To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1122
- compare with another revision
- download diff
- download tarball
- view history from revision 1122
- Committer: Teddy Hogeborn
- Date: 2019-07-24 11:02:24 UTC
- Revision ID: teddy@recompile.se-20190724110224-i5wwdsrv2h9ic4nh
Fix bashisms: Use "command -v" instead of "type"
* Makefile (DOCBOOKTOMAN): Change "type" to "command -v".
* mandos-to-cryptroot-unlock: - '' -
* Makefile (DOCBOOKTOMAN): Change "type" to "command -v".
* mandos-to-cryptroot-unlock: - '' -
- files added:
- debian/mandos-client.templates
- debian/tests
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
79
80
80
81
import dbus
81
82
import dbus.service
82
try:
83
from gi.repository import GObject
84
except ImportError:
85
import gobject as GObject
83
from gi.repository import GLib
86
84
from dbus.mainloop.glib import DBusGMainLoop
87
85
import ctypes
88
86
import ctypes.util
89
87
import xml.dom.minidom
90
88
import inspect
91
89
90
# Try to find the value of SO_BINDTODEVICE:
92
91
try:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
93
94
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
95
except AttributeError:
95
96
try:
97
# This is where SO_BINDTODEVICE was up to and including Python
98
# 2.6, and also 3.2:
96
99
from IN import SO_BINDTODEVICE
97
100
except ImportError:
98
SO_BINDTODEVICE = None
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
103
try:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
"/dev/stdin"],
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
112
# No value found
113
SO_BINDTODEVICE = None
99
114
100
115
if sys.version_info.major == 2:
101
116
str = unicode
102
117
103
version = "1.7.5"
118
version = "1.8.4"
104
119
stored_state_file = "clients.pickle"
105
120
106
121
logger = logging.getLogger()
110
125
if_nametoindex = ctypes.cdll.LoadLibrary(
111
126
ctypes.util.find_library("c")).if_nametoindex
112
127
except (OSError, AttributeError):
113
128
114
129
def if_nametoindex(interface):
115
130
"Get an interface index the hard way, i.e. using fcntl()"
116
131
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
139
154
140
155
def initlogger(debug, level=logging.WARNING):
141
156
"""init logger and add loglevel"""
142
157
143
158
global syslogger
144
159
syslogger = (logging.handlers.SysLogHandler(
145
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
146
address = "/dev/log"))
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
address="/dev/log"))
147
162
syslogger.setFormatter(logging.Formatter
148
163
('Mandos [%(process)d]: %(levelname)s:'
149
164
' %(message)s'))
150
165
logger.addHandler(syslogger)
151
166
152
167
if debug:
153
168
console = logging.StreamHandler()
154
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
166
181
167
182
class PGPEngine(object):
168
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
169
184
170
185
def __init__(self):
171
186
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
172
187
self.gpg = "gpg"
183
198
self.gnupgargs = ['--batch',
184
199
'--homedir', self.tempdir,
185
200
'--force-mdc',
186
'--quiet',
187
'--no-use-agent']
188
201
'--quiet']
202
# Only GPG version 1 has the --no-use-agent option.
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
self.gnupgargs.append("--no-use-agent")
205
189
206
def __enter__(self):
190
207
return self
191
208
192
209
def __exit__(self, exc_type, exc_value, traceback):
193
210
self._cleanup()
194
211
return False
195
212
196
213
def __del__(self):
197
214
self._cleanup()
198
215
199
216
def _cleanup(self):
200
217
if self.tempdir is not None:
201
218
# Delete contents of tempdir
202
219
for root, dirs, files in os.walk(self.tempdir,
203
topdown = False):
220
topdown=False):
204
221
for filename in files:
205
222
os.remove(os.path.join(root, filename))
206
223
for dirname in dirs:
208
225
# Remove tempdir
209
226
os.rmdir(self.tempdir)
210
227
self.tempdir = None
211
228
212
229
def password_encode(self, password):
213
230
# Passphrase can not be empty and can not contain newlines or
214
231
# NUL bytes. So we prefix it and hex encode it.
219
236
.replace(b"\n", b"\\n")
220
237
.replace(b"\0", b"\\x00"))
221
238
return encoded
222
239
223
240
def encrypt(self, data, password):
224
241
passphrase = self.password_encode(password)
225
242
with tempfile.NamedTemporaryFile(
230
247
'--passphrase-file',
231
248
passfile.name]
232
249
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
237
254
if proc.returncode != 0:
238
255
raise PGPError(err)
239
256
return ciphertext
240
257
241
258
def decrypt(self, data, password):
242
259
passphrase = self.password_encode(password)
243
260
with tempfile.NamedTemporaryFile(
244
dir = self.tempdir) as passfile:
261
dir=self.tempdir) as passfile:
245
262
passfile.write(passphrase)
246
263
passfile.flush()
247
264
proc = subprocess.Popen([self.gpg, '--decrypt',
248
265
'--passphrase-file',
249
266
passfile.name]
250
267
+ self.gnupgargs,
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
255
272
if proc.returncode != 0:
256
273
raise PGPError(err)
257
274
return decrypted_plaintext
258
275
276
259
277
# Pretend that we have an Avahi module
260
class Avahi(object):
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
278
class avahi(object):
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
267
284
DBUS_NAME = "org.freedesktop.Avahi"
268
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
269
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
270
287
DBUS_PATH_SERVER = "/"
271
def string_array_to_txt_array(self, t):
288
289
@staticmethod
290
def string_array_to_txt_array(t):
272
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
273
292
for s in t), signature="ay")
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
282
avahi = Avahi()
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
283
302
284
303
class AvahiError(Exception):
285
304
def __init__(self, value, *args, **kwargs):
298
317
299
318
class AvahiService(object):
300
319
"""An Avahi (Zeroconf) service.
301
320
302
321
Attributes:
303
322
interface: integer; avahi.IF_UNSPEC or an interface index.
304
323
Used to optionally bind to the specified interface.
316
335
server: D-Bus Server
317
336
bus: dbus.SystemBus()
318
337
"""
319
338
320
339
def __init__(self,
321
interface = avahi.IF_UNSPEC,
322
name = None,
323
servicetype = None,
324
port = None,
325
TXT = None,
326
domain = "",
327
host = "",
328
max_renames = 32768,
329
protocol = avahi.PROTO_UNSPEC,
330
bus = None):
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
331
350
self.interface = interface
332
351
self.name = name
333
352
self.type = servicetype
342
361
self.server = None
343
362
self.bus = bus
344
363
self.entry_group_state_changed_match = None
345
364
346
365
def rename(self, remove=True):
347
366
"""Derived from the Avahi example code"""
348
367
if self.rename_count >= self.max_renames:
368
387
logger.critical("D-Bus Exception", exc_info=error)
369
388
self.cleanup()
370
389
os._exit(1)
371
390
372
391
def remove(self):
373
392
"""Derived from the Avahi example code"""
374
393
if self.entry_group_state_changed_match is not None:
376
395
self.entry_group_state_changed_match = None
377
396
if self.group is not None:
378
397
self.group.Reset()
379
398
380
399
def add(self):
381
400
"""Derived from the Avahi example code"""
382
401
self.remove()
399
418
dbus.UInt16(self.port),
400
419
avahi.string_array_to_txt_array(self.TXT))
401
420
self.group.Commit()
402
421
403
422
def entry_group_state_changed(self, state, error):
404
423
"""Derived from the Avahi example code"""
405
424
logger.debug("Avahi entry group state change: %i", state)
406
425
407
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
408
427
logger.debug("Zeroconf service established.")
409
428
elif state == avahi.ENTRY_GROUP_COLLISION:
413
432
logger.critical("Avahi: Error in group state changed %s",
414
433
str(error))
415
434
raise AvahiGroupError("State changed: {!s}".format(error))
416
435
417
436
def cleanup(self):
418
437
"""Derived from the Avahi example code"""
419
438
if self.group is not None:
424
443
pass
425
444
self.group = None
426
445
self.remove()
427
446
428
447
def server_state_changed(self, state, error=None):
429
448
"""Derived from the Avahi example code"""
430
449
logger.debug("Avahi server state change: %i", state)
459
478
logger.debug("Unknown state: %r", state)
460
479
else:
461
480
logger.debug("Unknown state: %r: %r", state, error)
462
481
463
482
def activate(self):
464
483
"""Derived from the Avahi example code"""
465
484
if self.server is None:
476
495
class AvahiServiceToSyslog(AvahiService):
477
496
def rename(self, *args, **kwargs):
478
497
"""Add the new name to the syslog messages"""
479
ret = AvahiService.rename(self, *args, **kwargs)
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
480
499
syslogger.setFormatter(logging.Formatter(
481
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
482
501
.format(self.name)))
483
502
return ret
484
503
504
485
505
# Pretend that we have a GnuTLS module
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
489
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
493
def __init__(self):
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
496
# happens.
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
500
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
508
509
library = ctypes.util.find_library("gnutls")
510
if library is None:
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
513
del library
514
501
515
# Unless otherwise indicated, the constants and types below are
502
516
# all from the gnutls/gnutls.h C header file.
503
517
504
518
# Constants
505
519
E_SUCCESS = 0
506
520
E_INTERRUPTED = -52
507
521
E_AGAIN = -28
508
522
CRT_OPENPGP = 2
523
CRT_RAWPK = 3
509
524
CLIENT = 2
510
525
SHUT_RDWR = 0
511
526
CRD_CERTIFICATE = 1
512
527
E_NO_CERTIFICATE_FOUND = -49
528
X509_FMT_DER = 0
529
NO_TICKETS = 1<<10
530
ENABLE_RAWPK = 1<<18
531
CTYPE_PEERS = 3
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
513
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
514
534
515
535
# Types
516
536
class session_int(ctypes.Structure):
517
537
_fields_ = []
518
538
session_t = ctypes.POINTER(session_int)
539
519
540
class certificate_credentials_st(ctypes.Structure):
520
541
_fields_ = []
521
542
certificate_credentials_t = ctypes.POINTER(
522
543
certificate_credentials_st)
523
544
certificate_type_t = ctypes.c_int
545
524
546
class datum_t(ctypes.Structure):
525
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
548
('size', ctypes.c_uint)]
549
527
550
class openpgp_crt_int(ctypes.Structure):
528
551
_fields_ = []
529
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
531
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
532
555
credentials_type_t = ctypes.c_int
533
556
transport_ptr_t = ctypes.c_void_p
534
557
close_request_t = ctypes.c_int
535
558
536
559
# Exceptions
537
560
class Error(Exception):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
561
def __init__(self, message=None, code=None, args=()):
543
562
# Default usage is by a message string, but if a return
544
563
# code is passed, convert it to a string with
545
564
# gnutls.strerror()
546
565
self.code = code
547
566
if message is None and code is not None:
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
550
569
message, *args)
551
570
552
571
class CertificateSecurityError(Error):
553
572
pass
554
573
555
574
# Classes
556
575
class Credentials(object):
557
576
def __init__(self):
559
578
gnutls.certificate_allocate_credentials(
560
579
ctypes.byref(self._c_object))
561
580
self.type = gnutls.CRD_CERTIFICATE
562
581
563
582
def __del__(self):
564
583
gnutls.certificate_free_credentials(self._c_object)
565
584
566
585
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
586
def __init__(self, socket, credentials=None):
568
587
self._c_object = gnutls.session_t()
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version("3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
591
if gnutls.has_rawpk:
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
594
del gnutls_flags
570
595
gnutls.set_default_priority(self._c_object)
571
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
572
597
gnutls.handshake_set_private_extensions(self._c_object,
578
603
ctypes.cast(credentials._c_object,
579
604
ctypes.c_void_p))
580
605
self.credentials = credentials
581
606
582
607
def __del__(self):
583
608
gnutls.deinit(self._c_object)
584
609
585
610
def handshake(self):
586
611
return gnutls.handshake(self._c_object)
587
612
588
613
def send(self, data):
589
614
data = bytes(data)
590
615
data_len = len(data)
592
617
data_len -= gnutls.record_send(self._c_object,
593
618
data[-data_len:],
594
619
data_len)
595
620
596
621
def bye(self):
597
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
598
623
599
624
# Error handling functions
600
625
def _error_code(result):
601
626
"""A function to raise exceptions on errors, suitable
603
628
if result >= 0:
604
629
return result
605
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
608
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
633
609
634
def _retry_on_error(result, func, arguments):
610
635
"""A function to retry on some errors, suitable
611
636
for the 'errcheck' attribute on ctypes functions"""
614
639
return _error_code(result)
615
640
result = func(*arguments)
