To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 356
- compare with another revision
- download diff
- download tarball
- view history from revision 356
- Committer: Teddy Hogeborn
- Date: 2017-01-25 19:24:00 UTC
- mfrom: (237.7.439 trunk)
- Revision ID: teddy@recompile.se-20170125192400-qska3g89wkwg0ccu
Merge from trunk
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
23
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
25
# GNU General Public License for more details.
26
#
26
#
27
27
# You should have received a copy of the GNU General Public License
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
#
30
#
31
31
# Contact the authors at <mandos@recompile.se>.
32
#
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
38
41
39
42
try:
40
43
import SocketServer as socketserver
76
79
77
80
import dbus
78
81
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
82
from gi.repository import GLib
84
83
from dbus.mainloop.glib import DBusGMainLoop
85
84
import ctypes
86
85
import ctypes.util
87
86
import xml.dom.minidom
88
87
import inspect
89
88
89
# Try to find the value of SO_BINDTODEVICE:
90
90
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
91
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
94
except AttributeError:
93
95
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
94
98
from IN import SO_BINDTODEVICE
95
99
except ImportError:
96
SO_BINDTODEVICE = None
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
97
113
98
114
if sys.version_info.major == 2:
99
115
str = unicode
100
116
101
version = "1.7.1"
117
version = "1.7.13"
102
118
stored_state_file = "clients.pickle"
103
119
104
120
logger = logging.getLogger()
108
124
if_nametoindex = ctypes.cdll.LoadLibrary(
109
125
ctypes.util.find_library("c")).if_nametoindex
110
126
except (OSError, AttributeError):
111
127
112
128
def if_nametoindex(interface):
113
129
"Get an interface index the hard way, i.e. using fcntl()"
114
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
135
return interface_index
120
136
121
137
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
122
154
def initlogger(debug, level=logging.WARNING):
123
155
"""init logger and add loglevel"""
124
156
125
157
global syslogger
126
158
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
address="/dev/log"))
129
161
syslogger.setFormatter(logging.Formatter
130
162
('Mandos [%(process)d]: %(levelname)s:'
131
163
' %(message)s'))
132
164
logger.addHandler(syslogger)
133
165
134
166
if debug:
135
167
console = logging.StreamHandler()
136
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
148
180
149
181
class PGPEngine(object):
150
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
183
152
184
def __init__(self):
153
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
self.gpg = "gpg"
187
try:
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
191
if name == "gpg":
192
self.gpg = path
193
break
194
except OSError as e:
195
if e.errno != errno.ENOENT:
196
raise
154
197
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
198
'--homedir', self.tempdir,
156
199
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
204
160
205
def __enter__(self):
161
206
return self
162
207
163
208
def __exit__(self, exc_type, exc_value, traceback):
164
209
self._cleanup()
165
210
return False
166
211
167
212
def __del__(self):
168
213
self._cleanup()
169
214
170
215
def _cleanup(self):
171
216
if self.tempdir is not None:
172
217
# Delete contents of tempdir
173
218
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
219
topdown=False):
175
220
for filename in files:
176
221
os.remove(os.path.join(root, filename))
177
222
for dirname in dirs:
179
224
# Remove tempdir
180
225
os.rmdir(self.tempdir)
181
226
self.tempdir = None
182
227
183
228
def password_encode(self, password):
184
229
# Passphrase can not be empty and can not contain newlines or
185
230
# NUL bytes. So we prefix it and hex encode it.
190
235
.replace(b"\n", b"\\n")
191
236
.replace(b"\0", b"\\x00"))
192
237
return encoded
193
238
194
239
def encrypt(self, data, password):
195
240
passphrase = self.password_encode(password)
196
241
with tempfile.NamedTemporaryFile(
197
242
dir=self.tempdir) as passfile:
198
243
passfile.write(passphrase)
199
244
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
245
proc = subprocess.Popen([self.gpg, '--symmetric',
201
246
'--passphrase-file',
202
247
passfile.name]
203
248
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
208
253
if proc.returncode != 0:
209
254
raise PGPError(err)
210
255
return ciphertext
211
256
212
257
def decrypt(self, data, password):
213
258
passphrase = self.password_encode(password)
214
259
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
260
dir=self.tempdir) as passfile:
216
261
passfile.write(passphrase)
217
262
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
263
proc = subprocess.Popen([self.gpg, '--decrypt',
219
264
'--passphrase-file',
220
265
passfile.name]
221
266
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
226
271
if proc.returncode != 0:
227
272
raise PGPError(err)
228
273
return decrypted_plaintext
229
274
230
275
276
# Pretend that we have an Avahi module
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
288
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
301
302
231
303
class AvahiError(Exception):
232
304
def __init__(self, value, *args, **kwargs):
233
305
self.value = value
245
317
246
318
class AvahiService(object):
247
319
"""An Avahi (Zeroconf) service.
248
320
249
321
Attributes:
250
322
interface: integer; avahi.IF_UNSPEC or an interface index.
251
323
Used to optionally bind to the specified interface.
263
335
server: D-Bus Server
264
336
bus: dbus.SystemBus()
265
337
"""
266
338
267
339
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
278
350
self.interface = interface
279
351
self.name = name
280
352
self.type = servicetype
289
361
self.server = None
290
362
self.bus = bus
291
363
self.entry_group_state_changed_match = None
292
364
293
365
def rename(self, remove=True):
294
366
"""Derived from the Avahi example code"""
295
367
if self.rename_count >= self.max_renames:
315
387
logger.critical("D-Bus Exception", exc_info=error)
316
388
self.cleanup()
317
389
os._exit(1)
318
390
319
391
def remove(self):
320
392
"""Derived from the Avahi example code"""
321
393
if self.entry_group_state_changed_match is not None:
323
395
self.entry_group_state_changed_match = None
324
396
if self.group is not None:
325
397
self.group.Reset()
326
398
327
399
def add(self):
328
400
"""Derived from the Avahi example code"""
329
401
self.remove()
346
418
dbus.UInt16(self.port),
347
419
avahi.string_array_to_txt_array(self.TXT))
348
420
self.group.Commit()
349
421
350
422
def entry_group_state_changed(self, state, error):
351
423
"""Derived from the Avahi example code"""
352
424
logger.debug("Avahi entry group state change: %i", state)
353
425
354
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
427
logger.debug("Zeroconf service established.")
356
428
elif state == avahi.ENTRY_GROUP_COLLISION:
360
432
logger.critical("Avahi: Error in group state changed %s",
361
433
str(error))
362
434
raise AvahiGroupError("State changed: {!s}".format(error))
363
435
364
436
def cleanup(self):
365
437
"""Derived from the Avahi example code"""
366
438
if self.group is not None:
371
443
pass
372
444
self.group = None
373
445
self.remove()
374
446
375
447
def server_state_changed(self, state, error=None):
376
448
"""Derived from the Avahi example code"""
377
449
logger.debug("Avahi server state change: %i", state)
406
478
logger.debug("Unknown state: %r", state)
407
479
else:
408
480
logger.debug("Unknown state: %r: %r", state, error)
409
481
410
482
def activate(self):
411
483
"""Derived from the Avahi example code"""
412
484
if self.server is None:
429
501
.format(self.name)))
430
502
return ret
431
503
504
432
505
# Pretend that we have a GnuTLS module
433
506
class GnuTLS(object):
434
507
"""This isn't so much a class as it is a module-like namespace.
435
508
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
509
510
library = ctypes.util.find_library("gnutls")
511
if library is None:
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
514
del library
515
_need_version = b"3.3.0"
516
440
517
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
523
448
524
# Unless otherwise indicated, the constants and types below are
449
525
# all from the gnutls/gnutls.h C header file.
450
526
451
527
# Constants
452
528
E_SUCCESS = 0
453
529
E_INTERRUPTED = -52
458
534
CRD_CERTIFICATE = 1
459
535
E_NO_CERTIFICATE_FOUND = -49
460
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
537
462
538
# Types
463
539
class session_int(ctypes.Structure):
464
540
_fields_ = []
465
541
session_t = ctypes.POINTER(session_int)
542
466
543
class certificate_credentials_st(ctypes.Structure):
467
544
_fields_ = []
468
545
certificate_credentials_t = ctypes.POINTER(
469
546
certificate_credentials_st)
470
547
certificate_type_t = ctypes.c_int
548
471
549
class datum_t(ctypes.Structure):
472
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
551
('size', ctypes.c_uint)]
552
474
553
class openpgp_crt_int(ctypes.Structure):
475
554
_fields_ = []
476
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
558
credentials_type_t = ctypes.c_int
480
559
transport_ptr_t = ctypes.c_void_p
481
560
close_request_t = ctypes.c_int
482
561
483
562
# Exceptions
484
563
class Error(Exception):
485
564
# We need to use the class name "GnuTLS" here, since this
486
565
# exception might be raised from within GnuTLS.__init__,
487
566
# which is called before the assignment to the "gnutls"
488
567
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
568
def __init__(self, message=None, code=None, args=()):
490
569
# Default usage is by a message string, but if a return
491
570
# code is passed, convert it to a string with
492
571
# gnutls.strerror()
495
574
message = GnuTLS.strerror(code)
496
575
return super(GnuTLS.Error, self).__init__(
497
576
message, *args)
498
577
499
578
class CertificateSecurityError(Error):
500
579
pass
501
580
502
581
# Classes
503
582
class Credentials(object):
504
583
def __init__(self):
506
585
gnutls.certificate_allocate_credentials(
507
586
ctypes.byref(self._c_object))
508
587
self.type = gnutls.CRD_CERTIFICATE
509
588
510
589
def __del__(self):
511
590
gnutls.certificate_free_credentials(self._c_object)
512
591
513
592
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
593
def __init__(self, socket, credentials=None):
515
594
self._c_object = gnutls.session_t()
516
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
596
gnutls.set_default_priority(self._c_object)
525
604
ctypes.cast(credentials._c_object,
526
605
ctypes.c_void_p))
527
606
self.credentials = credentials
528
607
529
608
def __del__(self):
530
609
gnutls.deinit(self._c_object)
531
610
532
611
def handshake(self):
533
612
return gnutls.handshake(self._c_object)
534
613
535
614
def send(self, data):
536
615
data = bytes(data)
537
616
data_len = len(data)
539
618
data_len -= gnutls.record_send(self._c_object,
540
619
data[-data_len:],
541
620
data_len)
542
621
543
622
def bye(self):
544
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
624
546
625
# Error handling functions
547
626
def _error_code(result):
548
627
"""A function to raise exceptions on errors, suitable
550
629
if result >= 0:
551
630
return result
552
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
634
556
635
def _retry_on_error(result, func, arguments):
557
636
"""A function to retry on some errors, suitable
558
637
for the 'errcheck' attribute on ctypes functions"""
561
640
return _error_code(result)
562
641
result = func(*arguments)
