the 'errcheck' attribute on ctypes functions"""
572
661
return _error_code(result)
573
662
result = func(*arguments)
574
663
return result
575
664
576
665
# Unless otherwise indicated, the function declarations below are
577
666
# all from the gnutls/gnutls.h C header file.
578
667
579
668
# Functions
580
669
priority_set_direct = _library.gnutls_priority_set_direct
581
670
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
671
ctypes.POINTER(ctypes.c_char_p)]
583
672
priority_set_direct.restype = _error_code
584
673
585
674
init = _library.gnutls_init
586
675
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
676
init.restype = _error_code
588
677
589
678
set_default_priority = _library.gnutls_set_default_priority
590
679
set_default_priority.argtypes = [session_t]
591
680
set_default_priority.restype = _error_code
592
681
593
682
record_send = _library.gnutls_record_send
594
683
record_send.argtypes = [session_t, ctypes.c_void_p,
595
684
ctypes.c_size_t]
596
685
record_send.restype = ctypes.c_ssize_t
597
686
record_send.errcheck = _retry_on_error
598
687
599
688
certificate_allocate_credentials = (
600
689
_library.gnutls_certificate_allocate_credentials)
601
690
certificate_allocate_credentials.argtypes = [
602
691
ctypes.POINTER(certificate_credentials_t)]
603
692
certificate_allocate_credentials.restype = _error_code
604
693
605
694
certificate_free_credentials = (
606
695
_library.gnutls_certificate_free_credentials)
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
696
certificate_free_credentials.argtypes = [
697
certificate_credentials_t]
608
698
certificate_free_credentials.restype = None
609
699
610
700
handshake_set_private_extensions = (
611
701
_library.gnutls_handshake_set_private_extensions)
612
702
handshake_set_private_extensions.argtypes = [session_t,
613
703
ctypes.c_int]
614
704
handshake_set_private_extensions.restype = None
615
705
616
706
credentials_set = _library.gnutls_credentials_set
617
707
credentials_set.argtypes = [session_t, credentials_type_t,
618
708
ctypes.c_void_p]
619
709
credentials_set.restype = _error_code
620
710
621
711
strerror = _library.gnutls_strerror
622
712
strerror.argtypes = [ctypes.c_int]
623
713
strerror.restype = ctypes.c_char_p
624
714
625
715
certificate_type_get = _library.gnutls_certificate_type_get
626
716
certificate_type_get.argtypes = [session_t]
627
717
certificate_type_get.restype = _error_code
628
718
629
719
certificate_get_peers = _library.gnutls_certificate_get_peers
630
720
certificate_get_peers.argtypes = [session_t,
631
721
ctypes.POINTER(ctypes.c_uint)]
632
722
certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
723
634
724
global_set_log_level = _library.gnutls_global_set_log_level
635
725
global_set_log_level.argtypes = [ctypes.c_int]
636
726
global_set_log_level.restype = None
637
727
638
728
global_set_log_function = _library.gnutls_global_set_log_function
639
729
global_set_log_function.argtypes = [log_func]
640
730
global_set_log_function.restype = None
641
731
642
732
deinit = _library.gnutls_deinit
643
733
deinit.argtypes = [session_t]
644
734
deinit.restype = None
645
735
646
736
handshake = _library.gnutls_handshake
647
737
handshake.argtypes = [session_t]
648
738
handshake.restype = _error_code
649
739
handshake.errcheck = _retry_on_error
650
740
651
741
transport_set_ptr = _library.gnutls_transport_set_ptr
652
742
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
743
transport_set_ptr.restype = None
654
744
655
745
bye = _library.gnutls_bye
656
746
bye.argtypes = [session_t, close_request_t]
657
747
bye.restype = _error_code
658
748
bye.errcheck = _retry_on_error
659
749
660
750
check_version = _library.gnutls_check_version
661
751
check_version.argtypes = [ctypes.c_char_p]
662
752
check_version.restype = ctypes.c_char_p
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
753
754
_need_version = b"3.3.0"
755
if check_version(_need_version) is None:
756
raise self.Error("Needs GnuTLS {} or later"
757
.format(_need_version))
758
759
_tls_rawpk_version = b"3.6.6"
760
has_rawpk = bool(check_version(_tls_rawpk_version))
761
762
if has_rawpk:
763
# Types
764
class pubkey_st(ctypes.Structure):
765
_fields = []
766
pubkey_t = ctypes.POINTER(pubkey_st)
767
768
x509_crt_fmt_t = ctypes.c_int
769
770
# All the function declarations below are from gnutls/abstract.h
771
pubkey_init = _library.gnutls_pubkey_init
772
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
773
pubkey_init.restype = _error_code
774
775
pubkey_import = _library.gnutls_pubkey_import
776
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
777
x509_crt_fmt_t]
778
pubkey_import.restype = _error_code
779
780
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
781
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
782
ctypes.POINTER(ctypes.c_ubyte),
783
ctypes.POINTER(ctypes.c_size_t)]
784
pubkey_get_key_id.restype = _error_code
785
786
pubkey_deinit = _library.gnutls_pubkey_deinit
787
pubkey_deinit.argtypes = [pubkey_t]
788
pubkey_deinit.restype = None
789
else:
790
# All the function declarations below are from gnutls/openpgp.h
791
792
openpgp_crt_init = _library.gnutls_openpgp_crt_init
793
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
794
openpgp_crt_init.restype = _error_code
795
796
openpgp_crt_import = _library.gnutls_openpgp_crt_import
797
openpgp_crt_import.argtypes = [openpgp_crt_t,
798
ctypes.POINTER(datum_t),
799
openpgp_crt_fmt_t]
800
openpgp_crt_import.restype = _error_code
801
802
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
803
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
804
ctypes.POINTER(ctypes.c_uint)]
805
openpgp_crt_verify_self.restype = _error_code
806
807
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
808
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
809
openpgp_crt_deinit.restype = None
810
811
openpgp_crt_get_fingerprint = (
812
_library.gnutls_openpgp_crt_get_fingerprint)
813
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
814
ctypes.c_void_p,
815
ctypes.POINTER(
816
ctypes.c_size_t)]
817
openpgp_crt_get_fingerprint.restype = _error_code
818
819
if check_version(b"3.6.4"):
820
certificate_type_get2 = _library.gnutls_certificate_type_get2
821
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
822
certificate_type_get2.restype = _error_code
823
693
824
# Remove non-public functions
694
825
del _error_code, _retry_on_error
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
826
697
827
698
828
def call_pipe(connection, # : multiprocessing.Connection
699
829
func, *args, **kwargs):
700
830
"""This function is meant to be called by multiprocessing.Process
701
831
702
832
This function runs func(*args, **kwargs), and writes the resulting
703
833
return value on the provided multiprocessing.Connection.
704
834
"""
705
835
connection.send(func(*args, **kwargs))
706
836
connection.close()
707
837
708
class Client(object):
838
839
class Client:
709
840
"""A representation of a client host served by this server.
710
841
711
842
Attributes:
712
843
approved: bool(); 'None' if not yet approved/disapproved
713
844
approval_delay: datetime.timedelta(); Time to wait for approval
714
845
approval_duration: datetime.timedelta(); Duration of one approval
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a gobject event source tag, or None
846
checker: multiprocessing.Process(); a running checker process used
847
to see if the client lives. 'None' if no process is
848
running.
849
checker_callback_tag: a GLib event source tag, or None
719
850
checker_command: string; External command which is run to check
720
851
if client lives. %() expansions are done at
721
852
runtime with vars(self) as dict, so that for
722
853
instance %(name)s can be used in the command.
723
checker_initiator_tag: a gobject event source tag, or None
854
checker_initiator_tag: a GLib event source tag, or None
724
855
created: datetime.datetime(); (UTC) object creation
725
856
client_structure: Object describing what attributes a client has
726
857
and is used for storing the client at exit
727
858
current_checker_command: string; current running checker_command
728
disable_initiator_tag: a gobject event source tag, or None
859
disable_initiator_tag: a GLib event source tag, or None
729
860
enabled: bool()
730
861
fingerprint: string (40 or 32 hexadecimal digits); used to
731
uniquely identify the client
862
uniquely identify an OpenPGP client
863
key_id: string (64 hexadecimal digits); used to uniquely identify
864
a client using raw public keys
732
865
host: string; available for use by the checker command
733
866
interval: datetime.timedelta(); How often to start a new checker
734
867
last_approval_request: datetime.datetime(); (UTC) or None
750
883
disabled, or None
751
884
server_settings: The server_settings dict from main()
752
885
"""
753
886
754
887
runtime_expansions = ("approval_delay", "approval_duration",
755
"created", "enabled", "expires",
888
"created", "enabled", "expires", "key_id",
756
889
"fingerprint", "host", "interval",
757
890
"last_approval_request", "last_checked_ok",
758
891
"last_enabled", "name", "timeout")
767
900
"approved_by_default": "True",
768
901
"enabled": "True",
769
902
}
770
903
771
904
@staticmethod
772
905
def config_parser(config):
773
906
"""Construct a new dict of client settings of this form:
780
913
for client_name in config.sections():
781
914
section = dict(config.items(client_name))
782
915
client = settings[client_name] = {}
783
916
784
917
client["host"] = section["host"]
785
918
# Reformat values from string types to Python types
786
919
client["approved_by_default"] = config.getboolean(
787
920
client_name, "approved_by_default")
788
921
client["enabled"] = config.getboolean(client_name,
789
922
"enabled")
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
923
924
# Uppercase and remove spaces from key_id and fingerprint
925
# for later comparison purposes with return value from the
926
# key_id() and fingerprint() functions
927
client["key_id"] = (section.get("key_id", "").upper()
928
.replace(" ", ""))
794
929
client["fingerprint"] = (section["fingerprint"].upper()
795
930
.replace(" ", ""))
796
931
if "secret" in section:
797
client["secret"] = section["secret"].decode("base64")
932
client["secret"] = codecs.decode(section["secret"]
933
.encode("utf-8"),
934
"base64")
798
935
elif "secfile" in section:
799
936
with open(os.path.expanduser(os.path.expandvars
800
937
(section["secfile"])),
815
952
client["last_approval_request"] = None
816
953
client["last_checked_ok"] = None
817
954
client["last_checker_status"] = -2
818
955
819
956
return settings
820
821
def __init__(self, settings, name = None, server_settings=None):
957
958
def __init__(self, settings, name=None, server_settings=None):
822
959
self.name = name
823
960
if server_settings is None:
824
961
server_settings = {}
826
963
# adding all client settings
827
964
for setting, value in settings.items():
828
965
setattr(self, setting, value)
829
966
830
967
if self.enabled:
831
968
if not hasattr(self, "last_enabled"):
832
969
self.last_enabled = datetime.datetime.utcnow()
836
973
else:
837
974
self.last_enabled = None
838
975
self.expires = None
839
976
840
977
logger.debug("Creating client %r", self.name)
978
logger.debug(" Key ID: %s", self.key_id)
841
979
logger.debug(" Fingerprint: %s", self.fingerprint)
842
980
self.created = settings.get("created",
843
981
datetime.datetime.utcnow())
844
982
845
983
# attributes specific for this server instance
846
984
self.checker = None
847
985
self.checker_initiator_tag = None
853
991
self.changedstate = multiprocessing_manager.Condition(
854
992
multiprocessing_manager.Lock())
855
993
self.client_structure = [attr
856
for attr in self.__dict__.iterkeys()
994
for attr in self.__dict__.keys()
857
995
if not attr.startswith("_")]
858
996
self.client_structure.append("client_structure")
859
997
860
998
for name, t in inspect.getmembers(
861
999
type(self), lambda obj: isinstance(obj, property)):
862
1000
if not name.startswith("_"):
863
1001
self.client_structure.append(name)
864
1002
865
1003
# Send notice to process children that client state has changed
866
1004
def send_changedstate(self):
867
1005
with self.changedstate:
868
1006
self.changedstate.notify_all()
869
1007
870
1008
def enable(self):
871
1009
"""Start this client's checker and timeout hooks"""
872
1010
if getattr(self, "enabled", False):
877
1015
self.last_enabled = datetime.datetime.utcnow()
878
1016
self.init_checker()
879
1017
self.send_changedstate()
880
1018
881
1019
def disable(self, quiet=True):
882
1020
"""Disable this client."""
