/mandos/release : revision 237.7.868

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

19

21

# the Free Software Foundation, either version 3 of the License, or

20

22

# (at your option) any later version.

21

23

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

24

26

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

27

# GNU General Public License for more details.

26

#

28

#

27

29

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

31

32

# Contact the authors at <mandos@recompile.se>.

32

#

33

#

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

38

41

39

import SocketServer as socketserver

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

try:

48

import SocketServer as socketserver

49

except ImportError:

50

import socketserver

40

51

import socket

41

import argparse

42

52

import datetime

43

53

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

import sys

54

try:

55

import ConfigParser as configparser

56

except ImportError:

57

import configparser

52

58

import re

53

import os

54

59

import signal

55

60

import subprocess

56

61

import atexit

57

62

import stat

58

import logging

59

63

import logging.handlers

60

64

import pwd

61

65

import contextlib

62

66

import struct

63

67

import fcntl

64

68

import functools

65

import cPickle as pickle

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

66

73

import multiprocessing

67

74

import types

68

75

import binascii

69

76

import tempfile

70

77

import itertools

78

import collections

79

import codecs

80

import random

81

import shlex

71

82

72

83

import dbus

73

84

import dbus.service

74

import gobject

75

import avahi

85

import gi

86

from gi.repository import GLib

76

87

from dbus.mainloop.glib import DBusGMainLoop

77

88

import ctypes

78

89

import ctypes.util

79

90

import xml.dom.minidom

80

91

import inspect

81

import GnuPGInterface

82

83

try:

92

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

126

# Show warnings by default

127

if not sys.warnoptions:

128

import warnings

129

warnings.simplefilter("default")

130

131

# Try to find the value of SO_BINDTODEVICE:

132

try:

133

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

134

# newer, and it is also the most natural place for it:

84

135

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

136

except AttributeError:

86

137

try:

138

# This is where SO_BINDTODEVICE was up to and including Python

139

# 2.6, and also 3.2:

87

140

from IN import SO_BINDTODEVICE

88

141

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.0"

142

# In Python 2.7 it seems to have been removed entirely.

143

# Try running the C preprocessor:

144

try:

145

cc = subprocess.Popen(["cc", "--language=c", "-E",

146

"/dev/stdin"],

147

stdin=subprocess.PIPE,

148

stdout=subprocess.PIPE)

149

stdout = cc.communicate(

150

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

151

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

152

except (OSError, ValueError, IndexError):

153

# No value found

154

SO_BINDTODEVICE = None

155

156

if sys.version_info < (3, 2):

157

configparser.Configparser = configparser.SafeConfigParser

158

159

version = "1.8.18"

92

160

stored_state_file = "clients.pickle"

93

161

94

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

163

logging.captureWarnings(True) # Show warnings via the logging system

164

syslogger = None

98

165

99

166

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

167

if_nametoindex = ctypes.cdll.LoadLibrary(

168

ctypes.util.find_library("c")).if_nametoindex

103

169

except (OSError, AttributeError):

170

104

171

def if_nametoindex(interface):

105

172

"Get an interface index the hard way, i.e. using fcntl()"

106

173

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

174

with contextlib.closing(socket.socket()) as s:

108

175

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

176

struct.pack(b"16s16x", interface))

177

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

178

return interface_index

114

179

115

180

181

def copy_function(func):

182

"""Make a copy of a function"""

183

if sys.version_info.major == 2:

184

return types.FunctionType(func.func_code,

185

func.func_globals,

186

func.func_name,

187

func.func_defaults,

188

func.func_closure)

189

else:

190

return types.FunctionType(func.__code__,

191

func.__globals__,

192

func.__name__,

193

func.__defaults__,

194

func.__closure__)

195

196

116

197

def initlogger(debug, level=logging.WARNING):

117

198

"""init logger and add loglevel"""

118

199

200

global syslogger

201

syslogger = (logging.handlers.SysLogHandler(

202

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

address="/dev/log"))

119

204

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

208

124

209

if debug:

125

210

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

132

217

133

218

134

219

class PGPError(Exception):

136

221

pass

137

222

138

223

139

class PGPEngine(object):

224

class PGPEngine:

140

225

"""A simple class for OpenPGP symmetric encryption & decryption"""

226

141

227

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

228

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

229

self.gpg = "gpg"

230

try:

231

output = subprocess.check_output(["gpgconf"])

232

for line in output.splitlines():

233

name, text, path = line.split(b":")

234

if name == b"gpg":

235

self.gpg = path

236

break

237

except OSError as e:

238

if e.errno != errno.ENOENT:

239

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

244

# Only GPG version 1 has the --no-use-agent option.

245

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

246

self.gnupgargs.append("--no-use-agent")

247

151

248

def __enter__(self):

152

249

return self

153

250

154

251

def __exit__(self, exc_type, exc_value, traceback):

155

252

self._cleanup()

156

253

return False

157

254

158

255

def __del__(self):

159

256

self._cleanup()

160

257

161

258

def _cleanup(self):

162

259

if self.tempdir is not None:

163

260

# Delete contents of tempdir

164

261

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

262

topdown=False):

166

263

for filename in files:

167

264

os.remove(os.path.join(root, filename))

168

265

for dirname in dirs:

170

267

# Remove tempdir

171

268

os.rmdir(self.tempdir)

172

269

self.tempdir = None

173

270

174

271

def password_encode(self, password):

175

272

# Passphrase can not be empty and can not contain newlines or

176

273

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

274

encoded = b"mandos" + binascii.hexlify(password)

275

if len(encoded) > 2048:

276

# GnuPG can't handle long passwords, so encode differently

277

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

278

.replace(b"\n", b"\\n")

279

.replace(b"\0", b"\\x00"))

280

return encoded

281

179

282

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

283

passphrase = self.password_encode(password)

284

with tempfile.NamedTemporaryFile(

285

dir=self.tempdir) as passfile:

286

passfile.write(passphrase)

287

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

290

passfile.name]

291

+ self.gnupgargs,

292

stdin=subprocess.PIPE,

293

stdout=subprocess.PIPE,

294

stderr=subprocess.PIPE)

295

ciphertext, err = proc.communicate(input=data)

296

if proc.returncode != 0:

297

raise PGPError(err)

194

298

return ciphertext

195

299

196

300

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

301

passphrase = self.password_encode(password)

302

with tempfile.NamedTemporaryFile(

303

dir=self.tempdir) as passfile:

304

passfile.write(passphrase)

305

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

308

passfile.name]

309

+ self.gnupgargs,

310

stdin=subprocess.PIPE,

311

stdout=subprocess.PIPE,

312

stderr=subprocess.PIPE)

313

decrypted_plaintext, err = proc.communicate(input=data)

314

if proc.returncode != 0:

315

raise PGPError(err)

211

316

return decrypted_plaintext

212

317

213

318

319

# Pretend that we have an Avahi module

320

class avahi:

321

"""This isn't so much a class as it is a module-like namespace."""

322

IF_UNSPEC = -1 # avahi-common/address.h

323

PROTO_UNSPEC = -1 # avahi-common/address.h

324

PROTO_INET = 0 # avahi-common/address.h

325

PROTO_INET6 = 1 # avahi-common/address.h

326

DBUS_NAME = "org.freedesktop.Avahi"

327

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

328

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

329

DBUS_PATH_SERVER = "/"

330

331

@staticmethod

332

def string_array_to_txt_array(t):

333

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

334

for s in t), signature="ay")

335

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

336

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

337

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

338

SERVER_INVALID = 0 # avahi-common/defs.h

339

SERVER_REGISTERING = 1 # avahi-common/defs.h

340

SERVER_RUNNING = 2 # avahi-common/defs.h

341

SERVER_COLLISION = 3 # avahi-common/defs.h

342

SERVER_FAILURE = 4 # avahi-common/defs.h

343

344

214

345

class AvahiError(Exception):

215

346

def __init__(self, value, *args, **kwargs):

216

347

self.value = value

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

348

return super(AvahiError, self).__init__(value, *args,

349

**kwargs)

350

220

351

221

352

class AvahiServiceError(AvahiError):

222

353

pass

223

354

355

224

356

class AvahiGroupError(AvahiError):

225

357

pass

226

358

227

359

228

class AvahiService(object):

360

class AvahiService:

229

361

"""An Avahi (Zeroconf) service.

230

362

231

363

Attributes:

232

364

interface: integer; avahi.IF_UNSPEC or an interface index.

233

365

Used to optionally bind to the specified interface.

234

235

type: string; Example: '_mandos._tcp'.

236

See <http://www.dns-sd.org/ServiceTypes.html>

366

367

type: string; Example: "_mandos._tcp".

368

See <https://www.iana.org/assignments/service-names-port-numbers>

237

369

port: integer; what port to announce

238

370

TXT: list of strings; TXT record for the service

239

371

domain: string; Domain to publish on, default to .local if empty.

245

377

server: D-Bus Server

246

378

bus: dbus.SystemBus()

247

379

"""

248

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

servicetype = None, port = None, TXT = None,

251

domain = "", host = "", max_renames = 32768,

252

protocol = avahi.PROTO_UNSPEC, bus = None):

380

381

def __init__(self,

382

interface=avahi.IF_UNSPEC,

383

name=None,

384

servicetype=None,

385

port=None,

386

TXT=None,

387

domain="",

388

host="",

389

max_renames=32768,

390

protocol=avahi.PROTO_UNSPEC,

391

bus=None):

253

392

self.interface = interface

254

393

self.name = name

255

394

self.type = servicetype

264

403

self.server = None

265

404

self.bus = bus

266

405

self.entry_group_state_changed_match = None

267

268

def rename(self):

406

407

def rename(self, remove=True):

269

408

"""Derived from the Avahi example code"""

270

409

if self.rename_count >= self.max_renames:

271

logger.critical("No suitable Zeroconf service name found"

272

" after %i retries, exiting.",

273

self.rename_count)

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

274

413

raise AvahiServiceError("Too many renames")

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

277

logger.info("Changing Zeroconf service name to %r ...",

278

self.name)

279

self.remove()

280

try:

281

self.add()

282

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

414

self.name = str(

415

self.server.GetAlternativeServiceName(self.name))

286

416

self.rename_count += 1

287

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

419

if remove:

420

self.remove()

421

try:

422

self.add()

423

except dbus.exceptions.DBusException as error:

424

if (error.get_dbus_name()

425

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

427

return self.rename(remove=False)

428

else:

429

log.critical("D-Bus Exception", exc_info=error)

430

self.cleanup()

431

os._exit(1)

432

288

433

def remove(self):

289

434

"""Derived from the Avahi example code"""

290

435

if self.entry_group_state_changed_match is not None:

292

437

self.entry_group_state_changed_match = None

293

438

if self.group is not None:

294

439

self.group.Reset()

295

440

296

441

def add(self):

297

442

"""Derived from the Avahi example code"""

298

443

self.remove()

303

448

avahi.DBUS_INTERFACE_ENTRY_GROUP)

304

449

self.entry_group_state_changed_match = (

305

450

self.group.connect_to_signal(

306

'StateChanged', self.entry_group_state_changed))

307

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

308

self.name, self.type)

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

309

454

self.group.AddService(

310

455

self.interface,

311

456

self.protocol,

315

460

dbus.UInt16(self.port),

316

461

avahi.string_array_to_txt_array(self.TXT))

317

462

self.group.Commit()

318

463

319

464

def entry_group_state_changed(self, state, error):

320

465

"""Derived from the Avahi example code"""

321

logger.debug("Avahi entry group state change: %i", state)

322

466

log.debug("Avahi entry group state change: %i", state)

467

323

468

if state == avahi.ENTRY_GROUP_ESTABLISHED:

324

logger.debug("Zeroconf service established.")

469

log.debug("Zeroconf service established.")

325

470

elif state == avahi.ENTRY_GROUP_COLLISION:

326

logger.info("Zeroconf service name collision.")

471

log.info("Zeroconf service name collision.")

327

472

self.rename()

328

473

elif state == avahi.ENTRY_GROUP_FAILURE:

329

logger.critical("Avahi: Error in group state changed %s",

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

476

raise AvahiGroupError("State changed: {!s}".format(error))

477

334

478

def cleanup(self):

335

479

"""Derived from the Avahi example code"""

336

480

if self.group is not None:

341

485

pass

342

486

self.group = None

343

487

self.remove()

344

488

345

489

def server_state_changed(self, state, error=None):

346

490

"""Derived from the Avahi example code"""

347

logger.debug("Avahi server state change: %i", state)

348

bad_states = { avahi.SERVER_INVALID:

349

"Zeroconf server invalid",

350

avahi.SERVER_REGISTERING: None,

351

avahi.SERVER_COLLISION:

352

"Zeroconf server name collision",

353

avahi.SERVER_FAILURE:

354

"Zeroconf server failure" }

491

log.debug("Avahi server state change: %i", state)

492

bad_states = {

493

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

avahi.SERVER_REGISTERING: None,

495

avahi.SERVER_COLLISION: "Zeroconf server name collision",

496

avahi.SERVER_FAILURE: "Zeroconf server failure",

497

}

355

498

if state in bad_states:

356

499

if bad_states[state] is not None:

357

500

if error is None:

358

logger.error(bad_states[state])

501

log.error(bad_states[state])

359

502

else:

360

logger.error(bad_states[state] + ": %r", error)

503

log.error(bad_states[state] + ": %r", error)

361

504

self.cleanup()

362

505

elif state == avahi.SERVER_RUNNING:

363

self.add()

506

try:

507

self.add()

508

except dbus.exceptions.DBusException as error:

509

if (error.get_dbus_name()

510

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

512

return self.rename(remove=False)

513

else:

514

log.critical("D-Bus Exception", exc_info=error)

515

self.cleanup()

516

os._exit(1)

364

517

else:

365

518

if error is None:

366

logger.debug("Unknown state: %r", state)

519

log.debug("Unknown state: %r", state)

367

520

else:

368

logger.debug("Unknown state: %r: %r", state, error)

369

521

log.debug("Unknown state: %r: %r", state, error)

522

370

523

def activate(self):

371

524

"""Derived from the Avahi example code"""

372

525

if self.server is None:

376

529

follow_name_owner_changes=True),

377

530

avahi.DBUS_INTERFACE_SERVER)

378

531

self.server.connect_to_signal("StateChanged",

379

self.server_state_changed)

532

self.server_state_changed)

380

533

self.server_state_changed(self.server.GetState())

381

534

382

535

383

536

class AvahiServiceToSyslog(AvahiService):

384

def rename(self):

537

def rename(self, *args, **kwargs):

385

538

"""Add the new name to the syslog messages"""

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

541

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

543

.format(self.name)))

391

544

return ret

392

545

393

546

394

def timedelta_to_milliseconds(td):

395

"Convert a datetime.timedelta() to milliseconds"

396

return ((td.days * 24 * 60 * 60 * 1000)

397

+ (td.seconds * 1000)

398

+ (td.microseconds // 1000))

399

400

401

class Client(object):

547

# Pretend that we have a GnuTLS module

548

class gnutls:

549

"""This isn't so much a class as it is a module-like namespace."""

