To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1157
- compare with another revision
- download diff
- download tarball
- view history from revision 1157
- Committer: Teddy Hogeborn
- Date: 2019-08-16 20:47:52 UTC
- Revision ID: teddy@recompile.se-20190816204752-aoy0t8b6nq02ve2s
Add Swedish debconf translation
* debian/po/sv.po: New.
* debian/po/sv.po: New.
- files added:
- bugs.xml
- debian/tests
- dracut-module
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
import SocketServer as socketserver
43
try:
44
import SocketServer as socketserver
45
except ImportError:
46
import socketserver
40
47
import socket
41
48
import argparse
42
49
import datetime
43
50
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
try:
52
import ConfigParser as configparser
53
except ImportError:
54
import configparser
51
55
import sys
52
56
import re
53
57
import os
62
66
import struct
63
67
import fcntl
64
68
import functools
65
import cPickle as pickle
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
71
78
import collections
79
import codecs
72
80
73
81
import dbus
74
82
import dbus.service
75
import gobject
76
import avahi
83
import gi
84
from gi.repository import GLib
77
85
from dbus.mainloop.glib import DBusGMainLoop
78
86
import ctypes
79
87
import ctypes.util
80
88
import xml.dom.minidom
81
89
import inspect
82
90
91
if sys.version_info.major == 2:
92
__metaclass__ = type
93
94
# Try to find the value of SO_BINDTODEVICE:
83
95
try:
96
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
97
# newer, and it is also the most natural place for it:
84
98
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
99
except AttributeError:
86
100
try:
101
# This is where SO_BINDTODEVICE was up to and including Python
102
# 2.6, and also 3.2:
87
103
from IN import SO_BINDTODEVICE
88
104
except ImportError:
89
SO_BINDTODEVICE = None
90
91
version = "1.6.8"
105
# In Python 2.7 it seems to have been removed entirely.
106
# Try running the C preprocessor:
107
try:
108
cc = subprocess.Popen(["cc", "--language=c", "-E",
109
"/dev/stdin"],
110
stdin=subprocess.PIPE,
111
stdout=subprocess.PIPE)
112
stdout = cc.communicate(
113
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
114
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
115
except (OSError, ValueError, IndexError):
116
# No value found
117
SO_BINDTODEVICE = None
118
119
if sys.version_info.major == 2:
120
str = unicode
121
122
if sys.version_info < (3, 2):
123
configparser.Configparser = configparser.SafeConfigParser
124
125
version = "1.8.7"
92
126
stored_state_file = "clients.pickle"
93
127
94
128
logger = logging.getLogger()
95
129
syslogger = None
96
130
97
131
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
132
if_nametoindex = ctypes.cdll.LoadLibrary(
133
ctypes.util.find_library("c")).if_nametoindex
101
134
except (OSError, AttributeError):
135
102
136
def if_nametoindex(interface):
103
137
"Get an interface index the hard way, i.e. using fcntl()"
104
138
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
139
with contextlib.closing(socket.socket()) as s:
106
140
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
141
struct.pack(b"16s16x", interface))
142
interface_index = struct.unpack("I", ifreq[16:20])[0]
111
143
return interface_index
112
144
113
145
146
def copy_function(func):
147
"""Make a copy of a function"""
148
if sys.version_info.major == 2:
149
return types.FunctionType(func.func_code,
150
func.func_globals,
151
func.func_name,
152
func.func_defaults,
153
func.func_closure)
154
else:
155
return types.FunctionType(func.__code__,
156
func.__globals__,
157
func.__name__,
158
func.__defaults__,
159
func.__closure__)
160
161
114
162
def initlogger(debug, level=logging.WARNING):
115
163
"""init logger and add loglevel"""
116
164
117
165
global syslogger
118
syslogger = (logging.handlers.SysLogHandler
119
(facility =
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
166
syslogger = (logging.handlers.SysLogHandler(
167
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
168
address="/dev/log"))
122
169
syslogger.setFormatter(logging.Formatter
123
170
('Mandos [%(process)d]: %(levelname)s:'
124
171
' %(message)s'))
125
172
logger.addHandler(syslogger)
126
173
127
174
if debug:
128
175
console = logging.StreamHandler()
129
176
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
139
186
pass
140
187
141
188
142
class PGPEngine(object):
189
class PGPEngine:
143
190
"""A simple class for OpenPGP symmetric encryption & decryption"""
191
144
192
def __init__(self):
145
193
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
194
self.gpg = "gpg"
195
try:
196
output = subprocess.check_output(["gpgconf"])
197
for line in output.splitlines():
198
name, text, path = line.split(b":")
199
if name == "gpg":
200
self.gpg = path
201
break
202
except OSError as e:
203
if e.errno != errno.ENOENT:
204
raise
146
205
self.gnupgargs = ['--batch',
147
'--home', self.tempdir,
206
'--homedir', self.tempdir,
148
207
'--force-mdc',
149
'--quiet',
150
'--no-use-agent']
151
208
'--quiet']
209
# Only GPG version 1 has the --no-use-agent option.
210
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
211
self.gnupgargs.append("--no-use-agent")
212
152
213
def __enter__(self):
153
214
return self
154
215
155
216
def __exit__(self, exc_type, exc_value, traceback):
156
217
self._cleanup()
157
218
return False
158
219
159
220
def __del__(self):
160
221
self._cleanup()
161
222
162
223
def _cleanup(self):
163
224
if self.tempdir is not None:
164
225
# Delete contents of tempdir
165
226
for root, dirs, files in os.walk(self.tempdir,
166
topdown = False):
227
topdown=False):
167
228
for filename in files:
168
229
os.remove(os.path.join(root, filename))
169
230
for dirname in dirs:
171
232
# Remove tempdir
172
233
os.rmdir(self.tempdir)
173
234
self.tempdir = None
174
235
175
236
def password_encode(self, password):
176
237
# Passphrase can not be empty and can not contain newlines or
177
238
# NUL bytes. So we prefix it and hex encode it.
182
243
.replace(b"\n", b"\\n")
183
244
.replace(b"\0", b"\\x00"))
184
245
return encoded
185
246
186
247
def encrypt(self, data, password):
187
248
passphrase = self.password_encode(password)
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
189
) as passfile:
249
with tempfile.NamedTemporaryFile(
250
dir=self.tempdir) as passfile:
190
251
passfile.write(passphrase)
191
252
passfile.flush()
192
proc = subprocess.Popen(['gpg', '--symmetric',
253
proc = subprocess.Popen([self.gpg, '--symmetric',
193
254
'--passphrase-file',
194
255
passfile.name]
195
256
+ self.gnupgargs,
196
stdin = subprocess.PIPE,
197
stdout = subprocess.PIPE,
198
stderr = subprocess.PIPE)
199
ciphertext, err = proc.communicate(input = data)
257
stdin=subprocess.PIPE,
258
stdout=subprocess.PIPE,
259
stderr=subprocess.PIPE)
260
ciphertext, err = proc.communicate(input=data)
200
261
if proc.returncode != 0:
201
262
raise PGPError(err)
202
263
return ciphertext
203
264
204
265
def decrypt(self, data, password):
205
266
passphrase = self.password_encode(password)
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
207
) as passfile:
267
with tempfile.NamedTemporaryFile(
268
dir=self.tempdir) as passfile:
208
269
passfile.write(passphrase)
209
270
passfile.flush()
210
proc = subprocess.Popen(['gpg', '--decrypt',
271
proc = subprocess.Popen([self.gpg, '--decrypt',
211
272
'--passphrase-file',
212
273
passfile.name]
213
274
+ self.gnupgargs,
214
stdin = subprocess.PIPE,
215
stdout = subprocess.PIPE,
216
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
218
= data)
275
stdin=subprocess.PIPE,
276
stdout=subprocess.PIPE,
277
stderr=subprocess.PIPE)
278
decrypted_plaintext, err = proc.communicate(input=data)
219
279
if proc.returncode != 0:
220
280
raise PGPError(err)
221
281
return decrypted_plaintext
222
282
223
283
284
# Pretend that we have an Avahi module
285
class avahi:
286
"""This isn't so much a class as it is a module-like namespace."""
287
IF_UNSPEC = -1 # avahi-common/address.h
288
PROTO_UNSPEC = -1 # avahi-common/address.h
289
PROTO_INET = 0 # avahi-common/address.h
290
PROTO_INET6 = 1 # avahi-common/address.h
291
DBUS_NAME = "org.freedesktop.Avahi"
292
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
293
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
294
DBUS_PATH_SERVER = "/"
295
296
@staticmethod
297
def string_array_to_txt_array(t):
298
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
299
for s in t), signature="ay")
300
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
301
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
302
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
303
SERVER_INVALID = 0 # avahi-common/defs.h
304
SERVER_REGISTERING = 1 # avahi-common/defs.h
305
SERVER_RUNNING = 2 # avahi-common/defs.h
306
SERVER_COLLISION = 3 # avahi-common/defs.h
307
SERVER_FAILURE = 4 # avahi-common/defs.h
308
309
224
310
class AvahiError(Exception):
225
311
def __init__(self, value, *args, **kwargs):
226
312
self.value = value
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
313
return super(AvahiError, self).__init__(value, *args,
314
**kwargs)
315
230
316
231
317
class AvahiServiceError(AvahiError):
232
318
pass
233
319
320
234
321
class AvahiGroupError(AvahiError):
235
322
pass
236
323
237
324
238
class AvahiService(object):
325
class AvahiService:
239
326
"""An Avahi (Zeroconf) service.
240
327
241
328
Attributes:
242
329
interface: integer; avahi.IF_UNSPEC or an interface index.
243
330
Used to optionally bind to the specified interface.
255
342
server: D-Bus Server
256
343
bus: dbus.SystemBus()
257
344
"""
258
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
345
346
def __init__(self,
347
interface=avahi.IF_UNSPEC,
348
name=None,
349
servicetype=None,
350
port=None,
351
TXT=None,
352
domain="",
353
host="",
354
max_renames=32768,
355
protocol=avahi.PROTO_UNSPEC,
356
bus=None):
263
357
self.interface = interface
264
358
self.name = name
265
359
self.type = servicetype
274
368
self.server = None
275
369
self.bus = bus
276
370
self.entry_group_state_changed_match = None
277
278
def rename(self):
371
372
def rename(self, remove=True):
279
373
"""Derived from the Avahi example code"""
280
374
if self.rename_count >= self.max_renames:
281
375
logger.critical("No suitable Zeroconf service name found"
282
376
" after %i retries, exiting.",
283
377
self.rename_count)
284
378
raise AvahiServiceError("Too many renames")
285
self.name = unicode(self.server
286
.GetAlternativeServiceName(self.name))
379
self.name = str(
380
self.server.GetAlternativeServiceName(self.name))
381
self.rename_count += 1
287
382
logger.info("Changing Zeroconf service name to %r ...",
288
383
self.name)
289
self.remove()
384
if remove:
385
self.remove()
290
386
try:
291
387
self.add()
292
388
except dbus.exceptions.DBusException as error:
293
logger.critical("D-Bus Exception", exc_info=error)
294
self.cleanup()
295
os._exit(1)
296
self.rename_count += 1
297
389
if (error.get_dbus_name()
390
== "org.freedesktop.Avahi.CollisionError"):
391
logger.info("Local Zeroconf service name collision.")
392
return self.rename(remove=False)
393
else:
394
logger.critical("D-Bus Exception", exc_info=error)
395
self.cleanup()
396
os._exit(1)
397
298
398
def remove(self):
299
399
"""Derived from the Avahi example code"""
300
400
if self.entry_group_state_changed_match is not None:
302
402
self.entry_group_state_changed_match = None
303
403
if self.group is not None:
304
404
self.group.Reset()
305
405
306
406
def add(self):
307
407
"""Derived from the Avahi example code"""
308
408
self.remove()
325
425
dbus.UInt16(self.port),
326
426
avahi.string_array_to_txt_array(self.TXT))
327
427
self.group.Commit()
328
428
329
429
def entry_group_state_changed(self, state, error):
330
430
"""Derived from the Avahi example code"""
331
431
logger.debug("Avahi entry group state change: %i", state)
332
432
333
433
if state == avahi.ENTRY_GROUP_ESTABLISHED:
334
434
logger.debug("Zeroconf service established.")