883
1021
if not getattr(self, "enabled", False):
885
1023
if not quiet:
886
1024
logger.info("Disabling client %s", self.name)
887
1025
if getattr(self, "disable_initiator_tag", None) is not None:
888
gobject.source_remove(self.disable_initiator_tag)
1026
GLib.source_remove(self.disable_initiator_tag)
889
1027
self.disable_initiator_tag = None
890
1028
self.expires = None
891
1029
if getattr(self, "checker_initiator_tag", None) is not None:
892
gobject.source_remove(self.checker_initiator_tag)
1030
GLib.source_remove(self.checker_initiator_tag)
893
1031
self.checker_initiator_tag = None
894
1032
self.stop_checker()
895
1033
self.enabled = False
896
1034
if not quiet:
897
1035
self.send_changedstate()
898
# Do not run this again if called by a gobject.timeout_add
1036
# Do not run this again if called by a GLib.timeout_add
899
1037
return False
900
1038
901
1039
def __del__(self):
902
1040
self.disable()
903
1041
904
1042
def init_checker(self):
905
1043
# Schedule a new checker to be started an 'interval' from now,
906
1044
# and every interval from then on.
907
1045
if self.checker_initiator_tag is not None:
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
910
int(self.interval.total_seconds() * 1000),
1046
GLib.source_remove(self.checker_initiator_tag)
1047
self.checker_initiator_tag = GLib.timeout_add(
1048
random.randrange(int(self.interval.total_seconds() * 1000
1049
+ 1)),
911
1050
self.start_checker)
912
1051
# Schedule a disable() when 'timeout' has passed
913
1052
if self.disable_initiator_tag is not None:
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
1053
GLib.source_remove(self.disable_initiator_tag)
1054
self.disable_initiator_tag = GLib.timeout_add(
916
1055
int(self.timeout.total_seconds() * 1000), self.disable)
917
1056
# Also start a new checker *right now*.
918
1057
self.start_checker()
919
1058
920
1059
def checker_callback(self, source, condition, connection,
921
1060
command):
922
1061
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
924
self.checker = None
925
1062
# Read return code from connection (see call_pipe)
926
1063
returncode = connection.recv()
927
1064
connection.close()
928
1065
if self.checker is not None:
1066
self.checker.join()
1067
self.checker_callback_tag = None
1068
self.checker = None
1069
929
1070
if returncode >= 0:
930
1071
self.last_checker_status = returncode
931
1072
self.last_checker_signal = None
941
1082
logger.warning("Checker for %(name)s crashed?",
942
1083
vars(self))
943
1084
return False
944
1085
945
1086
def checked_ok(self):
946
1087
"""Assert that the client has been seen, alive and well."""
947
1088
self.last_checked_ok = datetime.datetime.utcnow()
948
1089
self.last_checker_status = 0
949
1090
self.last_checker_signal = None
950
1091
self.bump_timeout()
951
1092
952
1093
def bump_timeout(self, timeout=None):
953
1094
"""Bump up the timeout for this client."""
954
1095
if timeout is None:
955
1096
timeout = self.timeout
956
1097
if self.disable_initiator_tag is not None:
957
gobject.source_remove(self.disable_initiator_tag)
1098
GLib.source_remove(self.disable_initiator_tag)
958
1099
self.disable_initiator_tag = None
959
1100
if getattr(self, "enabled", False):
960
self.disable_initiator_tag = gobject.timeout_add(
1101
self.disable_initiator_tag = GLib.timeout_add(
961
1102
int(timeout.total_seconds() * 1000), self.disable)
962
1103
self.expires = datetime.datetime.utcnow() + timeout
963
1104
964
1105
def need_approval(self):
965
1106
self.last_approval_request = datetime.datetime.utcnow()
966
1107
967
1108
def start_checker(self):
968
1109
"""Start a new checker subprocess if one is not running.
969
1110
970
1111
If a checker already exists, leave it running and do
971
1112
nothing."""
972
1113
# The reason for not killing a running checker is that if we
977
1118
# checkers alone, the checker would have to take more time
978
1119
# than 'timeout' for the client to be disabled, which is as it
979
1120
# should be.
980
1121
981
1122
if self.checker is not None and not self.checker.is_alive():
982
1123
logger.warning("Checker was not alive; joining")
983
1124
self.checker.join()
987
1128
# Escape attributes for the shell
988
1129
escaped_attrs = {
989
1130
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
1131
for attr in self.runtime_expansions}
991
1132
try:
992
1133
command = self.checker_command % escaped_attrs
993
1134
except TypeError as error:
1005
1146
# The exception is when not debugging but nevertheless
1006
1147
# running in the foreground; use the previously
1007
1148
# created wnull.
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1149
popen_args = {"close_fds": True,
1150
"shell": True,
1151
"cwd": "/"}
1011
1152
if (not self.server_settings["debug"]
1012
1153
and self.server_settings["foreground"]):
1013
1154
popen_args.update({"stdout": wnull,
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1155
"stderr": wnull})
1156
pipe = multiprocessing.Pipe(duplex=False)
1016
1157
self.checker = multiprocessing.Process(
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1158
target=call_pipe,
1159
args=(pipe[1], subprocess.call, command),
1160
kwargs=popen_args)
1020
1161
self.checker.start()
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1162
self.checker_callback_tag = GLib.io_add_watch(
1163
GLib.IOChannel.unix_new(pipe[0].fileno()),
1164
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1023
1165
self.checker_callback, pipe[0], command)
1024
# Re-run this periodically if run by gobject.timeout_add
1166
# Re-run this periodically if run by GLib.timeout_add
1025
1167
return True
1026
1168
1027
1169
def stop_checker(self):
1028
1170
"""Force the checker process, if any, to stop."""
1029
1171
if self.checker_callback_tag:
1030
gobject.source_remove(self.checker_callback_tag)
1172
GLib.source_remove(self.checker_callback_tag)
1031
1173
self.checker_callback_tag = None
1032
1174
if getattr(self, "checker", None) is None:
1033
1175
return
1042
1184
byte_arrays=False):
1043
1185
"""Decorators for marking methods of a DBusObjectWithProperties to
1044
1186
become properties on the D-Bus.
1045
1187
1046
1188
The decorated method will be called with no arguments by "Get"
1047
1189
and with one argument by "Set".
1048
1190
1049
1191
The parameters, where they are supported, are the same as
1050
1192
dbus.service.method, except there is only "signature", since the
1051
1193
type from Get() and the type sent to Set() is the same.
1055
1197
if byte_arrays and signature != "ay":
1056
1198
raise ValueError("Byte arrays not supported for non-'ay'"
1057
1199
" signature {!r}".format(signature))
1058
1200
1059
1201
def decorator(func):
1060
1202
func._dbus_is_property = True
1061
1203
func._dbus_interface = dbus_interface
1064
1206
func._dbus_name = func.__name__
1065
1207
if func._dbus_name.endswith("_dbus_property"):
1066
1208
func._dbus_name = func._dbus_name[:-14]
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1209
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1068
1210
return func
1069
1211
1070
1212
return decorator
1071
1213
1072
1214
1073
1215
def dbus_interface_annotations(dbus_interface):
1074
1216
"""Decorator for marking functions returning interface annotations
1075
1217
1076
1218
Usage:
1077
1219
1078
1220
@dbus_interface_annotations("org.example.Interface")
1079
1221
def _foo(self): # Function name does not matter
1080
1222
return {"org.freedesktop.DBus.Deprecated": "true",
1081
1223
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1082
1224
"false"}
1083
1225
"""
1084
1226
1085
1227
def decorator(func):
1086
1228
func._dbus_is_interface = True
1087
1229
func._dbus_interface = dbus_interface
1088
1230
func._dbus_name = dbus_interface
1089
1231
return func
1090
1232
1091
1233
return decorator
1092
1234
1093
1235
1094
1236
def dbus_annotations(annotations):
1095
1237
"""Decorator to annotate D-Bus methods, signals or properties
1096
1238
Usage:
1097
1239
1098
1240
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1099
1241
"org.freedesktop.DBus.Property."
1100
1242
"EmitsChangedSignal": "false"})
1102
1244
access="r")
1103
1245
def Property_dbus_property(self):
1104
1246
return dbus.Boolean(False)
1105
1247
1106
1248
See also the DBusObjectWithAnnotations class.
1107
1249
"""
1108
1250
1109
1251
def decorator(func):
1110
1252
func._dbus_annotations = annotations
1111
1253
return func
1112
1254
1113
1255
return decorator
1114
1256
1115
1257
1133
1275
1134
1276
class DBusObjectWithAnnotations(dbus.service.Object):
1135
1277
"""A D-Bus object with annotations.
1136
1278
1137
1279
Classes inheriting from this can use the dbus_annotations
1138
1280
decorator to add annotations to methods or signals.
1139
1281
"""
1140
1282
1141
1283
@staticmethod
1142
1284
def _is_dbus_thing(thing):
1143
1285
"""Returns a function testing if an attribute is a D-Bus thing
1144
1286
1145
1287
If called like _is_dbus_thing("method") it returns a function
1146
1288
suitable for use as predicate to inspect.getmembers().
1147
1289
"""
1148
1290
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1149
1291
False)
1150
1292
1151
1293
def _get_all_dbus_things(self, thing):
1152
1294
"""Returns a generator of (name, attribute) pairs
1153
1295
"""
1156
1298
for cls in self.__class__.__mro__
1157
1299
for name, athing in
1158
1300
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
1301
1160
1302
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1303
out_signature="s",
1304
path_keyword='object_path',
1305
connection_keyword='connection')
1164
1306
def Introspect(self, object_path, connection):
1165
1307
"""Overloading of standard D-Bus method.
1166
1308
1167
1309
Inserts annotation tags on methods and signals.
1168
1310
"""
1169
1311
xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
1312
connection)
1171
1313
try:
1172
1314
document = xml.dom.minidom.parseString(xmlstring)
1173
1315
1174
1316
for if_tag in document.getElementsByTagName("interface"):
1175
1317
# Add annotation tags
1176
1318
for typ in ("method", "signal"):
1203
1345
if_tag.appendChild(ann_tag)
1204
1346
# Fix argument name for the Introspect method itself
1205
1347
if (if_tag.getAttribute("name")
1206
== dbus.INTROSPECTABLE_IFACE):
1348
== dbus.INTROSPECTABLE_IFACE):
1207
1349
for cn in if_tag.getElementsByTagName("method"):
1208
1350
if cn.getAttribute("name") == "Introspect":
1209
1351
for arg in cn.getElementsByTagName("arg"):
1222
1364
1223
1365
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
1366
"""A D-Bus object with properties.
1225
1367
1226
1368
Classes inheriting from this can use the dbus_service_property
1227
1369
decorator to expose methods as D-Bus properties. It exposes the
1228
1370
standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
1371
"""
1230
1372
1231
1373
def _get_dbus_property(self, interface_name, property_name):
1232
1374
"""Returns a bound method if one exists which is a D-Bus
1233
1375
property with the specified name and interface.