550

551

library = ctypes.util.find_library("gnutls")

552

if library is None:

553

library = ctypes.util.find_library("gnutls-deb0")

554

_library = ctypes.cdll.LoadLibrary(library)

555

del library

556

557

# Unless otherwise indicated, the constants and types below are

558

# all from the gnutls/gnutls.h C header file.

559

560

# Constants

561

E_SUCCESS = 0

562

E_INTERRUPTED = -52

563

E_AGAIN = -28

564

CRT_OPENPGP = 2

565

CRT_RAWPK = 3

566

CLIENT = 2

567

SHUT_RDWR = 0

568

CRD_CERTIFICATE = 1

569

E_NO_CERTIFICATE_FOUND = -49

570

X509_FMT_DER = 0

571

NO_TICKETS = 1<<10

572

ENABLE_RAWPK = 1<<18

573

CTYPE_PEERS = 3

574

KEYID_USE_SHA256 = 1 # gnutls/x509.h

575

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

577

# Types

578

class _session_int(ctypes.Structure):

579

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

581

582

class certificate_credentials_st(ctypes.Structure):

583

_fields_ = []

584

certificate_credentials_t = ctypes.POINTER(

585

certificate_credentials_st)

586

certificate_type_t = ctypes.c_int

587

588

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

591

592

class _openpgp_crt_int(ctypes.Structure):

593

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

595

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

credentials_type_t = ctypes.c_int

598

transport_ptr_t = ctypes.c_void_p

599

close_request_t = ctypes.c_int

600

601

# Exceptions

602

class Error(Exception):

603

def __init__(self, message=None, code=None, args=()):

604

# Default usage is by a message string, but if a return

605

# code is passed, convert it to a string with

606

# gnutls.strerror()

607

self.code = code

608

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

611

return super(gnutls.Error, self).__init__(

612

message, *args)

613

614

class CertificateSecurityError(Error):

615

pass

616

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

# Classes

643

class Credentials(With_from_param):

644

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

647

self.type = gnutls.CRD_CERTIFICATE

648

649

def __del__(self):

650

gnutls.certificate_free_credentials(self)

651

652

class ClientSession(With_from_param):

653

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

655

gnutls_flags = gnutls.CLIENT

656

if gnutls.check_version(b"3.5.6"):

657

gnutls_flags |= gnutls.NO_TICKETS

658

if gnutls.has_rawpk:

659

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

661

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

665

self.socket = socket

666

if credentials is None:

667

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

670

self.credentials = credentials

671

672

def __del__(self):

673

gnutls.deinit(self)

674

675

def handshake(self):

676

return gnutls.handshake(self)

677

678

def send(self, data):

679

data = bytes(data)

680

data_len = len(data)

681

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

683

data_len)

684

685

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

687

688

# Error handling functions

689

def _error_code(result):

690

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

693

return result

694

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

raise gnutls.CertificateSecurityError(code=result)

696

raise gnutls.Error(code=result)

697

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

700

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

703

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

return _error_code(result)

705

result = func(*arguments)

706

return result

707

708

# Unless otherwise indicated, the function declarations below are

709

# all from the gnutls/gnutls.h C header file.

710

711

# Functions

712

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

714

ctypes.POINTER(ctypes.c_char_p)]

715

priority_set_direct.restype = _error_code

716

717

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

719

init.restype = _error_code

720

721

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

723

set_default_priority.restype = _error_code

724

725

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

727

ctypes.c_size_t]

728

record_send.restype = ctypes.c_ssize_t

729

record_send.errcheck = _retry_on_error

730

731

certificate_allocate_credentials = (

732

_library.gnutls_certificate_allocate_credentials)

733

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

735

certificate_allocate_credentials.restype = _error_code

736

737

certificate_free_credentials = (

738

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

740

certificate_free_credentials.restype = None

741

742

handshake_set_private_extensions = (

743

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

745

ctypes.c_int]

746

handshake_set_private_extensions.restype = None

747

748

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

751

credentials_set.restype = _error_code

752

753

strerror = _library.gnutls_strerror

754

strerror.argtypes = [ctypes.c_int]

755

strerror.restype = ctypes.c_char_p

756

757

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

759

certificate_type_get.restype = _error_code

760

761

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

763

ctypes.POINTER(ctypes.c_uint)]

764

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

766

global_set_log_level = _library.gnutls_global_set_log_level

767

global_set_log_level.argtypes = [ctypes.c_int]

768

global_set_log_level.restype = None

769

770

global_set_log_function = _library.gnutls_global_set_log_function

771

global_set_log_function.argtypes = [log_func]

772

global_set_log_function.restype = None

773

774

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

776

deinit.restype = None

777

778

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

781

handshake.errcheck = _retry_on_error

782

783

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

785

transport_set_ptr.restype = None

786

787

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

790

bye.errcheck = _retry_on_error

791

792

check_version = _library.gnutls_check_version

793

check_version.argtypes = [ctypes.c_char_p]

794

check_version.restype = ctypes.c_char_p

795

796

_need_version = b"3.3.0"

797

if check_version(_need_version) is None:

798

raise self.Error("Needs GnuTLS {} or later"

799

.format(_need_version))

800

801

_tls_rawpk_version = b"3.6.6"

802

has_rawpk = bool(check_version(_tls_rawpk_version))

803

804

if has_rawpk:

805

# Types

806

class pubkey_st(ctypes.Structure):

807

_fields = []

808

pubkey_t = ctypes.POINTER(pubkey_st)

809

810

x509_crt_fmt_t = ctypes.c_int

811

812

# All the function declarations below are from

813

# gnutls/abstract.h

814

pubkey_init = _library.gnutls_pubkey_init

815

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

pubkey_init.restype = _error_code

817

818

pubkey_import = _library.gnutls_pubkey_import

819

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

820

x509_crt_fmt_t]

821

pubkey_import.restype = _error_code

822

823

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

824

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

825

ctypes.POINTER(ctypes.c_ubyte),

826

ctypes.POINTER(ctypes.c_size_t)]

827

pubkey_get_key_id.restype = _error_code

828

829

pubkey_deinit = _library.gnutls_pubkey_deinit

830

pubkey_deinit.argtypes = [pubkey_t]

831

pubkey_deinit.restype = None

832

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

835

836

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

838

openpgp_crt_init.restype = _error_code

839

840

openpgp_crt_import = _library.gnutls_openpgp_crt_import

841

openpgp_crt_import.argtypes = [openpgp_crt_t,

842

ctypes.POINTER(datum_t),

843

openpgp_crt_fmt_t]

844

openpgp_crt_import.restype = _error_code

845

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

853

openpgp_crt_verify_self.restype = _error_code

854

855

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

856

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

857

openpgp_crt_deinit.restype = None

858

859

openpgp_crt_get_fingerprint = (

860

_library.gnutls_openpgp_crt_get_fingerprint)

861

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

862

ctypes.c_void_p,

863

ctypes.POINTER(

864

ctypes.c_size_t)]

865

openpgp_crt_get_fingerprint.restype = _error_code

866

867

if check_version(b"3.6.4"):

868

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

870

certificate_type_get2.restype = _error_code

871

872

# Remove non-public functions

873

del _error_code, _retry_on_error

874

875

876

def call_pipe(connection, # : multiprocessing.Connection

877

func, *args, **kwargs):

878

"""This function is meant to be called by multiprocessing.Process

879

880

This function runs func(*args, **kwargs), and writes the resulting

881

return value on the provided multiprocessing.Connection.

882

"""

883

connection.send(func(*args, **kwargs))

884

connection.close()

885

886

887

class Client:

402

888

"""A representation of a client host served by this server.

403

889

404

890

Attributes:

405

approved: bool(); 'None' if not yet approved/disapproved

891

approved: bool(); None if not yet approved/disapproved

406

892

approval_delay: datetime.timedelta(); Time to wait for approval

407

893

approval_duration: datetime.timedelta(); Duration of one approval

408

checker: subprocess.Popen(); a running checker process used

409

to see if the client lives.

410

'None' if no process is running.

411

checker_callback_tag: a gobject event source tag, or None

894

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

896

running.

897

checker_callback_tag: a GLib event source tag, or None

412

898

checker_command: string; External command which is run to check

413

899

if client lives. %() expansions are done at

414

900

runtime with vars(self) as dict, so that for

415

901

instance %(name)s can be used in the command.

416

checker_initiator_tag: a gobject event source tag, or None

902

checker_initiator_tag: a GLib event source tag, or None

417

903

created: datetime.datetime(); (UTC) object creation

418

904

client_structure: Object describing what attributes a client has

419

905

and is used for storing the client at exit

420

906

current_checker_command: string; current running checker_command

421

disable_initiator_tag: a gobject event source tag, or None

907

disable_initiator_tag: a GLib event source tag, or None

422

908

enabled: bool()

423

909

fingerprint: string (40 or 32 hexadecimal digits); used to

424

uniquely identify the client

910

uniquely identify an OpenPGP client

911

key_id: string (64 hexadecimal digits); used to uniquely identify

912

a client using raw public keys

425

913

host: string; available for use by the checker command

426

914

interval: datetime.timedelta(); How often to start a new checker

427

915

last_approval_request: datetime.datetime(); (UTC) or None

429

917

last_checker_status: integer between 0 and 255 reflecting exit

430

918

status of last checker. -1 reflects crashed

431

919

checker, -2 means no checker completed yet.

920

last_checker_signal: The signal which killed the last checker, if

921

last_checker_status is -1

432

922

last_enabled: datetime.datetime(); (UTC) or None

433

923

434

924

D-Bus identifiers

439

929

runtime_expansions: Allowed attributes for runtime expansion.

440

930

expires: datetime.datetime(); time (UTC) when a client will be

441

931

disabled, or None

932

server_settings: The server_settings dict from main()

442

933

"""

443

934

444

935

runtime_expansions = ("approval_delay", "approval_duration",

445

"created", "enabled", "expires",

936

"created", "enabled", "expires", "key_id",

446

937

"fingerprint", "host", "interval",

447

938

"last_approval_request", "last_checked_ok",

448

939

"last_enabled", "name", "timeout")

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

460

def timeout_milliseconds(self):

461

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

463

464

def extended_timeout_milliseconds(self):

465

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

467

468

def interval_milliseconds(self):

469

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

471

472

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

474

940

client_defaults = {

941

"timeout": "PT5M",

942

"extended_timeout": "PT15M",

943

"interval": "PT2M",

944

"checker": "fping -q -- %%(host)s",

945

"host": "",

946

"approval_delay": "PT0S",

947

"approval_duration": "PT1S",

948

"approved_by_default": "True",

949

"enabled": "True",

950

}

951

475

952

@staticmethod

476

953

def config_parser(config):

477

954

"""Construct a new dict of client settings of this form:

484

961

for client_name in config.sections():

485

962

section = dict(config.items(client_name))

486

963

client = settings[client_name] = {}

487

964

488

965

client["host"] = section["host"]

489

966

# Reformat values from string types to Python types

490

967

client["approved_by_default"] = config.getboolean(

491

968

client_name, "approved_by_default")

492

969

client["enabled"] = config.getboolean(client_name,

493

970

"enabled")

494

495

client["fingerprint"] = (section["fingerprint"].upper()

971

972

# Uppercase and remove spaces from key_id and fingerprint

973

# for later comparison purposes with return value from the

974

# key_id() and fingerprint() functions

975

client["key_id"] = (section.get("key_id", "").upper()

976

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

496

979

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

497

985

if "secret" in section:

498

client["secret"] = section["secret"].decode("base64")

986

client["secret"] = codecs.decode(section["secret"]

987

.encode("utf-8"),

988

"base64")

499

989

elif "secfile" in section:

500

990

with open(os.path.expanduser(os.path.expandvars

501

991

(section["secfile"])),

502

992

"rb") as secfile:

503

993

client["secret"] = secfile.read()

504

994

else:

505

raise TypeError("No secret or secfile for section {0}"

995

raise TypeError("No secret or secfile for section {}"

506

996

.format(section))

507

997

client["timeout"] = string_to_delta(section["timeout"])

508

998

client["extended_timeout"] = string_to_delta(

516

1006

client["last_approval_request"] = None

517

1007

client["last_checked_ok"] = None

518

1008

client["last_checker_status"] = -2

519

1009

520

1010

return settings

521

522

def __init__(self, settings, name = None):

1011

1012

def __init__(self, settings, name=None, server_settings=None):

523

1013

self.name = name

1014

if server_settings is None:

1015

server_settings = {}

1016

self.server_settings = server_settings

524

1017

# adding all client settings

525

for setting, value in settings.iteritems():

1018

for setting, value in settings.items():

526

1019

setattr(self, setting, value)

527

1020

528

1021

if self.enabled:

529

1022

if not hasattr(self, "last_enabled"):

530

1023

self.last_enabled = datetime.datetime.utcnow()

534

1027

else:

535

1028

self.last_enabled = None

536

1029

self.expires = None

537

538

logger.debug("Creating client %r", self.name)

539

# Uppercase and remove spaces from fingerprint for later

540

# comparison purposes with return value from the fingerprint()

541

# function

542

logger.debug(" Fingerprint: %s", self.fingerprint)

1030

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

543

1034

self.created = settings.get("created",

544

1035

datetime.datetime.utcnow())

545

1036

546

1037

# attributes specific for this server instance

547

1038

self.checker = None

548

1039

self.checker_initiator_tag = None

551

1042

self.current_checker_command = None

552

1043

self.approved = None

553

1044

self.approvals_pending = 0

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

1045

self.changedstate = multiprocessing_manager.Condition(

1046

multiprocessing_manager.Lock())

1047

self.client_structure = [attr

1048

for attr in self.__dict__.keys()

559

1049

if not attr.startswith("_")]

560

1050

self.client_structure.append("client_structure")

561

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

1051

1052

for name, t in inspect.getmembers(

1053

type(self), lambda obj: isinstance(obj, property)):

566

1054

if not name.startswith("_"):

567

1055

self.client_structure.append(name)

568

1056

569

1057

# Send notice to process children that client state has changed

570

1058

def send_changedstate(self):

571

1059

with self.changedstate:

572

1060

self.changedstate.notify_all()

573

1061

574

1062

def enable(self):

575

1063

"""Start this client's checker and timeout hooks"""

576

1064

if getattr(self, "enabled", False):

577

1065

# Already enabled

578

1066

return

579

self.expires = datetime.datetime.utcnow() + self.timeout

580

1067

self.enabled = True

581

1068

self.last_enabled = datetime.datetime.utcnow()

582

1069

self.init_checker()

583

1070

self.send_changedstate()

584

1071

585

1072

def disable(self, quiet=True):

586

1073

"""Disable this client."""

587

1074

if not getattr(self, "enabled", False):

588

1075

return False

589

1076

if not quiet:

590

logger.info("Disabling client %s", self.name)

1077

log.info("Disabling client %s", self.name)

591

1078

if getattr(self, "disable_initiator_tag", None) is not None:

592

gobject.source_remove(self.disable_initiator_tag)

1079

GLib.source_remove(self.disable_initiator_tag)

593

1080

self.disable_initiator_tag = None

594

1081

self.expires = None

595

1082

if getattr(self, "checker_initiator_tag", None) is not None:

596

gobject.source_remove(self.checker_initiator_tag)

1083

GLib.source_remove(self.checker_initiator_tag)

597

1084

self.checker_initiator_tag = None

598

1085

self.stop_checker()

599

1086

self.enabled = False

600

1087

if not quiet:

601

1088

self.send_changedstate()

602

# Do not run this again if called by a gobject.timeout_add

1089

# Do not run this again if called by a GLib.timeout_add

603

1090

return False

604

1091

605

1092

def __del__(self):

606

1093

self.disable()

607

608

def init_checker(self):

609

# Schedule a new checker to be started an 'interval' from now,

610

# and every interval from then on.

1094

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

611

1100

if self.checker_initiator_tag is not None:

612

gobject.source_remove(self.checker_initiator_tag)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

616

# Schedule a disable() when 'timeout' has passed

1101

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

617

1119

if self.disable_initiator_tag is not None:

618

gobject.source_remove(self.disable_initiator_tag)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

622

# Also start a new checker *right now*.

623

self.start_checker()

624

625

def checker_callback(self, pid, condition, command):

1120

GLib.source_remove(self.disable_initiator_tag)

1121

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1124

1125

def checker_callback(self, source, condition, connection,

1126

command):

626

1127

"""The checker has completed, so take appropriate actions."""

1128

# Read return code from connection (see call_pipe)

1129

returncode = connection.recv()

1130

connection.close()

1131

if self.checker is not None:

1132

self.checker.join()

627

1133

self.checker_callback_tag = None

628

1134

self.checker = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

1135

1136

if returncode >= 0:

1137

self.last_checker_status = returncode

1138

self.last_checker_signal = None

631

1139

if self.last_checker_status == 0:

632

logger.info("Checker for %(name)s succeeded",

633

vars(self))

1140

log.info("Checker for %(name)s succeeded", vars(self))

634

1141

self.checked_ok()

635

1142

else:

636

logger.info("Checker for %(name)s failed",

637

vars(self))

1143

log.info("Checker for %(name)s failed", vars(self))

638

1144

else:

639

1145

self.last_checker_status = -1

640

logger.warning("Checker for %(name)s crashed?",

641

vars(self))

642

1146

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1148

return False

1149

643

1150

def checked_ok(self):

644

1151

"""Assert that the client has been seen, alive and well."""

645

1152

self.last_checked_ok = datetime.datetime.utcnow()

646

1153

self.last_checker_status = 0

1154

self.last_checker_signal = None

647

1155

self.bump_timeout()

648

1156

649

1157

def bump_timeout(self, timeout=None):

650

1158

"""Bump up the timeout for this client."""

651

1159

if timeout is None:

652

1160

timeout = self.timeout

653

1161

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

1162

GLib.source_remove(self.disable_initiator_tag)

655

1163

self.disable_initiator_tag = None

656

1164

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

1165

self.disable_initiator_tag = GLib.timeout_add(

1166

int(timeout.total_seconds() * 1000), self.disable)

660

1167

self.expires = datetime.datetime.utcnow() + timeout

661

1168

662

1169

def need_approval(self):

663

1170

self.last_approval_request = datetime.datetime.utcnow()

664

665

def start_checker(self):

1171

1172

def start_checker(self, start_was_randomized=False):

666

1173

"""Start a new checker subprocess if one is not running.

667

1174

668

1175

If a checker already exists, leave it running and do

669

1176

nothing."""

670

1177

# The reason for not killing a running checker is that if we

675

1182

# checkers alone, the checker would have to take more time

676

1183

# than 'timeout' for the client to be disabled, which is as it

677

1184

# should be.

678

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except (AttributeError, OSError) as error:

683

if (isinstance(error, OSError)

684

and error.errno != errno.ECHILD):

685

raise error

686

else:

687

if pid:

688

logger.warning("Checker was a zombie")

689

gobject.source_remove(self.checker_callback_tag)

690

self.checker_callback(pid, status,

691

self.current_checker_command)

1185

1186

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1188

self.checker.join()

1189

self.checker = None

692

1190

# Start a new checker if needed

693

1191

if self.checker is None:

694

1192

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

1193

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1195

for attr in self.runtime_expansions}

699

1196

try:

700

1197

command = self.checker_command % escaped_attrs

701

1198

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1201

return True # Try again later

705

1202

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/")

716

except OSError as error:

717

logger.error("Failed to start subprocess",

718

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

729

# Re-run this periodically if run by gobject.timeout_add

1203

log.info("Starting checker %r for %s", command, self.name)

1204

# We don't need to redirect stdout and stderr, since

1205

# in normal mode, that is already done by daemon(),

1206

# and in debug mode we don't want to. (Stdin is

1207

# always replaced by /dev/null.)

1208

# The exception is when not debugging but nevertheless

1209

# running in the foreground; use the previously

1210

# created wnull.

1211

popen_args = {"close_fds": True,

1212

"shell": True,

1213

"cwd": "/"}

1214

if (not self.server_settings["debug"]

1215

and self.server_settings["foreground"]):

1216

popen_args.update({"stdout": wnull,

1217

"stderr": wnull})

1218

pipe = multiprocessing.Pipe(duplex=False)

1219

self.checker = multiprocessing.Process(

1220

target=call_pipe,

1221

args=(pipe[1], subprocess.call, command),

1222

kwargs=popen_args)

1223

self.checker.start()

1224

self.checker_callback_tag = GLib.io_add_watch(

1225

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1227

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

# Re-run this periodically if run by GLib.timeout_add

730

1240

return True

731

1241

732

1242

def stop_checker(self):

733

1243

"""Force the checker process, if any, to stop."""