335
435
elif state == avahi.ENTRY_GROUP_COLLISION:
337
437
self.rename()
338
438
elif state == avahi.ENTRY_GROUP_FAILURE:
339
439
logger.critical("Avahi: Error in group state changed %s",
340
unicode(error))
341
raise AvahiGroupError("State changed: {!s}"
342
.format(error))
343
440
str(error))
441
raise AvahiGroupError("State changed: {!s}".format(error))
442
344
443
def cleanup(self):
345
444
"""Derived from the Avahi example code"""
346
445
if self.group is not None:
351
450
pass
352
451
self.group = None
353
452
self.remove()
354
453
355
454
def server_state_changed(self, state, error=None):
356
455
"""Derived from the Avahi example code"""
357
456
logger.debug("Avahi server state change: %i", state)
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
457
bad_states = {
458
avahi.SERVER_INVALID: "Zeroconf server invalid",
459
avahi.SERVER_REGISTERING: None,
460
avahi.SERVER_COLLISION: "Zeroconf server name collision",
461
avahi.SERVER_FAILURE: "Zeroconf server failure",
462
}
365
463
if state in bad_states:
366
464
if bad_states[state] is not None:
367
465
if error is None:
370
468
logger.error(bad_states[state] + ": %r", error)
371
469
self.cleanup()
372
470
elif state == avahi.SERVER_RUNNING:
373
self.add()
471
try:
472
self.add()
473
except dbus.exceptions.DBusException as error:
474
if (error.get_dbus_name()
475
== "org.freedesktop.Avahi.CollisionError"):
476
logger.info("Local Zeroconf service name"
477
" collision.")
478
return self.rename(remove=False)
479
else:
480
logger.critical("D-Bus Exception", exc_info=error)
481
self.cleanup()
482
os._exit(1)
374
483
else:
375
484
if error is None:
376
485
logger.debug("Unknown state: %r", state)
377
486
else:
378
487
logger.debug("Unknown state: %r: %r", state, error)
379
488
380
489
def activate(self):
381
490
"""Derived from the Avahi example code"""
382
491
if self.server is None:
386
495
follow_name_owner_changes=True),
387
496
avahi.DBUS_INTERFACE_SERVER)
388
497
self.server.connect_to_signal("StateChanged",
389
self.server_state_changed)
498
self.server_state_changed)
390
499
self.server_state_changed(self.server.GetState())
391
500
392
501
393
502
class AvahiServiceToSyslog(AvahiService):
394
def rename(self):
503
def rename(self, *args, **kwargs):
395
504
"""Add the new name to the syslog messages"""
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
505
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
506
syslogger.setFormatter(logging.Formatter(
507
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
508
.format(self.name)))
401
509
return ret
402
510
403
511
404
class Client(object):
512
# Pretend that we have a GnuTLS module
513
class gnutls:
514
"""This isn't so much a class as it is a module-like namespace."""
515
516
library = ctypes.util.find_library("gnutls")
517
if library is None:
518
library = ctypes.util.find_library("gnutls-deb0")
519
_library = ctypes.cdll.LoadLibrary(library)
520
del library
521
522
# Unless otherwise indicated, the constants and types below are
523
# all from the gnutls/gnutls.h C header file.
524
525
# Constants
526
E_SUCCESS = 0
527
E_INTERRUPTED = -52
528
E_AGAIN = -28
529
CRT_OPENPGP = 2
530
CRT_RAWPK = 3
531
CLIENT = 2
532
SHUT_RDWR = 0
533
CRD_CERTIFICATE = 1
534
E_NO_CERTIFICATE_FOUND = -49
535
X509_FMT_DER = 0
536
NO_TICKETS = 1<<10
537
ENABLE_RAWPK = 1<<18
538
CTYPE_PEERS = 3
539
KEYID_USE_SHA256 = 1 # gnutls/x509.h
540
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
541
542
# Types
543
class session_int(ctypes.Structure):
544
_fields_ = []
545
session_t = ctypes.POINTER(session_int)
546
547
class certificate_credentials_st(ctypes.Structure):
548
_fields_ = []
549
certificate_credentials_t = ctypes.POINTER(
550
certificate_credentials_st)
551
certificate_type_t = ctypes.c_int
552
553
class datum_t(ctypes.Structure):
554
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
555
('size', ctypes.c_uint)]
556
557
class openpgp_crt_int(ctypes.Structure):
558
_fields_ = []
559
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
560
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
561
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
562
credentials_type_t = ctypes.c_int
563
transport_ptr_t = ctypes.c_void_p
564
close_request_t = ctypes.c_int
565
566
# Exceptions
567
class Error(Exception):
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
571
# gnutls.strerror()
572
self.code = code
573
if message is None and code is not None:
574
message = gnutls.strerror(code)
575
return super(gnutls.Error, self).__init__(
576
message, *args)
577
578
class CertificateSecurityError(Error):
579
pass
580
581
# Classes
582
class Credentials:
583
def __init__(self):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
588
589
def __del__(self):
590
gnutls.certificate_free_credentials(self._c_object)
591
592
class ClientSession:
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls_flags = gnutls.CLIENT
596
if gnutls.check_version(b"3.5.6"):
597
gnutls_flags |= gnutls.NO_TICKETS
598
if gnutls.has_rawpk:
599
gnutls_flags |= gnutls.ENABLE_RAWPK
600
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
601
del gnutls_flags
602
gnutls.set_default_priority(self._c_object)
603
gnutls.transport_set_ptr(self._c_object, socket.fileno())
604
gnutls.handshake_set_private_extensions(self._c_object,
605
True)
606
self.socket = socket
607
if credentials is None:
608
credentials = gnutls.Credentials()
609
gnutls.credentials_set(self._c_object, credentials.type,
610
ctypes.cast(credentials._c_object,
611
ctypes.c_void_p))
612
self.credentials = credentials
613
614
def __del__(self):
615
gnutls.deinit(self._c_object)
616
617
def handshake(self):
618
return gnutls.handshake(self._c_object)
619
620
def send(self, data):
621
data = bytes(data)
622
data_len = len(data)
623
while data_len > 0:
624
data_len -= gnutls.record_send(self._c_object,
625
data[-data_len:],
626
data_len)
627
628
def bye(self):
629
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
630
631
# Error handling functions
632
def _error_code(result):
633
"""A function to raise exceptions on errors, suitable
634
for the 'restype' attribute on ctypes functions"""
635
if result >= 0:
636
return result
637
if result == gnutls.E_NO_CERTIFICATE_FOUND:
638
raise gnutls.CertificateSecurityError(code=result)
639
raise gnutls.Error(code=result)
640
641
def _retry_on_error(result, func, arguments):
642
"""A function to retry on some errors, suitable
643
for the 'errcheck' attribute on ctypes functions"""
644
while result < 0:
645
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
646
return _error_code(result)
647
result = func(*arguments)
648
return result
649
650
# Unless otherwise indicated, the function declarations below are
651
# all from the gnutls/gnutls.h C header file.
652
653
# Functions
654
priority_set_direct = _library.gnutls_priority_set_direct
655
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
656
ctypes.POINTER(ctypes.c_char_p)]
657
priority_set_direct.restype = _error_code
658
659
init = _library.gnutls_init
660
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
661
init.restype = _error_code
662
663
set_default_priority = _library.gnutls_set_default_priority
664
set_default_priority.argtypes = [session_t]
665
set_default_priority.restype = _error_code
666
667
record_send = _library.gnutls_record_send
668
record_send.argtypes = [session_t, ctypes.c_void_p,
669
ctypes.c_size_t]
670
record_send.restype = ctypes.c_ssize_t
671
record_send.errcheck = _retry_on_error
672
673
certificate_allocate_credentials = (
674
_library.gnutls_certificate_allocate_credentials)
675
certificate_allocate_credentials.argtypes = [
676
ctypes.POINTER(certificate_credentials_t)]
677
certificate_allocate_credentials.restype = _error_code
678
679
certificate_free_credentials = (
680
_library.gnutls_certificate_free_credentials)
681
certificate_free_credentials.argtypes = [
682
certificate_credentials_t]
683
certificate_free_credentials.restype = None
684
685
handshake_set_private_extensions = (
686
_library.gnutls_handshake_set_private_extensions)
687
handshake_set_private_extensions.argtypes = [session_t,
688
ctypes.c_int]
689
handshake_set_private_extensions.restype = None
690
691
credentials_set = _library.gnutls_credentials_set
692
credentials_set.argtypes = [session_t, credentials_type_t,
693
ctypes.c_void_p]
694
credentials_set.restype = _error_code
695
696
strerror = _library.gnutls_strerror
697
strerror.argtypes = [ctypes.c_int]
698
strerror.restype = ctypes.c_char_p
699
700
certificate_type_get = _library.gnutls_certificate_type_get
701
certificate_type_get.argtypes = [session_t]
702
certificate_type_get.restype = _error_code
703
704
certificate_get_peers = _library.gnutls_certificate_get_peers
705
certificate_get_peers.argtypes = [session_t,
706
ctypes.POINTER(ctypes.c_uint)]
707
certificate_get_peers.restype = ctypes.POINTER(datum_t)
708
709
global_set_log_level = _library.gnutls_global_set_log_level
710
global_set_log_level.argtypes = [ctypes.c_int]
711
global_set_log_level.restype = None
712
713
global_set_log_function = _library.gnutls_global_set_log_function
714
global_set_log_function.argtypes = [log_func]
715
global_set_log_function.restype = None
716
717
deinit = _library.gnutls_deinit
718
deinit.argtypes = [session_t]
719
deinit.restype = None
720
721
handshake = _library.gnutls_handshake
722
handshake.argtypes = [session_t]
723
handshake.restype = _error_code
724
handshake.errcheck = _retry_on_error
725
726
transport_set_ptr = _library.gnutls_transport_set_ptr
727
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
728
transport_set_ptr.restype = None
729
730
bye = _library.gnutls_bye
731
bye.argtypes = [session_t, close_request_t]
732
bye.restype = _error_code
733
bye.errcheck = _retry_on_error
734
735
check_version = _library.gnutls_check_version
736
check_version.argtypes = [ctypes.c_char_p]
737
check_version.restype = ctypes.c_char_p
738
739
_need_version = b"3.3.0"
740
if check_version(_need_version) is None:
741
raise self.Error("Needs GnuTLS {} or later"
742
.format(_need_version))
743
744
_tls_rawpk_version = b"3.6.6"
745
has_rawpk = bool(check_version(_tls_rawpk_version))
746
747
if has_rawpk:
748
# Types
749
class pubkey_st(ctypes.Structure):
750
_fields = []
751
pubkey_t = ctypes.POINTER(pubkey_st)
752
753
x509_crt_fmt_t = ctypes.c_int
754
755
# All the function declarations below are from gnutls/abstract.h
756
pubkey_init = _library.gnutls_pubkey_init
757
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
758
pubkey_init.restype = _error_code
759
760
pubkey_import = _library.gnutls_pubkey_import
761
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
762
x509_crt_fmt_t]
763
pubkey_import.restype = _error_code
764
765
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
766
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
767
ctypes.POINTER(ctypes.c_ubyte),
768
ctypes.POINTER(ctypes.c_size_t)]
769
pubkey_get_key_id.restype = _error_code
770
771
pubkey_deinit = _library.gnutls_pubkey_deinit
772
pubkey_deinit.argtypes = [pubkey_t]
773
pubkey_deinit.restype = None
774
else:
775
# All the function declarations below are from gnutls/openpgp.h
776
777
openpgp_crt_init = _library.gnutls_openpgp_crt_init
778
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
779
openpgp_crt_init.restype = _error_code
780
781
openpgp_crt_import = _library.gnutls_openpgp_crt_import
782
openpgp_crt_import.argtypes = [openpgp_crt_t,
783
ctypes.POINTER(datum_t),
784
openpgp_crt_fmt_t]
785
openpgp_crt_import.restype = _error_code
786
787
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
788
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
789
ctypes.POINTER(ctypes.c_uint)]
790
openpgp_crt_verify_self.restype = _error_code
791
792
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
793
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
794
openpgp_crt_deinit.restype = None
795
796
openpgp_crt_get_fingerprint = (
797
_library.gnutls_openpgp_crt_get_fingerprint)
798
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
ctypes.c_void_p,
800
ctypes.POINTER(
801
ctypes.c_size_t)]
802
openpgp_crt_get_fingerprint.restype = _error_code
803
804
if check_version(b"3.6.4"):
805
certificate_type_get2 = _library.gnutls_certificate_type_get2
806
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
807
certificate_type_get2.restype = _error_code
808
809
# Remove non-public functions
810
del _error_code, _retry_on_error
811
812
813
def call_pipe(connection, # : multiprocessing.Connection
814
func, *args, **kwargs):
815
"""This function is meant to be called by multiprocessing.Process
816
817
This function runs func(*args, **kwargs), and writes the resulting
818
return value on the provided multiprocessing.Connection.
819
"""
820
connection.send(func(*args, **kwargs))
821
connection.close()
822
823
824
class Client:
405
825
"""A representation of a client host served by this server.
406
826
407
827
Attributes:
408
828
approved: bool(); 'None' if not yet approved/disapproved
409
829
approval_delay: datetime.timedelta(); Time to wait for approval
410
830
approval_duration: datetime.timedelta(); Duration of one approval
411
checker: subprocess.Popen(); a running checker process used
412
to see if the client lives.
413
'None' if no process is running.
414
checker_callback_tag: a gobject event source tag, or None
831
checker: multiprocessing.Process(); a running checker process used
832
to see if the client lives. 'None' if no process is
833
running.