1238
1380
if (value._dbus_name == property_name
1239
1381
and value._dbus_interface == interface_name):
1240
1382
return value.__get__(self)
1241
1383
1242
1384
# No such property
1243
1385
raise DBusPropertyNotFound("{}:{}.{}".format(
1244
1386
self.dbus_object_path, interface_name, property_name))
1245
1387
1246
1388
@classmethod
1247
1389
def _get_all_interface_names(cls):
1248
1390
"""Get a sequence of all interfaces supported by an object"""
1251
1393
for x in (inspect.getmro(cls))
1252
1394
for attr in dir(x))
1253
1395
if name is not None)
1254
1396
1255
1397
@dbus.service.method(dbus.PROPERTIES_IFACE,
1256
1398
in_signature="ss",
1257
1399
out_signature="v")
1265
1407
if not hasattr(value, "variant_level"):
1266
1408
return value
1267
1409
return type(value)(value, variant_level=value.variant_level+1)
1268
1410
1269
1411
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1270
1412
def Set(self, interface_name, property_name, value):
1271
1413
"""Standard D-Bus property Set() method, see D-Bus standard.
1280
1422
raise ValueError("Byte arrays not supported for non-"
1281
1423
"'ay' signature {!r}"
1282
1424
.format(prop._dbus_signature))
1283
value = dbus.ByteArray(b''.join(chr(byte)
1284
for byte in value))
1425
value = dbus.ByteArray(bytes(value))
1285
1426
prop(value)
1286
1427
1287
1428
@dbus.service.method(dbus.PROPERTIES_IFACE,
1288
1429
in_signature="s",
1289
1430
out_signature="a{sv}")
1290
1431
def GetAll(self, interface_name):
1291
1432
"""Standard D-Bus property GetAll() method, see D-Bus
1292
1433
standard.
1293
1434
1294
1435
Note: Will not include properties with access="write".
1295
1436
"""
1296
1437
properties = {}
1307
1448
properties[name] = value
1308
1449
continue
1309
1450
properties[name] = type(value)(
1310
value, variant_level = value.variant_level + 1)
1451
value, variant_level=value.variant_level + 1)
1311
1452
return dbus.Dictionary(properties, signature="sv")
1312
1453
1313
1454
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1314
1455
def PropertiesChanged(self, interface_name, changed_properties,
1315
1456
invalidated_properties):
1317
1458
standard.
1318
1459
"""
1319
1460
pass
1320
1461
1321
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1322
1463
out_signature="s",
1323
1464
path_keyword='object_path',
1324
1465
connection_keyword='connection')
1325
1466
def Introspect(self, object_path, connection):
1326
1467
"""Overloading of standard D-Bus method.
1327
1468
1328
1469
Inserts property tags and interface annotation tags.
1329
1470
"""
1330
1471
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1332
1473
connection)
1333
1474
try:
1334
1475
document = xml.dom.minidom.parseString(xmlstring)
1335
1476
1336
1477
def make_tag(document, name, prop):
1337
1478
e = document.createElement("property")
1338
1479
e.setAttribute("name", name)
1339
1480
e.setAttribute("type", prop._dbus_signature)
1340
1481
e.setAttribute("access", prop._dbus_access)
1341
1482
return e
1342
1483
1343
1484
for if_tag in document.getElementsByTagName("interface"):
1344
1485
# Add property tags
1345
1486
for tag in (make_tag(document, name, prop)
1387
1528
exc_info=error)
1388
1529
return xmlstring
1389
1530
1531
1390
1532
try:
1391
1533
dbus.OBJECT_MANAGER_IFACE
1392
1534
except AttributeError:
1393
1535
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
1536
1537
1395
1538
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
1539
"""A D-Bus object with an ObjectManager.
1397
1540
1398
1541
Classes inheriting from this exposes the standard
1399
1542
GetManagedObjects call and the InterfacesAdded and
1400
1543
InterfacesRemoved signals on the standard
1401
1544
"org.freedesktop.DBus.ObjectManager" interface.
1402
1545
1403
1546
Note: No signals are sent automatically; they must be sent
1404
1547
manually.
1405
1548
"""
1406
1549
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
out_signature = "a{oa{sa{sv}}}")
1550
out_signature="a{oa{sa{sv}}}")
1408
1551
def GetManagedObjects(self):
1409
1552
"""This function must be overridden"""
1410
1553
raise NotImplementedError()
1411
1554
1412
1555
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
signature = "oa{sa{sv}}")
1556
signature="oa{sa{sv}}")
1414
1557
def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
1558
pass
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1559
1560
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1418
1561
def InterfacesRemoved(self, object_path, interfaces):
1419
1562
pass
1420
1563
1421
1564
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1565
out_signature="s",
1566
path_keyword='object_path',
1567
connection_keyword='connection')
1425
1568
def Introspect(self, object_path, connection):
1426
1569
"""Overloading of standard D-Bus method.
1427
1570
1428
1571
Override return argument name of GetManagedObjects to be
1429
1572
"objpath_interfaces_and_properties"
1430
1573
"""
1433
1576
connection)
1434
1577
try:
1435
1578
document = xml.dom.minidom.parseString(xmlstring)
1436
1579
1437
1580
for if_tag in document.getElementsByTagName("interface"):
1438
1581
# Fix argument name for the GetManagedObjects method
1439
1582
if (if_tag.getAttribute("name")
1440
== dbus.OBJECT_MANAGER_IFACE):
1583
== dbus.OBJECT_MANAGER_IFACE):
1441
1584
for cn in if_tag.getElementsByTagName("method"):
1442
1585
if (cn.getAttribute("name")
1443
1586
== "GetManagedObjects"):
1453
1596
except (AttributeError, xml.dom.DOMException,
1454
1597
xml.parsers.expat.ExpatError) as error:
1455
1598
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1599
exc_info=error)
1457
1600
return xmlstring
1458
1601
1602
1459
1603
def datetime_to_dbus(dt, variant_level=0):
1460
1604
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1461
1605
if dt is None:
1462
return dbus.String("", variant_level = variant_level)
1606
return dbus.String("", variant_level=variant_level)
1463
1607
return dbus.String(dt.isoformat(), variant_level=variant_level)
1464
1608
1465
1609
1468
1612
dbus.service.Object, it will add alternate D-Bus attributes with
1469
1613
interface names according to the "alt_interface_names" mapping.
1470
1614
Usage:
1471
1615
1472
1616
@alternate_dbus_interfaces({"org.example.Interface":
1473
1617
"net.example.AlternateInterface"})
1474
1618
class SampleDBusObject(dbus.service.Object):
1475
1619
@dbus.service.method("org.example.Interface")
1476
1620
def SampleDBusMethod():
1477
1621
pass
1478
1622
1479
1623
The above "SampleDBusMethod" on "SampleDBusObject" will be
1480
1624
reachable via two interfaces: "org.example.Interface" and
1481
1625
"net.example.AlternateInterface", the latter of which will have
1482
1626
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1483
1627
"true", unless "deprecate" is passed with a False value.
1484
1628
1485
1629
This works for methods and signals, and also for D-Bus properties
1486
1630
(from DBusObjectWithProperties) and interfaces (from the
1487
1631
dbus_interface_annotations decorator).
1488
1632
"""
1489
1633
1490
1634
def wrapper(cls):
1491
1635
for orig_interface_name, alt_interface_name in (
1492
1636
alt_interface_names.items()):
1507
1651
interface_names.add(alt_interface)
1508
1652
# Is this a D-Bus signal?
1509
1653
if getattr(attribute, "_dbus_is_signal", False):
1654
# Extract the original non-method undecorated
1655
# function by black magic
1510
1656
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1513
1657
nonmethod_func = (dict(
1514
1658
zip(attribute.func_code.co_freevars,
1515
1659
attribute.__closure__))
1516
1660
["func"].cell_contents)
1517
1661
else:
1518
nonmethod_func = attribute
1662
nonmethod_func = (dict(
1663
zip(attribute.__code__.co_freevars,
1664
attribute.__closure__))
1665
["func"].cell_contents)
1519
1666
# Create a new, but exactly alike, function
1520
1667
# object, and decorate it to be a new D-Bus signal
1521
1668
# with the alternate D-Bus interface name
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1669
new_function = copy_function(nonmethod_func)
1536
1670
new_function = (dbus.service.signal(
1537
1671
alt_interface,
1538
1672
attribute._dbus_signature)(new_function))
1542
1676
attribute._dbus_annotations)
1543
1677
except AttributeError:
1544
1678
pass
1679
1545
1680
# Define a creator of a function to call both the
1546
1681
# original and alternate functions, so both the
1547
1682
# original and alternate signals gets sent when
1550
1685
"""This function is a scope container to pass
1551
1686
func1 and func2 to the "call_both" function
1552
1687
outside of its arguments"""
1553
1688
1554
1689
@functools.wraps(func2)
1555
1690
def call_both(*args, **kwargs):
1556
1691
"""This function will emit two D-Bus
1557
1692
signals by calling func1 and func2"""
1558
1693
func1(*args, **kwargs)
1559
1694
func2(*args, **kwargs)
1560
# Make wrapper function look like a D-Bus signal
1695
# Make wrapper function look like a D-Bus
1696
# signal
1561
1697
for name, attr in inspect.getmembers(func2):
1562
1698
if name.startswith("_dbus_"):
1563
1699
setattr(call_both, name, attr)
1564
1700
1565
1701
return call_both
1566
1702
# Create the "call_both" function and add it to
1567
1703
# the class
1577
1713
alt_interface,
1578
1714
attribute._dbus_in_signature,
1579
1715
attribute._dbus_out_signature)
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1716
(copy_function(attribute)))
1585
1717
# Copy annotations, if any
1586
1718
try:
1587
1719
attr[attrname]._dbus_annotations = dict(
1599
1731
attribute._dbus_access,
1600
1732
attribute._dbus_get_args_options
1601
1733
["byte_arrays"])
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1734
(copy_function(attribute)))
1608
1735
# Copy annotations, if any
1609
1736
try:
1610
1737
attr[attrname]._dbus_annotations = dict(
1619
1746
# to the class.
1620
1747
attr[attrname] = (
1621
1748
dbus_interface_annotations(alt_interface)
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1749
(copy_function(attribute)))
1627
1750
if deprecate:
1628
1751
# Deprecate all alternate interfaces
1629
iname="_AlternateDBusNames_interface_annotation{}"
1752
iname = "_AlternateDBusNames_interface_annotation{}"
1630
1753
for interface_name in interface_names:
1631
1754
1632
1755
@dbus_interface_annotations(interface_name)
1633
1756
def func(self):
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1757
return {"org.freedesktop.DBus.Deprecated":
1758
"true"}
1636
1759
# Find an unused name
1637
1760
for aname in (iname.format(i)
1638
1761
for i in itertools.count()):
1642
1765
if interface_names:
1643
1766
# Replace the class with a new subclass of it with
1644
1767
# methods, signals, etc. as created above.
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1768
if sys.version_info.major == 2:
1769
cls = type(b"{}Alternate".format(cls.__name__),
1770
(cls, ), attr)
1771
else:
1772
cls = type("{}Alternate".format(cls.__name__),
1773
(cls, ), attr)
1647
1774
return cls
1648
1775
1649
1776
return wrapper
1650
1777
1651
1778
1653
1780
"se.bsnet.fukt.Mandos"})
1654
1781
class ClientDBus(Client, DBusObjectWithProperties):
1655
1782
"""A Client class using D-Bus
1656
1783
1657
1784
Attributes:
1658
1785
dbus_object_path: dbus.ObjectPath
1659
1786
bus: dbus.SystemBus()
1660
1787
"""
1661
1788
1662
1789
runtime_expansions = (Client.runtime_expansions
1663
1790
+ ("dbus_object_path", ))
1664
1791
1665
1792
_interface = "se.recompile.Mandos.Client"
1666
1793
1667
1794
# dbus.service.Object doesn't use super(), so we can't either.
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1795
1796
def __init__(self, bus=None, *args, **kwargs):
1670
1797
self.bus = bus
1671
1798
Client.__init__(self, *args, **kwargs)
1672
1799
# Only now, when this client is initialized, can it show up on
1678
1805
"/clients/" + client_object_name)
1679
1806
DBusObjectWithProperties.__init__(self, self.bus,
1680
1807
self.dbus_object_path)
1681
1808
1682
1809
def notifychangeproperty(transform_func, dbus_name,
1683
1810
type_func=lambda x: x,
1684
1811
variant_level=1,
1686
1813
_interface=_interface):
1687
1814
""" Modify a variable so that it's a property which announces
1688
1815
its changes to DBus.