734

1244

if self.checker_callback_tag:

735

gobject.source_remove(self.checker_callback_tag)

1245

GLib.source_remove(self.checker_callback_tag)

736

1246

self.checker_callback_tag = None

737

1247

if getattr(self, "checker", None) is None:

738

1248

return

739

logger.debug("Stopping checker for %(name)s", vars(self))

740

try:

741

self.checker.terminate()

742

#time.sleep(0.5)

743

#if self.checker.poll() is None:

744

# self.checker.kill()

745

except OSError as error:

746

if error.errno != errno.ESRCH: # No such process

747

raise

1249

log.debug("Stopping checker for %(name)s", vars(self))

1250

self.checker.terminate()

748

1251

self.checker = None

749

1252

750

1253

751

def dbus_service_property(dbus_interface, signature="v",

752

access="readwrite", byte_arrays=False):

1254

def dbus_service_property(dbus_interface,

1255

signature="v",

1256

access="readwrite",

1257

byte_arrays=False):

753

1258

"""Decorators for marking methods of a DBusObjectWithProperties to

754

1259

become properties on the D-Bus.

755

1260

756

1261

The decorated method will be called with no arguments by "Get"

757

1262

and with one argument by "Set".

758

1263

759

1264

The parameters, where they are supported, are the same as

760

1265

dbus.service.method, except there is only "signature", since the

761

1266

type from Get() and the type sent to Set() is the same.

764

1269

# "Set" method, so we fail early here:

765

1270

if byte_arrays and signature != "ay":

766

1271

raise ValueError("Byte arrays not supported for non-'ay'"

767

" signature {0!r}".format(signature))

1272

" signature {!r}".format(signature))

1273

768

1274

def decorator(func):

769

1275

func._dbus_is_property = True

770

1276

func._dbus_interface = dbus_interface

773

1279

func._dbus_name = func.__name__

774

1280

if func._dbus_name.endswith("_dbus_property"):

775

1281

func._dbus_name = func._dbus_name[:-14]

776

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

777

1283

return func

1284

778

1285

return decorator

779

1286

780

1287

781

1288

def dbus_interface_annotations(dbus_interface):

782

1289

"""Decorator for marking functions returning interface annotations

783

1290

784

1291

Usage:

785

1292

786

1293

@dbus_interface_annotations("org.example.Interface")

787

1294

def _foo(self): # Function name does not matter

788

1295

return {"org.freedesktop.DBus.Deprecated": "true",

789

1296

"org.freedesktop.DBus.Property.EmitsChangedSignal":

790

1297

"false"}

791

1298

"""

1299

792

1300

def decorator(func):

793

1301

func._dbus_is_interface = True

794

1302

func._dbus_interface = dbus_interface

795

1303

func._dbus_name = dbus_interface

796

1304

return func

1305

797

1306

return decorator

798

1307

799

1308

800

1309

def dbus_annotations(annotations):

801

1310

"""Decorator to annotate D-Bus methods, signals or properties

802

1311

Usage:

803

1312

1313

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1314

"org.freedesktop.DBus.Property."

1315

"EmitsChangedSignal": "false"})

804

1316

@dbus_service_property("org.example.Interface", signature="b",

805

1317

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

809

1318

def Property_dbus_property(self):

810

1319

return dbus.Boolean(False)

1320

1321

See also the DBusObjectWithAnnotations class.

811

1322

"""

1323

812

1324

def decorator(func):

813

1325

func._dbus_annotations = annotations

814

1326

return func

1327

815

1328

return decorator

816

1329

817

1330

818

1331

class DBusPropertyException(dbus.exceptions.DBusException):

819

1332

"""A base class for D-Bus property-related exceptions

820

1333

"""

821

def __unicode__(self):

822

return unicode(str(self))

1334

pass

823

1335

824

1336

825

1337

class DBusPropertyAccessException(DBusPropertyException):

834

1346

pass

835

1347

836

1348

837

class DBusObjectWithProperties(dbus.service.Object):

838

"""A D-Bus object with properties.

839

840

Classes inheriting from this can use the dbus_service_property

841

decorator to expose methods as D-Bus properties. It exposes the

842

standard Get(), Set(), and GetAll() methods on the D-Bus.

1349

class DBusObjectWithAnnotations(dbus.service.Object):

1350

"""A D-Bus object with annotations.

1351

1352

Classes inheriting from this can use the dbus_annotations

1353

decorator to add annotations to methods or signals.

843

1354

"""

844

1355

845

1356

@staticmethod

846

1357

def _is_dbus_thing(thing):

847

1358

"""Returns a function testing if an attribute is a D-Bus thing

848

1359

849

1360

If called like _is_dbus_thing("method") it returns a function

850

1361

suitable for use as predicate to inspect.getmembers().

851

1362

"""

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1363

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

853

1364

False)

854

1365

855

1366

def _get_all_dbus_things(self, thing):

856

1367

"""Returns a generator of (name, attribute) pairs

857

1368

"""

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

1369

return ((getattr(athing.__get__(self), "_dbus_name", name),

860

1370

athing.__get__(self))

861

1371

for cls in self.__class__.__mro__

862

1372

for name, athing in

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

865

1373

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1374

1375

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1379

def Introspect(self, object_path, connection):

1380

"""Overloading of standard D-Bus method.

1381

1382

Inserts annotation tags on methods and signals.

1383

"""

1384

xmlstring = dbus.service.Object.Introspect(self, object_path,

1385

connection)

1386

try:

1387

document = xml.dom.minidom.parseString(xmlstring)

1388

1389

for if_tag in document.getElementsByTagName("interface"):

1390

# Add annotation tags

1391

for typ in ("method", "signal"):

1392

for tag in if_tag.getElementsByTagName(typ):

1393

annots = dict()

1394

for name, prop in (self.

1395

_get_all_dbus_things(typ)):

1396

if (name == tag.getAttribute("name")

1397

and prop._dbus_interface

1398

== if_tag.getAttribute("name")):

1399

annots.update(getattr(

1400

prop, "_dbus_annotations", {}))

1401

for name, value in annots.items():

1402

ann_tag = document.createElement(

1403

"annotation")

1404

ann_tag.setAttribute("name", name)

1405

ann_tag.setAttribute("value", value)

1406

tag.appendChild(ann_tag)

1407

# Add interface annotation tags

1408

for annotation, value in dict(

1409

itertools.chain.from_iterable(

1410

annotations().items()

1411

for name, annotations

1412

in self._get_all_dbus_things("interface")

1413

if name == if_tag.getAttribute("name")

1414

)).items():

1415

ann_tag = document.createElement("annotation")

1416

ann_tag.setAttribute("name", annotation)

1417

ann_tag.setAttribute("value", value)

1418

if_tag.appendChild(ann_tag)

1419

# Fix argument name for the Introspect method itself

1420

if (if_tag.getAttribute("name")

1421

== dbus.INTROSPECTABLE_IFACE):

1422

for cn in if_tag.getElementsByTagName("method"):

1423

if cn.getAttribute("name") == "Introspect":

1424

for arg in cn.getElementsByTagName("arg"):

1425

if (arg.getAttribute("direction")

1426

== "out"):

1427

arg.setAttribute("name",

1428

"xml_data")

1429

xmlstring = document.toxml("utf-8")

1430

document.unlink()

1431

except (AttributeError, xml.dom.DOMException,

1432

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1435

return xmlstring

1436

1437

1438

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1439

"""A D-Bus object with properties.

1440

1441

Classes inheriting from this can use the dbus_service_property

1442

decorator to expose methods as D-Bus properties. It exposes the

1443

standard Get(), Set(), and GetAll() methods on the D-Bus.

1444

"""

1445

866

1446

def _get_dbus_property(self, interface_name, property_name):

867

1447

"""Returns a bound method if one exists which is a D-Bus

868

1448

property with the specified name and interface.

869

1449

"""

870

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

1450

for cls in self.__class__.__mro__:

1451

for name, value in inspect.getmembers(

1452

cls, self._is_dbus_thing("property")):

874

1453

if (value._dbus_name == property_name

875

1454

and value._dbus_interface == interface_name):

876

1455

return value.__get__(self)

877

1456

878

1457

# No such property

879

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

+ interface_name + "."

881

+ property_name)

882

883

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1458

raise DBusPropertyNotFound("{}:{}.{}".format(

1459

self.dbus_object_path, interface_name, property_name))

1460

1461

@classmethod

1462

def _get_all_interface_names(cls):

1463

"""Get a sequence of all interfaces supported by an object"""

1464

return (name for name in set(getattr(getattr(x, attr),

1465

"_dbus_interface", None)

1466

for x in (inspect.getmro(cls))

1467

for attr in dir(x))

1468

if name is not None)

1469

1470

@dbus.service.method(dbus.PROPERTIES_IFACE,

1471

in_signature="ss",

884

1472

out_signature="v")

885

1473

def Get(self, interface_name, property_name):

886

1474

"""Standard D-Bus property Get() method, see D-Bus standard.

892

1480

if not hasattr(value, "variant_level"):

893

1481

return value

894

1482

return type(value)(value, variant_level=value.variant_level+1)

895

1483

896

1484

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

897

1485

def Set(self, interface_name, property_name, value):

898

1486

"""Standard D-Bus property Set() method, see D-Bus standard.

904

1492

# The byte_arrays option is not supported yet on

905

1493

# signatures other than "ay".

906

1494

if prop._dbus_signature != "ay":

907

raise ValueError

908

value = dbus.ByteArray(b''.join(chr(byte)

909

for byte in value))

1495

raise ValueError("Byte arrays not supported for non-"

1496

"'ay' signature {!r}"

1497

.format(prop._dbus_signature))

1498

value = dbus.ByteArray(bytes(value))

910

1499

prop(value)

911

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1500

1501

@dbus.service.method(dbus.PROPERTIES_IFACE,

1502

in_signature="s",

913

1503

out_signature="a{sv}")

914

1504

def GetAll(self, interface_name):

915

1505

"""Standard D-Bus property GetAll() method, see D-Bus

916

1506

standard.

917

1507

918

1508

Note: Will not include properties with access="write".

919

1509

"""

920

1510

properties = {}

930

1520

if not hasattr(value, "variant_level"):

931

1521

properties[name] = value

932

1522

continue

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

1523

properties[name] = type(value)(

1524

value, variant_level=value.variant_level + 1)

935

1525

return dbus.Dictionary(properties, signature="sv")

936

1526

1527

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1528

def PropertiesChanged(self, interface_name, changed_properties,

1529

invalidated_properties):

1530

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1531

standard.

1532

"""

1533

pass

1534

937

1535

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

938

1536

out_signature="s",

939

path_keyword='object_path',

940

connection_keyword='connection')

1537

path_keyword="object_path",

1538

connection_keyword="connection")

941

1539

def Introspect(self, object_path, connection):

942

1540

"""Overloading of standard D-Bus method.

943

1541

944

1542

Inserts property tags and interface annotation tags.

945

1543

"""

946

xmlstring = dbus.service.Object.Introspect(self, object_path,

947

connection)

1544

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1545

object_path,

1546

connection)

948

1547

try:

949

1548

document = xml.dom.minidom.parseString(xmlstring)

1549

950

1550

def make_tag(document, name, prop):

951

1551

e = document.createElement("property")

952

1552

e.setAttribute("name", name)

953

1553

e.setAttribute("type", prop._dbus_signature)

954

1554

e.setAttribute("access", prop._dbus_access)

955

1555

return e

1556

956

1557

for if_tag in document.getElementsByTagName("interface"):

957

1558

# Add property tags

958

1559

for tag in (make_tag(document, name, prop)

961

1562

if prop._dbus_interface

962

1563

== if_tag.getAttribute("name")):

963

1564

if_tag.appendChild(tag)

964

# Add annotation tags

965

for typ in ("method", "signal", "property"):

966

for tag in if_tag.getElementsByTagName(typ):

967

annots = dict()

968

for name, prop in (self.

969

_get_all_dbus_things(typ)):

970

if (name == tag.getAttribute("name")

971

and prop._dbus_interface

972

== if_tag.getAttribute("name")):

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

978

ann_tag = document.createElement(

979

"annotation")

980

ann_tag.setAttribute("name", name)

981

ann_tag.setAttribute("value", value)

982

tag.appendChild(ann_tag)

983

# Add interface annotation tags

984

for annotation, value in dict(

985

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

989

if name == if_tag.getAttribute("name")

990

)).iteritems():

991

ann_tag = document.createElement("annotation")

992

ann_tag.setAttribute("name", annotation)

993

ann_tag.setAttribute("value", value)

994

if_tag.appendChild(ann_tag)

1565

# Add annotation tags for properties

1566

for tag in if_tag.getElementsByTagName("property"):

1567

annots = dict()

1568

for name, prop in self._get_all_dbus_things(

1569

"property"):

1570

if (name == tag.getAttribute("name")

1571

and prop._dbus_interface

1572

== if_tag.getAttribute("name")):

1573

annots.update(getattr(

1574

prop, "_dbus_annotations", {}))

1575

for name, value in annots.items():

1576

ann_tag = document.createElement(

1577

"annotation")

1578

ann_tag.setAttribute("name", name)

1579

ann_tag.setAttribute("value", value)

1580

tag.appendChild(ann_tag)

995

1581

# Add the names to the return values for the

996

1582

# "org.freedesktop.DBus.Properties" methods

997

1583

if (if_tag.getAttribute("name")

1011

1597

document.unlink()

1012

1598

except (AttributeError, xml.dom.DOMException,

1013

1599

xml.parsers.expat.ExpatError) as error:

1014

logger.error("Failed to override Introspection method",

1015

exc_info=error)

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1602

return xmlstring

1603

1604

1605

try:

1606

dbus.OBJECT_MANAGER_IFACE

1607

except AttributeError:

1608

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1609

1610

1611

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1612

"""A D-Bus object with an ObjectManager.

1613

1614

Classes inheriting from this exposes the standard

1615

GetManagedObjects call and the InterfacesAdded and

1616

InterfacesRemoved signals on the standard

1617

"org.freedesktop.DBus.ObjectManager" interface.

1618

1619

Note: No signals are sent automatically; they must be sent

1620

manually.

1621

"""

1622

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1623

out_signature="a{oa{sa{sv}}}")

1624

def GetManagedObjects(self):

1625

"""This function must be overridden"""

1626

raise NotImplementedError()

1627

1628

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1629

signature="oa{sa{sv}}")

1630

def InterfacesAdded(self, object_path, interfaces_and_properties):

1631

pass

1632

1633

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1634

def InterfacesRemoved(self, object_path, interfaces):

1635

pass

1636

1637

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1641

def Introspect(self, object_path, connection):

1642

"""Overloading of standard D-Bus method.

1643

1644

Override return argument name of GetManagedObjects to be

1645

"objpath_interfaces_and_properties"

1646

"""

1647

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1648

object_path,

1649

connection)

1650

try:

1651

document = xml.dom.minidom.parseString(xmlstring)

1652

1653

for if_tag in document.getElementsByTagName("interface"):

1654

# Fix argument name for the GetManagedObjects method

1655

if (if_tag.getAttribute("name")

1656

== dbus.OBJECT_MANAGER_IFACE):

1657

for cn in if_tag.getElementsByTagName("method"):

1658

if (cn.getAttribute("name")

1659

== "GetManagedObjects"):

1660

for arg in cn.getElementsByTagName("arg"):

1661

if (arg.getAttribute("direction")

1662

== "out"):

1663

arg.setAttribute(

1664

"name",

1665

"objpath_interfaces"

1666

"_and_properties")

1667

xmlstring = document.toxml("utf-8")

1668

document.unlink()

1669

except (AttributeError, xml.dom.DOMException,

1670

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1016

1673

return xmlstring

1017

1674

1018

1675

1019

1676

def datetime_to_dbus(dt, variant_level=0):

1020

1677

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1021

1678

if dt is None:

1022

return dbus.String("", variant_level = variant_level)

1023

return dbus.String(dt.isoformat(),

1024

variant_level=variant_level)

1679

return dbus.String("", variant_level=variant_level)

1680

return dbus.String(dt.isoformat(), variant_level=variant_level)

1025

1681

1026

1682

1027

1683

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1029

1685

dbus.service.Object, it will add alternate D-Bus attributes with

1030

1686

interface names according to the "alt_interface_names" mapping.