616
641
return result
617
642
618
643
# Unless otherwise indicated, the function declarations below are
619
644
# all from the gnutls/gnutls.h C header file.
620
645
621
646
# Functions
622
647
priority_set_direct = _library.gnutls_priority_set_direct
623
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
624
649
ctypes.POINTER(ctypes.c_char_p)]
625
650
priority_set_direct.restype = _error_code
626
651
627
652
init = _library.gnutls_init
628
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
629
654
init.restype = _error_code
630
655
631
656
set_default_priority = _library.gnutls_set_default_priority
632
657
set_default_priority.argtypes = [session_t]
633
658
set_default_priority.restype = _error_code
634
659
635
660
record_send = _library.gnutls_record_send
636
661
record_send.argtypes = [session_t, ctypes.c_void_p,
637
662
ctypes.c_size_t]
638
663
record_send.restype = ctypes.c_ssize_t
639
664
record_send.errcheck = _retry_on_error
640
665
641
666
certificate_allocate_credentials = (
642
667
_library.gnutls_certificate_allocate_credentials)
643
668
certificate_allocate_credentials.argtypes = [
644
669
ctypes.POINTER(certificate_credentials_t)]
645
670
certificate_allocate_credentials.restype = _error_code
646
671
647
672
certificate_free_credentials = (
648
673
_library.gnutls_certificate_free_credentials)
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
650
676
certificate_free_credentials.restype = None
651
677
652
678
handshake_set_private_extensions = (
653
679
_library.gnutls_handshake_set_private_extensions)
654
680
handshake_set_private_extensions.argtypes = [session_t,
655
681
ctypes.c_int]
656
682
handshake_set_private_extensions.restype = None
657
683
658
684
credentials_set = _library.gnutls_credentials_set
659
685
credentials_set.argtypes = [session_t, credentials_type_t,
660
686
ctypes.c_void_p]
661
687
credentials_set.restype = _error_code
662
688
663
689
strerror = _library.gnutls_strerror
664
690
strerror.argtypes = [ctypes.c_int]
665
691
strerror.restype = ctypes.c_char_p
666
692
667
693
certificate_type_get = _library.gnutls_certificate_type_get
668
694
certificate_type_get.argtypes = [session_t]
669
695
certificate_type_get.restype = _error_code
670
696
671
697
certificate_get_peers = _library.gnutls_certificate_get_peers
672
698
certificate_get_peers.argtypes = [session_t,
673
699
ctypes.POINTER(ctypes.c_uint)]
674
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
675
701
676
702
global_set_log_level = _library.gnutls_global_set_log_level
677
703
global_set_log_level.argtypes = [ctypes.c_int]
678
704
global_set_log_level.restype = None
679
705
680
706
global_set_log_function = _library.gnutls_global_set_log_function
681
707
global_set_log_function.argtypes = [log_func]
682
708
global_set_log_function.restype = None
683
709
684
710
deinit = _library.gnutls_deinit
685
711
deinit.argtypes = [session_t]
686
712
deinit.restype = None
687
713
688
714
handshake = _library.gnutls_handshake
689
715
handshake.argtypes = [session_t]
690
716
handshake.restype = _error_code
691
717
handshake.errcheck = _retry_on_error
692
718
693
719
transport_set_ptr = _library.gnutls_transport_set_ptr
694
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
695
721
transport_set_ptr.restype = None
696
722
697
723
bye = _library.gnutls_bye
698
724
bye.argtypes = [session_t, close_request_t]
699
725
bye.restype = _error_code
700
726
bye.errcheck = _retry_on_error
701
727
702
728
check_version = _library.gnutls_check_version
703
729
check_version.argtypes = [ctypes.c_char_p]
704
730
check_version.restype = ctypes.c_char_p
705
706
# All the function declarations below are from gnutls/openpgp.h
707
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
711
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
715
openpgp_crt_fmt_t]
716
openpgp_crt_import.restype = _error_code
717
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
722
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
726
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
ctypes.c_void_p,
731
ctypes.POINTER(
732
ctypes.c_size_t)]
733
openpgp_crt_get_fingerprint.restype = _error_code
734
731
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
736
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
739
740
if has_rawpk:
741
# Types
742
class pubkey_st(ctypes.Structure):
743
_fields = []
744
pubkey_t = ctypes.POINTER(pubkey_st)
745
746
x509_crt_fmt_t = ctypes.c_int
747
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
752
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
755
x509_crt_fmt_t]
756
pubkey_import.restype = _error_code
757
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
763
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
767
else:
768
# All the function declarations below are from gnutls/openpgp.h
769
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
773
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
777
openpgp_crt_fmt_t]
778
openpgp_crt_import.restype = _error_code
779
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
784
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
788
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
792
ctypes.c_void_p,
793
ctypes.POINTER(
794
ctypes.c_size_t)]
795
openpgp_crt_get_fingerprint.restype = _error_code
796
797
if check_version("3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
801
735
802
# Remove non-public functions
736
803
del _error_code, _retry_on_error
737
# Create the global "gnutls" object, simulating a module
738
gnutls = GnuTLS()
804
739
805
740
806
def call_pipe(connection, # : multiprocessing.Connection
741
807
func, *args, **kwargs):
742
808
"""This function is meant to be called by multiprocessing.Process
743
809
744
810
This function runs func(*args, **kwargs), and writes the resulting
745
811
return value on the provided multiprocessing.Connection.
746
812
"""
747
813
connection.send(func(*args, **kwargs))
748
814
connection.close()
749
815
816
750
817
class Client(object):
751
818
"""A representation of a client host served by this server.
752
819
753
820
Attributes:
754
821
approved: bool(); 'None' if not yet approved/disapproved
755
822
approval_delay: datetime.timedelta(); Time to wait for approval
757
824
checker: subprocess.Popen(); a running checker process used
758
825
to see if the client lives.
759
826
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
827
checker_callback_tag: a GLib event source tag, or None
761
828
checker_command: string; External command which is run to check
762
829
if client lives. %() expansions are done at
763
830
runtime with vars(self) as dict, so that for
764
831
instance %(name)s can be used in the command.
765
checker_initiator_tag: a GObject event source tag, or None
832
checker_initiator_tag: a GLib event source tag, or None
766
833
created: datetime.datetime(); (UTC) object creation
767
834
client_structure: Object describing what attributes a client has
768
835
and is used for storing the client at exit
769
836
current_checker_command: string; current running checker_command
770
disable_initiator_tag: a GObject event source tag, or None
837
disable_initiator_tag: a GLib event source tag, or None
771
838
enabled: bool()
772
839
fingerprint: string (40 or 32 hexadecimal digits); used to
773
uniquely identify the client
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
774
843
host: string; available for use by the checker command
775
844
interval: datetime.timedelta(); How often to start a new checker
776
845
last_approval_request: datetime.datetime(); (UTC) or None
792
861
disabled, or None
793
862
server_settings: The server_settings dict from main()
794
863
"""
795
864
796
865
runtime_expansions = ("approval_delay", "approval_duration",
797
"created", "enabled", "expires",
866
"created", "enabled", "expires", "key_id",
798
867
"fingerprint", "host", "interval",
799
868
"last_approval_request", "last_checked_ok",
800
869
"last_enabled", "name", "timeout")
809
878
"approved_by_default": "True",
810
879
"enabled": "True",
811
880
}
812
881
813
882
@staticmethod
814
883
def config_parser(config):
815
884
"""Construct a new dict of client settings of this form:
822
891
for client_name in config.sections():
823
892
section = dict(config.items(client_name))
824
893
client = settings[client_name] = {}
825
894
826
895
client["host"] = section["host"]
827
896
# Reformat values from string types to Python types
828
897
client["approved_by_default"] = config.getboolean(
829
898
client_name, "approved_by_default")
830
899
client["enabled"] = config.getboolean(client_name,
831
900
"enabled")
832
833
# Uppercase and remove spaces from fingerprint for later
834
# comparison purposes with return value from the
835
# fingerprint() function
901
902
# Uppercase and remove spaces from key_id and fingerprint
903
# for later comparison purposes with return value from the
904
# key_id() and fingerprint() functions
905
client["key_id"] = (section.get("key_id", "").upper()
906
.replace(" ", ""))
836
907
client["fingerprint"] = (section["fingerprint"].upper()
837
908
.replace(" ", ""))
838
909
if "secret" in section:
859
930
client["last_approval_request"] = None
860
931
client["last_checked_ok"] = None
861
932
client["last_checker_status"] = -2
862
933
863
934
return settings
864
865
def __init__(self, settings, name = None, server_settings=None):
935
936
def __init__(self, settings, name=None, server_settings=None):
866
937
self.name = name
867
938
if server_settings is None:
868
939
server_settings = {}
870
941
# adding all client settings
871
942
for setting, value in settings.items():
872
943
setattr(self, setting, value)
873
944
874
945
if self.enabled:
875
946
if not hasattr(self, "last_enabled"):
876
947
self.last_enabled = datetime.datetime.utcnow()
880
951
else:
881
952
self.last_enabled = None
882
953
self.expires = None
883
954
884
955
logger.debug("Creating client %r", self.name)
956
logger.debug(" Key ID: %s", self.key_id)
885
957
logger.debug(" Fingerprint: %s", self.fingerprint)
886
958
self.created = settings.get("created",
887
959
datetime.datetime.utcnow())
888
960
889
961
# attributes specific for this server instance
890
962
self.checker = None
891
963
self.checker_initiator_tag = None
900
972
for attr in self.__dict__.keys()
901
973
if not attr.startswith("_")]
902
974
self.client_structure.append("client_structure")
903
975
904
976
for name, t in inspect.getmembers(
905
977
type(self), lambda obj: isinstance(obj, property)):
906
978
if not name.startswith("_"):
907
979
self.client_structure.append(name)
908
980
909
981
# Send notice to process children that client state has changed
910
982
def send_changedstate(self):
911
983
with self.changedstate:
912
984
self.changedstate.notify_all()
913
985
914
986
def enable(self):
915
987
"""Start this client's checker and timeout hooks"""
916
988
if getattr(self, "enabled", False):
921
993
self.last_enabled = datetime.datetime.utcnow()
922
994
self.init_checker()
923
995
self.send_changedstate()
924
996
925
997
def disable(self, quiet=True):
926
998
"""Disable this client."""
927
999
if not getattr(self, "enabled", False):
929
1001
if not quiet:
930
1002
logger.info("Disabling client %s", self.name)
931
1003
if getattr(self, "disable_initiator_tag", None) is not None:
932
GObject.source_remove(self.disable_initiator_tag)
1004
GLib.source_remove(self.disable_initiator_tag)
933
1005
self.disable_initiator_tag = None
934
1006
self.expires = None
935
1007
if getattr(self, "checker_initiator_tag", None) is not None:
936
GObject.source_remove(self.checker_initiator_tag)
1008
GLib.source_remove(self.checker_initiator_tag)
937
1009
self.checker_initiator_tag = None
938
1010
self.stop_checker()
939
1011
self.enabled = False
940
1012
if not quiet:
941
1013
self.send_changedstate()
942
# Do not run this again if called by a GObject.timeout_add
1014
# Do not run this again if called by a GLib.timeout_add
943
1015
return False
944
1016
945
1017
def __del__(self):
946
1018
self.disable()
947
1019
948
1020
def init_checker(self):
949
1021
# Schedule a new checker to be started an 'interval' from now,
950
1022
# and every interval from then on.
951
1023
if self.checker_initiator_tag is not None:
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
954
1026
int(self.interval.total_seconds() * 1000),
955
1027
self.start_checker)
956
1028
# Schedule a disable() when 'timeout' has passed
957
1029
if self.disable_initiator_tag is not None:
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
960
1032
int(self.timeout.total_seconds() * 1000), self.disable)
961
1033
# Also start a new checker *right now*.
962
1034
self.start_checker()
963
1035
964
1036
def checker_callback(self, source, condition, connection,
965
1037
command):
966
1038
"""The checker has completed, so take appropriate actions."""
969
1041
# Read return code from connection (see call_pipe)
970
1042
returncode = connection.recv()
971
1043
connection.close()
972
1044
973
1045
if returncode >= 0:
974
1046
self.last_checker_status = returncode
975
1047
self.last_checker_signal = None
985
1057
logger.warning("Checker for %(name)s crashed?",
986
1058
vars(self))
987
1059
return False
988
1060
989
1061
def checked_ok(self):
990
1062
"""Assert that the client has been seen, alive and well."""