834
checker_callback_tag: a GLib event source tag, or None
415
835
checker_command: string; External command which is run to check
416
836
if client lives. %() expansions are done at
417
837
runtime with vars(self) as dict, so that for
418
838
instance %(name)s can be used in the command.
419
checker_initiator_tag: a gobject event source tag, or None
839
checker_initiator_tag: a GLib event source tag, or None
420
840
created: datetime.datetime(); (UTC) object creation
421
841
client_structure: Object describing what attributes a client has
422
842
and is used for storing the client at exit
423
843
current_checker_command: string; current running checker_command
424
disable_initiator_tag: a gobject event source tag, or None
844
disable_initiator_tag: a GLib event source tag, or None
425
845
enabled: bool()
426
846
fingerprint: string (40 or 32 hexadecimal digits); used to
427
uniquely identify the client
847
uniquely identify an OpenPGP client
848
key_id: string (64 hexadecimal digits); used to uniquely identify
849
a client using raw public keys
428
850
host: string; available for use by the checker command
429
851
interval: datetime.timedelta(); How often to start a new checker
430
852
last_approval_request: datetime.datetime(); (UTC) or None
432
854
last_checker_status: integer between 0 and 255 reflecting exit
433
855
status of last checker. -1 reflects crashed
434
856
checker, -2 means no checker completed yet.
857
last_checker_signal: The signal which killed the last checker, if
858
last_checker_status is -1
435
859
last_enabled: datetime.datetime(); (UTC) or None
436
860
name: string; from the config file, used in log messages and
437
861
D-Bus identifiers
444
868
disabled, or None
445
869
server_settings: The server_settings dict from main()
446
870
"""
447
871
448
872
runtime_expansions = ("approval_delay", "approval_duration",
449
"created", "enabled", "expires",
873
"created", "enabled", "expires", "key_id",
450
874
"fingerprint", "host", "interval",
451
875
"last_approval_request", "last_checked_ok",
452
876
"last_enabled", "name", "timeout")
453
client_defaults = { "timeout": "PT5M",
454
"extended_timeout": "PT15M",
455
"interval": "PT2M",
456
"checker": "fping -q -- %%(host)s",
457
"host": "",
458
"approval_delay": "PT0S",
459
"approval_duration": "PT1S",
460
"approved_by_default": "True",
461
"enabled": "True",
462
}
463
877
client_defaults = {
878
"timeout": "PT5M",
879
"extended_timeout": "PT15M",
880
"interval": "PT2M",
881
"checker": "fping -q -- %%(host)s",
882
"host": "",
883
"approval_delay": "PT0S",
884
"approval_duration": "PT1S",
885
"approved_by_default": "True",
886
"enabled": "True",
887
}
888
464
889
@staticmethod
465
890
def config_parser(config):
466
891
"""Construct a new dict of client settings of this form:
473
898
for client_name in config.sections():
474
899
section = dict(config.items(client_name))
475
900
client = settings[client_name] = {}
476
901
477
902
client["host"] = section["host"]
478
903
# Reformat values from string types to Python types
479
904
client["approved_by_default"] = config.getboolean(
480
905
client_name, "approved_by_default")
481
906
client["enabled"] = config.getboolean(client_name,
482
907
"enabled")
483
908
909
# Uppercase and remove spaces from key_id and fingerprint
910
# for later comparison purposes with return value from the
911
# key_id() and fingerprint() functions
912
client["key_id"] = (section.get("key_id", "").upper()
913
.replace(" ", ""))
484
914
client["fingerprint"] = (section["fingerprint"].upper()
485
915
.replace(" ", ""))
486
916
if "secret" in section:
487
client["secret"] = section["secret"].decode("base64")
917
client["secret"] = codecs.decode(section["secret"]
918
.encode("utf-8"),
919
"base64")
488
920
elif "secfile" in section:
489
921
with open(os.path.expanduser(os.path.expandvars
490
922
(section["secfile"])),
505
937
client["last_approval_request"] = None
506
938
client["last_checked_ok"] = None
507
939
client["last_checker_status"] = -2
508
940
509
941
return settings
510
511
def __init__(self, settings, name = None, server_settings=None):
942
943
def __init__(self, settings, name=None, server_settings=None):
512
944
self.name = name
513
945
if server_settings is None:
514
946
server_settings = {}
516
948
# adding all client settings
517
949
for setting, value in settings.items():
518
950
setattr(self, setting, value)
519
951
520
952
if self.enabled:
521
953
if not hasattr(self, "last_enabled"):
522
954
self.last_enabled = datetime.datetime.utcnow()
526
958
else:
527
959
self.last_enabled = None
528
960
self.expires = None
529
961
530
962
logger.debug("Creating client %r", self.name)
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the fingerprint()
533
# function
963
logger.debug(" Key ID: %s", self.key_id)
534
964
logger.debug(" Fingerprint: %s", self.fingerprint)
535
965
self.created = settings.get("created",
536
966
datetime.datetime.utcnow())
537
967
538
968
# attributes specific for this server instance
539
969
self.checker = None
540
970
self.checker_initiator_tag = None
543
973
self.current_checker_command = None
544
974
self.approved = None
545
975
self.approvals_pending = 0
546
self.changedstate = (multiprocessing_manager
547
.Condition(multiprocessing_manager
548
.Lock()))
549
self.client_structure = [attr for attr in
550
self.__dict__.iterkeys()
976
self.changedstate = multiprocessing_manager.Condition(
977
multiprocessing_manager.Lock())
978
self.client_structure = [attr
979
for attr in self.__dict__.keys()
551
980
if not attr.startswith("_")]
552
981
self.client_structure.append("client_structure")
553
554
for name, t in inspect.getmembers(type(self),
555
lambda obj:
556
isinstance(obj,
557
property)):
982
983
for name, t in inspect.getmembers(
984
type(self), lambda obj: isinstance(obj, property)):
558
985
if not name.startswith("_"):
559
986
self.client_structure.append(name)
560
987
561
988
# Send notice to process children that client state has changed
562
989
def send_changedstate(self):
563
990
with self.changedstate:
564
991
self.changedstate.notify_all()
565
992
566
993
def enable(self):
567
994
"""Start this client's checker and timeout hooks"""
568
995
if getattr(self, "enabled", False):
573
1000
self.last_enabled = datetime.datetime.utcnow()
574
1001
self.init_checker()
575
1002
self.send_changedstate()
576
1003
577
1004
def disable(self, quiet=True):
578
1005
"""Disable this client."""
579
1006
if not getattr(self, "enabled", False):
581
1008
if not quiet:
582
1009
logger.info("Disabling client %s", self.name)
583
1010
if getattr(self, "disable_initiator_tag", None) is not None:
584
gobject.source_remove(self.disable_initiator_tag)
1011
GLib.source_remove(self.disable_initiator_tag)
585
1012
self.disable_initiator_tag = None
586
1013
self.expires = None
587
1014
if getattr(self, "checker_initiator_tag", None) is not None:
588
gobject.source_remove(self.checker_initiator_tag)
1015
GLib.source_remove(self.checker_initiator_tag)
589
1016
self.checker_initiator_tag = None
590
1017
self.stop_checker()
591
1018
self.enabled = False
592
1019
if not quiet:
593
1020
self.send_changedstate()
594
# Do not run this again if called by a gobject.timeout_add
1021
# Do not run this again if called by a GLib.timeout_add
595
1022
return False
596
1023
597
1024
def __del__(self):
598
1025
self.disable()
599
1026
600
1027
def init_checker(self):
601
1028
# Schedule a new checker to be started an 'interval' from now,
602
1029
# and every interval from then on.
603
1030
if self.checker_initiator_tag is not None:
604
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
606
(int(self.interval
607
.total_seconds() * 1000),
608
self.start_checker))
1031
GLib.source_remove(self.checker_initiator_tag)
1032
self.checker_initiator_tag = GLib.timeout_add(
1033
int(self.interval.total_seconds() * 1000),
1034
self.start_checker)
609
1035
# Schedule a disable() when 'timeout' has passed
610
1036
if self.disable_initiator_tag is not None:
611
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
613
(int(self.timeout
614
.total_seconds() * 1000),
615
self.disable))
1037
GLib.source_remove(self.disable_initiator_tag)
1038
self.disable_initiator_tag = GLib.timeout_add(
1039
int(self.timeout.total_seconds() * 1000), self.disable)
616
1040
# Also start a new checker *right now*.
617
1041
self.start_checker()
618
619
def checker_callback(self, pid, condition, command):
1042
1043
def checker_callback(self, source, condition, connection,
1044
command):
620
1045
"""The checker has completed, so take appropriate actions."""
1046
# Read return code from connection (see call_pipe)
1047
returncode = connection.recv()
1048
connection.close()
1049
self.checker.join()
621
1050
self.checker_callback_tag = None
622
1051
self.checker = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
1052
1053
if returncode >= 0:
1054
self.last_checker_status = returncode
1055
self.last_checker_signal = None
625
1056
if self.last_checker_status == 0:
626
1057
logger.info("Checker for %(name)s succeeded",
627
1058
vars(self))
628
1059
self.checked_ok()
629
1060
else:
630
logger.info("Checker for %(name)s failed",
631
vars(self))
1061
logger.info("Checker for %(name)s failed", vars(self))
632
1062
else:
633
1063
self.last_checker_status = -1
1064
self.last_checker_signal = -returncode
634
1065
logger.warning("Checker for %(name)s crashed?",
635
1066
vars(self))
636
1067
return False
1068
637
1069
def checked_ok(self):
638
1070
"""Assert that the client has been seen, alive and well."""
639
1071
self.last_checked_ok = datetime.datetime.utcnow()
640
1072
self.last_checker_status = 0
1073
self.last_checker_signal = None
641
1074
self.bump_timeout()
642
1075
643
1076
def bump_timeout(self, timeout=None):
644
1077
"""Bump up the timeout for this client."""
645
1078
if timeout is None:
646
1079
timeout = self.timeout
647
1080
if self.disable_initiator_tag is not None:
648
gobject.source_remove(self.disable_initiator_tag)
1081
GLib.source_remove(self.disable_initiator_tag)
649
1082
self.disable_initiator_tag = None
650
1083
if getattr(self, "enabled", False):
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
1084
self.disable_initiator_tag = GLib.timeout_add(
1085
int(timeout.total_seconds() * 1000), self.disable)
654
1086
self.expires = datetime.datetime.utcnow() + timeout
655
1087
656
1088
def need_approval(self):
657
1089
self.last_approval_request = datetime.datetime.utcnow()
658
1090
659
1091
def start_checker(self):
660
1092
"""Start a new checker subprocess if one is not running.
661
1093
662
1094
If a checker already exists, leave it running and do
663
1095
nothing."""
664
1096
# The reason for not killing a running checker is that if we
669
1101
# checkers alone, the checker would have to take more time
670
1102
# than 'timeout' for the client to be disabled, which is as it
671
1103
# should be.
672
673
# If a checker exists, make sure it is not a zombie
674
try:
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
677
pass
678
except OSError as error:
679
if error.errno != errno.ECHILD:
680
raise
681
else:
682
if pid:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
1104
1105
if self.checker is not None and not self.checker.is_alive():
1106
logger.warning("Checker was not alive; joining")
1107
self.checker.join()
1108
self.checker = None
687
1109
# Start a new checker if needed
688
1110
if self.checker is None:
689
1111
# Escape attributes for the shell
690
escaped_attrs = { attr:
691
re.escape(unicode(getattr(self,
692
attr)))
693
for attr in self.runtime_expansions }
1112
escaped_attrs = {
1113
attr: re.escape(str(getattr(self, attr)))
1114
for attr in self.runtime_expansions}
694
1115
try:
695
1116
command = self.checker_command % escaped_attrs
696
1117
except TypeError as error:
697
1118
logger.error('Could not format string "%s"',
698
self.checker_command, exc_info=error)
699
return True # Try again later
1119
self.checker_command,
1120
exc_info=error)
1121
return True # Try again later
700
1122
self.current_checker_command = command
701
try:
702
logger.info("Starting checker %r for %s",
703
command, self.name)
704
# We don't need to redirect stdout and stderr, since
705
# in normal mode, that is already done by daemon(),
706
# and in debug mode we don't want to. (Stdin is
707
# always replaced by /dev/null.)
708
# The exception is when not debugging but nevertheless
709
# running in the foreground; use the previously
710
# created wnull.
711
popen_args = {}
712
if (not self.server_settings["debug"]
713
and self.server_settings["foreground"]):
714
popen_args.update({"stdout": wnull,
715
"stderr": wnull })
716
self.checker = subprocess.Popen(command,
717
close_fds=True,
718
shell=True, cwd="/",
719
**popen_args)
720
except OSError as error:
721
logger.error("Failed to start subprocess",
722
exc_info=error)
723
return True
724
self.checker_callback_tag = (gobject.child_watch_add
725
(self.checker.pid,
726
self.checker_callback,
727
data=command))
728
# The checker may have completed before the gobject
729
# watch was added. Check for this.
730
try:
731
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
732
except OSError as error:
733
if error.errno == errno.ECHILD:
734
# This should never happen
735
logger.error("Child process vanished",
736
exc_info=error)
737
return True
738
raise
739
if pid:
740
gobject.source_remove(self.checker_callback_tag)
741
self.checker_callback(pid, status, command)
742
# Re-run this periodically if run by gobject.timeout_add
1123
logger.info("Starting checker %r for %s", command,
1124
self.name)
1125
# We don't need to redirect stdout and stderr, since
1126
# in normal mode, that is already done by daemon(),
1127
# and in debug mode we don't want to. (Stdin is
1128
# always replaced by /dev/null.)
1129
# The exception is when not debugging but nevertheless
1130
# running in the foreground; use the previously
1131
# created wnull.
1132
popen_args = {"close_fds": True,
1133
"shell": True,
1134
"cwd": "/"}
1135
if (not self.server_settings["debug"]
1136
and self.server_settings["foreground"]):
1137
popen_args.update({"stdout": wnull,
1138
"stderr": wnull})
1139
pipe = multiprocessing.Pipe(duplex=False)
1140
self.checker = multiprocessing.Process(
1141
target=call_pipe,
1142
args=(pipe[1], subprocess.call, command),
1143
kwargs=popen_args)
1144
self.checker.start()
1145
self.checker_callback_tag = GLib.io_add_watch(
1146
pipe[0].fileno(), GLib.IO_IN,
1147
self.checker_callback, pipe[0], command)
1148
# Re-run this periodically if run by GLib.timeout_add
743
1149
return True
744
1150
745
1151
def stop_checker(self):
746
1152
"""Force the checker process, if any, to stop."""