1031

1687

Usage:

1032

1688

1033

1689

@alternate_dbus_interfaces({"org.example.Interface":

1034

1690

"net.example.AlternateInterface"})

1035

1691

class SampleDBusObject(dbus.service.Object):

1036

1692

@dbus.service.method("org.example.Interface")

1037

1693

def SampleDBusMethod():

1038

1694

pass

1039

1695

1040

1696

The above "SampleDBusMethod" on "SampleDBusObject" will be

1041

1697

reachable via two interfaces: "org.example.Interface" and

1042

1698

"net.example.AlternateInterface", the latter of which will have

1043

1699

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1044

1700

"true", unless "deprecate" is passed with a False value.

1045

1701

1046

1702

This works for methods and signals, and also for D-Bus properties

1047

1703

(from DBusObjectWithProperties) and interfaces (from the

1048

1704

dbus_interface_annotations decorator).

1049

1705

"""

1706

1050

1707

def wrapper(cls):

1051

1708

for orig_interface_name, alt_interface_name in (

1052

alt_interface_names.iteritems()):

1709

alt_interface_names.items()):

1053

1710

attr = {}

1054

1711

interface_names = set()

1055

1712

# Go though all attributes of the class

1057

1714

# Ignore non-D-Bus attributes, and D-Bus attributes

1058

1715

# with the wrong interface name

1059

1716

if (not hasattr(attribute, "_dbus_interface")

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1717

or not attribute._dbus_interface.startswith(

1718

orig_interface_name)):

1062

1719

continue

1063

1720

# Create an alternate D-Bus interface name based on

1064

1721

# the current name

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1722

alt_interface = attribute._dbus_interface.replace(

1723

orig_interface_name, alt_interface_name)

1068

1724

interface_names.add(alt_interface)

1069

1725

# Is this a D-Bus signal?

1070

1726

if getattr(attribute, "_dbus_is_signal", False):

1071

# Extract the original non-method function by

1072

# black magic

1073

nonmethod_func = (dict(

1727

# Extract the original non-method undecorated

1728

# function by black magic

1729

if sys.version_info.major == 2:

1730

nonmethod_func = (dict(

1074

1731

zip(attribute.func_code.co_freevars,

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1732

attribute.__closure__))

1733

["func"].cell_contents)

1734

else:

1735

nonmethod_func = (dict(

1736

zip(attribute.__code__.co_freevars,

1737

attribute.__closure__))

1738

["func"].cell_contents)

1077

1739

# Create a new, but exactly alike, function

1078

1740

# object, and decorate it to be a new D-Bus signal

1079

1741

# with the alternate D-Bus interface name

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1083

(types.FunctionType(

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1742

new_function = copy_function(nonmethod_func)

1743

new_function = (dbus.service.signal(

1744

alt_interface,

1745

attribute._dbus_signature)(new_function))

1089

1746

# Copy annotations, if any

1090

1747

try:

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1748

new_function._dbus_annotations = dict(

1749

attribute._dbus_annotations)

1093

1750

except AttributeError:

1094

1751

pass

1752

1095

1753

# Define a creator of a function to call both the

1096

1754

# original and alternate functions, so both the

1097

1755

# original and alternate signals gets sent when

1100

1758

"""This function is a scope container to pass

1101

1759

func1 and func2 to the "call_both" function

1102

1760

outside of its arguments"""

1761

1762

@functools.wraps(func2)

1103

1763

def call_both(*args, **kwargs):

1104

1764

"""This function will emit two D-Bus

1105

1765

signals by calling func1 and func2"""

1106

1766

func1(*args, **kwargs)

1107

1767

func2(*args, **kwargs)

1768

# Make wrapper function look like a D-Bus

1769

# signal

1770

for name, attr in inspect.getmembers(func2):

1771

if name.startswith("_dbus_"):

1772

setattr(call_both, name, attr)

1773

1108

1774

return call_both

1109

1775

# Create the "call_both" function and add it to

1110

1776

# the class

1115

1781

# object. Decorate it to be a new D-Bus method

1116

1782

# with the alternate D-Bus interface name. Add it

1117

1783

# to the class.

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1784

attr[attrname] = (

1785

dbus.service.method(

1786

alt_interface,

1787

attribute._dbus_in_signature,

1788

attribute._dbus_out_signature)

1789

(copy_function(attribute)))

1128

1790

# Copy annotations, if any

1129

1791

try:

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1792

attr[attrname]._dbus_annotations = dict(

1793

attribute._dbus_annotations)

1132

1794

except AttributeError:

1133

1795

pass

1134

1796

# Is this a D-Bus property?

1137

1799

# object, and decorate it to be a new D-Bus

1138

1800

# property with the alternate D-Bus interface

1139

1801

# name. Add it to the class.

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1802

attr[attrname] = (dbus_service_property(

1803

alt_interface, attribute._dbus_signature,

1804

attribute._dbus_access,

1805

attribute._dbus_get_args_options

1806

["byte_arrays"])

1807

(copy_function(attribute)))

1153

1808

# Copy annotations, if any

1154

1809

try:

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1810

attr[attrname]._dbus_annotations = dict(

1811

attribute._dbus_annotations)

1157

1812

except AttributeError:

1158

1813

pass

1159

1814

# Is this a D-Bus interface?

1162

1817

# object. Decorate it to be a new D-Bus interface

1163

1818

# with the alternate D-Bus interface name. Add it

1164

1819

# to the class.

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1820

attr[attrname] = (

1821

dbus_interface_annotations(alt_interface)

1822

(copy_function(attribute)))

1173

1823

if deprecate:

1174

1824

# Deprecate all alternate interfaces

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1825

iname = "_AlternateDBusNames_interface_annotation{}"

1176

1826

for interface_name in interface_names:

1827

1177

1828

@dbus_interface_annotations(interface_name)

1178

1829

def func(self):

1179

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1830

return {"org.freedesktop.DBus.Deprecated":

1831

"true"}

1181

1832

# Find an unused name

1182

1833

for aname in (iname.format(i)

1183

1834

for i in itertools.count()):

1187

1838

if interface_names:

1188

1839

# Replace the class with a new subclass of it with

1189

1840

# methods, signals, etc. as created above.

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1841

if sys.version_info.major == 2:

1842

cls = type(b"{}Alternate".format(cls.__name__),

1843

(cls, ), attr)

1844

else:

1845

cls = type("{}Alternate".format(cls.__name__),

1846

(cls, ), attr)

1192

1847

return cls

1848

1193

1849

return wrapper

1194

1850

1195

1851

1196

1852

@alternate_dbus_interfaces({"se.recompile.Mandos":

1197

"se.bsnet.fukt.Mandos"})

1853

"se.bsnet.fukt.Mandos"})

1198

1854

class ClientDBus(Client, DBusObjectWithProperties):

1199

1855

"""A Client class using D-Bus

1200

1856

1201

1857

Attributes:

1202

1858

dbus_object_path: dbus.ObjectPath

1203

1859

bus: dbus.SystemBus()

1204

1860

"""

1205

1861

1206

1862

runtime_expansions = (Client.runtime_expansions

1207

+ ("dbus_object_path",))

1208

1863

+ ("dbus_object_path", ))

1864

1865

_interface = "se.recompile.Mandos.Client"

1866

1209

1867

# dbus.service.Object doesn't use super(), so we can't either.

1210

1211

def __init__(self, bus = None, *args, **kwargs):

1868

1869

def __init__(self, bus=None, *args, **kwargs):

1212

1870

self.bus = bus

1213

1871

Client.__init__(self, *args, **kwargs)

1214

1872

# Only now, when this client is initialized, can it show up on

1215

1873

# the D-Bus

1216

client_object_name = unicode(self.name).translate(

1874

client_object_name = str(self.name).translate(

1217

1875

{ord("."): ord("_"),

1218

1876

ord("-"): ord("_")})

1219

self.dbus_object_path = (dbus.ObjectPath

1220

("/clients/" + client_object_name))

1877

self.dbus_object_path = dbus.ObjectPath(

1878

"/clients/" + client_object_name)

1221

1879

DBusObjectWithProperties.__init__(self, self.bus,

1222

1880

self.dbus_object_path)

1223

1224

def notifychangeproperty(transform_func,

1225

dbus_name, type_func=lambda x: x,

1226

variant_level=1):

1881

1882

def notifychangeproperty(transform_func, dbus_name,

1883

type_func=lambda x: x,

1884

variant_level=1,

1885

invalidate_only=False,

1886

_interface=_interface):

1227

1887

""" Modify a variable so that it's a property which announces

1228

1888

its changes to DBus.

1229

1889

1230

1890

transform_fun: Function that takes a value and a variant_level

1231

1891

and transforms it to a D-Bus type.

1232

1892

dbus_name: D-Bus name of the variable

1234

1894

to the D-Bus. Default: no transform

1235

1895

variant_level: D-Bus variant level. Default: 1

1236

1896

"""

1237

attrname = "_{0}".format(dbus_name)

1897

attrname = "_{}".format(dbus_name)

1898

1238

1899

def setter(self, value):

1239

1900

if hasattr(self, "dbus_object_path"):

1240

1901

if (not hasattr(self, attrname) or

1241

1902

type_func(getattr(self, attrname, None))

1242

1903

!= type_func(value)):

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

1246

self.PropertyChanged(dbus.String(dbus_name),

1247

dbus_value)

1904

if invalidate_only:

1905

self.PropertiesChanged(

1906

_interface, dbus.Dictionary(),

1907

dbus.Array((dbus_name, )))

1908

else:

1909

dbus_value = transform_func(

1910

type_func(value),

1911

variant_level=variant_level)

1912

self.PropertyChanged(dbus.String(dbus_name),

1913

dbus_value)

1914

self.PropertiesChanged(

1915

_interface,

1916

dbus.Dictionary({dbus.String(dbus_name):

1917

dbus_value}),

1918

dbus.Array())

1248

1919

setattr(self, attrname, value)

1249

1920

1250

1921

return property(lambda self: getattr(self, attrname), setter)

1251

1922

1252

1923

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1253

1924

approvals_pending = notifychangeproperty(dbus.Boolean,

1254

1925

"ApprovalPending",

1255

type_func = bool)

1926

type_func=bool)

1256

1927

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1257

1928

last_enabled = notifychangeproperty(datetime_to_dbus,

1258

1929

"LastEnabled")

1259

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

1930

checker = notifychangeproperty(

1931

dbus.Boolean, "CheckerRunning",

1932

type_func=lambda checker: checker is not None)

1262

1933

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1263

1934

"LastCheckedOK")

1264

1935

last_checker_status = notifychangeproperty(dbus.Int16,

1267

1938

datetime_to_dbus, "LastApprovalRequest")

1268

1939

approved_by_default = notifychangeproperty(dbus.Boolean,

1269

1940

"ApprovedByDefault")

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1941

approval_delay = notifychangeproperty(

1942

dbus.UInt64, "ApprovalDelay",

1943

type_func=lambda td: td.total_seconds() * 1000)

1274

1944

approval_duration = notifychangeproperty(

1275

1945

dbus.UInt64, "ApprovalDuration",

1276

type_func = timedelta_to_milliseconds)

1946

type_func=lambda td: td.total_seconds() * 1000)

1277

1947

host = notifychangeproperty(dbus.String, "Host")

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1948

timeout = notifychangeproperty(

1949

dbus.UInt64, "Timeout",

1950

type_func=lambda td: td.total_seconds() * 1000)

1281

1951

extended_timeout = notifychangeproperty(

1282

1952

dbus.UInt64, "ExtendedTimeout",

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

1953

type_func=lambda td: td.total_seconds() * 1000)

1954

interval = notifychangeproperty(

1955

dbus.UInt64, "Interval",

1956

type_func=lambda td: td.total_seconds() * 1000)

1288

1957

checker_command = notifychangeproperty(dbus.String, "Checker")

1289

1958

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1959

invalidate_only=True)

1960

1290

1961

del notifychangeproperty

1291

1962

1292

1963

def __del__(self, *args, **kwargs):

1293

1964

try:

1294

1965

self.remove_from_connection()

1297

1968

if hasattr(DBusObjectWithProperties, "__del__"):

1298

1969

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1299

1970

Client.__del__(self, *args, **kwargs)

1300

1301

def checker_callback(self, pid, condition, command,

1302

*args, **kwargs):

1303

self.checker_callback_tag = None

1304

self.checker = None

1305

if os.WIFEXITED(condition):

1306

exitstatus = os.WEXITSTATUS(condition)

1971

1972

def checker_callback(self, source, condition,

1973

connection, command, *args, **kwargs):

1974

ret = Client.checker_callback(self, source, condition,

1975

connection, command, *args,

1976

**kwargs)

1977

exitstatus = self.last_checker_status

1978

if exitstatus >= 0:

1307

1979

# Emit D-Bus signal

1308

1980

self.CheckerCompleted(dbus.Int16(exitstatus),

1309

dbus.Int64(condition),

1981

# This is specific to GNU libC

1982

dbus.Int64(exitstatus << 8),

1310

1983

dbus.String(command))

1311

1984

else:

1312

1985

# Emit D-Bus signal

1313

1986

self.CheckerCompleted(dbus.Int16(-1),

1314

dbus.Int64(condition),

1987

dbus.Int64(

1988

# This is specific to GNU libC

1989

(exitstatus << 8)

1990

| self.last_checker_signal),

1315

1991

dbus.String(command))

1316

1317

return Client.checker_callback(self, pid, condition, command,

1318

*args, **kwargs)

1319

1992

return ret

1993

1320

1994

def start_checker(self, *args, **kwargs):

1321

old_checker = self.checker

1322

if self.checker is not None:

1323

old_checker_pid = self.checker.pid

1324

else:

1325

old_checker_pid = None

1995

old_checker_pid = getattr(self.checker, "pid", None)

1326

1996

r = Client.start_checker(self, *args, **kwargs)

1327

1997

# Only if new checker process was started

1328

1998

if (self.checker is not None

1330

2000

# Emit D-Bus signal

1331

2001

self.CheckerStarted(self.current_checker_command)

1332

2002

return r

1333

2003

1334

2004

def _reset_approved(self):

1335

2005

self.approved = None

1336

2006

return False

1337

2007

1338

2008

def approve(self, value=True):

1339

2009

self.approved = value

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

2010

GLib.timeout_add(int(self.approval_duration.total_seconds()

2011

* 1000), self._reset_approved)

1343

2012

self.send_changedstate()

1344

1345

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1347

1348

## Interfaces

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

1355

## Signals

1356

2013

2014

# D-Bus methods, signals & properties

2015

2016

# Interfaces

2017

2018

# Signals

2019

1357

2020

# CheckerCompleted - signal

1358

2021

@dbus.service.signal(_interface, signature="nxs")

1359

2022

def CheckerCompleted(self, exitcode, waitstatus, command):

1360

2023

"D-Bus signal"

1361

2024

pass

1362

2025

1363

2026

# CheckerStarted - signal

1364

2027

@dbus.service.signal(_interface, signature="s")

1365

2028

def CheckerStarted(self, command):

1366

2029

"D-Bus signal"

1367

2030

pass

1368

2031

1369

2032

# PropertyChanged - signal

2033

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1370

2034

@dbus.service.signal(_interface, signature="sv")

1371

2035

def PropertyChanged(self, property, value):

1372

2036

"D-Bus signal"

1373

2037

pass

1374

2038

1375

2039

# GotSecret - signal

1376

2040

@dbus.service.signal(_interface)

1377

2041

def GotSecret(self):

1380

2044

server to mandos-client

1381

2045

"""

1382

2046

pass

1383

2047

1384

2048

# Rejected - signal

1385

2049

@dbus.service.signal(_interface, signature="s")

1386

2050

def Rejected(self, reason):

1387

2051

"D-Bus signal"

1388

2052

pass

1389

2053

1390

2054

# NeedApproval - signal

1391

2055

@dbus.service.signal(_interface, signature="tb")

1392

2056

def NeedApproval(self, timeout, default):

1393

2057

"D-Bus signal"

1394

2058

return self.need_approval()

1395

1396

## Methods

1397

2059

2060

# Methods

2061

1398

2062

# Approve - method

1399

2063

@dbus.service.method(_interface, in_signature="b")

1400

2064

def Approve(self, value):

1401

2065

self.approve(value)

1402

2066

1403

2067

# CheckedOK - method

1404

2068

@dbus.service.method(_interface)

1405

2069

def CheckedOK(self):

1406

2070

self.checked_ok()

1407

2071

1408

2072

# Enable - method

2073

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1409

2074

@dbus.service.method(_interface)

1410

2075

def Enable(self):

1411

2076

"D-Bus method"

1412

2077

self.enable()

1413

2078

1414

2079

# StartChecker - method

2080

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1415

2081

@dbus.service.method(_interface)

1416

2082

def StartChecker(self):

1417

2083

"D-Bus method"

1418

2084

self.start_checker()

1419

2085

1420

2086

# Disable - method

2087

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1421

2088

@dbus.service.method(_interface)

1422

2089

def Disable(self):

1423

2090

"D-Bus method"

1424

2091

self.disable()

1425

2092

1426

2093

# StopChecker - method

2094

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1427

2095

@dbus.service.method(_interface)

1428

2096

def StopChecker(self):

1429

2097

self.stop_checker()

1430

1431

## Properties

1432

2098

2099

# Properties

2100

1433

2101

# ApprovalPending - property

1434

2102

@dbus_service_property(_interface, signature="b", access="read")

1435

2103

def ApprovalPending_dbus_property(self):

1436

2104

return dbus.Boolean(bool(self.approvals_pending))

1437

2105

1438

2106

# ApprovedByDefault - property

1439

@dbus_service_property(_interface, signature="b",

2107

@dbus_service_property(_interface,

2108

signature="b",

1440

2109

access="readwrite")