563
642
return result
564
643
565
644
# Unless otherwise indicated, the function declarations below are
566
645
# all from the gnutls/gnutls.h C header file.
567
646
568
647
# Functions
569
648
priority_set_direct = _library.gnutls_priority_set_direct
570
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
650
ctypes.POINTER(ctypes.c_char_p)]
572
651
priority_set_direct.restype = _error_code
573
652
574
653
init = _library.gnutls_init
575
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
655
init.restype = _error_code
577
656
578
657
set_default_priority = _library.gnutls_set_default_priority
579
658
set_default_priority.argtypes = [session_t]
580
659
set_default_priority.restype = _error_code
581
660
582
661
record_send = _library.gnutls_record_send
583
662
record_send.argtypes = [session_t, ctypes.c_void_p,
584
663
ctypes.c_size_t]
585
664
record_send.restype = ctypes.c_ssize_t
586
665
record_send.errcheck = _retry_on_error
587
666
588
667
certificate_allocate_credentials = (
589
668
_library.gnutls_certificate_allocate_credentials)
590
669
certificate_allocate_credentials.argtypes = [
591
670
ctypes.POINTER(certificate_credentials_t)]
592
671
certificate_allocate_credentials.restype = _error_code
593
672
594
673
certificate_free_credentials = (
595
674
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
597
677
certificate_free_credentials.restype = None
598
678
599
679
handshake_set_private_extensions = (
600
680
_library.gnutls_handshake_set_private_extensions)
601
681
handshake_set_private_extensions.argtypes = [session_t,
602
682
ctypes.c_int]
603
683
handshake_set_private_extensions.restype = None
604
684
605
685
credentials_set = _library.gnutls_credentials_set
606
686
credentials_set.argtypes = [session_t, credentials_type_t,
607
687
ctypes.c_void_p]
608
688
credentials_set.restype = _error_code
609
689
610
690
strerror = _library.gnutls_strerror
611
691
strerror.argtypes = [ctypes.c_int]
612
692
strerror.restype = ctypes.c_char_p
613
693
614
694
certificate_type_get = _library.gnutls_certificate_type_get
615
695
certificate_type_get.argtypes = [session_t]
616
696
certificate_type_get.restype = _error_code
617
697
618
698
certificate_get_peers = _library.gnutls_certificate_get_peers
619
699
certificate_get_peers.argtypes = [session_t,
620
700
ctypes.POINTER(ctypes.c_uint)]
621
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
702
623
703
global_set_log_level = _library.gnutls_global_set_log_level
624
704
global_set_log_level.argtypes = [ctypes.c_int]
625
705
global_set_log_level.restype = None
626
706
627
707
global_set_log_function = _library.gnutls_global_set_log_function
628
708
global_set_log_function.argtypes = [log_func]
629
709
global_set_log_function.restype = None
630
710
631
711
deinit = _library.gnutls_deinit
632
712
deinit.argtypes = [session_t]
633
713
deinit.restype = None
634
714
635
715
handshake = _library.gnutls_handshake
636
716
handshake.argtypes = [session_t]
637
717
handshake.restype = _error_code
638
718
handshake.errcheck = _retry_on_error
639
719
640
720
transport_set_ptr = _library.gnutls_transport_set_ptr
641
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
722
transport_set_ptr.restype = None
643
723
644
724
bye = _library.gnutls_bye
645
725
bye.argtypes = [session_t, close_request_t]
646
726
bye.restype = _error_code
647
727
bye.errcheck = _retry_on_error
648
728
649
729
check_version = _library.gnutls_check_version
650
730
check_version.argtypes = [ctypes.c_char_p]
651
731
check_version.restype = ctypes.c_char_p
652
732
653
733
# All the function declarations below are from gnutls/openpgp.h
654
734
655
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
737
openpgp_crt_init.restype = _error_code
658
738
659
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
741
ctypes.POINTER(datum_t),
662
742
openpgp_crt_fmt_t]
663
743
openpgp_crt_import.restype = _error_code
664
744
665
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
747
ctypes.POINTER(ctypes.c_uint)]
668
748
openpgp_crt_verify_self.restype = _error_code
669
749
670
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
752
openpgp_crt_deinit.restype = None
673
753
674
754
openpgp_crt_get_fingerprint = (
675
755
_library.gnutls_openpgp_crt_get_fingerprint)
676
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
678
758
ctypes.POINTER(
679
759
ctypes.c_size_t)]
680
760
openpgp_crt_get_fingerprint.restype = _error_code
681
761
682
762
# Remove non-public functions
683
763
del _error_code, _retry_on_error
684
764
# Create the global "gnutls" object, simulating a module
685
765
gnutls = GnuTLS()
686
766
767
687
768
def call_pipe(connection, # : multiprocessing.Connection
688
769
func, *args, **kwargs):
689
770
"""This function is meant to be called by multiprocessing.Process
690
771
691
772
This function runs func(*args, **kwargs), and writes the resulting
692
773
return value on the provided multiprocessing.Connection.
693
774
"""
694
775
connection.send(func(*args, **kwargs))
695
776
connection.close()
696
777
778
697
779
class Client(object):
698
780
"""A representation of a client host served by this server.
699
781
700
782
Attributes:
701
783
approved: bool(); 'None' if not yet approved/disapproved
702
784
approval_delay: datetime.timedelta(); Time to wait for approval
704
786
checker: subprocess.Popen(); a running checker process used
705
787
to see if the client lives.
706
788
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
789
checker_callback_tag: a GLib event source tag, or None
708
790
checker_command: string; External command which is run to check
709
791
if client lives. %() expansions are done at
710
792
runtime with vars(self) as dict, so that for
711
793
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
794
checker_initiator_tag: a GLib event source tag, or None
713
795
created: datetime.datetime(); (UTC) object creation
714
796
client_structure: Object describing what attributes a client has
715
797
and is used for storing the client at exit
716
798
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
799
disable_initiator_tag: a GLib event source tag, or None
718
800
enabled: bool()
719
801
fingerprint: string (40 or 32 hexadecimal digits); used to
720
802
uniquely identify the client
739
821
disabled, or None
740
822
server_settings: The server_settings dict from main()
741
823
"""
742
824
743
825
runtime_expansions = ("approval_delay", "approval_duration",
744
826
"created", "enabled", "expires",
745
827
"fingerprint", "host", "interval",
756
838
"approved_by_default": "True",
757
839
"enabled": "True",
758
840
}
759
841
760
842
@staticmethod
761
843
def config_parser(config):
762
844
"""Construct a new dict of client settings of this form:
769
851
for client_name in config.sections():
770
852
section = dict(config.items(client_name))
771
853
client = settings[client_name] = {}
772
854
773
855
client["host"] = section["host"]
774
856
# Reformat values from string types to Python types
775
857
client["approved_by_default"] = config.getboolean(
776
858
client_name, "approved_by_default")
777
859
client["enabled"] = config.getboolean(client_name,
778
860
"enabled")
779
861
780
862
# Uppercase and remove spaces from fingerprint for later
781
863
# comparison purposes with return value from the
782
864
# fingerprint() function
783
865
client["fingerprint"] = (section["fingerprint"].upper()
784
866
.replace(" ", ""))
785
867
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
868
client["secret"] = codecs.decode(section["secret"]
869
.encode("utf-8"),
870
"base64")
787
871
elif "secfile" in section:
788
872
with open(os.path.expanduser(os.path.expandvars
789
873
(section["secfile"])),
804
888
client["last_approval_request"] = None
805
889
client["last_checked_ok"] = None
806
890
client["last_checker_status"] = -2
807
891
808
892
return settings
809
810
def __init__(self, settings, name = None, server_settings=None):
893
894
def __init__(self, settings, name=None, server_settings=None):
811
895
self.name = name
812
896
if server_settings is None:
813
897
server_settings = {}
815
899
# adding all client settings
816
900
for setting, value in settings.items():
817
901
setattr(self, setting, value)
818
902
819
903
if self.enabled:
820
904
if not hasattr(self, "last_enabled"):
821
905
self.last_enabled = datetime.datetime.utcnow()
825
909
else:
826
910
self.last_enabled = None
827
911
self.expires = None
828
912
829
913
logger.debug("Creating client %r", self.name)
830
914
logger.debug(" Fingerprint: %s", self.fingerprint)
831
915
self.created = settings.get("created",
832
916
datetime.datetime.utcnow())
833
917
834
918
# attributes specific for this server instance
835
919
self.checker = None
836
920
self.checker_initiator_tag = None
842
926
self.changedstate = multiprocessing_manager.Condition(
843
927
multiprocessing_manager.Lock())
844
928
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
929
for attr in self.__dict__.keys()
846
930
if not attr.startswith("_")]
847
931
self.client_structure.append("client_structure")
848
932
849
933
for name, t in inspect.getmembers(
850
934
type(self), lambda obj: isinstance(obj, property)):
851
935
if not name.startswith("_"):
852
936
self.client_structure.append(name)
853
937
854
938
# Send notice to process children that client state has changed
855
939
def send_changedstate(self):
856
940
with self.changedstate:
857
941
self.changedstate.notify_all()
858
942
859
943
def enable(self):
860
944
"""Start this client's checker and timeout hooks"""
861
945
if getattr(self, "enabled", False):
866
950
self.last_enabled = datetime.datetime.utcnow()
867
951
self.init_checker()
868
952
self.send_changedstate()
869
953
870
954
def disable(self, quiet=True):
871
955
"""Disable this client."""
872
956
if not getattr(self, "enabled", False):
874
958
if not quiet:
875
959
logger.info("Disabling client %s", self.name)
876
960
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
961
GLib.source_remove(self.disable_initiator_tag)
878
962
self.disable_initiator_tag = None
879
963
self.expires = None
880
964
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
965
GLib.source_remove(self.checker_initiator_tag)
882
966
self.checker_initiator_tag = None
883
967
self.stop_checker()
884
968
self.enabled = False
885
969
if not quiet:
886
970
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
971
# Do not run this again if called by a GLib.timeout_add
888
972
return False
889
973
890
974
def __del__(self):
891
975
self.disable()
892
976
893
977
def init_checker(self):
894
978
# Schedule a new checker to be started an 'interval' from now,
895
979
# and every interval from then on.
896
980
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
899
983
int(self.interval.total_seconds() * 1000),
900
984
self.start_checker)
901
985
# Schedule a disable() when 'timeout' has passed
902
986
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
905
989
int(self.timeout.total_seconds() * 1000), self.disable)
906
990
# Also start a new checker *right now*.
907
991
self.start_checker()
908
992
909
993
def checker_callback(self, source, condition, connection,
910
994
command):
911
995
"""The checker has completed, so take appropriate actions."""