747
1153
if self.checker_callback_tag:
748
gobject.source_remove(self.checker_callback_tag)
1154
GLib.source_remove(self.checker_callback_tag)
749
1155
self.checker_callback_tag = None
750
1156
if getattr(self, "checker", None) is None:
751
1157
return
752
1158
logger.debug("Stopping checker for %(name)s", vars(self))
753
try:
754
self.checker.terminate()
755
#time.sleep(0.5)
756
#if self.checker.poll() is None:
757
# self.checker.kill()
758
except OSError as error:
759
if error.errno != errno.ESRCH: # No such process
760
raise
1159
self.checker.terminate()
761
1160
self.checker = None
762
1161
763
1162
764
def dbus_service_property(dbus_interface, signature="v",
765
access="readwrite", byte_arrays=False):
1163
def dbus_service_property(dbus_interface,
1164
signature="v",
1165
access="readwrite",
1166
byte_arrays=False):
766
1167
"""Decorators for marking methods of a DBusObjectWithProperties to
767
1168
become properties on the D-Bus.
768
1169
769
1170
The decorated method will be called with no arguments by "Get"
770
1171
and with one argument by "Set".
771
1172
772
1173
The parameters, where they are supported, are the same as
773
1174
dbus.service.method, except there is only "signature", since the
774
1175
type from Get() and the type sent to Set() is the same.
778
1179
if byte_arrays and signature != "ay":
779
1180
raise ValueError("Byte arrays not supported for non-'ay'"
780
1181
" signature {!r}".format(signature))
1182
781
1183
def decorator(func):
782
1184
func._dbus_is_property = True
783
1185
func._dbus_interface = dbus_interface
786
1188
func._dbus_name = func.__name__
787
1189
if func._dbus_name.endswith("_dbus_property"):
788
1190
func._dbus_name = func._dbus_name[:-14]
789
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1191
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
790
1192
return func
1193
791
1194
return decorator
792
1195
793
1196
794
1197
def dbus_interface_annotations(dbus_interface):
795
1198
"""Decorator for marking functions returning interface annotations
796
1199
797
1200
Usage:
798
1201
799
1202
@dbus_interface_annotations("org.example.Interface")
800
1203
def _foo(self): # Function name does not matter
801
1204
return {"org.freedesktop.DBus.Deprecated": "true",
802
1205
"org.freedesktop.DBus.Property.EmitsChangedSignal":
803
1206
"false"}
804
1207
"""
1208
805
1209
def decorator(func):
806
1210
func._dbus_is_interface = True
807
1211
func._dbus_interface = dbus_interface
808
1212
func._dbus_name = dbus_interface
809
1213
return func
1214
810
1215
return decorator
811
1216
812
1217
813
1218
def dbus_annotations(annotations):
814
1219
"""Decorator to annotate D-Bus methods, signals or properties
815
1220
Usage:
816
1221
1222
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1223
"org.freedesktop.DBus.Property."
1224
"EmitsChangedSignal": "false"})
817
1225
@dbus_service_property("org.example.Interface", signature="b",
818
1226
access="r")
819
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
820
"org.freedesktop.DBus.Property."
821
"EmitsChangedSignal": "false"})
822
1227
def Property_dbus_property(self):
823
1228
return dbus.Boolean(False)
1229
1230
See also the DBusObjectWithAnnotations class.
824
1231
"""
1232
825
1233
def decorator(func):
826
1234
func._dbus_annotations = annotations
827
1235
return func
1236
828
1237
return decorator
829
1238
830
1239
831
1240
class DBusPropertyException(dbus.exceptions.DBusException):
832
1241
"""A base class for D-Bus property-related exceptions
833
1242
"""
834
def __unicode__(self):
835
return unicode(str(self))
1243
pass
836
1244
837
1245
838
1246
class DBusPropertyAccessException(DBusPropertyException):
847
1255
pass
848
1256
849
1257
850
class DBusObjectWithProperties(dbus.service.Object):
851
"""A D-Bus object with properties.
852
853
Classes inheriting from this can use the dbus_service_property
854
decorator to expose methods as D-Bus properties. It exposes the
855
standard Get(), Set(), and GetAll() methods on the D-Bus.
1258
class DBusObjectWithAnnotations(dbus.service.Object):
1259
"""A D-Bus object with annotations.
1260
1261
Classes inheriting from this can use the dbus_annotations
1262
decorator to add annotations to methods or signals.
856
1263
"""
857
1264
858
1265
@staticmethod
859
1266
def _is_dbus_thing(thing):
860
1267
"""Returns a function testing if an attribute is a D-Bus thing
861
1268
862
1269
If called like _is_dbus_thing("method") it returns a function
863
1270
suitable for use as predicate to inspect.getmembers().
864
1271
"""
865
1272
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
866
1273
False)
867
1274
868
1275
def _get_all_dbus_things(self, thing):
869
1276
"""Returns a generator of (name, attribute) pairs
870
1277
"""
871
return ((getattr(athing.__get__(self), "_dbus_name",
872
name),
1278
return ((getattr(athing.__get__(self), "_dbus_name", name),
873
1279
athing.__get__(self))
874
1280
for cls in self.__class__.__mro__
875
1281
for name, athing in
876
inspect.getmembers(cls,
877
self._is_dbus_thing(thing)))
878
1282
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1283
1284
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1285
out_signature="s",
1286
path_keyword='object_path',
1287
connection_keyword='connection')
1288
def Introspect(self, object_path, connection):
1289
"""Overloading of standard D-Bus method.
1290
1291
Inserts annotation tags on methods and signals.
1292
"""
1293
xmlstring = dbus.service.Object.Introspect(self, object_path,
1294
connection)
1295
try:
1296
document = xml.dom.minidom.parseString(xmlstring)
1297
1298
for if_tag in document.getElementsByTagName("interface"):
1299
# Add annotation tags
1300
for typ in ("method", "signal"):
1301
for tag in if_tag.getElementsByTagName(typ):
1302
annots = dict()
1303
for name, prop in (self.
1304
_get_all_dbus_things(typ)):
1305
if (name == tag.getAttribute("name")
1306
and prop._dbus_interface
1307
== if_tag.getAttribute("name")):
1308
annots.update(getattr(
1309
prop, "_dbus_annotations", {}))
1310
for name, value in annots.items():
1311
ann_tag = document.createElement(
1312
"annotation")
1313
ann_tag.setAttribute("name", name)
1314
ann_tag.setAttribute("value", value)
1315
tag.appendChild(ann_tag)
1316
# Add interface annotation tags
1317
for annotation, value in dict(
1318
itertools.chain.from_iterable(
1319
annotations().items()
1320
for name, annotations
1321
in self._get_all_dbus_things("interface")
1322
if name == if_tag.getAttribute("name")
1323
)).items():
1324
ann_tag = document.createElement("annotation")
1325
ann_tag.setAttribute("name", annotation)
1326
ann_tag.setAttribute("value", value)
1327
if_tag.appendChild(ann_tag)
1328
# Fix argument name for the Introspect method itself
1329
if (if_tag.getAttribute("name")
1330
== dbus.INTROSPECTABLE_IFACE):
1331
for cn in if_tag.getElementsByTagName("method"):
1332
if cn.getAttribute("name") == "Introspect":
1333
for arg in cn.getElementsByTagName("arg"):
1334
if (arg.getAttribute("direction")
1335
== "out"):
1336
arg.setAttribute("name",
1337
"xml_data")
1338
xmlstring = document.toxml("utf-8")
1339
document.unlink()
1340
except (AttributeError, xml.dom.DOMException,
1341
xml.parsers.expat.ExpatError) as error:
1342
logger.error("Failed to override Introspection method",
1343
exc_info=error)
1344
return xmlstring
1345
1346
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1348
"""A D-Bus object with properties.
1349
1350
Classes inheriting from this can use the dbus_service_property
1351
decorator to expose methods as D-Bus properties. It exposes the
1352
standard Get(), Set(), and GetAll() methods on the D-Bus.
1353
"""
1354
879
1355
def _get_dbus_property(self, interface_name, property_name):
880
1356
"""Returns a bound method if one exists which is a D-Bus
881
1357
property with the specified name and interface.
882
1358
"""
883
for cls in self.__class__.__mro__:
884
for name, value in (inspect.getmembers
885
(cls,
886
self._is_dbus_thing("property"))):
1359
for cls in self.__class__.__mro__:
1360
for name, value in inspect.getmembers(
1361
cls, self._is_dbus_thing("property")):
887
1362
if (value._dbus_name == property_name
888
1363
and value._dbus_interface == interface_name):
889
1364
return value.__get__(self)
890
1365
891
1366
# No such property
892
raise DBusPropertyNotFound(self.dbus_object_path + ":"
893
+ interface_name + "."
894
+ property_name)
895
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1367
raise DBusPropertyNotFound("{}:{}.{}".format(
1368
self.dbus_object_path, interface_name, property_name))
1369
1370
@classmethod
1371
def _get_all_interface_names(cls):
1372
"""Get a sequence of all interfaces supported by an object"""
1373
return (name for name in set(getattr(getattr(x, attr),
1374
"_dbus_interface", None)
1375
for x in (inspect.getmro(cls))
1376
for attr in dir(x))
1377
if name is not None)
1378
1379
@dbus.service.method(dbus.PROPERTIES_IFACE,
1380
in_signature="ss",
897
1381
out_signature="v")
898
1382
def Get(self, interface_name, property_name):
899
1383
"""Standard D-Bus property Get() method, see D-Bus standard.
905
1389
if not hasattr(value, "variant_level"):
906
1390
return value
907
1391
return type(value)(value, variant_level=value.variant_level+1)
908
1392
909
1393
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
910
1394
def Set(self, interface_name, property_name, value):
911
1395
"""Standard D-Bus property Set() method, see D-Bus standard.
923
1407
value = dbus.ByteArray(b''.join(chr(byte)
924
1408
for byte in value))
925
1409
prop(value)
926
927
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1410
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1412
in_signature="s",
928
1413
out_signature="a{sv}")
929
1414
def GetAll(self, interface_name):
930
1415
"""Standard D-Bus property GetAll() method, see D-Bus
931
1416
standard.
932
1417
933
1418
Note: Will not include properties with access="write".
934
1419
"""
935
1420
properties = {}
945
1430
if not hasattr(value, "variant_level"):
946
1431
properties[name] = value
947
1432
continue
948
properties[name] = type(value)(value, variant_level=
949
value.variant_level+1)
1433
properties[name] = type(value)(
1434
value, variant_level=value.variant_level + 1)
950
1435
return dbus.Dictionary(properties, signature="sv")
951
1436
1437
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1438
def PropertiesChanged(self, interface_name, changed_properties,
1439
invalidated_properties):
1440
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1441
standard.
1442
"""
1443
pass
1444
952
1445
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
953
1446
out_signature="s",
954
1447
path_keyword='object_path',
955
1448
connection_keyword='connection')
956
1449
def Introspect(self, object_path, connection):
957
1450
"""Overloading of standard D-Bus method.
958
1451
959
1452
Inserts property tags and interface annotation tags.