1441

2110

def ApprovedByDefault_dbus_property(self, value=None):

1442

2111

if value is None: # get

1443

2112

return dbus.Boolean(self.approved_by_default)

1444

2113

self.approved_by_default = bool(value)

1445

2114

1446

2115

# ApprovalDelay - property

1447

@dbus_service_property(_interface, signature="t",

2116

@dbus_service_property(_interface,

2117

signature="t",

1448

2118

access="readwrite")

1449

2119

def ApprovalDelay_dbus_property(self, value=None):

1450

2120

if value is None: # get

1451

return dbus.UInt64(self.approval_delay_milliseconds())

2121

return dbus.UInt64(self.approval_delay.total_seconds()

2122

* 1000)

1452

2123

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1453

2124

1454

2125

# ApprovalDuration - property

1455

@dbus_service_property(_interface, signature="t",

2126

@dbus_service_property(_interface,

2127

signature="t",

1456

2128

access="readwrite")

1457

2129

def ApprovalDuration_dbus_property(self, value=None):

1458

2130

if value is None: # get

1459

return dbus.UInt64(timedelta_to_milliseconds(

1460

self.approval_duration))

2131

return dbus.UInt64(self.approval_duration.total_seconds()

2132

* 1000)

1461

2133

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1462

2134

1463

2135

# Name - property

2136

@dbus_annotations(

2137

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1464

2138

@dbus_service_property(_interface, signature="s", access="read")

1465

2139

def Name_dbus_property(self):

1466

2140

return dbus.String(self.name)

1467

2141

2142

# KeyID - property

2143

@dbus_annotations(

2144

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2145

@dbus_service_property(_interface, signature="s", access="read")

2146

def KeyID_dbus_property(self):

2147

return dbus.String(self.key_id)

2148

1468

2149

# Fingerprint - property

2150

@dbus_annotations(

2151

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1469

2152

@dbus_service_property(_interface, signature="s", access="read")

1470

2153

def Fingerprint_dbus_property(self):

1471

2154

return dbus.String(self.fingerprint)

1472

2155

1473

2156

# Host - property

1474

@dbus_service_property(_interface, signature="s",

2157

@dbus_service_property(_interface,

2158

signature="s",

1475

2159

access="readwrite")

1476

2160

def Host_dbus_property(self, value=None):

1477

2161

if value is None: # get

1478

2162

return dbus.String(self.host)

1479

self.host = unicode(value)

1480

2163

self.host = str(value)

2164

1481

2165

# Created - property

2166

@dbus_annotations(

2167

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1482

2168

@dbus_service_property(_interface, signature="s", access="read")

1483

2169

def Created_dbus_property(self):

1484

2170

return datetime_to_dbus(self.created)

1485

2171

1486

2172

# LastEnabled - property

1487

2173

@dbus_service_property(_interface, signature="s", access="read")

1488

2174

def LastEnabled_dbus_property(self):

1489

2175

return datetime_to_dbus(self.last_enabled)

1490

2176

1491

2177

# Enabled - property

1492

@dbus_service_property(_interface, signature="b",

2178

@dbus_service_property(_interface,

2179

signature="b",

1493

2180

access="readwrite")

1494

2181

def Enabled_dbus_property(self, value=None):

1495

2182

if value is None: # get

1498

2185

self.enable()

1499

2186

else:

1500

2187

self.disable()

1501

2188

1502

2189

# LastCheckedOK - property

1503

@dbus_service_property(_interface, signature="s",

2190

@dbus_service_property(_interface,

2191

signature="s",

1504

2192

access="readwrite")

1505

2193

def LastCheckedOK_dbus_property(self, value=None):

1506

2194

if value is not None:

1507

2195

self.checked_ok()

1508

2196

return

1509

2197

return datetime_to_dbus(self.last_checked_ok)

1510

2198

1511

2199

# LastCheckerStatus - property

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

2200

@dbus_service_property(_interface, signature="n", access="read")

1514

2201

def LastCheckerStatus_dbus_property(self):

1515

2202

return dbus.Int16(self.last_checker_status)

1516

2203

1517

2204

# Expires - property

1518

2205

@dbus_service_property(_interface, signature="s", access="read")

1519

2206

def Expires_dbus_property(self):

1520

2207

return datetime_to_dbus(self.expires)

1521

2208

1522

2209

# LastApprovalRequest - property

1523

2210

@dbus_service_property(_interface, signature="s", access="read")

1524

2211

def LastApprovalRequest_dbus_property(self):

1525

2212

return datetime_to_dbus(self.last_approval_request)

1526

2213

1527

2214

# Timeout - property

1528

@dbus_service_property(_interface, signature="t",

2215

@dbus_service_property(_interface,

2216

signature="t",

1529

2217

access="readwrite")

1530

2218

def Timeout_dbus_property(self, value=None):

1531

2219

if value is None: # get

1532

return dbus.UInt64(self.timeout_milliseconds())

2220

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1533

2221

old_timeout = self.timeout

1534

2222

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

2223

# Reschedule disabling

1543

2231

if (getattr(self, "disable_initiator_tag", None)

1544

2232

is None):

1545

2233

return

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1551

2234

GLib.source_remove(self.disable_initiator_tag)

2235

self.disable_initiator_tag = GLib.timeout_add(

2236

int((self.expires - now).total_seconds() * 1000),

2237

self.disable)

2238

1552

2239

# ExtendedTimeout - property

1553

@dbus_service_property(_interface, signature="t",

2240

@dbus_service_property(_interface,

2241

signature="t",

1554

2242

access="readwrite")

1555

2243

def ExtendedTimeout_dbus_property(self, value=None):

1556

2244

if value is None: # get

1557

return dbus.UInt64(self.extended_timeout_milliseconds())

2245

return dbus.UInt64(self.extended_timeout.total_seconds()

2246

* 1000)

1558

2247

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1559

2248

1560

2249

# Interval - property

1561

@dbus_service_property(_interface, signature="t",

2250

@dbus_service_property(_interface,

2251

signature="t",

1562

2252

access="readwrite")

1563

2253

def Interval_dbus_property(self, value=None):

1564

2254

if value is None: # get

1565

return dbus.UInt64(self.interval_milliseconds())

2255

return dbus.UInt64(self.interval.total_seconds() * 1000)

1566

2256

self.interval = datetime.timedelta(0, 0, 0, value)

1567

2257

if getattr(self, "checker_initiator_tag", None) is None:

1568

2258

return

1569

2259

if self.enabled:

1570

2260

# Reschedule checker run

1571

gobject.source_remove(self.checker_initiator_tag)

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1575

2261

GLib.source_remove(self.checker_initiator_tag)

2262

self.checker_initiator_tag = GLib.timeout_add(

2263

value, self.start_checker)

2264

self.start_checker() # Start one now, too

2265

1576

2266

# Checker - property

1577

@dbus_service_property(_interface, signature="s",

2267

@dbus_service_property(_interface,

2268

signature="s",

1578

2269

access="readwrite")

1579

2270

def Checker_dbus_property(self, value=None):

1580

2271

if value is None: # get

1581

2272

return dbus.String(self.checker_command)

1582

self.checker_command = unicode(value)

1583

2273

self.checker_command = str(value)

2274

1584

2275

# CheckerRunning - property

1585

@dbus_service_property(_interface, signature="b",

2276

@dbus_service_property(_interface,

2277

signature="b",

1586

2278

access="readwrite")

1587

2279

def CheckerRunning_dbus_property(self, value=None):

1588

2280

if value is None: # get

1591

2283

self.start_checker()

1592

2284

else:

1593

2285

self.stop_checker()

1594

2286

1595

2287

# ObjectPath - property

2288

@dbus_annotations(

2289

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2290

"org.freedesktop.DBus.Deprecated": "true"})

1596

2291

@dbus_service_property(_interface, signature="o", access="read")

1597

2292

def ObjectPath_dbus_property(self):

1598

return self.dbus_object_path # is already a dbus.ObjectPath

1599

2293

return self.dbus_object_path # is already a dbus.ObjectPath

2294

1600

2295

# Secret = property

1601

@dbus_service_property(_interface, signature="ay",

1602

access="write", byte_arrays=True)

2296

@dbus_annotations(

2297

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2298

"invalidates"})

2299

@dbus_service_property(_interface,

2300

signature="ay",

2301

access="write",

2302

byte_arrays=True)

1603

2303

def Secret_dbus_property(self, value):

1604

self.secret = str(value)

1605

2304

self.secret = bytes(value)

2305

1606

2306

del _interface

1607

2307

1608

2308

1609

class ProxyClient(object):

1610

def __init__(self, child_pipe, fpr, address):

2309

class ProxyClient:

2310

def __init__(self, child_pipe, key_id, fpr, address):

1611

2311

self._pipe = child_pipe

1612

self._pipe.send(('init', fpr, address))

2312

self._pipe.send(("init", key_id, fpr, address))

1613

2313

if not self._pipe.recv():

1614

raise KeyError()

1615

2314

raise KeyError(key_id or fpr)

2315

1616

2316

def __getattribute__(self, name):

1617

if name == '_pipe':

2317

if name == "_pipe":

1618

2318

return super(ProxyClient, self).__getattribute__(name)

1619

self._pipe.send(('getattr', name))

2319

self._pipe.send(("getattr", name))

1620

2320

data = self._pipe.recv()

1621

if data[0] == 'data':

2321

if data[0] == "data":

1622

2322

return data[1]

1623

if data[0] == 'function':

2323

if data[0] == "function":

2324

1624

2325

def func(*args, **kwargs):

1625

self._pipe.send(('funcall', name, args, kwargs))

2326

self._pipe.send(("funcall", name, args, kwargs))

1626

2327

return self._pipe.recv()[1]

2328

1627

2329

return func

1628

2330

1629

2331

def __setattr__(self, name, value):

1630

if name == '_pipe':

2332

if name == "_pipe":

1631

2333

return super(ProxyClient, self).__setattr__(name, value)

1632

self._pipe.send(('setattr', name, value))

2334

self._pipe.send(("setattr", name, value))

1633

2335

1634

2336

1635

2337

class ClientHandler(socketserver.BaseRequestHandler, object):

1636

2338

"""A class to handle client connections.

1637

2339

1638

2340

Instantiated once for each connection to handle it.

1639

2341

Note: This will run in its own forked process."""

1640

2342

1641

2343

def handle(self):

1642

2344

with contextlib.closing(self.server.child_pipe) as child_pipe:

1643

logger.info("TCP connection from: %s",

1644

unicode(self.client_address))

1645

logger.debug("Pipe FD: %d",

1646

self.server.child_pipe.fileno())

1647

1648

session = (gnutls.connection

1649

.ClientSession(self.request,

1650

gnutls.connection

1651

.X509Credentials()))

1652

1653

# Note: gnutls.connection.X509Credentials is really a

1654

# generic GnuTLS certificate credentials object so long as

1655

# no X.509 keys are added to it. Therefore, we can use it

1656

# here despite using OpenPGP certificates.

1657

1658

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1659

# "+AES-256-CBC", "+SHA1",

1660

# "+COMP-NULL", "+CTYPE-OPENPGP",

1661

# "+DHE-DSS"))

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2348

2349

session = gnutls.ClientSession(self.request)

2350

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2352

# "+AES-256-CBC", "+SHA1",

2353

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

# "+DHE-DSS"))

1662

2355

# Use a fallback default, since this MUST be set.

1663

2356

priority = self.server.gnutls_priority

1664

2357

if priority is None:

1665

2358

priority = "NORMAL"

1666

(gnutls.library.functions

1667

.gnutls_priority_set_direct(session._c_object,

1668

priority, None))

1669

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2361

1670

2362

# Start communication using the Mandos protocol

1671

2363

# Get protocol number

1672

2364

line = self.request.makefile().readline()

1673

logger.debug("Protocol version: %r", line)

2365

log.debug("Protocol version: %r", line)

1674

2366

try:

1675

2367

if int(line.strip().split()[0]) > 1:

1676

raise RuntimeError

2368

raise RuntimeError(line)

1677

2369

except (ValueError, IndexError, RuntimeError) as error:

1678

logger.error("Unknown protocol version: %s", error)

2370

log.error("Unknown protocol version: %s", error)

1679

2371

return

1680

2372

1681

2373

# Start GnuTLS connection

1682

2374

try:

1683

2375

session.handshake()

1684

except gnutls.errors.GNUTLSError as error:

1685

logger.warning("Handshake failed: %s", error)

2376

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

1686

2378

# Do not run session.bye() here: the session is not

1687

2379

# established. Just abandon the request.

1688

2380

return

1689

logger.debug("Handshake succeeded")

1690

2381

log.debug("Handshake succeeded")

2382

1691

2383

approval_required = False

1692

2384

try:

1693

try:

1694

fpr = self.fingerprint(self.peer_certificate

1695

(session))

1696

except (TypeError,

1697

gnutls.errors.GNUTLSError) as error:

1698

logger.warning("Bad certificate: %s", error)

1699

return

1700

logger.debug("Fingerprint: %s", fpr)

1701

1702

try:

1703

client = ProxyClient(child_pipe, fpr,

2385

if gnutls.has_rawpk:

2386

fpr = b""

2387

try:

2388

key_id = self.key_id(

2389

self.peer_certificate(session))

2390

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2392

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2396

2397

else:

2398

key_id = b""

2399

try:

2400

fpr = self.fingerprint(

2401

self.peer_certificate(session))

2402

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2404

return

2405

log.debug("Fingerprint: %s", fpr)

2406

2407

try:

2408

client = ProxyClient(child_pipe, key_id, fpr,

1704

2409

self.client_address)

1705

2410

except KeyError:

1706

2411

return

1707

2412

1708

2413

if client.approval_delay:

1709

2414

delay = client.approval_delay

1710

2415

client.approvals_pending += 1

1711

2416

approval_required = True

1712

2417

1713

2418

while True:

1714

2419

if not client.enabled:

1715

logger.info("Client %s is disabled",

1716

client.name)

2420

log.info("Client %s is disabled", client.name)

1717

2421

if self.server.use_dbus:

1718

2422

# Emit D-Bus signal

1719

2423

client.Rejected("Disabled")

1720

2424

return

1721

2425

1722

2426

if client.approved or not client.approval_delay:

1723

#We are approved or approval is disabled

2427

# We are approved or approval is disabled

1724

2428

break

1725

2429

elif client.approved is None:

1726

logger.info("Client %s needs approval",

2430

log.info("Client %s needs approval",

2431

client.name)

2432

if self.server.use_dbus:

2433

# Emit D-Bus signal

2434

client.NeedApproval(

2435

client.approval_delay.total_seconds()

2436

* 1000, client.approved_by_default)

2437

else:

2438

log.warning("Client %s was not approved",

1727

2439

client.name)

1728

2440

if self.server.use_dbus:

1729

2441

# Emit D-Bus signal

1730

client.NeedApproval(

1731

client.approval_delay_milliseconds(),

1732

client.approved_by_default)

1733

else:

1734

logger.warning("Client %s was not approved",

1735

client.name)

1736

if self.server.use_dbus:

1737

# Emit D-Bus signal

1738

2442

client.Rejected("Denied")

1739

2443

return

1740

1741

#wait until timeout or approved

2444

2445

# wait until timeout or approved

1742

2446

time = datetime.datetime.now()

1743

2447

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

2448

client.changedstate.wait(delay.total_seconds())

1747

2449

client.changedstate.release()

1748

2450

time2 = datetime.datetime.now()

1749

2451

if (time2 - time) >= delay:

1750

2452

if not client.approved_by_default:

1751

logger.warning("Client %s timed out while"

1752

" waiting for approval",

1753

client.name)

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

1754

2456

if self.server.use_dbus:

1755

2457

# Emit D-Bus signal

1756

2458

client.Rejected("Approval timed out")

1759

2461

break

1760

2462

else:

1761

2463

delay -= time2 - time

1762

1763

sent_size = 0

1764

while sent_size < len(client.secret):

1765

try:

1766

sent = session.send(client.secret[sent_size:])

1767

except gnutls.errors.GNUTLSError as error:

1768

logger.warning("gnutls send failed",

1769

exc_info=error)

1770

return

1771

logger.debug("Sent: %d, remaining: %d",

1772

sent, len(client.secret)

1773

- (sent_size + sent))

1774

sent_size += sent

1775

1776

logger.info("Sending secret to %s", client.name)

2464

2465

try:

2466

session.send(client.secret)

2467

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2469

return

2470

2471

log.info("Sending secret to %s", client.name)

1777

2472

# bump the timeout using extended_timeout

1778

2473

client.bump_timeout(client.extended_timeout)

1779

2474

if self.server.use_dbus:

1780

2475

# Emit D-Bus signal

1781

2476

client.GotSecret()

1782

2477

1783

2478

finally:

1784

2479

if approval_required:

1785

2480

client.approvals_pending -= 1

1786

2481

try:

1787

2482

session.bye()

1788

except gnutls.errors.GNUTLSError as error:

1789

logger.warning("GnuTLS bye failed",

1790

exc_info=error)

1791

2483

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2485

1792

2486

@staticmethod

1793

2487

def peer_certificate(session):

1794

"Return the peer's OpenPGP certificate as a bytestring"

1795

# If not an OpenPGP certificate...

1796

if (gnutls.library.functions

1797

.gnutls_certificate_type_get(session._c_object)