991
1063
self.last_checked_ok = datetime.datetime.utcnow()
992
1064
self.last_checker_status = 0
993
1065
self.last_checker_signal = None
994
1066
self.bump_timeout()
995
1067
996
1068
def bump_timeout(self, timeout=None):
997
1069
"""Bump up the timeout for this client."""
998
1070
if timeout is None:
999
1071
timeout = self.timeout
1000
1072
if self.disable_initiator_tag is not None:
1001
GObject.source_remove(self.disable_initiator_tag)
1073
GLib.source_remove(self.disable_initiator_tag)
1002
1074
self.disable_initiator_tag = None
1003
1075
if getattr(self, "enabled", False):
1004
self.disable_initiator_tag = GObject.timeout_add(
1076
self.disable_initiator_tag = GLib.timeout_add(
1005
1077
int(timeout.total_seconds() * 1000), self.disable)
1006
1078
self.expires = datetime.datetime.utcnow() + timeout
1007
1079
1008
1080
def need_approval(self):
1009
1081
self.last_approval_request = datetime.datetime.utcnow()
1010
1082
1011
1083
def start_checker(self):
1012
1084
"""Start a new checker subprocess if one is not running.
1013
1085
1014
1086
If a checker already exists, leave it running and do
1015
1087
nothing."""
1016
1088
# The reason for not killing a running checker is that if we
1021
1093
# checkers alone, the checker would have to take more time
1022
1094
# than 'timeout' for the client to be disabled, which is as it
1023
1095
# should be.
1024
1096
1025
1097
if self.checker is not None and not self.checker.is_alive():
1026
1098
logger.warning("Checker was not alive; joining")
1027
1099
self.checker.join()
1031
1103
# Escape attributes for the shell
1032
1104
escaped_attrs = {
1033
1105
attr: re.escape(str(getattr(self, attr)))
1034
for attr in self.runtime_expansions }
1106
for attr in self.runtime_expansions}
1035
1107
try:
1036
1108
command = self.checker_command % escaped_attrs
1037
1109
except TypeError as error:
1049
1121
# The exception is when not debugging but nevertheless
1050
1122
# running in the foreground; use the previously
1051
1123
# created wnull.
1052
popen_args = { "close_fds": True,
1053
"shell": True,
1054
"cwd": "/" }
1124
popen_args = {"close_fds": True,
1125
"shell": True,
1126
"cwd": "/"}
1055
1127
if (not self.server_settings["debug"]
1056
1128
and self.server_settings["foreground"]):
1057
1129
popen_args.update({"stdout": wnull,
1058
"stderr": wnull })
1059
pipe = multiprocessing.Pipe(duplex = False)
1130
"stderr": wnull})
1131
pipe = multiprocessing.Pipe(duplex=False)
1060
1132
self.checker = multiprocessing.Process(
1061
target = call_pipe,
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1133
target=call_pipe,
1134
args=(pipe[1], subprocess.call, command),
1135
kwargs=popen_args)
1064
1136
self.checker.start()
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1137
self.checker_callback_tag = GLib.io_add_watch(
1138
pipe[0].fileno(), GLib.IO_IN,
1067
1139
self.checker_callback, pipe[0], command)
1068
# Re-run this periodically if run by GObject.timeout_add
1140
# Re-run this periodically if run by GLib.timeout_add
1069
1141
return True
1070
1142
1071
1143
def stop_checker(self):
1072
1144
"""Force the checker process, if any, to stop."""
1073
1145
if self.checker_callback_tag:
1074
GObject.source_remove(self.checker_callback_tag)
1146
GLib.source_remove(self.checker_callback_tag)
1075
1147
self.checker_callback_tag = None
1076
1148
if getattr(self, "checker", None) is None:
1077
1149
return
1086
1158
byte_arrays=False):
1087
1159
"""Decorators for marking methods of a DBusObjectWithProperties to
1088
1160
become properties on the D-Bus.
1089
1161
1090
1162
The decorated method will be called with no arguments by "Get"
1091
1163
and with one argument by "Set".
1092
1164
1093
1165
The parameters, where they are supported, are the same as
1094
1166
dbus.service.method, except there is only "signature", since the
1095
1167
type from Get() and the type sent to Set() is the same.
1099
1171
if byte_arrays and signature != "ay":
1100
1172
raise ValueError("Byte arrays not supported for non-'ay'"
1101
1173
" signature {!r}".format(signature))
1102
1174
1103
1175
def decorator(func):
1104
1176
func._dbus_is_property = True
1105
1177
func._dbus_interface = dbus_interface
1108
1180
func._dbus_name = func.__name__
1109
1181
if func._dbus_name.endswith("_dbus_property"):
1110
1182
func._dbus_name = func._dbus_name[:-14]
1111
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1183
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1112
1184
return func
1113
1185
1114
1186
return decorator
1115
1187
1116
1188
1117
1189
def dbus_interface_annotations(dbus_interface):
1118
1190
"""Decorator for marking functions returning interface annotations
1119
1191
1120
1192
Usage:
1121
1193
1122
1194
@dbus_interface_annotations("org.example.Interface")
1123
1195
def _foo(self): # Function name does not matter
1124
1196
return {"org.freedesktop.DBus.Deprecated": "true",
1125
1197
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1126
1198
"false"}
1127
1199
"""
1128
1200
1129
1201
def decorator(func):
1130
1202
func._dbus_is_interface = True
1131
1203
func._dbus_interface = dbus_interface
1132
1204
func._dbus_name = dbus_interface
1133
1205
return func
1134
1206
1135
1207
return decorator
1136
1208
1137
1209
1138
1210
def dbus_annotations(annotations):
1139
1211
"""Decorator to annotate D-Bus methods, signals or properties
1140
1212
Usage:
1141
1213
1142
1214
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1143
1215
"org.freedesktop.DBus.Property."
1144
1216
"EmitsChangedSignal": "false"})
1146
1218
access="r")
1147
1219
def Property_dbus_property(self):
1148
1220
return dbus.Boolean(False)
1149
1221
1150
1222
See also the DBusObjectWithAnnotations class.
1151
1223
"""
1152
1224
1153
1225
def decorator(func):
1154
1226
func._dbus_annotations = annotations
1155
1227
return func
1156
1228
1157
1229
return decorator
1158
1230
1159
1231
1177
1249
1178
1250
class DBusObjectWithAnnotations(dbus.service.Object):
1179
1251
"""A D-Bus object with annotations.
1180
1252
1181
1253
Classes inheriting from this can use the dbus_annotations
1182
1254
decorator to add annotations to methods or signals.
1183
1255
"""
1184
1256
1185
1257
@staticmethod
1186
1258
def _is_dbus_thing(thing):
1187
1259
"""Returns a function testing if an attribute is a D-Bus thing
1188
1260
1189
1261
If called like _is_dbus_thing("method") it returns a function
1190
1262
suitable for use as predicate to inspect.getmembers().
1191
1263
"""
1192
1264
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1193
1265
False)
1194
1266
1195
1267
def _get_all_dbus_things(self, thing):
1196
1268
"""Returns a generator of (name, attribute) pairs
1197
1269
"""
1200
1272
for cls in self.__class__.__mro__
1201
1273
for name, athing in
1202
1274
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1203
1275
1204
1276
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1277
out_signature="s",
1278
path_keyword='object_path',
1279
connection_keyword='connection')
1208
1280
def Introspect(self, object_path, connection):
1209
1281
"""Overloading of standard D-Bus method.
1210
1282
1211
1283
Inserts annotation tags on methods and signals.
1212
1284
"""
1213
1285
xmlstring = dbus.service.Object.Introspect(self, object_path,
1214
1286
connection)
1215
1287
try:
1216
1288
document = xml.dom.minidom.parseString(xmlstring)
1217
1289
1218
1290
for if_tag in document.getElementsByTagName("interface"):
1219
1291
# Add annotation tags
1220
1292
for typ in ("method", "signal"):
1247
1319
if_tag.appendChild(ann_tag)
1248
1320
# Fix argument name for the Introspect method itself
1249
1321
if (if_tag.getAttribute("name")
1250
== dbus.INTROSPECTABLE_IFACE):
1322
== dbus.INTROSPECTABLE_IFACE):
1251
1323
for cn in if_tag.getElementsByTagName("method"):
1252
1324
if cn.getAttribute("name") == "Introspect":
1253
1325
for arg in cn.getElementsByTagName("arg"):
1266
1338
1267
1339
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1268
1340
"""A D-Bus object with properties.
1269
1341
1270
1342
Classes inheriting from this can use the dbus_service_property
1271
1343
decorator to expose methods as D-Bus properties. It exposes the
1272
1344
standard Get(), Set(), and GetAll() methods on the D-Bus.
1273
1345
"""
1274
1346
1275
1347
def _get_dbus_property(self, interface_name, property_name):
1276
1348
"""Returns a bound method if one exists which is a D-Bus
1277
1349
property with the specified name and interface.
1282
1354
if (value._dbus_name == property_name
1283
1355
and value._dbus_interface == interface_name):
1284
1356
return value.__get__(self)
1285
1357
1286
1358
# No such property
1287
1359
raise DBusPropertyNotFound("{}:{}.{}".format(
1288
1360
self.dbus_object_path, interface_name, property_name))
1289
1361
1290
1362
@classmethod
1291
1363
def _get_all_interface_names(cls):
1292
1364
"""Get a sequence of all interfaces supported by an object"""
1295
1367
for x in (inspect.getmro(cls))
1296
1368
for attr in dir(x))
1297
1369
if name is not None)
1298
1370
1299
1371
@dbus.service.method(dbus.PROPERTIES_IFACE,
1300
1372
in_signature="ss",
1301
1373
out_signature="v")
1309
1381
if not hasattr(value, "variant_level"):
1310
1382
return value
1311
1383
return type(value)(value, variant_level=value.variant_level+1)
1312
1384
1313
1385
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1314
1386
def Set(self, interface_name, property_name, value):
1315
1387
"""Standard D-Bus property Set() method, see D-Bus standard.
1327
1399
value = dbus.ByteArray(b''.join(chr(byte)
1328
1400
for byte in value))
1329
1401
prop(value)
1330
1402
1331
1403
@dbus.service.method(dbus.PROPERTIES_IFACE,
1332
1404
in_signature="s",
1333
1405
out_signature="a{sv}")
1334
1406
def GetAll(self, interface_name):
1335
1407
"""Standard D-Bus property GetAll() method, see D-Bus
1336
1408
standard.
1337
1409
1338
1410
Note: Will not include properties with access="write".
1339
1411
"""
1340
1412
properties = {}
1351
1423
properties[name] = value
1352
1424
continue
1353
1425
properties[name] = type(value)(
1354
value, variant_level = value.variant_level + 1)
1426
value, variant_level=value.variant_level + 1)
1355
1427
return dbus.Dictionary(properties, signature="sv")
1356
1428
1357
1429
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1358
1430
def PropertiesChanged(self, interface_name, changed_properties,
1359
1431
invalidated_properties):
1361
1433
standard.
1362
1434
"""
1363
1435
pass
1364
1436
1365
1437
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1366
1438
out_signature="s",
1367
1439
path_keyword='object_path',
1368
1440
connection_keyword='connection')
1369
1441
def Introspect(self, object_path, connection):
1370
1442
"""Overloading of standard D-Bus method.
1371
1443
1372
1444
Inserts property tags and interface annotation tags.
1373
1445
"""
1374
1446
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1376
1448
connection)
1377
1449
try:
1378
1450
document = xml.dom.minidom.parseString(xmlstring)
1379
1451
1380
1452
def make_tag(document, name, prop):
1381
1453
e = document.createElement("property")
1382
1454
e.setAttribute("name", name)
1383
1455
e.setAttribute("type", prop._dbus_signature)
1384
1456
e.setAttribute("access", prop._dbus_access)
1385
1457
return e
1386
1458
1387
1459
for if_tag in document.getElementsByTagName("interface"):
1388
1460
# Add property tags
1389
1461
for tag in (make_tag(document, name, prop)
1431
1503
exc_info=error)
1432
1504
return xmlstring
1433
1505
1506
1434
1507
try:
1435
1508
dbus.OBJECT_MANAGER_IFACE
1436
1509
except AttributeError:
1437
1510
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1438
1511
1512
1439
1513
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1440
1514
"""A D-Bus object with an ObjectManager.