914
998
# Read return code from connection (see call_pipe)
915
999
returncode = connection.recv()
916
1000
connection.close()
917
1001
918
1002
if returncode >= 0:
919
1003
self.last_checker_status = returncode
920
1004
self.last_checker_signal = None
930
1014
logger.warning("Checker for %(name)s crashed?",
931
1015
vars(self))
932
1016
return False
933
1017
934
1018
def checked_ok(self):
935
1019
"""Assert that the client has been seen, alive and well."""
936
1020
self.last_checked_ok = datetime.datetime.utcnow()
937
1021
self.last_checker_status = 0
938
1022
self.last_checker_signal = None
939
1023
self.bump_timeout()
940
1024
941
1025
def bump_timeout(self, timeout=None):
942
1026
"""Bump up the timeout for this client."""
943
1027
if timeout is None:
944
1028
timeout = self.timeout
945
1029
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1030
GLib.source_remove(self.disable_initiator_tag)
947
1031
self.disable_initiator_tag = None
948
1032
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1033
self.disable_initiator_tag = GLib.timeout_add(
950
1034
int(timeout.total_seconds() * 1000), self.disable)
951
1035
self.expires = datetime.datetime.utcnow() + timeout
952
1036
953
1037
def need_approval(self):
954
1038
self.last_approval_request = datetime.datetime.utcnow()
955
1039
956
1040
def start_checker(self):
957
1041
"""Start a new checker subprocess if one is not running.
958
1042
959
1043
If a checker already exists, leave it running and do
960
1044
nothing."""
961
1045
# The reason for not killing a running checker is that if we
966
1050
# checkers alone, the checker would have to take more time
967
1051
# than 'timeout' for the client to be disabled, which is as it
968
1052
# should be.
969
1053
970
1054
if self.checker is not None and not self.checker.is_alive():
971
1055
logger.warning("Checker was not alive; joining")
972
1056
self.checker.join()
976
1060
# Escape attributes for the shell
977
1061
escaped_attrs = {
978
1062
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
1063
for attr in self.runtime_expansions}
980
1064
try:
981
1065
command = self.checker_command % escaped_attrs
982
1066
except TypeError as error:
994
1078
# The exception is when not debugging but nevertheless
995
1079
# running in the foreground; use the previously
996
1080
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1081
popen_args = {"close_fds": True,
1082
"shell": True,
1083
"cwd": "/"}
1000
1084
if (not self.server_settings["debug"]
1001
1085
and self.server_settings["foreground"]):
1002
1086
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1087
"stderr": wnull})
1088
pipe = multiprocessing.Pipe(duplex=False)
1005
1089
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1090
target=call_pipe,
1091
args=(pipe[1], subprocess.call, command),
1092
kwargs=popen_args)
1009
1093
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1012
1096
self.checker_callback, pipe[0], command)
1013
# Re-run this periodically if run by gobject.timeout_add
1097
# Re-run this periodically if run by GLib.timeout_add
1014
1098
return True
1015
1099
1016
1100
def stop_checker(self):
1017
1101
"""Force the checker process, if any, to stop."""
1018
1102
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1103
GLib.source_remove(self.checker_callback_tag)
1020
1104
self.checker_callback_tag = None
1021
1105
if getattr(self, "checker", None) is None:
1022
1106
return
1031
1115
byte_arrays=False):
1032
1116
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
1117
become properties on the D-Bus.
1034
1118
1035
1119
The decorated method will be called with no arguments by "Get"
1036
1120
and with one argument by "Set".
1037
1121
1038
1122
The parameters, where they are supported, are the same as
1039
1123
dbus.service.method, except there is only "signature", since the
1040
1124
type from Get() and the type sent to Set() is the same.
1044
1128
if byte_arrays and signature != "ay":
1045
1129
raise ValueError("Byte arrays not supported for non-'ay'"
1046
1130
" signature {!r}".format(signature))
1047
1131
1048
1132
def decorator(func):
1049
1133
func._dbus_is_property = True
1050
1134
func._dbus_interface = dbus_interface
1053
1137
func._dbus_name = func.__name__
1054
1138
if func._dbus_name.endswith("_dbus_property"):
1055
1139
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1057
1141
return func
1058
1142
1059
1143
return decorator
1060
1144
1061
1145
1062
1146
def dbus_interface_annotations(dbus_interface):
1063
1147
"""Decorator for marking functions returning interface annotations
1064
1148
1065
1149
Usage:
1066
1150
1067
1151
@dbus_interface_annotations("org.example.Interface")
1068
1152
def _foo(self): # Function name does not matter
1069
1153
return {"org.freedesktop.DBus.Deprecated": "true",
1070
1154
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
1155
"false"}
1072
1156
"""
1073
1157
1074
1158
def decorator(func):
1075
1159
func._dbus_is_interface = True
1076
1160
func._dbus_interface = dbus_interface
1077
1161
func._dbus_name = dbus_interface
1078
1162
return func
1079
1163
1080
1164
return decorator
1081
1165
1082
1166
1083
1167
def dbus_annotations(annotations):
1084
1168
"""Decorator to annotate D-Bus methods, signals or properties
1085
1169
Usage:
1086
1170
1087
1171
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
1172
"org.freedesktop.DBus.Property."
1089
1173
"EmitsChangedSignal": "false"})
1091
1175
access="r")
1092
1176
def Property_dbus_property(self):
1093
1177
return dbus.Boolean(False)
1094
1178
1095
1179
See also the DBusObjectWithAnnotations class.
1096
1180
"""
1097
1181
1098
1182
def decorator(func):
1099
1183
func._dbus_annotations = annotations
1100
1184
return func
1101
1185
1102
1186
return decorator
1103
1187
1104
1188
1122
1206
1123
1207
class DBusObjectWithAnnotations(dbus.service.Object):
1124
1208
"""A D-Bus object with annotations.
1125
1209
1126
1210
Classes inheriting from this can use the dbus_annotations
1127
1211
decorator to add annotations to methods or signals.
1128
1212
"""
1129
1213
1130
1214
@staticmethod
1131
1215
def _is_dbus_thing(thing):
1132
1216
"""Returns a function testing if an attribute is a D-Bus thing
1133
1217
1134
1218
If called like _is_dbus_thing("method") it returns a function
1135
1219
suitable for use as predicate to inspect.getmembers().
1136
1220
"""
1137
1221
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1138
1222
False)
1139
1223
1140
1224
def _get_all_dbus_things(self, thing):
1141
1225
"""Returns a generator of (name, attribute) pairs
1142
1226
"""
1145
1229
for cls in self.__class__.__mro__
1146
1230
for name, athing in
1147
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1232
1149
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1234
out_signature="s",
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1153
1237
def Introspect(self, object_path, connection):
1154
1238
"""Overloading of standard D-Bus method.
1155
1239
1156
1240
Inserts annotation tags on methods and signals.
1157
1241
"""
1158
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
1243
connection)
1160
1244
try:
1161
1245
document = xml.dom.minidom.parseString(xmlstring)
1162
1246
1163
1247
for if_tag in document.getElementsByTagName("interface"):
1164
1248
# Add annotation tags
1165
1249
for typ in ("method", "signal"):
1192
1276
if_tag.appendChild(ann_tag)
1193
1277
# Fix argument name for the Introspect method itself
1194
1278
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1279
== dbus.INTROSPECTABLE_IFACE):
1196
1280
for cn in if_tag.getElementsByTagName("method"):
1197
1281
if cn.getAttribute("name") == "Introspect":
1198
1282
for arg in cn.getElementsByTagName("arg"):
1211
1295
1212
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
1297
"""A D-Bus object with properties.
1214
1298
1215
1299
Classes inheriting from this can use the dbus_service_property
1216
1300
decorator to expose methods as D-Bus properties. It exposes the
1217
1301
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
1302
"""
1219
1303
1220
1304
def _get_dbus_property(self, interface_name, property_name):
1221
1305
"""Returns a bound method if one exists which is a D-Bus
1222
1306
property with the specified name and interface.
1227
1311
if (value._dbus_name == property_name
1228
1312
and value._dbus_interface == interface_name):
1229
1313
return value.__get__(self)
1230
1314
1231
1315
# No such property
1232
1316
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
1317
self.dbus_object_path, interface_name, property_name))
1234
1318
1235
1319
@classmethod
1236
1320
def _get_all_interface_names(cls):
1237
1321
"""Get a sequence of all interfaces supported by an object"""
1240
1324
for x in (inspect.getmro(cls))
1241
1325
for attr in dir(x))
1242
1326
if name is not None)
1243
1327
1244
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
1329
in_signature="ss",
1246
1330
out_signature="v")
1254
1338
if not hasattr(value, "variant_level"):
1255
1339
return value
1256
1340
return type(value)(value, variant_level=value.variant_level+1)
1257
1341
1258
1342
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
1343
def Set(self, interface_name, property_name, value):
1260
1344
"""Standard D-Bus property Set() method, see D-Bus standard.
1272
1356
value = dbus.ByteArray(b''.join(chr(byte)
1273
1357
for byte in value))
1274
1358
prop(value)
1275
1359
1276
1360
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
1361
in_signature="s",
1278
1362
out_signature="a{sv}")
1279
1363
def GetAll(self, interface_name):
1280
1364
"""Standard D-Bus property GetAll() method, see D-Bus
1281
1365
standard.
1282
1366
1283
1367
Note: Will not include properties with access="write".
1284
1368
"""
1285
1369
properties = {}
1296
1380
properties[name] = value
1297
1381
continue
1298
1382
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1383
value, variant_level=value.variant_level + 1)
1300
1384
return dbus.Dictionary(properties, signature="sv")
1301
1385
1302
1386
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
1387
def PropertiesChanged(self, interface_name, changed_properties,
1304
1388
invalidated_properties):
1306
1390
standard.
1307
1391
"""
1308
1392
pass
1309
1393
1310
1394
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
1395
out_signature="s",
1312
1396
path_keyword='object_path',
1313
1397
connection_keyword='connection')
1314
1398
def Introspect(self, object_path, connection):
1315
1399
"""Overloading of standard D-Bus method.
1316
1400
1317
1401
Inserts property tags and interface annotation tags.
1318
1402
"""
1319
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1321
1405
connection)
1322
1406
try:
1323
1407
document = xml.dom.minidom.parseString(xmlstring)
1324
1408
1325
1409
def make_tag(document, name, prop):
1326
1410
e = document.createElement("property")
1327
1411
e.setAttribute("name", name)
1328
1412
e.setAttribute("type", prop._dbus_signature)
1329
1413
e.setAttribute("access", prop._dbus_access)
1330
1414
return e
1331
1415
1332
1416
for if_tag in document.getElementsByTagName("interface"):
1333
1417
# Add property tags
1334
1418
for tag in (make_tag(document, name, prop)
1376
1460
exc_info=error)
1377
1461
return xmlstring
1378
1462
1463
1379
1464
try:
1380
1465
dbus.OBJECT_MANAGER_IFACE
1381
1466
except AttributeError:
1382
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1468
1469
1384
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1471
"""A D-Bus object with an ObjectManager.
1386
1472
1387
1473
Classes inheriting from this exposes the standard
1388
1474
GetManagedObjects call and the InterfacesAdded and
1389
1475
InterfacesRemoved signals on the standard
1390
1476
"org.freedesktop.DBus.ObjectManager" interface.
1391
1477
1392
1478
Note: No signals are sent automatically; they must be sent
1393
1479
manually.
1394
1480
"""
1395
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1482
out_signature="a{oa{sa{sv}}}")
1397
1483
def GetManagedObjects(self):
1398
1484
"""This function must be overridden"""
1399
1485
raise NotImplementedError()
1400
1486
1401
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1488
signature="oa{sa{sv}}")
1403
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
1490
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1491
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1493
def InterfacesRemoved(self, object_path, interfaces):
1408
1494
pass
1409
1495
1410
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1497
out_signature="s",
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1414
1500
def Introspect(self, object_path, connection):
1415
1501
"""Overloading of standard D-Bus method.
1416
1502
1417
1503
Override return argument name of GetManagedObjects to be
1418
1504
"objpath_interfaces_and_properties"
1419
1505
"""
1422
1508
connection)
1423
1509
try:
1424
1510
document = xml.dom.minidom.parseString(xmlstring)
1425
1511
1426
1512
for if_tag in document.getElementsByTagName("interface"):
1427
1513
# Fix argument name for the GetManagedObjects method
1428
1514
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1515
== dbus.OBJECT_MANAGER_IFACE):
1430
1516
for cn in if_tag.getElementsByTagName("method"):
1431
1517
if (cn.getAttribute("name")
1432
1518
== "GetManagedObjects"):
1442
1528
except (AttributeError, xml.dom.DOMException,
1443
1529
xml.parsers.expat.ExpatError) as error:
1444
1530
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1531
exc_info=error)
1446
1532
return xmlstring
1447
1533
1534
1448
1535
def datetime_to_dbus(dt, variant_level=0):
1449
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1537
if dt is None:
1451
return dbus.String("", variant_level = variant_level)
1538
return dbus.String("", variant_level=variant_level)
1452
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1453
1540
1454
1541
1457
1544
dbus.service.Object, it will add alternate D-Bus attributes with
1458
1545
interface names according to the "alt_interface_names" mapping.
1459
1546
Usage:
1460
1547
1461
1548
@alternate_dbus_interfaces({"org.example.Interface":
1462
1549
"net.example.AlternateInterface"})
1463
1550
class SampleDBusObject(dbus.service.Object):
1464
1551
@dbus.service.method("org.example.Interface")
1465
1552
def SampleDBusMethod():
1466
1553
pass
1467
1554
1468
1555
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
1556
reachable via two interfaces: "org.example.Interface" and
1470
1557
"net.example.AlternateInterface", the latter of which will have
1471
1558
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
1559
"true", unless "deprecate" is passed with a False value.
1473
1560
1474
1561
This works for methods and signals, and also for D-Bus properties
1475
1562
(from DBusObjectWithProperties) and interfaces (from the
1476
1563
dbus_interface_annotations decorator).
1477
1564
"""
1478
1565
1479
1566
def wrapper(cls):
1480
1567
for orig_interface_name, alt_interface_name in (
1481
1568
alt_interface_names.items()):
1496
1583
interface_names.add(alt_interface)
1497
1584
# Is this a D-Bus signal?
1498
1585
if getattr(attribute, "_dbus_is_signal", False):
1586
# Extract the original non-method undecorated
1587
# function by black magic
1499
1588
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
1589
nonmethod_func = (dict(
1503
1590
zip(attribute.func_code.co_freevars,
1504
1591
attribute.__closure__))
1505
1592
["func"].cell_contents)
1506
1593
else:
1507
nonmethod_func = attribute
1594
nonmethod_func = (dict(
1595
zip(attribute.__code__.co_freevars,
1596
attribute.__closure__))
1597
["func"].cell_contents)
1508
1598
# Create a new, but exactly alike, function
1509
1599
# object, and decorate it to be a new D-Bus signal
1510
1600
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1601
new_function = copy_function(nonmethod_func)
1525
1602
new_function = (dbus.service.signal(
1526
1603
alt_interface,
1527
1604
attribute._dbus_signature)(new_function))
1531
1608
attribute._dbus_annotations)
1532
1609
except AttributeError:
1533
1610
pass
1611
1534
1612
# Define a creator of a function to call both the
1535
1613
# original and alternate functions, so both the
1536
1614
# original and alternate signals gets sent when
1539
1617
"""This function is a scope container to pass
1540
1618
func1 and func2 to the "call_both" function
1541
1619
outside of its arguments"""
1542
1620
1543
1621
@functools.wraps(func2)
1544
1622
def call_both(*args, **kwargs):
1545
1623
"""This function will emit two D-Bus
1546
1624
signals by calling func1 and func2"""
1547
1625
func1(*args, **kwargs)
1548
1626
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1627
# Make wrapper function look like a D-Bus
1628
# signal
1550
1629
for name, attr in inspect.getmembers(func2):
1551
1630
if name.startswith("_dbus_"):
1552
1631
setattr(call_both, name, attr)
1553
1632
1554
1633
return call_both
1555
1634
# Create the "call_both" function and add it to
1556
1635
# the class
1566
1645
alt_interface,
1567
1646
attribute._dbus_in_signature,
1568
1647
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1648
(copy_function(attribute)))
1574
1649
# Copy annotations, if any
1575
1650
try:
1576
1651
attr[attrname]._dbus_annotations = dict(
1588
1663
attribute._dbus_access,
1589
1664
attribute._dbus_get_args_options
1590
1665
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1666
(copy_function(attribute)))
1597
1667
# Copy annotations, if any
1598
1668
try:
1599
1669
attr[attrname]._dbus_annotations = dict(
1608
1678
# to the class.
1609
1679
attr[attrname] = (
1610
1680
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1681
(copy_function(attribute)))
1616
1682
if deprecate:
1617
1683
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1684
iname = "_AlternateDBusNames_interface_annotation{}"
1619
1685
for interface_name in interface_names:
1620
1686
1621
1687
@dbus_interface_annotations(interface_name)
1622
1688
def func(self):
1623
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1689
return {"org.freedesktop.DBus.Deprecated":
1690
"true"}
1625
1691
# Find an unused name
1626
1692
for aname in (iname.format(i)
1627
1693
for i in itertools.count()):
1631
1697
if interface_names:
1632
1698
# Replace the class with a new subclass of it with
1633
1699
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1700
if sys.version_info.major == 2:
1701
cls = type(b"{}Alternate".format(cls.__name__),
1702
(cls, ), attr)
1703
else:
1704
cls = type("{}Alternate".format(cls.__name__),
1705
(cls, ), attr)
1636
1706
return cls
1637
1707
1638
1708
return wrapper
1639
1709
1640
1710
1642
1712
"se.bsnet.fukt.Mandos"})
1643
1713
class ClientDBus(Client, DBusObjectWithProperties):
1644
1714
"""A Client class using D-Bus
1645
1715
1646
1716
Attributes:
1647
1717
dbus_object_path: dbus.ObjectPath
1648
1718
bus: dbus.SystemBus()
1649
1719
"""
1650
1720
1651
1721
runtime_expansions = (Client.runtime_expansions
1652
1722
+ ("dbus_object_path", ))
1653
1723
1654
1724
_interface = "se.recompile.Mandos.Client"
1655
1725
1656
1726
# dbus.service.Object doesn't use super(), so we can't either.
1657
1658
def __init__(self, bus = None, *args, **kwargs):
1727
1728
def __init__(self, bus=None, *args, **kwargs):
1659
1729
self.bus = bus
1660
1730
Client.__init__(self, *args, **kwargs)
1661
1731
# Only now, when this client is initialized, can it show up on
1667
1737
"/clients/" + client_object_name)
1668
1738
DBusObjectWithProperties.__init__(self, self.bus,
1669
1739
self.dbus_object_path)
1670
1740
1671
1741
def notifychangeproperty(transform_func, dbus_name,
1672
1742
type_func=lambda x: x,
1673
1743
variant_level=1,
1675
1745
_interface=_interface):
1676
1746
""" Modify a variable so that it's a property which announces
1677
1747
its changes to DBus.
1678
1748
1679
1749
transform_fun: Function that takes a value and a variant_level
1680
1750
and transforms it to a D-Bus type.
1681
1751
dbus_name: D-Bus name of the variable
1684
1754
variant_level: D-Bus variant level. Default: 1
1685
1755
"""
1686
1756
attrname = "_{}".format(dbus_name)
1687
1757
1688
1758
def setter(self, value):
1689
1759
if hasattr(self, "dbus_object_path"):
1690
1760
if (not hasattr(self, attrname) or
1697
1767
else:
1698
1768
dbus_value = transform_func(
1699
1769
type_func(value),
1700
variant_level = variant_level)
1770
variant_level=variant_level)
1701
1771
self.PropertyChanged(dbus.String(dbus_name),
1702
1772
dbus_value)
1703
1773
self.PropertiesChanged(
1704
1774
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1775
dbus.Dictionary({dbus.String(dbus_name):
1776
dbus_value}),
1707
1777
dbus.Array())
1708
1778
setattr(self, attrname, value)
1709
1779
1710
1780
return property(lambda self: getattr(self, attrname), setter)
1711
1781
1712
1782
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
1783
approvals_pending = notifychangeproperty(dbus.Boolean,
1714
1784
"ApprovalPending",
1715
type_func = bool)
1785
type_func=bool)
1716
1786
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1787
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1788
"LastEnabled")
1719
1789
checker = notifychangeproperty(
1720
1790
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1791
type_func=lambda checker: checker is not None)
1722
1792
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1793
"LastCheckedOK")
1724
1794
last_checker_status = notifychangeproperty(dbus.Int16,
1729
1799
"ApprovedByDefault")
1730
1800
approval_delay = notifychangeproperty(
1731
1801
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1802
type_func=lambda td: td.total_seconds() * 1000)
1733
1803
approval_duration = notifychangeproperty(
1734
1804
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1805
type_func=lambda td: td.total_seconds() * 1000)
1736
1806
host = notifychangeproperty(dbus.String, "Host")
1737
1807
timeout = notifychangeproperty(
1738
1808
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1809
type_func=lambda td: td.total_seconds() * 1000)
1740
1810
extended_timeout = notifychangeproperty(
1741
1811
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1812
type_func=lambda td: td.total_seconds() * 1000)
1743
1813
interval = notifychangeproperty(
1744
1814
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1815
type_func=lambda td: td.total_seconds() * 1000)
1746
1816
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
1817
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
1818
invalidate_only=True)
1749
1819
1750
1820
del notifychangeproperty
1751
1821
1752
1822
def __del__(self, *args, **kwargs):
1753
1823
try:
1754
1824
self.remove_from_connection()
1757
1827
if hasattr(DBusObjectWithProperties, "__del__"):
1758
1828
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1829
Client.__del__(self, *args, **kwargs)
1760
1830
1761
1831
def checker_callback(self, source, condition,
1762
1832
connection, command, *args, **kwargs):
1763
1833
ret = Client.checker_callback(self, source, condition,
1779
1849
| self.last_checker_signal),
1780
1850
dbus.String(command))
1781
1851
return ret
1782
1852
1783
1853
def start_checker(self, *args, **kwargs):
1784
1854
old_checker_pid = getattr(self.checker, "pid", None)
1785
1855
r = Client.start_checker(self, *args, **kwargs)
1789
1859
# Emit D-Bus signal
1790
1860
self.CheckerStarted(self.current_checker_command)
1791
1861
return r
1792
1862
1793
1863
def _reset_approved(self):
1794
1864
self.approved = None
1795
1865
return False
1796
1866
1797
1867
def approve(self, value=True):
1798
1868
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
1801
1871
self.send_changedstate()
1802
1803
## D-Bus methods, signals & properties
1804
1805
## Interfaces
1806
1807
## Signals
1808
1872
1873
# D-Bus methods, signals & properties
1874
1875
# Interfaces
1876
1877
# Signals
1878
1809
1879
# CheckerCompleted - signal
1810
1880
@dbus.service.signal(_interface, signature="nxs")
1811
1881
def CheckerCompleted(self, exitcode, waitstatus, command):
1812
1882
"D-Bus signal"
1813
1883
pass
1814
1884
1815
1885
# CheckerStarted - signal
1816
1886
@dbus.service.signal(_interface, signature="s")
1817
1887
def CheckerStarted(self, command):
1818
1888
"D-Bus signal"
1819
1889
pass
1820
1890
1821
1891
# PropertyChanged - signal
1822
1892
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
1893
@dbus.service.signal(_interface, signature="sv")
1824
1894
def PropertyChanged(self, property, value):
1825
1895
"D-Bus signal"
1826
1896
pass
1827
1897
1828
1898
# GotSecret - signal
1829
1899
@dbus.service.signal(_interface)
1830
1900
def GotSecret(self):
1833
1903
server to mandos-client
1834
1904
"""
1835
1905
pass
1836
1906
1837
1907
# Rejected - signal
1838
1908
@dbus.service.signal(_interface, signature="s")
1839
1909
def Rejected(self, reason):
1840
1910
"D-Bus signal"
1841
1911
pass
1842
1912
1843
1913
# NeedApproval - signal
1844
1914
@dbus.service.signal(_interface, signature="tb")
1845
1915
def NeedApproval(self, timeout, default):
1846
1916
"D-Bus signal"
1847
1917
return self.need_approval()
1848
1849
## Methods
1850
1918
1919
# Methods
1920
1851
1921
# Approve - method
1852
1922
@dbus.service.method(_interface, in_signature="b")
1853
1923
def Approve(self, value):
1854
1924
self.approve(value)
1855
1925
1856
1926
# CheckedOK - method
1857
1927
@dbus.service.method(_interface)
1858
1928
def CheckedOK(self):
1859
1929
self.checked_ok()
1860
1930
1861
1931
# Enable - method
1862
1932
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
1933
@dbus.service.method(_interface)
1864
1934
def Enable(self):
1865
1935
"D-Bus method"
1866
1936
self.enable()
1867
1937
1868
1938
# StartChecker - method
1869
1939
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
1940
@dbus.service.method(_interface)
1871
1941
def StartChecker(self):
1872
1942
"D-Bus method"
1873
1943
self.start_checker()
1874
1944
1875
1945
# Disable - method
1876
1946
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
1947
@dbus.service.method(_interface)
1878
1948
def Disable(self):
1879
1949
"D-Bus method"
1880
1950
self.disable()
1881
1951
1882
1952
# StopChecker - method
1883
1953
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
1954
@dbus.service.method(_interface)
1885
1955
def StopChecker(self):
1886
1956
self.stop_checker()
1887
1888
## Properties
1889
1957
1958
# Properties
1959
1890
1960
# ApprovalPending - property
1891
1961
@dbus_service_property(_interface, signature="b", access="read")
1892
1962
def ApprovalPending_dbus_property(self):
1893
1963
return dbus.Boolean(bool(self.approvals_pending))
1894
1964
1895
1965
# ApprovedByDefault - property
1896
1966
@dbus_service_property(_interface,
1897
1967
signature="b",
1900
1970
if value is None: # get
1901
1971
return dbus.Boolean(self.approved_by_default)
1902
1972
self.approved_by_default = bool(value)
1903
1973
1904
1974
# ApprovalDelay - property
1905
1975
@dbus_service_property(_interface,
1906
1976
signature="t",
1910
1980
return dbus.UInt64(self.approval_delay.total_seconds()
1911
1981
* 1000)
1912
1982
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
1983
1914
1984
# ApprovalDuration - property
1915
1985
@dbus_service_property(_interface,
1916
1986
signature="t",
1920
1990
return dbus.UInt64(self.approval_duration.total_seconds()
1921
1991
* 1000)
1922
1992
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
1993
1924
1994
# Name - property
1925
1995
@dbus_annotations(
1926
1996
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
1997
@dbus_service_property(_interface, signature="s", access="read")
1928
1998
def Name_dbus_property(self):
1929
1999
return dbus.String(self.name)
1930
2000
1931
2001
# Fingerprint - property
1932
2002
@dbus_annotations(
1933
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
2004
@dbus_service_property(_interface, signature="s", access="read")
1935
2005
def Fingerprint_dbus_property(self):
1936
2006
return dbus.String(self.fingerprint)
1937
2007
1938
2008
# Host - property
1939
2009
@dbus_service_property(_interface,
1940
2010
signature="s",
1943
2013
if value is None: # get
1944
2014
return dbus.String(self.host)
1945
2015
self.host = str(value)
1946
2016
1947
2017
# Created - property
1948
2018
@dbus_annotations(
1949
2019
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
2020
@dbus_service_property(_interface, signature="s", access="read")
1951
2021
def Created_dbus_property(self):
1952
2022
return datetime_to_dbus(self.created)
1953
2023
1954
2024
# LastEnabled - property
1955
2025
@dbus_service_property(_interface, signature="s", access="read")
1956
2026
def LastEnabled_dbus_property(self):
1957
2027
return datetime_to_dbus(self.last_enabled)
1958
2028
1959
2029
# Enabled - property
1960
2030
@dbus_service_property(_interface,
1961
2031
signature="b",
1967
2037
self.enable()
1968
2038
else:
1969
2039
self.disable()
1970
2040
1971
2041
# LastCheckedOK - property
1972
2042
@dbus_service_property(_interface,
1973
2043
signature="s",
1977
2047
self.checked_ok()
1978
2048
return
1979
2049
return datetime_to_dbus(self.last_checked_ok)
1980
2050
1981
2051
# LastCheckerStatus - property
1982
2052
@dbus_service_property(_interface, signature="n", access="read")
1983
2053
def LastCheckerStatus_dbus_property(self):
1984
2054
return dbus.Int16(self.last_checker_status)
1985
2055
1986
2056
# Expires - property
1987
2057
@dbus_service_property(_interface, signature="s", access="read")
1988
2058
def Expires_dbus_property(self):
1989
2059
return datetime_to_dbus(self.expires)
1990
2060
1991
2061
# LastApprovalRequest - property
1992
2062
@dbus_service_property(_interface, signature="s", access="read")
1993
2063
def LastApprovalRequest_dbus_property(self):
1994
2064
return datetime_to_dbus(self.last_approval_request)
1995
2065
1996
2066
# Timeout - property
1997
2067
@dbus_service_property(_interface,
1998
2068
signature="t",
2013
2083
if (getattr(self, "disable_initiator_tag", None)
2014
2084
is None):
2015
2085
return
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2086
GLib.source_remove(self.disable_initiator_tag)
2087
self.disable_initiator_tag = GLib.timeout_add(
2018
2088
int((self.expires - now).total_seconds() * 1000),
2019
2089
self.disable)
2020
2090
2021
2091
# ExtendedTimeout - property
2022
2092
@dbus_service_property(_interface,
2023
2093
signature="t",
2027
2097
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
2098
* 1000)
2029
2099
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
2100
2031
2101
# Interval - property
2032
2102
@dbus_service_property(_interface,
2033
2103
signature="t",
2040
2110
return
2041
2111
if self.enabled:
2042
2112
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2113
GLib.source_remove(self.checker_initiator_tag)
2114
self.checker_initiator_tag = GLib.timeout_add(
2045
2115
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2047
2116
self.start_checker() # Start one now, too
2117
2048
2118
# Checker - property
2049
2119
@dbus_service_property(_interface,
2050
2120
signature="s",
2053
2123
if value is None: # get
2054
2124
return dbus.String(self.checker_command)
2055
2125
self.checker_command = str(value)
2056
2126
2057
2127
# CheckerRunning - property
2058
2128
@dbus_service_property(_interface,
2059
2129
signature="b",
2065
2135
self.start_checker()
2066
2136
else:
2067
2137
self.stop_checker()
2068
2138
2069
2139
# ObjectPath - property
2070
2140
@dbus_annotations(
2071
2141
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
2142
"org.freedesktop.DBus.Deprecated": "true"})
2073
2143
@dbus_service_property(_interface, signature="o", access="read")
2074
2144
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2076
2145
return self.dbus_object_path # is already a dbus.ObjectPath
2146
2077
2147
# Secret = property
2078
2148
@dbus_annotations(
2079
2149
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2084
2154
byte_arrays=True)
2085
2155
def Secret_dbus_property(self, value):
2086
2156
self.secret = bytes(value)
2087
2157
2088
2158
del _interface
2089
2159
2090
2160
2094
2164
self._pipe.send(('init', fpr, address))
2095
2165
if not self._pipe.recv():
2096
2166
raise KeyError(fpr)
2097
2167
2098
2168
def __getattribute__(self, name):
2099
2169
if name == '_pipe':
2100
2170
return super(ProxyClient, self).__getattribute__(name)
2103
2173
if data[0] == 'data':
2104
2174
return data[1]
2105
2175
if data[0] == 'function':
2106
2176
2107
2177
def func(*args, **kwargs):
2108
2178
self._pipe.send(('funcall', name, args, kwargs))
2109
2179
return self._pipe.recv()[1]
2110
2180
2111
2181
return func
2112
2182
2113
2183
def __setattr__(self, name, value):
2114
2184
if name == '_pipe':
2115
2185
return super(ProxyClient, self).__setattr__(name, value)
2118
2188
2119
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2190
"""A class to handle client connections.