1798

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1799

# ...do the normal thing

1800

return session.peer_certificate

2488

"Return the peer's certificate as a bytestring"

2489

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2492

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2494

if gnutls.has_rawpk:

2495

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

else:

2497

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

# If not a valid certificate type...

2499

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2502

# ...return invalid data

2503

return b""

1801

2504

list_size = ctypes.c_uint(1)

1802

cert_list = (gnutls.library.functions

1803

.gnutls_certificate_get_peers

1804

(session._c_object, ctypes.byref(list_size)))

2505

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

1805

2507

if not bool(cert_list) and list_size.value != 0:

1806

raise gnutls.errors.GNUTLSError("error getting peer"

1807

" certificate")

2508

raise gnutls.Error("error getting peer certificate")

1808

2509

if list_size.value == 0:

1809

2510

return None

1810

2511

cert = cert_list[0]

1811

2512

return ctypes.string_at(cert.data, cert.size)

1812

2513

2514

@staticmethod

2515

def key_id(certificate):

2516

"Convert a certificate bytestring to a hexdigit key ID"

2517

# New GnuTLS "datum" with the public key

2518

datum = gnutls.datum_t(

2519

ctypes.cast(ctypes.c_char_p(certificate),

2520

ctypes.POINTER(ctypes.c_ubyte)),

2521

ctypes.c_uint(len(certificate)))

2522

# XXX all these need to be created in the gnutls "module"

2523

# New empty GnuTLS certificate

2524

pubkey = gnutls.pubkey_t()

2525

gnutls.pubkey_init(ctypes.byref(pubkey))

2526

# Import the raw public key into the certificate

2527

gnutls.pubkey_import(pubkey,

2528

ctypes.byref(datum),

2529

gnutls.X509_FMT_DER)

2530

# New buffer for the key ID

2531

buf = ctypes.create_string_buffer(32)

2532

buf_len = ctypes.c_size_t(len(buf))

2533

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2540

# Deinit the certificate

2541

gnutls.pubkey_deinit(pubkey)

2542

2543

# Convert the buffer to a Python bytestring

2544

key_id = ctypes.string_at(buf, buf_len.value)

2545

# Convert the bytestring to hexadecimal notation

2546

hex_key_id = binascii.hexlify(key_id).upper()

2547

return hex_key_id

2548

1813

2549

@staticmethod

1814

2550

def fingerprint(openpgp):

1815

2551

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1816

2552

# New GnuTLS "datum" with the OpenPGP public key

1817

datum = (gnutls.library.types

1818

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1819

ctypes.POINTER

1820

(ctypes.c_ubyte)),

1821

ctypes.c_uint(len(openpgp))))

2553

datum = gnutls.datum_t(

2554

ctypes.cast(ctypes.c_char_p(openpgp),

2555

ctypes.POINTER(ctypes.c_ubyte)),

2556

ctypes.c_uint(len(openpgp)))

1822

2557

# New empty GnuTLS certificate

1823

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1824

(gnutls.library.functions

1825

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2558

crt = gnutls.openpgp_crt_t()

2559

gnutls.openpgp_crt_init(ctypes.byref(crt))

1826

2560

# Import the OpenPGP public key into the certificate

1827

(gnutls.library.functions

1828

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1829

gnutls.library.constants

1830

.GNUTLS_OPENPGP_FMT_RAW))

2561

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2562

gnutls.OPENPGP_FMT_RAW)

1831

2563

# Verify the self signature in the key

1832

2564

crtverify = ctypes.c_uint()

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_verify_self(crt, 0,

1835

ctypes.byref(crtverify)))

2565

gnutls.openpgp_crt_verify_self(crt, 0,

2566

ctypes.byref(crtverify))

1836

2567

if crtverify.value != 0:

1837

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1838

raise (gnutls.errors.CertificateSecurityError

1839

("Verify failed"))

2568

gnutls.openpgp_crt_deinit(crt)

2569

raise gnutls.CertificateSecurityError(code

2570

=crtverify.value)

1840

2571

# New buffer for the fingerprint

1841

2572

buf = ctypes.create_string_buffer(20)

1842

2573

buf_len = ctypes.c_size_t()

1843

2574

# Get the fingerprint from the certificate into the buffer

1844

(gnutls.library.functions

1845

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1846

ctypes.byref(buf_len)))

2575

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2576

ctypes.byref(buf_len))

1847

2577

# Deinit the certificate

1848

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2578

gnutls.openpgp_crt_deinit(crt)

1849

2579

# Convert the buffer to a Python bytestring

1850

2580

fpr = ctypes.string_at(buf, buf_len.value)

1851

2581

# Convert the bytestring to hexadecimal notation

1853

2583

return hex_fpr

1854

2584

1855

2585

1856

class MultiprocessingMixIn(object):

2586

class MultiprocessingMixIn:

1857

2587

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2588

1858

2589

def sub_process_main(self, request, address):

1859

2590

try:

1860

2591

self.finish_request(request, address)

1861

2592

except Exception:

1862

2593

self.handle_error(request, address)

1863

2594

self.close_request(request)

1864

2595

1865

2596

def process_request(self, request, address):

1866

2597

"""Start a new process to process the request."""

1867

proc = multiprocessing.Process(target = self.sub_process_main,

1868

args = (request, address))

2598

proc = multiprocessing.Process(target=self.sub_process_main,

2599

args=(request, address))

1869

2600

proc.start()

1870

2601

return proc

1871

2602

1872

2603

1873

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2604

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1874

2605

""" adds a pipe to the MixIn """

2606

1875

2607

def process_request(self, request, client_address):

1876

2608

"""Overrides and wraps the original process_request().

1877

2609

1878

2610

This function creates a new pipe in self.pipe

1879

2611

"""

1880

2612

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1881

2613

1882

2614

proc = MultiprocessingMixIn.process_request(self, request,

1883

2615

client_address)

1884

2616

self.child_pipe.close()

1885

2617

self.add_pipe(parent_pipe, proc)

1886

2618

1887

2619

def add_pipe(self, parent_pipe, proc):

1888

2620

"""Dummy function; override as necessary"""

1889

raise NotImplementedError

2621

raise NotImplementedError()

1890

2622

1891

2623

1892

2624

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1893

socketserver.TCPServer, object):

1894

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1895

2625

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2627

1896

2628

Attributes:

1897

2629

enabled: Boolean; whether this server is activated yet

1898

2630

interface: None or a network interface name (string)

1899

2631

use_ipv6: Boolean; to use IPv6 or not

1900

2632

"""

2633

1901

2634

def __init__(self, server_address, RequestHandlerClass,

1902

interface=None, use_ipv6=True, socketfd=None):

2635

interface=None,

2636

use_ipv6=True,

2637

socketfd=None):

1903

2638

"""If socketfd is set, use that file descriptor instead of

1904

2639

creating a new one with socket.socket().

1905

2640

"""

1911

2646

self.socketfd = socketfd

1912

2647

# Save the original socket.socket() function

1913

2648

self.socket_socket = socket.socket

2649

1914

2650

# To implement --socket, we monkey patch socket.socket.

1915

#

2651

#

1916

2652

# (When socketserver.TCPServer is a new-style class, we

1917

2653

# could make self.socket into a property instead of monkey

1918

2654

# patching socket.socket.)

1919

#

2655

#

1920

2656

# Create a one-time-only replacement for socket.socket()

1921

2657

@functools.wraps(socket.socket)

1922

2658

def socket_wrapper(*args, **kwargs):

1934

2670

# socket_wrapper(), if socketfd was set.

1935

2671

socketserver.TCPServer.__init__(self, server_address,

1936

2672

RequestHandlerClass)

1937

2673

1938

2674

def server_bind(self):

1939

2675

"""This overrides the normal server_bind() function

1940

2676

to bind to an interface if one was specified, and also NOT to

1941

2677

bind to an address or port if they were not specified."""

2678

global SO_BINDTODEVICE

1942

2679

if self.interface is not None:

1943

2680

if SO_BINDTODEVICE is None:

1944

logger.error("SO_BINDTODEVICE does not exist;"

1945

" cannot bind to interface %s",

1946

self.interface)

1947

else:

1948

try:

1949

self.socket.setsockopt(socket.SOL_SOCKET,

1950

SO_BINDTODEVICE,

1951

str(self.interface + '\0'))

1952

except socket.error as error:

1953

if error.errno == errno.EPERM:

1954

logger.error("No permission to bind to"

1955

" interface %s", self.interface)

1956

elif error.errno == errno.ENOPROTOOPT:

1957

logger.error("SO_BINDTODEVICE not available;"

1958

" cannot bind to interface %s",

1959

self.interface)

1960

elif error.errno == errno.ENODEV:

1961

logger.error("Interface %s does not exist,"

1962

" cannot bind", self.interface)

1963

else:

1964

raise

2681

# Fall back to a hard-coded value which seems to be

2682

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2684

SO_BINDTODEVICE = 25

2685

try:

2686

self.socket.setsockopt(

2687

socket.SOL_SOCKET, SO_BINDTODEVICE,

2688

(self.interface + "\0").encode("utf-8"))

2689

except socket.error as error:

2690

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2693

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2696

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2699

else:

2700

raise

1965

2701

# Only bind(2) the socket if we really need to.

1966

2702

if self.server_address[0] or self.server_address[1]:

2703

if self.server_address[1]:

2704

self.allow_reuse_address = True

1967

2705

if not self.server_address[0]:

1968

2706

if self.address_family == socket.AF_INET6:

1969

any_address = "::" # in6addr_any

2707

any_address = "::" # in6addr_any

1970

2708

else:

1971

any_address = socket.INADDR_ANY

2709

any_address = "0.0.0.0" # INADDR_ANY

1972

2710

self.server_address = (any_address,

1973

2711

self.server_address[1])

1974

2712

elif not self.server_address[1]:

1975

self.server_address = (self.server_address[0],

1976

0)

2713

self.server_address = (self.server_address[0], 0)

1977

2714

# if self.interface:

1978

2715

# self.server_address = (self.server_address[0],

1979

2716

# 0, # port

1985

2722

1986

2723

class MandosServer(IPv6_TCPServer):

1987

2724

"""Mandos server.

1988

2725

1989

2726

Attributes:

1990

2727

clients: set of Client objects

1991

2728

gnutls_priority GnuTLS priority string

1992

2729

use_dbus: Boolean; to emit D-Bus signals or not

1993

1994

Assumes a gobject.MainLoop event loop.

2730

2731

Assumes a GLib.MainLoop event loop.

1995

2732

"""

2733

1996

2734

def __init__(self, server_address, RequestHandlerClass,

1997

interface=None, use_ipv6=True, clients=None,

1998

gnutls_priority=None, use_dbus=True, socketfd=None):

2735

interface=None,

2736

use_ipv6=True,

2737

clients=None,

2738

gnutls_priority=None,

2739

use_dbus=True,

2740

socketfd=None):

1999

2741

self.enabled = False

2000

2742

self.clients = clients

2001

2743

if self.clients is None:

2004

2746

self.gnutls_priority = gnutls_priority

2005

2747

IPv6_TCPServer.__init__(self, server_address,

2006

2748

RequestHandlerClass,

2007

interface = interface,

2008

use_ipv6 = use_ipv6,

2009

socketfd = socketfd)

2749

interface=interface,

2750

use_ipv6=use_ipv6,

2751

socketfd=socketfd)

2752

2010

2753

def server_activate(self):

2011

2754

if self.enabled:

2012

2755

return socketserver.TCPServer.server_activate(self)

2013

2756

2014

2757

def enable(self):

2015

2758

self.enabled = True

2016

2759

2017

2760

def add_pipe(self, parent_pipe, proc):

2018

2761

# Call "handle_ipc" for both data and EOF events

2019

gobject.io_add_watch(parent_pipe.fileno(),

2020

gobject.IO_IN | gobject.IO_HUP,

2021

functools.partial(self.handle_ipc,

2022

parent_pipe =

2023

parent_pipe,

2024

proc = proc))

2025

2026

def handle_ipc(self, source, condition, parent_pipe=None,

2027

proc = None, client_object=None):

2762

GLib.io_add_watch(

2763

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2764

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2765

functools.partial(self.handle_ipc,

2766

parent_pipe=parent_pipe,

2767

proc=proc))

2768

2769

def handle_ipc(self, source, condition,

2770

parent_pipe=None,

2771

proc=None,

2772

client_object=None):

2028

2773

# error, or the other end of multiprocessing.Pipe has closed

2029

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2774

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2030

2775

# Wait for other process to exit

2031

2776

proc.join()

2032

2777

return False

2033

2778

2034

2779

# Read a request from the child

2035

2780

request = parent_pipe.recv()

2036

2781

command = request[0]

2037

2038

if command == 'init':

2039

fpr = request[1]

2040

address = request[2]

2041

2042

for c in self.clients.itervalues():

2043

if c.fingerprint == fpr:

2782

2783

if command == "init":

2784

key_id = request[1].decode("ascii")

2785

fpr = request[2].decode("ascii")

2786

address = request[3]

2787

2788

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2791

continue

2792

if key_id and c.key_id == key_id:

2793

client = c

2794

break

2795

if fpr and c.fingerprint == fpr:

2044

2796

client = c

2045

2797

break

2046

2798

else:

2047

logger.info("Client not found for fingerprint: %s, ad"

2048

"dress: %s", fpr, address)

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2049

2801

if self.use_dbus:

2050

2802

# Emit D-Bus signal

2051

mandos_dbus_service.ClientNotFound(fpr,

2803

mandos_dbus_service.ClientNotFound(key_id or fpr,

2052

2804

address[0])

2053

2805

parent_pipe.send(False)

2054

2806

return False

2055

2056

gobject.io_add_watch(parent_pipe.fileno(),

2057

gobject.IO_IN | gobject.IO_HUP,

2058

functools.partial(self.handle_ipc,

2059

parent_pipe =

2060

parent_pipe,

2061

proc = proc,

2062

client_object =

2063

client))

2807

2808

GLib.io_add_watch(

2809

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2810

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2811

functools.partial(self.handle_ipc,

2812

parent_pipe=parent_pipe,

2813

proc=proc,

2814

client_object=client))

2064

2815

parent_pipe.send(True)

2065

2816

# remove the old hook in favor of the new above hook on

2066

2817

# same fileno

2067

2818

return False

2068

if command == 'funcall':

2819

if command == "funcall":

2069

2820

funcname = request[1]

2070

2821

args = request[2]

2071

2822

kwargs = request[3]

2072

2073

parent_pipe.send(('data', getattr(client_object,

2823

2824

parent_pipe.send(("data", getattr(client_object,

2074

2825

funcname)(*args,

2075

**kwargs)))

2076

2077

if command == 'getattr':

2826

**kwargs)))

2827

2828

if command == "getattr":

2078

2829

attrname = request[1]

2079

if callable(client_object.__getattribute__(attrname)):

2080

parent_pipe.send(('function',))

2830

if isinstance(client_object.__getattribute__(attrname),

2831

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2081

2833

else:

2082

parent_pipe.send(('data', client_object

2083

.__getattribute__(attrname)))

2084

2085

if command == 'setattr':

2834

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2836

2837

if command == "setattr":

2086

2838

attrname = request[1]

2087

2839

value = request[2]

2088

2840

setattr(client_object, attrname, value)

2089

2841

2090

2842

return True

2091

2843

2092

2844

2845

def rfc3339_duration_to_delta(duration):

2846

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2864

"""

2865

2866

# Parsing an RFC 3339 duration with regular expressions is not

2867

# possible - there would have to be multiple places for the same

2868

# values, like seconds. The current code, while more esoteric, is

2869

# cleaner without depending on a parsing library. If Python had a

2870

# built-in library for parsing we would use it, but we'd like to

2871

# avoid excessive use of external libraries.

2872

2873

# New type for defining tokens, syntax, and semantics all-in-one

2874

Token = collections.namedtuple("Token", (

2875

"regexp", # To match token; if "value" is not None, must have

2876

# a "group" containing digits

2877

"value", # datetime.timedelta or None

2878

"followers")) # Tokens valid after this token

2879

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2880

# the "duration" ABNF definition in RFC 3339, Appendix A.

2881

token_end = Token(re.compile(r"$"), None, frozenset())

2882

token_second = Token(re.compile(r"(\d+)S"),

2883

datetime.timedelta(seconds=1),

2884

frozenset((token_end, )))

2885

token_minute = Token(re.compile(r"(\d+)M"),

2886

datetime.timedelta(minutes=1),

2887

frozenset((token_second, token_end)))

2888

token_hour = Token(re.compile(r"(\d+)H"),

2889

datetime.timedelta(hours=1),

2890

frozenset((token_minute, token_end)))

2891

token_time = Token(re.compile(r"T"),

2892

None,

2893

frozenset((token_hour, token_minute,

2894

token_second)))

2895

token_day = Token(re.compile(r"(\d+)D"),

2896

datetime.timedelta(days=1),

2897

frozenset((token_time, token_end)))

2898

token_month = Token(re.compile(r"(\d+)M"),

2899

datetime.timedelta(weeks=4),

2900

frozenset((token_day, token_end)))

2901

token_year = Token(re.compile(r"(\d+)Y"),

2902

datetime.timedelta(weeks=52),

2903

frozenset((token_month, token_end)))

2904

token_week = Token(re.compile(r"(\d+)W"),

2905

datetime.timedelta(weeks=1),

2906

frozenset((token_end, )))