1441
1515
1442
1516
Classes inheriting from this exposes the standard
1443
1517
GetManagedObjects call and the InterfacesAdded and
1444
1518
InterfacesRemoved signals on the standard
1445
1519
"org.freedesktop.DBus.ObjectManager" interface.
1446
1520
1447
1521
Note: No signals are sent automatically; they must be sent
1448
1522
manually.
1449
1523
"""
1450
1524
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1451
out_signature = "a{oa{sa{sv}}}")
1525
out_signature="a{oa{sa{sv}}}")
1452
1526
def GetManagedObjects(self):
1453
1527
"""This function must be overridden"""
1454
1528
raise NotImplementedError()
1455
1529
1456
1530
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1457
signature = "oa{sa{sv}}")
1531
signature="oa{sa{sv}}")
1458
1532
def InterfacesAdded(self, object_path, interfaces_and_properties):
1459
1533
pass
1460
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1534
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1462
1536
def InterfacesRemoved(self, object_path, interfaces):
1463
1537
pass
1464
1538
1465
1539
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1540
out_signature="s",
1541
path_keyword='object_path',
1542
connection_keyword='connection')
1469
1543
def Introspect(self, object_path, connection):
1470
1544
"""Overloading of standard D-Bus method.
1471
1545
1472
1546
Override return argument name of GetManagedObjects to be
1473
1547
"objpath_interfaces_and_properties"
1474
1548
"""
1477
1551
connection)
1478
1552
try:
1479
1553
document = xml.dom.minidom.parseString(xmlstring)
1480
1554
1481
1555
for if_tag in document.getElementsByTagName("interface"):
1482
1556
# Fix argument name for the GetManagedObjects method
1483
1557
if (if_tag.getAttribute("name")
1484
== dbus.OBJECT_MANAGER_IFACE):
1558
== dbus.OBJECT_MANAGER_IFACE):
1485
1559
for cn in if_tag.getElementsByTagName("method"):
1486
1560
if (cn.getAttribute("name")
1487
1561
== "GetManagedObjects"):
1497
1571
except (AttributeError, xml.dom.DOMException,
1498
1572
xml.parsers.expat.ExpatError) as error:
1499
1573
logger.error("Failed to override Introspection method",
1500
exc_info = error)
1574
exc_info=error)
1501
1575
return xmlstring
1502
1576
1577
1503
1578
def datetime_to_dbus(dt, variant_level=0):
1504
1579
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1505
1580
if dt is None:
1506
return dbus.String("", variant_level = variant_level)
1581
return dbus.String("", variant_level=variant_level)
1507
1582
return dbus.String(dt.isoformat(), variant_level=variant_level)
1508
1583
1509
1584
1512
1587
dbus.service.Object, it will add alternate D-Bus attributes with
1513
1588
interface names according to the "alt_interface_names" mapping.
1514
1589
Usage:
1515
1590
1516
1591
@alternate_dbus_interfaces({"org.example.Interface":
1517
1592
"net.example.AlternateInterface"})
1518
1593
class SampleDBusObject(dbus.service.Object):
1519
1594
@dbus.service.method("org.example.Interface")
1520
1595
def SampleDBusMethod():
1521
1596
pass
1522
1597
1523
1598
The above "SampleDBusMethod" on "SampleDBusObject" will be
1524
1599
reachable via two interfaces: "org.example.Interface" and
1525
1600
"net.example.AlternateInterface", the latter of which will have
1526
1601
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1527
1602
"true", unless "deprecate" is passed with a False value.
1528
1603
1529
1604
This works for methods and signals, and also for D-Bus properties
1530
1605
(from DBusObjectWithProperties) and interfaces (from the
1531
1606
dbus_interface_annotations decorator).
1532
1607
"""
1533
1608
1534
1609
def wrapper(cls):
1535
1610
for orig_interface_name, alt_interface_name in (
1536
1611
alt_interface_names.items()):
1576
1651
attribute._dbus_annotations)
1577
1652
except AttributeError:
1578
1653
pass
1654
1579
1655
# Define a creator of a function to call both the
1580
1656
# original and alternate functions, so both the
1581
1657
# original and alternate signals gets sent when
1584
1660
"""This function is a scope container to pass
1585
1661
func1 and func2 to the "call_both" function
1586
1662
outside of its arguments"""
1587
1663
1588
1664
@functools.wraps(func2)
1589
1665
def call_both(*args, **kwargs):
1590
1666
"""This function will emit two D-Bus
1591
1667
signals by calling func1 and func2"""
1592
1668
func1(*args, **kwargs)
1593
1669
func2(*args, **kwargs)
1594
# Make wrapper function look like a D-Bus signal
1670
# Make wrapper function look like a D-Bus
1671
# signal
1595
1672
for name, attr in inspect.getmembers(func2):
1596
1673
if name.startswith("_dbus_"):
1597
1674
setattr(call_both, name, attr)
1598
1675
1599
1676
return call_both
1600
1677
# Create the "call_both" function and add it to
1601
1678
# the class
1647
1724
(copy_function(attribute)))
1648
1725
if deprecate:
1649
1726
# Deprecate all alternate interfaces
1650
iname="_AlternateDBusNames_interface_annotation{}"
1727
iname = "_AlternateDBusNames_interface_annotation{}"
1651
1728
for interface_name in interface_names:
1652
1729
1653
1730
@dbus_interface_annotations(interface_name)
1654
1731
def func(self):
1655
return { "org.freedesktop.DBus.Deprecated":
1656
"true" }
1732
return {"org.freedesktop.DBus.Deprecated":
1733
"true"}
1657
1734
# Find an unused name
1658
1735
for aname in (iname.format(i)
1659
1736
for i in itertools.count()):
1670
1747
cls = type("{}Alternate".format(cls.__name__),
1671
1748
(cls, ), attr)
1672
1749
return cls
1673
1750
1674
1751
return wrapper
1675
1752
1676
1753
1678
1755
"se.bsnet.fukt.Mandos"})
1679
1756
class ClientDBus(Client, DBusObjectWithProperties):
1680
1757
"""A Client class using D-Bus
1681
1758
1682
1759
Attributes:
1683
1760
dbus_object_path: dbus.ObjectPath
1684
1761
bus: dbus.SystemBus()
1685
1762
"""
1686
1763
1687
1764
runtime_expansions = (Client.runtime_expansions
1688
1765
+ ("dbus_object_path", ))
1689
1766
1690
1767
_interface = "se.recompile.Mandos.Client"
1691
1768
1692
1769
# dbus.service.Object doesn't use super(), so we can't either.
1693
1694
def __init__(self, bus = None, *args, **kwargs):
1770
1771
def __init__(self, bus=None, *args, **kwargs):
1695
1772
self.bus = bus
1696
1773
Client.__init__(self, *args, **kwargs)
1697
1774
# Only now, when this client is initialized, can it show up on
1703
1780
"/clients/" + client_object_name)
1704
1781
DBusObjectWithProperties.__init__(self, self.bus,
1705
1782
self.dbus_object_path)
1706
1783
1707
1784
def notifychangeproperty(transform_func, dbus_name,
1708
1785
type_func=lambda x: x,
1709
1786
variant_level=1,
1711
1788
_interface=_interface):
1712
1789
""" Modify a variable so that it's a property which announces
1713
1790
its changes to DBus.
1714
1791
1715
1792
transform_fun: Function that takes a value and a variant_level
1716
1793
and transforms it to a D-Bus type.
1717
1794
dbus_name: D-Bus name of the variable
1720
1797
variant_level: D-Bus variant level. Default: 1
1721
1798
"""
1722
1799
attrname = "_{}".format(dbus_name)
1723
1800
1724
1801
def setter(self, value):
1725
1802
if hasattr(self, "dbus_object_path"):
1726
1803
if (not hasattr(self, attrname) or
1733
1810
else:
1734
1811
dbus_value = transform_func(
1735
1812
type_func(value),
1736
variant_level = variant_level)
1813
variant_level=variant_level)
1737
1814
self.PropertyChanged(dbus.String(dbus_name),
1738
1815
dbus_value)
1739
1816
self.PropertiesChanged(
1740
1817
_interface,
1741
dbus.Dictionary({ dbus.String(dbus_name):
1742
dbus_value }),
1818
dbus.Dictionary({dbus.String(dbus_name):
1819
dbus_value}),
1743
1820
dbus.Array())
1744
1821
setattr(self, attrname, value)
1745
1822
1746
1823
return property(lambda self: getattr(self, attrname), setter)
1747
1824
1748
1825
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1749
1826
approvals_pending = notifychangeproperty(dbus.Boolean,
1750
1827
"ApprovalPending",
1751
type_func = bool)
1828
type_func=bool)
1752
1829
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1753
1830
last_enabled = notifychangeproperty(datetime_to_dbus,
1754
1831
"LastEnabled")
1755
1832
checker = notifychangeproperty(
1756
1833
dbus.Boolean, "CheckerRunning",
1757
type_func = lambda checker: checker is not None)
1834
type_func=lambda checker: checker is not None)
1758
1835
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1759
1836
"LastCheckedOK")
1760
1837
last_checker_status = notifychangeproperty(dbus.Int16,
1765
1842
"ApprovedByDefault")
1766
1843
approval_delay = notifychangeproperty(
1767
1844
dbus.UInt64, "ApprovalDelay",
1768
type_func = lambda td: td.total_seconds() * 1000)
1845
type_func=lambda td: td.total_seconds() * 1000)
1769
1846
approval_duration = notifychangeproperty(
1770
1847
dbus.UInt64, "ApprovalDuration",
1771
type_func = lambda td: td.total_seconds() * 1000)
1848
type_func=lambda td: td.total_seconds() * 1000)
1772
1849
host = notifychangeproperty(dbus.String, "Host")
1773
1850
timeout = notifychangeproperty(
1774
1851
dbus.UInt64, "Timeout",
1775
type_func = lambda td: td.total_seconds() * 1000)
1852
type_func=lambda td: td.total_seconds() * 1000)
1776
1853
extended_timeout = notifychangeproperty(
1777
1854
dbus.UInt64, "ExtendedTimeout",
1778
type_func = lambda td: td.total_seconds() * 1000)
1855
type_func=lambda td: td.total_seconds() * 1000)
1779
1856
interval = notifychangeproperty(
1780
1857
dbus.UInt64, "Interval",
1781
type_func = lambda td: td.total_seconds() * 1000)
1858
type_func=lambda td: td.total_seconds() * 1000)
1782
1859
checker_command = notifychangeproperty(dbus.String, "Checker")
1783
1860
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1784
1861
invalidate_only=True)
1785
1862
1786
1863
del notifychangeproperty
1787
1864
1788
1865
def __del__(self, *args, **kwargs):
1789
1866
try:
1790
1867
self.remove_from_connection()
1793
1870
if hasattr(DBusObjectWithProperties, "__del__"):
1794
1871
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1795
1872
Client.__del__(self, *args, **kwargs)
1796
1873
1797
1874
def checker_callback(self, source, condition,
1798
1875
connection, command, *args, **kwargs):
1799
1876
ret = Client.checker_callback(self, source, condition,
1815
1892
| self.last_checker_signal),
1816
1893
dbus.String(command))
1817
1894
return ret
1818
1895
1819
1896
def start_checker(self, *args, **kwargs):
1820
1897
old_checker_pid = getattr(self.checker, "pid", None)
1821
1898
r = Client.start_checker(self, *args, **kwargs)
1825
1902
# Emit D-Bus signal
1826
1903
self.CheckerStarted(self.current_checker_command)
1827
1904
return r
1828
1905
1829
1906
def _reset_approved(self):
1830
1907
self.approved = None
1831
1908
return False
1832
1909
1833
1910
def approve(self, value=True):
1834
1911
self.approved = value
1835
GObject.timeout_add(int(self.approval_duration.total_seconds()
1836
* 1000), self._reset_approved)
1912
GLib.timeout_add(int(self.approval_duration.total_seconds()
1913
* 1000), self._reset_approved)
1837
1914
self.send_changedstate()
1838
1839
## D-Bus methods, signals & properties
1840
1841
## Interfaces
1842
1843
## Signals
1844
1915
1916
# D-Bus methods, signals & properties
1917
1918
# Interfaces
1919
1920