2121
2191
2122
2192
Instantiated once for each connection to handle it.
2123
2193
Note: This will run in its own forked process."""
2124
2194
2125
2195
def handle(self):
2126
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
2197
logger.info("TCP connection from: %s",
2128
2198
str(self.client_address))
2129
2199
logger.debug("Pipe FD: %d",
2130
2200
self.server.child_pipe.fileno())
2131
2201
2132
2202
session = gnutls.ClientSession(self.request)
2133
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2137
# "+DHE-DSS"))
2203
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2207
# "+DHE-DSS"))
2138
2208
# Use a fallback default, since this MUST be set.
2139
2209
priority = self.server.gnutls_priority
2140
2210
if priority is None:
2141
2211
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
2143
2214
None)
2144
2215
2145
2216
# Start communication using the Mandos protocol
2146
2217
# Get protocol number
2147
2218
line = self.request.makefile().readline()
2152
2223
except (ValueError, IndexError, RuntimeError) as error:
2153
2224
logger.error("Unknown protocol version: %s", error)
2154
2225
return
2155
2226
2156
2227
# Start GnuTLS connection
2157
2228
try:
2158
2229
session.handshake()
2162
2233
# established. Just abandon the request.
2163
2234
return
2164
2235
logger.debug("Handshake succeeded")
2165
2236
2166
2237
approval_required = False
2167
2238
try:
2168
2239
try:
2172
2243
logger.warning("Bad certificate: %s", error)
2173
2244
return
2174
2245
logger.debug("Fingerprint: %s", fpr)
2175
2246
2176
2247
try:
2177
2248
client = ProxyClient(child_pipe, fpr,
2178
2249
self.client_address)
2179
2250
except KeyError:
2180
2251
return
2181
2252
2182
2253
if client.approval_delay:
2183
2254
delay = client.approval_delay
2184
2255
client.approvals_pending += 1
2185
2256
approval_required = True
2186
2257
2187
2258
while True:
2188
2259
if not client.enabled:
2189
2260
logger.info("Client %s is disabled",
2192
2263
# Emit D-Bus signal
2193
2264
client.Rejected("Disabled")
2194
2265
return
2195
2266
2196
2267
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2268
# We are approved or approval is disabled
2198
2269
break
2199
2270
elif client.approved is None:
2200
2271
logger.info("Client %s needs approval",
2211
2282
# Emit D-Bus signal
2212
2283
client.Rejected("Denied")
2213
2284
return
2214
2215
#wait until timeout or approved
2285
2286
# wait until timeout or approved
2216
2287
time = datetime.datetime.now()
2217
2288
client.changedstate.acquire()
2218
2289
client.changedstate.wait(delay.total_seconds())
2231
2302
break
2232
2303
else:
2233
2304
delay -= time2 - time
2234
2305
2235
2306
try:
2236
2307
session.send(client.secret)
2237
2308
except gnutls.Error as error:
2238
2309
logger.warning("gnutls send failed",
2239
exc_info = error)
2310
exc_info=error)
2240
2311
return
2241
2312
2242
2313
logger.info("Sending secret to %s", client.name)
2243
2314
# bump the timeout using extended_timeout
2244
2315
client.bump_timeout(client.extended_timeout)
2245
2316
if self.server.use_dbus:
2246
2317
# Emit D-Bus signal
2247
2318
client.GotSecret()
2248
2319
2249
2320
finally:
2250
2321
if approval_required:
2251
2322
client.approvals_pending -= 1
2254
2325
except gnutls.Error as error:
2255
2326
logger.warning("GnuTLS bye failed",
2256
2327
exc_info=error)
2257
2328
2258
2329
@staticmethod
2259
2330
def peer_certificate(session):
2260
2331
"Return the peer's OpenPGP certificate as a bytestring"
2272
2343
return None
2273
2344
cert = cert_list[0]
2274
2345
return ctypes.string_at(cert.data, cert.size)
2275
2346
2276
2347
@staticmethod
2277
2348
def fingerprint(openpgp):
2278
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2311
2382
2312
2383
class MultiprocessingMixIn(object):
2313
2384
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2385
2315
2386
def sub_process_main(self, request, address):
2316
2387
try:
2317
2388
self.finish_request(request, address)
2318
2389
except Exception:
2319
2390
self.handle_error(request, address)
2320
2391
self.close_request(request)
2321
2392
2322
2393
def process_request(self, request, address):
2323
2394
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
2326
2397
proc.start()
2327
2398
return proc
2328
2399
2329
2400
2330
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2331
2402
""" adds a pipe to the MixIn """
2332
2403
2333
2404
def process_request(self, request, client_address):
2334
2405
"""Overrides and wraps the original process_request().
2335
2406
2336
2407
This function creates a new pipe in self.pipe
2337
2408
"""
2338
2409
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2339
2410
2340
2411
proc = MultiprocessingMixIn.process_request(self, request,
2341
2412
client_address)
2342
2413
self.child_pipe.close()
2343
2414
self.add_pipe(parent_pipe, proc)
2344
2415
2345
2416
def add_pipe(self, parent_pipe, proc):
2346
2417
"""Dummy function; override as necessary"""
2347
2418
raise NotImplementedError()
2350
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
2422
socketserver.TCPServer, object):
2352
2423
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2353
2424
2354
2425
Attributes:
2355
2426
enabled: Boolean; whether this server is activated yet
2356
2427
interface: None or a network interface name (string)
2357
2428
use_ipv6: Boolean; to use IPv6 or not
2358
2429
"""
2359
2430
2360
2431
def __init__(self, server_address, RequestHandlerClass,
2361
2432
interface=None,
2362
2433
use_ipv6=True,
2372
2443
self.socketfd = socketfd
2373
2444
# Save the original socket.socket() function
2374
2445
self.socket_socket = socket.socket
2446
2375
2447
# To implement --socket, we monkey patch socket.socket.
2376
#
2448
#
2377
2449
# (When socketserver.TCPServer is a new-style class, we
2378
2450
# could make self.socket into a property instead of monkey
2379
2451
# patching socket.socket.)
2380
#
2452
#
2381
2453
# Create a one-time-only replacement for socket.socket()
2382
2454
@functools.wraps(socket.socket)
2383
2455
def socket_wrapper(*args, **kwargs):
2395
2467
# socket_wrapper(), if socketfd was set.
2396
2468
socketserver.TCPServer.__init__(self, server_address,
2397
2469
RequestHandlerClass)
2398
2470
2399
2471
def server_bind(self):
2400
2472
"""This overrides the normal server_bind() function
2401
2473
to bind to an interface if one was specified, and also NOT to
2402
2474
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2403
2476
if self.interface is not None:
2404
2477
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2407
self.interface)
2408
else:
2409
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2420
self.interface)
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2424
else:
2425
raise
2478
# Fall back to a hard-coded value which seems to be
2479
# common enough.
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2482
try:
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2493
self.interface)
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2497
else:
2498
raise
2426
2499
# Only bind(2) the socket if we really need to.
2427
2500
if self.server_address[0] or self.server_address[1]:
2428
2501
if not self.server_address[0]:
2429
2502
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2503
any_address = "::" # in6addr_any
2431
2504
else:
2432
any_address = "0.0.0.0" # INADDR_ANY
2505
any_address = "0.0.0.0" # INADDR_ANY
2433
2506
self.server_address = (any_address,
2434
2507
self.server_address[1])
2435
2508
elif not self.server_address[1]:
2445
2518
2446
2519
class MandosServer(IPv6_TCPServer):
2447
2520
"""Mandos server.
2448
2521
2449
2522
Attributes:
2450
2523
clients: set of Client objects
2451
2524
gnutls_priority GnuTLS priority string
2452
2525
use_dbus: Boolean; to emit D-Bus signals or not
2453
2454
Assumes a gobject.MainLoop event loop.
2526
2527
Assumes a GLib.MainLoop event loop.
2455
2528
"""
2456
2529
2457
2530
def __init__(self, server_address, RequestHandlerClass,
2458
2531
interface=None,
2459
2532
use_ipv6=True,
2469
2542
self.gnutls_priority = gnutls_priority
2470
2543
IPv6_TCPServer.__init__(self, server_address,
2471
2544
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2475
2545
interface=interface,
2546
use_ipv6=use_ipv6,
2547
socketfd=socketfd)
2548
2476
2549
def server_activate(self):
2477
2550
if self.enabled:
2478
2551
return socketserver.TCPServer.server_activate(self)
2479
2552
2480
2553
def enable(self):
2481
2554
self.enabled = True
2482
2555
2483
2556
def add_pipe(self, parent_pipe, proc):
2484
2557
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2558
GLib.io_add_watch(
2486
2559
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2560
GLib.IO_IN | GLib.IO_HUP,
2488
2561
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2491
2562
parent_pipe=parent_pipe,
2563
proc=proc))
2564
2492
2565
def handle_ipc(self, source, condition,
2493
2566
parent_pipe=None,
2494
proc = None,
2567
proc=None,
2495
2568
client_object=None):
2496
2569
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2570
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2571
# Wait for other process to exit
2499
2572
proc.join()
2500
2573
return False
2501
2574
2502
2575
# Read a request from the child
2503
2576
request = parent_pipe.recv()
2504
2577
command = request[0]
2505
2578
2506
2579
if command == 'init':
2507
2580
fpr = request[1]
2508
2581
address = request[2]
2509
2510
for c in self.clients.itervalues():
2582
2583
for c in self.clients.values():
2511
2584
if c.fingerprint == fpr:
2512
2585
client = c
2513
2586
break
2520
2593
address[0])
2521
2594
parent_pipe.send(False)
2522
2595
return False
2523
2524
gobject.io_add_watch(
2596
2597
GLib.io_add_watch(
2525
2598
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2599
GLib.IO_IN | GLib.IO_HUP,
2527
2600
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2601
parent_pipe=parent_pipe,
2602
proc=proc,
2603
client_object=client))
2531
2604
parent_pipe.send(True)
2532
2605
# remove the old hook in favor of the new above hook on
2533
2606
# same fileno
2536
2609
funcname = request[1]
2537
2610
args = request[2]
2538
2611
kwargs = request[3]
2539
2612
2540
2613
parent_pipe.send(('data', getattr(client_object,
2541
2614
funcname)(*args,
2542
2615
**kwargs)))
2543
2616
2544
2617
if command == 'getattr':
2545
2618
attrname = request[1]
2546
2619
if isinstance(client_object.__getattribute__(attrname),
2549
2622
else:
2550
2623
parent_pipe.send((
2551
2624
'data', client_object.__getattribute__(attrname)))
2552
2625
2553
2626
if command == 'setattr':
2554
2627
attrname = request[1]
2555
2628
value = request[2]
2556
2629
setattr(client_object, attrname, value)
2557
2630
2558
2631
return True
2559
2632
2560
2633
2561
2634
def rfc3339_duration_to_delta(duration):
2562
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2563
2636
2564
2637
>>> rfc3339_duration_to_delta("P7D")
2565
2638
datetime.timedelta(7)
2566
2639
>>> rfc3339_duration_to_delta("PT60S")
2576
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
2650
datetime.timedelta(1, 200)
2578
2651
"""
2579
2652
2580
2653
# Parsing an RFC 3339 duration with regular expressions is not
2581
2654
# possible - there would have to be multiple places for the same
2582
2655
# values, like seconds. The current code, while more esoteric, is
2583
2656
# cleaner without depending on a parsing library. If Python had a
2584
2657
# built-in library for parsing we would use it, but we'd like to
2585
2658
# avoid excessive use of external libraries.
2586
2659
2587
2660
# New type for defining tokens, syntax, and semantics all-in-one
2588
2661
Token = collections.namedtuple("Token", (
2589
2662
"regexp", # To match token; if "value" is not None, must have
2622
2695
frozenset((token_year, token_month,
2623
2696
token_day, token_time,
2624
2697
token_week)))
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2698
# Define starting values:
2699
# Value so far
2700
value = datetime.timedelta()
2627
2701
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2702
# Following valid tokens
2703
followers = frozenset((token_duration, ))
2704
# String left to parse
2705
s = duration
2630
2706
# Loop until end token is found
2631
2707
while found_token is not token_end:
2632
2708
# Search for any currently valid tokens
2656
2732
2657
2733
def string_to_delta(interval):
2658
2734
"""Parse a string and return a datetime.timedelta
2659
2735
2660
2736
>>> string_to_delta('7d')
2661
2737
datetime.timedelta(7)
2662
2738
>>> string_to_delta('60s')
2670
2746
>>> string_to_delta('5m 30s')
2671
2747
datetime.timedelta(0, 330)
2672
2748
"""
2673
2749
2674
2750
try:
2675
2751
return rfc3339_duration_to_delta(interval)
2676
2752
except ValueError:
2677
2753
pass
2678
2754
2679
2755
timevalue = datetime.timedelta(0)
2680
2756
for s in interval.split():
2681
2757
try:
2699
2775
return timevalue
2700
2776
2701
2777
2702
def daemon(nochdir = False, noclose = False):
2778
def daemon(nochdir=False, noclose=False):
2703
2779
"""See daemon(3). Standard BSD Unix function.
2704
2780
2705
2781
This should really exist as os.daemon, but it doesn't (yet)."""
2706
2782
if os.fork():
2707
2783
sys.exit()
2725
2801
2726
2802
2727
2803
def main():
2728
2804
2729
2805
##################################################################
2730
2806
# Parsing of options, both command line and config file
2731
2807
2732
2808
parser = argparse.ArgumentParser()
2733
2809
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2810
version="%(prog)s {}".format(version),
2735
2811
help="show version number and exit")
2736
2812
parser.add_argument("-i", "--interface", metavar="IF",
2737
2813
help="Bind to interface IF")
2773
2849
parser.add_argument("--no-zeroconf", action="store_false",
2774
2850
dest="zeroconf", help="Do not use Zeroconf",
2775
2851
default=None)
2776
2852
2777
2853
options = parser.parse_args()
2778
2854
2779
2855
if options.check:
2780
2856
import doctest
2781
2857
fail_count, test_count = doctest.testmod()
2782
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2783
2859
2784
2860
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2786
"address": "",
2787
"port": "",
2788
"debug": "False",
2789
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2793
"use_dbus": "True",
2794
"use_ipv6": "True",
2795
"debuglevel": "",
2796
"restore": "True",
2797
"socket": "",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2802
2861
server_defaults = {"interface": "",
2862
"address": "",
2863
"port": "",
2864
"debug": "False",
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2869
"use_dbus": "True",
2870
"use_ipv6": "True",
2871
"debuglevel": "",
2872
"restore": "True",
2873
"socket": "",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
2876
"zeroconf": "True",
2877
}
2878
2803
2879
# Parse config file for server-global settings
2804
2880
server_config = configparser.SafeConfigParser(server_defaults)
2805
2881
del server_defaults
2823
2899
server_settings["socket"] = os.dup(server_settings
2824
2900
["socket"])
2825
2901
del server_config
2826
2902
2827
2903
# Override the settings from the config file with command line
2828
2904
# options, if set.
2829
2905
for option in ("interface", "address", "port", "debug",
2847
2923
if server_settings["debug"]:
2848
2924
server_settings["foreground"] = True
2849
2925
# Now we have our good server settings in "server_settings"
2850
2926
2851
2927
##################################################################
2852
2928
2853
2929
if (not server_settings["zeroconf"]
2854
2930
and not (server_settings["port"]
2855
2931
or server_settings["socket"] != "")):
2856
2932
parser.error("Needs port or socket to work without Zeroconf")
2857
2933
2858
2934
# For convenience
2859
2935
debug = server_settings["debug"]
2860
2936
debuglevel = server_settings["debuglevel"]
2864
2940
stored_state_file)
2865
2941
foreground = server_settings["foreground"]
2866
2942
zeroconf = server_settings["zeroconf"]
2867
2943
2868
2944
if debug:
2869
2945
initlogger(debug, logging.DEBUG)
2870
2946
else:
2873
2949
else:
2874
2950
level = getattr(logging, debuglevel.upper())
2875
2951
initlogger(debug, level)
2876
2952
2877
2953
if server_settings["servicename"] != "Mandos":
2878
2954
syslogger.setFormatter(
2879
2955
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
2956
' %(levelname)s: %(message)s'.format(
2881
2957
server_settings["servicename"])))
2882
2958
2883
2959
# Parse config file with clients
2884
2960
client_config = configparser.SafeConfigParser(Client
2885
2961
.client_defaults)
2886
2962
client_config.read(os.path.join(server_settings["configdir"],
2887
2963
"clients.conf"))
2888
2964
2889
2965
global mandos_dbus_service
2890
2966
mandos_dbus_service = None
2891
2967
2892
2968
socketfd = None
2893
2969
if server_settings["socket"] != "":
2894
2970
socketfd = server_settings["socket"]
2910
2986
except IOError as e:
2911
2987
logger.error("Could not open file %r", pidfilename,
2912
2988
exc_info=e)
2913
2914
for name in ("_mandos", "mandos", "nobody"):
2989
2990
for name, group in (("_mandos", "_mandos"),
2991
("mandos", "mandos"),
2992
("nobody", "nogroup")):
2915
2993
try:
2916
2994
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
2995
gid = pwd.getpwnam(group).pw_gid
2918
2996
break
2919
2997
except KeyError:
2920
2998
continue
2924
3002
try:
2925
3003
os.setgid(gid)
2926
3004
os.setuid(uid)
3005
if debug:
3006
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3007
gid))
2927
3008
except OSError as error:
3009
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
.format(uid, gid, os.strerror(error.errno)))
2928
3011
if error.errno != errno.EPERM:
2929
3012
raise
2930
3013
2931
3014
if debug:
2932
3015
# Enable all possible GnuTLS debugging
2933
3016
2934
3017
# "Use a log level over 10 to enable all debugging options."
2935
3018
# - GnuTLS manual
2936
3019
gnutls.global_set_log_level(11)
2937
3020
2938
3021
@gnutls.log_func
2939
3022
def debug_gnutls(level, string):
2940
3023
logger.debug("GnuTLS: %s", string[:-1])
2941
3024
2942
3025
gnutls.global_set_log_function(debug_gnutls)
2943
3026
2944
3027
# Redirect stdin so all checkers get /dev/null
2945
3028
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
3029
os.dup2(null, sys.stdin.fileno())
2947
3030
if null > 2:
2948
3031
os.close(null)
2949
3032
2950
3033
# Need to fork before connecting to D-Bus
2951
3034
if not foreground:
2952
3035
# Close all input and output, do double fork, etc.
2953
3036
daemon()
2954
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2958
3037
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
3040
GLib.threads_init()
3041
2959
3042
global main_loop
2960
3043
# From the Avahi example code
2961
3044
DBusGMainLoop(set_as_default=True)
2962
main_loop = gobject.MainLoop()
3045
main_loop = GLib.MainLoop()
2963
3046
bus = dbus.SystemBus()
2964
3047
# End of Avahi example code
2965
3048
if use_dbus:
2978
3061
if zeroconf:
2979
3062
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3063
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
3064
name=server_settings["servicename"],
3065
servicetype="_mandos._tcp",
3066
protocol=protocol,
3067
bus=bus)
2985
3068
if server_settings["interface"]:
2986
3069
service.interface = if_nametoindex(
2987
3070
server_settings["interface"].encode("utf-8"))
2988
3071
2989
3072
global multiprocessing_manager
2990
3073
multiprocessing_manager = multiprocessing.Manager()
2991
3074
2992
3075
client_class = Client
2993
3076
if use_dbus:
2994
client_class = functools.partial(ClientDBus, bus = bus)
2995
3077
client_class = functools.partial(ClientDBus, bus=bus)
3078
2996
3079
client_settings = Client.config_parser(client_config)
2997
3080
old_client_settings = {}
2998
3081
clients_data = {}
2999
3082
3000
3083
# This is used to redirect stdout and stderr for checker processes
3001
3084
global wnull
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3085
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3086
# Only used if server is running in foreground but not in debug
3004
3087
# mode
3005
3088
if debug or not foreground:
3006
3089
wnull.close()
3007
3090
3008
3091
# Get client data and settings from last running state.
3009
3092
if server_settings["restore"]:
3010
3093
try:
3011
3094
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
3095
if sys.version_info.major == 2:
3096
clients_data, old_client_settings = pickle.load(
3097
stored_state)
3098
else:
3099
bytes_clients_data, bytes_old_client_settings = (
3100
pickle.load(stored_state, encoding="bytes"))
3101
# Fix bytes to strings
3102
# clients_data
3103
# .keys()
3104
clients_data = {(key.decode("utf-8")
3105
if isinstance(key, bytes)
3106
else key): value
3107
for key, value in
3108
bytes_clients_data.items()}
3109
del bytes_clients_data
3110
for key in clients_data:
3111
value = {(k.decode("utf-8")
3112
if isinstance(k, bytes) else k): v
3113
for k, v in
3114
clients_data[key].items()}
3115
clients_data[key] = value
3116
# .client_structure
3117
value["client_structure"] = [
3118
(s.decode("utf-8")
3119
if isinstance(s, bytes)
3120
else s) for s in
3121
value["client_structure"]]
3122
# .name & .host
3123
for k in ("name", "host"):
3124
if isinstance(value[k], bytes):
3125
value[k] = value[k].decode("utf-8")
3126
# old_client_settings
3127
# .keys()
3128
old_client_settings = {
3129
(key.decode("utf-8")
3130
if isinstance(key, bytes)
3131
else key): value
3132
for key, value in
3133
bytes_old_client_settings.items()}
3134
del bytes_old_client_settings
3135
# .host
3136
for value in old_client_settings.values():
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3139
.decode("utf-8"))
3014
3140
os.remove(stored_state_path)
3015
3141
except IOError as e:
3016
3142
if e.errno == errno.ENOENT:
3024
3150
logger.warning("Could not load persistent state: "
3025
3151
"EOFError:",
3026
3152
exc_info=e)
3027
3153
3028
3154
with PGPEngine() as pgp:
3029
3155
for client_name, client in clients_data.items():
3030
3156
# Skip removed clients
3031
3157
if client_name not in client_settings:
3032
3158
continue
3033
3159
3034
3160
# Decide which value to use after restoring saved state.
3035
3161
# We have three different values: Old config file,
3036
3162
# new config file, and saved state.
3047
3173
client[name] = value
3048
3174
except KeyError:
3049
3175
pass
3050
3176
3051
3177
# Clients who has passed its expire date can still be
3052
3178
# enabled if its last checker was successful. A Client
3053
3179
# whose checker succeeded before we stored its state is
3086
3212
client_name))
3087
3213
client["secret"] = (client_settings[client_name]
3088
3214
["secret"])
3089
3215
3090
3216
# Add/remove clients based on new changes made to config
3091
3217
for client_name in (set(old_client_settings)
3092
3218
- set(client_settings)):
3094
3220
for client_name in (set(client_settings)
3095
3221
- set(old_client_settings)):
3096
3222
clients_data[client_name] = client_settings[client_name]
3097
3223
3098
3224
# Create all client objects
3099
3225
for client_name, client in clients_data.items():
3100
3226
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
3103
server_settings = server_settings)
3104
3227
name=client_name,
3228
settings=client,
3229
server_settings=server_settings)
3230
3105
3231
if not tcp_server.clients:
3106
3232
logger.warning("No clients defined")
3107
3233
3108
3234
if not foreground:
3109
3235
if pidfile is not None:
3110
3236
pid = os.getpid()
3116
3242
pidfilename, pid)
3117
3243
del pidfile
3118
3244
del pidfilename
3119
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
3245
3246
for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
lambda: main_loop.quit() and False)
3249
3123
3250
if use_dbus:
3124
3251
3125
3252
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3253
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3254
class MandosDBusService(DBusObjectWithObjectManager):
3128
3255
"""A D-Bus proxy object"""
3129
3256
3130
3257
def __init__(self):
3131
3258
dbus.service.Object.__init__(self, bus, "/")
3132
3259
3133
3260
_interface = "se.recompile.Mandos"
3134
3261
3135
3262
@dbus.service.signal(_interface, signature="o")
3136
3263
def ClientAdded(self, objpath):
3137
3264
"D-Bus signal"
3138
3265
pass
3139
3266
3140
3267
@dbus.service.signal(_interface, signature="ss")
3141
3268
def ClientNotFound(self, fingerprint, address):
3142
3269
"D-Bus signal"
3143
3270
pass
3144
3271
3145
3272
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
3273
"true"})
3147
3274
@dbus.service.signal(_interface, signature="os")
3148
3275
def ClientRemoved(self, objpath, name):
3149
3276
"D-Bus signal"
3150
3277
pass
3151
3278
3152
3279
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
3280
"true"})
3154
3281
@dbus.service.method(_interface, out_signature="ao")
3155
3282
def GetAllClients(self):
3156
3283
"D-Bus method"
3157
3284
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3159
3285
tcp_server.clients.values())
3286
3160
3287
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
3288
"true"})
3162
3289
@dbus.service.method(_interface,
3164
3291
def GetAllClientsWithProperties(self):
3165
3292
"D-Bus method"
3166
3293
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3294
{c.dbus_object_path: c.GetAll(
3168
3295
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3296
for c in tcp_server.clients.values()},
3170
3297
signature="oa{sv}")
3171
3298
3172
3299
@dbus.service.method(_interface, in_signature="o")
3173
3300
def RemoveClient(self, object_path):
3174
3301
"D-Bus method"
3175
for c in tcp_server.clients.itervalues():
3302
for c in tcp_server.clients.values():
3176
3303
if c.dbus_object_path == object_path:
3177
3304
del tcp_server.clients[c.name]
3178
3305
c.remove_from_connection()
3182
3309
self.client_removed_signal(c)
3183
3310
return
3184
3311
raise KeyError(object_path)
3185
3312
3186
3313
del _interface
3187
3314
3188
3315
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3316
out_signature="a{oa{sa{sv}}}")
3190
3317
def GetManagedObjects(self):
3191
3318
"""D-Bus method"""
3192
3319
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3320
{client.dbus_object_path:
3321
dbus.Dictionary(
3322
{interface: client.GetAll(interface)
3323
for interface in
3324
client._get_all_interface_names()})
3325
for client in tcp_server.clients.values()})
3326
3200
3327
def client_added_signal(self, client):
3201
3328
"""Send the new standard signal and the old signal"""
3202
3329
if use_dbus:
3204
3331
self.InterfacesAdded(
3205
3332
client.dbus_object_path,
3206
3333
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3334
{interface: client.GetAll(interface)
3335
for interface in
3336
client._get_all_interface_names()}))
3210
3337
# Old signal
3211
3338
self.ClientAdded(client.dbus_object_path)
3212
3339
3213
3340
def client_removed_signal(self, client):
3214
3341
"""Send the new standard signal and the old signal"""
3215
3342
if use_dbus:
3220
3347
# Old signal
3221
3348
self.ClientRemoved(client.dbus_object_path,
3222
3349
client.name)
3223
3350
3224
3351
mandos_dbus_service = MandosDBusService()
3225
3352
3353
# Save modules to variables to exempt the modules from being
3354
# unloaded before the function registered with atexit() is run.
3355
mp = multiprocessing
3356
wn = wnull
3357
3226
3358
def cleanup():
3227
3359
"Cleanup function; run on exit"
3228
3360
if zeroconf:
3229
3361
service.cleanup()
3230
3231
multiprocessing.active_children()
3232
wnull.close()
3362
3363
mp.active_children()
3364
wn.close()
3233
3365
if not (tcp_server.clients or client_settings):
3234
3366
return
3235
3367
3236
3368
# Store client before exiting. Secrets are encrypted with key
3237
3369
# based on what config file has. If config file is
3238
3370
# removed/edited, old secret will thus be unrecovable.
3239
3371
clients = {}
3240
3372
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3373
for client in tcp_server.clients.values():
3242
3374
key = client_settings[client.name]["secret"]
3243
3375
client.encrypted_secret = pgp.encrypt(client.secret,
3244
3376
key)
3245
3377
client_dict = {}
3246
3378
3247
3379
# A list of attributes that can not be pickled
3248
3380
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3381
exclude = {"bus", "changedstate", "secret",
3382
"checker", "server_settings"}
3251
3383
for name, typ in inspect.getmembers(dbus.service
3252
3384
.Object):
3253
3385
exclude.add(name)
3254
3386
3255
3387
client_dict["encrypted_secret"] = (client
3256
3388
.encrypted_secret)
3257
3389
for attr in client.client_structure:
3258
3390
if attr not in exclude:
3259
3391
client_dict[attr] = getattr(client, attr)
3260
3392
3261
3393
clients[client.name] = client_dict
3262
3394
del client_settings[client.name]["secret"]
3263
3395
3264
3396
try:
3265
3397
with tempfile.NamedTemporaryFile(
3266
3398
mode='wb',
3268
3400
prefix='clients-',
3269
3401
dir=os.path.dirname(stored_state_path),
3270
3402
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3403
pickle.dump((clients, client_settings), stored_state,
3404
protocol=2)
3272
3405
tempname = stored_state.name
3273
3406
os.rename(tempname, stored_state_path)
3274
3407
except (IOError, OSError) as e:
3284
3417
logger.warning("Could not save persistent state:",
3285
3418
exc_info=e)
3286
3419
raise
3287
3420
3288
3421
# Delete all clients, and settings from config
3289
3422
while tcp_server.clients:
3290
3423
name, client = tcp_server.clients.popitem()
3296
3429
if use_dbus:
3297
3430
mandos_dbus_service.client_removed_signal(client)
3298
3431
client_settings.clear()
3299
3432
3300
3433
atexit.register(cleanup)
3301
3302
for client in tcp_server.clients.itervalues():
3434
3435
for client in tcp_server.clients.values():
3303
3436
if use_dbus:
3304
3437
# Emit D-Bus signal for adding
3305
3438
mandos_dbus_service.client_added_signal(client)
3306
3439
# Need to initiate checking of clients
3307
3440
if client.enabled:
3308
3441
client.init_checker()
3309
3442
3310
3443
tcp_server.enable()
3311
3444
tcp_server.server_activate()
3312
3445
3313
3446
# Find out what port we got
3314
3447
if zeroconf:
3315
3448
service.port = tcp_server.socket.getsockname()[1]
3320
3453
else: # IPv4
3321
3454
logger.info("Now listening on address %r, port %d",
3322
3455
*tcp_server.socket.getsockname())
3323
3324
#service.interface = tcp_server.socket.getsockname()[3]
3325
3456
3457
# service.interface = tcp_server.socket.getsockname()[3]
3458
3326
3459
try:
3327
3460
if zeroconf:
3328
3461
# From the Avahi example code
3333
3466
cleanup()
3334
3467
sys.exit(1)
3335
3468
# End of Avahi example code
3336
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3341
3469
3470
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
lambda *args, **kwargs:
3472
(tcp_server.handle_request
3473
(*args[2:], **kwargs) or True))
3474
3342
3475
logger.debug("Starting main loop")
3343
3476
main_loop.run()
3344
3477
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0