To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1127
- compare with another revision
- download diff
- download tarball
- view history from revision 1127
- Committer: Teddy Hogeborn
- Date: 2019-07-27 10:11:45 UTC
- Revision ID: teddy@recompile.se-20190727101145-jnpbpf8220gldbcd
Add dracut(8) support
Add support for the dracut(8) system for generating initramfs image
files; dracut is an alternative to the "initramfs-tools" package.
* .bzrignore (dracut-module/password-agent): Ignore new binary file.
* dracut-module: New directory for the dracut module.
* INSTALL (Prerequisites/Libraries/Mandos Client): Add dracut as an
alternative to
initramfs-tools,
and also add GLib.
* Makefile (DRACUTMODULE, GLIB_CFLAGS, GLIB_LIBS): New.
(CPROGS): Add "dracut-module/password-agent".
(DOCS): Add "dracut-module/password-agent.8mandos".
(dracut-module/password-agent.8mandos): New.
(dracut-module/password-agent.8mandos.xhtml): - '' -
(dracut-module/password-agent): - '' -
(check): Add command to run tests of password-agent(8mandos).
(install-client-nokey): Also install the dracut module directory,
its files, and the password-agent(8mandos)
manual page.
(install-client): To update the initramfs image file, run
update-initramfs or dracut depending on what is
installed.
(uninstall-client): - '' - and also uninstall the the files in the
dracut module directory, that directory itself,
and the password-agent(8mandos) manual page.
* debian/control (Build-Depends): Add "libglib2.0-dev (>=2.40)".
(Package: mandos-client/Depends): Add "dracut (>= 044+241-3)" as an
alternative dependency to
initramfs-tools.
(Package: mandos-client/Conflicts): New; set to
"dracut-config-generic".
(debian/mandos-client.README.Debian): Document alternative commands
to update the initramfs image
for when dracut is used.
* debian/mandos-client.postinst (update_initramfs): Use alternative
commands to update
the initramfs
image for when
dracut is used.
* debian/tests/control (password-agent, password-agent-suid): Add two
new tests.
* dracut-module/ask-password-mandos.path: New.
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/cmdline-mandos.sh: - '' -
* dracut-module/module-setup.sh: - '' -
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: - '' -
* initramfs-unpack: Use the dracut "skipcpio" command, if available.
Also be more flexible and try hard to detect where
compressed data starts.
* plugins.d/mandos-client.xml (SECURITY): Be more precise that the
mandos-client binary might
not always be setuid, but
that the program assumes
that it has been started
that way.
* plugins.d/password-prompt.c: Add new "--prompt" option.
(conflict_detection): First try to detect the new PID file of
plymouth.
(main): Define and use new "prompt" variable.
* plugins.d/password-prompt.xml (SYNOPSIS): Show new --prompt option.
(DESCRIPTION): Describe new behavior of looking for plymouth PID
file.
(OPTIONS): Document new "--prompt" option.
(ENVIRONMENT): Clarify that the CRYPTTAB_SOURCE and CRYPTTAB_NAME
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the CRYPTTAB_SOURCE and
CRYPTTAB_NAME comes from, since this can now be
either initramfs-tools or dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference, and add commas
to separate the other references.
* plugins.d/plymouth.c: Add new "--prompt" and "--debug" options.
(debug): New global flag.
(fprintf_plus): New function, used for debug output.
(exec_and_wait): Add extra "const" to "argv" argument.
(main): Define and use new "prompt" variable. Add debug output.
(main/options, main/parse_opt): New; used to parse options.
* plugins.d/plymouth.xml (SYNOPSIS): Show new options.
(OPTIONS): Document new options.
(ENVIRONMENT): Clarify that the cryptsource and crypttarget
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the cryptsource and crypttarget
comes from, since this can now be either
initramfs-tools or dracut.
(EXAMPLE): Add an example using an option.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/splashy.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/usplash.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
Add support for the dracut(8) system for generating initramfs image
files; dracut is an alternative to the "initramfs-tools" package.
* .bzrignore (dracut-module/password-agent): Ignore new binary file.
* dracut-module: New directory for the dracut module.
* INSTALL (Prerequisites/Libraries/Mandos Client): Add dracut as an
alternative to
initramfs-tools,
and also add GLib.
* Makefile (DRACUTMODULE, GLIB_CFLAGS, GLIB_LIBS): New.
(CPROGS): Add "dracut-module/password-agent".
(DOCS): Add "dracut-module/password-agent.8mandos".
(dracut-module/password-agent.8mandos): New.
(dracut-module/password-agent.8mandos.xhtml): - '' -
(dracut-module/password-agent): - '' -
(check): Add command to run tests of password-agent(8mandos).
(install-client-nokey): Also install the dracut module directory,
its files, and the password-agent(8mandos)
manual page.
(install-client): To update the initramfs image file, run
update-initramfs or dracut depending on what is
installed.
(uninstall-client): - '' - and also uninstall the the files in the
dracut module directory, that directory itself,
and the password-agent(8mandos) manual page.
* debian/control (Build-Depends): Add "libglib2.0-dev (>=2.40)".
(Package: mandos-client/Depends): Add "dracut (>= 044+241-3)" as an
alternative dependency to
initramfs-tools.
(Package: mandos-client/Conflicts): New; set to
"dracut-config-generic".
(debian/mandos-client.README.Debian): Document alternative commands
to update the initramfs image
for when dracut is used.
* debian/mandos-client.postinst (update_initramfs): Use alternative
commands to update
the initramfs
image for when
dracut is used.
* debian/tests/control (password-agent, password-agent-suid): Add two
new tests.
* dracut-module/ask-password-mandos.path: New.
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/cmdline-mandos.sh: - '' -
* dracut-module/module-setup.sh: - '' -
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: - '' -
* initramfs-unpack: Use the dracut "skipcpio" command, if available.
Also be more flexible and try hard to detect where
compressed data starts.
* plugins.d/mandos-client.xml (SECURITY): Be more precise that the
mandos-client binary might
not always be setuid, but
that the program assumes
that it has been started
that way.
* plugins.d/password-prompt.c: Add new "--prompt" option.
(conflict_detection): First try to detect the new PID file of
plymouth.
(main): Define and use new "prompt" variable.
* plugins.d/password-prompt.xml (SYNOPSIS): Show new --prompt option.
(DESCRIPTION): Describe new behavior of looking for plymouth PID
file.
(OPTIONS): Document new "--prompt" option.
(ENVIRONMENT): Clarify that the CRYPTTAB_SOURCE and CRYPTTAB_NAME
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the CRYPTTAB_SOURCE and
CRYPTTAB_NAME comes from, since this can now be
either initramfs-tools or dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference, and add commas
to separate the other references.
* plugins.d/plymouth.c: Add new "--prompt" and "--debug" options.
(debug): New global flag.
(fprintf_plus): New function, used for debug output.
(exec_and_wait): Add extra "const" to "argv" argument.
(main): Define and use new "prompt" variable. Add debug output.
(main/options, main/parse_opt): New; used to parse options.
* plugins.d/plymouth.xml (SYNOPSIS): Show new options.
(OPTIONS): Document new options.
(ENVIRONMENT): Clarify that the cryptsource and crypttarget
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the cryptsource and crypttarget
comes from, since this can now be either
initramfs-tools or dracut.
(EXAMPLE): Add an example using an option.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/splashy.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/usplash.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
76
80
77
81
import dbus
78
82
import dbus.service
79
try:
80
from gi.repository import GObject
81
except ImportError:
82
import gobject as GObject
83
import avahi
83
from gi.repository import GLib
84
84
from dbus.mainloop.glib import DBusGMainLoop
85
85
import ctypes
86
86
import ctypes.util
87
87
import xml.dom.minidom
88
88
import inspect
89
89
90
# Try to find the value of SO_BINDTODEVICE:
90
91
try:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
91
94
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
95
except AttributeError:
93
96
try:
97
# This is where SO_BINDTODEVICE was up to and including Python
98
# 2.6, and also 3.2:
94
99
from IN import SO_BINDTODEVICE
95
100
except ImportError:
96
SO_BINDTODEVICE = None
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
103
try:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
"/dev/stdin"],
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
112
# No value found
113
SO_BINDTODEVICE = None
97
114
98
115
if sys.version_info.major == 2:
99
116
str = unicode
100
117
101
version = "1.7.3"
118
version = "1.8.4"
102
119
stored_state_file = "clients.pickle"
103
120
104
121
logger = logging.getLogger()
108
125
if_nametoindex = ctypes.cdll.LoadLibrary(
109
126
ctypes.util.find_library("c")).if_nametoindex
110
127
except (OSError, AttributeError):
111
128
112
129
def if_nametoindex(interface):
113
130
"Get an interface index the hard way, i.e. using fcntl()"
114
131
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
136
return interface_index
120
137
121
138
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
143
func.func_globals,
144
func.func_name,
145
func.func_defaults,
146
func.func_closure)
147
else:
148
return types.FunctionType(func.__code__,
149
func.__globals__,
150
func.__name__,
151
func.__defaults__,
152
func.__closure__)
153
154
122
155
def initlogger(debug, level=logging.WARNING):
123
156
"""init logger and add loglevel"""
124
157
125
158
global syslogger
126
159
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
address="/dev/log"))
129
162
syslogger.setFormatter(logging.Formatter
130
163
('Mandos [%(process)d]: %(levelname)s:'
131
164
' %(message)s'))
132
165
logger.addHandler(syslogger)
133
166
134
167
if debug:
135
168
console = logging.StreamHandler()
136
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
148
181
149
182
class PGPEngine(object):
150
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
184
152
185
def __init__(self):
153
186
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
187
self.gpg = "gpg"
155
188
try:
156
189
output = subprocess.check_output(["gpgconf"])
157
190
for line in output.splitlines():
158
name, text, path = line.split(":")
191
name, text, path = line.split(b":")
159
192
if name == "gpg":
160
193
self.gpg = path
161
194
break
165
198
self.gnupgargs = ['--batch',
166
199
'--homedir', self.tempdir,
167
200
'--force-mdc',
168
'--quiet',
169
'--no-use-agent']
170
201
'--quiet']
202
# Only GPG version 1 has the --no-use-agent option.
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
self.gnupgargs.append("--no-use-agent")
205
171
206
def __enter__(self):
172
207
return self
173
208
174
209
def __exit__(self, exc_type, exc_value, traceback):
175
210
self._cleanup()
176
211
return False
177
212
178
213
def __del__(self):
179
214
self._cleanup()
180
215
181
216
def _cleanup(self):
182
217
if self.tempdir is not None:
183
218
# Delete contents of tempdir
184
219
for root, dirs, files in os.walk(self.tempdir,
185
topdown = False):
220
topdown=False):
186
221
for filename in files:
187
222
os.remove(os.path.join(root, filename))
188
223
for dirname in dirs:
190
225
# Remove tempdir
191
226
os.rmdir(self.tempdir)
192
227
self.tempdir = None
193
228
194
229
def password_encode(self, password):
195
230
# Passphrase can not be empty and can not contain newlines or
196
231
# NUL bytes. So we prefix it and hex encode it.
201
236
.replace(b"\n", b"\\n")
202
237
.replace(b"\0", b"\\x00"))
203
238
return encoded
204
239
205
240
def encrypt(self, data, password):
206
241
passphrase = self.password_encode(password)
207
242
with tempfile.NamedTemporaryFile(
212
247
'--passphrase-file',
213
248
passfile.name]
214
249
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
219
254
if proc.returncode != 0:
220
255
raise PGPError(err)
221
256
return ciphertext
222
257
223
258
def decrypt(self, data, password):
224
259
passphrase = self.password_encode(password)
225
260
with tempfile.NamedTemporaryFile(
226
dir = self.tempdir) as passfile:
261
dir=self.tempdir) as passfile:
227
262
passfile.write(passphrase)
228
263
passfile.flush()
229
264
proc = subprocess.Popen([self.gpg, '--decrypt',
230
265
'--passphrase-file',
231
266
passfile.name]
232
267
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
237
272
if proc.returncode != 0:
238
273
raise PGPError(err)
239
274
return decrypted_plaintext
240
275
241
276
277
# Pretend that we have an Avahi module
278
class avahi(object):
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
288
289
@staticmethod
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
302
242
303
class AvahiError(Exception):
243
304
def __init__(self, value, *args, **kwargs):
244
305
self.value = value
256
317
257
318
class AvahiService(object):
258
319
"""An Avahi (Zeroconf) service.
259
320
260
321
Attributes:
261
322
interface: integer; avahi.IF_UNSPEC or an interface index.
262
323
Used to optionally bind to the specified interface.
274
335
server: D-Bus Server
275
336
bus: dbus.SystemBus()
276
337
"""
277
338
278
339
def __init__(self,
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
289
350
self.interface = interface
290
351
self.name = name
291
352
self.type = servicetype
300
361
self.server = None
301
362
self.bus = bus
302
363
self.entry_group_state_changed_match = None
303
364
304
365
def rename(self, remove=True):
305
366
"""Derived from the Avahi example code"""
306
367
if self.rename_count >= self.max_renames:
326
387
logger.critical("D-Bus Exception", exc_info=error)
327
388
self.cleanup()
328
389
os._exit(1)
329
390
330
391
def remove(self):
331
392
"""Derived from the Avahi example code"""
332
393
if self.entry_group_state_changed_match is not None:
334
395
self.entry_group_state_changed_match = None
335
396
if self.group is not None:
336
397
self.group.Reset()
337
398
338
399
def add(self):
339
400
"""Derived from the Avahi example code"""
340
401
self.remove()
357
418
dbus.UInt16(self.port),
358
419
avahi.string_array_to_txt_array(self.TXT))
359
420
self.group.Commit()
360
421
361
422
def entry_group_state_changed(self, state, error):
362
423
"""Derived from the Avahi example code"""
363
424
logger.debug("Avahi entry group state change: %i", state)
364
425
365
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
366
427
logger.debug("Zeroconf service established.")
367
428
elif state == avahi.ENTRY_GROUP_COLLISION:
371
432
logger.critical("Avahi: Error in group state changed %s",
372
433
str(error))
373
434
raise AvahiGroupError("State changed: {!s}".format(error))
374
435
375
436
def cleanup(self):
376
437
"""Derived from the Avahi example code"""
377
438
if self.group is not None:
382
443
pass
383
444
self.group = None
384
445
self.remove()
385
446
386
447
def server_state_changed(self, state, error=None):
387
448
"""Derived from the Avahi example code"""
388
449
logger.debug("Avahi server state change: %i", state)
417
478
logger.debug("Unknown state: %r", state)
418
479
else:
419
480
logger.debug("Unknown state: %r: %r", state, error)
420
481
421
482
def activate(self):
422
483
"""Derived from the Avahi example code"""
423
484
if self.server is None:
434
495
class AvahiServiceToSyslog(AvahiService):
435
496
def rename(self, *args, **kwargs):
436
497
"""Add the new name to the syslog messages"""
437
ret = AvahiService.rename(self, *args, **kwargs)
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
438
499
syslogger.setFormatter(logging.Formatter(
439
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
440
501
.format(self.name)))
441
502
return ret
442
503
504
443
505
# Pretend that we have a GnuTLS module
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
508
509
library = ctypes.util.find_library("gnutls")
510
if library is None:
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
513
del library
514
459
515
# Unless otherwise indicated, the constants and types below are
460
516
# all from the gnutls/gnutls.h C header file.
461
517
462
518
# Constants
463
519
E_SUCCESS = 0
464
520
E_INTERRUPTED = -52
465
521
E_AGAIN = -28
466
522
CRT_OPENPGP = 2
523
CRT_RAWPK = 3
467
524
CLIENT = 2
468
525
SHUT_RDWR = 0
469
526
CRD_CERTIFICATE = 1
470
527
E_NO_CERTIFICATE_FOUND = -49
528
X509_FMT_DER = 0
529
NO_TICKETS = 1<<10
530
ENABLE_RAWPK = 1<<18
531
CTYPE_PEERS = 3
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
471
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
472
534
473
535
# Types
474
536
class session_int(ctypes.Structure):
475
537
_fields_ = []
476
538
session_t = ctypes.POINTER(session_int)
539
477
540
class certificate_credentials_st(ctypes.Structure):
478
541
_fields_ = []
479
542
certificate_credentials_t = ctypes.POINTER(
480
543
certificate_credentials_st)
481
544
certificate_type_t = ctypes.c_int
545
482
546
class datum_t(ctypes.Structure):
483
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
548
('size', ctypes.c_uint)]
549
485
550
class openpgp_crt_int(ctypes.Structure):
486
551
_fields_ = []
487
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
credentials_type_t = ctypes.c_int #
555
credentials_type_t = ctypes.c_int
491
556
transport_ptr_t = ctypes.c_void_p
492
557
close_request_t = ctypes.c_int
493
558
494
559
# Exceptions
495
560
class Error(Exception):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
561
def __init__(self, message=None, code=None, args=()):
501
562
# Default usage is by a message string, but if a return
502
563
# code is passed, convert it to a string with
503
564
# gnutls.strerror()
504
565
self.code = code
505
566
if message is None and code is not None:
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
508
569
message, *args)
509
570
510
571
class CertificateSecurityError(Error):
511
572
pass
512
573
513
574
# Classes
514
575
class Credentials(object):
515
576
def __init__(self):
517
578
gnutls.certificate_allocate_credentials(
518
579
ctypes.byref(self._c_object))
519
580
self.type = gnutls.CRD_CERTIFICATE
520
581
521
582
def __del__(self):
522
583
gnutls.certificate_free_credentials(self._c_object)
523
584
524
585
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
586
def __init__(self, socket, credentials=None):
526
587
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version("3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
591
if gnutls.has_rawpk:
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
594
del gnutls_flags
528
595
gnutls.set_default_priority(self._c_object)
529
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
597
gnutls.handshake_set_private_extensions(self._c_object,
536
603
ctypes.cast(credentials._c_object,
537
604
ctypes.c_void_p))
538
605
self.credentials = credentials
539
606
540
607
def __del__(self):
541
608
gnutls.deinit(self._c_object)
542
609
543
610
def handshake(self):
544
611
return gnutls.handshake(self._c_object)
545
612
546
613
def send(self, data):
547
614
data = bytes(data)
548
615
data_len = len(data)
550
617
data_len -= gnutls.record_send(self._c_object,
551
618
data[-data_len:],
552
619
data_len)
553
620
554
621
def bye(self):
555
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
623
557
624
# Error handling functions
558
625
def _error_code(result):
559
626
"""A function to raise exceptions on errors, suitable
561
628
if result >= 0:
562
629
return result
563
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
633
567
634
def _retry_on_error(result, func, arguments):
568
635
"""A function to retry on some errors, suitable
569
636
for the 'errcheck' attribute on ctypes functions"""
572
639
return _error_code(result)
573
640
result = func(*arguments)
574
641
return result
575
642
576
643
# Unless otherwise indicated, the function declarations below are
577
644
# all from the gnutls/gnutls.h C header file.
578
645
579
646
# Functions
580
647
priority_set_direct = _library.gnutls_priority_set_direct
581
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
649
ctypes.POINTER(ctypes.c_char_p)]
583
650
priority_set_direct.restype = _error_code
584
651
585
652
init = _library.gnutls_init
586
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
654
init.restype = _error_code
588
655
589
656
set_default_priority = _library.gnutls_set_default_priority
590
657
set_default_priority.argtypes = [session_t]
591
658
set_default_priority.restype = _error_code
592
659
593
660
record_send = _library.gnutls_record_send
594
661
record_send.argtypes = [session_t, ctypes.c_void_p,
595
662
ctypes.c_size_t]
596
663
record_send.restype = ctypes.c_ssize_t
597
664
record_send.errcheck = _retry_on_error
598
665
599
666
certificate_allocate_credentials = (
600
667
_library.gnutls_certificate_allocate_credentials)
601
668
certificate_allocate_credentials.argtypes = [
602
669
ctypes.POINTER(certificate_credentials_t)]
603
670
certificate_allocate_credentials.restype = _error_code
604
671
605
672
certificate_free_credentials = (
606
673
_library.gnutls_certificate_free_credentials)
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
608
676
certificate_free_credentials.restype = None
609
677
610
678
handshake_set_private_extensions = (
611
679
_library.gnutls_handshake_set_private_extensions)
612
680
handshake_set_private_extensions.argtypes = [session_t,
613
681
ctypes.c_int]
614
682
handshake_set_private_extensions.restype = None
615
683
616
684
credentials_set = _library.gnutls_credentials_set
617
685
credentials_set.argtypes = [session_t, credentials_type_t,
618
686
ctypes.c_void_p]
619
687
credentials_set.restype = _error_code
620
688
621
689
strerror = _library.gnutls_strerror
622
690
strerror.argtypes = [ctypes.c_int]
623
691
strerror.restype = ctypes.c_char_p
624
692
625
693
certificate_type_get = _library.gnutls_certificate_type_get
626
694
certificate_type_get.argtypes = [session_t]
627
695
certificate_type_get.restype = _error_code
628
696
629
697
certificate_get_peers = _library.gnutls_certificate_get_peers
630
698
certificate_get_peers.argtypes = [session_t,
631
699
ctypes.POINTER(ctypes.c_uint)]
632
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
701
634
702
global_set_log_level = _library.gnutls_global_set_log_level
635
703
global_set_log_level.argtypes = [ctypes.c_int]
636
704
global_set_log_level.restype = None
637
705
638
706
global_set_log_function = _library.gnutls_global_set_log_function
639
707
global_set_log_function.argtypes = [log_func]
640
708
global_set_log_function.restype = None
641
709
642
710
deinit = _library.gnutls_deinit
643
711
deinit.argtypes = [session_t]
644
712
deinit.restype = None
645
713
646
714
handshake = _library.gnutls_handshake
647
715
handshake.argtypes = [session_t]
648
716
handshake.restype = _error_code
649
717
handshake.errcheck = _retry_on_error
650
718
651
719
transport_set_ptr = _library.gnutls_transport_set_ptr
652
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
721
transport_set_ptr.restype = None
654
722
655
723
bye = _library.gnutls_bye
656
724
bye.argtypes = [session_t, close_request_t]
657
725
bye.restype = _error_code
658
726
bye.errcheck = _retry_on_error
659
727
660
728
check_version = _library.gnutls_check_version
661
729
check_version.argtypes = [ctypes.c_char_p]
662
730
check_version.restype = ctypes.c_char_p
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
731
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
736
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
739
740
if has_rawpk:
741
# Types
742
class pubkey_st(ctypes.Structure):
743
_fields = []
744
pubkey_t = ctypes.POINTER(pubkey_st)
745
746
x509_crt_fmt_t = ctypes.c_int
747
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
752
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
755
x509_crt_fmt_t]
756
pubkey_import.restype = _error_code
757
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
763
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
767
else:
768
# All the function declarations below are from gnutls/openpgp.h
769
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
773
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
777
openpgp_crt_fmt_t]
778
openpgp_crt_import.restype = _error_code
779
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
784
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
788
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
792
ctypes.c_void_p,
793
ctypes.POINTER(
794
ctypes.c_size_t)]
795
openpgp_crt_get_fingerprint.restype = _error_code
796
797
if check_version("3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
801
693
802
# Remove non-public functions
694
803
del _error_code, _retry_on_error
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
804
697
805
698
806
def call_pipe(connection, # : multiprocessing.Connection
699
807
func, *args, **kwargs):
700
808
"""This function is meant to be called by multiprocessing.Process
701
809
702
810
This function runs func(*args, **kwargs), and writes the resulting
703
811
return value on the provided multiprocessing.Connection.
704
812
"""
705
813
connection.send(func(*args, **kwargs))
706
814
connection.close()
707
815
816
708
817
class Client(object):
709
818
"""A representation of a client host served by this server.
710
819
711
820
Attributes:
712
821
approved: bool(); 'None' if not yet approved/disapproved
713
822
approval_delay: datetime.timedelta(); Time to wait for approval
715
824
checker: subprocess.Popen(); a running checker process used
716
825
to see if the client lives.
717
826
'None' if no process is running.
718
checker_callback_tag: a GObject event source tag, or None
827
checker_callback_tag: a GLib event source tag, or None
719
828
checker_command: string; External command which is run to check
720
829
if client lives. %() expansions are done at
721
830
runtime with vars(self) as dict, so that for
722
831
instance %(name)s can be used in the command.
723
checker_initiator_tag: a GObject event source tag, or None
832
checker_initiator_tag: a GLib event source tag, or None
724
833
created: datetime.datetime(); (UTC) object creation
725
834
client_structure: Object describing what attributes a client has
726
835
and is used for storing the client at exit
727
836
current_checker_command: string; current running checker_command
728
disable_initiator_tag: a GObject event source tag, or None
837
disable_initiator_tag: a GLib event source tag, or None
729
838
enabled: bool()
730
839
fingerprint: string (40 or 32 hexadecimal digits); used to
731
uniquely identify the client
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
732
843
host: string; available for use by the checker command
733
844
interval: datetime.timedelta(); How often to start a new checker
734
845
last_approval_request: datetime.datetime(); (UTC) or None
750
861
disabled, or None
751
862
server_settings: The server_settings dict from main()
752
863
"""
753
864
754
865
runtime_expansions = ("approval_delay", "approval_duration",
755
"created", "enabled", "expires",
866
"created", "enabled", "expires", "key_id",
756
867
"fingerprint", "host", "interval",
757
868
"last_approval_request", "last_checked_ok",
758
869
"last_enabled", "name", "timeout")
767
878
"approved_by_default": "True",
768
879
"enabled": "True",
769
880
}
770
881
771
882
@staticmethod
772
883
def config_parser(config):
773
884
"""Construct a new dict of client settings of this form:
780
891
for client_name in config.sections():
781
892
section = dict(config.items(client_name))
782
893
client = settings[client_name] = {}
783
894
784
895
client["host"] = section["host"]
785
896
# Reformat values from string types to Python types
786
897
client["approved_by_default"] = config.getboolean(
787
898
client_name, "approved_by_default")
788
899
client["enabled"] = config.getboolean(client_name,
789
900
"enabled")
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
901
902
# Uppercase and remove spaces from key_id and fingerprint
903
# for later comparison purposes with return value from the
904
# key_id() and fingerprint() functions
905
client["key_id"] = (section.get("key_id", "").upper()
906
.replace(" ", ""))
794
907
client["fingerprint"] = (section["fingerprint"].upper()
795
908
.replace(" ", ""))
796
909
if "secret" in section:
797
client["secret"] = section["secret"].decode("base64")
910
client["secret"] = codecs.decode(section["secret"]
911
.encode("utf-8"),
912
"base64")
798
913
elif "secfile" in section:
799
914
with open(os.path.expanduser(os.path.expandvars
800
915
(section["secfile"])),
815
930
client["last_approval_request"] = None
816
931
client["last_checked_ok"] = None
817
932
client["last_checker_status"] = -2
818
933
819
934
return settings
820
821
def __init__(self, settings, name = None, server_settings=None):
935
936
def __init__(self, settings, name=None, server_settings=None):
822
937
self.name = name
823
938
if server_settings is None:
824
939
server_settings = {}
826
941
# adding all client settings
827
942
for setting, value in settings.items():
828
943
setattr(self, setting, value)
829
944
830
945
if self.enabled:
831
946
if not hasattr(self, "last_enabled"):
832
947
self.last_enabled = datetime.datetime.utcnow()
836
951
else:
837
952
self.last_enabled = None
838
953
self.expires = None
839
954
840
955
logger.debug("Creating client %r", self.name)
956
logger.debug(" Key ID: %s", self.key_id)
841
957
logger.debug(" Fingerprint: %s", self.fingerprint)
842
958
self.created = settings.get("created",
843
959
datetime.datetime.utcnow())
844
960
845
961
# attributes specific for this server instance
846
962
self.checker = None
847
963
self.checker_initiator_tag = None
853
969
self.changedstate = multiprocessing_manager.Condition(
854
970
multiprocessing_manager.Lock())
855
971
self.client_structure = [attr
856
for attr in self.__dict__.iterkeys()
972
for attr in self.__dict__.keys()
857
973
if not attr.startswith("_")]
858
974
self.client_structure.append("client_structure")
859
975
860
976
for name, t in inspect.getmembers(
861
977
type(self), lambda obj: isinstance(obj, property)):
862
978
if not name.startswith("_"):
863
979
self.client_structure.append(name)
864
980
865
981
# Send notice to process children that client state has changed
866
982
def send_changedstate(self):
867
983
with self.changedstate:
868
984
self.changedstate.notify_all()
869
985
870
986
def enable(self):
871
987
"""Start this client's checker and timeout hooks"""
872
988
if getattr(self, "enabled", False):
877
993
self.last_enabled = datetime.datetime.utcnow()
878
994
self.init_checker()
879
995
self.send_changedstate()
880
996
881
997
def disable(self, quiet=True):
882
998
"""Disable this client."""
883
999
if not getattr(self, "enabled", False):
885
1001
if not quiet:
886
1002
logger.info("Disabling client %s", self.name)
887
1003
if getattr(self, "disable_initiator_tag", None) is not None:
888
GObject.source_remove(self.disable_initiator_tag)
1004
GLib.source_remove(self.disable_initiator_tag)
889
1005
self.disable_initiator_tag = None
890
1006
self.expires = None
891
1007
if getattr(self, "checker_initiator_tag", None) is not None:
892
GObject.source_remove(self.checker_initiator_tag)
1008
GLib.source_remove(self.checker_initiator_tag)
893
1009
self.checker_initiator_tag = None
894
1010
self.stop_checker()
895
1011
self.enabled = False
896
1012
if not quiet:
897
1013
self.send_changedstate()
898
# Do not run this again if called by a GObject.timeout_add
1014
# Do not run this again if called by a GLib.timeout_add
899
1015
return False
900
1016
901
1017
def __del__(self):
902
1018
self.disable()
903
1019
904
1020
def init_checker(self):
905
1021
# Schedule a new checker to be started an 'interval' from now,
906
1022
# and every interval from then on.
907
1023
if self.checker_initiator_tag is not None:
908
GObject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = GObject.timeout_add(
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
910
1026
int(self.interval.total_seconds() * 1000),
911
1027
self.start_checker)
912
1028
# Schedule a disable() when 'timeout' has passed
913
1029
if self.disable_initiator_tag is not None:
914
GObject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = GObject.timeout_add(
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
916
1032
int(self.timeout.total_seconds() * 1000), self.disable)
917
1033
# Also start a new checker *right now*.
918
1034
self.start_checker()
919
1035
920
1036
def checker_callback(self, source, condition, connection,
921
1037
command):
922
1038
"""The checker has completed, so take appropriate actions."""
925
1041
# Read return code from connection (see call_pipe)
926
1042
returncode = connection.recv()
927
1043
connection.close()
928
1044
929
1045
if returncode >= 0:
930
1046
self.last_checker_status = returncode
931
1047
self.last_checker_signal = None
941
1057
logger.warning("Checker for %(name)s crashed?",
942
1058
vars(self))
943
1059
return False
944
1060
945
1061
def checked_ok(self):
946
1062
"""Assert that the client has been seen, alive and well."""
947
1063
self.last_checked_ok = datetime.datetime.utcnow()
948
1064
self.last_checker_status = 0
949
1065
self.last_checker_signal = None
950
1066
self.bump_timeout()
951
1067
952
1068
def bump_timeout(self, timeout=None):
953
1069
"""Bump up the timeout for this client."""
954
1070
if timeout is None:
955
1071
timeout = self.timeout
956
1072
if self.disable_initiator_tag is not None:
957
GObject.source_remove(self.disable_initiator_tag)
1073
GLib.source_remove(self.disable_initiator_tag)
958
1074
self.disable_initiator_tag = None
959
1075
if getattr(self, "enabled", False):
960
self.disable_initiator_tag = GObject.timeout_add(
1076
self.disable_initiator_tag = GLib.timeout_add(
961
1077
int(timeout.total_seconds() * 1000), self.disable)
962
1078
self.expires = datetime.datetime.utcnow() + timeout
963
1079
964
1080
def need_approval(self):
965
1081
self.last_approval_request = datetime.datetime.utcnow()
966
1082
967
1083
def start_checker(self):
968
1084
"""Start a new checker subprocess if one is not running.
969
1085
970
1086
If a checker already exists, leave it running and do
971
1087
nothing."""
972
1088
# The reason for not killing a running checker is that if we
977
1093
# checkers alone, the checker would have to take more time
978
1094
# than 'timeout' for the client to be disabled, which is as it
979
1095
# should be.
980
1096
981
1097
if self.checker is not None and not self.checker.is_alive():
982
1098
logger.warning("Checker was not alive; joining")
983
1099
self.checker.join()
987
1103
# Escape attributes for the shell
988
1104
escaped_attrs = {
989
1105
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
1106
for attr in self.runtime_expansions}
991
1107
try:
992
1108
command = self.checker_command % escaped_attrs
993
1109
except TypeError as error:
1005
1121
# The exception is when not debugging but nevertheless
1006
1122
# running in the foreground; use the previously
1007
1123
# created wnull.
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1124
popen_args = {"close_fds": True,
1125
"shell": True,
1126
"cwd": "/"}
1011
1127
if (not self.server_settings["debug"]
1012
1128
and self.server_settings["foreground"]):
1013
1129
popen_args.update({"stdout": wnull,
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1130
"stderr": wnull})
1131
pipe = multiprocessing.Pipe(duplex=False)
1016
1132
self.checker = multiprocessing.Process(
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1133
target=call_pipe,
1134
args=(pipe[1], subprocess.call, command),
1135
kwargs=popen_args)
1020
1136
self.checker.start()
1021
self.checker_callback_tag = GObject.io_add_watch(
1022
pipe[0].fileno(), GObject.IO_IN,
1137
self.checker_callback_tag = GLib.io_add_watch(
1138
pipe[0].fileno(), GLib.IO_IN,
1023
1139
self.checker_callback, pipe[0], command)
1024
# Re-run this periodically if run by GObject.timeout_add
1140
# Re-run this periodically if run by GLib.timeout_add
1025
1141
return True
1026
1142
1027
1143
def stop_checker(self):
1028
1144
"""Force the checker process, if any, to stop."""
1029
1145
if self.checker_callback_tag:
1030
GObject.source_remove(self.checker_callback_tag)
1146
GLib.source_remove(self.checker_callback_tag)
1031
1147
self.checker_callback_tag = None
1032
1148
if getattr(self, "checker", None) is None:
1033
1149
return
1042
1158
byte_arrays=False):
1043
1159
"""Decorators for marking methods of a DBusObjectWithProperties to
1044
1160
become properties on the D-Bus.
1045
1161
1046
1162
The decorated method will be called with no arguments by "Get"
1047
1163
and with one argument by "Set".
1048
1164
1049
1165
The parameters, where they are supported, are the same as
1050
1166
dbus.service.method, except there is only "signature", since the
1051
1167
type from Get() and the type sent to Set() is the same.
1055
1171
if byte_arrays and signature != "ay":
1056
1172
raise ValueError("Byte arrays not supported for non-'ay'"
1057
1173
" signature {!r}".format(signature))
1058
1174
1059
1175
def decorator(func):
1060
1176
func._dbus_is_property = True
1061
1177
func._dbus_interface = dbus_interface
1064
1180
func._dbus_name = func.__name__
1065
1181
if func._dbus_name.endswith("_dbus_property"):
1066
1182
func._dbus_name = func._dbus_name[:-14]
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1183
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1068
1184
return func
1069
1185
1070
1186
return decorator
1071
1187
1072
1188
1073
1189
def dbus_interface_annotations(dbus_interface):
1074
1190
"""Decorator for marking functions returning interface annotations
1075
1191
1076
1192
Usage:
1077
1193
1078
1194
@dbus_interface_annotations("org.example.Interface")
1079
1195
def _foo(self): # Function name does not matter
1080
1196
return {"org.freedesktop.DBus.Deprecated": "true",
1081
1197
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1082
1198
"false"}
1083
1199
"""
1084
1200
1085
1201
def decorator(func):
1086
1202
func._dbus_is_interface = True
1087
1203
func._dbus_interface = dbus_interface
1088
1204
func._dbus_name = dbus_interface
1089
1205
return func
1090
1206
1091
1207
return decorator
1092
1208
1093
1209
1094
1210
def dbus_annotations(annotations):
1095
1211
"""Decorator to annotate D-Bus methods, signals or properties
1096
1212
Usage:
1097
1213
1098
1214
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1099
1215
"org.freedesktop.DBus.Property."
1100
1216
"EmitsChangedSignal": "false"})
1102
1218
access="r")
1103
1219
def Property_dbus_property(self):
1104
1220
return dbus.Boolean(False)
1105
1221
1106
1222
See also the DBusObjectWithAnnotations class.
1107
1223
"""
1108
1224
1109
1225
def decorator(func):
1110
1226
func._dbus_annotations = annotations
1111
1227
return func
1112
1228
1113
1229
return decorator
1114
1230
1115
1231
1133
1249
1134
1250
class DBusObjectWithAnnotations(dbus.service.Object):
1135
1251
"""A D-Bus object with annotations.
1136
1252
1137
1253
Classes inheriting from this can use the dbus_annotations
1138
1254
decorator to add annotations to methods or signals.
1139
1255
"""
1140
1256
1141
1257
@staticmethod
1142
1258
def _is_dbus_thing(thing):
1143
1259
"""Returns a function testing if an attribute is a D-Bus thing
1144
1260
1145
1261
If called like _is_dbus_thing("method") it returns a function
1146
1262
suitable for use as predicate to inspect.getmembers().
1147
1263
"""
1148
1264
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1149
1265
False)
1150
1266
1151
1267
def _get_all_dbus_things(self, thing):
1152
1268
"""Returns a generator of (name, attribute) pairs
1153
1269
"""
1156
1272
for cls in self.__class__.__mro__
1157
1273
for name, athing in
1158
1274
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
1275
1160
1276
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1277
out_signature="s",
1278
path_keyword='object_path',
1279
connection_keyword='connection')
1164
1280
def Introspect(self, object_path, connection):
1165
1281
"""Overloading of standard D-Bus method.
1166
1282
1167
1283
Inserts annotation tags on methods and signals.
1168
1284
"""
1169
1285
xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
1286
connection)
1171
1287
try:
1172
1288
document = xml.dom.minidom.parseString(xmlstring)
1173
1289
1174
1290
for if_tag in document.getElementsByTagName("interface"):
1175
1291
# Add annotation tags
1176
1292
for typ in ("method", "signal"):
1203
1319
if_tag.appendChild(ann_tag)
1204
1320
# Fix argument name for the Introspect method itself
1205
1321
if (if_tag.getAttribute("name")
1206
== dbus.INTROSPECTABLE_IFACE):
1322
== dbus.INTROSPECTABLE_IFACE):
1207
1323
for cn in if_tag.getElementsByTagName("method"):
1208
1324
if cn.getAttribute("name") == "Introspect":
1209
1325
for arg in cn.getElementsByTagName("arg"):
1222
1338
1223
1339
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
1340
"""A D-Bus object with properties.
1225
1341
1226
1342
Classes inheriting from this can use the dbus_service_property
1227
1343
decorator to expose methods as D-Bus properties. It exposes the
1228
1344
standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
1345
"""
1230
1346
1231
1347
def _get_dbus_property(self, interface_name, property_name):
1232
1348
"""Returns a bound method if one exists which is a D-Bus
1233
1349
property with the specified name and interface.
1238
1354
if (value._dbus_name == property_name
1239
1355
and value._dbus_interface == interface_name):
1240
1356
return value.__get__(self)
1241
1357
1242
1358
# No such property
1243
1359
raise DBusPropertyNotFound("{}:{}.{}".format(
1244
1360
self.dbus_object_path, interface_name, property_name))
1245
1361
1246
1362
@classmethod
1247
1363
def _get_all_interface_names(cls):
1248
1364
"""Get a sequence of all interfaces supported by an object"""
1251
1367
for x in (inspect.getmro(cls))
1252
1368
for attr in dir(x))
1253
1369
if name is not None)
1254
1370
1255
1371
@dbus.service.method(dbus.PROPERTIES_IFACE,
1256
1372
in_signature="ss",
1257
1373
out_signature="v")
1265
1381
if not hasattr(value, "variant_level"):
1266
1382
return value
1267
1383
return type(value)(value, variant_level=value.variant_level+1)
1268
1384
1269
1385
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1270
1386
def Set(self, interface_name, property_name, value):
1271
1387
"""Standard D-Bus property Set() method, see D-Bus standard.
1283
1399
value = dbus.ByteArray(b''.join(chr(byte)
1284
1400
for byte in value))
1285
1401
prop(value)
1286
1402
1287
1403
@dbus.service.method(dbus.PROPERTIES_IFACE,
1288
1404
in_signature="s",
1289
1405
out_signature="a{sv}")
1290
1406
def GetAll(self, interface_name):
1291
1407
"""Standard D-Bus property GetAll() method, see D-Bus
1292
1408
standard.
1293
1409
1294
1410
Note: Will not include properties with access="write".
1295
1411
"""
1296
1412
properties = {}
1307
1423
properties[name] = value
1308
1424
continue
1309
1425
properties[name] = type(value)(
1310
value, variant_level = value.variant_level + 1)
1426
value, variant_level=value.variant_level + 1)
1311
1427
return dbus.Dictionary(properties, signature="sv")
1312
1428
1313
1429
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1314
1430
def PropertiesChanged(self, interface_name, changed_properties,
1315
1431
invalidated_properties):
1317
1433
standard.
1318
1434
"""
1319
1435
pass
1320
1436
1321
1437
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1322
1438
out_signature="s",
1323
1439
path_keyword='object_path',
1324
1440
connection_keyword='connection')
1325
1441
def Introspect(self, object_path, connection):
1326
1442
"""Overloading of standard D-Bus method.
1327
1443
1328
1444
Inserts property tags and interface annotation tags.
1329
1445
"""
1330
1446
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1332
1448
connection)
1333
1449
try:
1334
1450
document = xml.dom.minidom.parseString(xmlstring)
1335
1451
1336
1452
def make_tag(document, name, prop):
1337
1453
e = document.createElement("property")
1338
1454
e.setAttribute("name", name)
1339
1455
e.setAttribute("type", prop._dbus_signature)
1340
1456
e.setAttribute("access", prop._dbus_access)
1341
1457
return e
1342
1458
1343
1459
for if_tag in document.getElementsByTagName("interface"):
1344
1460
# Add property tags
1345
1461
for tag in (make_tag(document, name, prop)
1387
1503
exc_info=error)
1388
1504
return xmlstring
1389
1505
1506
1390
1507
try:
1391
1508
dbus.OBJECT_MANAGER_IFACE
1392
1509
except AttributeError:
1393
1510
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
1511
1512
1395
1513
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
1514
"""A D-Bus object with an ObjectManager.
1397
1515
1398
1516
Classes inheriting from this exposes the standard
1399
1517
GetManagedObjects call and the InterfacesAdded and
1400
1518
InterfacesRemoved signals on the standard
1401
1519
"org.freedesktop.DBus.ObjectManager" interface.
1402
1520
1403
1521
Note: No signals are sent automatically; they must be sent
1404
1522
manually.
1405
1523
"""
1406
1524
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
out_signature = "a{oa{sa{sv}}}")
1525
out_signature="a{oa{sa{sv}}}")
1408
1526
def GetManagedObjects(self):
1409
1527
"""This function must be overridden"""
1410
1528
raise NotImplementedError()
1411
1529
1412
1530
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
signature = "oa{sa{sv}}")
1531
signature="oa{sa{sv}}")
1414
1532
def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
1533
pass
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1534
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1418
1536
def InterfacesRemoved(self, object_path, interfaces):
1419
1537
pass
1420
1538
1421
1539
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1540
out_signature="s",
1541
path_keyword='object_path',
1542
connection_keyword='connection')
1425
1543
def Introspect(self, object_path, connection):
1426
1544
"""Overloading of standard D-Bus method.
1427
1545
1428
1546
Override return argument name of GetManagedObjects to be
1429
1547
"objpath_interfaces_and_properties"
1430
1548
"""
1433
1551
connection)
1434
1552
try:
1435
1553
document = xml.dom.minidom.parseString(xmlstring)
1436
1554
1437
1555
for if_tag in document.getElementsByTagName("interface"):
1438
1556
# Fix argument name for the GetManagedObjects method
1439
1557
if (if_tag.getAttribute("name")
1440
== dbus.OBJECT_MANAGER_IFACE):
1558
== dbus.OBJECT_MANAGER_IFACE):
1441
1559
for cn in if_tag.getElementsByTagName("method"):
1442
1560
if (cn.getAttribute("name")
1443
1561
== "GetManagedObjects"):
1453
1571
except (AttributeError, xml.dom.DOMException,
1454
1572
xml.parsers.expat.ExpatError) as error:
1455
1573
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1574
exc_info=error)
1457
1575
return xmlstring
1458
1576
1577
1459
1578
def datetime_to_dbus(dt, variant_level=0):
1460
1579
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1461
1580
if dt is None:
1462
return dbus.String("", variant_level = variant_level)
1581
return dbus.String("", variant_level=variant_level)
1463
1582
return dbus.String(dt.isoformat(), variant_level=variant_level)
1464
1583
1465
1584
1468
1587
dbus.service.Object, it will add alternate D-Bus attributes with
1469
1588
interface names according to the "alt_interface_names" mapping.
1470
1589
Usage:
1471
1590
1472
1591
@alternate_dbus_interfaces({"org.example.Interface":
1473
1592
"net.example.AlternateInterface"})
1474
1593
class SampleDBusObject(dbus.service.Object):
1475
1594
@dbus.service.method("org.example.Interface")
1476
1595
def SampleDBusMethod():
1477
1596
pass
1478
1597
1479
1598
The above "SampleDBusMethod" on "SampleDBusObject" will be
1480
1599
reachable via two interfaces: "org.example.Interface" and
1481
1600
"net.example.AlternateInterface", the latter of which will have
1482
1601
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1483
1602
"true", unless "deprecate" is passed with a False value.
1484
1603
1485
1604
This works for methods and signals, and also for D-Bus properties
1486
1605
(from DBusObjectWithProperties) and interfaces (from the
1487
1606
dbus_interface_annotations decorator).
1488
1607
"""
1489
1608
1490
1609
def wrapper(cls):
1491
1610
for orig_interface_name, alt_interface_name in (
1492
1611
alt_interface_names.items()):
1507
1626
interface_names.add(alt_interface)
1508
1627
# Is this a D-Bus signal?
1509
1628
if getattr(attribute, "_dbus_is_signal", False):
1629
# Extract the original non-method undecorated
1630
# function by black magic
1510
1631
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1513
1632
nonmethod_func = (dict(
1514
1633
zip(attribute.func_code.co_freevars,
1515
1634
attribute.__closure__))
1516
1635
["func"].cell_contents)
1517
1636
else:
1518
nonmethod_func = attribute
1637
nonmethod_func = (dict(
1638
zip(attribute.__code__.co_freevars,
1639
attribute.__closure__))
1640
["func"].cell_contents)
1519
1641
# Create a new, but exactly alike, function
1520
1642
# object, and decorate it to be a new D-Bus signal
1521
1643
# with the alternate D-Bus interface name
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1644
new_function = copy_function(nonmethod_func)
1536
1645
new_function = (dbus.service.signal(
1537
1646
alt_interface,
1538
1647
attribute._dbus_signature)(new_function))
1542
1651
attribute._dbus_annotations)
1543
1652
except AttributeError:
1544
1653
pass
1654
1545
1655
# Define a creator of a function to call both the
1546
1656
# original and alternate functions, so both the
1547
1657
# original and alternate signals gets sent when
1550
1660
"""This function is a scope container to pass
1551
1661
func1 and func2 to the "call_both" function
1552
1662
outside of its arguments"""
1553
1663
1554
1664
@functools.wraps(func2)
1555
1665
def call_both(*args, **kwargs):
1556
1666
"""This function will emit two D-Bus
1557
1667
signals by calling func1 and func2"""
1558
1668
func1(*args, **kwargs)
1559
1669
func2(*args, **kwargs)
1560
# Make wrapper function look like a D-Bus signal
1670
# Make wrapper function look like a D-Bus
1671
# signal
1561
1672
for name, attr in inspect.getmembers(func2):
1562
1673
if name.startswith("_dbus_"):
1563
1674
setattr(call_both, name, attr)
1564
1675
1565
1676
return call_both
1566
1677
# Create the "call_both" function and add it to
1567
1678
# the class
1577
1688
alt_interface,
1578
1689
attribute._dbus_in_signature,
1579
1690
attribute._dbus_out_signature)
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1691
(copy_function(attribute)))
1585
1692
# Copy annotations, if any
1586
1693
try:
1587
1694
attr[attrname]._dbus_annotations = dict(
1599
1706
attribute._dbus_access,
1600
1707
attribute._dbus_get_args_options
1601
1708
["byte_arrays"])
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1709
(copy_function(attribute)))
1608
1710
# Copy annotations, if any
1609
1711
try:
1610
1712
attr[attrname]._dbus_annotations = dict(
1619
1721
# to the class.
1620
1722
attr[attrname] = (
1621
1723
dbus_interface_annotations(alt_interface)
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1724
(copy_function(attribute)))
1627
1725
if deprecate:
1628
1726
# Deprecate all alternate interfaces
1629
iname="_AlternateDBusNames_interface_annotation{}"
1727
iname = "_AlternateDBusNames_interface_annotation{}"
1630
1728
for interface_name in interface_names:
1631
1729
1632
1730
@dbus_interface_annotations(interface_name)
1633
1731
def func(self):
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1732
return {"org.freedesktop.DBus.Deprecated":
1733
"true"}
1636
1734
# Find an unused name
1637
1735
for aname in (iname.format(i)
1638
1736
for i in itertools.count()):
1642
1740
if interface_names:
1643
1741
# Replace the class with a new subclass of it with
1644
1742
# methods, signals, etc. as created above.
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1743
if sys.version_info.major == 2:
1744
cls = type(b"{}Alternate".format(cls.__name__),
1745
(cls, ), attr)
1746
else:
1747
cls = type("{}Alternate".format(cls.__name__),
1748
(cls, ), attr)
1647
1749
return cls
1648
1750
1649
1751
return wrapper
1650
1752
1651
1753
1653
1755
"se.bsnet.fukt.Mandos"})
1654
1756
class ClientDBus(Client, DBusObjectWithProperties):
1655
1757
"""A Client class using D-Bus
1656
1758
1657
1759
Attributes:
1658
1760
dbus_object_path: dbus.ObjectPath
1659
1761
bus: dbus.SystemBus()
1660
1762
"""
1661
1763
1662
1764
runtime_expansions = (Client.runtime_expansions
1663
1765
+ ("dbus_object_path", ))
1664
1766
1665
1767
_interface = "se.recompile.Mandos.Client"
1666
1768
1667
1769
# dbus.service.Object doesn't use super(), so we can't either.
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1770
1771
def __init__(self, bus=None, *args, **kwargs):
1670
1772
self.bus = bus
1671
1773
Client.__init__(self, *args, **kwargs)
1672
1774
# Only now, when this client is initialized, can it show up on
1678
1780
"/clients/" + client_object_name)
1679
1781
DBusObjectWithProperties.__init__(self, self.bus,
1680
1782
self.dbus_object_path)
1681
1783
1682
1784
def notifychangeproperty(transform_func, dbus_name,
1683
1785
type_func=lambda x: x,
1684
1786
variant_level=1,
1686
1788
_interface=_interface):
1687
1789
""" Modify a variable so that it's a property which announces
1688
1790
its changes to DBus.
1689
1791
1690
1792
transform_fun: Function that takes a value and a variant_level
1691
1793
and transforms it to a D-Bus type.
1692
1794
dbus_name: D-Bus name of the variable
1695
1797
variant_level: D-Bus variant level. Default: 1
1696
1798
"""
1697
1799
attrname = "_{}".format(dbus_name)
1698
1800
1699
1801
def setter(self, value):
1700
1802
if hasattr(self, "dbus_object_path"):
1701
1803
if (not hasattr(self, attrname) or
1708
1810
else:
1709
1811
dbus_value = transform_func(
1710
1812
type_func(value),
1711
variant_level = variant_level)
1813
variant_level=variant_level)
1712
1814
self.PropertyChanged(dbus.String(dbus_name),
1713
1815
dbus_value)
1714
1816
self.PropertiesChanged(
1715
1817
_interface,
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1818
dbus.Dictionary({dbus.String(dbus_name):
1819
dbus_value}),
1718
1820
dbus.Array())
1719
1821
setattr(self, attrname, value)
1720
1822
1721
1823
return property(lambda self: getattr(self, attrname), setter)
1722
1824
1723
1825
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1724
1826
approvals_pending = notifychangeproperty(dbus.Boolean,
1725
1827
"ApprovalPending",
1726
type_func = bool)
1828
type_func=bool)
1727
1829
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1728
1830
last_enabled = notifychangeproperty(datetime_to_dbus,
1729
1831
"LastEnabled")
1730
1832
checker = notifychangeproperty(
1731
1833
dbus.Boolean, "CheckerRunning",
1732
type_func = lambda checker: checker is not None)
1834
type_func=lambda checker: checker is not None)
1733
1835
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1734
1836
"LastCheckedOK")
1735
1837
last_checker_status = notifychangeproperty(dbus.Int16,
1740
1842
"ApprovedByDefault")
1741
1843
approval_delay = notifychangeproperty(
1742
1844
dbus.UInt64, "ApprovalDelay",
1743
type_func = lambda td: td.total_seconds() * 1000)
1845
type_func=lambda td: td.total_seconds() * 1000)
1744
1846
approval_duration = notifychangeproperty(
1745
1847
dbus.UInt64, "ApprovalDuration",
1746
type_func = lambda td: td.total_seconds() * 1000)
1848
type_func=lambda td: td.total_seconds() * 1000)
1747
1849
host = notifychangeproperty(dbus.String, "Host")
1748
1850
timeout = notifychangeproperty(
1749
1851
dbus.UInt64, "Timeout",
1750
type_func = lambda td: td.total_seconds() * 1000)
1852
type_func=lambda td: td.total_seconds() * 1000)
1751
1853
extended_timeout = notifychangeproperty(
1752
1854
dbus.UInt64, "ExtendedTimeout",
1753
type_func = lambda td: td.total_seconds() * 1000)
1855
type_func=lambda td: td.total_seconds() * 1000)
1754
1856
interval = notifychangeproperty(
1755
1857
dbus.UInt64, "Interval",
1756
type_func = lambda td: td.total_seconds() * 1000)
1858
type_func=lambda td: td.total_seconds() * 1000)
1757
1859
checker_command = notifychangeproperty(dbus.String, "Checker")
1758
1860
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1759
1861
invalidate_only=True)
1760
1862
1761
1863
del notifychangeproperty
1762
1864
1763
1865
def __del__(self, *args, **kwargs):
1764
1866
try:
1765
1867
self.remove_from_connection()
1768
1870
if hasattr(DBusObjectWithProperties, "__del__"):
1769
1871
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1770
1872
Client.__del__(self, *args, **kwargs)
1771
1873
1772
1874
def checker_callback(self, source, condition,
1773
1875
connection, command, *args, **kwargs):
1774
1876
ret = Client.checker_callback(self, source, condition,
1790
1892
| self.last_checker_signal),
1791
1893
dbus.String(command))
1792
1894
return ret
1793
1895
1794
1896
def start_checker(self, *args, **kwargs):
1795
1897
old_checker_pid = getattr(self.checker, "pid", None)
1796
1898
r = Client.start_checker(self, *args, **kwargs)
1800
1902
# Emit D-Bus signal
1801
1903
self.CheckerStarted(self.current_checker_command)
1802
1904
return r
1803
1905
1804
1906
def _reset_approved(self):
1805
1907
self.approved = None
1806
1908
return False
1807
1909
1808
1910
def approve(self, value=True):
1809
1911
self.approved = value
1810
GObject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1912
GLib.timeout_add(int(self.approval_duration.total_seconds()
1913
* 1000), self._reset_approved)
1812
1914
self.send_changedstate()
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1915
1916
# D-Bus methods, signals & properties
1917
1918
# Interfaces
1919
1920
# Signals
1921
1820
1922
# CheckerCompleted - signal
1821
1923
@dbus.service.signal(_interface, signature="nxs")
1822
1924
def CheckerCompleted(self, exitcode, waitstatus, command):
1823
1925
"D-Bus signal"
1824
1926
pass
1825
1927
1826
1928
# CheckerStarted - signal
1827
1929
@dbus.service.signal(_interface, signature="s")
1828
1930
def CheckerStarted(self, command):
1829
1931
"D-Bus signal"
1830
1932
pass
1831
1933
1832
1934
# PropertyChanged - signal
1833
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1834
1936
@dbus.service.signal(_interface, signature="sv")
1835
1937
def PropertyChanged(self, property, value):
1836
1938
"D-Bus signal"
1837
1939
pass
1838
1940
1839
1941
# GotSecret - signal
1840
1942
@dbus.service.signal(_interface)
1841
1943
def GotSecret(self):
1844
1946
server to mandos-client
1845
1947
"""
1846
1948
pass
1847
1949
1848
1950
# Rejected - signal
1849
1951
@dbus.service.signal(_interface, signature="s")
1850
1952
def Rejected(self, reason):
1851
1953
"D-Bus signal"
1852
1954
pass
1853
1955
1854
1956
# NeedApproval - signal
1855
1957
@dbus.service.signal(_interface, signature="tb")
1856
1958
def NeedApproval(self, timeout, default):
1857
1959
"D-Bus signal"
1858
1960
return self.need_approval()
1859
1860
## Methods
1861
1961
1962
# Methods
1963
1862
1964
# Approve - method
1863
1965
@dbus.service.method(_interface, in_signature="b")
1864
1966
def Approve(self, value):
1865
1967
self.approve(value)
1866
1968
1867
1969
# CheckedOK - method
1868
1970
@dbus.service.method(_interface)
1869
1971
def CheckedOK(self):
1870
1972
self.checked_ok()
1871
1973
1872
1974
# Enable - method
1873
1975
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
1976
@dbus.service.method(_interface)
1875
1977
def Enable(self):
1876
1978
"D-Bus method"
1877
1979
self.enable()
1878
1980
1879
1981
# StartChecker - method
1880
1982
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
1983
@dbus.service.method(_interface)
1882
1984
def StartChecker(self):
1883
1985
"D-Bus method"
1884
1986
self.start_checker()
1885
1987
1886
1988
# Disable - method
1887
1989
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
1990
@dbus.service.method(_interface)
1889
1991
def Disable(self):
1890
1992
"D-Bus method"
1891
1993
self.disable()
1892
1994
1893
1995
# StopChecker - method
1894
1996
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
1997
@dbus.service.method(_interface)
1896
1998
def StopChecker(self):
1897
1999
self.stop_checker()
1898
1899
## Properties
1900
2000
2001
# Properties
2002
1901
2003
# ApprovalPending - property
1902
2004
@dbus_service_property(_interface, signature="b", access="read")
1903
2005
def ApprovalPending_dbus_property(self):
1904
2006
return dbus.Boolean(bool(self.approvals_pending))
1905
2007
1906
2008
# ApprovedByDefault - property
1907
2009
@dbus_service_property(_interface,
1908
2010
signature="b",
1911
2013
if value is None: # get
1912
2014
return dbus.Boolean(self.approved_by_default)
1913
2015
self.approved_by_default = bool(value)
1914
2016
1915
2017
# ApprovalDelay - property
1916
2018
@dbus_service_property(_interface,
1917
2019
signature="t",
1921
2023
return dbus.UInt64(self.approval_delay.total_seconds()
1922
2024
* 1000)
1923
2025
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1924
2026
1925
2027
# ApprovalDuration - property
1926
2028
@dbus_service_property(_interface,
1927
2029
signature="t",
1931
2033
return dbus.UInt64(self.approval_duration.total_seconds()
1932
2034
* 1000)
1933
2035
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
2036
1935
2037
# Name - property
1936
2038
@dbus_annotations(
1937
2039
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
2040
@dbus_service_property(_interface, signature="s", access="read")
1939
2041
def Name_dbus_property(self):
1940
2042
return dbus.String(self.name)
1941
2043
2044
# KeyID - property
2045
@dbus_annotations(
2046
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2047
@dbus_service_property(_interface, signature="s", access="read")
2048
def KeyID_dbus_property(self):
2049
return dbus.String(self.key_id)
2050
1942
2051
# Fingerprint - property
1943
2052
@dbus_annotations(
1944
2053
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
2054
@dbus_service_property(_interface, signature="s", access="read")
1946
2055
def Fingerprint_dbus_property(self):
1947
2056
return dbus.String(self.fingerprint)
1948
2057
1949
2058
# Host - property
1950
2059
@dbus_service_property(_interface,
1951
2060
signature="s",
1954
2063
if value is None: # get
1955
2064
return dbus.String(self.host)
1956
2065
self.host = str(value)
1957
2066
1958
2067
# Created - property
1959
2068
@dbus_annotations(
1960
2069
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
2070
@dbus_service_property(_interface, signature="s", access="read")
1962
2071
def Created_dbus_property(self):
1963
2072
return datetime_to_dbus(self.created)
1964
2073
1965
2074
# LastEnabled - property
1966
2075
@dbus_service_property(_interface, signature="s", access="read")
1967
2076
def LastEnabled_dbus_property(self):
1968
2077
return datetime_to_dbus(self.last_enabled)
1969
2078
1970
2079
# Enabled - property
1971
2080
@dbus_service_property(_interface,
1972
2081
signature="b",
1978
2087
self.enable()
1979
2088
else:
1980
2089
self.disable()
1981
2090
1982
2091
# LastCheckedOK - property
1983
2092
@dbus_service_property(_interface,
1984
2093
signature="s",
1988
2097
self.checked_ok()
1989
2098
return
1990
2099
return datetime_to_dbus(self.last_checked_ok)
1991
2100
1992
2101
# LastCheckerStatus - property
1993
2102
@dbus_service_property(_interface, signature="n", access="read")
1994
2103
def LastCheckerStatus_dbus_property(self):
1995
2104
return dbus.Int16(self.last_checker_status)
1996
2105
1997
2106
# Expires - property
1998
2107
@dbus_service_property(_interface, signature="s", access="read")
1999
2108
def Expires_dbus_property(self):
2000
2109
return datetime_to_dbus(self.expires)
2001
2110
2002
2111
# LastApprovalRequest - property
2003
2112
@dbus_service_property(_interface, signature="s", access="read")
2004
2113
def LastApprovalRequest_dbus_property(self):
2005
2114
return datetime_to_dbus(self.last_approval_request)
2006
2115
2007
2116
# Timeout - property
2008
2117
@dbus_service_property(_interface,
2009
2118
signature="t",
2024
2133
if (getattr(self, "disable_initiator_tag", None)
2025
2134
is None):
2026
2135
return
2027
GObject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = GObject.timeout_add(
2136
GLib.source_remove(self.disable_initiator_tag)
2137
self.disable_initiator_tag = GLib.timeout_add(
2029
2138
int((self.expires - now).total_seconds() * 1000),
2030
2139
self.disable)
2031
2140
2032
2141
# ExtendedTimeout - property
2033
2142
@dbus_service_property(_interface,
2034
2143
signature="t",
2038
2147
return dbus.UInt64(self.extended_timeout.total_seconds()
2039
2148
* 1000)
2040
2149
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2041
2150
2042
2151
# Interval - property
2043
2152
@dbus_service_property(_interface,
2044
2153
signature="t",
2051
2160
return
2052
2161
if self.enabled:
2053
2162
# Reschedule checker run
2054
GObject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = GObject.timeout_add(
2163
GLib.source_remove(self.checker_initiator_tag)
2164
self.checker_initiator_tag = GLib.timeout_add(
2056
2165
value, self.start_checker)
2057
self.start_checker() # Start one now, too
2058
2166
self.start_checker() # Start one now, too
2167
2059
2168
# Checker - property
2060
2169
@dbus_service_property(_interface,
2061
2170
signature="s",
2064
2173
if value is None: # get
2065
2174
return dbus.String(self.checker_command)
2066
2175
self.checker_command = str(value)
2067
2176
2068
2177
# CheckerRunning - property
2069
2178
@dbus_service_property(_interface,
2070
2179
signature="b",
2076
2185
self.start_checker()
2077
2186
else:
2078
2187
self.stop_checker()
2079
2188
2080
2189
# ObjectPath - property
2081
2190
@dbus_annotations(
2082
2191
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
2192
"org.freedesktop.DBus.Deprecated": "true"})
2084
2193
@dbus_service_property(_interface, signature="o", access="read")
2085
2194
def ObjectPath_dbus_property(self):
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2195
return self.dbus_object_path # is already a dbus.ObjectPath
2196
2088
2197
# Secret = property
2089
2198
@dbus_annotations(
2090
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2095
2204
byte_arrays=True)
2096
2205
def Secret_dbus_property(self, value):
2097
2206
self.secret = bytes(value)
2098
2207
2099
2208
del _interface
2100
2209
2101
2210
2102
2211
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2212
def __init__(self, child_pipe, key_id, fpr, address):
2104
2213
self._pipe = child_pipe
2105
self._pipe.send(('init', fpr, address))
2214
self._pipe.send(('init', key_id, fpr, address))
2106
2215
if not self._pipe.recv():
2107
raise KeyError(fpr)
2108
2216
raise KeyError(key_id or fpr)
2217
2109
2218
def __getattribute__(self, name):
2110
2219
if name == '_pipe':
2111
2220
return super(ProxyClient, self).__getattribute__(name)
2114
2223
if data[0] == 'data':
2115
2224
return data[1]
2116
2225
if data[0] == 'function':
2117
2226
2118
2227
def func(*args, **kwargs):
2119
2228
self._pipe.send(('funcall', name, args, kwargs))
2120
2229
return self._pipe.recv()[1]
2121
2230
2122
2231
return func
2123
2232
2124
2233
def __setattr__(self, name, value):
2125
2234
if name == '_pipe':
2126
2235
return super(ProxyClient, self).__setattr__(name, value)
2129
2238
2130
2239
class ClientHandler(socketserver.BaseRequestHandler, object):
2131
2240
"""A class to handle client connections.
2132
2241
2133
2242
Instantiated once for each connection to handle it.
2134
2243
Note: This will run in its own forked process."""
2135
2244
2136
2245
def handle(self):
2137
2246
with contextlib.closing(self.server.child_pipe) as child_pipe:
2138
2247
logger.info("TCP connection from: %s",
2139
2248
str(self.client_address))
2140
2249
logger.debug("Pipe FD: %d",
2141
2250
self.server.child_pipe.fileno())
2142
2251
2143
2252
session = gnutls.ClientSession(self.request)
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2253
2254
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2255
# "+AES-256-CBC", "+SHA1",
2256
# "+COMP-NULL", "+CTYPE-OPENPGP",
2257
# "+DHE-DSS"))
2149
2258
# Use a fallback default, since this MUST be set.
2150
2259
priority = self.server.gnutls_priority
2151
2260
if priority is None:
2152
2261
priority = "NORMAL"
2153
gnutls.priority_set_direct(session._c_object, priority,
2262
gnutls.priority_set_direct(session._c_object,
2263
priority.encode("utf-8"),
2154
2264
None)
2155
2265
2156
2266
# Start communication using the Mandos protocol
2157
2267
# Get protocol number
2158
2268
line = self.request.makefile().readline()
2163
2273
except (ValueError, IndexError, RuntimeError) as error:
2164
2274
logger.error("Unknown protocol version: %s", error)
2165
2275
return
2166
2276
2167
2277
# Start GnuTLS connection
2168
2278
try:
2169
2279
session.handshake()
2173
2283
# established. Just abandon the request.
2174
2284
return
2175
2285
logger.debug("Handshake succeeded")
2176
2286
2177
2287
approval_required = False
2178
2288
try:
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2289
if gnutls.has_rawpk:
2290
fpr = ""
2291
try:
2292
key_id = self.key_id(
2293
self.peer_certificate(session))
2294
except (TypeError, gnutls.Error) as error:
2295
logger.warning("Bad certificate: %s", error)
2296
return
2297
logger.debug("Key ID: %s", key_id)
2298
2299
else:
2300
key_id = ""
2301
try:
2302
fpr = self.fingerprint(
2303
self.peer_certificate(session))
2304
except (TypeError, gnutls.Error) as error:
2305
logger.warning("Bad certificate: %s", error)
2306
return
2307
logger.debug("Fingerprint: %s", fpr)
2308
2309
try:
2310
client = ProxyClient(child_pipe, key_id, fpr,
2189
2311
self.client_address)
2190
2312
except KeyError:
2191
2313
return
2192
2314
2193
2315
if client.approval_delay:
2194
2316
delay = client.approval_delay
2195
2317
client.approvals_pending += 1
2196
2318
approval_required = True
2197
2319
2198
2320
while True:
2199
2321
if not client.enabled:
2200
2322
logger.info("Client %s is disabled",
2203
2325
# Emit D-Bus signal
2204
2326
client.Rejected("Disabled")
2205
2327
return
2206
2328
2207
2329
if client.approved or not client.approval_delay:
2208
#We are approved or approval is disabled
2330
# We are approved or approval is disabled
2209
2331
break
2210
2332
elif client.approved is None:
2211
2333
logger.info("Client %s needs approval",
2222
2344
# Emit D-Bus signal
2223
2345
client.Rejected("Denied")
2224
2346
return
2225
2226
#wait until timeout or approved
2347
2348
# wait until timeout or approved
2227
2349
time = datetime.datetime.now()
2228
2350
client.changedstate.acquire()
2229
2351
client.changedstate.wait(delay.total_seconds())
2242
2364
break
2243
2365
else:
2244
2366
delay -= time2 - time
2245
2367
2246
2368
try:
2247
2369
session.send(client.secret)
2248
2370
except gnutls.Error as error:
2249
2371
logger.warning("gnutls send failed",
2250
exc_info = error)
2372
exc_info=error)
2251
2373
return
2252
2374
2253
2375
logger.info("Sending secret to %s", client.name)
2254
2376
# bump the timeout using extended_timeout
2255
2377
client.bump_timeout(client.extended_timeout)
2256
2378
if self.server.use_dbus:
2257
2379
# Emit D-Bus signal
2258
2380
client.GotSecret()
2259
2381
2260
2382
finally:
2261
2383
if approval_required:
2262
2384
client.approvals_pending -= 1
2265
2387
except gnutls.Error as error:
2266
2388
logger.warning("GnuTLS bye failed",
2267
2389
exc_info=error)
2268
2390
2269
2391
@staticmethod
2270
2392
def peer_certificate(session):
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2393
"Return the peer's certificate as a bytestring"
2394
try:
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2396
gnutls.CTYPE_PEERS)
2397
except AttributeError:
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2399
if gnutls.has_rawpk:
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2401
else:
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
# If not a valid certificate type...
2404
if cert_type not in valid_cert_types:
2405
logger.info("Cert type %r not in %r", cert_type,
2406
valid_cert_types)
2275
2407
# ...return invalid data
2276
2408
return b""
2277
2409
list_size = ctypes.c_uint(1)
2283
2415
return None
2284
2416
cert = cert_list[0]
2285
2417
return ctypes.string_at(cert.data, cert.size)
2286
2418
2419
@staticmethod
2420
def key_id(certificate):
2421
"Convert a certificate bytestring to a hexdigit key ID"
2422
# New GnuTLS "datum" with the public key
2423
datum = gnutls.datum_t(
2424
ctypes.cast(ctypes.c_char_p(certificate),
2425
ctypes.POINTER(ctypes.c_ubyte)),
2426
ctypes.c_uint(len(certificate)))
2427
# XXX all these need to be created in the gnutls "module"
2428
# New empty GnuTLS certificate
2429
pubkey = gnutls.pubkey_t()
2430
gnutls.pubkey_init(ctypes.byref(pubkey))
2431
# Import the raw public key into the certificate
2432
gnutls.pubkey_import(pubkey,
2433
ctypes.byref(datum),
2434
gnutls.X509_FMT_DER)
2435
# New buffer for the key ID
2436
buf = ctypes.create_string_buffer(32)
2437
buf_len = ctypes.c_size_t(len(buf))
2438
# Get the key ID from the raw public key into the buffer
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2444
# Deinit the certificate
2445
gnutls.pubkey_deinit(pubkey)
2446
2447
# Convert the buffer to a Python bytestring
2448
key_id = ctypes.string_at(buf, buf_len.value)
2449
# Convert the bytestring to hexadecimal notation
2450
hex_key_id = binascii.hexlify(key_id).upper()
2451
return hex_key_id
2452
2287
2453
@staticmethod
2288
2454
def fingerprint(openpgp):
2289
2455
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2304
2470
ctypes.byref(crtverify))
2305
2471
if crtverify.value != 0:
2306
2472
gnutls.openpgp_crt_deinit(crt)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2473
raise gnutls.CertificateSecurityError(code
2474
=crtverify.value)
2308
2475
# New buffer for the fingerprint
2309
2476
buf = ctypes.create_string_buffer(20)
2310
2477
buf_len = ctypes.c_size_t()
2322
2489
2323
2490
class MultiprocessingMixIn(object):
2324
2491
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2325
2492
2326
2493
def sub_process_main(self, request, address):
2327
2494
try:
2328
2495
self.finish_request(request, address)
2329
2496
except Exception:
2330
2497
self.handle_error(request, address)
2331
2498
self.close_request(request)
2332
2499
2333
2500
def process_request(self, request, address):
2334
2501
"""Start a new process to process the request."""
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2502
proc = multiprocessing.Process(target=self.sub_process_main,
2503
args=(request, address))
2337
2504
proc.start()
2338
2505
return proc
2339
2506
2340
2507
2341
2508
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2342
2509
""" adds a pipe to the MixIn """
2343
2510
2344
2511
def process_request(self, request, client_address):
2345
2512
"""Overrides and wraps the original process_request().
2346
2513
2347
2514
This function creates a new pipe in self.pipe
2348
2515
"""
2349
2516
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2350
2517
2351
2518
proc = MultiprocessingMixIn.process_request(self, request,
2352
2519
client_address)
2353
2520
self.child_pipe.close()
2354
2521
self.add_pipe(parent_pipe, proc)
2355
2522
2356
2523
def add_pipe(self, parent_pipe, proc):
2357
2524
"""Dummy function; override as necessary"""
2358
2525
raise NotImplementedError()
2361
2528
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2362
2529
socketserver.TCPServer, object):
2363
2530
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2364
2531
2365
2532
Attributes:
2366
2533
enabled: Boolean; whether this server is activated yet
2367
2534
interface: None or a network interface name (string)
2368
2535
use_ipv6: Boolean; to use IPv6 or not
2369
2536
"""
2370
2537
2371
2538
def __init__(self, server_address, RequestHandlerClass,
2372
2539
interface=None,
2373
2540
use_ipv6=True,
2383
2550
self.socketfd = socketfd
2384
2551
# Save the original socket.socket() function
2385
2552
self.socket_socket = socket.socket
2553
2386
2554
# To implement --socket, we monkey patch socket.socket.
2387
#
2555
#
2388
2556
# (When socketserver.TCPServer is a new-style class, we
2389
2557
# could make self.socket into a property instead of monkey
2390
2558
# patching socket.socket.)
2391
#
2559
#
2392
2560
# Create a one-time-only replacement for socket.socket()
2393
2561
@functools.wraps(socket.socket)
2394
2562
def socket_wrapper(*args, **kwargs):
2406
2574
# socket_wrapper(), if socketfd was set.
2407
2575
socketserver.TCPServer.__init__(self, server_address,
2408
2576
RequestHandlerClass)
2409
2577
2410
2578
def server_bind(self):
2411
2579
"""This overrides the normal server_bind() function
2412
2580
to bind to an interface if one was specified, and also NOT to
2413
2581
bind to an address or port if they were not specified."""
2582
global SO_BINDTODEVICE
2414
2583
if self.interface is not None:
2415
2584
if SO_BINDTODEVICE is None:
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2585
# Fall back to a hard-coded value which seems to be
2586
# common enough.
2587
logger.warning("SO_BINDTODEVICE not found, trying 25")
2588
SO_BINDTODEVICE = 25
2589
try:
2590
self.socket.setsockopt(
2591
socket.SOL_SOCKET, SO_BINDTODEVICE,
2592
(self.interface + "\0").encode("utf-8"))
2593
except socket.error as error:
2594
if error.errno == errno.EPERM:
2595
logger.error("No permission to bind to"
2596
" interface %s", self.interface)
2597
elif error.errno == errno.ENOPROTOOPT:
2598
logger.error("SO_BINDTODEVICE not available;"
2599
" cannot bind to interface %s",
2600
self.interface)
2601
elif error.errno == errno.ENODEV:
2602
logger.error("Interface %s does not exist,"
2603
" cannot bind", self.interface)
2604
else:
2605
raise
2437
2606
# Only bind(2) the socket if we really need to.
2438
2607
if self.server_address[0] or self.server_address[1]:
2608
if self.server_address[1]:
2609
self.allow_reuse_address = True
2439
2610
if not self.server_address[0]:
2440
2611
if self.address_family == socket.AF_INET6:
2441
any_address = "::" # in6addr_any
2612
any_address = "::" # in6addr_any
2442
2613
else:
2443
any_address = "0.0.0.0" # INADDR_ANY
2614
any_address = "0.0.0.0" # INADDR_ANY
2444
2615
self.server_address = (any_address,
2445
2616
self.server_address[1])
2446
2617
elif not self.server_address[1]:
2456
2627
2457
2628
class MandosServer(IPv6_TCPServer):
2458
2629
"""Mandos server.
2459
2630
2460
2631
Attributes:
2461
2632
clients: set of Client objects
2462
2633
gnutls_priority GnuTLS priority string
2463
2634
use_dbus: Boolean; to emit D-Bus signals or not
2464
2465
Assumes a GObject.MainLoop event loop.
2635
2636
Assumes a GLib.MainLoop event loop.
2466
2637
"""
2467
2638
2468
2639
def __init__(self, server_address, RequestHandlerClass,
2469
2640
interface=None,
2470
2641
use_ipv6=True,
2480
2651
self.gnutls_priority = gnutls_priority
2481
2652
IPv6_TCPServer.__init__(self, server_address,
2482
2653
RequestHandlerClass,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2654
interface=interface,
2655
use_ipv6=use_ipv6,
2656
socketfd=socketfd)
2657
2487
2658
def server_activate(self):
2488
2659
if self.enabled:
2489
2660
return socketserver.TCPServer.server_activate(self)
2490
2661
2491
2662
def enable(self):
2492
2663
self.enabled = True
2493
2664
2494
2665
def add_pipe(self, parent_pipe, proc):
2495
2666
# Call "handle_ipc" for both data and EOF events
2496
GObject.io_add_watch(
2667
GLib.io_add_watch(
2497
2668
parent_pipe.fileno(),
2498
GObject.IO_IN | GObject.IO_HUP,
2669
GLib.IO_IN | GLib.IO_HUP,
2499
2670
functools.partial(self.handle_ipc,
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2671
parent_pipe=parent_pipe,
2672
proc=proc))
2673
2503
2674
def handle_ipc(self, source, condition,
2504
2675
parent_pipe=None,
2505
proc = None,
2676
proc=None,
2506
2677
client_object=None):
2507
2678
# error, or the other end of multiprocessing.Pipe has closed
2508
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2679
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2509
2680
# Wait for other process to exit
2510
2681
proc.join()
2511
2682
return False
2512
2683
2513
2684
# Read a request from the child
2514
2685
request = parent_pipe.recv()
2515
2686
command = request[0]
2516
2687
2517
2688
if command == 'init':
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2689
key_id = request[1].decode("ascii")
2690
fpr = request[2].decode("ascii")
2691
address = request[3]
2692
2693
for c in self.clients.values():
2694
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2695
continue
2696
if key_id and c.key_id == key_id:
2697
client = c
2698
break
2699
if fpr and c.fingerprint == fpr:
2523
2700
client = c
2524
2701
break
2525
2702
else:
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2703
logger.info("Client not found for key ID: %s, address"
2704
": %s", key_id or fpr, address)
2528
2705
if self.use_dbus:
2529
2706
# Emit D-Bus signal
2530
mandos_dbus_service.ClientNotFound(fpr,
2707
mandos_dbus_service.ClientNotFound(key_id or fpr,
2531
2708
address[0])
2532
2709
parent_pipe.send(False)
2533
2710
return False
2534
2535
GObject.io_add_watch(
2711
2712
GLib.io_add_watch(
2536
2713
parent_pipe.fileno(),
2537
GObject.IO_IN | GObject.IO_HUP,
2714
GLib.IO_IN | GLib.IO_HUP,
2538
2715
functools.partial(self.handle_ipc,
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2716
parent_pipe=parent_pipe,
2717
proc=proc,
2718
client_object=client))
2542
2719
parent_pipe.send(True)
2543
2720
# remove the old hook in favor of the new above hook on
2544
2721
# same fileno
2547
2724
funcname = request[1]
2548
2725
args = request[2]
2549
2726
kwargs = request[3]
2550
2727
2551
2728
parent_pipe.send(('data', getattr(client_object,
2552
2729
funcname)(*args,
2553
2730
**kwargs)))
2554
2731
2555
2732
if command == 'getattr':
2556
2733
attrname = request[1]
2557
2734
if isinstance(client_object.__getattribute__(attrname),
2560
2737
else:
2561
2738
parent_pipe.send((
2562
2739
'data', client_object.__getattribute__(attrname)))
2563
2740
2564
2741
if command == 'setattr':
2565
2742
attrname = request[1]
2566
2743
value = request[2]
2567
2744
setattr(client_object, attrname, value)
2568
2745
2569
2746
return True
2570
2747
2571
2748
2572
2749
def rfc3339_duration_to_delta(duration):
2573
2750
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2574
2751
2575
2752
>>> rfc3339_duration_to_delta("P7D")
2576
2753
datetime.timedelta(7)
2577
2754
>>> rfc3339_duration_to_delta("PT60S")
2587
2764
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
2765
datetime.timedelta(1, 200)
2589
2766
"""
2590
2767
2591
2768
# Parsing an RFC 3339 duration with regular expressions is not
2592
2769
# possible - there would have to be multiple places for the same
2593
2770
# values, like seconds. The current code, while more esoteric, is
2594
2771
# cleaner without depending on a parsing library. If Python had a
2595
2772
# built-in library for parsing we would use it, but we'd like to
2596
2773
# avoid excessive use of external libraries.
2597
2774
2598
2775
# New type for defining tokens, syntax, and semantics all-in-one
2599
2776
Token = collections.namedtuple("Token", (
2600
2777
"regexp", # To match token; if "value" is not None, must have
2633
2810
frozenset((token_year, token_month,
2634
2811
token_day, token_time,
2635
2812
token_week)))
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2813
# Define starting values:
2814
# Value so far
2815
value = datetime.timedelta()
2638
2816
found_token = None
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2817
# Following valid tokens
2818
followers = frozenset((token_duration, ))
2819
# String left to parse
2820
s = duration
2641
2821
# Loop until end token is found
2642
2822
while found_token is not token_end:
2643
2823
# Search for any currently valid tokens
2667
2847
2668
2848
def string_to_delta(interval):
2669
2849
"""Parse a string and return a datetime.timedelta
2670
2850
2671
2851
>>> string_to_delta('7d')
2672
2852
datetime.timedelta(7)
2673
2853
>>> string_to_delta('60s')
2681
2861
>>> string_to_delta('5m 30s')
2682
2862
datetime.timedelta(0, 330)
2683
2863
"""
2684
2864
2685
2865
try:
2686
2866
return rfc3339_duration_to_delta(interval)
2687
2867
except ValueError:
2688
2868
pass
2689
2869
2690
2870
timevalue = datetime.timedelta(0)
2691
2871
for s in interval.split():
2692
2872
try:
2710
2890
return timevalue
2711
2891
2712
2892
2713
def daemon(nochdir = False, noclose = False):
2893
def daemon(nochdir=False, noclose=False):
2714
2894
"""See daemon(3). Standard BSD Unix function.
2715
2895
2716
2896
This should really exist as os.daemon, but it doesn't (yet)."""
2717
2897
if os.fork():
2718
2898
sys.exit()
2736
2916
2737
2917
2738
2918
def main():
2739
2919
2740
2920
##################################################################
2741
2921
# Parsing of options, both command line and config file
2742
2922
2743
2923
parser = argparse.ArgumentParser()
2744
2924
parser.add_argument("-v", "--version", action="version",
2745
version = "%(prog)s {}".format(version),
2925
version="%(prog)s {}".format(version),
2746
2926
help="show version number and exit")
2747
2927
parser.add_argument("-i", "--interface", metavar="IF",
2748
2928
help="Bind to interface IF")
2784
2964
parser.add_argument("--no-zeroconf", action="store_false",
2785
2965
dest="zeroconf", help="Do not use Zeroconf",
2786
2966
default=None)
2787
2967
2788
2968
options = parser.parse_args()
2789
2969
2790
2970
if options.check:
2791
2971
import doctest
2792
2972
fail_count, test_count = doctest.testmod()
2793
2973
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
2974
2795
2975
# Default values for config file for server-global settings
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
2976
if gnutls.has_rawpk:
2977
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2978
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2979
else:
2980
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2981
":+SIGN-DSA-SHA256")
2982
server_defaults = {"interface": "",
2983
"address": "",
2984
"port": "",
2985
"debug": "False",
2986
"priority": priority,
2987
"servicename": "Mandos",
2988
"use_dbus": "True",
2989
"use_ipv6": "True",
2990
"debuglevel": "",
2991
"restore": "True",
2992
"socket": "",
2993
"statedir": "/var/lib/mandos",
2994
"foreground": "False",
2995
"zeroconf": "True",
2996
}
2997
del priority
2998
2814
2999
# Parse config file for server-global settings
2815
3000
server_config = configparser.SafeConfigParser(server_defaults)
2816
3001
del server_defaults
2818
3003
# Convert the SafeConfigParser object to a dict
2819
3004
server_settings = server_config.defaults()
2820
3005
# Use the appropriate methods on the non-string config options
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3006
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3007
"foreground", "zeroconf"):
2822
3008
server_settings[option] = server_config.getboolean("DEFAULT",
2823
3009
option)
2824
3010
if server_settings["port"]:
2834
3020
server_settings["socket"] = os.dup(server_settings
2835
3021
["socket"])
2836
3022
del server_config
2837
3023
2838
3024
# Override the settings from the config file with command line
2839
3025
# options, if set.
2840
3026
for option in ("interface", "address", "port", "debug",
2858
3044
if server_settings["debug"]:
2859
3045
server_settings["foreground"] = True
2860
3046
# Now we have our good server settings in "server_settings"
2861
3047
2862
3048
##################################################################
2863
3049
2864
3050
if (not server_settings["zeroconf"]
2865
3051
and not (server_settings["port"]
2866
3052
or server_settings["socket"] != "")):
2867
3053
parser.error("Needs port or socket to work without Zeroconf")
2868
3054
2869
3055
# For convenience
2870
3056
debug = server_settings["debug"]
2871
3057
debuglevel = server_settings["debuglevel"]
2875
3061
stored_state_file)
2876
3062
foreground = server_settings["foreground"]
2877
3063
zeroconf = server_settings["zeroconf"]
2878
3064
2879
3065
if debug:
2880
3066
initlogger(debug, logging.DEBUG)
2881
3067
else:
2884
3070
else:
2885
3071
level = getattr(logging, debuglevel.upper())
2886
3072
initlogger(debug, level)
2887
3073
2888
3074
if server_settings["servicename"] != "Mandos":
2889
3075
syslogger.setFormatter(
2890
3076
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
3077
' %(levelname)s: %(message)s'.format(
2892
3078
server_settings["servicename"])))
2893
3079
2894
3080
# Parse config file with clients
2895
3081
client_config = configparser.SafeConfigParser(Client
2896
3082
.client_defaults)
2897
3083
client_config.read(os.path.join(server_settings["configdir"],
2898
3084
"clients.conf"))
2899
3085
2900
3086
global mandos_dbus_service
2901
3087
mandos_dbus_service = None
2902
3088
2903
3089
socketfd = None
2904
3090
if server_settings["socket"] != "":
2905
3091
socketfd = server_settings["socket"]
2921
3107
except IOError as e:
2922
3108
logger.error("Could not open file %r", pidfilename,
2923
3109
exc_info=e)
2924
3110
2925
3111
for name, group in (("_mandos", "_mandos"),
2926
3112
("mandos", "mandos"),
2927
3113
("nobody", "nogroup")):
2937
3123
try:
2938
3124
os.setgid(gid)
2939
3125
os.setuid(uid)
3126
if debug:
3127
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3128
gid))
2940
3129
except OSError as error:
3130
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3131
.format(uid, gid, os.strerror(error.errno)))
2941
3132
if error.errno != errno.EPERM:
2942
3133
raise
2943
3134
2944
3135
if debug:
2945
3136
# Enable all possible GnuTLS debugging
2946
3137
2947
3138
# "Use a log level over 10 to enable all debugging options."
2948
3139
# - GnuTLS manual
2949
3140
gnutls.global_set_log_level(11)
2950
3141
2951
3142
@gnutls.log_func
2952
3143
def debug_gnutls(level, string):
2953
3144
logger.debug("GnuTLS: %s", string[:-1])
2954
3145
2955
3146
gnutls.global_set_log_function(debug_gnutls)
2956
3147
2957
3148
# Redirect stdin so all checkers get /dev/null
2958
3149
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2959
3150
os.dup2(null, sys.stdin.fileno())
2960
3151
if null > 2:
2961
3152
os.close(null)
2962
3153
2963
3154
# Need to fork before connecting to D-Bus
2964
3155
if not foreground:
2965
3156
# Close all input and output, do double fork, etc.
2966
3157
daemon()
2967
2968
# multiprocessing will use threads, so before we use GObject we
2969
# need to inform GObject that threads will be used.
2970
GObject.threads_init()
2971
3158
3159
# multiprocessing will use threads, so before we use GLib we need
3160
# to inform GLib that threads will be used.
3161
GLib.threads_init()
3162
2972
3163
global main_loop
2973
3164
# From the Avahi example code
2974
3165
DBusGMainLoop(set_as_default=True)
2975
main_loop = GObject.MainLoop()
3166
main_loop = GLib.MainLoop()
2976
3167
bus = dbus.SystemBus()
2977
3168
# End of Avahi example code
2978
3169
if use_dbus:
2991
3182
if zeroconf:
2992
3183
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2993
3184
service = AvahiServiceToSyslog(
2994
name = server_settings["servicename"],
2995
servicetype = "_mandos._tcp",
2996
protocol = protocol,
2997
bus = bus)
3185
name=server_settings["servicename"],
3186
servicetype="_mandos._tcp",
3187
protocol=protocol,
3188
bus=bus)
2998
3189
if server_settings["interface"]:
2999
3190
service.interface = if_nametoindex(
3000
3191
server_settings["interface"].encode("utf-8"))
3001
3192
3002
3193
global multiprocessing_manager
3003
3194
multiprocessing_manager = multiprocessing.Manager()
3004
3195
3005
3196
client_class = Client
3006
3197
if use_dbus:
3007
client_class = functools.partial(ClientDBus, bus = bus)
3008
3198
client_class = functools.partial(ClientDBus, bus=bus)
3199
3009
3200
client_settings = Client.config_parser(client_config)
3010
3201
old_client_settings = {}
3011
3202
clients_data = {}
3012
3203
3013
3204
# This is used to redirect stdout and stderr for checker processes
3014
3205
global wnull
3015
wnull = open(os.devnull, "w") # A writable /dev/null
3206
wnull = open(os.devnull, "w") # A writable /dev/null
3016
3207
# Only used if server is running in foreground but not in debug
3017
3208
# mode
3018
3209
if debug or not foreground:
3019
3210
wnull.close()
3020
3211
3021
3212
# Get client data and settings from last running state.
3022
3213
if server_settings["restore"]:
3023
3214
try:
3024
3215
with open(stored_state_path, "rb") as stored_state:
3025
clients_data, old_client_settings = pickle.load(
3026
stored_state)
3216
if sys.version_info.major == 2:
3217
clients_data, old_client_settings = pickle.load(
3218
stored_state)
3219
else:
3220
bytes_clients_data, bytes_old_client_settings = (
3221
pickle.load(stored_state, encoding="bytes"))
3222
# Fix bytes to strings
3223
# clients_data
3224
# .keys()
3225
clients_data = {(key.decode("utf-8")
3226
if isinstance(key, bytes)
3227
else key): value
3228
for key, value in
3229
bytes_clients_data.items()}
3230
del bytes_clients_data
3231
for key in clients_data:
3232
value = {(k.decode("utf-8")
3233
if isinstance(k, bytes) else k): v
3234
for k, v in
3235
clients_data[key].items()}
3236
clients_data[key] = value
3237
# .client_structure
3238
value["client_structure"] = [
3239
(s.decode("utf-8")
3240
if isinstance(s, bytes)
3241
else s) for s in
3242
value["client_structure"]]
3243
# .name & .host
3244
for k in ("name", "host"):
3245
if isinstance(value[k], bytes):
3246
value[k] = value[k].decode("utf-8")
3247
if not value.has_key("key_id"):
3248
value["key_id"] = ""
3249
elif not value.has_key("fingerprint"):
3250
value["fingerprint"] = ""
3251
# old_client_settings
3252
# .keys()
3253
old_client_settings = {
3254
(key.decode("utf-8")
3255
if isinstance(key, bytes)
3256
else key): value
3257
for key, value in
3258
bytes_old_client_settings.items()}
3259
del bytes_old_client_settings
3260
# .host
3261
for value in old_client_settings.values():
3262
if isinstance(value["host"], bytes):
3263
value["host"] = (value["host"]
3264
.decode("utf-8"))
3027
3265
os.remove(stored_state_path)
3028
3266
except IOError as e:
3029
3267
if e.errno == errno.ENOENT:
3037
3275
logger.warning("Could not load persistent state: "
3038
3276
"EOFError:",
3039
3277
exc_info=e)
3040
3278
3041
3279
with PGPEngine() as pgp:
3042
3280
for client_name, client in clients_data.items():
3043
3281
# Skip removed clients
3044
3282
if client_name not in client_settings:
3045
3283
continue
3046
3284
3047
3285
# Decide which value to use after restoring saved state.
3048
3286
# We have three different values: Old config file,
3049
3287
# new config file, and saved state.
3060
3298
client[name] = value
3061
3299
except KeyError:
3062
3300
pass
3063
3301
3064
3302
# Clients who has passed its expire date can still be
3065
3303
# enabled if its last checker was successful. A Client
3066
3304
# whose checker succeeded before we stored its state is
3099
3337
client_name))
3100
3338
client["secret"] = (client_settings[client_name]
3101
3339
["secret"])
3102
3340
3103
3341
# Add/remove clients based on new changes made to config
3104
3342
for client_name in (set(old_client_settings)
3105
3343
- set(client_settings)):
3107
3345
for client_name in (set(client_settings)
3108
3346
- set(old_client_settings)):
3109
3347
clients_data[client_name] = client_settings[client_name]
3110
3348
3111
3349
# Create all client objects
3112
3350
for client_name, client in clients_data.items():
3113
3351
tcp_server.clients[client_name] = client_class(
3114
name = client_name,
3115
settings = client,
3116
server_settings = server_settings)
3117
3352
name=client_name,
3353
settings=client,
3354
server_settings=server_settings)
3355
3118
3356
if not tcp_server.clients:
3119
3357
logger.warning("No clients defined")
3120
3358
3121
3359
if not foreground:
3122
3360
if pidfile is not None:
3123
3361
pid = os.getpid()
3129
3367
pidfilename, pid)
3130
3368
del pidfile
3131
3369
del pidfilename
3132
3133
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3134
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3135
3370
3371
for termsig in (signal.SIGHUP, signal.SIGTERM):
3372
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3373
lambda: main_loop.quit() and False)
3374
3136
3375
if use_dbus:
3137
3376
3138
3377
@alternate_dbus_interfaces(
3139
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3378
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3140
3379
class MandosDBusService(DBusObjectWithObjectManager):
3141
3380
"""A D-Bus proxy object"""
3142
3381
3143
3382
def __init__(self):
3144
3383
dbus.service.Object.__init__(self, bus, "/")
3145
3384
3146
3385
_interface = "se.recompile.Mandos"
3147
3386
3148
3387
@dbus.service.signal(_interface, signature="o")
3149
3388
def ClientAdded(self, objpath):
3150
3389
"D-Bus signal"
3151
3390
pass
3152
3391
3153
3392
@dbus.service.signal(_interface, signature="ss")
3154
def ClientNotFound(self, fingerprint, address):
3393
def ClientNotFound(self, key_id, address):
3155
3394
"D-Bus signal"
3156
3395
pass
3157
3396
3158
3397
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3159
3398
"true"})
3160
3399
@dbus.service.signal(_interface, signature="os")
3161
3400
def ClientRemoved(self, objpath, name):
3162
3401
"D-Bus signal"
3163
3402
pass
3164
3403
3165
3404
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3166
3405
"true"})
3167
3406
@dbus.service.method(_interface, out_signature="ao")
3168
3407
def GetAllClients(self):
3169
3408
"D-Bus method"
3170
3409
return dbus.Array(c.dbus_object_path for c in
3171
tcp_server.clients.itervalues())
3172
3410
tcp_server.clients.values())
3411
3173
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3174
3413
"true"})
3175
3414
@dbus.service.method(_interface,
3177
3416
def GetAllClientsWithProperties(self):
3178
3417
"D-Bus method"
3179
3418
return dbus.Dictionary(
3180
{ c.dbus_object_path: c.GetAll(
3419
{c.dbus_object_path: c.GetAll(
3181
3420
"se.recompile.Mandos.Client")
3182
for c in tcp_server.clients.itervalues() },
3421
for c in tcp_server.clients.values()},
3183
3422
signature="oa{sv}")
3184
3423
3185
3424
@dbus.service.method(_interface, in_signature="o")
3186
3425
def RemoveClient(self, object_path):
3187
3426
"D-Bus method"
3188
for c in tcp_server.clients.itervalues():
3427
for c in tcp_server.clients.values():
3189
3428
if c.dbus_object_path == object_path:
3190
3429
del tcp_server.clients[c.name]
3191
3430
c.remove_from_connection()
3195
3434
self.client_removed_signal(c)
3196
3435
return
3197
3436
raise KeyError(object_path)
3198
3437
3199
3438
del _interface
3200
3439
3201
3440
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3202
out_signature = "a{oa{sa{sv}}}")
3441
out_signature="a{oa{sa{sv}}}")
3203
3442
def GetManagedObjects(self):
3204
3443
"""D-Bus method"""
3205
3444
return dbus.Dictionary(
3206
{ client.dbus_object_path:
3207
dbus.Dictionary(
3208
{ interface: client.GetAll(interface)
3209
for interface in
3210
client._get_all_interface_names()})
3211
for client in tcp_server.clients.values()})
3212
3445
{client.dbus_object_path:
3446
dbus.Dictionary(
3447
{interface: client.GetAll(interface)
3448
for interface in
3449
client._get_all_interface_names()})
3450
for client in tcp_server.clients.values()})
3451
3213
3452
def client_added_signal(self, client):
3214
3453
"""Send the new standard signal and the old signal"""
3215
3454
if use_dbus:
3217
3456
self.InterfacesAdded(
3218
3457
client.dbus_object_path,
3219
3458
dbus.Dictionary(
3220
{ interface: client.GetAll(interface)
3221
for interface in
3222
client._get_all_interface_names()}))
3459
{interface: client.GetAll(interface)
3460
for interface in
3461
client._get_all_interface_names()}))
3223
3462
# Old signal
3224
3463
self.ClientAdded(client.dbus_object_path)
3225
3464
3226
3465
def client_removed_signal(self, client):
3227
3466
"""Send the new standard signal and the old signal"""
3228
3467
if use_dbus:
3233
3472
# Old signal
3234
3473
self.ClientRemoved(client.dbus_object_path,
3235
3474
client.name)
3236
3475
3237
3476
mandos_dbus_service = MandosDBusService()
3238
3477
3478
# Save modules to variables to exempt the modules from being
3479
# unloaded before the function registered with atexit() is run.
3480
mp = multiprocessing
3481
wn = wnull
3482
3239
3483
def cleanup():
3240
3484
"Cleanup function; run on exit"
3241
3485
if zeroconf:
3242
3486
service.cleanup()
3243
3244
multiprocessing.active_children()
3245
wnull.close()
3487
3488
mp.active_children()
3489
wn.close()
3246
3490
if not (tcp_server.clients or client_settings):
3247
3491
return
3248
3492
3249
3493
# Store client before exiting. Secrets are encrypted with key
3250
3494
# based on what config file has. If config file is
3251
3495
# removed/edited, old secret will thus be unrecovable.
3252
3496
clients = {}
3253
3497
with PGPEngine() as pgp:
3254
for client in tcp_server.clients.itervalues():
3498
for client in tcp_server.clients.values():
3255
3499
key = client_settings[client.name]["secret"]
3256
3500
client.encrypted_secret = pgp.encrypt(client.secret,
3257
3501
key)
3258
3502
client_dict = {}
3259
3503
3260
3504
# A list of attributes that can not be pickled
3261
3505
# + secret.
3262
exclude = { "bus", "changedstate", "secret",
3263
"checker", "server_settings" }
3506
exclude = {"bus", "changedstate", "secret",
3507
"checker", "server_settings"}
3264
3508
for name, typ in inspect.getmembers(dbus.service
3265
3509
.Object):
3266
3510
exclude.add(name)
3267
3511
3268
3512
client_dict["encrypted_secret"] = (client
3269
3513
.encrypted_secret)
3270
3514
for attr in client.client_structure:
3271
3515
if attr not in exclude:
3272
3516
client_dict[attr] = getattr(client, attr)
3273
3517
3274
3518
clients[client.name] = client_dict
3275
3519
del client_settings[client.name]["secret"]
3276
3520
3277
3521
try:
3278
3522
with tempfile.NamedTemporaryFile(
3279
3523
mode='wb',
3281
3525
prefix='clients-',
3282
3526
dir=os.path.dirname(stored_state_path),
3283
3527
delete=False) as stored_state:
3284
pickle.dump((clients, client_settings), stored_state)
3528
pickle.dump((clients, client_settings), stored_state,
3529
protocol=2)
3285
3530
tempname = stored_state.name
3286
3531
os.rename(tempname, stored_state_path)
3287
3532
except (IOError, OSError) as e:
3297
3542
logger.warning("Could not save persistent state:",
3298
3543
exc_info=e)
3299
3544
raise
3300
3545
3301
3546
# Delete all clients, and settings from config
3302
3547
while tcp_server.clients:
3303
3548
name, client = tcp_server.clients.popitem()
3309
3554
if use_dbus:
3310
3555
mandos_dbus_service.client_removed_signal(client)
3311
3556
client_settings.clear()
3312
3557
3313
3558
atexit.register(cleanup)
3314
3315
for client in tcp_server.clients.itervalues():
3559
3560
for client in tcp_server.clients.values():
3316
3561
if use_dbus:
3317
3562
# Emit D-Bus signal for adding
3318
3563
mandos_dbus_service.client_added_signal(client)
3319
3564
# Need to initiate checking of clients
3320
3565
if client.enabled:
3321
3566
client.init_checker()
3322
3567
3323
3568
tcp_server.enable()
3324
3569
tcp_server.server_activate()
3325
3570
3326
3571
# Find out what port we got
3327
3572
if zeroconf:
3328
3573
service.port = tcp_server.socket.getsockname()[1]
3333
3578
else: # IPv4
3334
3579
logger.info("Now listening on address %r, port %d",
3335
3580
*tcp_server.socket.getsockname())
3336
3337
#service.interface = tcp_server.socket.getsockname()[3]
3338
3581
3582
# service.interface = tcp_server.socket.getsockname()[3]
3583
3339
3584
try:
3340
3585
if zeroconf:
3341
3586
# From the Avahi example code
3346
3591
cleanup()
3347
3592
sys.exit(1)
3348
3593
# End of Avahi example code
3349
3350
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3351
lambda *args, **kwargs:
3352
(tcp_server.handle_request
3353
(*args[2:], **kwargs) or True))
3354
3594
3595
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3596
lambda *args, **kwargs:
3597
(tcp_server.handle_request
3598
(*args[2:], **kwargs) or True))
3599
3355
3600
logger.debug("Starting main loop")
3356
3601
main_loop.run()
3357
3602
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0