# Signals
1921
1845
1922
# CheckerCompleted - signal
1846
1923
@dbus.service.signal(_interface, signature="nxs")
1847
1924
def CheckerCompleted(self, exitcode, waitstatus, command):
1848
1925
"D-Bus signal"
1849
1926
pass
1850
1927
1851
1928
# CheckerStarted - signal
1852
1929
@dbus.service.signal(_interface, signature="s")
1853
1930
def CheckerStarted(self, command):
1854
1931
"D-Bus signal"
1855
1932
pass
1856
1933
1857
1934
# PropertyChanged - signal
1858
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1859
1936
@dbus.service.signal(_interface, signature="sv")
1860
1937
def PropertyChanged(self, property, value):
1861
1938
"D-Bus signal"
1862
1939
pass
1863
1940
1864
1941
# GotSecret - signal
1865
1942
@dbus.service.signal(_interface)
1866
1943
def GotSecret(self):
1869
1946
server to mandos-client
1870
1947
"""
1871
1948
pass
1872
1949
1873
1950
# Rejected - signal
1874
1951
@dbus.service.signal(_interface, signature="s")
1875
1952
def Rejected(self, reason):
1876
1953
"D-Bus signal"
1877
1954
pass
1878
1955
1879
1956
# NeedApproval - signal
1880
1957
@dbus.service.signal(_interface, signature="tb")
1881
1958
def NeedApproval(self, timeout, default):
1882
1959
"D-Bus signal"
1883
1960
return self.need_approval()
1884
1885
## Methods
1886
1961
1962
# Methods
1963
1887
1964
# Approve - method
1888
1965
@dbus.service.method(_interface, in_signature="b")
1889
1966
def Approve(self, value):
1890
1967
self.approve(value)
1891
1968
1892
1969
# CheckedOK - method
1893
1970
@dbus.service.method(_interface)
1894
1971
def CheckedOK(self):
1895
1972
self.checked_ok()
1896
1973
1897
1974
# Enable - method
1898
1975
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1899
1976
@dbus.service.method(_interface)
1900
1977
def Enable(self):
1901
1978
"D-Bus method"
1902
1979
self.enable()
1903
1980
1904
1981
# StartChecker - method
1905
1982
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1906
1983
@dbus.service.method(_interface)
1907
1984
def StartChecker(self):
1908
1985
"D-Bus method"
1909
1986
self.start_checker()
1910
1987
1911
1988
# Disable - method
1912
1989
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1913
1990
@dbus.service.method(_interface)
1914
1991
def Disable(self):
1915
1992
"D-Bus method"
1916
1993
self.disable()
1917
1994
1918
1995
# StopChecker - method
1919
1996
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1920
1997
@dbus.service.method(_interface)
1921
1998
def StopChecker(self):
1922
1999
self.stop_checker()
1923
1924
## Properties
1925
2000
2001
# Properties
2002
1926
2003
# ApprovalPending - property
1927
2004
@dbus_service_property(_interface, signature="b", access="read")
1928
2005
def ApprovalPending_dbus_property(self):
1929
2006
return dbus.Boolean(bool(self.approvals_pending))
1930
2007
1931
2008
# ApprovedByDefault - property
1932
2009
@dbus_service_property(_interface,
1933
2010
signature="b",
1936
2013
if value is None: # get
1937
2014
return dbus.Boolean(self.approved_by_default)
1938
2015
self.approved_by_default = bool(value)
1939
2016
1940
2017
# ApprovalDelay - property
1941
2018
@dbus_service_property(_interface,
1942
2019
signature="t",
1946
2023
return dbus.UInt64(self.approval_delay.total_seconds()
1947
2024
* 1000)
1948
2025
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1949
2026
1950
2027
# ApprovalDuration - property
1951
2028
@dbus_service_property(_interface,
1952
2029
signature="t",
1956
2033
return dbus.UInt64(self.approval_duration.total_seconds()
1957
2034
* 1000)
1958
2035
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1959
2036
1960
2037
# Name - property
1961
2038
@dbus_annotations(
1962
2039
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1963
2040
@dbus_service_property(_interface, signature="s", access="read")
1964
2041
def Name_dbus_property(self):
1965
2042
return dbus.String(self.name)
1966
2043
2044
# KeyID - property
2045
@dbus_annotations(
2046
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2047
@dbus_service_property(_interface, signature="s", access="read")
2048
def KeyID_dbus_property(self):
2049
return dbus.String(self.key_id)
2050
1967
2051
# Fingerprint - property
1968
2052
@dbus_annotations(
1969
2053
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1970
2054
@dbus_service_property(_interface, signature="s", access="read")
1971
2055
def Fingerprint_dbus_property(self):
1972
2056
return dbus.String(self.fingerprint)
1973
2057
1974
2058
# Host - property
1975
2059
@dbus_service_property(_interface,
1976
2060
signature="s",
1979
2063
if value is None: # get
1980
2064
return dbus.String(self.host)
1981
2065
self.host = str(value)
1982
2066
1983
2067
# Created - property
1984
2068
@dbus_annotations(
1985
2069
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
2070
@dbus_service_property(_interface, signature="s", access="read")
1987
2071
def Created_dbus_property(self):
1988
2072
return datetime_to_dbus(self.created)
1989
2073
1990
2074
# LastEnabled - property
1991
2075
@dbus_service_property(_interface, signature="s", access="read")
1992
2076
def LastEnabled_dbus_property(self):
1993
2077
return datetime_to_dbus(self.last_enabled)
1994
2078
1995
2079
# Enabled - property
1996
2080
@dbus_service_property(_interface,
1997
2081
signature="b",
2003
2087
self.enable()
2004
2088
else:
2005
2089
self.disable()
2006
2090
2007
2091
# LastCheckedOK - property
2008
2092
@dbus_service_property(_interface,
2009
2093
signature="s",
2013
2097
self.checked_ok()
2014
2098
return
2015
2099
return datetime_to_dbus(self.last_checked_ok)
2016
2100
2017
2101
# LastCheckerStatus - property
2018
2102
@dbus_service_property(_interface, signature="n", access="read")
2019
2103
def LastCheckerStatus_dbus_property(self):
2020
2104
return dbus.Int16(self.last_checker_status)
2021
2105
2022
2106
# Expires - property
2023
2107
@dbus_service_property(_interface, signature="s", access="read")
2024
2108
def Expires_dbus_property(self):
2025
2109
return datetime_to_dbus(self.expires)
2026
2110
2027
2111
# LastApprovalRequest - property
2028
2112
@dbus_service_property(_interface, signature="s", access="read")
2029
2113
def LastApprovalRequest_dbus_property(self):
2030
2114
return datetime_to_dbus(self.last_approval_request)
2031
2115
2032
2116
# Timeout - property
2033
2117
@dbus_service_property(_interface,
2034
2118
signature="t",
2049
2133
if (getattr(self, "disable_initiator_tag", None)
2050
2134
is None):
2051
2135
return
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2136
GLib.source_remove(self.disable_initiator_tag)
2137
self.disable_initiator_tag = GLib.timeout_add(
2054
2138
int((self.expires - now).total_seconds() * 1000),
2055
2139
self.disable)
2056
2140
2057
2141
# ExtendedTimeout - property
2058
2142
@dbus_service_property(_interface,
2059
2143
signature="t",
2063
2147
return dbus.UInt64(self.extended_timeout.total_seconds()
2064
2148
* 1000)
2065
2149
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2066
2150
2067
2151
# Interval - property
2068
2152
@dbus_service_property(_interface,
2069
2153
signature="t",
2076
2160
return
2077
2161
if self.enabled:
2078
2162
# Reschedule checker run
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2163
GLib.source_remove(self.checker_initiator_tag)
2164
self.checker_initiator_tag = GLib.timeout_add(
2081
2165
value, self.start_checker)
2082
self.start_checker() # Start one now, too
2083
2166
self.start_checker() # Start one now, too
2167
2084
2168
# Checker - property
2085
2169
@dbus_service_property(_interface,
2086
2170
signature="s",
2089
2173
if value is None: # get
2090
2174
return dbus.String(self.checker_command)
2091
2175
self.checker_command = str(value)
2092
2176
2093
2177
# CheckerRunning - property
2094
2178
@dbus_service_property(_interface,
2095
2179
signature="b",
2101
2185
self.start_checker()
2102
2186
else:
2103
2187
self.stop_checker()
2104
2188
2105
2189
# ObjectPath - property
2106
2190
@dbus_annotations(
2107
2191
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2108
2192
"org.freedesktop.DBus.Deprecated": "true"})
2109
2193
@dbus_service_property(_interface, signature="o", access="read")
2110
2194
def ObjectPath_dbus_property(self):
2111
return self.dbus_object_path # is already a dbus.ObjectPath
2112
2195
return self.dbus_object_path # is already a dbus.ObjectPath
2196
2113
2197
# Secret = property
2114
2198
@dbus_annotations(
2115
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2120
2204
byte_arrays=True)
2121
2205
def Secret_dbus_property(self, value):
2122
2206
self.secret = bytes(value)
2123
2207
2124
2208
del _interface
2125
2209
2126
2210
2127
2211
class ProxyClient(object):
2128
def __init__(self, child_pipe, fpr, address):
2212
def __init__(self, child_pipe, key_id, fpr, address):
2129
2213
self._pipe = child_pipe
2130
self._pipe.send(('init', fpr, address))
2214
self._pipe.send(('init', key_id, fpr, address))
2131
2215
if not self._pipe.recv():
2132
raise KeyError(fpr)
2133
2216
raise KeyError(key_id or fpr)
2217
2134
2218
def __getattribute__(self, name):
2135
2219
if name == '_pipe':
2136
2220
return super(ProxyClient, self).__getattribute__(name)
2139
2223
if data[0] == 'data':
2140
2224
return data[1]
2141
2225
if data[0] == 'function':
2142
2226
2143
2227
def func(*args, **kwargs):
2144
2228
self._pipe.send(('funcall', name, args, kwargs))
2145
2229
return self._pipe.recv()[1]
2146
2230
2147
2231
return func
2148
2232
2149
2233
def __setattr__(self, name, value):
2150
2234
if name == '_pipe':
2151
2235
return super(ProxyClient, self).__setattr__(name, value)
2154
2238
2155
2239
class ClientHandler(socketserver.BaseRequestHandler, object):
2156
2240
"""A class to handle client connections.
2157
2241
2158
2242
Instantiated once for each connection to handle it.
2159
2243
Note: This will run in its own forked process."""
2160
2244
2161
2245
def handle(self):
2162
2246
with contextlib.closing(self.server.child_pipe) as child_pipe:
2163
2247
logger.info("TCP connection from: %s",
2164
2248
str(self.client_address))
2165
2249
logger.debug("Pipe FD: %d",
2166
2250
self.server.child_pipe.fileno())
2167
2251
2168
2252
session = gnutls.ClientSession(self.request)
2169
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2173
# "+DHE-DSS"))
2253
2254
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2255
# "+AES-256-CBC", "+SHA1",
2256
# "+COMP-NULL", "+CTYPE-OPENPGP",
2257
# "+DHE-DSS"))
2174
2258
# Use a fallback default, since this MUST be set.
2175
2259
priority = self.server.gnutls_priority
2176
2260
if priority is None:
2177
2261
priority = "NORMAL"
2178
gnutls.priority_set_direct(session._c_object, priority,
2262
gnutls.priority_set_direct(session._c_object,
2263
priority.encode("utf-8"),
2179
2264
None)
2180
2265
2181
2266
# Start communication using the Mandos protocol
2182
2267
# Get protocol number
2183
2268
line = self.request.makefile().readline()
2188
2273
except (ValueError, IndexError, RuntimeError) as error:
2189
2274
logger.error("Unknown protocol version: %s", error)
2190
2275
return
2191
2276
2192
2277
# Start GnuTLS connection
2193
2278
try:
2194
2279
session.handshake()