1689
1816
1690
1817
transform_fun: Function that takes a value and a variant_level
1691
1818
and transforms it to a D-Bus type.
1692
1819
dbus_name: D-Bus name of the variable
1695
1822
variant_level: D-Bus variant level. Default: 1
1696
1823
"""
1697
1824
attrname = "_{}".format(dbus_name)
1698
1825
1699
1826
def setter(self, value):
1700
1827
if hasattr(self, "dbus_object_path"):
1701
1828
if (not hasattr(self, attrname) or
1708
1835
else:
1709
1836
dbus_value = transform_func(
1710
1837
type_func(value),
1711
variant_level = variant_level)
1838
variant_level=variant_level)
1712
1839
self.PropertyChanged(dbus.String(dbus_name),
1713
1840
dbus_value)
1714
1841
self.PropertiesChanged(
1715
1842
_interface,
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1843
dbus.Dictionary({dbus.String(dbus_name):
1844
dbus_value}),
1718
1845
dbus.Array())
1719
1846
setattr(self, attrname, value)
1720
1847
1721
1848
return property(lambda self: getattr(self, attrname), setter)
1722
1849
1723
1850
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1724
1851
approvals_pending = notifychangeproperty(dbus.Boolean,
1725
1852
"ApprovalPending",
1726
type_func = bool)
1853
type_func=bool)
1727
1854
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1728
1855
last_enabled = notifychangeproperty(datetime_to_dbus,
1729
1856
"LastEnabled")
1730
1857
checker = notifychangeproperty(
1731
1858
dbus.Boolean, "CheckerRunning",
1732
type_func = lambda checker: checker is not None)
1859
type_func=lambda checker: checker is not None)
1733
1860
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1734
1861
"LastCheckedOK")
1735
1862
last_checker_status = notifychangeproperty(dbus.Int16,
1740
1867
"ApprovedByDefault")
1741
1868
approval_delay = notifychangeproperty(
1742
1869
dbus.UInt64, "ApprovalDelay",
1743
type_func = lambda td: td.total_seconds() * 1000)
1870
type_func=lambda td: td.total_seconds() * 1000)
1744
1871
approval_duration = notifychangeproperty(
1745
1872
dbus.UInt64, "ApprovalDuration",
1746
type_func = lambda td: td.total_seconds() * 1000)
1873
type_func=lambda td: td.total_seconds() * 1000)
1747
1874
host = notifychangeproperty(dbus.String, "Host")
1748
1875
timeout = notifychangeproperty(
1749
1876
dbus.UInt64, "Timeout",
1750
type_func = lambda td: td.total_seconds() * 1000)
1877
type_func=lambda td: td.total_seconds() * 1000)
1751
1878
extended_timeout = notifychangeproperty(
1752
1879
dbus.UInt64, "ExtendedTimeout",
1753
type_func = lambda td: td.total_seconds() * 1000)
1880
type_func=lambda td: td.total_seconds() * 1000)
1754
1881
interval = notifychangeproperty(
1755
1882
dbus.UInt64, "Interval",
1756
type_func = lambda td: td.total_seconds() * 1000)
1883
type_func=lambda td: td.total_seconds() * 1000)
1757
1884
checker_command = notifychangeproperty(dbus.String, "Checker")
1758
1885
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1759
1886
invalidate_only=True)
1760
1887
1761
1888
del notifychangeproperty
1762
1889
1763
1890
def __del__(self, *args, **kwargs):
1764
1891
try:
1765
1892
self.remove_from_connection()
1768
1895
if hasattr(DBusObjectWithProperties, "__del__"):
1769
1896
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1770
1897
Client.__del__(self, *args, **kwargs)
1771
1898
1772
1899
def checker_callback(self, source, condition,
1773
1900
connection, command, *args, **kwargs):
1774
1901
ret = Client.checker_callback(self, source, condition,
1790
1917
| self.last_checker_signal),
1791
1918
dbus.String(command))
1792
1919
return ret
1793
1920
1794
1921
def start_checker(self, *args, **kwargs):
1795
1922
old_checker_pid = getattr(self.checker, "pid", None)
1796
1923
r = Client.start_checker(self, *args, **kwargs)
1800
1927
# Emit D-Bus signal
1801
1928
self.CheckerStarted(self.current_checker_command)
1802
1929
return r
1803
1930
1804
1931
def _reset_approved(self):
1805
1932
self.approved = None
1806
1933
return False
1807
1934
1808
1935
def approve(self, value=True):
1809
1936
self.approved = value
1810
gobject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1937
GLib.timeout_add(int(self.approval_duration.total_seconds()
1938
* 1000), self._reset_approved)
1812
1939
self.send_changedstate()
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1940
1941
# D-Bus methods, signals & properties
1942
1943
# Interfaces
1944
1945
# Signals
1946
1820
1947
# CheckerCompleted - signal
1821
1948
@dbus.service.signal(_interface, signature="nxs")
1822
1949
def CheckerCompleted(self, exitcode, waitstatus, command):
1823
1950
"D-Bus signal"
1824
1951
pass
1825
1952
1826
1953
# CheckerStarted - signal
1827
1954
@dbus.service.signal(_interface, signature="s")
1828
1955
def CheckerStarted(self, command):
1829
1956
"D-Bus signal"
1830
1957
pass
1831
1958
1832
1959
# PropertyChanged - signal
1833
1960
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1834
1961
@dbus.service.signal(_interface, signature="sv")
1835
1962
def PropertyChanged(self, property, value):
1836
1963
"D-Bus signal"
1837
1964
pass
1838
1965
1839
1966
# GotSecret - signal
1840
1967
@dbus.service.signal(_interface)
1841
1968
def GotSecret(self):
1844
1971
server to mandos-client
1845
1972
"""
1846
1973
pass
1847
1974
1848
1975
# Rejected - signal
1849
1976
@dbus.service.signal(_interface, signature="s")
1850
1977
def Rejected(self, reason):
1851
1978
"D-Bus signal"
1852
1979
pass
1853
1980
1854
1981
# NeedApproval - signal
1855
1982
@dbus.service.signal(_interface, signature="tb")
1856
1983
def NeedApproval(self, timeout, default):
1857
1984
"D-Bus signal"
1858
1985
return self.need_approval()
1859
1860
## Methods
1861
1986
1987
# Methods
1988
1862
1989
# Approve - method
1863
1990
@dbus.service.method(_interface, in_signature="b")
1864
1991
def Approve(self, value):
1865
1992
self.approve(value)
1866
1993
1867
1994
# CheckedOK - method
1868
1995
@dbus.service.method(_interface)
1869
1996
def CheckedOK(self):
1870
1997
self.checked_ok()
1871
1998
1872
1999
# Enable - method
1873
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
2001
@dbus.service.method(_interface)
1875
2002
def Enable(self):
1876
2003
"D-Bus method"
1877
2004
self.enable()
1878
2005
1879
2006
# StartChecker - method
1880
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
2008
@dbus.service.method(_interface)
1882
2009
def StartChecker(self):
1883
2010
"D-Bus method"
1884
2011
self.start_checker()
1885
2012
1886
2013
# Disable - method
1887
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
2015
@dbus.service.method(_interface)
1889
2016
def Disable(self):
1890
2017
"D-Bus method"
1891
2018
self.disable()
1892
2019
1893
2020
# StopChecker - method
1894
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
2022
@dbus.service.method(_interface)
1896
2023
def StopChecker(self):
1897
2024
self.stop_checker()
1898
1899
## Properties
1900
2025
2026
# Properties
2027
1901
2028
# ApprovalPending - property
1902
2029
@dbus_service_property(_interface, signature="b", access="read")
1903
2030
def ApprovalPending_dbus_property(self):
1904
2031
return dbus.Boolean(bool(self.approvals_pending))
1905
2032
1906
2033
# ApprovedByDefault - property
1907
2034
@dbus_service_property(_interface,
1908
2035
signature="b",
1911
2038
if value is None: # get
1912
2039
return dbus.Boolean(self.approved_by_default)
1913
2040
self.approved_by_default = bool(value)
1914
2041
1915
2042
# ApprovalDelay - property
1916
2043
@dbus_service_property(_interface,
1917
2044
signature="t",
1921
2048
return dbus.UInt64(self.approval_delay.total_seconds()
1922
2049
* 1000)
1923
2050
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1924
2051
1925
2052
# ApprovalDuration - property
1926
2053
@dbus_service_property(_interface,
1927
2054
signature="t",
1931
2058
return dbus.UInt64(self.approval_duration.total_seconds()
1932
2059
* 1000)
1933
2060
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
2061
1935
2062
# Name - property
1936
2063
@dbus_annotations(
1937
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
2065
@dbus_service_property(_interface, signature="s", access="read")
1939
2066
def Name_dbus_property(self):
1940
2067
return dbus.String(self.name)
1941
2068
2069
# KeyID - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2072
@dbus_service_property(_interface, signature="s", access="read")
2073
def KeyID_dbus_property(self):
2074
return dbus.String(self.key_id)
2075
1942
2076
# Fingerprint - property
1943
2077
@dbus_annotations(
1944
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
2079
@dbus_service_property(_interface, signature="s", access="read")
1946
2080
def Fingerprint_dbus_property(self):
1947
2081
return dbus.String(self.fingerprint)
1948
2082
1949
2083
# Host - property
1950
2084
@dbus_service_property(_interface,
1951
2085
signature="s",
1954
2088
if value is None: # get
1955
2089
return dbus.String(self.host)
1956
2090
self.host = str(value)
1957
2091
1958
2092
# Created - property
1959
2093
@dbus_annotations(
1960
2094
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
2095
@dbus_service_property(_interface, signature="s", access="read")
1962
2096
def Created_dbus_property(self):
1963
2097
return datetime_to_dbus(self.created)
1964
2098
1965
2099
# LastEnabled - property
1966
2100
@dbus_service_property(_interface, signature="s", access="read")
1967
2101
def LastEnabled_dbus_property(self):
1968
2102
return datetime_to_dbus(self.last_enabled)
1969
2103
1970
2104
# Enabled - property
1971
2105
@dbus_service_property(_interface,
1972
2106
signature="b",
1978
2112
self.enable()
1979
2113
else:
1980
2114
self.disable()
1981
2115
1982
2116
# LastCheckedOK - property
1983
2117
@dbus_service_property(_interface,
1984
2118
signature="s",
1988
2122
self.checked_ok()
1989
2123
return
1990
2124
return datetime_to_dbus(self.last_checked_ok)
1991
2125
1992
2126
# LastCheckerStatus - property
1993
2127
@dbus_service_property(_interface, signature="n", access="read")
1994
2128
def LastCheckerStatus_dbus_property(self):
1995
2129
return dbus.Int16(self.last_checker_status)
1996
2130
1997
2131
# Expires - property
1998
2132
@dbus_service_property(_interface, signature="s", access="read")
1999
2133
def Expires_dbus_property(self):
2000
2134
return datetime_to_dbus(self.expires)
2001
2135
2002
2136
# LastApprovalRequest - property
2003
2137
@dbus_service_property(_interface, signature="s", access="read")
2004
2138
def LastApprovalRequest_dbus_property(self):
2005
2139
return datetime_to_dbus(self.last_approval_request)
2006
2140
2007
2141
# Timeout - property
2008
2142
@dbus_service_property(_interface,
2009
2143
signature="t",
2024
2158