2907

token_duration = Token(re.compile(r"P"), None,

2908

frozenset((token_year, token_month,

2909

token_day, token_time,

2910

token_week)))

2911

# Define starting values:

2912

# Value so far

2913

value = datetime.timedelta()

2914

found_token = None

2915

# Following valid tokens

2916

followers = frozenset((token_duration, ))

2917

# String left to parse

2918

s = duration

2919

# Loop until end token is found

2920

while found_token is not token_end:

2921

# Search for any currently valid tokens

2922

for token in followers:

2923

match = token.regexp.match(s)

2924

if match is not None:

2925

# Token found

2926

if token.value is not None:

2927

# Value found, parse digits

2928

factor = int(match.group(1), 10)

2929

# Add to value so far

2930

value += factor * token.value

2931

# Strip token from string

2932

s = token.regexp.sub("", s, 1)

2933

# Go to found token

2934

found_token = token

2935

# Set valid next tokens

2936

followers = found_token.followers

2937

break

2938

else:

2939

# No currently valid tokens were found

2940

raise ValueError("Invalid RFC 3339 duration: {!r}"

2941

.format(duration))

2942

# End token found

2943

return value

2944

2945

2093

2946

def string_to_delta(interval):

2094

2947

"""Parse a string and return a datetime.timedelta

2095

2096

>>> string_to_delta('7d')

2097

datetime.timedelta(7)

2098

>>> string_to_delta('60s')

2099

datetime.timedelta(0, 60)

2100

>>> string_to_delta('60m')

2101

datetime.timedelta(0, 3600)

2102

>>> string_to_delta('24h')

2103

datetime.timedelta(1)

2104

>>> string_to_delta('1w')

2105

datetime.timedelta(7)

2106

>>> string_to_delta('5m 30s')

2107

datetime.timedelta(0, 330)

2948

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2960

True

2108

2961

"""

2962

2963

try:

2964

return rfc3339_duration_to_delta(interval)

2965

except ValueError:

2966

pass

2967

2109

2968

timevalue = datetime.timedelta(0)

2110

2969

for s in interval.split():

2111

2970

try:

2112

suffix = unicode(s[-1])

2971

suffix = s[-1]

2113

2972

value = int(s[:-1])

2114

2973

if suffix == "d":

2115

2974

delta = datetime.timedelta(value)

2122

2981

elif suffix == "w":

2123

2982

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2124

2983

else:

2125

raise ValueError("Unknown suffix {0!r}"

2126

.format(suffix))

2127

except (ValueError, IndexError) as e:

2984

raise ValueError("Unknown suffix {!r}".format(suffix))

2985

except IndexError as e:

2128

2986

raise ValueError(*(e.args))

2129

2987

timevalue += delta

2130

2988

return timevalue

2131

2989

2132

2990

2133

def daemon(nochdir = False, noclose = False):

2991

def daemon(nochdir=False, noclose=False):

2134

2992

"""See daemon(3). Standard BSD Unix function.

2135

2993

2136

2994

This should really exist as os.daemon, but it doesn't (yet)."""

2137

2995

if os.fork():

2138

2996

sys.exit()

2146

3004

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2147

3005

if not stat.S_ISCHR(os.fstat(null).st_mode):

2148

3006

raise OSError(errno.ENODEV,

2149

"{0} not a character device"

3007

"{} not a character device"

2150

3008

.format(os.devnull))

2151

3009

os.dup2(null, sys.stdin.fileno())

2152

3010

os.dup2(null, sys.stdout.fileno())

2156

3014

2157

3015

2158

3016

def main():

2159

3017

2160

3018

##################################################################

2161

3019

# Parsing of options, both command line and config file

2162

3020

2163

3021

parser = argparse.ArgumentParser()

2164

3022

parser.add_argument("-v", "--version", action="version",

2165

version = "%(prog)s {0}".format(version),

3023

version="%(prog)s {}".format(version),

2166

3024

help="show version number and exit")

2167

3025

parser.add_argument("-i", "--interface", metavar="IF",

2168

3026

help="Bind to interface IF")

2174

3032

help="Run self-test")

2175

3033

parser.add_argument("--debug", action="store_true",

2176

3034

help="Debug mode; run in foreground and log"

2177

" to terminal")

3035

" to terminal", default=None)

2178

3036

parser.add_argument("--debuglevel", metavar="LEVEL",

2179

3037

help="Debug level for stdout output")

2180

3038

parser.add_argument("--priority", help="GnuTLS"

2187

3045

" files")

2188

3046

parser.add_argument("--no-dbus", action="store_false",

2189

3047

dest="use_dbus", help="Do not provide D-Bus"

2190

" system bus interface")

3048

" system bus interface", default=None)

2191

3049

parser.add_argument("--no-ipv6", action="store_false",

2192

dest="use_ipv6", help="Do not use IPv6")

3050

dest="use_ipv6", help="Do not use IPv6",

3051

default=None)

2193

3052

parser.add_argument("--no-restore", action="store_false",

2194

3053

dest="restore", help="Do not restore stored"

2195

" state")

3054

" state", default=None)

2196

3055

parser.add_argument("--socket", type=int,

2197

3056

help="Specify a file descriptor to a network"

2198

3057

" socket to use instead of creating one")

2199

3058

parser.add_argument("--statedir", metavar="DIR",

2200

3059

help="Directory to save/restore state in")

2201

3060

parser.add_argument("--foreground", action="store_true",

2202

help="Run in foreground")

2203

3061

help="Run in foreground", default=None)

3062

parser.add_argument("--no-zeroconf", action="store_false",

3063

dest="zeroconf", help="Do not use Zeroconf",

3064

default=None)

3065

2204

3066

options = parser.parse_args()

2205

2206

if options.check:

2207

import doctest

2208

doctest.testmod()

2209

sys.exit()

2210

3067

2211

3068

# Default values for config file for server-global settings

2212

server_defaults = { "interface": "",

2213

"address": "",

2214

"port": "",

2215

"debug": "False",

2216

"priority":

2217

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2218

"servicename": "Mandos",

2219

"use_dbus": "True",

2220

"use_ipv6": "True",

2221

"debuglevel": "",

2222

"restore": "True",

2223

"socket": "",

2224

"statedir": "/var/lib/mandos",

2225

"foreground": "False",

2226

}

2227

3069

if gnutls.has_rawpk:

3070

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3071

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3072

else:

3073

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3074

":+SIGN-DSA-SHA256")

3075

server_defaults = {"interface": "",

3076

"address": "",

3077

"port": "",

3078

"debug": "False",

3079

"priority": priority,

3080

"servicename": "Mandos",

3081

"use_dbus": "True",

3082

"use_ipv6": "True",

3083

"debuglevel": "",

3084

"restore": "True",

3085

"socket": "",

3086

"statedir": "/var/lib/mandos",

3087

"foreground": "False",

3088

"zeroconf": "True",

3089

}

3090

del priority

3091

2228

3092

# Parse config file for server-global settings

2229

server_config = configparser.SafeConfigParser(server_defaults)

3093

server_config = configparser.ConfigParser(server_defaults)

2230

3094

del server_defaults

2231

server_config.read(os.path.join(options.configdir,

2232

"mandos.conf"))

2233

# Convert the SafeConfigParser object to a dict

3095

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3096

# Convert the ConfigParser object to a dict

2234

3097

server_settings = server_config.defaults()

2235

3098

# Use the appropriate methods on the non-string config options

2236

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3099

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3100

"foreground", "zeroconf"):

2237

3101

server_settings[option] = server_config.getboolean("DEFAULT",

2238

3102

option)

2239

3103

if server_settings["port"]:

2245

3109

# Later, stdin will, and stdout and stderr might, be dup'ed

2246

3110

# over with an opened os.devnull. But we don't want this to

2247

3111

# happen with a supplied network socket.

2248

if 0 <= server_settings["socket"] <= 2:

3112

while 0 <= server_settings["socket"] <= 2:

2249

3113

server_settings["socket"] = os.dup(server_settings

2250

3114

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

2251

3116

del server_config

2252

3117

2253

3118

# Override the settings from the config file with command line

2254

3119

# options, if set.

2255

3120

for option in ("interface", "address", "port", "debug",

2256

"priority", "servicename", "configdir",

2257

"use_dbus", "use_ipv6", "debuglevel", "restore",

2258

"statedir", "socket", "foreground"):

3121

"priority", "servicename", "configdir", "use_dbus",

3122

"use_ipv6", "debuglevel", "restore", "statedir",

3123

"socket", "foreground", "zeroconf"):

2259

3124

value = getattr(options, option)

2260

3125

if value is not None:

2261

3126

server_settings[option] = value

2262

3127

del options

2263

3128

# Force all strings to be unicode

2264

3129

for option in server_settings.keys():

2265

if type(server_settings[option]) is str:

2266

server_settings[option] = unicode(server_settings[option])

3130

if isinstance(server_settings[option], bytes):

3131

server_settings[option] = (server_settings[option]

3132

.decode("utf-8"))

3133

# Force all boolean options to be boolean

3134

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3135

"foreground", "zeroconf"):

3136

server_settings[option] = bool(server_settings[option])

2267

3137

# Debug implies foreground

2268

3138

if server_settings["debug"]:

2269

3139

server_settings["foreground"] = True

2270

3140

# Now we have our good server settings in "server_settings"

2271

3141

2272

3142

##################################################################

2273

3143

3144

if (not server_settings["zeroconf"]

3145

and not (server_settings["port"]

3146

or server_settings["socket"] != "")):

3147

parser.error("Needs port or socket to work without Zeroconf")

3148

2274

3149

# For convenience

2275

3150

debug = server_settings["debug"]

2276

3151

debuglevel = server_settings["debuglevel"]

2279

3154

stored_state_path = os.path.join(server_settings["statedir"],

2280

3155

stored_state_file)

2281

3156

foreground = server_settings["foreground"]

2282

3157

zeroconf = server_settings["zeroconf"]

3158

2283

3159

if debug:

2284

3160

initlogger(debug, logging.DEBUG)

2285

3161

else:

2288

3164

else:

2289

3165

level = getattr(logging, debuglevel.upper())

2290

3166

initlogger(debug, level)

2291

3167

2292

3168

if server_settings["servicename"] != "Mandos":

2293

syslogger.setFormatter(logging.Formatter

2294

('Mandos ({0}) [%(process)d]:'

2295

' %(levelname)s: %(message)s'

2296

.format(server_settings

2297

["servicename"])))

2298

3169

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

3172

server_settings["servicename"])))

3173

2299

3174

# Parse config file with clients

2300

client_config = configparser.SafeConfigParser(Client

2301

.client_defaults)

3175

client_config = configparser.ConfigParser(Client.client_defaults)

2302

3176

client_config.read(os.path.join(server_settings["configdir"],

2303

3177

"clients.conf"))

2304

3178

2305

3179

global mandos_dbus_service

2306

3180

mandos_dbus_service = None

2307

2308

tcp_server = MandosServer((server_settings["address"],

2309

server_settings["port"]),

2310

ClientHandler,

2311

interface=(server_settings["interface"]

2312

or None),

2313

use_ipv6=use_ipv6,

2314

gnutls_priority=

2315

server_settings["priority"],

2316

use_dbus=use_dbus,

2317

socketfd=(server_settings["socket"]

2318

or None))

3181

3182

socketfd = None

3183

if server_settings["socket"] != "":

3184

socketfd = server_settings["socket"]

3185

tcp_server = MandosServer(

3186

(server_settings["address"], server_settings["port"]),

3187

ClientHandler,

3188

interface=(server_settings["interface"] or None),

3189

use_ipv6=use_ipv6,

3190

gnutls_priority=server_settings["priority"],

3191

use_dbus=use_dbus,

3192

socketfd=socketfd)

2319

3193

if not foreground:

2320

pidfilename = "/var/run/mandos.pid"

3194

pidfilename = "/run/mandos.pid"

3195

if not os.path.isdir("/run/."):

3196

pidfilename = "/var/run/mandos.pid"

2321

3197

pidfile = None

2322

3198

try:

2323

pidfile = open(pidfilename, "w")

3199

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2324

3200

except IOError as e:

2325

logger.error("Could not open file %r", pidfilename,

2326

exc_info=e)

2327

2328

for name in ("_mandos", "mandos", "nobody"):

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3203

3204

for name, group in (("_mandos", "_mandos"),

3205

("mandos", "mandos"),

3206

("nobody", "nogroup")):

2329

3207

try:

2330

3208

uid = pwd.getpwnam(name).pw_uid

2331

gid = pwd.getpwnam(name).pw_gid

3209

gid = pwd.getpwnam(group).pw_gid

2332

3210

break

2333

3211

except KeyError:

2334

3212

continue

2338

3216

try:

2339

3217

os.setgid(gid)

2340

3218

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

2341

3220

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

2342

3223

if error.errno != errno.EPERM:

2343

raise error

2344

3224

raise

3225

2345

3226

if debug:

2346

3227

# Enable all possible GnuTLS debugging

2347

3228

2348

3229

# "Use a log level over 10 to enable all debugging options."

2349

3230

# - GnuTLS manual

2350

gnutls.library.functions.gnutls_global_set_log_level(11)

2351

2352

@gnutls.library.types.gnutls_log_func

3231

gnutls.global_set_log_level(11)

3232

3233

@gnutls.log_func

2353

3234

def debug_gnutls(level, string):

2354

logger.debug("GnuTLS: %s", string[:-1])

2355

2356

(gnutls.library.functions

2357

.gnutls_global_set_log_function(debug_gnutls))

2358

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3237

3238

gnutls.global_set_log_function(debug_gnutls)

3239

2359

3240

# Redirect stdin so all checkers get /dev/null

2360

3241

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2361

3242

os.dup2(null, sys.stdin.fileno())

2362

3243

if null > 2:

2363

3244

os.close(null)

2364

3245

2365

3246

# Need to fork before connecting to D-Bus

2366

3247

if not foreground:

2367

3248

# Close all input and output, do double fork, etc.

2368

3249

daemon()

2369

2370

# multiprocessing will use threads, so before we use gobject we

2371

# need to inform gobject that threads will be used.

2372

gobject.threads_init()

2373

3250

3251

if gi.version_info < (3, 10, 2):

3252

# multiprocessing will use threads, so before we use GLib we

3253

# need to inform GLib that threads will be used.

3254

GLib.threads_init()

3255

2374

3256

global main_loop

2375

3257

# From the Avahi example code

2376

3258

DBusGMainLoop(set_as_default=True)

2377

main_loop = gobject.MainLoop()

2378

bus = dbus.SystemBus()

3259

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

2379

3262

# End of Avahi example code

2380

3263

if use_dbus:

2381

3264

try:

2382

3265

bus_name = dbus.service.BusName("se.recompile.Mandos",

2383

bus, do_not_queue=True)

2384

old_bus_name = (dbus.service.BusName

2385

("se.bsnet.fukt.Mandos", bus,

2386

do_not_queue=True))

2387

except dbus.exceptions.NameExistsException as e:

2388

logger.error("Disabling D-Bus:", exc_info=e)

3266

bus,

3267

do_not_queue=True)

3268

old_bus_name = dbus.service.BusName(

3269

"se.bsnet.fukt.Mandos", bus,

3270

do_not_queue=True)

3271

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

2389

3273

use_dbus = False

2390

3274

server_settings["use_dbus"] = False

2391

3275

tcp_server.use_dbus = False

2392

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2393

service = AvahiServiceToSyslog(name =

2394

server_settings["servicename"],

2395

servicetype = "_mandos._tcp",

2396

protocol = protocol, bus = bus)

2397

if server_settings["interface"]:

2398

service.interface = (if_nametoindex

2399

(str(server_settings["interface"])))

2400

3276

if zeroconf:

3277

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3278

service = AvahiServiceToSyslog(

3279

name=server_settings["servicename"],

3280

servicetype="_mandos._tcp",

3281

protocol=protocol,

3282

bus=bus)

3283

if server_settings["interface"]:

3284

service.interface = if_nametoindex(

3285

server_settings["interface"].encode("utf-8"))

3286

2401

3287

global multiprocessing_manager

2402

3288

multiprocessing_manager = multiprocessing.Manager()

2403

3289

2404

3290

client_class = Client

2405

3291

if use_dbus:

2406

client_class = functools.partial(ClientDBus, bus = bus)

2407

3292

client_class = functools.partial(ClientDBus, bus=bus)

3293

2408

3294

client_settings = Client.config_parser(client_config)

2409

3295

old_client_settings = {}

2410

3296

clients_data = {}

2411

3297

3298

# This is used to redirect stdout and stderr for checker processes

3299

global wnull

3300

wnull = open(os.devnull, "w") # A writable /dev/null

3301

# Only used if server is running in foreground but not in debug

3302

# mode

3303

if debug or not foreground:

3304

wnull.close()

3305

2412

3306

# Get client data and settings from last running state.

2413

3307

if server_settings["restore"]:

2414

3308

try:

2415

3309

with open(stored_state_path, "rb") as stored_state:

2416

clients_data, old_client_settings = (pickle.load

2417

(stored_state))

3310

if sys.version_info.major == 2:

3311

clients_data, old_client_settings = pickle.load(

3312

stored_state)

3313

else:

3314

bytes_clients_data, bytes_old_client_settings = (

3315

pickle.load(stored_state, encoding="bytes"))

3316

# Fix bytes to strings

3317

# clients_data

3318

# .keys()

3319

clients_data = {(key.decode("utf-8")

3320

if isinstance(key, bytes)