2198
2283
# established. Just abandon the request.
2199
2284
return
2200
2285
logger.debug("Handshake succeeded")
2201
2286
2202
2287
approval_required = False
2203
2288
try:
2204
try:
2205
fpr = self.fingerprint(
2206
self.peer_certificate(session))
2207
except (TypeError, gnutls.Error) as error:
2208
logger.warning("Bad certificate: %s", error)
2209
return
2210
logger.debug("Fingerprint: %s", fpr)
2211
2212
try:
2213
client = ProxyClient(child_pipe, fpr,
2289
if gnutls.has_rawpk:
2290
fpr = ""
2291
try:
2292
key_id = self.key_id(
2293
self.peer_certificate(session))
2294
except (TypeError, gnutls.Error) as error:
2295
logger.warning("Bad certificate: %s", error)
2296
return
2297
logger.debug("Key ID: %s", key_id)
2298
2299
else:
2300
key_id = ""
2301
try:
2302
fpr = self.fingerprint(
2303
self.peer_certificate(session))
2304
except (TypeError, gnutls.Error) as error:
2305
logger.warning("Bad certificate: %s", error)
2306
return
2307
logger.debug("Fingerprint: %s", fpr)
2308
2309
try:
2310
client = ProxyClient(child_pipe, key_id, fpr,
2214
2311
self.client_address)
2215
2312
except KeyError:
2216
2313
return
2217
2314
2218
2315
if client.approval_delay:
2219
2316
delay = client.approval_delay
2220
2317
client.approvals_pending += 1
2221
2318
approval_required = True
2222
2319
2223
2320
while True:
2224
2321
if not client.enabled:
2225
2322
logger.info("Client %s is disabled",
2228
2325
# Emit D-Bus signal
2229
2326
client.Rejected("Disabled")
2230
2327
return
2231
2328
2232
2329
if client.approved or not client.approval_delay:
2233
#We are approved or approval is disabled
2330
# We are approved or approval is disabled
2234
2331
break
2235
2332
elif client.approved is None:
2236
2333
logger.info("Client %s needs approval",
2247
2344
# Emit D-Bus signal
2248
2345
client.Rejected("Denied")
2249
2346
return
2250
2251
#wait until timeout or approved
2347
2348
# wait until timeout or approved
2252
2349
time = datetime.datetime.now()
2253
2350
client.changedstate.acquire()
2254
2351
client.changedstate.wait(delay.total_seconds())
2267
2364
break
2268
2365
else:
2269
2366
delay -= time2 - time
2270
2367
2271
2368
try:
2272
2369
session.send(client.secret)
2273
2370
except gnutls.Error as error:
2274
2371
logger.warning("gnutls send failed",
2275
exc_info = error)
2372
exc_info=error)
2276
2373
return
2277
2374
2278
2375
logger.info("Sending secret to %s", client.name)
2279
2376
# bump the timeout using extended_timeout
2280
2377
client.bump_timeout(client.extended_timeout)
2281
2378
if self.server.use_dbus:
2282
2379
# Emit D-Bus signal
2283
2380
client.GotSecret()
2284
2381
2285
2382
finally:
2286
2383
if approval_required:
2287
2384
client.approvals_pending -= 1
2290
2387
except gnutls.Error as error:
2291
2388
logger.warning("GnuTLS bye failed",
2292
2389
exc_info=error)
2293
2390
2294
2391
@staticmethod
2295
2392
def peer_certificate(session):
2296
"Return the peer's OpenPGP certificate as a bytestring"
2297
# If not an OpenPGP certificate...
2298
if (gnutls.certificate_type_get(session._c_object)
2299
!= gnutls.CRT_OPENPGP):
2393
"Return the peer's certificate as a bytestring"
2394
try:
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2396
gnutls.CTYPE_PEERS)
2397
except AttributeError:
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2399
if gnutls.has_rawpk:
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2401
else:
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
# If not a valid certificate type...
2404
if cert_type not in valid_cert_types:
2405
logger.info("Cert type %r not in %r", cert_type,
2406
valid_cert_types)
2300
2407
# ...return invalid data
2301
2408
return b""
2302
2409
list_size = ctypes.c_uint(1)
2308
2415
return None
2309
2416
cert = cert_list[0]
2310
2417
return ctypes.string_at(cert.data, cert.size)
2311
2418
2419
@staticmethod
2420
def key_id(certificate):
2421
"Convert a certificate bytestring to a hexdigit key ID"
2422
# New GnuTLS "datum" with the public key
2423
datum = gnutls.datum_t(
2424
ctypes.cast(ctypes.c_char_p(certificate),
2425
ctypes.POINTER(ctypes.c_ubyte)),
2426
ctypes.c_uint(len(certificate)))
2427
# XXX all these need to be created in the gnutls "module"
2428
# New empty GnuTLS certificate
2429
pubkey = gnutls.pubkey_t()
2430
gnutls.pubkey_init(ctypes.byref(pubkey))
2431
# Import the raw public key into the certificate
2432
gnutls.pubkey_import(pubkey,
2433
ctypes.byref(datum),
2434
gnutls.X509_FMT_DER)
2435
# New buffer for the key ID
2436
buf = ctypes.create_string_buffer(32)
2437
buf_len = ctypes.c_size_t(len(buf))
2438
# Get the key ID from the raw public key into the buffer
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2444
# Deinit the certificate
2445
gnutls.pubkey_deinit(pubkey)
2446
2447
# Convert the buffer to a Python bytestring
2448
key_id = ctypes.string_at(buf, buf_len.value)
2449
# Convert the bytestring to hexadecimal notation
2450
hex_key_id = binascii.hexlify(key_id).upper()
2451
return hex_key_id
2452
2312
2453
@staticmethod
2313
2454
def fingerprint(openpgp):
2314
2455
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2329
2470
ctypes.byref(crtverify))
2330
2471
if crtverify.value != 0:
2331
2472
gnutls.openpgp_crt_deinit(crt)
2332
raise gnutls.CertificateSecurityError("Verify failed")
2473
raise gnutls.CertificateSecurityError(code
2474
=crtverify.value)
2333
2475
# New buffer for the fingerprint
2334
2476
buf = ctypes.create_string_buffer(20)
2335
2477
buf_len = ctypes.c_size_t()
2347
2489
2348
2490
class MultiprocessingMixIn(object):
2349
2491
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2350
2492
2351
2493
def sub_process_main(self, request, address):
2352
2494
try:
2353
2495
self.finish_request(request, address)
2354
2496
except Exception:
2355
2497
self.handle_error(request, address)
2356
2498
self.close_request(request)
2357
2499
2358
2500
def process_request(self, request, address):
2359
2501
"""Start a new process to process the request."""
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2502
proc = multiprocessing.Process(target=self.sub_process_main,
2503
args=(request, address))
2362
2504
proc.start()
2363
2505
return proc
2364
2506
2365
2507
2366
2508
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2367
2509
""" adds a pipe to the MixIn """
2368
2510
2369
2511
def process_request(self, request, client_address):
2370
2512
"""Overrides and wraps the original process_request().
2371
2513
2372
2514
This function creates a new pipe in self.pipe
2373
2515
"""
2374
2516
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2375
2517
2376
2518
proc = MultiprocessingMixIn.process_request(self, request,
2377
2519
client_address)
2378
2520
self.child_pipe.close()
2379
2521
self.add_pipe(parent_pipe, proc)
2380
2522
2381
2523
def add_pipe(self, parent_pipe, proc):
2382
2524
"""Dummy function; override as necessary"""
2383
2525
raise NotImplementedError()
2386
2528
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2387
2529
socketserver.TCPServer, object):
2388
2530
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2389
2531
2390
2532
Attributes:
2391
2533
enabled: Boolean; whether this server is activated yet
2392
2534
interface: None or a network interface name (string)
2393
2535
use_ipv6: Boolean; to use IPv6 or not
2394
2536
"""
2395
2537
2396
2538
def __init__(self, server_address, RequestHandlerClass,
2397
2539
interface=None,
2398
2540
use_ipv6=True,
2408
2550
self.socketfd = socketfd
2409
2551
# Save the original socket.socket() function
2410
2552
self.socket_socket = socket.socket
2553
2411
2554
# To implement --socket, we monkey patch socket.socket.
2412
#
2555
#
2413
2556
# (When socketserver.TCPServer is a new-style class, we
2414
2557
# could make self.socket into a property instead of monkey
2415
2558
# patching socket.socket.)
2416
#
2559
#
2417
2560
# Create a one-time-only replacement for socket.socket()
2418
2561
@functools.wraps(socket.socket)
2419
2562
def socket_wrapper(*args, **kwargs):
2431
2574
# socket_wrapper(), if socketfd was set.
2432
2575
socketserver.TCPServer.__init__(self, server_address,
2433
2576
RequestHandlerClass)
2434
2577
2435
2578
def server_bind(self):
2436
2579
"""This overrides the normal server_bind() function
2437
2580
to bind to an interface if one was specified, and also NOT to
2438
2581
bind to an address or port if they were not specified."""
2582
global SO_BINDTODEVICE
2439
2583
if self.interface is not None:
2440
2584
if SO_BINDTODEVICE is None:
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2443
self.interface)
2444
else:
2445
try:
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2456
self.interface)
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2460
else:
2461
raise
2585
# Fall back to a hard-coded value which seems to be
2586
# common enough.
2587
logger.warning("SO_BINDTODEVICE not found, trying 25")
2588
SO_BINDTODEVICE = 25
2589
try:
2590
self.socket.setsockopt(
2591
socket.SOL_SOCKET, SO_BINDTODEVICE,
2592
(self.interface + "\0").encode("utf-8"))
2593
except socket.error as error:
2594
if error.errno == errno.EPERM:
2595
logger.error("No permission to bind to"
2596
" interface %s", self.interface)
2597
elif error.errno == errno.ENOPROTOOPT:
2598
logger.error("SO_BINDTODEVICE not available;"
2599
" cannot bind to interface %s",
2600
self.interface)
2601
elif error.errno == errno.ENODEV:
2602
logger.error("Interface %s does not exist,"
2603
" cannot bind", self.interface)
2604
else:
2605
raise
2462
2606
# Only bind(2) the socket if we really need to.
2463
2607
if self.server_address[0] or self.server_address[1]:
2608
if self.server_address[1]:
2609
self.allow_reuse_address = True
2464
2610
if not self.server_address[0]:
2465
2611
if self.address_family == socket.AF_INET6:
2466
any_address = "::" # in6addr_any
2612
any_address = "::" # in6addr_any
2467
2613
else:
2468
any_address = "0.0.0.0" # INADDR_ANY
2614
any_address = "0.0.0.0" # INADDR_ANY
2469
2615
self.server_address = (any_address,
2470
2616
self.server_address[1])
2471
2617
elif not self.server_address[1]:
2481
2627
2482
2628
class MandosServer(IPv6_TCPServer):
2483
2629
"""Mandos server.
2484
2630
2485
2631
Attributes:
2486
2632
clients: set of Client objects
2487
2633
gnutls_priority GnuTLS priority string
2488
2634
use_dbus: Boolean; to emit D-Bus signals or not
2489
2490
Assumes a GObject.MainLoop event loop.
2635
2636
Assumes a GLib.MainLoop event loop.
2491
2637
"""
2492
2638
2493
2639
def __init__(self, server_address, RequestHandlerClass,
2494
2640
interface=None,
2495
2641
use_ipv6=True,
2505
2651
self.gnutls_priority = gnutls_priority
2506
2652
IPv6_TCPServer.__init__(self, server_address,
2507
2653
RequestHandlerClass,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2511
2654
interface=interface,
2655
use_ipv6=use_ipv6,
2656
socketfd=socketfd)
2657
2512
2658
def server_activate(self):
2513
2659
if self.enabled:
2514
2660
return socketserver.TCPServer.server_activate(self)
2515
2661
2516
2662
def enable(self):
2517
2663
self.enabled = True
2518
2664
2519
2665
def add_pipe(self, parent_pipe, proc):
2520
2666
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2667
GLib.io_add_watch(
2522
2668
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2669
GLib.IO_IN | GLib.IO_HUP,
2524
2670
functools.partial(self.handle_ipc,
2525
parent_pipe = parent_pipe,
2526
proc = proc))
2527
2671
parent_pipe=parent_pipe,
2672
proc=proc))
2673
2528
2674
def handle_ipc(self, source, condition,
2529
2675
parent_pipe=None,
2530
proc = None,
2676
proc=None,
2531
2677
client_object=None):
2532
2678
# error, or the other end of multiprocessing.Pipe has closed
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2679
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2534
2680
# Wait for other process to exit
2535
2681
proc.join()
2536
2682
return False
2537
2683
2538
2684
# Read a request from the child
2539
2685
request = parent_pipe.recv()
2540
2686
command = request[0]
2541
2687
2542
2688
if command == 'init':
2543
fpr = request[1]
2544
address = request[2]
2545
2689
key_id = request[1].decode("ascii")
2690
fpr = request[2].decode("ascii")
2691
address = request[3]
2692
2546
2693
for c in self.clients.values():
2547
if c.fingerprint == fpr:
2694
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2695
continue
2696
if key_id and c.key_id == key_id:
2697
client = c
2698
break
2699
if fpr and c.fingerprint == fpr:
2548
2700
client = c
2549
2701
break
2550
2702
else:
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2703
logger.info("Client not found for key ID: %s, address"
2704
": %s", key_id or fpr, address)
2553
2705
if self.use_dbus:
2554
2706
# Emit D-Bus signal
2555
mandos_dbus_service.ClientNotFound(fpr,
2707
mandos_dbus_service.ClientNotFound(key_id or fpr,
2556
2708
address[0])
2557
2709
parent_pipe.send(False)
2558
2710
return False
2559
2560
GObject.io_add_watch(
2711
2712
GLib.io_add_watch(
2561
2713
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2714
GLib.IO_IN | GLib.IO_HUP,
2563
2715
functools.partial(self.handle_ipc,
2564
parent_pipe = parent_pipe,
2565
proc = proc,
2566
client_object = client))
2716
parent_pipe=parent_pipe,
2717
proc=proc,
2718
client_object=client))
2567
2719
parent_pipe.send(True)
2568
2720
# remove the old hook in favor of the new above hook on
2569
2721
# same fileno
2572
2724
funcname = request[1]
2573
2725
args = request[2]
2574
2726
kwargs = request[3]
2575
2727
2576
2728
parent_pipe.send(('data', getattr(client_object,
2577
2729
funcname)(*args,
2578
2730
**kwargs)))
2579
2731
2580
2732
if command == 'getattr':
2581
2733
attrname = request[1]
2582
2734
if isinstance(client_object.__getattribute__(attrname),
2585
2737
else:
2586
2738
parent_pipe.send((
2587
2739
'data', client_object.__getattribute__(attrname)))
2588
2740
2589
2741
if command == 'setattr':
2590
2742
attrname = request[1]
2591
2743
value = request[2]
2592
2744
setattr(client_object, attrname, value)
2593
2745
2594
2746
return True
2595
2747
2596
2748
2597
2749
def rfc3339_duration_to_delta(duration):
2598
2750
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2599
2751
2600
2752
>>> rfc3339_duration_to_delta("P7D")
2601
2753
datetime.timedelta(7)
2602
2754
>>> rfc3339_duration_to_delta("PT60S")
2612
2764
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
2765
datetime.timedelta(1, 200)
2614
2766
"""
2615
2767
2616
2768
# Parsing an RFC 3339 duration with regular expressions is not
2617
2769
# possible - there would have to be multiple places for the same
2618
2770
# values, like seconds. The current code, while more esoteric, is
2619
2771
# cleaner without depending on a parsing library. If Python had a
2620
2772
# built-in library for parsing we would use it, but we'd like to
2621
2773
# avoid excessive use of external libraries.
2622
2774
2623
2775
# New type for defining tokens, syntax, and semantics all-in-one
2624
2776
Token = collections.namedtuple("Token", (
2625
2777
"regexp", # To match token; if "value" is not None, must have
2658
2810
frozenset((token_year, token_month,
2659
2811
token_day, token_time,
2660
2812
token_week)))
2661
# Define starting values
2662
value = datetime.timedelta() # Value so far
2813
# Define starting values:
2814
# Value so far
2815
value = datetime.timedelta()
2663
2816
found_token = None
2664
followers = frozenset((token_duration, )) # Following valid tokens
2665
s = duration # String left to parse
2817
# Following valid tokens
2818
followers = frozenset((token_duration, ))
2819
# String left to parse
2820
s = duration
2666
2821
# Loop until end token is found
2667
2822
while found_token is not token_end:
2668
2823
# Search for any currently valid tokens
2692
2847
2693
2848
def string_to_delta(interval):
2694
2849
"""Parse a string and return a datetime.timedelta
2695
2850
2696
2851
>>> string_to_delta('7d')
2697
2852
datetime.timedelta(7)
2698
2853
>>> string_to_delta('60s')
2706
2861
>>> string_to_delta('5m 30s')
2707
2862
datetime.timedelta(0, 330)
2708
2863
"""
2709
2864
2710
2865
try:
2711
2866
return rfc3339_duration_to_delta(interval)
2712
2867
except ValueError:
2713
2868
pass
2714
2869
2715
2870
timevalue = datetime.timedelta(0)
2716
2871
for s in interval.split():
2717
2872
try:
2735
2890
return timevalue
2736
2891
2737
2892
2738
def daemon(nochdir = False, noclose = False):
2893
def daemon(nochdir=False, noclose=False):
2739
2894
"""See daemon(3). Standard BSD Unix function.
2740
2895
2741
2896
This should really exist as os.daemon, but it doesn't (yet)."""
2742
2897
if os.fork():
2743
2898
sys.exit()
2761
2916
2762
2917
2763
2918
def main():
2764
2919
2765
2920
##################################################################
2766
2921
# Parsing of options, both command line and config file
2767
2922
2768
2923
parser = argparse.ArgumentParser()
2769
2924
parser.add_argument("-v", "--version", action="version",
2770
version = "%(prog)s {}".format(version),
2925
version="%(prog)s {}".format(version),
2771
2926
help="show version number and exit")
2772
2927
parser.add_argument("-i", "--interface", metavar="IF",
2773
2928
help="Bind to interface IF")
2809
2964
parser.add_argument("--no-zeroconf", action="store_false",
2810
2965
dest="zeroconf", help="Do not use Zeroconf",
2811
2966
default=None)
2812
2967
2813
2968
options = parser.parse_args()
2814
2969
2815
2970
if options.check:
2816
2971
import doctest
2817
2972
fail_count, test_count = doctest.testmod()
2818
2973
sys.exit(os.EX_OK if fail_count == 0 else 1)
2819
2974
2820
2975
# Default values for config file for server-global settings
2821
server_defaults = { "interface": "",
2822
"address": "",
2823
"port": "",
2824
"debug": "False",
2825
"priority":
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2829
"use_dbus": "True",
2830
"use_ipv6": "True",
2831
"debuglevel": "",
2832
"restore": "True",
2833
"socket": "",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2836
"zeroconf": "True",
2837
}
2838
2976
if gnutls.has_rawpk:
2977
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2978
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2979
else:
2980
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2981
":+SIGN-DSA-SHA256")
2982
server_defaults = {"interface": "",
2983
"address": "",
2984
"port": "",
2985
"debug": "False",
2986
"priority": priority,
2987
"servicename": "Mandos",
2988
"use_dbus": "True",
2989
"use_ipv6": "True",
2990
"debuglevel": "",
2991
"restore": "True",
2992
"socket": "",
2993
"statedir": "/var/lib/mandos",
2994
"foreground": "False",
2995
"zeroconf": "True",
2996
}
2997
del priority
2998
2839
2999
# Parse config file for server-global settings
2840
3000
server_config = configparser.SafeConfigParser(server_defaults)
2841
3001
del server_defaults
2843
3003
# Convert the SafeConfigParser object to a dict
2844
3004
server_settings = server_config.defaults()
2845
3005
# Use the appropriate methods on the non-string config options
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3006
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3007
"foreground", "zeroconf"):
2847
3008
server_settings[option] = server_config.getboolean("DEFAULT",
2848
3009
option)
2849
3010
if server_settings["port"]:
2859
3020
server_settings["socket"] = os.dup(server_settings
2860
3021
["socket"])
2861
3022
del server_config
2862
3023
2863
3024
# Override the settings from the config file with command line
2864
3025
# options, if set.
2865
3026
for option in ("interface", "address", "port", "debug",
2883
3044
if server_settings["debug"]:
2884
3045
server_settings["foreground"] = True
2885
3046
# Now we have our good server settings in "server_settings"
2886
3047
2887
3048
##################################################################
2888
3049
2889
3050
if (not server_settings["zeroconf"]
2890
3051
and not (server_settings["port"]
2891
3052
or server_settings["socket"] != "")):
2892
3053
parser.error("Needs port or socket to work without Zeroconf")
2893
3054
2894
3055
# For convenience
2895
3056
debug = server_settings["debug"]
2896
3057
debuglevel = server_settings["debuglevel"]
2900
3061
stored_state_file)
2901
3062
foreground = server_settings["foreground"]
2902
3063
zeroconf = server_settings["zeroconf"]
2903
3064
2904
3065
if debug:
2905
3066
initlogger(debug, logging.DEBUG)
2906
3067
else:
2909
3070
else:
2910
3071
level = getattr(logging, debuglevel.upper())
2911
3072
initlogger(debug, level)
2912
3073
2913
3074
if server_settings["servicename"] != "Mandos":
2914
3075
syslogger.setFormatter(
2915
3076
logging.Formatter('Mandos ({}) [%(process)d]:'
2916
3077
' %(levelname)s: %(message)s'.format(
2917
3078
server_settings["servicename"])))
2918
3079
2919
3080
# Parse config file with clients
2920
3081
client_config = configparser.SafeConfigParser(Client
2921
3082
.client_defaults)
2922
3083
client_config.read(os.path.join(server_settings["configdir"],
2923
3084
"clients.conf"))
2924
3085
2925
3086
global mandos_dbus_service
2926
3087
mandos_dbus_service = None
2927
3088
2928
3089
socketfd = None
2929
3090
if server_settings["socket"] != "":
2930
3091
socketfd = server_settings["socket"]
2946
3107
except IOError as e:
2947
3108
logger.error("Could not open file %r", pidfilename,
2948
3109
exc_info=e)
2949
3110
2950
3111
for name, group in (("_mandos", "_mandos"),
2951
3112
("mandos", "mandos"),
2952
3113
("nobody", "nogroup")):
2970
3131
.format(uid, gid, os.strerror(error.errno)))
2971
3132
if error.errno != errno.EPERM:
2972
3133
raise
2973
3134
2974
3135
if debug:
2975
3136
# Enable all possible GnuTLS debugging
2976
3137
2977
3138
# "Use a log level over 10 to enable all debugging options."
2978
3139
# - GnuTLS manual
2979
3140
gnutls.global_set_log_level(11)
2980
3141
2981
3142
@gnutls.log_func
2982
3143
def debug_gnutls(level, string):
2983
3144
logger.debug("GnuTLS: %s", string[:-1])
2984
3145
2985
3146
gnutls.global_set_log_function(debug_gnutls)
2986
3147
2987
3148
# Redirect stdin so all checkers get /dev/null
2988
3149
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2989
3150
os.dup2(null, sys.stdin.fileno())
2990
3151
if null > 2:
2991
3152
os.close(null)
2992
3153
2993
3154
# Need to fork before connecting to D-Bus
2994
3155
if not foreground:
2995
3156
# Close all input and output, do double fork, etc.
2996
3157
daemon()
2997
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
3001
3158
3159
# multiprocessing will use threads, so before we use GLib we need
3160
# to inform GLib that threads will be used.
3161
GLib.threads_init()
3162
3002
3163
global main_loop
3003
3164
# From the Avahi example code
3004
3165
DBusGMainLoop(set_as_default=True)
3005
main_loop = GObject.MainLoop()
3166
main_loop = GLib.MainLoop()
3006
3167
bus = dbus.SystemBus()
3007
3168
# End of Avahi example code
3008
3169
if use_dbus:
3021
3182
if zeroconf:
3022
3183
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3023
3184
service = AvahiServiceToSyslog(
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3027
bus = bus)
3185
name=server_settings["servicename"],
3186
servicetype="_mandos._tcp",
3187
protocol=protocol,
3188
bus=bus)
3028
3189
if server_settings["interface"]:
3029
3190
service.interface = if_nametoindex(
3030
3191
server_settings["interface"].encode("utf-8"))
3031
3192
3032
3193
global multiprocessing_manager
3033
3194
multiprocessing_manager = multiprocessing.Manager()
3034
3195
3035
3196
client_class = Client
3036
3197
if use_dbus:
3037
client_class = functools.partial(ClientDBus, bus = bus)
3038
3198
client_class = functools.partial(ClientDBus, bus=bus)
3199
3039
3200
client_settings = Client.config_parser(client_config)
3040
3201
old_client_settings = {}
3041
3202
clients_data = {}
3042
3203
3043
3204
# This is used to redirect stdout and stderr for checker processes
3044
3205
global wnull
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3206
wnull = open(os.devnull, "w") # A writable /dev/null
3046
3207
# Only used if server is running in foreground but not in debug
3047
3208
# mode
3048
3209
if debug or not foreground:
3049
3210
wnull.close()
3050
3211
3051
3212
# Get client data and settings from last running state.
3052
3213
if server_settings["restore"]:
3053
3214
try:
3054
3215
with open(stored_state_path, "rb") as stored_state:
3055
if sys.version_info.major == 2:
3216
if sys.version_info.major == 2:
3056
3217
clients_data, old_client_settings = pickle.load(
3057
3218
stored_state)
3058
3219
else:
3059
3220
bytes_clients_data, bytes_old_client_settings = (
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3062
## clients_data
3221
pickle.load(stored_state, encoding="bytes"))
3222
# Fix bytes to strings
3223
# clients_data
3063
3224
# .keys()
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3066
else key): value
3067
for key, value in
3068
bytes_clients_data.items() }
3225
clients_data = {(key.decode("utf-8")
3226
if isinstance(key, bytes)
3227
else key): value
3228
for key, value in
3229
bytes_clients_data.items()}
3230
del bytes_clients_data
3069
3231
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3232
value = {(k.decode("utf-8")
3233
if isinstance(k, bytes) else k): v
3234
for k, v in
3235
clients_data[key].items()}
3074
3236
clients_data[key] = value
3075
3237
# .client_structure
3076
3238
value["client_structure"] = [
3077
3239
(s.decode("utf-8")
3078
3240
if isinstance(s, bytes)
3079
3241
else s) for s in
3080
value["client_structure"] ]
3242
value["client_structure"]]
3081
3243
# .name & .host
3082
3244
for k in ("name", "host"):
3083
3245
if isinstance(value[k], bytes):
3084
3246
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys
3247
if not value.has_key("key_id"):
3248
value["key_id"] = ""
3249
elif not value.has_key("fingerprint"):
3250
value["fingerprint"] = ""
3251
# old_client_settings
3252
# .keys()
3087
3253
old_client_settings = {
3088
3254
(key.decode("utf-8")
3089
3255
if isinstance(key, bytes)
3090
3256
else key): value
3091
3257
for key, value in
3092
bytes_old_client_settings.items() }
3258
bytes_old_client_settings.items()}
3259
del bytes_old_client_settings
3093
3260
# .host
3094
3261
for value in old_client_settings.values():
3095
value["host"] = value["host"].decode("utf-8")
3262
if isinstance(value["host"], bytes):
3263
value["host"] = (value["host"]
3264
.decode("utf-8"))
3096
3265
os.remove(stored_state_path)
3097
3266
except IOError as e:
3098
3267
if e.errno == errno.ENOENT:
3106
3275
logger.warning("Could not load persistent state: "
3107
3276
"EOFError:",
3108
3277
exc_info=e)
3109
3278
3110
3279
with PGPEngine() as pgp:
3111
3280
for client_name, client in clients_data.items():
3112
3281
# Skip removed clients
3113
3282
if client_name not in client_settings:
3114
3283
continue
3115
3284
3116
3285
# Decide which value to use after restoring saved state.
3117
3286
# We have three different values: Old config file,
3118
3287
# new config file, and saved state.
3129
3298
client[name] = value
3130
3299
except KeyError:
3131
3300
pass
3132
3301
3133
3302
# Clients who has passed its expire date can still be
3134
3303
# enabled if its last checker was successful. A Client
3135
3304
# whose checker succeeded before we stored its state is
3168
3337
client_name))
3169
3338
client["secret"] = (client_settings[client_name]
3170
3339
["secret"])
3171
3340
3172
3341
# Add/remove clients based on new changes made to config
3173
3342
for client_name in (set(old_client_settings)
3174
3343
- set(client_settings)):
3176
3345
for client_name in (set(client_settings)
3177
3346
- set(old_client_settings)):
3178
3347
clients_data[client_name] = client_settings[client_name]
3179
3348
3180
3349
# Create all client objects
3181
3350
for client_name, client in clients_data.items():
3182
3351
tcp_server.clients[client_name] = client_class(
3183
name = client_name,
3184
settings = client,
3185
server_settings = server_settings)
3186
3352
name=client_name,
3353
settings=client,
3354
server_settings=server_settings)
3355
3187
3356
if not tcp_server.clients:
3188
3357
logger.warning("No clients defined")
3189
3358
3190
3359
if not foreground:
3191
3360
if pidfile is not None:
3192
3361
pid = os.getpid()
3198
3367
pidfilename, pid)
3199
3368
del pidfile
3200
3369
del pidfilename
3201
3202
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3203
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3204
3370
3371
for termsig in (signal.SIGHUP, signal.SIGTERM):
3372
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3373
lambda: main_loop.quit() and False)
3374
3205
3375
if use_dbus:
3206
3376
3207
3377
@alternate_dbus_interfaces(
3208
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3378
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3209
3379
class MandosDBusService(DBusObjectWithObjectManager):
3210
3380
"""A D-Bus proxy object"""
3211
3381
3212
3382
def __init__(self):
3213
3383
dbus.service.Object.__init__(self, bus, "/")
3214
3384
3215
3385
_interface = "se.recompile.Mandos"
3216
3386
3217
3387
@dbus.service.signal(_interface, signature="o")
3218
3388
def ClientAdded(self, objpath):
3219
3389
"D-Bus signal"
3220
3390
pass
3221
3391
3222
3392
@dbus.service.signal(_interface, signature="ss")
3223
def ClientNotFound(self, fingerprint, address):
3393
def ClientNotFound(self, key_id, address):
3224
3394
"D-Bus signal"
3225
3395
pass
3226
3396
3227
3397
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3228
3398
"true"})
3229
3399
@dbus.service.signal(_interface, signature="os")
3230
3400
def ClientRemoved(self, objpath, name):
3231
3401
"D-Bus signal"
3232
3402
pass
3233
3403
3234
3404
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3235
3405
"true"})
3236
3406
@dbus.service.method(_interface, out_signature="ao")
3238
3408
"D-Bus method"
3239
3409
return dbus.Array(c.dbus_object_path for c in
3240
3410
tcp_server.clients.values())
3241
3411
3242
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3243
3413
"true"})
3244
3414
@dbus.service.method(_interface,
3246
3416
def GetAllClientsWithProperties(self):
3247
3417
"D-Bus method"
3248
3418
return dbus.Dictionary(
3249
{ c.dbus_object_path: c.GetAll(
3419
{c.dbus_object_path: c.GetAll(
3250
3420
"se.recompile.Mandos.Client")
3251
for c in tcp_server.clients.values() },
3421
for c in tcp_server.clients.values()},
3252
3422
signature="oa{sv}")
3253
3423
3254
3424
@dbus.service.method(_interface, in_signature="o")
3255
3425
def RemoveClient(self, object_path):
3256
3426
"D-Bus method"
3264
3434
self.client_removed_signal(c)
3265
3435
return
3266
3436
raise KeyError(object_path)
3267
3437
3268
3438
del _interface
3269
3439
3270
3440
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3271
out_signature = "a{oa{sa{sv}}}")
3441
out_signature="a{oa{sa{sv}}}")
3272
3442
def GetManagedObjects(self):
3273
3443
"""D-Bus method"""
3274
3444
return dbus.Dictionary(
3275
{ client.dbus_object_path:
3276
dbus.Dictionary(
3277
{ interface: client.GetAll(interface)
3278
for interface in
3279
client._get_all_interface_names()})
3280
for client in tcp_server.clients.values()})
3281
3445
{client.dbus_object_path:
3446
dbus.Dictionary(
3447
{interface: client.GetAll(interface)
3448
for interface in
3449
client._get_all_interface_names()})
3450
for client in tcp_server.clients.values()})
3451
3282
3452
def client_added_signal(self, client):
3283
3453
"""Send the new standard signal and the old signal"""
3284
3454
if use_dbus:
3286
3456
self.InterfacesAdded(
3287
3457
client.dbus_object_path,
3288
3458
dbus.Dictionary(
3289
{ interface: client.GetAll(interface)
3290
for interface in
3291
client._get_all_interface_names()}))
3459
{interface: client.GetAll(interface)
3460
for interface in
3461
client._get_all_interface_names()}))
3292
3462
# Old signal
3293
3463
self.ClientAdded(client.dbus_object_path)
3294
3464
3295
3465
def client_removed_signal(self, client):
3296
3466
"""Send the new standard signal and the old signal"""
3297
3467
if use_dbus:
3302
3472
# Old signal
3303
3473
self.ClientRemoved(client.dbus_object_path,
3304
3474
client.name)
3305
3475
3306
3476
mandos_dbus_service = MandosDBusService()
3307
3477
3478
# Save modules to variables to exempt the modules from being
3479
# unloaded before the function registered with atexit() is run.
3480
mp = multiprocessing
3481
wn = wnull
3482
3308
3483
def cleanup():
3309
3484
"Cleanup function; run on exit"
3310
3485
if zeroconf:
3311
3486
service.cleanup()
3312
3313
multiprocessing.active_children()
3314
wnull.close()
3487
3488
mp.active_children()
3489
wn.close()
3315
3490
if not (tcp_server.clients or client_settings):
3316
3491
return
3317
3492
3318
3493
# Store client before exiting. Secrets are encrypted with key
3319
3494
# based on what config file has. If config file is
3320
3495
# removed/edited, old secret will thus be unrecovable.
3325
3500
client.encrypted_secret = pgp.encrypt(client.secret,
3326
3501
key)
3327
3502
client_dict = {}
3328
3503
3329
3504
# A list of attributes that can not be pickled
3330
3505
# + secret.
3331
exclude = { "bus", "changedstate", "secret",
3332
"checker", "server_settings" }
3506
exclude = {"bus", "changedstate", "secret",
3507
"checker", "server_settings"}
3333
3508
for name, typ in inspect.getmembers(dbus.service
3334
3509
.Object):
3335
3510
exclude.add(name)
3336
3511
3337
3512
client_dict["encrypted_secret"] = (client
3338
3513
.encrypted_secret)
3339
3514
for attr in client.client_structure:
3340
3515
if attr not in exclude:
3341
3516
client_dict[attr] = getattr(client, attr)
3342
3517
3343
3518
clients[client.name] = client_dict
3344
3519
del client_settings[client.name]["secret"]
3345
3520
3346
3521
try:
3347
3522
with tempfile.NamedTemporaryFile(
3348
3523
mode='wb',
3351
3526
dir=os.path.dirname(stored_state_path),
3352
3527
delete=False) as stored_state:
3353
3528
pickle.dump((clients, client_settings), stored_state,
3354
protocol = 2)
3529
protocol=2)
3355
3530
tempname = stored_state.name
3356
3531
os.rename(tempname, stored_state_path)
3357
3532
except (IOError, OSError) as e:
3367
3542
logger.warning("Could not save persistent state:",
3368
3543
exc_info=e)
3369
3544
raise
3370
3545
3371
3546
# Delete all clients, and settings from config
3372
3547
while tcp_server.clients:
3373
3548
name, client = tcp_server.clients.popitem()
3379
3554
if use_dbus:
3380
3555
mandos_dbus_service.client_removed_signal(client)
3381
3556
client_settings.clear()
3382
3557
3383
3558
atexit.register(cleanup)
3384
3559
3385
3560
for client in tcp_server.clients.values():
3386
3561
if use_dbus:
3387
3562
# Emit D-Bus signal for adding
3389
3564
# Need to initiate checking of clients
3390
3565
if client.enabled:
3391
3566
client.init_checker()
3392
3567
3393
3568
tcp_server.enable()
3394
3569
tcp_server.server_activate()
3395
3570
3396
3571
# Find out what port we got
3397
3572
if zeroconf:
3398
3573
service.port = tcp_server.socket.getsockname()[1]
3403
3578
else: # IPv4
3404
3579
logger.info("Now listening on address %r, port %d",
3405
3580
*tcp_server.socket.getsockname())
3406
3407
#service.interface = tcp_server.socket.getsockname()[3]
3408
3581
3582
# service.interface = tcp_server.socket.getsockname()[3]
3583
3409
3584
try:
3410
3585
if zeroconf:
3411
3586
# From the Avahi example code
3416
3591
cleanup()
3417
3592
sys.exit(1)
3418
3593
# End of Avahi example code
3419
3420
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3421
lambda *args, **kwargs:
3422
(tcp_server.handle_request
3423
(*args[2:], **kwargs) or True))
3424
3594
3595
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3596
lambda *args, **kwargs:
3597
(tcp_server.handle_request
3598
(*args[2:], **kwargs) or True))
3599
3425
3600
logger.debug("Starting main loop")
3426
3601
main_loop.run()
3427
3602
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0