if (getattr(self, "disable_initiator_tag", None)
2025
2159
is None):
2026
2160
return
2027
gobject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = gobject.timeout_add(
2161
GLib.source_remove(self.disable_initiator_tag)
2162
self.disable_initiator_tag = GLib.timeout_add(
2029
2163
int((self.expires - now).total_seconds() * 1000),
2030
2164
self.disable)
2031
2165
2032
2166
# ExtendedTimeout - property
2033
2167
@dbus_service_property(_interface,
2034
2168
signature="t",
2038
2172
return dbus.UInt64(self.extended_timeout.total_seconds()
2039
2173
* 1000)
2040
2174
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2041
2175
2042
2176
# Interval - property
2043
2177
@dbus_service_property(_interface,
2044
2178
signature="t",
2051
2185
return
2052
2186
if self.enabled:
2053
2187
# Reschedule checker run
2054
gobject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = gobject.timeout_add(
2188
GLib.source_remove(self.checker_initiator_tag)
2189
self.checker_initiator_tag = GLib.timeout_add(
2056
2190
value, self.start_checker)
2057
self.start_checker() # Start one now, too
2058
2191
self.start_checker() # Start one now, too
2192
2059
2193
# Checker - property
2060
2194
@dbus_service_property(_interface,
2061
2195
signature="s",
2064
2198
if value is None: # get
2065
2199
return dbus.String(self.checker_command)
2066
2200
self.checker_command = str(value)
2067
2201
2068
2202
# CheckerRunning - property
2069
2203
@dbus_service_property(_interface,
2070
2204
signature="b",
2076
2210
self.start_checker()
2077
2211
else:
2078
2212
self.stop_checker()
2079
2213
2080
2214
# ObjectPath - property
2081
2215
@dbus_annotations(
2082
2216
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
2217
"org.freedesktop.DBus.Deprecated": "true"})
2084
2218
@dbus_service_property(_interface, signature="o", access="read")
2085
2219
def ObjectPath_dbus_property(self):
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2220
return self.dbus_object_path # is already a dbus.ObjectPath
2221
2088
2222
# Secret = property
2089
2223
@dbus_annotations(
2090
2224
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2095
2229
byte_arrays=True)
2096
2230
def Secret_dbus_property(self, value):
2097
2231
self.secret = bytes(value)
2098
2232
2099
2233
del _interface
2100
2234
2101
2235
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2236
class ProxyClient:
2237
def __init__(self, child_pipe, key_id, fpr, address):
2104
2238
self._pipe = child_pipe
2105
self._pipe.send(('init', fpr, address))
2239
self._pipe.send(('init', key_id, fpr, address))
2106
2240
if not self._pipe.recv():
2107
raise KeyError(fpr)
2108
2241
raise KeyError(key_id or fpr)
2242
2109
2243
def __getattribute__(self, name):
2110
2244
if name == '_pipe':
2111
2245
return super(ProxyClient, self).__getattribute__(name)
2114
2248
if data[0] == 'data':
2115
2249
return data[1]
2116
2250
if data[0] == 'function':
2117
2251
2118
2252
def func(*args, **kwargs):
2119
2253
self._pipe.send(('funcall', name, args, kwargs))
2120
2254
return self._pipe.recv()[1]
2121
2255
2122
2256
return func
2123
2257
2124
2258
def __setattr__(self, name, value):
2125
2259
if name == '_pipe':
2126
2260
return super(ProxyClient, self).__setattr__(name, value)
2129
2263
2130
2264
class ClientHandler(socketserver.BaseRequestHandler, object):
2131
2265
"""A class to handle client connections.
2132
2266
2133
2267
Instantiated once for each connection to handle it.
2134
2268
Note: This will run in its own forked process."""
2135
2269
2136
2270
def handle(self):
2137
2271
with contextlib.closing(self.server.child_pipe) as child_pipe:
2138
2272
logger.info("TCP connection from: %s",
2139
2273
str(self.client_address))
2140
2274
logger.debug("Pipe FD: %d",
2141
2275
self.server.child_pipe.fileno())
2142
2276
2143
2277
session = gnutls.ClientSession(self.request)
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2278
2279
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2280
# "+AES-256-CBC", "+SHA1",
2281
# "+COMP-NULL", "+CTYPE-OPENPGP",
2282
# "+DHE-DSS"))
2149
2283
# Use a fallback default, since this MUST be set.
2150
2284
priority = self.server.gnutls_priority
2151
2285
if priority is None:
2152
2286
priority = "NORMAL"
2153
gnutls.priority_set_direct(session._c_object, priority,
2287
gnutls.priority_set_direct(session._c_object,
2288
priority.encode("utf-8"),
2154
2289
None)
2155
2290
2156
2291
# Start communication using the Mandos protocol
2157
2292
# Get protocol number
2158
2293
line = self.request.makefile().readline()
2163
2298
except (ValueError, IndexError, RuntimeError) as error:
2164
2299
logger.error("Unknown protocol version: %s", error)
2165
2300
return
2166
2301
2167
2302
# Start GnuTLS connection
2168
2303
try:
2169
2304
session.handshake()
2173
2308
# established. Just abandon the request.
2174
2309
return
2175
2310
logger.debug("Handshake succeeded")
2176
2311
2177
2312
approval_required = False
2178
2313
try:
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2314
if gnutls.has_rawpk:
2315
fpr = b""
2316
try:
2317
key_id = self.key_id(
2318
self.peer_certificate(session))
2319
except (TypeError, gnutls.Error) as error:
2320
logger.warning("Bad certificate: %s", error)
2321
return
2322
logger.debug("Key ID: %s", key_id)
2323
2324
else:
2325
key_id = b""
2326
try:
2327
fpr = self.fingerprint(
2328
self.peer_certificate(session))
2329
except (TypeError, gnutls.Error) as error:
2330
logger.warning("Bad certificate: %s", error)
2331
return
2332
logger.debug("Fingerprint: %s", fpr)
2333
2334
try:
2335
client = ProxyClient(child_pipe, key_id, fpr,
2189
2336
self.client_address)
2190
2337
except KeyError:
2191
2338
return
2192
2339
2193
2340
if client.approval_delay:
2194
2341
delay = client.approval_delay
2195
2342
client.approvals_pending += 1
2196
2343
approval_required = True
2197
2344
2198
2345
while True:
2199
2346
if not client.enabled:
2200
2347
logger.info("Client %s is disabled",
2203
2350
# Emit D-Bus signal
2204
2351
client.Rejected("Disabled")
2205
2352
return
2206
2353
2207
2354
if client.approved or not client.approval_delay:
2208
#We are approved or approval is disabled
2355
# We are approved or approval is disabled
2209
2356
break
2210
2357
elif client.approved is None:
2211
2358
logger.info("Client %s needs approval",
2222
2369
# Emit D-Bus signal
2223
2370
client.Rejected("Denied")
2224
2371
return
2225
2226
#wait until timeout or approved
2372
2373
# wait until timeout or approved
2227
2374
time = datetime.datetime.now()
2228
2375
client.changedstate.acquire()
2229
2376
client.changedstate.wait(delay.total_seconds())
2242
2389
break
2243
2390
else:
2244
2391
delay -= time2 - time
2245
2392
2246
2393
try:
2247
2394
session.send(client.secret)
2248
2395
except gnutls.Error as error:
2249
2396
logger.warning("gnutls send failed",
2250
exc_info = error)
2397
exc_info=error)
2251
2398
return
2252
2399
2253
2400
logger.info("Sending secret to %s", client.name)
2254
2401
# bump the timeout using extended_timeout
2255
2402
client.bump_timeout(client.extended_timeout)
2256
2403
if self.server.use_dbus:
2257
2404
# Emit D-Bus signal
2258
2405
client.GotSecret()
2259
2406
2260
2407
finally:
2261
2408
if approval_required:
2262
2409
client.approvals_pending -= 1
2265
2412
except gnutls.Error as error:
2266
2413
logger.warning("GnuTLS bye failed",
2267
2414
exc_info=error)
2268
2415
2269
2416
@staticmethod
2270
2417
def peer_certificate(session):
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2418
"Return the peer's certificate as a bytestring"
2419
try:
2420
cert_type = gnutls.certificate_type_get2(session._c_object,
2421
gnutls.CTYPE_PEERS)
2422
except AttributeError:
2423
cert_type = gnutls.certificate_type_get(session._c_object)
2424
if gnutls.has_rawpk:
2425
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2426
else:
2427
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2428
# If not a valid certificate type...
2429
if cert_type not in valid_cert_types:
2430
logger.info("Cert type %r not in %r", cert_type,
2431
valid_cert_types)
2275
2432
# ...return invalid data
2276
2433
return b""
2277
2434
list_size = ctypes.c_uint(1)
2283
2440
return None
2284
2441
cert = cert_list[0]
2285
2442
return ctypes.string_at(cert.data, cert.size)
2286
2443
2444
@staticmethod
2445
def key_id(certificate):
2446
"Convert a certificate bytestring to a hexdigit key ID"
2447
# New GnuTLS "datum" with the public key
2448
datum = gnutls.datum_t(
2449
ctypes.cast(ctypes.c_char_p(certificate),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.c_uint(len(certificate)))
2452
# XXX all these need to be created in the gnutls "module"
2453
# New empty GnuTLS certificate
2454
pubkey = gnutls.pubkey_t()
2455
gnutls.pubkey_init(ctypes.byref(pubkey))
2456
# Import the raw public key into the certificate
2457
gnutls.pubkey_import(pubkey,
2458
ctypes.byref(datum),
2459
gnutls.X509_FMT_DER)
2460
# New buffer for the key ID
2461
buf = ctypes.create_string_buffer(32)
2462
buf_len = ctypes.c_size_t(len(buf))
2463
# Get the key ID from the raw public key into the buffer
2464
gnutls.pubkey_get_key_id(pubkey,
2465
gnutls.KEYID_USE_SHA256,
2466
ctypes.cast(ctypes.byref(buf),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.byref(buf_len))
2469
# Deinit the certificate
2470
gnutls.pubkey_deinit(pubkey)
2471
2472
# Convert the buffer to a Python bytestring
2473
key_id = ctypes.string_at(buf, buf_len.value)
2474
# Convert the bytestring to hexadecimal notation
2475
hex_key_id = binascii.hexlify(key_id).upper()
2476
return hex_key_id
2477
2287
2478
@staticmethod
2288
2479
def fingerprint(openpgp):
2289
2480
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2304
2495
ctypes.byref(crtverify))
2305
2496
if crtverify.value != 0:
2306
2497
gnutls.openpgp_crt_deinit(crt)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2498
raise gnutls.CertificateSecurityError(code
2499
=crtverify.value)
2308
2500
# New buffer for the fingerprint
2309
2501
buf = ctypes.create_string_buffer(20)
2310
2502
buf_len = ctypes.c_size_t()
2320
2512
return hex_fpr
2321
2513
2322
2514
2323
class MultiprocessingMixIn(object):
2515
class MultiprocessingMixIn:
2324
2516
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2325
2517
2326
2518
def sub_process_main(self, request, address):
2327
2519
try:
2328
2520
self.finish_request(request, address)
2329
2521
except Exception:
2330
2522
self.handle_error(request, address)
2331
2523
self.close_request(request)
2332
2524
2333
2525
def process_request(self, request, address):
2334
2526
"""Start a new process to process the request."""
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2527
proc = multiprocessing.Process(target=self.sub_process_main,
2528
args=(request, address))
2337
2529
proc.start()
2338
2530
return proc
2339
2531
2340
2532
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2533
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2342
2534
""" adds a pipe to the MixIn """
2343
2535
2344
2536
def process_request(self, request, client_address):
2345
2537
"""Overrides and wraps the original process_request().
2346
2538
2347
2539
This function creates a new pipe in self.pipe
2348
2540
"""
2349
2541
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2350
2542
2351
2543
proc = MultiprocessingMixIn.process_request(self, request,
2352
2544
client_address)
2353
2545
self.child_pipe.close()
2354
2546
self.add_pipe(parent_pipe, proc)
2355
2547
2356
2548
def add_pipe(self, parent_pipe, proc):
2357
2549
"""Dummy function; override as necessary"""
2358
2550
raise NotImplementedError()
2359
2551
2360
2552
2361
2553
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2362
socketserver.TCPServer, object):
2554
socketserver.TCPServer):
2363
2555
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2364
2556
2365
2557
Attributes:
2366
2558
enabled: Boolean; whether this server is activated yet
2367
2559
interface: None or a network interface name (string)
2368
2560
use_ipv6: Boolean; to use IPv6 or not
2369
2561
"""
2370
2562
2371
2563
def __init__(self, server_address, RequestHandlerClass,
2372
2564
interface=None,
2373
2565
use_ipv6=True,
2383
2575
self.socketfd = socketfd
2384
2576
# Save the original socket.socket() function
2385
2577
self.socket_socket = socket.socket
2578
2386
2579
# To implement --socket, we monkey patch socket.socket.
2387
#
2580
#
2388
2581
# (When socketserver.TCPServer is a new-style class, we
2389
2582
# could make self.socket into a property instead of monkey
2390
2583
# patching socket.socket.)
2391
#
2584
#
2392
2585
# Create a one-time-only replacement for socket.socket()
2393
2586
@functools.wraps(socket.socket)
2394
2587
def socket_wrapper(*args, **kwargs):
2406
2599
# socket_wrapper(), if socketfd was set.
2407
2600
socketserver.TCPServer.__init__(self, server_address,
2408
2601
RequestHandlerClass)
2409
2602
2410
2603
def server_bind(self):
2411
2604
"""This overrides the normal server_bind() function
2412
2605
to bind to an interface if one was specified, and also NOT to
2413
2606
bind to an address or port if they were not specified."""
2607
global SO_BINDTODEVICE
2414
2608
if self.interface is not None:
2415
2609
if SO_BINDTODEVICE is None:
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2610
# Fall back to a hard-coded value which seems to be
2611
# common enough.
2612
logger.warning("SO_BINDTODEVICE not found, trying 25")
2613
SO_BINDTODEVICE = 25
2614
try:
2615
self.socket.setsockopt(
2616
socket.SOL_SOCKET, SO_BINDTODEVICE,
2617
(self.interface + "\0").encode("utf-8"))
2618
except socket.error as error:
2619
if error.errno == errno.EPERM:
2620
logger.error("No permission to bind to"
2621
" interface %s", self.interface)
2622
elif error.errno == errno.ENOPROTOOPT:
2623
logger.error("SO_BINDTODEVICE not available;"
2624
" cannot bind to interface %s",
2625
self.interface)
2626
elif error.errno == errno.ENODEV:
2627
logger.error("Interface %s does not exist,"
2628
" cannot bind", self.interface)
2629
else:
2630
raise
2437
2631
# Only bind(2) the socket if we really need to.
2438
2632
if self.server_address[0] or self.server_address[1]:
2633
if self.server_address[1]:
2634
self.allow_reuse_address = True
2439
2635
if not self.server_address[0]:
2440
2636
if self.address_family == socket.AF_INET6:
2441
any_address = "::" # in6addr_any
2637
any_address = "::" # in6addr_any
2442
2638
else:
2443
any_address = "0.0.0.0" # INADDR_ANY
2639
any_address = "0.0.0.0" # INADDR_ANY
2444
2640
self.server_address = (any_address,
2445
2641
self.server_address[1])
2446
2642
elif not self.server_address[1]:
2456
2652
2457
2653
class MandosServer(IPv6_TCPServer):
2458
2654
"""Mandos server.
2459
2655
2460
2656
Attributes:
2461
2657
clients: set of Client objects
2462
2658
gnutls_priority GnuTLS priority string
2463
2659
use_dbus: Boolean; to emit D-Bus signals or not
2464
2465
Assumes a gobject.MainLoop event loop.
2660
2661
Assumes a GLib.MainLoop event loop.
2466
2662
"""
2467
2663
2468
2664
def __init__(self, server_address, RequestHandlerClass,
2469
2665
interface=None,
2470
2666
use_ipv6=True,
2480
2676
self.gnutls_priority = gnutls_priority
2481
2677
IPv6_TCPServer.__init__(self, server_address,
2482
2678
RequestHandlerClass,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2679
interface=interface,
2680
use_ipv6=use_ipv6,
2681
socketfd=socketfd)
2682
2487
2683
def server_activate(self):
2488
2684
if self.enabled:
2489
2685
return socketserver.TCPServer.server_activate(self)
2490
2686
2491
2687
def enable(self):
2492
2688
self.enabled = True
2493
2689
2494
2690
def add_pipe(self, parent_pipe, proc):
2495
2691
# Call "handle_ipc" for both data and EOF events
2496
gobject.io_add_watch(
2497
parent_pipe.fileno(),
2498
gobject.IO_IN | gobject.IO_HUP,
2692
GLib.io_add_watch(
2693
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2694
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2499
2695
functools.partial(self.handle_ipc,
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2696
parent_pipe=parent_pipe,
2697
proc=proc))
2698
2503
2699
def handle_ipc(self, source, condition,
2504
2700
parent_pipe=None,
2505
proc = None,
2701
proc=None,
2506
2702
client_object=None):
2507
2703
# error, or the other end of multiprocessing.Pipe has closed
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2704
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2509
2705
# Wait for other process to exit
2510
2706
proc.join()
2511
2707
return False
2512
2708
2513
2709
# Read a request from the child
2514
2710
request = parent_pipe.recv()
2515
2711
command = request[0]
2516
2712
2517
2713
if command == 'init':
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2714
key_id = request[1].decode("ascii")
2715
fpr = request[2].decode("ascii")
2716
address = request[3]
2717
2718
for c in self.clients.values():
2719
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2720
continue
2721
if key_id and c.key_id == key_id:
2722
client = c
2723
break
2724
if fpr and c.fingerprint == fpr:
2523
2725
client = c
2524
2726
break
2525
2727
else:
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2728
logger.info("Client not found for key ID: %s, address"
2729
": %s", key_id or fpr, address)
2528
2730
if self.use_dbus:
2529
2731
# Emit D-Bus signal
2530
mandos_dbus_service.ClientNotFound(fpr,
2732
mandos_dbus_service.ClientNotFound(key_id or fpr,
2531
2733
address[0])
2532
2734
parent_pipe.send(False)
2533
2735
return False
2534
2535
gobject.io_add_watch(
2536
parent_pipe.fileno(),
2537
gobject.IO_IN | gobject.IO_HUP,
2736
2737
GLib.io_add_watch(
2738
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2739
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2538
2740
functools.partial(self.handle_ipc,
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2741
parent_pipe=parent_pipe,
2742
proc=proc,
2743
client_object=client))
2542
2744
parent_pipe.send(True)
2543
2745
# remove the old hook in favor of the new above hook on
2544
2746
# same fileno
2547
2749
funcname = request[1]
2548
2750
args = request[2]
2549
2751
kwargs = request[3]
2550
2752
2551
2753
parent_pipe.send(('data', getattr(client_object,
2552
2754
funcname)(*args,
2553
2755
**kwargs)))
2554
2756
2555
2757
if command == 'getattr':
2556
2758
attrname = request[1]
2557
2759
if isinstance(client_object.__getattribute__(attrname),
2558
collections.Callable):
2760
collections.abc.Callable):
2559
2761
parent_pipe.send(('function', ))
2560
2762
else:
2561
2763
parent_pipe.send((
2562
2764
'data', client_object.__getattribute__(attrname)))
2563
2765
2564
2766
if command == 'setattr':
2565
2767
attrname = request[1]
2566
2768
value = request[2]
2567
2769
setattr(client_object, attrname, value)
2568
2770
2569
2771
return True
2570
2772
2571
2773
2572
2774
def rfc3339_duration_to_delta(duration):
2573
2775
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2574
2575
>>> rfc3339_duration_to_delta("P7D")
2576
datetime.timedelta(7)
2577
>>> rfc3339_duration_to_delta("PT60S")
2578
datetime.timedelta(0, 60)
2579
>>> rfc3339_duration_to_delta("PT60M")
2580
datetime.timedelta(0, 3600)
2581
>>> rfc3339_duration_to_delta("PT24H")
2582
datetime.timedelta(1)
2583
>>> rfc3339_duration_to_delta("P1W")
2584
datetime.timedelta(7)
2585
>>> rfc3339_duration_to_delta("PT5M30S")
2586
datetime.timedelta(0, 330)
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
datetime.timedelta(1, 200)
2776
2777
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2780
True
2781
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2782
True
2783
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2784
True
2785
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2786
True
2787
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2788
True
2789
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2790
True
2589
2791
"""
2590
2792
2591
2793
# Parsing an RFC 3339 duration with regular expressions is not
2592
2794
# possible - there would have to be multiple places for the same
2593
2795
# values, like seconds. The current code, while more esoteric, is
2594
2796
# cleaner without depending on a parsing library. If Python had a
2595
2797
# built-in library for parsing we would use it, but we'd like to
2596
2798
# avoid excessive use of external libraries.
2597
2799
2598
2800
# New type for defining tokens, syntax, and semantics all-in-one
2599
2801
Token = collections.namedtuple("Token", (
2600
2802
"regexp", # To match token; if "value" is not None, must have
2633
2835
frozenset((token_year, token_month,
2634
2836
token_day, token_time,
2635
2837
token_week)))
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2838
# Define starting values:
2839
# Value so far
2840
value = datetime.timedelta()
2638
2841
found_token = None
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2842
# Following valid tokens
2843
followers = frozenset((token_duration, ))
2844
# String left to parse
2845
s = duration
2641
2846
# Loop until end token is found
2642
2847
while found_token is not token_end:
2643
2848
# Search for any currently valid tokens
2667
2872
2668
2873
def string_to_delta(interval):
2669
2874
"""Parse a string and return a datetime.timedelta
2670
2671
>>> string_to_delta('7d')
2672
datetime.timedelta(7)
2673
>>> string_to_delta('60s')
2674
datetime.timedelta(0, 60)
2675
>>> string_to_delta('60m')
2676
datetime.timedelta(0, 3600)
2677
>>> string_to_delta('24h')
2678
datetime.timedelta(1)
2679
>>> string_to_delta('1w')
2680
datetime.timedelta(7)
2681
>>> string_to_delta('5m 30s')
2682
datetime.timedelta(0, 330)
2875
2876
>>> string_to_delta('7d') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2879
True
2880
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2881
True
2882
>>> string_to_delta('24h') == datetime.timedelta(1)
2883
True
2884
>>> string_to_delta('1w') == datetime.timedelta(7)
2885
True
2886
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2887
True
2683
2888
"""
2684
2889
2685
2890
try:
2686
2891
return rfc3339_duration_to_delta(interval)
2687
2892
except ValueError:
2688
2893
pass
2689
2894
2690
2895
timevalue = datetime.timedelta(0)
2691
2896
for s in interval.split():
2692
2897
try:
2710
2915
return timevalue
2711
2916
2712
2917
2713
def daemon(nochdir = False, noclose = False):
2918
def daemon(nochdir=False, noclose=False):
2714
2919
"""See daemon(3). Standard BSD Unix function.
2715
2920
2716
2921
This should really exist as os.daemon, but it doesn't (yet)."""
2717
2922
if os.fork():
2718
2923
sys.exit()
2736
2941
2737
2942
2738
2943
def main():
2739
2944
2740
2945
##################################################################
2741
2946
# Parsing of options, both command line and config file
2742
2947
2743
2948
parser = argparse.ArgumentParser()
2744
2949
parser.add_argument("-v", "--version", action="version",
2745
version = "%(prog)s {}".format(version),
2950
version="%(prog)s {}".format(version),
2746
2951
help="show version number and exit")
2747
2952
parser.add_argument("-i", "--interface", metavar="IF",
2748
2953
help="Bind to interface IF")
2784
2989
parser.add_argument("--no-zeroconf", action="store_false",
2785
2990
dest="zeroconf", help="Do not use Zeroconf",
2786
2991
default=None)
2787
2992
2788
2993
options = parser.parse_args()
2789
2790
if options.check:
2791
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
2994
2795
2995
# Default values for config file for server-global settings
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
2996
if gnutls.has_rawpk:
2997
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2998
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2999
else:
3000
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3001
":+SIGN-DSA-SHA256")
3002
server_defaults = {"interface": "",
3003
"address": "",
3004
"port": "",
3005
"debug": "False",
3006
"priority": priority,
3007
"servicename": "Mandos",
3008
"use_dbus": "True",
3009
"use_ipv6": "True",
3010
"debuglevel": "",
3011
"restore": "True",
3012
"socket": "",
3013
"statedir": "/var/lib/mandos",
3014
"foreground": "False",
3015
"zeroconf": "True",
3016
}
3017
del priority
3018
2814
3019
# Parse config file for server-global settings
2815
server_config = configparser.SafeConfigParser(server_defaults)
3020
server_config = configparser.ConfigParser(server_defaults)
2816
3021
del server_defaults
2817
3022
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2818
# Convert the SafeConfigParser object to a dict
3023
# Convert the ConfigParser object to a dict
2819
3024
server_settings = server_config.defaults()
2820
3025
# Use the appropriate methods on the non-string config options
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3026
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3027
"foreground", "zeroconf"):
2822
3028
server_settings[option] = server_config.getboolean("DEFAULT",
2823
3029
option)
2824
3030
if server_settings["port"]:
2834
3040
server_settings["socket"] = os.dup(server_settings
2835
3041
["socket"])
2836
3042
del server_config
2837
3043
2838
3044
# Override the settings from the config file with command line
2839
3045
# options, if set.
2840
3046
for option in ("interface", "address", "port", "debug",
2858
3064
if server_settings["debug"]:
2859
3065
server_settings["foreground"] = True
2860
3066
# Now we have our good server settings in "server_settings"
2861
3067
2862
3068
##################################################################
2863
3069
2864
3070
if (not server_settings["zeroconf"]
2865
3071
and not (server_settings["port"]
2866
3072
or server_settings["socket"] != "")):
2867
3073
parser.error("Needs port or socket to work without Zeroconf")
2868
3074
2869
3075
# For convenience
2870
3076
debug = server_settings["debug"]
2871
3077
debuglevel = server_settings["debuglevel"]
2875
3081
stored_state_file)
2876
3082
foreground = server_settings["foreground"]
2877
3083
zeroconf = server_settings["zeroconf"]
2878
3084
2879
3085
if debug:
2880
3086
initlogger(debug, logging.DEBUG)
2881
3087
else:
2884
3090
else:
2885
3091
level = getattr(logging, debuglevel.upper())
2886
3092
initlogger(debug, level)
2887
3093
2888
3094
if server_settings["servicename"] != "Mandos":
2889
3095
syslogger.setFormatter(
2890
3096
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
3097
' %(levelname)s: %(message)s'.format(
2892
3098
server_settings["servicename"])))
2893
3099
2894
3100
# Parse config file with clients
2895
client_config = configparser.SafeConfigParser(Client
2896
.client_defaults)
3101
client_config = configparser.ConfigParser(Client.client_defaults)
2897
3102
client_config.read(os.path.join(server_settings["configdir"],
2898
3103
"clients.conf"))
2899
3104
2900
3105
global mandos_dbus_service
2901
3106
mandos_dbus_service = None
2902
3107
2903
3108
socketfd = None
2904
3109
if server_settings["socket"] != "":
2905
3110
socketfd = server_settings["socket"]
2921
3126
except IOError as e:
2922
3127
logger.error("Could not open file %r", pidfilename,
2923
3128
exc_info=e)
2924
2925
for name in ("_mandos", "mandos", "nobody"):
3129
3130
for name, group in (("_mandos", "_mandos"),
3131
("mandos", "mandos"),
3132
("nobody", "nogroup")):
2926
3133
try:
2927
3134
uid = pwd.getpwnam(name).pw_uid
2928
gid = pwd.getpwnam(name).pw_gid
3135
gid = pwd.getpwnam(group).pw_gid
2929
3136
break
2930
3137
except KeyError:
2931
3138
continue
2935
3142
try:
2936
3143
os.setgid(gid)
2937
3144
os.setuid(uid)
3145
if debug:
3146
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3147
gid))
2938
3148
except OSError as error:
3149
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3150
.format(uid, gid, os.strerror(error.errno)))
2939
3151
if error.errno != errno.EPERM:
2940
3152
raise
2941
3153
2942
3154
if debug:
2943
3155
# Enable all possible GnuTLS debugging
2944
3156
2945
3157
# "Use a log level over 10 to enable all debugging options."
2946
3158
# - GnuTLS manual
2947
3159
gnutls.global_set_log_level(11)
2948
3160
2949
3161
@gnutls.log_func
2950
3162
def debug_gnutls(level, string):
2951
3163
logger.debug("GnuTLS: %s", string[:-1])
2952
3164
2953
3165
gnutls.global_set_log_function(debug_gnutls)
2954
3166
2955
3167
# Redirect stdin so all checkers get /dev/null
2956
3168
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2957
3169
os.dup2(null, sys.stdin.fileno())
2958
3170
if null > 2:
2959
3171
os.close(null)
2960
3172
2961
3173
# Need to fork before connecting to D-Bus
2962
3174
if not foreground:
2963
3175
# Close all input and output, do double fork, etc.
2964
3176
daemon()
2965
2966
# multiprocessing will use threads, so before we use gobject we
2967
# need to inform gobject that threads will be used.
2968
gobject.threads_init()
2969
3177
3178
if gi.version_info < (3, 10, 2):
3179
# multiprocessing will use threads, so before we use GLib we
3180
# need to inform GLib that threads will be used.
3181
GLib.threads_init()
3182
2970
3183
global main_loop
2971
3184
# From the Avahi example code
2972
3185
DBusGMainLoop(set_as_default=True)
2973
main_loop = gobject.MainLoop()
3186
main_loop = GLib.MainLoop()
2974
3187
bus = dbus.SystemBus()
2975
3188
# End of Avahi example code
2976
3189
if use_dbus:
2989
3202
if zeroconf:
2990
3203
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2991
3204
service = AvahiServiceToSyslog(
2992
name = server_settings["servicename"],
2993
servicetype = "_mandos._tcp",
2994
protocol = protocol,
2995
bus = bus)
3205
name=server_settings["servicename"],
3206
servicetype="_mandos._tcp",
3207
protocol=protocol,
3208
bus=bus)
2996
3209
if server_settings["interface"]:
2997
3210
service.interface = if_nametoindex(
2998
3211
server_settings["interface"].encode("utf-8"))
2999
3212
3000
3213
global multiprocessing_manager
3001
3214
multiprocessing_manager = multiprocessing.Manager()
3002
3215
3003
3216
client_class = Client
3004
3217
if use_dbus:
3005
client_class = functools.partial(ClientDBus, bus = bus)
3006
3218
client_class = functools.partial(ClientDBus, bus=bus)
3219
3007
3220
client_settings = Client.config_parser(client_config)
3008
3221
old_client_settings = {}
3009
3222
clients_data = {}
3010
3223
3011
3224
# This is used to redirect stdout and stderr for checker processes
3012
3225
global wnull
3013
wnull = open(os.devnull, "w") # A writable /dev/null
3226
wnull = open(os.devnull, "w") # A writable /dev/null
3014
3227
# Only used if server is running in foreground but not in debug
3015
3228
# mode
3016
3229
if debug or not foreground:
3017
3230
wnull.close()
3018
3231
3019
3232
# Get client data and settings from last running state.
3020
3233
if server_settings["restore"]:
3021
3234
try:
3022
3235
with open(stored_state_path, "rb") as stored_state:
3023
clients_data, old_client_settings = pickle.load(
3024
stored_state)
3236
if sys.version_info.major == 2:
3237
clients_data, old_client_settings = pickle.load(
3238
stored_state)
3239
else:
3240
bytes_clients_data, bytes_old_client_settings = (
3241
pickle.load(stored_state, encoding="bytes"))
3242
# Fix bytes to strings
3243
# clients_data
3244
# .keys()
3245
clients_data = {(key.decode("utf-8")
3246
if isinstance(key, bytes)
3247
else key): value
3248
for key, value in
3249
bytes_clients_data.items()}
3250
del bytes_clients_data
3251
for key in clients_data:
3252
value = {(k.decode("utf-8")
3253
if isinstance(k, bytes) else k): v
3254
for k, v in
3255
clients_data[key].items()}
3256
clients_data[key] = value
3257
# .client_structure
3258
value["client_structure"] = [
3259
(s.decode("utf-8")
3260
if isinstance(s, bytes)
3261
else s) for s in
3262
value["client_structure"]]
3263
# .name, .host, and .checker_command
3264
for k in ("name", "host", "checker_command"):
3265
if isinstance(value[k], bytes):
3266
value[k] = value[k].decode("utf-8")
3267
if "key_id" not in value:
3268
value["key_id"] = ""
3269
elif "fingerprint" not in value:
3270
value["fingerprint"] = ""
3271
# old_client_settings
3272
# .keys()
3273
old_client_settings = {
3274
(key.decode("utf-8")
3275
if isinstance(key, bytes)
3276
else key): value
3277
for key, value in
3278
bytes_old_client_settings.items()}
3279
del bytes_old_client_settings
3280
# .host and .checker_command
3281
for value in old_client_settings.values():
3282
for attribute in ("host", "checker_command"):
3283
if isinstance(value[attribute], bytes):
3284
value[attribute] = (value[attribute]
3285
.decode("utf-8"))
3025
3286
os.remove(stored_state_path)
3026
3287
except IOError as e:
3027
3288
if e.errno == errno.ENOENT:
3035
3296
logger.warning("Could not load persistent state: "
3036
3297
"EOFError:",
3037
3298
exc_info=e)
3038
3299
3039
3300
with PGPEngine() as pgp:
3040
3301
for client_name, client in clients_data.items():
3041
3302
# Skip removed clients
3042
3303
if client_name not in client_settings:
3043
3304
continue
3044
3305
3045
3306
# Decide which value to use after restoring saved state.
3046
3307
# We have three different values: Old config file,
3047
3308
# new config file, and saved state.
3058
3319
client[name] = value
3059
3320
except KeyError:
3060
3321
pass
3061
3322
3062
3323
# Clients who has passed its expire date can still be
3063
3324
# enabled if its last checker was successful. A Client
3064
3325
# whose checker succeeded before we stored its state is
3097
3358
client_name))
3098
3359
client["secret"] = (client_settings[client_name]
3099
3360
["secret"])
3100
3361
3101
3362
# Add/remove clients based on new changes made to config
3102
3363
for client_name in (set(old_client_settings)
3103
3364
- set(client_settings)):
3105
3366
for client_name in (set(client_settings)
3106
3367
- set(old_client_settings)):
3107
3368
clients_data[client_name] = client_settings[client_name]
3108
3369
3109
3370
# Create all client objects
3110
3371
for client_name, client in clients_data.items():
3111
3372
tcp_server.clients[client_name] = client_class(
3112
name = client_name,
3113
settings = client,
3114
server_settings = server_settings)
3115
3373
name=client_name,
3374
settings=client,
3375
server_settings=server_settings)
3376
3116
3377
if not tcp_server.clients:
3117
3378
logger.warning("No clients defined")
3118
3379
3119
3380
if not foreground:
3120
3381
if pidfile is not None:
3121
3382
pid = os.getpid()
3127
3388
pidfilename, pid)
3128
3389
del pidfile
3129
3390
del pidfilename
3130
3131
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3132
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3133
3391
3392
for termsig in (signal.SIGHUP, signal.SIGTERM):
3393
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3394
lambda: main_loop.quit() and False)
3395
3134
3396
if use_dbus:
3135
3397
3136
3398
@alternate_dbus_interfaces(
3137
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3399
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3138
3400
class MandosDBusService(DBusObjectWithObjectManager):
3139
3401
"""A D-Bus proxy object"""
3140
3402
3141
3403
def __init__(self):
3142
3404
dbus.service.Object.__init__(self, bus, "/")
3143
3405
3144
3406
_interface = "se.recompile.Mandos"
3145
3407
3146
3408
@dbus.service.signal(_interface, signature="o")
3147
3409
def ClientAdded(self, objpath):
3148
3410
"D-Bus signal"
3149
3411
pass
3150
3412
3151
3413
@dbus.service.signal(_interface, signature="ss")
3152
def ClientNotFound(self, fingerprint, address):
3414
def ClientNotFound(self, key_id, address):
3153
3415
"D-Bus signal"
3154
3416
pass
3155
3417
3156
3418
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3157
3419
"true"})
3158
3420
@dbus.service.signal(_interface, signature="os")
3159
3421
def ClientRemoved(self, objpath, name):
3160
3422
"D-Bus signal"
3161
3423
pass
3162
3424
3163
3425
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3164
3426
"true"})
3165
3427
@dbus.service.method(_interface, out_signature="ao")
3166
3428
def GetAllClients(self):
3167
3429
"D-Bus method"
3168
3430
return dbus.Array(c.dbus_object_path for c in
3169
tcp_server.clients.itervalues())
3170
3431
tcp_server.clients.values())
3432
3171
3433
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3172
3434
"true"})
3173
3435
@dbus.service.method(_interface,
3175
3437
def GetAllClientsWithProperties(self):
3176
3438
"D-Bus method"
3177
3439
return dbus.Dictionary(
3178
{ c.dbus_object_path: c.GetAll(
3440
{c.dbus_object_path: c.GetAll(
3179
3441
"se.recompile.Mandos.Client")
3180
for c in tcp_server.clients.itervalues() },
3442
for c in tcp_server.clients.values()},
3181
3443
signature="oa{sv}")
3182
3444
3183
3445
@dbus.service.method(_interface, in_signature="o")
3184
3446
def RemoveClient(self, object_path):
3185
3447
"D-Bus method"
3186
for c in tcp_server.clients.itervalues():
3448
for c in tcp_server.clients.values():
3187
3449
if c.dbus_object_path == object_path:
3188
3450
del tcp_server.clients[c.name]
3189
3451
c.remove_from_connection()
3193
3455
self.client_removed_signal(c)
3194
3456
return
3195
3457
raise KeyError(object_path)
3196
3458
3197
3459
del _interface
3198
3460
3199
3461
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3200
out_signature = "a{oa{sa{sv}}}")
3462
out_signature="a{oa{sa{sv}}}")
3201
3463
def GetManagedObjects(self):
3202
3464
"""D-Bus method"""
3203
3465
return dbus.Dictionary(
3204
{ client.dbus_object_path:
3205
dbus.Dictionary(
3206
{ interface: client.GetAll(interface)
3207
for interface in
3208
client._get_all_interface_names()})
3209
for client in tcp_server.clients.values()})
3210
3466
{client.dbus_object_path:
3467
dbus.Dictionary(
3468
{interface: client.GetAll(interface)
3469
for interface in
3470
client._get_all_interface_names()})
3471
for client in tcp_server.clients.values()})
3472
3211
3473
def client_added_signal(self, client):
3212
3474
"""Send the new standard signal and the old signal"""
3213
3475
if use_dbus:
3215
3477
self.InterfacesAdded(
3216
3478
client.dbus_object_path,
3217
3479
dbus.Dictionary(
3218
{ interface: client.GetAll(interface)
3219
for interface in
3220
client._get_all_interface_names()}))
3480
{interface: client.GetAll(interface)
3481
for interface in
3482
client._get_all_interface_names()}))
3221
3483
# Old signal
3222
3484
self.ClientAdded(client.dbus_object_path)
3223
3485
3224
3486
def client_removed_signal(self, client):
3225
3487
"""Send the new standard signal and the old signal"""
3226
3488
if use_dbus:
3231
3493
# Old signal
3232
3494
self.ClientRemoved(client.dbus_object_path,
3233
3495
client.name)
3234
3496
3235
3497
mandos_dbus_service = MandosDBusService()
3236
3498
3499
# Save modules to variables to exempt the modules from being
3500
# unloaded before the function registered with atexit() is run.
3501
mp = multiprocessing
3502
wn = wnull
3503
3237
3504
def cleanup():
3238
3505
"Cleanup function; run on exit"
3239
3506
if zeroconf:
3240
3507
service.cleanup()
3241
3242
multiprocessing.active_children()
3243
wnull.close()
3508
3509
mp.active_children()
3510
wn.close()
3244
3511
if not (tcp_server.clients or client_settings):
3245
3512
return
3246
3513
3247
3514
# Store client before exiting. Secrets are encrypted with key
3248
3515
# based on what config file has. If config file is
3249
3516
# removed/edited, old secret will thus be unrecovable.
3250
3517
clients = {}
3251
3518
with PGPEngine() as pgp:
3252
for client in tcp_server.clients.itervalues():
3519
for client in tcp_server.clients.values():
3253
3520
key = client_settings[client.name]["secret"]
3254
3521
client.encrypted_secret = pgp.encrypt(client.secret,
3255
3522
key)
3256
3523
client_dict = {}
3257
3524
3258
3525
# A list of attributes that can not be pickled
3259
3526
# + secret.
3260
exclude = { "bus", "changedstate", "secret",
3261
"checker", "server_settings" }
3527
exclude = {"bus", "changedstate", "secret",
3528
"checker", "server_settings"}
3262
3529
for name, typ in inspect.getmembers(dbus.service
3263
3530
.Object):
3264
3531
exclude.add(name)
3265
3532
3266
3533
client_dict["encrypted_secret"] = (client
3267
3534
.encrypted_secret)
3268
3535
for attr in client.client_structure:
3269
3536
if attr not in exclude:
3270
3537
client_dict[attr] = getattr(client, attr)
3271
3538
3272
3539
clients[client.name] = client_dict
3273
3540
del client_settings[client.name]["secret"]
3274
3541
3275
3542
try:
3276
3543
with tempfile.NamedTemporaryFile(
3277
3544
mode='wb',
3279
3546
prefix='clients-',
3280
3547
dir=os.path.dirname(stored_state_path),
3281
3548
delete=False) as stored_state:
3282
pickle.dump((clients, client_settings), stored_state)
3549
pickle.dump((clients, client_settings), stored_state,
3550
protocol=2)
3283
3551
tempname = stored_state.name
3284
3552
os.rename(tempname, stored_state_path)
3285
3553
except (IOError, OSError) as e:
3295
3563
logger.warning("Could not save persistent state:",
3296
3564
exc_info=e)
3297
3565
raise
3298
3566
3299
3567
# Delete all clients, and settings from config
3300
3568
while tcp_server.clients:
3301
3569
name, client = tcp_server.clients.popitem()
3307
3575
if use_dbus:
3308
3576
mandos_dbus_service.client_removed_signal(client)
3309
3577
client_settings.clear()
3310
3578
3311
3579
atexit.register(cleanup)
3312
3313
for client in tcp_server.clients.itervalues():
3580
3581
for client in tcp_server.clients.values():
3314
3582
if use_dbus:
3315
3583
# Emit D-Bus signal for adding
3316
3584
mandos_dbus_service.client_added_signal(client)
3317
3585
# Need to initiate checking of clients
3318
3586
if client.enabled:
3319
3587
client.init_checker()
3320
3588
3321
3589
tcp_server.enable()
3322
3590
tcp_server.server_activate()
3323
3591
3324
3592
# Find out what port we got
3325
3593
if zeroconf:
3326
3594
service.port = tcp_server.socket.getsockname()[1]
3331
3599
else: # IPv4
3332
3600
logger.info("Now listening on address %r, port %d",
3333
3601
*tcp_server.socket.getsockname())
3334
3335
#service.interface = tcp_server.socket.getsockname()[3]
3336
3602
3603
# service.interface = tcp_server.socket.getsockname()[3]
3604
3337
3605
try:
3338
3606
if zeroconf:
3339
3607
# From the Avahi example code
3344
3612
cleanup()
3345
3613
sys.exit(1)
3346
3614
# End of Avahi example code
3347
3348
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3349
lambda *args, **kwargs:
3350
(tcp_server.handle_request
3351
(*args[2:], **kwargs) or True))
3352
3615
3616
GLib.io_add_watch(
3617
GLib.IOChannel.unix_new(tcp_server.fileno()),
3618
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3619
lambda *args, **kwargs: (tcp_server.handle_request
3620
(*args[2:], **kwargs) or True))
3621
3353
3622
logger.debug("Starting main loop")
3354
3623
main_loop.run()
3355
3624
except AvahiError as error:
3364
3633
# Must run before the D-Bus bus name gets deregistered
3365
3634
cleanup()
3366
3635
3636
3637
def should_only_run_tests():
3638
parser = argparse.ArgumentParser(add_help=False)
3639
parser.add_argument("--check", action='store_true')
3640
args, unknown_args = parser.parse_known_args()
3641
run_tests = args.check
3642
if run_tests:
3643
# Remove --check argument from sys.argv
3644
sys.argv[1:] = unknown_args
3645
return run_tests
3646
3647
# Add all tests from doctest strings
3648
def load_tests(loader, tests, none):
3649
import doctest
3650
tests.addTests(doctest.DocTestSuite())
3651
return tests
3367
3652
3368
3653
if __name__ == '__main__':
3369
main()
3654
try:
3655
if should_only_run_tests():
3656
# Call using ./mandos --check [--verbose]
3657
unittest.main()
3658
else:
3659
main()
3660
finally:
3661
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0