3321

else key): value

3322

for key, value in

3323

bytes_clients_data.items()}

3324

del bytes_clients_data

3325

for key in clients_data:

3326

value = {(k.decode("utf-8")

3327

if isinstance(k, bytes) else k): v

3328

for k, v in

3329

clients_data[key].items()}

3330

clients_data[key] = value

3331

# .client_structure

3332

value["client_structure"] = [

3333

(s.decode("utf-8")

3334

if isinstance(s, bytes)

3335

else s) for s in

3336

value["client_structure"]]

3337

# .name, .host, and .checker_command

3338

for k in ("name", "host", "checker_command"):

3339

if isinstance(value[k], bytes):

3340

value[k] = value[k].decode("utf-8")

3341

if "key_id" not in value:

3342

value["key_id"] = ""

3343

elif "fingerprint" not in value:

3344

value["fingerprint"] = ""

3345

# old_client_settings

3346

# .keys()

3347

old_client_settings = {

3348

(key.decode("utf-8")

3349

if isinstance(key, bytes)

3350

else key): value

3351

for key, value in

3352

bytes_old_client_settings.items()}

3353

del bytes_old_client_settings

3354

# .host and .checker_command

3355

for value in old_client_settings.values():

3356

for attribute in ("host", "checker_command"):

3357

if isinstance(value[attribute], bytes):

3358

value[attribute] = (value[attribute]

3359

.decode("utf-8"))

2418

3360

os.remove(stored_state_path)

2419

3361

except IOError as e:

2420

3362

if e.errno == errno.ENOENT:

2421

logger.warning("Could not load persistent state: {0}"

2422

.format(os.strerror(e.errno)))

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

2423

3365

else:

2424

logger.critical("Could not load persistent state:",

2425

exc_info=e)

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

2426

3368

raise

2427

3369

except EOFError as e:

2428

logger.warning("Could not load persistent state: "

2429

"EOFError:", exc_info=e)

2430

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3372

2431

3373

with PGPEngine() as pgp:

2432

for client_name, client in clients_data.iteritems():

3374

for client_name, client in clients_data.items():

3375

# Skip removed clients

3376

if client_name not in client_settings:

3377

continue

3378

2433

3379

# Decide which value to use after restoring saved state.

2434

3380

# We have three different values: Old config file,

2435

3381

# new config file, and saved state.

2440

3386

# For each value in new config, check if it

2441

3387

# differs from the old config value (Except for

2442

3388

# the "secret" attribute)

2443

if (name != "secret" and

2444

value != old_client_settings[client_name]

2445

[name]):

3389

if (name != "secret"

3390

and (value !=

3391

old_client_settings[client_name][name])):

2446

3392

client[name] = value

2447

3393

except KeyError:

2448

3394

pass

2449

3395

2450

3396

# Clients who has passed its expire date can still be

2451

# enabled if its last checker was successful. Clients

3397

# enabled if its last checker was successful. A Client

2452

3398

# whose checker succeeded before we stored its state is

2453

3399

# assumed to have successfully run all checkers during

2454

3400

# downtime.

2455

3401

if client["enabled"]:

2456

3402

if datetime.datetime.utcnow() >= client["expires"]:

2457

3403

if not client["last_checked_ok"]:

2458

logger.warning(

2459

"disabling client {0} - Client never "

2460

"performed a successful checker"

2461

.format(client_name))

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

2462

3407

client["enabled"] = False

2463

3408

elif client["last_checker_status"] != 0:

2464

logger.warning(

2465

"disabling client {0} - Client "

2466

"last checker failed with error code {1}"

2467

.format(client_name,

2468

client["last_checker_status"]))

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

2469

3413

client["enabled"] = False

2470

3414

else:

2471

client["expires"] = (datetime.datetime

2472

.utcnow()

2473

+ client["timeout"])

2474

logger.debug("Last checker succeeded,"

2475

" keeping {0} enabled"

2476

.format(client_name))

3415

client["expires"] = (

3416

datetime.datetime.utcnow()

3417

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

2477

3420

try:

2478

client["secret"] = (

2479

pgp.decrypt(client["encrypted_secret"],

2480

client_settings[client_name]

2481

["secret"]))

3421

client["secret"] = pgp.decrypt(

3422

client["encrypted_secret"],

3423

client_settings[client_name]["secret"])

2482

3424

except PGPError:

2483

3425

# If decryption fails, we use secret from new settings

2484

logger.debug("Failed to decrypt {0} old secret"

2485

.format(client_name))

2486

client["secret"] = (

2487

client_settings[client_name]["secret"])

2488

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3428

client["secret"] = (client_settings[client_name]

3429

["secret"])

3430

2489

3431

# Add/remove clients based on new changes made to config

2490

3432

for client_name in (set(old_client_settings)

2491

3433

- set(client_settings)):

2493

3435

for client_name in (set(client_settings)

2494

3436

- set(old_client_settings)):

2495

3437

clients_data[client_name] = client_settings[client_name]

2496

3438

2497

3439

# Create all client objects

2498

for client_name, client in clients_data.iteritems():

3440

for client_name, client in clients_data.items():

2499

3441

tcp_server.clients[client_name] = client_class(

2500

name = client_name, settings = client)

2501

3442

name=client_name,

3443

settings=client,

3444

server_settings=server_settings)

3445

2502

3446

if not tcp_server.clients:

2503

logger.warning("No clients defined")

2504

3447

log.warning("No clients defined")

3448

2505

3449

if not foreground:

2506

3450

if pidfile is not None:

3451

pid = os.getpid()

2507

3452

try:

2508

3453

with pidfile:

2509

pid = os.getpid()

2510

pidfile.write(str(pid) + "\n".encode("utf-8"))

3454

print(pid, file=pidfile)

2511

3455

except IOError:

2512

logger.error("Could not write to file %r with PID %d",

2513

pidfilename, pid)

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

2514

3458

del pidfile

2515

3459

del pidfilename

2516

2517

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2518

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2519

3460

3461

for termsig in (signal.SIGHUP, signal.SIGTERM):

3462

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3463

lambda: main_loop.quit() and False)

3464

2520

3465

if use_dbus:

2521

@alternate_dbus_interfaces({"se.recompile.Mandos":

2522

"se.bsnet.fukt.Mandos"})

2523

class MandosDBusService(DBusObjectWithProperties):

3466

3467

@alternate_dbus_interfaces(

3468

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3469

class MandosDBusService(DBusObjectWithObjectManager):

2524

3470

"""A D-Bus proxy object"""

3471

2525

3472

def __init__(self):

2526

3473

dbus.service.Object.__init__(self, bus, "/")

3474

2527

3475

_interface = "se.recompile.Mandos"

2528

2529

@dbus_interface_annotations(_interface)

2530

def _foo(self):

2531

return { "org.freedesktop.DBus.Property"

2532

".EmitsChangedSignal":

2533

"false"}

2534

3476

2535

3477

@dbus.service.signal(_interface, signature="o")

2536

3478

def ClientAdded(self, objpath):

2537

3479

"D-Bus signal"

2538

3480

pass

2539

3481

2540

3482

@dbus.service.signal(_interface, signature="ss")

2541

def ClientNotFound(self, fingerprint, address):

3483

def ClientNotFound(self, key_id, address):

2542

3484

"D-Bus signal"

2543

3485

pass

2544

3486

3487

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3488

"true"})

2545

3489

@dbus.service.signal(_interface, signature="os")

2546

3490

def ClientRemoved(self, objpath, name):

2547

3491

"D-Bus signal"

2548

3492

pass

2549

3493

3494

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3495

"true"})

2550

3496

@dbus.service.method(_interface, out_signature="ao")

2551

3497

def GetAllClients(self):

2552

3498

"D-Bus method"

2553

return dbus.Array(c.dbus_object_path

2554

for c in

2555

tcp_server.clients.itervalues())

2556

3499

return dbus.Array(c.dbus_object_path for c in

3500

tcp_server.clients.values())

3501

3502

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3503

"true"})

2557

3504

@dbus.service.method(_interface,

2558

3505

out_signature="a{oa{sv}}")

2559

3506

def GetAllClientsWithProperties(self):

2560

3507

"D-Bus method"

2561

3508

return dbus.Dictionary(

2562

((c.dbus_object_path, c.GetAll(""))

2563

for c in tcp_server.clients.itervalues()),

3509

{c.dbus_object_path: c.GetAll(

3510

"se.recompile.Mandos.Client")

3511

for c in tcp_server.clients.values()},

2564

3512

signature="oa{sv}")

2565

3513

2566

3514

@dbus.service.method(_interface, in_signature="o")

2567

3515

def RemoveClient(self, object_path):

2568

3516

"D-Bus method"

2569

for c in tcp_server.clients.itervalues():

3517

for c in tcp_server.clients.values():

2570

3518

if c.dbus_object_path == object_path:

2571

3519

del tcp_server.clients[c.name]

2572

3520

c.remove_from_connection()

2573

# Don't signal anything except ClientRemoved

3521

# Don't signal the disabling

2574

3522

c.disable(quiet=True)

2575

# Emit D-Bus signal

2576

self.ClientRemoved(object_path, c.name)

3523

# Emit D-Bus signal for removal

3524

self.client_removed_signal(c)

2577

3525

return

2578

3526

raise KeyError(object_path)

2579

3527

2580

3528

del _interface

2581

3529

3530

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3531

out_signature="a{oa{sa{sv}}}")

3532

def GetManagedObjects(self):

3533

"""D-Bus method"""

3534

return dbus.Dictionary(

3535

{client.dbus_object_path:

3536

dbus.Dictionary(

3537

{interface: client.GetAll(interface)

3538

for interface in

3539

client._get_all_interface_names()})

3540

for client in tcp_server.clients.values()})

3541

3542

def client_added_signal(self, client):

3543

"""Send the new standard signal and the old signal"""

3544

if use_dbus:

3545

# New standard signal

3546

self.InterfacesAdded(

3547

client.dbus_object_path,

3548

dbus.Dictionary(

3549

{interface: client.GetAll(interface)

3550

for interface in

3551

client._get_all_interface_names()}))

3552

# Old signal

3553

self.ClientAdded(client.dbus_object_path)

3554

3555

def client_removed_signal(self, client):

3556

"""Send the new standard signal and the old signal"""

3557

if use_dbus:

3558

# New standard signal

3559

self.InterfacesRemoved(

3560

client.dbus_object_path,

3561

client._get_all_interface_names())

3562

# Old signal

3563

self.ClientRemoved(client.dbus_object_path,

3564

client.name)

3565

2582

3566

mandos_dbus_service = MandosDBusService()

2583

3567

3568

# Save modules to variables to exempt the modules from being

3569

# unloaded before the function registered with atexit() is run.

3570

mp = multiprocessing

3571

wn = wnull

3572

2584

3573

def cleanup():

2585

3574

"Cleanup function; run on exit"

2586

service.cleanup()

2587

2588

multiprocessing.active_children()

3575

if zeroconf:

3576

service.cleanup()

3577

3578

mp.active_children()

3579

wn.close()

2589

3580

if not (tcp_server.clients or client_settings):

2590

3581

return

2591

3582

2592

3583

# Store client before exiting. Secrets are encrypted with key

2593

3584

# based on what config file has. If config file is

2594

3585

# removed/edited, old secret will thus be unrecovable.

2595

3586

clients = {}

2596

3587

with PGPEngine() as pgp:

2597

for client in tcp_server.clients.itervalues():

3588

for client in tcp_server.clients.values():

2598

3589

key = client_settings[client.name]["secret"]

2599

3590

client.encrypted_secret = pgp.encrypt(client.secret,

2600

3591

key)

2601

3592

client_dict = {}

2602

3593

2603

3594

# A list of attributes that can not be pickled

2604

3595

# + secret.

2605

exclude = set(("bus", "changedstate", "secret",

2606

"checker"))

2607

for name, typ in (inspect.getmembers

2608

(dbus.service.Object)):

3596

exclude = {"bus", "changedstate", "secret",

3597

"checker", "server_settings"}

3598

for name, typ in inspect.getmembers(dbus.service

3599

.Object):

2609

3600

exclude.add(name)

2610

3601

2611

3602

client_dict["encrypted_secret"] = (client

2612

3603

.encrypted_secret)

2613

3604

for attr in client.client_structure:

2614

3605

if attr not in exclude:

2615

3606

client_dict[attr] = getattr(client, attr)

2616

3607

2617

3608

clients[client.name] = client_dict

2618

3609

del client_settings[client.name]["secret"]

2619

3610

2620

3611

try:

2621

with (tempfile.NamedTemporaryFile

2622

(mode='wb', suffix=".pickle", prefix='clients-',

2623

dir=os.path.dirname(stored_state_path),

2624

delete=False)) as stored_state:

2625

pickle.dump((clients, client_settings), stored_state)

2626

tempname=stored_state.name

3612

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3614

suffix=".pickle",

3615

prefix="clients-",

3616

dir=os.path.dirname(stored_state_path),

3617

delete=False) as stored_state:

3618

pickle.dump((clients, client_settings), stored_state,

3619

protocol=2)

3620

tempname = stored_state.name

2627

3621

os.rename(tempname, stored_state_path)

2628

3622

except (IOError, OSError) as e:

2629

3623

if not debug:

2632

3626

except NameError:

2633

3627

pass

2634

3628

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2635

logger.warning("Could not save persistent state: {0}"

2636

.format(os.strerror(e.errno)))

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

2637

3631

else:

2638

logger.warning("Could not save persistent state:",

2639

exc_info=e)

2640

raise e

2641

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3634

raise

3635

2642

3636

# Delete all clients, and settings from config

2643

3637

while tcp_server.clients:

2644

3638

name, client = tcp_server.clients.popitem()

2645

3639

if use_dbus:

2646

3640

client.remove_from_connection()

2647

# Don't signal anything except ClientRemoved

3641

# Don't signal the disabling

2648

3642

client.disable(quiet=True)

3643

# Emit D-Bus signal for removal

2649

3644

if use_dbus:

2650

# Emit D-Bus signal

2651

mandos_dbus_service.ClientRemoved(client

2652

.dbus_object_path,

2653

client.name)

3645

mandos_dbus_service.client_removed_signal(client)

2654

3646

client_settings.clear()

2655

3647

2656

3648

atexit.register(cleanup)

2657

2658

for client in tcp_server.clients.itervalues():

3649

3650

for client in tcp_server.clients.values():

2659

3651

if use_dbus:

2660

# Emit D-Bus signal

2661

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3652

# Emit D-Bus signal for adding

3653

mandos_dbus_service.client_added_signal(client)

2662

3654

# Need to initiate checking of clients

2663

3655

if client.enabled:

2664

client.init_checker()

2665

3656

client.init_checker(randomize_start=True)

3657

2666

3658

tcp_server.enable()

2667

3659

tcp_server.server_activate()

2668

3660

2669

3661

# Find out what port we got

2670

service.port = tcp_server.socket.getsockname()[1]

3662

if zeroconf:

3663

service.port = tcp_server.socket.getsockname()[1]

2671

3664

if use_ipv6:

2672

logger.info("Now listening on address %r, port %d,"

2673

" flowinfo %d, scope_id %d",

2674

*tcp_server.socket.getsockname())

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

2675

3667

else: # IPv4

2676

logger.info("Now listening on address %r, port %d",

2677

*tcp_server.socket.getsockname())

2678

2679

#service.interface = tcp_server.socket.getsockname()[3]

2680

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3670

3671

# service.interface = tcp_server.socket.getsockname()[3]

3672

2681

3673

try:

2682

# From the Avahi example code

2683

try:

2684

service.activate()

2685

except dbus.exceptions.DBusException as error:

2686

logger.critical("D-Bus Exception", exc_info=error)

2687

cleanup()

2688

sys.exit(1)

2689

# End of Avahi example code

2690

2691

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2692

lambda *args, **kwargs:

2693

(tcp_server.handle_request

2694

(*args[2:], **kwargs) or True))

2695

2696

logger.debug("Starting main loop")

3674

if zeroconf:

3675

# From the Avahi example code

3676

try:

3677

service.activate()

3678

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3680

cleanup()

3681

sys.exit(1)

3682

# End of Avahi example code

3683

3684

GLib.io_add_watch(

3685

GLib.IOChannel.unix_new(tcp_server.fileno()),

3686

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3687

lambda *args, **kwargs: (tcp_server.handle_request

3688

(*args[2:], **kwargs) or True))

3689

3690

log.debug("Starting main loop")

2697

3691

main_loop.run()

2698

3692

except AvahiError as error:

2699

logger.critical("Avahi Error", exc_info=error)

3693

log.critical("Avahi Error", exc_info=error)

2700

3694

cleanup()

2701

3695

sys.exit(1)

2702

3696

except KeyboardInterrupt:

2703

3697

if debug:

2704

3698

print("", file=sys.stderr)

2705

logger.debug("Server received KeyboardInterrupt")

2706

logger.debug("Server exiting")

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

2707

3701

# Must run before the D-Bus bus name gets deregistered

2708

3702

cleanup()

2709

3703

2710

if __name__ == '__main__':

2711

main()

3704

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3707

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3710

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3713

sys.argv[1:] = unknown_args

3714

return args

3715

3716

# Add all tests from doctest strings

3717

def load_tests(loader, tests, none):

3718

import doctest

3719

tests.addTests(doctest.DocTestSuite())

3720

return tests

3721

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3724

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3737

else:

3738

main()

3739

finally:

3740

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End: