To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1151
- compare with another revision
- download diff
- download tarball
- view history from revision 1151
- Committer: Teddy Hogeborn
- Date: 2019-08-05 21:03:31 UTC
- Revision ID: teddy@recompile.se-20190805210331-vut4mdrc129c6ycs
Override lintian warning about old debhelper format
* debian/source/lintian-overrides
(package-uses-old-debhelper-compat-version): New; set to "10".
* debian/source/lintian-overrides
(package-uses-old-debhelper-compat-version): New; set to "10".
- files added:
- bugs.xml
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
76
80
77
81
import dbus
78
82
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
83
import gi
84
from gi.repository import GLib
84
85
from dbus.mainloop.glib import DBusGMainLoop
85
86
import ctypes
86
87
import ctypes.util
87
88
import xml.dom.minidom
88
89
import inspect
89
90
91
# Try to find the value of SO_BINDTODEVICE:
90
92
try:
93
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
94
# newer, and it is also the most natural place for it:
91
95
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
96
except AttributeError:
93
97
try:
98
# This is where SO_BINDTODEVICE was up to and including Python
99
# 2.6, and also 3.2:
94
100
from IN import SO_BINDTODEVICE
95
101
except ImportError:
96
SO_BINDTODEVICE = None
102
# In Python 2.7 it seems to have been removed entirely.
103
# Try running the C preprocessor:
104
try:
105
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
"/dev/stdin"],
107
stdin=subprocess.PIPE,
108
stdout=subprocess.PIPE)
109
stdout = cc.communicate(
110
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
111
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
112
except (OSError, ValueError, IndexError):
113
# No value found
114
SO_BINDTODEVICE = None
97
115
98
116
if sys.version_info.major == 2:
99
117
str = unicode
100
118
101
version = "1.7.1"
119
if sys.version_info < (3, 2):
120
configparser.Configparser = configparser.SafeConfigParser
121
122
version = "1.8.6"
102
123
stored_state_file = "clients.pickle"
103
124
104
125
logger = logging.getLogger()
108
129
if_nametoindex = ctypes.cdll.LoadLibrary(
109
130
ctypes.util.find_library("c")).if_nametoindex
110
131
except (OSError, AttributeError):
111
132
112
133
def if_nametoindex(interface):
113
134
"Get an interface index the hard way, i.e. using fcntl()"
114
135
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
140
return interface_index
120
141
121
142
143
def copy_function(func):
144
"""Make a copy of a function"""
145
if sys.version_info.major == 2:
146
return types.FunctionType(func.func_code,
147
func.func_globals,
148
func.func_name,
149
func.func_defaults,
150
func.func_closure)
151
else:
152
return types.FunctionType(func.__code__,
153
func.__globals__,
154
func.__name__,
155
func.__defaults__,
156
func.__closure__)
157
158
122
159
def initlogger(debug, level=logging.WARNING):
123
160
"""init logger and add loglevel"""
124
161
125
162
global syslogger
126
163
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
164
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
165
address="/dev/log"))
129
166
syslogger.setFormatter(logging.Formatter
130
167
('Mandos [%(process)d]: %(levelname)s:'
131
168
' %(message)s'))
132
169
logger.addHandler(syslogger)
133
170
134
171
if debug:
135
172
console = logging.StreamHandler()
136
173
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
148
185
149
186
class PGPEngine(object):
150
187
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
188
152
189
def __init__(self):
153
190
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
191
self.gpg = "gpg"
192
try:
193
output = subprocess.check_output(["gpgconf"])
194
for line in output.splitlines():
195
name, text, path = line.split(b":")
196
if name == "gpg":
197
self.gpg = path
198
break
199
except OSError as e:
200
if e.errno != errno.ENOENT:
201
raise
154
202
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
203
'--homedir', self.tempdir,
156
204
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
205
'--quiet']
206
# Only GPG version 1 has the --no-use-agent option.
207
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
208
self.gnupgargs.append("--no-use-agent")
209
160
210
def __enter__(self):
161
211
return self
162
212
163
213
def __exit__(self, exc_type, exc_value, traceback):
164
214
self._cleanup()
165
215
return False
166
216
167
217
def __del__(self):
168
218
self._cleanup()
169
219
170
220
def _cleanup(self):
171
221
if self.tempdir is not None:
172
222
# Delete contents of tempdir
173
223
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
224
topdown=False):
175
225
for filename in files:
176
226
os.remove(os.path.join(root, filename))
177
227
for dirname in dirs:
179
229
# Remove tempdir
180
230
os.rmdir(self.tempdir)
181
231
self.tempdir = None
182
232
183
233
def password_encode(self, password):
184
234
# Passphrase can not be empty and can not contain newlines or
185
235
# NUL bytes. So we prefix it and hex encode it.
190
240
.replace(b"\n", b"\\n")
191
241
.replace(b"\0", b"\\x00"))
192
242
return encoded
193
243
194
244
def encrypt(self, data, password):
195
245
passphrase = self.password_encode(password)
196
246
with tempfile.NamedTemporaryFile(
197
247
dir=self.tempdir) as passfile:
198
248
passfile.write(passphrase)
199
249
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
250
proc = subprocess.Popen([self.gpg, '--symmetric',
201
251
'--passphrase-file',
202
252
passfile.name]
203
253
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
254
stdin=subprocess.PIPE,
255
stdout=subprocess.PIPE,
256
stderr=subprocess.PIPE)
257
ciphertext, err = proc.communicate(input=data)
208
258
if proc.returncode != 0:
209
259
raise PGPError(err)
210
260
return ciphertext
211
261
212
262
def decrypt(self, data, password):
213
263
passphrase = self.password_encode(password)
214
264
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
265
dir=self.tempdir) as passfile:
216
266
passfile.write(passphrase)
217
267
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
268
proc = subprocess.Popen([self.gpg, '--decrypt',
219
269
'--passphrase-file',
220
270
passfile.name]
221
271
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
decrypted_plaintext, err = proc.communicate(input=data)
226
276
if proc.returncode != 0:
227
277
raise PGPError(err)
228
278
return decrypted_plaintext
229
279
230
280
281
# Pretend that we have an Avahi module
282
class avahi(object):
283
"""This isn't so much a class as it is a module-like namespace."""
284
IF_UNSPEC = -1 # avahi-common/address.h
285
PROTO_UNSPEC = -1 # avahi-common/address.h
286
PROTO_INET = 0 # avahi-common/address.h
287
PROTO_INET6 = 1 # avahi-common/address.h
288
DBUS_NAME = "org.freedesktop.Avahi"
289
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
290
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
291
DBUS_PATH_SERVER = "/"
292
293
@staticmethod
294
def string_array_to_txt_array(t):
295
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
296
for s in t), signature="ay")
297
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
298
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
299
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
300
SERVER_INVALID = 0 # avahi-common/defs.h
301
SERVER_REGISTERING = 1 # avahi-common/defs.h
302
SERVER_RUNNING = 2 # avahi-common/defs.h
303
SERVER_COLLISION = 3 # avahi-common/defs.h
304
SERVER_FAILURE = 4 # avahi-common/defs.h
305
306
231
307
class AvahiError(Exception):
232
308
def __init__(self, value, *args, **kwargs):
233
309
self.value = value
245
321
246
322
class AvahiService(object):
247
323
"""An Avahi (Zeroconf) service.
248
324
249
325
Attributes:
250
326
interface: integer; avahi.IF_UNSPEC or an interface index.
251
327
Used to optionally bind to the specified interface.
263
339
server: D-Bus Server
264
340
bus: dbus.SystemBus()
265
341
"""
266
342
267
343
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
344
interface=avahi.IF_UNSPEC,
345
name=None,
346
servicetype=None,
347
port=None,
348
TXT=None,
349
domain="",
350
host="",
351
max_renames=32768,
352
protocol=avahi.PROTO_UNSPEC,
353
bus=None):
278
354
self.interface = interface
279
355
self.name = name
280
356
self.type = servicetype
289
365
self.server = None
290
366
self.bus = bus
291
367
self.entry_group_state_changed_match = None
292
368
293
369
def rename(self, remove=True):
294
370
"""Derived from the Avahi example code"""
295
371
if self.rename_count >= self.max_renames:
315
391
logger.critical("D-Bus Exception", exc_info=error)
316
392
self.cleanup()
317
393
os._exit(1)
318
394
319
395
def remove(self):
320
396
"""Derived from the Avahi example code"""
321
397
if self.entry_group_state_changed_match is not None:
323
399
self.entry_group_state_changed_match = None
324
400
if self.group is not None:
325
401
self.group.Reset()
326
402
327
403
def add(self):
328
404
"""Derived from the Avahi example code"""
329
405
self.remove()
346
422
dbus.UInt16(self.port),
347
423
avahi.string_array_to_txt_array(self.TXT))
348
424
self.group.Commit()
349
425
350
426
def entry_group_state_changed(self, state, error):
351
427
"""Derived from the Avahi example code"""
352
428
logger.debug("Avahi entry group state change: %i", state)
353
429
354
430
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
431
logger.debug("Zeroconf service established.")
356
432
elif state == avahi.ENTRY_GROUP_COLLISION:
360
436
logger.critical("Avahi: Error in group state changed %s",
361
437
str(error))
362
438
raise AvahiGroupError("State changed: {!s}".format(error))
363
439
364
440
def cleanup(self):
365
441
"""Derived from the Avahi example code"""
366
442
if self.group is not None:
371
447
pass
372
448
self.group = None
373
449
self.remove()
374
450
375
451
def server_state_changed(self, state, error=None):
376
452
"""Derived from the Avahi example code"""
377
453
logger.debug("Avahi server state change: %i", state)
406
482
logger.debug("Unknown state: %r", state)
407
483
else:
408
484
logger.debug("Unknown state: %r: %r", state, error)
409
485
410
486
def activate(self):
411
487
"""Derived from the Avahi example code"""
412
488
if self.server is None:
423
499
class AvahiServiceToSyslog(AvahiService):
424
500
def rename(self, *args, **kwargs):
425
501
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
502
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
427
503
syslogger.setFormatter(logging.Formatter(
428
504
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
505
.format(self.name)))
430
506
return ret
431
507
508
432
509
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
510
class gnutls(object):
511
"""This isn't so much a class as it is a module-like namespace."""
512
513
library = ctypes.util.find_library("gnutls")
514
if library is None:
515
library = ctypes.util.find_library("gnutls-deb0")
516
_library = ctypes.cdll.LoadLibrary(library)
517
del library
518
448
519
# Unless otherwise indicated, the constants and types below are
449
520
# all from the gnutls/gnutls.h C header file.
450
521
451
522
# Constants
452
523
E_SUCCESS = 0
453
524
E_INTERRUPTED = -52
454
525
E_AGAIN = -28
455
526
CRT_OPENPGP = 2
527
CRT_RAWPK = 3
456
528
CLIENT = 2
457
529
SHUT_RDWR = 0
458
530
CRD_CERTIFICATE = 1
459
531
E_NO_CERTIFICATE_FOUND = -49
532
X509_FMT_DER = 0
533
NO_TICKETS = 1<<10
534
ENABLE_RAWPK = 1<<18
535
CTYPE_PEERS = 3
536
KEYID_USE_SHA256 = 1 # gnutls/x509.h
460
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
538
462
539
# Types
463
540
class session_int(ctypes.Structure):
464
541
_fields_ = []
465
542
session_t = ctypes.POINTER(session_int)
543
466
544
class certificate_credentials_st(ctypes.Structure):
467
545
_fields_ = []
468
546
certificate_credentials_t = ctypes.POINTER(
469
547
certificate_credentials_st)
470
548
certificate_type_t = ctypes.c_int
549
471
550
class datum_t(ctypes.Structure):
472
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
552
('size', ctypes.c_uint)]
553
474
554
class openpgp_crt_int(ctypes.Structure):
475
555
_fields_ = []
476
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
559
credentials_type_t = ctypes.c_int
480
560
transport_ptr_t = ctypes.c_void_p
481
561
close_request_t = ctypes.c_int
482
562
483
563
# Exceptions
484
564
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
565
def __init__(self, message=None, code=None, args=()):
490
566
# Default usage is by a message string, but if a return
491
567
# code is passed, convert it to a string with
492
568
# gnutls.strerror()
493
569
self.code = code
494
570
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
571
message = gnutls.strerror(code)
572
return super(gnutls.Error, self).__init__(
497
573
message, *args)
498
574
499
575
class CertificateSecurityError(Error):
500
576
pass
501
577
502
578
# Classes
503
579
class Credentials(object):
504
580
def __init__(self):
506
582
gnutls.certificate_allocate_credentials(
507
583
ctypes.byref(self._c_object))
508
584
self.type = gnutls.CRD_CERTIFICATE
509
585
510
586
def __del__(self):
511
587
gnutls.certificate_free_credentials(self._c_object)
512
588
513
589
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
590
def __init__(self, socket, credentials=None):
515
591
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
592
gnutls_flags = gnutls.CLIENT
593
if gnutls.check_version(b"3.5.6"):
594
gnutls_flags |= gnutls.NO_TICKETS
595
if gnutls.has_rawpk:
596
gnutls_flags |= gnutls.ENABLE_RAWPK
597
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
598
del gnutls_flags
517
599
gnutls.set_default_priority(self._c_object)
518
600
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
601
gnutls.handshake_set_private_extensions(self._c_object,
525
607
ctypes.cast(credentials._c_object,
526
608
ctypes.c_void_p))
527
609
self.credentials = credentials
528
610
529
611
def __del__(self):
530
612
gnutls.deinit(self._c_object)
531
613
532
614
def handshake(self):
533
615
return gnutls.handshake(self._c_object)
534
616
535
617
def send(self, data):
536
618
data = bytes(data)
537
619
data_len = len(data)
539
621
data_len -= gnutls.record_send(self._c_object,
540
622
data[-data_len:],
541
623
data_len)
542
624
543
625
def bye(self):
544
626
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
627
546
628
# Error handling functions
547
629
def _error_code(result):
548
630
"""A function to raise exceptions on errors, suitable
550
632
if result >= 0:
551
633
return result
552
634
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
635
raise gnutls.CertificateSecurityError(code=result)
636
raise gnutls.Error(code=result)
637
556
638
def _retry_on_error(result, func, arguments):
557
639
"""A function to retry on some errors, suitable
558
640
for the 'errcheck' attribute on ctypes functions"""
561
643
return _error_code(result)
562
644
result = func(*arguments)
563
645
return result
564
646
565
647
# Unless otherwise indicated, the function declarations below are
566
648
# all from the gnutls/gnutls.h C header file.
567
649
568
650
# Functions
569
651
priority_set_direct = _library.gnutls_priority_set_direct
570
652
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
653
ctypes.POINTER(ctypes.c_char_p)]
572
654
priority_set_direct.restype = _error_code
573
655
574
656
init = _library.gnutls_init
575
657
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
658
init.restype = _error_code
577
659
578
660
set_default_priority = _library.gnutls_set_default_priority
579
661
set_default_priority.argtypes = [session_t]
580
662
set_default_priority.restype = _error_code
581
663
582
664
record_send = _library.gnutls_record_send
583
665
record_send.argtypes = [session_t, ctypes.c_void_p,
584
666
ctypes.c_size_t]
585
667
record_send.restype = ctypes.c_ssize_t
586
668
record_send.errcheck = _retry_on_error
587
669
588
670
certificate_allocate_credentials = (
589
671
_library.gnutls_certificate_allocate_credentials)
590
672
certificate_allocate_credentials.argtypes = [
591
673
ctypes.POINTER(certificate_credentials_t)]
592
674
certificate_allocate_credentials.restype = _error_code
593
675
594
676
certificate_free_credentials = (
595
677
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
678
certificate_free_credentials.argtypes = [
679
certificate_credentials_t]
597
680
certificate_free_credentials.restype = None
598
681
599
682
handshake_set_private_extensions = (
600
683
_library.gnutls_handshake_set_private_extensions)
601
684
handshake_set_private_extensions.argtypes = [session_t,
602
685
ctypes.c_int]
603
686
handshake_set_private_extensions.restype = None
604
687
605
688
credentials_set = _library.gnutls_credentials_set
606
689
credentials_set.argtypes = [session_t, credentials_type_t,
607
690
ctypes.c_void_p]
608
691
credentials_set.restype = _error_code
609
692
610
693
strerror = _library.gnutls_strerror
611
694
strerror.argtypes = [ctypes.c_int]
612
695
strerror.restype = ctypes.c_char_p
613
696
614
697
certificate_type_get = _library.gnutls_certificate_type_get
615
698
certificate_type_get.argtypes = [session_t]
616
699
certificate_type_get.restype = _error_code
617
700
618
701
certificate_get_peers = _library.gnutls_certificate_get_peers
619
702
certificate_get_peers.argtypes = [session_t,
620
703
ctypes.POINTER(ctypes.c_uint)]
621
704
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
705
623
706
global_set_log_level = _library.gnutls_global_set_log_level
624
707
global_set_log_level.argtypes = [ctypes.c_int]
625
708
global_set_log_level.restype = None
626
709
627
710
global_set_log_function = _library.gnutls_global_set_log_function
628
711
global_set_log_function.argtypes = [log_func]
629
712
global_set_log_function.restype = None
630
713
631
714
deinit = _library.gnutls_deinit
632
715
deinit.argtypes = [session_t]
633
716
deinit.restype = None
634
717
635
718
handshake = _library.gnutls_handshake
636
719
handshake.argtypes = [session_t]
637
720
handshake.restype = _error_code
638
721
handshake.errcheck = _retry_on_error
639
722
640
723
transport_set_ptr = _library.gnutls_transport_set_ptr
641
724
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
725
transport_set_ptr.restype = None
643
726
644
727
bye = _library.gnutls_bye
645
728
bye.argtypes = [session_t, close_request_t]
646
729
bye.restype = _error_code
647
730
bye.errcheck = _retry_on_error
648
731
649
732
check_version = _library.gnutls_check_version
650
733
check_version.argtypes = [ctypes.c_char_p]
651
734
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
735
736
_need_version = b"3.3.0"
737
if check_version(_need_version) is None:
738
raise self.Error("Needs GnuTLS {} or later"
739
.format(_need_version))
740
741
_tls_rawpk_version = b"3.6.6"
742
has_rawpk = bool(check_version(_tls_rawpk_version))
743
744
if has_rawpk:
745
# Types
746
class pubkey_st(ctypes.Structure):
747
_fields = []
748
pubkey_t = ctypes.POINTER(pubkey_st)
749
750
x509_crt_fmt_t = ctypes.c_int
751
752
# All the function declarations below are from gnutls/abstract.h
753
pubkey_init = _library.gnutls_pubkey_init
754
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
755
pubkey_init.restype = _error_code
756
757
pubkey_import = _library.gnutls_pubkey_import
758
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
759
x509_crt_fmt_t]
760
pubkey_import.restype = _error_code
761
762
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
763
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
764
ctypes.POINTER(ctypes.c_ubyte),
765
ctypes.POINTER(ctypes.c_size_t)]
766
pubkey_get_key_id.restype = _error_code
767
768
pubkey_deinit = _library.gnutls_pubkey_deinit
769
pubkey_deinit.argtypes = [pubkey_t]
770
pubkey_deinit.restype = None
771
else:
772
# All the function declarations below are from gnutls/openpgp.h
773
774
openpgp_crt_init = _library.gnutls_openpgp_crt_init
775
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
776
openpgp_crt_init.restype = _error_code
777
778
openpgp_crt_import = _library.gnutls_openpgp_crt_import
779
openpgp_crt_import.argtypes = [openpgp_crt_t,
780
ctypes.POINTER(datum_t),
781
openpgp_crt_fmt_t]
782
openpgp_crt_import.restype = _error_code
783
784
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
785
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
786
ctypes.POINTER(ctypes.c_uint)]
787
openpgp_crt_verify_self.restype = _error_code
788
789
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
790
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
791
openpgp_crt_deinit.restype = None
792
793
openpgp_crt_get_fingerprint = (
794
_library.gnutls_openpgp_crt_get_fingerprint)
795
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
796
ctypes.c_void_p,
797
ctypes.POINTER(
798
ctypes.c_size_t)]
799
openpgp_crt_get_fingerprint.restype = _error_code
800
801
if check_version(b"3.6.4"):
802
certificate_type_get2 = _library.gnutls_certificate_type_get2
803
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
804
certificate_type_get2.restype = _error_code
805
682
806
# Remove non-public functions
683
807
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
808
686
809
687
810
def call_pipe(connection, # : multiprocessing.Connection
688
811
func, *args, **kwargs):
689
812
"""This function is meant to be called by multiprocessing.Process
690
813
691
814
This function runs func(*args, **kwargs), and writes the resulting
692
815
return value on the provided multiprocessing.Connection.
693
816
"""
694
817
connection.send(func(*args, **kwargs))
695
818
connection.close()
696
819
820
697
821
class Client(object):
698
822
"""A representation of a client host served by this server.
699
823
700
824
Attributes:
701
825
approved: bool(); 'None' if not yet approved/disapproved
702
826
approval_delay: datetime.timedelta(); Time to wait for approval
703
827
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
828
checker: multiprocessing.Process(); a running checker process used
829
to see if the client lives. 'None' if no process is
830
running.
831
checker_callback_tag: a GLib event source tag, or None
708
832
checker_command: string; External command which is run to check
709
833
if client lives. %() expansions are done at
710
834
runtime with vars(self) as dict, so that for
711
835
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
836
checker_initiator_tag: a GLib event source tag, or None
713
837
created: datetime.datetime(); (UTC) object creation
714
838
client_structure: Object describing what attributes a client has
715
839
and is used for storing the client at exit
716
840
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
841
disable_initiator_tag: a GLib event source tag, or None
718
842
enabled: bool()
719
843
fingerprint: string (40 or 32 hexadecimal digits); used to
720
uniquely identify the client
844
uniquely identify an OpenPGP client
845
key_id: string (64 hexadecimal digits); used to uniquely identify
846
a client using raw public keys
721
847
host: string; available for use by the checker command
722
848
interval: datetime.timedelta(); How often to start a new checker
723
849
last_approval_request: datetime.datetime(); (UTC) or None
739
865
disabled, or None
740
866
server_settings: The server_settings dict from main()
741
867
"""
742
868
743
869
runtime_expansions = ("approval_delay", "approval_duration",
744
"created", "enabled", "expires",
870
"created", "enabled", "expires", "key_id",
745
871
"fingerprint", "host", "interval",
746
872
"last_approval_request", "last_checked_ok",
747
873
"last_enabled", "name", "timeout")
756
882
"approved_by_default": "True",
757
883
"enabled": "True",
758
884
}
759
885
760
886
@staticmethod
761
887
def config_parser(config):
762
888
"""Construct a new dict of client settings of this form:
769
895
for client_name in config.sections():
770
896
section = dict(config.items(client_name))
771
897
client = settings[client_name] = {}
772
898
773
899
client["host"] = section["host"]
774
900
# Reformat values from string types to Python types
775
901
client["approved_by_default"] = config.getboolean(
776
902
client_name, "approved_by_default")
777
903
client["enabled"] = config.getboolean(client_name,
778
904
"enabled")
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
905
906
# Uppercase and remove spaces from key_id and fingerprint
907
# for later comparison purposes with return value from the
908
# key_id() and fingerprint() functions
909
client["key_id"] = (section.get("key_id", "").upper()
910
.replace(" ", ""))
783
911
client["fingerprint"] = (section["fingerprint"].upper()
784
912
.replace(" ", ""))
785
913
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
914
client["secret"] = codecs.decode(section["secret"]
915
.encode("utf-8"),
916
"base64")
787
917
elif "secfile" in section:
788
918
with open(os.path.expanduser(os.path.expandvars
789
919
(section["secfile"])),
804
934
client["last_approval_request"] = None
805
935
client["last_checked_ok"] = None
806
936
client["last_checker_status"] = -2
807
937
808
938
return settings
809
810
def __init__(self, settings, name = None, server_settings=None):
939
940
def __init__(self, settings, name=None, server_settings=None):
811
941
self.name = name
812
942
if server_settings is None:
813
943
server_settings = {}
815
945
# adding all client settings
816
946
for setting, value in settings.items():
817
947
setattr(self, setting, value)
818
948
819
949
if self.enabled:
820
950
if not hasattr(self, "last_enabled"):
821
951
self.last_enabled = datetime.datetime.utcnow()
825
955
else:
826
956
self.last_enabled = None
827
957
self.expires = None
828
958
829
959
logger.debug("Creating client %r", self.name)
960
logger.debug(" Key ID: %s", self.key_id)
830
961
logger.debug(" Fingerprint: %s", self.fingerprint)
831
962
self.created = settings.get("created",
832
963
datetime.datetime.utcnow())
833
964
834
965
# attributes specific for this server instance
835
966
self.checker = None
836
967
self.checker_initiator_tag = None
842
973
self.changedstate = multiprocessing_manager.Condition(
843
974
multiprocessing_manager.Lock())
844
975
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
976
for attr in self.__dict__.keys()
846
977
if not attr.startswith("_")]
847
978
self.client_structure.append("client_structure")
848
979
849
980
for name, t in inspect.getmembers(
850
981
type(self), lambda obj: isinstance(obj, property)):
851
982
if not name.startswith("_"):
852
983
self.client_structure.append(name)
853
984
854
985
# Send notice to process children that client state has changed
855
986
def send_changedstate(self):
856
987
with self.changedstate:
857
988
self.changedstate.notify_all()
858
989
859
990
def enable(self):
860
991
"""Start this client's checker and timeout hooks"""
861
992
if getattr(self, "enabled", False):
866
997
self.last_enabled = datetime.datetime.utcnow()
867
998
self.init_checker()
868
999
self.send_changedstate()
869
1000
870
1001
def disable(self, quiet=True):
871
1002
"""Disable this client."""
872
1003
if not getattr(self, "enabled", False):
874
1005
if not quiet:
875
1006
logger.info("Disabling client %s", self.name)
876
1007
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
1008
GLib.source_remove(self.disable_initiator_tag)
878
1009
self.disable_initiator_tag = None
879
1010
self.expires = None
880
1011
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
1012
GLib.source_remove(self.checker_initiator_tag)
882
1013
self.checker_initiator_tag = None
883
1014
self.stop_checker()
884
1015
self.enabled = False
885
1016
if not quiet:
886
1017
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
1018
# Do not run this again if called by a GLib.timeout_add
888
1019
return False
889
1020
890
1021
def __del__(self):
891
1022
self.disable()
892
1023
893
1024
def init_checker(self):
894
1025
# Schedule a new checker to be started an 'interval' from now,
895
1026
# and every interval from then on.
896
1027
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
1028
GLib.source_remove(self.checker_initiator_tag)
1029
self.checker_initiator_tag = GLib.timeout_add(
899
1030
int(self.interval.total_seconds() * 1000),
900
1031
self.start_checker)
901
1032
# Schedule a disable() when 'timeout' has passed
902
1033
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
1034
GLib.source_remove(self.disable_initiator_tag)
1035
self.disable_initiator_tag = GLib.timeout_add(
905
1036
int(self.timeout.total_seconds() * 1000), self.disable)
906
1037
# Also start a new checker *right now*.
907
1038
self.start_checker()
908
1039
909
1040
def checker_callback(self, source, condition, connection,
910
1041
command):
911
1042
"""The checker has completed, so take appropriate actions."""
912
self.checker_callback_tag = None
913
self.checker = None
914
1043
# Read return code from connection (see call_pipe)
915
1044
returncode = connection.recv()
916
1045
connection.close()
917
1046
self.checker.join()
1047
self.checker_callback_tag = None
1048
self.checker = None
1049
918
1050
if returncode >= 0:
919
1051
self.last_checker_status = returncode
920
1052
self.last_checker_signal = None
930
1062
logger.warning("Checker for %(name)s crashed?",
931
1063
vars(self))
932
1064
return False
933
1065
934
1066
def checked_ok(self):
935
1067
"""Assert that the client has been seen, alive and well."""
936
1068
self.last_checked_ok = datetime.datetime.utcnow()
937
1069
self.last_checker_status = 0
938
1070
self.last_checker_signal = None
939
1071
self.bump_timeout()
940
1072
941
1073
def bump_timeout(self, timeout=None):
942
1074
"""Bump up the timeout for this client."""
943
1075
if timeout is None:
944
1076
timeout = self.timeout
945
1077
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1078
GLib.source_remove(self.disable_initiator_tag)
947
1079
self.disable_initiator_tag = None
948
1080
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1081
self.disable_initiator_tag = GLib.timeout_add(
950
1082
int(timeout.total_seconds() * 1000), self.disable)
951
1083
self.expires = datetime.datetime.utcnow() + timeout
952
1084
953
1085
def need_approval(self):
954
1086
self.last_approval_request = datetime.datetime.utcnow()
955
1087
956
1088
def start_checker(self):
957
1089
"""Start a new checker subprocess if one is not running.
958
1090
959
1091
If a checker already exists, leave it running and do
960
1092
nothing."""
961
1093
# The reason for not killing a running checker is that if we
966
1098
# checkers alone, the checker would have to take more time
967
1099
# than 'timeout' for the client to be disabled, which is as it
968
1100
# should be.
969
1101
970
1102
if self.checker is not None and not self.checker.is_alive():
971
1103
logger.warning("Checker was not alive; joining")
972
1104
self.checker.join()
976
1108
# Escape attributes for the shell
977
1109
escaped_attrs = {
978
1110
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
1111
for attr in self.runtime_expansions}
980
1112
try:
981
1113
command = self.checker_command % escaped_attrs
982
1114
except TypeError as error:
994
1126
# The exception is when not debugging but nevertheless
995
1127
# running in the foreground; use the previously
996
1128
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1129
popen_args = {"close_fds": True,
1130
"shell": True,
1131
"cwd": "/"}
1000
1132
if (not self.server_settings["debug"]
1001
1133
and self.server_settings["foreground"]):
1002
1134
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1135
"stderr": wnull})
1136
pipe = multiprocessing.Pipe(duplex=False)
1005
1137
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1138
target=call_pipe,
1139
args=(pipe[1], subprocess.call, command),
1140
kwargs=popen_args)
1009
1141
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1142
self.checker_callback_tag = GLib.io_add_watch(
1143
pipe[0].fileno(), GLib.IO_IN,
1012
1144
self.checker_callback, pipe[0], command)
1013
# Re-run this periodically if run by gobject.timeout_add
1145
# Re-run this periodically if run by GLib.timeout_add
1014
1146
return True
1015
1147
1016
1148
def stop_checker(self):
1017
1149
"""Force the checker process, if any, to stop."""
1018
1150
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1151
GLib.source_remove(self.checker_callback_tag)
1020
1152
self.checker_callback_tag = None
1021
1153
if getattr(self, "checker", None) is None:
1022
1154
return
1031
1163
byte_arrays=False):
1032
1164
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
1165
become properties on the D-Bus.
1034
1166
1035
1167
The decorated method will be called with no arguments by "Get"
1036
1168
and with one argument by "Set".
1037
1169
1038
1170
The parameters, where they are supported, are the same as
1039
1171
dbus.service.method, except there is only "signature", since the
1040
1172
type from Get() and the type sent to Set() is the same.
1044
1176
if byte_arrays and signature != "ay":
1045
1177
raise ValueError("Byte arrays not supported for non-'ay'"
1046
1178
" signature {!r}".format(signature))
1047
1179
1048
1180
def decorator(func):
1049
1181
func._dbus_is_property = True
1050
1182
func._dbus_interface = dbus_interface
1053
1185
func._dbus_name = func.__name__
1054
1186
if func._dbus_name.endswith("_dbus_property"):
1055
1187
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1188
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1057
1189
return func
1058
1190
1059
1191
return decorator
1060
1192
1061
1193
1062
1194
def dbus_interface_annotations(dbus_interface):
1063
1195
"""Decorator for marking functions returning interface annotations
1064
1196
1065
1197
Usage:
1066
1198
1067
1199
@dbus_interface_annotations("org.example.Interface")
1068
1200
def _foo(self): # Function name does not matter
1069
1201
return {"org.freedesktop.DBus.Deprecated": "true",
1070
1202
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
1203
"false"}
1072
1204
"""
1073
1205
1074
1206
def decorator(func):
1075
1207
func._dbus_is_interface = True
1076
1208
func._dbus_interface = dbus_interface
1077
1209
func._dbus_name = dbus_interface
1078
1210
return func
1079
1211
1080
1212
return decorator
1081
1213
1082
1214
1083
1215
def dbus_annotations(annotations):
1084
1216
"""Decorator to annotate D-Bus methods, signals or properties
1085
1217
Usage:
1086
1218
1087
1219
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
1220
"org.freedesktop.DBus.Property."
1089
1221
"EmitsChangedSignal": "false"})
1091
1223
access="r")
1092
1224
def Property_dbus_property(self):
1093
1225
return dbus.Boolean(False)
1094
1226
1095
1227
See also the DBusObjectWithAnnotations class.
1096
1228
"""
1097
1229
1098
1230
def decorator(func):
1099
1231
func._dbus_annotations = annotations
1100
1232
return func
1101
1233
1102
1234
return decorator
1103
1235
1104
1236
1122
1254
1123
1255
class DBusObjectWithAnnotations(dbus.service.Object):
1124
1256
"""A D-Bus object with annotations.
1125
1257
1126
1258
Classes inheriting from this can use the dbus_annotations
1127
1259
decorator to add annotations to methods or signals.
1128
1260
"""
1129
1261
1130
1262
@staticmethod
1131
1263
def _is_dbus_thing(thing):
1132
1264
"""Returns a function testing if an attribute is a D-Bus thing
1133
1265
1134
1266
If called like _is_dbus_thing("method") it returns a function
1135
1267
suitable for use as predicate to inspect.getmembers().
1136
1268
"""
1137
1269
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1138
1270
False)
1139
1271
1140
1272
def _get_all_dbus_things(self, thing):
1141
1273
"""Returns a generator of (name, attribute) pairs
1142
1274
"""
1145
1277
for cls in self.__class__.__mro__
1146
1278
for name, athing in
1147
1279
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1280
1149
1281
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1282
out_signature="s",
1283
path_keyword='object_path',
1284
connection_keyword='connection')
1153
1285
def Introspect(self, object_path, connection):
1154
1286
"""Overloading of standard D-Bus method.
1155
1287
1156
1288
Inserts annotation tags on methods and signals.
1157
1289
"""
1158
1290
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
1291
connection)
1160
1292
try:
1161
1293
document = xml.dom.minidom.parseString(xmlstring)
1162
1294
1163
1295
for if_tag in document.getElementsByTagName("interface"):
1164
1296
# Add annotation tags
1165
1297
for typ in ("method", "signal"):
1192
1324
if_tag.appendChild(ann_tag)
1193
1325
# Fix argument name for the Introspect method itself
1194
1326
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1327
== dbus.INTROSPECTABLE_IFACE):
1196
1328
for cn in if_tag.getElementsByTagName("method"):
1197
1329
if cn.getAttribute("name") == "Introspect":
1198
1330
for arg in cn.getElementsByTagName("arg"):
1211
1343
1212
1344
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
1345
"""A D-Bus object with properties.
1214
1346
1215
1347
Classes inheriting from this can use the dbus_service_property
1216
1348
decorator to expose methods as D-Bus properties. It exposes the
1217
1349
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
1350
"""
1219
1351
1220
1352
def _get_dbus_property(self, interface_name, property_name):
1221
1353
"""Returns a bound method if one exists which is a D-Bus
1222
1354
property with the specified name and interface.
1227
1359
if (value._dbus_name == property_name
1228
1360
and value._dbus_interface == interface_name):
1229
1361
return value.__get__(self)
1230
1362
1231
1363
# No such property
1232
1364
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
1365
self.dbus_object_path, interface_name, property_name))
1234
1366
1235
1367
@classmethod
1236
1368
def _get_all_interface_names(cls):
1237
1369
"""Get a sequence of all interfaces supported by an object"""
1240
1372
for x in (inspect.getmro(cls))
1241
1373
for attr in dir(x))
1242
1374
if name is not None)
1243
1375
1244
1376
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
1377
in_signature="ss",
1246
1378
out_signature="v")
1254
1386
if not hasattr(value, "variant_level"):
1255
1387
return value
1256
1388
return type(value)(value, variant_level=value.variant_level+1)
1257
1389
1258
1390
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
1391
def Set(self, interface_name, property_name, value):
1260
1392
"""Standard D-Bus property Set() method, see D-Bus standard.
1272
1404
value = dbus.ByteArray(b''.join(chr(byte)
1273
1405
for byte in value))
1274
1406
prop(value)
1275
1407
1276
1408
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
1409
in_signature="s",
1278
1410
out_signature="a{sv}")
1279
1411
def GetAll(self, interface_name):
1280
1412
"""Standard D-Bus property GetAll() method, see D-Bus
1281
1413
standard.
1282
1414
1283
1415
Note: Will not include properties with access="write".
1284
1416
"""
1285
1417
properties = {}
1296
1428
properties[name] = value
1297
1429
continue
1298
1430
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1431
value, variant_level=value.variant_level + 1)
1300
1432
return dbus.Dictionary(properties, signature="sv")
1301
1433
1302
1434
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
1435
def PropertiesChanged(self, interface_name, changed_properties,
1304
1436
invalidated_properties):
1306
1438
standard.
1307
1439
"""
1308
1440
pass
1309
1441
1310
1442
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
1443
out_signature="s",
1312
1444
path_keyword='object_path',
1313
1445
connection_keyword='connection')
1314
1446
def Introspect(self, object_path, connection):
1315
1447
"""Overloading of standard D-Bus method.
1316
1448
1317
1449
Inserts property tags and interface annotation tags.
1318
1450
"""
1319
1451
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1321
1453
connection)
1322
1454
try:
1323
1455
document = xml.dom.minidom.parseString(xmlstring)
1324
1456
1325
1457
def make_tag(document, name, prop):
1326
1458
e = document.createElement("property")
1327
1459
e.setAttribute("name", name)
1328
1460
e.setAttribute("type", prop._dbus_signature)
1329
1461
e.setAttribute("access", prop._dbus_access)
1330
1462
return e
1331
1463
1332
1464
for if_tag in document.getElementsByTagName("interface"):
1333
1465
# Add property tags
1334
1466
for tag in (make_tag(document, name, prop)
1376
1508
exc_info=error)
1377
1509
return xmlstring
1378
1510
1511
1379
1512
try:
1380
1513
dbus.OBJECT_MANAGER_IFACE
1381
1514
except AttributeError:
1382
1515
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1516
1517
1384
1518
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1519
"""A D-Bus object with an ObjectManager.
1386
1520
1387
1521
Classes inheriting from this exposes the standard
1388
1522
GetManagedObjects call and the InterfacesAdded and
1389
1523
InterfacesRemoved signals on the standard
1390
1524
"org.freedesktop.DBus.ObjectManager" interface.
1391
1525
1392
1526
Note: No signals are sent automatically; they must be sent
1393
1527
manually.
1394
1528
"""
1395
1529
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1530
out_signature="a{oa{sa{sv}}}")
1397
1531
def GetManagedObjects(self):
1398
1532
"""This function must be overridden"""
1399
1533
raise NotImplementedError()
1400
1534
1401
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1536
signature="oa{sa{sv}}")
1403
1537
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
1538
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1539
1540
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1541
def InterfacesRemoved(self, object_path, interfaces):
1408
1542
pass
1409
1543
1410
1544
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1545
out_signature="s",
1546
path_keyword='object_path',
1547
connection_keyword='connection')
1414
1548
def Introspect(self, object_path, connection):
1415
1549
"""Overloading of standard D-Bus method.
1416
1550
1417
1551
Override return argument name of GetManagedObjects to be
1418
1552
"objpath_interfaces_and_properties"
1419
1553
"""
1422
1556
connection)
1423
1557
try:
1424
1558
document = xml.dom.minidom.parseString(xmlstring)
1425
1559
1426
1560
for if_tag in document.getElementsByTagName("interface"):
1427
1561
# Fix argument name for the GetManagedObjects method
1428
1562
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1563
== dbus.OBJECT_MANAGER_IFACE):
1430
1564
for cn in if_tag.getElementsByTagName("method"):
1431
1565
if (cn.getAttribute("name")
1432
1566
== "GetManagedObjects"):
1442
1576
except (AttributeError, xml.dom.DOMException,
1443
1577
xml.parsers.expat.ExpatError) as error:
1444
1578
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1579
exc_info=error)
1446
1580
return xmlstring
1447
1581
1582
1448
1583
def datetime_to_dbus(dt, variant_level=0):
1449
1584
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1585
if dt is None:
1451
return dbus.String("", variant_level = variant_level)
1586
return dbus.String("", variant_level=variant_level)
1452
1587
return dbus.String(dt.isoformat(), variant_level=variant_level)
1453
1588
1454
1589
1457
1592
dbus.service.Object, it will add alternate D-Bus attributes with
1458
1593
interface names according to the "alt_interface_names" mapping.
1459
1594
Usage:
1460
1595
1461
1596
@alternate_dbus_interfaces({"org.example.Interface":
1462
1597
"net.example.AlternateInterface"})
1463
1598
class SampleDBusObject(dbus.service.Object):
1464
1599
@dbus.service.method("org.example.Interface")
1465
1600
def SampleDBusMethod():
1466
1601
pass
1467
1602
1468
1603
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
1604
reachable via two interfaces: "org.example.Interface" and
1470
1605
"net.example.AlternateInterface", the latter of which will have
1471
1606
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
1607
"true", unless "deprecate" is passed with a False value.
1473
1608
1474
1609
This works for methods and signals, and also for D-Bus properties
1475
1610
(from DBusObjectWithProperties) and interfaces (from the
1476
1611
dbus_interface_annotations decorator).
1477
1612
"""
1478
1613
1479
1614
def wrapper(cls):
1480
1615
for orig_interface_name, alt_interface_name in (
1481
1616
alt_interface_names.items()):
1496
1631
interface_names.add(alt_interface)
1497
1632
# Is this a D-Bus signal?
1498
1633
if getattr(attribute, "_dbus_is_signal", False):
1634
# Extract the original non-method undecorated
1635
# function by black magic
1499
1636
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
1637
nonmethod_func = (dict(
1503
1638
zip(attribute.func_code.co_freevars,
1504
1639
attribute.__closure__))
1505
1640
["func"].cell_contents)
1506
1641
else:
1507
nonmethod_func = attribute
1642
nonmethod_func = (dict(
1643
zip(attribute.__code__.co_freevars,
1644
attribute.__closure__))
1645
["func"].cell_contents)
1508
1646
# Create a new, but exactly alike, function
1509
1647
# object, and decorate it to be a new D-Bus signal
1510
1648
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1649
new_function = copy_function(nonmethod_func)
1525
1650
new_function = (dbus.service.signal(
1526
1651
alt_interface,
1527
1652
attribute._dbus_signature)(new_function))
1531
1656
attribute._dbus_annotations)
1532
1657
except AttributeError:
1533
1658
pass
1659
1534
1660
# Define a creator of a function to call both the
1535
1661
# original and alternate functions, so both the
1536
1662
# original and alternate signals gets sent when
1539
1665
"""This function is a scope container to pass
1540
1666
func1 and func2 to the "call_both" function
1541
1667
outside of its arguments"""
1542
1668
1543
1669
@functools.wraps(func2)
1544
1670
def call_both(*args, **kwargs):
1545
1671
"""This function will emit two D-Bus
1546
1672
signals by calling func1 and func2"""
1547
1673
func1(*args, **kwargs)
1548
1674
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1675
# Make wrapper function look like a D-Bus
1676
# signal
1550
1677
for name, attr in inspect.getmembers(func2):
1551
1678
if name.startswith("_dbus_"):
1552
1679
setattr(call_both, name, attr)
1553
1680
1554
1681
return call_both
1555
1682
# Create the "call_both" function and add it to
1556
1683
# the class
1566
1693
alt_interface,
1567
1694
attribute._dbus_in_signature,
1568
1695
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1696
(copy_function(attribute)))
1574
1697
# Copy annotations, if any
1575
1698
try:
1576
1699
attr[attrname]._dbus_annotations = dict(
1588
1711
attribute._dbus_access,
1589
1712
attribute._dbus_get_args_options
1590
1713
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1714
(copy_function(attribute)))
1597
1715
# Copy annotations, if any
1598
1716
try:
1599
1717
attr[attrname]._dbus_annotations = dict(
1608
1726
# to the class.
1609
1727
attr[attrname] = (
1610
1728
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1729
(copy_function(attribute)))
1616
1730
if deprecate:
1617
1731
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1732
iname = "_AlternateDBusNames_interface_annotation{}"
1619
1733
for interface_name in interface_names:
1620
1734
1621
1735
@dbus_interface_annotations(interface_name)
1622
1736
def func(self):
1623
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1737
return {"org.freedesktop.DBus.Deprecated":
1738
"true"}
1625
1739
# Find an unused name
1626
1740
for aname in (iname.format(i)
1627
1741
for i in itertools.count()):
1631
1745
if interface_names:
1632
1746
# Replace the class with a new subclass of it with
1633
1747
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1748
if sys.version_info.major == 2:
1749
cls = type(b"{}Alternate".format(cls.__name__),
1750
(cls, ), attr)
1751
else:
1752
cls = type("{}Alternate".format(cls.__name__),
1753
(cls, ), attr)
1636
1754
return cls
1637
1755
1638
1756
return wrapper
1639
1757
1640
1758
1642
1760
"se.bsnet.fukt.Mandos"})
1643
1761
class ClientDBus(Client, DBusObjectWithProperties):
1644
1762
"""A Client class using D-Bus
1645
1763
1646
1764
Attributes:
1647
1765
dbus_object_path: dbus.ObjectPath
1648
1766
bus: dbus.SystemBus()
1649
1767
"""
1650
1768
1651
1769
runtime_expansions = (Client.runtime_expansions
1652
1770
+ ("dbus_object_path", ))
1653
1771
1654
1772
_interface = "se.recompile.Mandos.Client"
1655
1773
1656
1774
# dbus.service.Object doesn't use super(), so we can't either.
1657
1658
def __init__(self, bus = None, *args, **kwargs):
1775
1776
def __init__(self, bus=None, *args, **kwargs):
1659
1777
self.bus = bus
1660
1778
Client.__init__(self, *args, **kwargs)
1661
1779
# Only now, when this client is initialized, can it show up on
1667
1785
"/clients/" + client_object_name)
1668
1786
DBusObjectWithProperties.__init__(self, self.bus,
1669
1787
self.dbus_object_path)
1670
1788
1671
1789
def notifychangeproperty(transform_func, dbus_name,
1672
1790
type_func=lambda x: x,
1673
1791
variant_level=1,
1675
1793
_interface=_interface):
1676
1794
""" Modify a variable so that it's a property which announces
1677
1795
its changes to DBus.
1678
1796
1679
1797
transform_fun: Function that takes a value and a variant_level
1680
1798
and transforms it to a D-Bus type.
1681
1799
dbus_name: D-Bus name of the variable
1684
1802
variant_level: D-Bus variant level. Default: 1
1685
1803
"""
1686
1804
attrname = "_{}".format(dbus_name)
1687
1805
1688
1806
def setter(self, value):
1689
1807
if hasattr(self, "dbus_object_path"):
1690
1808
if (not hasattr(self, attrname) or
1697
1815
else:
1698
1816
dbus_value = transform_func(
1699
1817
type_func(value),
1700
variant_level = variant_level)
1818
variant_level=variant_level)
1701
1819
self.PropertyChanged(dbus.String(dbus_name),
1702
1820
dbus_value)
1703
1821
self.PropertiesChanged(
1704
1822
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1823
dbus.Dictionary({dbus.String(dbus_name):
1824
dbus_value}),
1707
1825
dbus.Array())
1708
1826
setattr(self, attrname, value)
1709
1827
1710
1828
return property(lambda self: getattr(self, attrname), setter)
1711
1829
1712
1830
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
1831
approvals_pending = notifychangeproperty(dbus.Boolean,
1714
1832
"ApprovalPending",
1715
type_func = bool)
1833
type_func=bool)
1716
1834
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1835
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1836
"LastEnabled")
1719
1837
checker = notifychangeproperty(
1720
1838
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1839
type_func=lambda checker: checker is not None)
1722
1840
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1841
"LastCheckedOK")
1724
1842
last_checker_status = notifychangeproperty(dbus.Int16,
1729
1847
"ApprovedByDefault")
1730
1848
approval_delay = notifychangeproperty(
1731
1849
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1850
type_func=lambda td: td.total_seconds() * 1000)
1733
1851
approval_duration = notifychangeproperty(
1734
1852
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1853
type_func=lambda td: td.total_seconds() * 1000)
1736
1854
host = notifychangeproperty(dbus.String, "Host")
1737
1855
timeout = notifychangeproperty(
1738
1856
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1857
type_func=lambda td: td.total_seconds() * 1000)
1740
1858
extended_timeout = notifychangeproperty(
1741
1859
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1860
type_func=lambda td: td.total_seconds() * 1000)
1743
1861
interval = notifychangeproperty(
1744
1862
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1863
type_func=lambda td: td.total_seconds() * 1000)
1746
1864
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
1865
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
1866
invalidate_only=True)
1749
1867
1750
1868
del notifychangeproperty
1751
1869
1752
1870
def __del__(self, *args, **kwargs):
1753
1871
try:
1754
1872
self.remove_from_connection()
1757
1875
if hasattr(DBusObjectWithProperties, "__del__"):
1758
1876
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1877
Client.__del__(self, *args, **kwargs)
1760
1878
1761
1879
def checker_callback(self, source, condition,
1762
1880
connection, command, *args, **kwargs):
1763
1881
ret = Client.checker_callback(self, source, condition,
1779
1897
| self.last_checker_signal),
1780
1898
dbus.String(command))
1781
1899
return ret
1782
1900
1783
1901
def start_checker(self, *args, **kwargs):
1784
1902
old_checker_pid = getattr(self.checker, "pid", None)
1785
1903
r = Client.start_checker(self, *args, **kwargs)
1789
1907
# Emit D-Bus signal
1790
1908
self.CheckerStarted(self.current_checker_command)
1791
1909
return r
1792
1910
1793
1911
def _reset_approved(self):
1794
1912
self.approved = None
1795
1913
return False
1796
1914
1797
1915
def approve(self, value=True):
1798
1916
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1917
GLib.timeout_add(int(self.approval_duration.total_seconds()
1918
* 1000), self._reset_approved)
1801
1919
self.send_changedstate()
1802
1803
## D-Bus methods, signals & properties
1804
1805
## Interfaces
1806
1807
## Signals
1808
1920
1921
# D-Bus methods, signals & properties
1922
1923
# Interfaces
1924
1925
# Signals
1926
1809
1927
# CheckerCompleted - signal
1810
1928
@dbus.service.signal(_interface, signature="nxs")
1811
1929
def CheckerCompleted(self, exitcode, waitstatus, command):
1812
1930
"D-Bus signal"
1813
1931
pass
1814
1932
1815
1933
# CheckerStarted - signal
1816
1934
@dbus.service.signal(_interface, signature="s")
1817
1935
def CheckerStarted(self, command):
1818
1936
"D-Bus signal"
1819
1937
pass
1820
1938
1821
1939
# PropertyChanged - signal
1822
1940
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
1941
@dbus.service.signal(_interface, signature="sv")
1824
1942
def PropertyChanged(self, property, value):
1825
1943
"D-Bus signal"
1826
1944
pass
1827
1945
1828
1946
# GotSecret - signal
1829
1947
@dbus.service.signal(_interface)
1830
1948
def GotSecret(self):
1833
1951
server to mandos-client
1834
1952
"""
1835
1953
pass
1836
1954
1837
1955
# Rejected - signal
1838
1956
@dbus.service.signal(_interface, signature="s")
1839
1957
def Rejected(self, reason):
1840
1958
"D-Bus signal"
1841
1959
pass
1842
1960
1843
1961
# NeedApproval - signal
1844
1962
@dbus.service.signal(_interface, signature="tb")
1845
1963
def NeedApproval(self, timeout, default):
1846
1964
"D-Bus signal"
1847
1965
return self.need_approval()
1848
1849
## Methods
1850
1966
1967
# Methods
1968
1851
1969
# Approve - method
1852
1970
@dbus.service.method(_interface, in_signature="b")
1853
1971
def Approve(self, value):
1854
1972
self.approve(value)
1855
1973
1856
1974
# CheckedOK - method
1857
1975
@dbus.service.method(_interface)
1858
1976
def CheckedOK(self):
1859
1977
self.checked_ok()
1860
1978
1861
1979
# Enable - method
1862
1980
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
1981
@dbus.service.method(_interface)
1864
1982
def Enable(self):
1865
1983
"D-Bus method"
1866
1984
self.enable()
1867
1985
1868
1986
# StartChecker - method
1869
1987
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
1988
@dbus.service.method(_interface)
1871
1989
def StartChecker(self):
1872
1990
"D-Bus method"
1873
1991
self.start_checker()
1874
1992
1875
1993
# Disable - method
1876
1994
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
1995
@dbus.service.method(_interface)
1878
1996
def Disable(self):
1879
1997
"D-Bus method"
1880
1998
self.disable()
1881
1999
1882
2000
# StopChecker - method
1883
2001
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
2002
@dbus.service.method(_interface)
1885
2003
def StopChecker(self):
1886
2004
self.stop_checker()
1887
1888
## Properties
1889
2005
2006
# Properties
2007
1890
2008
# ApprovalPending - property
1891
2009
@dbus_service_property(_interface, signature="b", access="read")
1892
2010
def ApprovalPending_dbus_property(self):
1893
2011
return dbus.Boolean(bool(self.approvals_pending))
1894
2012
1895
2013
# ApprovedByDefault - property
1896
2014
@dbus_service_property(_interface,
1897
2015
signature="b",
1900
2018
if value is None: # get
1901
2019
return dbus.Boolean(self.approved_by_default)
1902
2020
self.approved_by_default = bool(value)
1903
2021
1904
2022
# ApprovalDelay - property
1905
2023
@dbus_service_property(_interface,
1906
2024
signature="t",
1910
2028
return dbus.UInt64(self.approval_delay.total_seconds()
1911
2029
* 1000)
1912
2030
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
2031
1914
2032
# ApprovalDuration - property
1915
2033
@dbus_service_property(_interface,
1916
2034
signature="t",
1920
2038
return dbus.UInt64(self.approval_duration.total_seconds()
1921
2039
* 1000)
1922
2040
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
2041
1924
2042
# Name - property
1925
2043
@dbus_annotations(
1926
2044
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
2045
@dbus_service_property(_interface, signature="s", access="read")
1928
2046
def Name_dbus_property(self):
1929
2047
return dbus.String(self.name)
1930
2048
2049
# KeyID - property
2050
@dbus_annotations(
2051
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2052
@dbus_service_property(_interface, signature="s", access="read")
2053
def KeyID_dbus_property(self):
2054
return dbus.String(self.key_id)
2055
1931
2056
# Fingerprint - property
1932
2057
@dbus_annotations(
1933
2058
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
2059
@dbus_service_property(_interface, signature="s", access="read")
1935
2060
def Fingerprint_dbus_property(self):
1936
2061
return dbus.String(self.fingerprint)
1937
2062
1938
2063
# Host - property
1939
2064
@dbus_service_property(_interface,
1940
2065
signature="s",
1943
2068
if value is None: # get
1944
2069
return dbus.String(self.host)
1945
2070
self.host = str(value)
1946
2071
1947
2072
# Created - property
1948
2073
@dbus_annotations(
1949
2074
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
2075
@dbus_service_property(_interface, signature="s", access="read")
1951
2076
def Created_dbus_property(self):
1952
2077
return datetime_to_dbus(self.created)
1953
2078
1954
2079
# LastEnabled - property
1955
2080
@dbus_service_property(_interface, signature="s", access="read")
1956
2081
def LastEnabled_dbus_property(self):
1957
2082
return datetime_to_dbus(self.last_enabled)
1958
2083
1959
2084
# Enabled - property
1960
2085
@dbus_service_property(_interface,
1961
2086
signature="b",
1967
2092
self.enable()
1968
2093
else:
1969
2094
self.disable()
1970
2095
1971
2096
# LastCheckedOK - property
1972
2097
@dbus_service_property(_interface,
1973
2098
signature="s",
1977
2102
self.checked_ok()
1978
2103
return
1979
2104
return datetime_to_dbus(self.last_checked_ok)
1980
2105
1981
2106
# LastCheckerStatus - property
1982
2107
@dbus_service_property(_interface, signature="n", access="read")
1983
2108
def LastCheckerStatus_dbus_property(self):
1984
2109
return dbus.Int16(self.last_checker_status)
1985
2110
1986
2111
# Expires - property
1987
2112
@dbus_service_property(_interface, signature="s", access="read")
1988
2113
def Expires_dbus_property(self):
1989
2114
return datetime_to_dbus(self.expires)
1990
2115
1991
2116
# LastApprovalRequest - property
1992
2117
@dbus_service_property(_interface, signature="s", access="read")
1993
2118
def LastApprovalRequest_dbus_property(self):
1994
2119
return datetime_to_dbus(self.last_approval_request)
1995
2120
1996
2121
# Timeout - property
1997
2122
@dbus_service_property(_interface,
1998
2123
signature="t",
2013
2138
if (getattr(self, "disable_initiator_tag", None)
2014
2139
is None):
2015
2140
return
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2141
GLib.source_remove(self.disable_initiator_tag)
2142
self.disable_initiator_tag = GLib.timeout_add(
2018
2143
int((self.expires - now).total_seconds() * 1000),
2019
2144
self.disable)
2020
2145
2021
2146
# ExtendedTimeout - property
2022
2147
@dbus_service_property(_interface,
2023
2148
signature="t",
2027
2152
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
2153
* 1000)
2029
2154
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
2155
2031
2156
# Interval - property
2032
2157
@dbus_service_property(_interface,
2033
2158
signature="t",
2040
2165
return
2041
2166
if self.enabled:
2042
2167
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2168
GLib.source_remove(self.checker_initiator_tag)
2169
self.checker_initiator_tag = GLib.timeout_add(
2045
2170
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2047
2171
self.start_checker() # Start one now, too
2172
2048
2173
# Checker - property
2049
2174
@dbus_service_property(_interface,
2050
2175
signature="s",
2053
2178
if value is None: # get
2054
2179
return dbus.String(self.checker_command)
2055
2180
self.checker_command = str(value)
2056
2181
2057
2182
# CheckerRunning - property
2058
2183
@dbus_service_property(_interface,
2059
2184
signature="b",
2065
2190
self.start_checker()
2066
2191
else:
2067
2192
self.stop_checker()
2068
2193
2069
2194
# ObjectPath - property
2070
2195
@dbus_annotations(
2071
2196
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
2197
"org.freedesktop.DBus.Deprecated": "true"})
2073
2198
@dbus_service_property(_interface, signature="o", access="read")
2074
2199
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2076
2200
return self.dbus_object_path # is already a dbus.ObjectPath
2201
2077
2202
# Secret = property
2078
2203
@dbus_annotations(
2079
2204
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2084
2209
byte_arrays=True)
2085
2210
def Secret_dbus_property(self, value):
2086
2211
self.secret = bytes(value)
2087
2212
2088
2213
del _interface
2089
2214
2090
2215
2091
2216
class ProxyClient(object):
2092
def __init__(self, child_pipe, fpr, address):
2217
def __init__(self, child_pipe, key_id, fpr, address):
2093
2218
self._pipe = child_pipe
2094
self._pipe.send(('init', fpr, address))
2219
self._pipe.send(('init', key_id, fpr, address))
2095
2220
if not self._pipe.recv():
2096
raise KeyError(fpr)
2097
2221
raise KeyError(key_id or fpr)
2222
2098
2223
def __getattribute__(self, name):
2099
2224
if name == '_pipe':
2100
2225
return super(ProxyClient, self).__getattribute__(name)
2103
2228
if data[0] == 'data':
2104
2229
return data[1]
2105
2230
if data[0] == 'function':
2106
2231
2107
2232
def func(*args, **kwargs):
2108
2233
self._pipe.send(('funcall', name, args, kwargs))
2109
2234
return self._pipe.recv()[1]
2110
2235
2111
2236
return func
2112
2237
2113
2238
def __setattr__(self, name, value):
2114
2239
if name == '_pipe':
2115
2240
return super(ProxyClient, self).__setattr__(name, value)
2118
2243
2119
2244
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2245
"""A class to handle client connections.
2121
2246
2122
2247
Instantiated once for each connection to handle it.
2123
2248
Note: This will run in its own forked process."""
2124
2249
2125
2250
def handle(self):
2126
2251
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
2252
logger.info("TCP connection from: %s",
2128
2253
str(self.client_address))
2129
2254
logger.debug("Pipe FD: %d",
2130
2255
self.server.child_pipe.fileno())
2131
2256
2132
2257
session = gnutls.ClientSession(self.request)
2133
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2137
# "+DHE-DSS"))
2258
2259
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2260
# "+AES-256-CBC", "+SHA1",
2261
# "+COMP-NULL", "+CTYPE-OPENPGP",
2262
# "+DHE-DSS"))
2138
2263
# Use a fallback default, since this MUST be set.
2139
2264
priority = self.server.gnutls_priority
2140
2265
if priority is None:
2141
2266
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2267
gnutls.priority_set_direct(session._c_object,
2268
priority.encode("utf-8"),
2143
2269
None)
2144
2270
2145
2271
# Start communication using the Mandos protocol
2146
2272
# Get protocol number
2147
2273
line = self.request.makefile().readline()
2152
2278
except (ValueError, IndexError, RuntimeError) as error:
2153
2279
logger.error("Unknown protocol version: %s", error)
2154
2280
return
2155
2281
2156
2282
# Start GnuTLS connection
2157
2283
try:
2158
2284
session.handshake()
2162
2288
# established. Just abandon the request.
2163
2289
return
2164
2290
logger.debug("Handshake succeeded")
2165
2291
2166
2292
approval_required = False
2167
2293
try:
2168
try:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
2172
logger.warning("Bad certificate: %s", error)
2173
return
2174
logger.debug("Fingerprint: %s", fpr)
2175
2176
try:
2177
client = ProxyClient(child_pipe, fpr,
2294
if gnutls.has_rawpk:
2295
fpr = b""
2296
try:
2297
key_id = self.key_id(
2298
self.peer_certificate(session))
2299
except (TypeError, gnutls.Error) as error:
2300
logger.warning("Bad certificate: %s", error)
2301
return
2302
logger.debug("Key ID: %s", key_id)
2303
2304
else:
2305
key_id = b""
2306
try:
2307
fpr = self.fingerprint(
2308
self.peer_certificate(session))
2309
except (TypeError, gnutls.Error) as error:
2310
logger.warning("Bad certificate: %s", error)
2311
return
2312
logger.debug("Fingerprint: %s", fpr)
2313
2314
try:
2315
client = ProxyClient(child_pipe, key_id, fpr,
2178
2316
self.client_address)
2179
2317
except KeyError:
2180
2318
return
2181
2319
2182
2320
if client.approval_delay:
2183
2321
delay = client.approval_delay
2184
2322
client.approvals_pending += 1
2185
2323
approval_required = True
2186
2324
2187
2325
while True:
2188
2326
if not client.enabled:
2189
2327
logger.info("Client %s is disabled",
2192
2330
# Emit D-Bus signal
2193
2331
client.Rejected("Disabled")
2194
2332
return
2195
2333
2196
2334
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2335
# We are approved or approval is disabled
2198
2336
break
2199
2337
elif client.approved is None:
2200
2338
logger.info("Client %s needs approval",
2211
2349
# Emit D-Bus signal
2212
2350
client.Rejected("Denied")
2213
2351
return
2214
2215
#wait until timeout or approved
2352
2353
# wait until timeout or approved
2216
2354
time = datetime.datetime.now()
2217
2355
client.changedstate.acquire()
2218
2356
client.changedstate.wait(delay.total_seconds())
2231
2369
break
2232
2370
else:
2233
2371
delay -= time2 - time
2234
2372
2235
2373
try:
2236
2374
session.send(client.secret)
2237
2375
except gnutls.Error as error:
2238
2376
logger.warning("gnutls send failed",
2239
exc_info = error)
2377
exc_info=error)
2240
2378
return
2241
2379
2242
2380
logger.info("Sending secret to %s", client.name)
2243
2381
# bump the timeout using extended_timeout
2244
2382
client.bump_timeout(client.extended_timeout)
2245
2383
if self.server.use_dbus:
2246
2384
# Emit D-Bus signal
2247
2385
client.GotSecret()
2248
2386
2249
2387
finally:
2250
2388
if approval_required:
2251
2389
client.approvals_pending -= 1
2254
2392
except gnutls.Error as error:
2255
2393
logger.warning("GnuTLS bye failed",
2256
2394
exc_info=error)
2257
2395
2258
2396
@staticmethod
2259
2397
def peer_certificate(session):
2260
"Return the peer's OpenPGP certificate as a bytestring"
2261
# If not an OpenPGP certificate...
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2398
"Return the peer's certificate as a bytestring"
2399
try:
2400
cert_type = gnutls.certificate_type_get2(session._c_object,
2401
gnutls.CTYPE_PEERS)
2402
except AttributeError:
2403
cert_type = gnutls.certificate_type_get(session._c_object)
2404
if gnutls.has_rawpk:
2405
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2406
else:
2407
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2408
# If not a valid certificate type...
2409
if cert_type not in valid_cert_types:
2410
logger.info("Cert type %r not in %r", cert_type,
2411
valid_cert_types)
2264
2412
# ...return invalid data
2265
2413
return b""
2266
2414
list_size = ctypes.c_uint(1)
2272
2420
return None
2273
2421
cert = cert_list[0]
2274
2422
return ctypes.string_at(cert.data, cert.size)
2275
2423
2424
@staticmethod
2425
def key_id(certificate):
2426
"Convert a certificate bytestring to a hexdigit key ID"
2427
# New GnuTLS "datum" with the public key
2428
datum = gnutls.datum_t(
2429
ctypes.cast(ctypes.c_char_p(certificate),
2430
ctypes.POINTER(ctypes.c_ubyte)),
2431
ctypes.c_uint(len(certificate)))
2432
# XXX all these need to be created in the gnutls "module"
2433
# New empty GnuTLS certificate
2434
pubkey = gnutls.pubkey_t()
2435
gnutls.pubkey_init(ctypes.byref(pubkey))
2436
# Import the raw public key into the certificate
2437
gnutls.pubkey_import(pubkey,
2438
ctypes.byref(datum),
2439
gnutls.X509_FMT_DER)
2440
# New buffer for the key ID
2441
buf = ctypes.create_string_buffer(32)
2442
buf_len = ctypes.c_size_t(len(buf))
2443
# Get the key ID from the raw public key into the buffer
2444
gnutls.pubkey_get_key_id(pubkey,
2445
gnutls.KEYID_USE_SHA256,
2446
ctypes.cast(ctypes.byref(buf),
2447
ctypes.POINTER(ctypes.c_ubyte)),
2448
ctypes.byref(buf_len))
2449
# Deinit the certificate
2450
gnutls.pubkey_deinit(pubkey)
2451
2452
# Convert the buffer to a Python bytestring
2453
key_id = ctypes.string_at(buf, buf_len.value)
2454
# Convert the bytestring to hexadecimal notation
2455
hex_key_id = binascii.hexlify(key_id).upper()
2456
return hex_key_id
2457
2276
2458
@staticmethod
2277
2459
def fingerprint(openpgp):
2278
2460
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2293
2475
ctypes.byref(crtverify))
2294
2476
if crtverify.value != 0:
2295
2477
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
2478
raise gnutls.CertificateSecurityError(code
2479
=crtverify.value)
2297
2480
# New buffer for the fingerprint
2298
2481
buf = ctypes.create_string_buffer(20)
2299
2482
buf_len = ctypes.c_size_t()
2311
2494
2312
2495
class MultiprocessingMixIn(object):
2313
2496
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2497
2315
2498
def sub_process_main(self, request, address):
2316
2499
try:
2317
2500
self.finish_request(request, address)
2318
2501
except Exception:
2319
2502
self.handle_error(request, address)
2320
2503
self.close_request(request)
2321
2504
2322
2505
def process_request(self, request, address):
2323
2506
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2507
proc = multiprocessing.Process(target=self.sub_process_main,
2508
args=(request, address))
2326
2509
proc.start()
2327
2510
return proc
2328
2511
2329
2512
2330
2513
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2331
2514
""" adds a pipe to the MixIn """
2332
2515
2333
2516
def process_request(self, request, client_address):
2334
2517
"""Overrides and wraps the original process_request().
2335
2518
2336
2519
This function creates a new pipe in self.pipe
2337
2520
"""
2338
2521
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2339
2522
2340
2523
proc = MultiprocessingMixIn.process_request(self, request,
2341
2524
client_address)
2342
2525
self.child_pipe.close()
2343
2526
self.add_pipe(parent_pipe, proc)
2344
2527
2345
2528
def add_pipe(self, parent_pipe, proc):
2346
2529
"""Dummy function; override as necessary"""
2347
2530
raise NotImplementedError()
2350
2533
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
2534
socketserver.TCPServer, object):
2352
2535
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2353
2536
2354
2537
Attributes:
2355
2538
enabled: Boolean; whether this server is activated yet
2356
2539
interface: None or a network interface name (string)
2357
2540
use_ipv6: Boolean; to use IPv6 or not
2358
2541
"""
2359
2542
2360
2543
def __init__(self, server_address, RequestHandlerClass,
2361
2544
interface=None,
2362
2545
use_ipv6=True,
2372
2555
self.socketfd = socketfd
2373
2556
# Save the original socket.socket() function
2374
2557
self.socket_socket = socket.socket
2558
2375
2559
# To implement --socket, we monkey patch socket.socket.
2376
#
2560
#
2377
2561
# (When socketserver.TCPServer is a new-style class, we
2378
2562
# could make self.socket into a property instead of monkey
2379
2563
# patching socket.socket.)
2380
#
2564
#
2381
2565
# Create a one-time-only replacement for socket.socket()
2382
2566
@functools.wraps(socket.socket)
2383
2567
def socket_wrapper(*args, **kwargs):
2395
2579
# socket_wrapper(), if socketfd was set.
2396
2580
socketserver.TCPServer.__init__(self, server_address,
2397
2581
RequestHandlerClass)
2398
2582
2399
2583
def server_bind(self):
2400
2584
"""This overrides the normal server_bind() function
2401
2585
to bind to an interface if one was specified, and also NOT to
2402
2586
bind to an address or port if they were not specified."""
2587
global SO_BINDTODEVICE
2403
2588
if self.interface is not None:
2404
2589
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2407
self.interface)
2408
else:
2409
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2420
self.interface)
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2424
else:
2425
raise
2590
# Fall back to a hard-coded value which seems to be
2591
# common enough.
2592
logger.warning("SO_BINDTODEVICE not found, trying 25")
2593
SO_BINDTODEVICE = 25
2594
try:
2595
self.socket.setsockopt(
2596
socket.SOL_SOCKET, SO_BINDTODEVICE,
2597
(self.interface + "\0").encode("utf-8"))
2598
except socket.error as error:
2599
if error.errno == errno.EPERM:
2600
logger.error("No permission to bind to"
2601
" interface %s", self.interface)
2602
elif error.errno == errno.ENOPROTOOPT:
2603
logger.error("SO_BINDTODEVICE not available;"
2604
" cannot bind to interface %s",
2605
self.interface)
2606
elif error.errno == errno.ENODEV:
2607
logger.error("Interface %s does not exist,"
2608
" cannot bind", self.interface)
2609
else:
2610
raise
2426
2611
# Only bind(2) the socket if we really need to.
2427
2612
if self.server_address[0] or self.server_address[1]:
2613
if self.server_address[1]:
2614
self.allow_reuse_address = True
2428
2615
if not self.server_address[0]:
2429
2616
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2617
any_address = "::" # in6addr_any
2431
2618
else:
2432
any_address = "0.0.0.0" # INADDR_ANY
2619
any_address = "0.0.0.0" # INADDR_ANY
2433
2620
self.server_address = (any_address,
2434
2621
self.server_address[1])
2435
2622
elif not self.server_address[1]:
2445
2632
2446
2633
class MandosServer(IPv6_TCPServer):
2447
2634
"""Mandos server.
2448
2635
2449
2636
Attributes:
2450
2637
clients: set of Client objects
2451
2638
gnutls_priority GnuTLS priority string
2452
2639
use_dbus: Boolean; to emit D-Bus signals or not
2453
2454
Assumes a gobject.MainLoop event loop.
2640
2641
Assumes a GLib.MainLoop event loop.
2455
2642
"""
2456
2643
2457
2644
def __init__(self, server_address, RequestHandlerClass,
2458
2645
interface=None,
2459
2646
use_ipv6=True,
2469
2656
self.gnutls_priority = gnutls_priority
2470
2657
IPv6_TCPServer.__init__(self, server_address,
2471
2658
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2475
2659
interface=interface,
2660
use_ipv6=use_ipv6,
2661
socketfd=socketfd)
2662
2476
2663
def server_activate(self):
2477
2664
if self.enabled:
2478
2665
return socketserver.TCPServer.server_activate(self)
2479
2666
2480
2667
def enable(self):
2481
2668
self.enabled = True
2482
2669
2483
2670
def add_pipe(self, parent_pipe, proc):
2484
2671
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2672
GLib.io_add_watch(
2486
2673
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2674
GLib.IO_IN | GLib.IO_HUP,
2488
2675
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2491
2676
parent_pipe=parent_pipe,
2677
proc=proc))
2678
2492
2679
def handle_ipc(self, source, condition,
2493
2680
parent_pipe=None,
2494
proc = None,
2681
proc=None,
2495
2682
client_object=None):
2496
2683
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2684
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2685
# Wait for other process to exit
2499
2686
proc.join()
2500
2687
return False
2501
2688
2502
2689
# Read a request from the child
2503
2690
request = parent_pipe.recv()
2504
2691
command = request[0]
2505
2692
2506
2693
if command == 'init':
2507
fpr = request[1]
2508
address = request[2]
2509
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2694
key_id = request[1].decode("ascii")
2695
fpr = request[2].decode("ascii")
2696
address = request[3]
2697
2698
for c in self.clients.values():
2699
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2700
continue
2701
if key_id and c.key_id == key_id:
2702
client = c
2703
break
2704
if fpr and c.fingerprint == fpr:
2512
2705
client = c
2513
2706
break
2514
2707
else:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2708
logger.info("Client not found for key ID: %s, address"
2709
": %s", key_id or fpr, address)
2517
2710
if self.use_dbus:
2518
2711
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
2712
mandos_dbus_service.ClientNotFound(key_id or fpr,
2520
2713
address[0])
2521
2714
parent_pipe.send(False)
2522
2715
return False
2523
2524
gobject.io_add_watch(
2716
2717
GLib.io_add_watch(
2525
2718
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2719
GLib.IO_IN | GLib.IO_HUP,
2527
2720
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2721
parent_pipe=parent_pipe,
2722
proc=proc,
2723
client_object=client))
2531
2724
parent_pipe.send(True)
2532
2725
# remove the old hook in favor of the new above hook on
2533
2726
# same fileno
2536
2729
funcname = request[1]
2537
2730
args = request[2]
2538
2731
kwargs = request[3]
2539
2732
2540
2733
parent_pipe.send(('data', getattr(client_object,
2541
2734
funcname)(*args,
2542
2735
**kwargs)))
2543
2736
2544
2737
if command == 'getattr':
2545
2738
attrname = request[1]
2546
2739
if isinstance(client_object.__getattribute__(attrname),
2549
2742
else:
2550
2743
parent_pipe.send((
2551
2744
'data', client_object.__getattribute__(attrname)))
2552
2745
2553
2746
if command == 'setattr':
2554
2747
attrname = request[1]
2555
2748
value = request[2]
2556
2749
setattr(client_object, attrname, value)
2557
2750
2558
2751
return True
2559
2752
2560
2753
2561
2754
def rfc3339_duration_to_delta(duration):
2562
2755
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2563
2756
2564
2757
>>> rfc3339_duration_to_delta("P7D")
2565
2758
datetime.timedelta(7)
2566
2759
>>> rfc3339_duration_to_delta("PT60S")
2576
2769
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
2770
datetime.timedelta(1, 200)
2578
2771
"""
2579
2772
2580
2773
# Parsing an RFC 3339 duration with regular expressions is not
2581
2774
# possible - there would have to be multiple places for the same
2582
2775
# values, like seconds. The current code, while more esoteric, is
2583
2776
# cleaner without depending on a parsing library. If Python had a
2584
2777
# built-in library for parsing we would use it, but we'd like to
2585
2778
# avoid excessive use of external libraries.
2586
2779
2587
2780
# New type for defining tokens, syntax, and semantics all-in-one
2588
2781
Token = collections.namedtuple("Token", (
2589
2782
"regexp", # To match token; if "value" is not None, must have
2622
2815
frozenset((token_year, token_month,
2623
2816
token_day, token_time,
2624
2817
token_week)))
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2818
# Define starting values:
2819
# Value so far
2820
value = datetime.timedelta()
2627
2821
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2822
# Following valid tokens
2823
followers = frozenset((token_duration, ))
2824
# String left to parse
2825
s = duration
2630
2826
# Loop until end token is found
2631
2827
while found_token is not token_end:
2632
2828
# Search for any currently valid tokens
2656
2852
2657
2853
def string_to_delta(interval):
2658
2854
"""Parse a string and return a datetime.timedelta
2659
2855
2660
2856
>>> string_to_delta('7d')
2661
2857
datetime.timedelta(7)
2662
2858
>>> string_to_delta('60s')
2670
2866
>>> string_to_delta('5m 30s')
2671
2867
datetime.timedelta(0, 330)
2672
2868
"""
2673
2869
2674
2870
try:
2675
2871
return rfc3339_duration_to_delta(interval)
2676
2872
except ValueError:
2677
2873
pass
2678
2874
2679
2875
timevalue = datetime.timedelta(0)
2680
2876
for s in interval.split():
2681
2877
try:
2699
2895
return timevalue
2700
2896
2701
2897
2702
def daemon(nochdir = False, noclose = False):
2898
def daemon(nochdir=False, noclose=False):
2703
2899
"""See daemon(3). Standard BSD Unix function.
2704
2900
2705
2901
This should really exist as os.daemon, but it doesn't (yet)."""
2706
2902
if os.fork():
2707
2903
sys.exit()
2725
2921
2726
2922
2727
2923
def main():
2728
2924
2729
2925
##################################################################
2730
2926
# Parsing of options, both command line and config file
2731
2927
2732
2928
parser = argparse.ArgumentParser()
2733
2929
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2930
version="%(prog)s {}".format(version),
2735
2931
help="show version number and exit")
2736
2932
parser.add_argument("-i", "--interface", metavar="IF",
2737
2933
help="Bind to interface IF")
2773
2969
parser.add_argument("--no-zeroconf", action="store_false",
2774
2970
dest="zeroconf", help="Do not use Zeroconf",
2775
2971
default=None)
2776
2972
2777
2973
options = parser.parse_args()
2778
2974
2779
2975
if options.check:
2780
2976
import doctest
2781
2977
fail_count, test_count = doctest.testmod()
2782
2978
sys.exit(os.EX_OK if fail_count == 0 else 1)
2783
2979
2784
2980
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2786
"address": "",
2787
"port": "",
2788
"debug": "False",
2789
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2793
"use_dbus": "True",
2794
"use_ipv6": "True",
2795
"debuglevel": "",
2796
"restore": "True",
2797
"socket": "",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2802
2981
if gnutls.has_rawpk:
2982
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2983
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2984
else:
2985
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2986
":+SIGN-DSA-SHA256")
2987
server_defaults = {"interface": "",
2988
"address": "",
2989
"port": "",
2990
"debug": "False",
2991
"priority": priority,
2992
"servicename": "Mandos",
2993
"use_dbus": "True",
2994
"use_ipv6": "True",
2995
"debuglevel": "",
2996
"restore": "True",
2997
"socket": "",
2998
"statedir": "/var/lib/mandos",
2999
"foreground": "False",
3000
"zeroconf": "True",
3001
}
3002
del priority
3003
2803
3004
# Parse config file for server-global settings
2804
server_config = configparser.SafeConfigParser(server_defaults)
3005
server_config = configparser.ConfigParser(server_defaults)
2805
3006
del server_defaults
2806
3007
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2807
# Convert the SafeConfigParser object to a dict
3008
# Convert the ConfigParser object to a dict
2808
3009
server_settings = server_config.defaults()
2809
3010
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3011
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3012
"foreground", "zeroconf"):
2811
3013
server_settings[option] = server_config.getboolean("DEFAULT",
2812
3014
option)
2813
3015
if server_settings["port"]:
2823
3025
server_settings["socket"] = os.dup(server_settings
2824
3026
["socket"])
2825
3027
del server_config
2826
3028
2827
3029
# Override the settings from the config file with command line
2828
3030
# options, if set.
2829
3031
for option in ("interface", "address", "port", "debug",
2847
3049
if server_settings["debug"]:
2848
3050
server_settings["foreground"] = True
2849
3051
# Now we have our good server settings in "server_settings"
2850
3052
2851
3053
##################################################################
2852
3054
2853
3055
if (not server_settings["zeroconf"]
2854
3056
and not (server_settings["port"]
2855
3057
or server_settings["socket"] != "")):
2856
3058
parser.error("Needs port or socket to work without Zeroconf")
2857
3059
2858
3060
# For convenience
2859
3061
debug = server_settings["debug"]
2860
3062
debuglevel = server_settings["debuglevel"]
2864
3066
stored_state_file)
2865
3067
foreground = server_settings["foreground"]
2866
3068
zeroconf = server_settings["zeroconf"]
2867
3069
2868
3070
if debug:
2869
3071
initlogger(debug, logging.DEBUG)
2870
3072
else:
2873
3075
else:
2874
3076
level = getattr(logging, debuglevel.upper())
2875
3077
initlogger(debug, level)
2876
3078
2877
3079
if server_settings["servicename"] != "Mandos":
2878
3080
syslogger.setFormatter(
2879
3081
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
3082
' %(levelname)s: %(message)s'.format(
2881
3083
server_settings["servicename"])))
2882
3084
2883
3085
# Parse config file with clients
2884
client_config = configparser.SafeConfigParser(Client
2885
.client_defaults)
3086
client_config = configparser.ConfigParser(Client.client_defaults)
2886
3087
client_config.read(os.path.join(server_settings["configdir"],
2887
3088
"clients.conf"))
2888
3089
2889
3090
global mandos_dbus_service
2890
3091
mandos_dbus_service = None
2891
3092
2892
3093
socketfd = None
2893
3094
if server_settings["socket"] != "":
2894
3095
socketfd = server_settings["socket"]
2910
3111
except IOError as e:
2911
3112
logger.error("Could not open file %r", pidfilename,
2912
3113
exc_info=e)
2913
2914
for name in ("_mandos", "mandos", "nobody"):
3114
3115
for name, group in (("_mandos", "_mandos"),
3116
("mandos", "mandos"),
3117
("nobody", "nogroup")):
2915
3118
try:
2916
3119
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
3120
gid = pwd.getpwnam(group).pw_gid
2918
3121
break
2919
3122
except KeyError:
2920
3123
continue
2924
3127
try:
2925
3128
os.setgid(gid)
2926
3129
os.setuid(uid)
3130
if debug:
3131
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3132
gid))
2927
3133
except OSError as error:
3134
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3135
.format(uid, gid, os.strerror(error.errno)))
2928
3136
if error.errno != errno.EPERM:
2929
3137
raise
2930
3138
2931
3139
if debug:
2932
3140
# Enable all possible GnuTLS debugging
2933
3141
2934
3142
# "Use a log level over 10 to enable all debugging options."
2935
3143
# - GnuTLS manual
2936
3144
gnutls.global_set_log_level(11)
2937
3145
2938
3146
@gnutls.log_func
2939
3147
def debug_gnutls(level, string):
2940
3148
logger.debug("GnuTLS: %s", string[:-1])
2941
3149
2942
3150
gnutls.global_set_log_function(debug_gnutls)
2943
3151
2944
3152
# Redirect stdin so all checkers get /dev/null
2945
3153
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
3154
os.dup2(null, sys.stdin.fileno())
2947
3155
if null > 2:
2948
3156
os.close(null)
2949
3157
2950
3158
# Need to fork before connecting to D-Bus
2951
3159
if not foreground:
2952
3160
# Close all input and output, do double fork, etc.
2953
3161
daemon()
2954
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2958
3162
3163
if gi.version_info < (3, 10, 2):
3164
# multiprocessing will use threads, so before we use GLib we
3165
# need to inform GLib that threads will be used.
3166
GLib.threads_init()
3167
2959
3168
global main_loop
2960
3169
# From the Avahi example code
2961
3170
DBusGMainLoop(set_as_default=True)
2962
main_loop = gobject.MainLoop()
3171
main_loop = GLib.MainLoop()
2963
3172
bus = dbus.SystemBus()
2964
3173
# End of Avahi example code
2965
3174
if use_dbus:
2978
3187
if zeroconf:
2979
3188
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3189
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
3190
name=server_settings["servicename"],
3191
servicetype="_mandos._tcp",
3192
protocol=protocol,
3193
bus=bus)
2985
3194
if server_settings["interface"]:
2986
3195
service.interface = if_nametoindex(
2987
3196
server_settings["interface"].encode("utf-8"))
2988
3197
2989
3198
global multiprocessing_manager
2990
3199
multiprocessing_manager = multiprocessing.Manager()
2991
3200
2992
3201
client_class = Client
2993
3202
if use_dbus:
2994
client_class = functools.partial(ClientDBus, bus = bus)
2995
3203
client_class = functools.partial(ClientDBus, bus=bus)
3204
2996
3205
client_settings = Client.config_parser(client_config)
2997
3206
old_client_settings = {}
2998
3207
clients_data = {}
2999
3208
3000
3209
# This is used to redirect stdout and stderr for checker processes
3001
3210
global wnull
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3211
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3212
# Only used if server is running in foreground but not in debug
3004
3213
# mode
3005
3214
if debug or not foreground:
3006
3215
wnull.close()
3007
3216
3008
3217
# Get client data and settings from last running state.
3009
3218
if server_settings["restore"]:
3010
3219
try:
3011
3220
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
3221
if sys.version_info.major == 2:
3222
clients_data, old_client_settings = pickle.load(
3223
stored_state)
3224
else:
3225
bytes_clients_data, bytes_old_client_settings = (
3226
pickle.load(stored_state, encoding="bytes"))
3227
# Fix bytes to strings
3228
# clients_data
3229
# .keys()
3230
clients_data = {(key.decode("utf-8")
3231
if isinstance(key, bytes)
3232
else key): value
3233
for key, value in
3234
bytes_clients_data.items()}
3235
del bytes_clients_data
3236
for key in clients_data:
3237
value = {(k.decode("utf-8")
3238
if isinstance(k, bytes) else k): v
3239
for k, v in
3240
clients_data[key].items()}
3241
clients_data[key] = value
3242
# .client_structure
3243
value["client_structure"] = [
3244
(s.decode("utf-8")
3245
if isinstance(s, bytes)
3246
else s) for s in
3247
value["client_structure"]]
3248
# .name & .host
3249
for k in ("name", "host"):
3250
if isinstance(value[k], bytes):
3251
value[k] = value[k].decode("utf-8")
3252
if "key_id" not in value:
3253
value["key_id"] = ""
3254
elif "fingerprint" not in value:
3255
value["fingerprint"] = ""
3256
# old_client_settings
3257
# .keys()
3258
old_client_settings = {
3259
(key.decode("utf-8")
3260
if isinstance(key, bytes)
3261
else key): value
3262
for key, value in
3263
bytes_old_client_settings.items()}
3264
del bytes_old_client_settings
3265
# .host
3266
for value in old_client_settings.values():
3267
if isinstance(value["host"], bytes):
3268
value["host"] = (value["host"]
3269
.decode("utf-8"))
3014
3270
os.remove(stored_state_path)
3015
3271
except IOError as e:
3016
3272
if e.errno == errno.ENOENT:
3024
3280
logger.warning("Could not load persistent state: "
3025
3281
"EOFError:",
3026
3282
exc_info=e)
3027
3283
3028
3284
with PGPEngine() as pgp:
3029
3285
for client_name, client in clients_data.items():
3030
3286
# Skip removed clients
3031
3287
if client_name not in client_settings:
3032
3288
continue
3033
3289
3034
3290
# Decide which value to use after restoring saved state.
3035
3291
# We have three different values: Old config file,
3036
3292
# new config file, and saved state.
3047
3303
client[name] = value
3048
3304
except KeyError:
3049
3305
pass
3050
3306
3051
3307
# Clients who has passed its expire date can still be
3052
3308
# enabled if its last checker was successful. A Client
3053
3309
# whose checker succeeded before we stored its state is
3086
3342
client_name))
3087
3343
client["secret"] = (client_settings[client_name]
3088
3344
["secret"])
3089
3345
3090
3346
# Add/remove clients based on new changes made to config
3091
3347
for client_name in (set(old_client_settings)
3092
3348
- set(client_settings)):
3094
3350
for client_name in (set(client_settings)
3095
3351
- set(old_client_settings)):
3096
3352
clients_data[client_name] = client_settings[client_name]
3097
3353
3098
3354
# Create all client objects
3099
3355
for client_name, client in clients_data.items():
3100
3356
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
3103
server_settings = server_settings)
3104
3357
name=client_name,
3358
settings=client,
3359
server_settings=server_settings)
3360
3105
3361
if not tcp_server.clients:
3106
3362
logger.warning("No clients defined")
3107
3363
3108
3364
if not foreground:
3109
3365
if pidfile is not None:
3110
3366
pid = os.getpid()
3116
3372
pidfilename, pid)
3117
3373
del pidfile
3118
3374
del pidfilename
3119
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
3375
3376
for termsig in (signal.SIGHUP, signal.SIGTERM):
3377
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3378
lambda: main_loop.quit() and False)
3379
3123
3380
if use_dbus:
3124
3381
3125
3382
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3383
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3384
class MandosDBusService(DBusObjectWithObjectManager):
3128
3385
"""A D-Bus proxy object"""
3129
3386
3130
3387
def __init__(self):
3131
3388
dbus.service.Object.__init__(self, bus, "/")
3132
3389
3133
3390
_interface = "se.recompile.Mandos"
3134
3391
3135
3392
@dbus.service.signal(_interface, signature="o")
3136
3393
def ClientAdded(self, objpath):
3137
3394
"D-Bus signal"
3138
3395
pass
3139
3396
3140
3397
@dbus.service.signal(_interface, signature="ss")
3141
def ClientNotFound(self, fingerprint, address):
3398
def ClientNotFound(self, key_id, address):
3142
3399
"D-Bus signal"
3143
3400
pass
3144
3401
3145
3402
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
3403
"true"})
3147
3404
@dbus.service.signal(_interface, signature="os")
3148
3405
def ClientRemoved(self, objpath, name):
3149
3406
"D-Bus signal"
3150
3407
pass
3151
3408
3152
3409
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
3410
"true"})
3154
3411
@dbus.service.method(_interface, out_signature="ao")
3155
3412
def GetAllClients(self):
3156
3413
"D-Bus method"
3157
3414
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3159
3415
tcp_server.clients.values())
3416
3160
3417
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
3418
"true"})
3162
3419
@dbus.service.method(_interface,
3164
3421
def GetAllClientsWithProperties(self):
3165
3422
"D-Bus method"
3166
3423
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3424
{c.dbus_object_path: c.GetAll(
3168
3425
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3426
for c in tcp_server.clients.values()},
3170
3427
signature="oa{sv}")
3171
3428
3172
3429
@dbus.service.method(_interface, in_signature="o")
3173
3430
def RemoveClient(self, object_path):
3174
3431
"D-Bus method"
3175
for c in tcp_server.clients.itervalues():
3432
for c in tcp_server.clients.values():
3176
3433
if c.dbus_object_path == object_path:
3177
3434
del tcp_server.clients[c.name]
3178
3435
c.remove_from_connection()
3182
3439
self.client_removed_signal(c)
3183
3440
return
3184
3441
raise KeyError(object_path)
3185
3442
3186
3443
del _interface
3187
3444
3188
3445
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3446
out_signature="a{oa{sa{sv}}}")
3190
3447
def GetManagedObjects(self):
3191
3448
"""D-Bus method"""
3192
3449
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3450
{client.dbus_object_path:
3451
dbus.Dictionary(
3452
{interface: client.GetAll(interface)
3453
for interface in
3454
client._get_all_interface_names()})
3455
for client in tcp_server.clients.values()})
3456
3200
3457
def client_added_signal(self, client):
3201
3458
"""Send the new standard signal and the old signal"""
3202
3459
if use_dbus:
3204
3461
self.InterfacesAdded(
3205
3462
client.dbus_object_path,
3206
3463
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3464
{interface: client.GetAll(interface)
3465
for interface in
3466
client._get_all_interface_names()}))
3210
3467
# Old signal
3211
3468
self.ClientAdded(client.dbus_object_path)
3212
3469
3213
3470
def client_removed_signal(self, client):
3214
3471
"""Send the new standard signal and the old signal"""
3215
3472
if use_dbus:
3220
3477
# Old signal
3221
3478
self.ClientRemoved(client.dbus_object_path,
3222
3479
client.name)
3223
3480
3224
3481
mandos_dbus_service = MandosDBusService()
3225
3482
3483
# Save modules to variables to exempt the modules from being
3484
# unloaded before the function registered with atexit() is run.
3485
mp = multiprocessing
3486
wn = wnull
3487
3226
3488
def cleanup():
3227
3489
"Cleanup function; run on exit"
3228
3490
if zeroconf:
3229
3491
service.cleanup()
3230
3231
multiprocessing.active_children()
3232
wnull.close()
3492
3493
mp.active_children()
3494
wn.close()
3233
3495
if not (tcp_server.clients or client_settings):
3234
3496
return
3235
3497
3236
3498
# Store client before exiting. Secrets are encrypted with key
3237
3499
# based on what config file has. If config file is
3238
3500
# removed/edited, old secret will thus be unrecovable.
3239
3501
clients = {}
3240
3502
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3503
for client in tcp_server.clients.values():
3242
3504
key = client_settings[client.name]["secret"]
3243
3505
client.encrypted_secret = pgp.encrypt(client.secret,
3244
3506
key)
3245
3507
client_dict = {}
3246
3508
3247
3509
# A list of attributes that can not be pickled
3248
3510
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3511
exclude = {"bus", "changedstate", "secret",
3512
"checker", "server_settings"}
3251
3513
for name, typ in inspect.getmembers(dbus.service
3252
3514
.Object):
3253
3515
exclude.add(name)
3254
3516
3255
3517
client_dict["encrypted_secret"] = (client
3256
3518
.encrypted_secret)
3257
3519
for attr in client.client_structure:
3258
3520
if attr not in exclude:
3259
3521
client_dict[attr] = getattr(client, attr)
3260
3522
3261
3523
clients[client.name] = client_dict
3262
3524
del client_settings[client.name]["secret"]
3263
3525
3264
3526
try:
3265
3527
with tempfile.NamedTemporaryFile(
3266
3528
mode='wb',
3268
3530
prefix='clients-',
3269
3531
dir=os.path.dirname(stored_state_path),
3270
3532
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3533
pickle.dump((clients, client_settings), stored_state,
3534
protocol=2)
3272
3535
tempname = stored_state.name
3273
3536
os.rename(tempname, stored_state_path)
3274
3537
except (IOError, OSError) as e:
3284
3547
logger.warning("Could not save persistent state:",
3285
3548
exc_info=e)
3286
3549
raise
3287
3550
3288
3551
# Delete all clients, and settings from config
3289
3552
while tcp_server.clients:
3290
3553
name, client = tcp_server.clients.popitem()
3296
3559
if use_dbus:
3297
3560
mandos_dbus_service.client_removed_signal(client)
3298
3561
client_settings.clear()
3299
3562
3300
3563
atexit.register(cleanup)
3301
3302
for client in tcp_server.clients.itervalues():
3564
3565
for client in tcp_server.clients.values():
3303
3566
if use_dbus:
3304
3567
# Emit D-Bus signal for adding
3305
3568
mandos_dbus_service.client_added_signal(client)
3306
3569
# Need to initiate checking of clients
3307
3570
if client.enabled:
3308
3571
client.init_checker()
3309
3572
3310
3573
tcp_server.enable()
3311
3574
tcp_server.server_activate()
3312
3575
3313
3576
# Find out what port we got
3314
3577
if zeroconf:
3315
3578
service.port = tcp_server.socket.getsockname()[1]
3320
3583
else: # IPv4
3321
3584
logger.info("Now listening on address %r, port %d",
3322
3585
*tcp_server.socket.getsockname())
3323
3324
#service.interface = tcp_server.socket.getsockname()[3]
3325
3586
3587
# service.interface = tcp_server.socket.getsockname()[3]
3588
3326
3589
try:
3327
3590
if zeroconf:
3328
3591
# From the Avahi example code
3333
3596
cleanup()
3334
3597
sys.exit(1)
3335
3598
# End of Avahi example code
3336
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3341
3599
3600
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3601
lambda *args, **kwargs:
3602
(tcp_server.handle_request
3603
(*args[2:], **kwargs) or True))
3604
3342
3605
logger.debug("Starting main loop")
3343
3606
main_loop.run()
3344
3607
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0