960
1453
"""
961
xmlstring = dbus.service.Object.Introspect(self, object_path,
962
connection)
1454
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1455
object_path,
1456
connection)
963
1457
try:
964
1458
document = xml.dom.minidom.parseString(xmlstring)
1459
965
1460
def make_tag(document, name, prop):
966
1461
e = document.createElement("property")
967
1462
e.setAttribute("name", name)
968
1463
e.setAttribute("type", prop._dbus_signature)
969
1464
e.setAttribute("access", prop._dbus_access)
970
1465
return e
1466
971
1467
for if_tag in document.getElementsByTagName("interface"):
972
1468
# Add property tags
973
1469
for tag in (make_tag(document, name, prop)
976
1472
if prop._dbus_interface
977
1473
== if_tag.getAttribute("name")):
978
1474
if_tag.appendChild(tag)
979
# Add annotation tags
980
for typ in ("method", "signal", "property"):
981
for tag in if_tag.getElementsByTagName(typ):
982
annots = dict()
983
for name, prop in (self.
984
_get_all_dbus_things(typ)):
985
if (name == tag.getAttribute("name")
986
and prop._dbus_interface
987
== if_tag.getAttribute("name")):
988
annots.update(getattr
989
(prop,
990
"_dbus_annotations",
991
{}))
992
for name, value in annots.items():
993
ann_tag = document.createElement(
994
"annotation")
995
ann_tag.setAttribute("name", name)
996
ann_tag.setAttribute("value", value)
997
tag.appendChild(ann_tag)
998
# Add interface annotation tags
999
for annotation, value in dict(
1000
itertools.chain.from_iterable(
1001
annotations().items()
1002
for name, annotations in
1003
self._get_all_dbus_things("interface")
1004
if name == if_tag.getAttribute("name")
1005
)).items():
1006
ann_tag = document.createElement("annotation")
1007
ann_tag.setAttribute("name", annotation)
1008
ann_tag.setAttribute("value", value)
1009
if_tag.appendChild(ann_tag)
1475
# Add annotation tags for properties
1476
for tag in if_tag.getElementsByTagName("property"):
1477
annots = dict()
1478
for name, prop in self._get_all_dbus_things(
1479
"property"):
1480
if (name == tag.getAttribute("name")
1481
and prop._dbus_interface
1482
== if_tag.getAttribute("name")):
1483
annots.update(getattr(
1484
prop, "_dbus_annotations", {}))
1485
for name, value in annots.items():
1486
ann_tag = document.createElement(
1487
"annotation")
1488
ann_tag.setAttribute("name", name)
1489
ann_tag.setAttribute("value", value)
1490
tag.appendChild(ann_tag)
1010
1491
# Add the names to the return values for the
1011
1492
# "org.freedesktop.DBus.Properties" methods
1012
1493
if (if_tag.getAttribute("name")
1031
1512
return xmlstring
1032
1513
1033
1514
1515
try:
1516
dbus.OBJECT_MANAGER_IFACE
1517
except AttributeError:
1518
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1519
1520
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1522
"""A D-Bus object with an ObjectManager.
1523
1524
Classes inheriting from this exposes the standard
1525
GetManagedObjects call and the InterfacesAdded and
1526
InterfacesRemoved signals on the standard
1527
"org.freedesktop.DBus.ObjectManager" interface.
1528
1529
Note: No signals are sent automatically; they must be sent
1530
manually.
1531
"""
1532
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1533
out_signature="a{oa{sa{sv}}}")
1534
def GetManagedObjects(self):
1535
"""This function must be overridden"""
1536
raise NotImplementedError()
1537
1538
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1539
signature="oa{sa{sv}}")
1540
def InterfacesAdded(self, object_path, interfaces_and_properties):
1541
pass
1542
1543
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1544
def InterfacesRemoved(self, object_path, interfaces):
1545
pass
1546
1547
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1548
out_signature="s",
1549
path_keyword='object_path',
1550
connection_keyword='connection')
1551
def Introspect(self, object_path, connection):
1552
"""Overloading of standard D-Bus method.
1553
1554
Override return argument name of GetManagedObjects to be
1555
"objpath_interfaces_and_properties"
1556
"""
1557
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1558
object_path,
1559
connection)
1560
try:
1561
document = xml.dom.minidom.parseString(xmlstring)
1562
1563
for if_tag in document.getElementsByTagName("interface"):
1564
# Fix argument name for the GetManagedObjects method
1565
if (if_tag.getAttribute("name")
1566
== dbus.OBJECT_MANAGER_IFACE):
1567
for cn in if_tag.getElementsByTagName("method"):
1568
if (cn.getAttribute("name")
1569
== "GetManagedObjects"):
1570
for arg in cn.getElementsByTagName("arg"):
1571
if (arg.getAttribute("direction")
1572
== "out"):
1573
arg.setAttribute(
1574
"name",
1575
"objpath_interfaces"
1576
"_and_properties")
1577
xmlstring = document.toxml("utf-8")
1578
document.unlink()
1579
except (AttributeError, xml.dom.DOMException,
1580
xml.parsers.expat.ExpatError) as error:
1581
logger.error("Failed to override Introspection method",
1582
exc_info=error)
1583
return xmlstring
1584
1585
1034
1586
def datetime_to_dbus(dt, variant_level=0):
1035
1587
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1036
1588
if dt is None:
1037
return dbus.String("", variant_level = variant_level)
1038
return dbus.String(dt.isoformat(),
1039
variant_level=variant_level)
1589
return dbus.String("", variant_level=variant_level)
1590
return dbus.String(dt.isoformat(), variant_level=variant_level)
1040
1591
1041
1592
1042
1593
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1044
1595
dbus.service.Object, it will add alternate D-Bus attributes with
1045
1596
interface names according to the "alt_interface_names" mapping.
1046
1597
Usage:
1047
1598
1048
1599
@alternate_dbus_interfaces({"org.example.Interface":
1049
1600
"net.example.AlternateInterface"})
1050
1601
class SampleDBusObject(dbus.service.Object):
1051
1602
@dbus.service.method("org.example.Interface")
1052
1603
def SampleDBusMethod():
1053
1604
pass
1054
1605
1055
1606
The above "SampleDBusMethod" on "SampleDBusObject" will be
1056
1607
reachable via two interfaces: "org.example.Interface" and
1057
1608
"net.example.AlternateInterface", the latter of which will have
1058
1609
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1059
1610
"true", unless "deprecate" is passed with a False value.
1060
1611
1061
1612
This works for methods and signals, and also for D-Bus properties
1062
1613
(from DBusObjectWithProperties) and interfaces (from the
1063
1614
dbus_interface_annotations decorator).
1064
1615
"""
1616
1065
1617
def wrapper(cls):
1066
1618
for orig_interface_name, alt_interface_name in (
1067
alt_interface_names.items()):
1619
alt_interface_names.items()):
1068
1620
attr = {}
1069
1621
interface_names = set()
1070
1622
# Go though all attributes of the class
1072
1624
# Ignore non-D-Bus attributes, and D-Bus attributes
1073
1625
# with the wrong interface name
1074
1626
if (not hasattr(attribute, "_dbus_interface")
1075
or not attribute._dbus_interface
1076
.startswith(orig_interface_name)):
1627
or not attribute._dbus_interface.startswith(
1628
orig_interface_name)):
1077
1629
continue
1078
1630
# Create an alternate D-Bus interface name based on
1079
1631
# the current name
1080
alt_interface = (attribute._dbus_interface
1081
.replace(orig_interface_name,
1082
alt_interface_name))
1632
alt_interface = attribute._dbus_interface.replace(
1633
orig_interface_name, alt_interface_name)
1083
1634
interface_names.add(alt_interface)
1084
1635
# Is this a D-Bus signal?
1085
1636
if getattr(attribute, "_dbus_is_signal", False):
1086
1637
# Extract the original non-method undecorated
1087
1638
# function by black magic
1088
nonmethod_func = (dict(
1639
if sys.version_info.major == 2:
1640
nonmethod_func = (dict(
1089
1641
zip(attribute.func_code.co_freevars,
1090
attribute.__closure__))["func"]
1091
.cell_contents)
1642
attribute.__closure__))
1643
["func"].cell_contents)
1644
else:
1645
nonmethod_func = (dict(
1646
zip(attribute.__code__.co_freevars,
1647
attribute.__closure__))
1648
["func"].cell_contents)
1092
1649
# Create a new, but exactly alike, function
1093
1650
# object, and decorate it to be a new D-Bus signal
1094
1651
# with the alternate D-Bus interface name
1095
new_function = (dbus.service.signal
1096
(alt_interface,
1097
attribute._dbus_signature)
1098
(types.FunctionType(
1099
nonmethod_func.func_code,
1100
nonmethod_func.func_globals,
1101
nonmethod_func.func_name,
1102
nonmethod_func.func_defaults,
1103
nonmethod_func.func_closure)))
1652
new_function = copy_function(nonmethod_func)
1653
new_function = (dbus.service.signal(
1654
alt_interface,
1655
attribute._dbus_signature)(new_function))
1104
1656
# Copy annotations, if any
1105
1657
try:
1106
new_function._dbus_annotations = (
1107
dict(attribute._dbus_annotations))
1658
new_function._dbus_annotations = dict(
1659
attribute._dbus_annotations)
1108
1660
except AttributeError:
1109
1661
pass
1662
1110
1663
# Define a creator of a function to call both the
1111
1664
# original and alternate functions, so both the
1112
1665
# original and alternate signals gets sent when
1115
1668
"""This function is a scope container to pass
1116
1669
func1 and func2 to the "call_both" function
1117
1670
outside of its arguments"""
1671
1672
@functools.wraps(func2)
1118
1673
def call_both(*args, **kwargs):
1119
1674
"""This function will emit two D-Bus
1120
1675
signals by calling func1 and func2"""
1121
1676
func1(*args, **kwargs)
1122
1677
func2(*args, **kwargs)
1678
# Make wrapper function look like a D-Bus
1679
# signal
1680
for name, attr in inspect.getmembers(func2):
1681
if name.startswith("_dbus_"):
1682
setattr(call_both, name, attr)
1683
1123
1684
return call_both
1124
1685
# Create the "call_both" function and add it to
1125
1686
# the class
1130
1691
# object. Decorate it to be a new D-Bus method
1131
1692
# with the alternate D-Bus interface name. Add it
1132
1693
# to the class.
1133
attr[attrname] = (dbus.service.method
1134
(alt_interface,
1135
attribute._dbus_in_signature,
1136
attribute._dbus_out_signature)
1137
(types.FunctionType
1138
(attribute.func_code,
1139
attribute.func_globals,
1140
attribute.func_name,
1141
attribute.func_defaults,
1142
attribute.func_closure)))
1694
attr[attrname] = (
1695
dbus.service.method(
1696
alt_interface,
1697
attribute._dbus_in_signature,
1698
attribute._dbus_out_signature)
1699
(copy_function(attribute)))
1143
1700
# Copy annotations, if any
1144
1701
try:
1145
attr[attrname]._dbus_annotations = (
1146
dict(attribute._dbus_annotations))
1702
attr[attrname]._dbus_annotations = dict(
1703
attribute._dbus_annotations)
1147
1704
except AttributeError:
1148
1705
pass
1149
1706
# Is this a D-Bus property?
1152
1709
# object, and decorate it to be a new D-Bus
1153
1710
# property with the alternate D-Bus interface
1154
1711
# name. Add it to the class.
1155
attr[attrname] = (dbus_service_property
1156
(alt_interface,
1157
attribute._dbus_signature,
1158
attribute._dbus_access,
1159
attribute
1160
._dbus_get_args_options
1161
["byte_arrays"])
1162
(types.FunctionType
1163
(attribute.func_code,
1164
attribute.func_globals,
1165
attribute.func_name,
1166
attribute.func_defaults,
1167
attribute.func_closure)))
1712
attr[attrname] = (dbus_service_property(
1713
alt_interface, attribute._dbus_signature,
1714
attribute._dbus_access,
1715
attribute._dbus_get_args_options
1716
["byte_arrays"])
1717
(copy_function(attribute)))
1168
1718
# Copy annotations, if any
1169
1719
try:
1170
attr[attrname]._dbus_annotations = (
1171
dict(attribute._dbus_annotations))
1720
attr[attrname]._dbus_annotations = dict(
1721
attribute._dbus_annotations)
1172
1722
except AttributeError:
1173
1723
pass
1174
1724
# Is this a D-Bus interface?
1177
1727
# object. Decorate it to be a new D-Bus interface
1178
1728
# with the alternate D-Bus interface name. Add it
1179
1729
# to the class.
1180
attr[attrname] = (dbus_interface_annotations
1181
(alt_interface)
1182
(types.FunctionType
1183
(attribute.func_code,
1184
attribute.func_globals,
1185
attribute.func_name,
1186
attribute.func_defaults,
1187
attribute.func_closure)))
1730
attr[attrname] = (
1731
dbus_interface_annotations(alt_interface)
1732
(copy_function(attribute)))
1188
1733
if deprecate:
1189
1734
# Deprecate all alternate interfaces
1190
iname="_AlternateDBusNames_interface_annotation{}"
1735
iname = "_AlternateDBusNames_interface_annotation{}"
1191
1736
for interface_name in interface_names:
1737
1192
1738
@dbus_interface_annotations(interface_name)
1193
1739
def func(self):
1194
return { "org.freedesktop.DBus.Deprecated":
1195
"true" }
1740
return {"org.freedesktop.DBus.Deprecated":
1741
"true"}
1196
1742
# Find an unused name
1197
1743
for aname in (iname.format(i)
1198
1744
for i in itertools.count()):
1202
1748
if interface_names:
1203
1749
# Replace the class with a new subclass of it with
1204
1750
# methods, signals, etc. as created above.
1205
cls = type(b"{}Alternate".format(cls.__name__),
1206
(cls,), attr)
1751
if sys.version_info.major == 2:
1752
cls = type(b"{}Alternate".format(cls.__name__),
1753
(cls, ), attr)
1754
else:
1755
cls = type("{}Alternate".format(cls.__name__),
1756
(cls, ), attr)
1207
1757
return cls
1758
1208
1759
return wrapper
1209
1760
1210
1761
1211
1762
@alternate_dbus_interfaces({"se.recompile.Mandos":
1212
"se.bsnet.fukt.Mandos"})
1763
"se.bsnet.fukt.Mandos"})
1213
1764
class ClientDBus(Client, DBusObjectWithProperties):
1214
1765
"""A Client class using D-Bus
1215
1766
1216
1767
Attributes:
1217
1768
dbus_object_path: dbus.ObjectPath
1218
1769
bus: dbus.SystemBus()
1219
1770
"""
1220
1771
1221
1772
runtime_expansions = (Client.runtime_expansions
1222
+ ("dbus_object_path",))
1223
1773
+ ("dbus_object_path", ))
1774
1775
_interface = "se.recompile.Mandos.Client"
1776
1224
1777
# dbus.service.Object doesn't use super(), so we can't either.
1225
1226
def __init__(self, bus = None, *args, **kwargs):
1778
1779
def __init__(self, bus=None, *args, **kwargs):
1227
1780
self.bus = bus
1228
1781
Client.__init__(self, *args, **kwargs)
1229
1782
# Only now, when this client is initialized, can it show up on
1230
1783
# the D-Bus
1231
client_object_name = unicode(self.name).translate(
1784
client_object_name = str(self.name).translate(
1232
1785
{ord("."): ord("_"),
1233
1786
ord("-"): ord("_")})
1234
self.dbus_object_path = (dbus.ObjectPath
1235
("/clients/" + client_object_name))
1787
self.dbus_object_path = dbus.ObjectPath(
1788
"/clients/" + client_object_name)
1236
1789
DBusObjectWithProperties.__init__(self, self.bus,
1237
1790
self.dbus_object_path)
1238
1239
def notifychangeproperty(transform_func,
1240
dbus_name, type_func=lambda x: x,
1241
variant_level=1):
1791
1792
def notifychangeproperty(transform_func, dbus_name,
1793
type_func=lambda x: x,
1794
variant_level=1,
1795
invalidate_only=False,
1796
_interface=_interface):
1242
1797
""" Modify a variable so that it's a property which announces
1243
1798
its changes to DBus.
1244
1799
1245
1800
transform_fun: Function that takes a value and a variant_level
1246
1801
and transforms it to a D-Bus type.
1247
1802
dbus_name: D-Bus name of the variable
1250
1805
variant_level: D-Bus variant level. Default: 1
1251
1806
"""
1252
1807
attrname = "_{}".format(dbus_name)
1808
1253
1809
def setter(self, value):
1254
1810
if hasattr(self, "dbus_object_path"):
1255
1811
if (not hasattr(self, attrname) or
1256
1812
type_func(getattr(self, attrname, None))
1257
1813
!= type_func(value)):
1258
dbus_value = transform_func(type_func(value),
1259
variant_level
1260
=variant_level)
1261
self.PropertyChanged(dbus.String(dbus_name),
1262
dbus_value)
1814
if invalidate_only:
1815
self.PropertiesChanged(
1816
_interface, dbus.Dictionary(),
1817
dbus.Array((dbus_name, )))
1818
else:
1819
dbus_value = transform_func(
1820
type_func(value),
1821
variant_level=variant_level)
1822
self.PropertyChanged(dbus.String(dbus_name),
1823
dbus_value)
1824
self.PropertiesChanged(
1825
_interface,
1826
dbus.Dictionary({dbus.String(dbus_name):
1827
dbus_value}),
1828
dbus.Array())
1263
1829
setattr(self, attrname, value)
1264
1830
1265
1831
return property(lambda self: getattr(self, attrname), setter)
1266
1832
1267
1833
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1268
1834
approvals_pending = notifychangeproperty(dbus.Boolean,
1269
1835
"ApprovalPending",
1270
type_func = bool)
1836
type_func=bool)
1271
1837
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1272
1838
last_enabled = notifychangeproperty(datetime_to_dbus,
1273
1839
"LastEnabled")
1274
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1275
type_func = lambda checker:
1276
checker is not None)
1840
checker = notifychangeproperty(
1841
dbus.Boolean, "CheckerRunning",
1842
type_func=lambda checker: checker is not None)
1277
1843
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1278
1844
"LastCheckedOK")
1279
1845
last_checker_status = notifychangeproperty(dbus.Int16,
1282
1848
datetime_to_dbus, "LastApprovalRequest")
1283
1849
approved_by_default = notifychangeproperty(dbus.Boolean,
1284
1850
"ApprovedByDefault")
1285
approval_delay = notifychangeproperty(dbus.UInt64,
1286
"ApprovalDelay",
1287
type_func =
1288
lambda td: td.total_seconds()
1289
* 1000)
1851
approval_delay = notifychangeproperty(
1852
dbus.UInt64, "ApprovalDelay",
1853
type_func=lambda td: td.total_seconds() * 1000)
1290
1854
approval_duration = notifychangeproperty(
1291
1855
dbus.UInt64, "ApprovalDuration",
1292
type_func = lambda td: td.total_seconds() * 1000)
1856
type_func=lambda td: td.total_seconds() * 1000)
1293
1857
host = notifychangeproperty(dbus.String, "Host")
1294
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1295
type_func = lambda td:
1296
td.total_seconds() * 1000)
1858
timeout = notifychangeproperty(
1859
dbus.UInt64, "Timeout",
1860
type_func=lambda td: td.total_seconds() * 1000)
1297
1861
extended_timeout = notifychangeproperty(
1298
1862
dbus.UInt64, "ExtendedTimeout",
1299
type_func = lambda td: td.total_seconds() * 1000)
1300
interval = notifychangeproperty(dbus.UInt64,
1301
"Interval",
1302
type_func =
1303
lambda td: td.total_seconds()
1304
* 1000)
1863
type_func=lambda td: td.total_seconds() * 1000)
1864
interval = notifychangeproperty(
1865
dbus.UInt64, "Interval",
1866
type_func=lambda td: td.total_seconds() * 1000)
1305
1867
checker_command = notifychangeproperty(dbus.String, "Checker")
1306
1868
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1869
invalidate_only=True)
1870
1307
1871
del notifychangeproperty
1308
1872
1309
1873
def __del__(self, *args, **kwargs):
1310
1874
try:
1311
1875
self.remove_from_connection()
1314
1878
if hasattr(DBusObjectWithProperties, "__del__"):
1315
1879
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1316
1880
Client.__del__(self, *args, **kwargs)
1317
1318
def checker_callback(self, pid, condition, command,
1319
*args, **kwargs):
1320
self.checker_callback_tag = None
1321
self.checker = None
1322
if os.WIFEXITED(condition):
1323
exitstatus = os.WEXITSTATUS(condition)
1881
1882
def checker_callback(self, source, condition,
1883
connection, command, *args, **kwargs):
1884
ret = Client.checker_callback(self, source, condition,
1885
connection, command, *args,
1886
**kwargs)
1887
exitstatus = self.last_checker_status
1888
if exitstatus >= 0:
1324
1889
# Emit D-Bus signal
1325
1890
self.CheckerCompleted(dbus.Int16(exitstatus),
1326
dbus.Int64(condition),
1891
# This is specific to GNU libC
1892
dbus.Int64(exitstatus << 8),
1327
1893
dbus.String(command))
1328
1894
else:
1329
1895
# Emit D-Bus signal
1330
1896
self.CheckerCompleted(dbus.Int16(-1),
1331
dbus.Int64(condition),
1897
dbus.Int64(
1898
# This is specific to GNU libC
1899
(exitstatus << 8)
1900
| self.last_checker_signal),
1332
1901
dbus.String(command))
1333
1334
return Client.checker_callback(self, pid, condition, command,
1335
*args, **kwargs)
1336
1902
return ret
1903
1337
1904
def start_checker(self, *args, **kwargs):
1338
1905
old_checker_pid = getattr(self.checker, "pid", None)
1339
1906
r = Client.start_checker(self, *args, **kwargs)
1343
1910
# Emit D-Bus signal
1344
1911
self.CheckerStarted(self.current_checker_command)
1345
1912
return r
1346
1913
1347
1914
def _reset_approved(self):
1348
1915
self.approved = None
1349
1916
return False
1350
1917
1351
1918
def approve(self, value=True):
1352
1919
self.approved = value
1353
gobject.timeout_add(int(self.approval_duration.total_seconds()
1354
* 1000), self._reset_approved)
1920
GLib.timeout_add(int(self.approval_duration.total_seconds()
1921
* 1000), self._reset_approved)
1355
1922
self.send_changedstate()
1356
1357
## D-Bus methods, signals & properties
1358
_interface = "se.recompile.Mandos.Client"
1359
1360
## Interfaces
1361
1362
@dbus_interface_annotations(_interface)
1363
def _foo(self):
1364
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1365
"false"}
1366
1367
## Signals
1368
1923
1924
# D-Bus methods, signals & properties
1925
1926
# Interfaces
1927
1928
# Signals
1929
1369
1930
# CheckerCompleted - signal
1370
1931
@dbus.service.signal(_interface, signature="nxs")
1371
1932
def CheckerCompleted(self, exitcode, waitstatus, command):
1372
1933
"D-Bus signal"
1373
1934
pass
1374
1935
1375
1936
# CheckerStarted - signal
1376
1937
@dbus.service.signal(_interface, signature="s")
1377
1938
def CheckerStarted(self, command):
1378
1939
"D-Bus signal"
1379
1940
pass
1380
1941
1381
1942
# PropertyChanged - signal
1943
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1382
1944
@dbus.service.signal(_interface, signature="sv")
1383
1945
def PropertyChanged(self, property, value):
1384
1946
"D-Bus signal"
1385
1947
pass
1386
1948
1387
1949
# GotSecret - signal
1388
1950
@dbus.service.signal(_interface)
1389
1951
def GotSecret(self):
1392
1954
server to mandos-client
1393
1955
"""
1394
1956
pass
1395
1957
1396
1958
# Rejected - signal
1397
1959
@dbus.service.signal(_interface, signature="s")
1398
1960
def Rejected(self, reason):
1399
1961
"D-Bus signal"
1400
1962
pass
1401
1963
1402
1964
# NeedApproval - signal
1403
1965
@dbus.service.signal(_interface, signature="tb")
1404
1966
def NeedApproval(self, timeout, default):
1405
1967
"D-Bus signal"
1406
1968
return self.need_approval()
1407
1408
## Methods
1409
1969
1970
# Methods
1971
1410
1972
# Approve - method
1411
1973
@dbus.service.method(_interface, in_signature="b")
1412
1974
def Approve(self, value):
1413
1975
self.approve(value)
1414
1976
1415
1977
# CheckedOK - method
1416
1978
@dbus.service.method(_interface)
1417
1979
def CheckedOK(self):
1418
1980
self.checked_ok()
1419
1981
1420
1982
# Enable - method
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1421
1984
@dbus.service.method(_interface)
1422
1985
def Enable(self):
1423
1986
"D-Bus method"
1424
1987
self.enable()
1425
1988
1426
1989
# StartChecker - method
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1427
1991
@dbus.service.method(_interface)
1428
1992
def StartChecker(self):
1429
1993
"D-Bus method"
1430
1994
self.start_checker()
1431
1995
1432
1996
# Disable - method
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1433
1998
@dbus.service.method(_interface)
1434
1999
def Disable(self):
1435
2000
"D-Bus method"
1436
2001
self.disable()
1437
2002
1438
2003
# StopChecker - method
2004
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1439
2005
@dbus.service.method(_interface)
1440
2006
def StopChecker(self):
1441
2007
self.stop_checker()
1442
1443
## Properties
1444
2008
2009
# Properties
2010
1445
2011
# ApprovalPending - property
1446
2012
@dbus_service_property(_interface, signature="b", access="read")
1447
2013
def ApprovalPending_dbus_property(self):
1448
2014
return dbus.Boolean(bool(self.approvals_pending))
1449
2015
1450
2016
# ApprovedByDefault - property
1451
@dbus_service_property(_interface, signature="b",
2017
@dbus_service_property(_interface,
2018
signature="b",
1452
2019
access="readwrite")
1453
2020
def ApprovedByDefault_dbus_property(self, value=None):
1454
2021
if value is None: # get
1455
2022
return dbus.Boolean(self.approved_by_default)
1456
2023
self.approved_by_default = bool(value)
1457
2024
1458
2025
# ApprovalDelay - property
1459
@dbus_service_property(_interface, signature="t",
2026
@dbus_service_property(_interface,
2027
signature="t",
1460
2028
access="readwrite")
1461
2029
def ApprovalDelay_dbus_property(self, value=None):
1462
2030
if value is None: # get
1463
2031
return dbus.UInt64(self.approval_delay.total_seconds()
1464
2032
* 1000)
1465
2033
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1466
2034
1467
2035
# ApprovalDuration - property
1468
@dbus_service_property(_interface, signature="t",
2036
@dbus_service_property(_interface,
2037
signature="t",
1469
2038
access="readwrite")
1470
2039
def ApprovalDuration_dbus_property(self, value=None):
1471
2040
if value is None: # get
1472
2041
return dbus.UInt64(self.approval_duration.total_seconds()
1473
2042
* 1000)
1474
2043
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1475
2044
1476
2045
# Name - property
2046
@dbus_annotations(
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1477
2048
@dbus_service_property(_interface, signature="s", access="read")
1478
2049
def Name_dbus_property(self):
1479
2050
return dbus.String(self.name)
1480
2051
2052
# KeyID - property
2053
@dbus_annotations(
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2055
@dbus_service_property(_interface, signature="s", access="read")
2056
def KeyID_dbus_property(self):
2057
return dbus.String(self.key_id)
2058
1481
2059
# Fingerprint - property
2060
@dbus_annotations(
2061
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1482
2062
@dbus_service_property(_interface, signature="s", access="read")
1483
2063
def Fingerprint_dbus_property(self):
1484
2064
return dbus.String(self.fingerprint)
1485
2065
1486
2066
# Host - property
1487
@dbus_service_property(_interface, signature="s",
2067
@dbus_service_property(_interface,
2068
signature="s",
1488
2069
access="readwrite")
1489
2070
def Host_dbus_property(self, value=None):
1490
2071
if value is None: # get
1491
2072
return dbus.String(self.host)
1492
self.host = unicode(value)
1493
2073
self.host = str(value)
2074
1494
2075
# Created - property
2076
@dbus_annotations(
2077
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1495
2078
@dbus_service_property(_interface, signature="s", access="read")
1496
2079
def Created_dbus_property(self):
1497
2080
return datetime_to_dbus(self.created)
1498
2081
1499
2082
# LastEnabled - property
1500
2083
@dbus_service_property(_interface, signature="s", access="read")
1501
2084
def LastEnabled_dbus_property(self):
1502
2085
return datetime_to_dbus(self.last_enabled)
1503
2086
1504
2087
# Enabled - property
1505
@dbus_service_property(_interface, signature="b",
2088
@dbus_service_property(_interface,
2089
signature="b",
1506
2090
access="readwrite")
1507
2091
def Enabled_dbus_property(self, value=None):
1508
2092
if value is None: # get
1511
2095
self.enable()
1512
2096
else:
1513
2097
self.disable()
1514
2098
1515
2099
# LastCheckedOK - property
1516
@dbus_service_property(_interface, signature="s",
2100
@dbus_service_property(_interface,
2101
signature="s",
1517
2102
access="readwrite")
1518
2103
def LastCheckedOK_dbus_property(self, value=None):
1519
2104
if value is not None:
1520
2105
self.checked_ok()
1521
2106
return
1522
2107
return datetime_to_dbus(self.last_checked_ok)
1523
2108
1524
2109
# LastCheckerStatus - property
1525
@dbus_service_property(_interface, signature="n",
1526
access="read")
2110
@dbus_service_property(_interface, signature="n", access="read")
1527
2111
def LastCheckerStatus_dbus_property(self):
1528
2112
return dbus.Int16(self.last_checker_status)
1529
2113
1530
2114
# Expires - property
1531
2115
@dbus_service_property(_interface, signature="s", access="read")
1532
2116
def Expires_dbus_property(self):
1533
2117
return datetime_to_dbus(self.expires)
1534
2118
1535
2119
# LastApprovalRequest - property
1536
2120
@dbus_service_property(_interface, signature="s", access="read")
1537
2121
def LastApprovalRequest_dbus_property(self):
1538
2122
return datetime_to_dbus(self.last_approval_request)
1539
2123
1540
2124
# Timeout - property
1541
@dbus_service_property(_interface, signature="t",
2125
@dbus_service_property(_interface,
2126
signature="t",
1542
2127
access="readwrite")
1543
2128
def Timeout_dbus_property(self, value=None):
1544
2129
if value is None: # get
1556
2141
if (getattr(self, "disable_initiator_tag", None)
1557
2142
is None):
1558
2143
return
1559
gobject.source_remove(self.disable_initiator_tag)
1560
self.disable_initiator_tag = (
1561
gobject.timeout_add(
1562
int((self.expires - now).total_seconds()
1563
* 1000), self.disable))
1564
2144
GLib.source_remove(self.disable_initiator_tag)
2145
self.disable_initiator_tag = GLib.timeout_add(
2146
int((self.expires - now).total_seconds() * 1000),
2147
self.disable)
2148
1565
2149
# ExtendedTimeout - property
1566
@dbus_service_property(_interface, signature="t",
2150
@dbus_service_property(_interface,
2151
signature="t",
1567
2152
access="readwrite")
1568
2153
def ExtendedTimeout_dbus_property(self, value=None):
1569
2154
if value is None: # get
1570
2155
return dbus.UInt64(self.extended_timeout.total_seconds()
1571
2156
* 1000)
1572
2157
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1573
2158
1574
2159
# Interval - property
1575
@dbus_service_property(_interface, signature="t",
2160
@dbus_service_property(_interface,
2161
signature="t",
1576
2162
access="readwrite")
1577
2163
def Interval_dbus_property(self, value=None):
1578
2164
if value is None: # get
1582
2168
return
1583
2169
if self.enabled:
1584
2170
# Reschedule checker run
1585
gobject.source_remove(self.checker_initiator_tag)
1586
self.checker_initiator_tag = (gobject.timeout_add
1587
(value, self.start_checker))
1588
self.start_checker() # Start one now, too
1589
2171
GLib.source_remove(self.checker_initiator_tag)
2172
self.checker_initiator_tag = GLib.timeout_add(
2173
value, self.start_checker)
2174
self.start_checker() # Start one now, too
2175
1590
2176
# Checker - property
1591
@dbus_service_property(_interface, signature="s",
2177
@dbus_service_property(_interface,
2178
signature="s",
1592
2179
access="readwrite")
1593
2180
def Checker_dbus_property(self, value=None):
1594
2181
if value is None: # get
1595
2182
return dbus.String(self.checker_command)
1596
self.checker_command = unicode(value)
1597
2183
self.checker_command = str(value)
2184
1598
2185
# CheckerRunning - property
1599
@dbus_service_property(_interface, signature="b",
2186
@dbus_service_property(_interface,
2187
signature="b",
1600
2188
access="readwrite")
1601
2189
def CheckerRunning_dbus_property(self, value=None):
1602
2190
if value is None: # get
1605
2193
self.start_checker()
1606
2194
else:
1607
2195
self.stop_checker()
1608
2196
1609
2197
# ObjectPath - property
2198
@dbus_annotations(
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2200
"org.freedesktop.DBus.Deprecated": "true"})
1610
2201
@dbus_service_property(_interface, signature="o", access="read")
1611
2202
def ObjectPath_dbus_property(self):
1612
return self.dbus_object_path # is already a dbus.ObjectPath
1613
2203
return self.dbus_object_path # is already a dbus.ObjectPath
2204
1614
2205
# Secret = property
1615
@dbus_service_property(_interface, signature="ay",
1616
access="write", byte_arrays=True)
2206
@dbus_annotations(
2207
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2208
"invalidates"})
2209
@dbus_service_property(_interface,
2210
signature="ay",
2211
access="write",
2212
byte_arrays=True)
1617
2213
def Secret_dbus_property(self, value):
1618
self.secret = str(value)
1619
2214
self.secret = bytes(value)
2215
1620
2216
del _interface
1621
2217
1622
2218
1623
class ProxyClient(object):
1624
def __init__(self, child_pipe, fpr, address):
2219
class ProxyClient:
2220
def __init__(self, child_pipe, key_id, fpr, address):
1625
2221
self._pipe = child_pipe
1626
self._pipe.send(('init', fpr, address))
2222
self._pipe.send(('init', key_id, fpr, address))
1627
2223
if not self._pipe.recv():
1628
raise KeyError()
1629
2224
raise KeyError(key_id or fpr)
2225
1630
2226
def __getattribute__(self, name):
1631
2227
if name == '_pipe':
1632
2228
return super(ProxyClient, self).__getattribute__(name)
1635
2231
if data[0] == 'data':
1636
2232
return data[1]
1637
2233
if data[0] == 'function':
2234
1638
2235
def func(*args, **kwargs):
1639
2236
self._pipe.send(('funcall', name, args, kwargs))
1640
2237
return self._pipe.recv()[1]
2238
1641
2239
return func
1642
2240
1643
2241
def __setattr__(self, name, value):
1644
2242
if name == '_pipe':
1645
2243
return super(ProxyClient, self).__setattr__(name, value)
1648
2246
1649
2247
class ClientHandler(socketserver.BaseRequestHandler, object):
1650
2248
"""A class to handle client connections.
1651
2249
1652
2250
Instantiated once for each connection to handle it.
1653
2251
Note: This will run in its own forked process."""
1654
2252
1655
2253
def handle(self):
1656
2254
with contextlib.closing(self.server.child_pipe) as child_pipe:
1657
2255
logger.info("TCP connection from: %s",
1658
unicode(self.client_address))
2256
str(self.client_address))
1659
2257
logger.debug("Pipe FD: %d",
1660
2258
self.server.child_pipe.fileno())
1661
1662
session = (gnutls.connection
1663
.ClientSession(self.request,
1664
gnutls.connection
1665
.X509Credentials()))
1666
1667
# Note: gnutls.connection.X509Credentials is really a
1668
# generic GnuTLS certificate credentials object so long as
1669
# no X.509 keys are added to it. Therefore, we can use it
1670
# here despite using OpenPGP certificates.
1671
1672
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1673
# "+AES-256-CBC", "+SHA1",
1674
# "+COMP-NULL", "+CTYPE-OPENPGP",
1675
# "+DHE-DSS"))
2259
2260
session = gnutls.ClientSession(self.request)
2261
2262
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2263
# "+AES-256-CBC", "+SHA1",
2264
# "+COMP-NULL", "+CTYPE-OPENPGP",
2265
# "+DHE-DSS"))
1676
2266
# Use a fallback default, since this MUST be set.
1677
2267
priority = self.server.gnutls_priority
1678
2268
if priority is None:
1679
2269
priority = "NORMAL"
1680
(gnutls.library.functions
1681
.gnutls_priority_set_direct(session._c_object,
1682
priority, None))
1683
2270
gnutls.priority_set_direct(session._c_object,
2271
priority.encode("utf-8"),
2272
None)
2273
1684
2274
# Start communication using the Mandos protocol
1685
2275
# Get protocol number
1686
2276
line = self.request.makefile().readline()
1691
2281
except (ValueError, IndexError, RuntimeError) as error:
1692
2282
logger.error("Unknown protocol version: %s", error)
1693
2283
return
1694
2284
1695
2285
# Start GnuTLS connection
1696
2286
try:
1697
2287
session.handshake()
1698
except gnutls.errors.GNUTLSError as error:
2288
except gnutls.Error as error:
1699
2289
logger.warning("Handshake failed: %s", error)
1700
2290
# Do not run session.bye() here: the session is not
1701
2291
# established. Just abandon the request.
1702
2292
return
1703
2293
logger.debug("Handshake succeeded")
1704
2294
1705
2295
approval_required = False
1706
2296
try:
1707
try:
1708
fpr = self.fingerprint(self.peer_certificate
1709
(session))
1710
except (TypeError,
1711
gnutls.errors.GNUTLSError) as error:
1712
logger.warning("Bad certificate: %s", error)
1713
return
1714
logger.debug("Fingerprint: %s", fpr)
1715
1716
try:
1717
client = ProxyClient(child_pipe, fpr,
2297
if gnutls.has_rawpk:
2298
fpr = b""
2299
try:
2300
key_id = self.key_id(
2301
self.peer_certificate(session))
2302
except (TypeError, gnutls.Error) as error:
2303
logger.warning("Bad certificate: %s", error)
2304
return
2305
logger.debug("Key ID: %s", key_id)
2306
2307
else:
2308
key_id = b""
2309
try:
2310
fpr = self.fingerprint(
2311
self.peer_certificate(session))
2312
except (TypeError, gnutls.Error) as error:
2313
logger.warning("Bad certificate: %s", error)
2314
return
2315
logger.debug("Fingerprint: %s", fpr)
2316
2317
try:
2318
client = ProxyClient(child_pipe, key_id, fpr,
1718
2319
self.client_address)
1719
2320
except KeyError:
1720
2321
return
1721
2322
1722
2323
if client.approval_delay:
1723
2324
delay = client.approval_delay
1724
2325
client.approvals_pending += 1
1725
2326
approval_required = True
1726
2327
1727
2328
while True:
1728
2329
if not client.enabled:
1729
2330
logger.info("Client %s is disabled",
1730
client.name)
2331
client.name)
1731
2332
if self.server.use_dbus:
1732
2333
# Emit D-Bus signal
1733
2334
client.Rejected("Disabled")
1734
2335
return
1735
2336
1736
2337
if client.approved or not client.approval_delay:
1737
#We are approved or approval is disabled
2338
# We are approved or approval is disabled
1738
2339
break
1739
2340
elif client.approved is None:
1740
2341
logger.info("Client %s needs approval",
1751
2352
# Emit D-Bus signal
1752
2353
client.Rejected("Denied")
1753
2354
return
1754
1755
#wait until timeout or approved
2355
2356
# wait until timeout or approved
1756
2357
time = datetime.datetime.now()
1757
2358
client.changedstate.acquire()
1758
2359
client.changedstate.wait(delay.total_seconds())
1771
2372
break
1772
2373
else:
1773
2374
delay -= time2 - time
1774
1775
sent_size = 0
1776
while sent_size < len(client.secret):
1777
try:
1778
sent = session.send(client.secret[sent_size:])
1779
except gnutls.errors.GNUTLSError as error:
1780
logger.warning("gnutls send failed",
1781
exc_info=error)
1782
return
1783
logger.debug("Sent: %d, remaining: %d",
1784
sent, len(client.secret)
1785
- (sent_size + sent))
1786
sent_size += sent
1787
2375
2376
try:
2377
session.send(client.secret)
2378
except gnutls.Error as error:
2379
logger.warning("gnutls send failed",
2380
exc_info=error)
2381
return
2382
1788
2383
logger.info("Sending secret to %s", client.name)
1789
2384
# bump the timeout using extended_timeout
1790
2385
client.bump_timeout(client.extended_timeout)
1791
2386
if self.server.use_dbus:
1792
2387
# Emit D-Bus signal
1793
2388
client.GotSecret()
1794
2389
1795
2390
finally:
1796
2391
if approval_required:
1797
2392
client.approvals_pending -= 1
1798
2393
try:
1799
2394
session.bye()
1800
except gnutls.errors.GNUTLSError as error:
2395
except gnutls.Error as error:
1801
2396
logger.warning("GnuTLS bye failed",
1802
2397
exc_info=error)
1803
2398
1804
2399
@staticmethod
1805
2400
def peer_certificate(session):
1806
"Return the peer's OpenPGP certificate as a bytestring"
1807
# If not an OpenPGP certificate...
1808
if (gnutls.library.functions
1809
.gnutls_certificate_type_get(session._c_object)
1810
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1811
# ...do the normal thing
1812
return session.peer_certificate
2401
"Return the peer's certificate as a bytestring"
2402
try:
2403
cert_type = gnutls.certificate_type_get2(session._c_object,
2404
gnutls.CTYPE_PEERS)
2405
except AttributeError:
2406
cert_type = gnutls.certificate_type_get(session._c_object)
2407
if gnutls.has_rawpk:
2408
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2409
else:
2410
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2411
# If not a valid certificate type...
2412
if cert_type not in valid_cert_types:
2413
logger.info("Cert type %r not in %r", cert_type,
2414
valid_cert_types)
2415
# ...return invalid data
2416
return b""
1813
2417
list_size = ctypes.c_uint(1)
1814
cert_list = (gnutls.library.functions
1815
.gnutls_certificate_get_peers
2418
cert_list = (gnutls.certificate_get_peers
1816
2419
(session._c_object, ctypes.byref(list_size)))
1817
2420
if not bool(cert_list) and list_size.value != 0:
1818
raise gnutls.errors.GNUTLSError("error getting peer"
1819
" certificate")
2421
raise gnutls.Error("error getting peer certificate")
1820
2422
if list_size.value == 0:
1821
2423
return None
1822
2424
cert = cert_list[0]
1823
2425
return ctypes.string_at(cert.data, cert.size)
1824
2426
2427
@staticmethod
2428
def key_id(certificate):
2429
"Convert a certificate bytestring to a hexdigit key ID"
2430
# New GnuTLS "datum" with the public key
2431
datum = gnutls.datum_t(
2432
ctypes.cast(ctypes.c_char_p(certificate),
2433
ctypes.POINTER(ctypes.c_ubyte)),
2434
ctypes.c_uint(len(certificate)))
2435
# XXX all these need to be created in the gnutls "module"
2436
# New empty GnuTLS certificate
2437
pubkey = gnutls.pubkey_t()
2438
gnutls.pubkey_init(ctypes.byref(pubkey))
2439
# Import the raw public key into the certificate
2440
gnutls.pubkey_import(pubkey,
2441
ctypes.byref(datum),
2442
gnutls.X509_FMT_DER)
2443
# New buffer for the key ID
2444
buf = ctypes.create_string_buffer(32)
2445
buf_len = ctypes.c_size_t(len(buf))
2446
# Get the key ID from the raw public key into the buffer
2447
gnutls.pubkey_get_key_id(pubkey,
2448
gnutls.KEYID_USE_SHA256,
2449
ctypes.cast(ctypes.byref(buf),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.byref(buf_len))
2452
# Deinit the certificate
2453
gnutls.pubkey_deinit(pubkey)
2454
2455
# Convert the buffer to a Python bytestring
2456
key_id = ctypes.string_at(buf, buf_len.value)
2457
# Convert the bytestring to hexadecimal notation
2458
hex_key_id = binascii.hexlify(key_id).upper()
2459
return hex_key_id
2460
1825
2461
@staticmethod
1826
2462
def fingerprint(openpgp):
1827
2463
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1828
2464
# New GnuTLS "datum" with the OpenPGP public key
1829
datum = (gnutls.library.types
1830
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1831
ctypes.POINTER
1832
(ctypes.c_ubyte)),
1833
ctypes.c_uint(len(openpgp))))
2465
datum = gnutls.datum_t(
2466
ctypes.cast(ctypes.c_char_p(openpgp),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.c_uint(len(openpgp)))
1834
2469
# New empty GnuTLS certificate
1835
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1836
(gnutls.library.functions
1837
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2470
crt = gnutls.openpgp_crt_t()
2471
gnutls.openpgp_crt_init(ctypes.byref(crt))
1838
2472
# Import the OpenPGP public key into the certificate
1839
(gnutls.library.functions
1840
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1841
gnutls.library.constants
1842
.GNUTLS_OPENPGP_FMT_RAW))
2473
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2474
gnutls.OPENPGP_FMT_RAW)
1843
2475
# Verify the self signature in the key
1844
2476
crtverify = ctypes.c_uint()
1845
(gnutls.library.functions
1846
.gnutls_openpgp_crt_verify_self(crt, 0,
1847
ctypes.byref(crtverify)))
2477
gnutls.openpgp_crt_verify_self(crt, 0,
2478
ctypes.byref(crtverify))
1848
2479
if crtverify.value != 0:
1849
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1850
raise (gnutls.errors.CertificateSecurityError
1851
("Verify failed"))
2480
gnutls.openpgp_crt_deinit(crt)
2481
raise gnutls.CertificateSecurityError(code
2482
=crtverify.value)
1852
2483
# New buffer for the fingerprint
1853
2484
buf = ctypes.create_string_buffer(20)
1854
2485
buf_len = ctypes.c_size_t()
1855
2486
# Get the fingerprint from the certificate into the buffer
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1858
ctypes.byref(buf_len)))
2487
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2488
ctypes.byref(buf_len))
1859
2489
# Deinit the certificate
1860
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2490
gnutls.openpgp_crt_deinit(crt)
1861
2491
# Convert the buffer to a Python bytestring
1862
2492
fpr = ctypes.string_at(buf, buf_len.value)
1863
2493
# Convert the bytestring to hexadecimal notation
1865
2495
return hex_fpr
1866
2496
1867
2497
1868
class MultiprocessingMixIn(object):
2498
class MultiprocessingMixIn:
1869
2499
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2500
1870
2501
def sub_process_main(self, request, address):
1871
2502
try:
1872
2503
self.finish_request(request, address)
1873
2504
except Exception:
1874
2505
self.handle_error(request, address)
1875
2506
self.close_request(request)
1876
2507
1877
2508
def process_request(self, request, address):
1878
2509
"""Start a new process to process the request."""
1879
proc = multiprocessing.Process(target = self.sub_process_main,
1880
args = (request, address))
2510
proc = multiprocessing.Process(target=self.sub_process_main,
2511
args=(request, address))
1881
2512
proc.start()
1882
2513
return proc
1883
2514
1884
2515
1885
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1886
2517
""" adds a pipe to the MixIn """
2518
1887
2519
def process_request(self, request, client_address):
1888
2520
"""Overrides and wraps the original process_request().
1889
2521
1890
2522
This function creates a new pipe in self.pipe
1891
2523
"""
1892
2524
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1893
2525
1894
2526
proc = MultiprocessingMixIn.process_request(self, request,
1895
2527
client_address)
1896
2528
self.child_pipe.close()
1897
2529
self.add_pipe(parent_pipe, proc)
1898
2530
1899
2531
def add_pipe(self, parent_pipe, proc):
1900
2532
"""Dummy function; override as necessary"""
1901
2533
raise NotImplementedError()
1902
2534
1903
2535
1904
2536
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1905
socketserver.TCPServer, object):
2537
socketserver.TCPServer):
1906
2538
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1907
2539
1908
2540
Attributes:
1909
2541
enabled: Boolean; whether this server is activated yet
1910
2542
interface: None or a network interface name (string)
1911
2543
use_ipv6: Boolean; to use IPv6 or not
1912
2544
"""
2545
1913
2546
def __init__(self, server_address, RequestHandlerClass,
1914
interface=None, use_ipv6=True, socketfd=None):
2547
interface=None,
2548
use_ipv6=True,
2549
socketfd=None):
1915
2550
"""If socketfd is set, use that file descriptor instead of
1916
2551
creating a new one with socket.socket().
1917
2552
"""
1923
2558
self.socketfd = socketfd
1924
2559
# Save the original socket.socket() function
1925
2560
self.socket_socket = socket.socket
2561
1926
2562
# To implement --socket, we monkey patch socket.socket.
1927
#
2563
#
1928
2564
# (When socketserver.TCPServer is a new-style class, we
1929
2565
# could make self.socket into a property instead of monkey
1930
2566
# patching socket.socket.)
1931
#
2567
#
1932
2568
# Create a one-time-only replacement for socket.socket()
1933
2569
@functools.wraps(socket.socket)
1934
2570
def socket_wrapper(*args, **kwargs):
1946
2582
# socket_wrapper(), if socketfd was set.
1947
2583
socketserver.TCPServer.__init__(self, server_address,
1948
2584
RequestHandlerClass)
1949
2585
1950
2586
def server_bind(self):
1951
2587
"""This overrides the normal server_bind() function
1952
2588
to bind to an interface if one was specified, and also NOT to
1953
2589
bind to an address or port if they were not specified."""
2590
global SO_BINDTODEVICE
1954
2591
if self.interface is not None:
1955
2592
if SO_BINDTODEVICE is None:
1956
logger.error("SO_BINDTODEVICE does not exist;"
1957
" cannot bind to interface %s",
1958
self.interface)
1959
else:
1960
try:
1961
self.socket.setsockopt(socket.SOL_SOCKET,
1962
SO_BINDTODEVICE,
1963
str(self.interface + '\0'))
1964
except socket.error as error:
1965
if error.errno == errno.EPERM:
1966
logger.error("No permission to bind to"
1967
" interface %s", self.interface)
1968
elif error.errno == errno.ENOPROTOOPT:
1969
logger.error("SO_BINDTODEVICE not available;"
1970
" cannot bind to interface %s",
1971
self.interface)
1972
elif error.errno == errno.ENODEV:
1973
logger.error("Interface %s does not exist,"
1974
" cannot bind", self.interface)
1975
else:
1976
raise
2593
# Fall back to a hard-coded value which seems to be
2594
# common enough.
2595
logger.warning("SO_BINDTODEVICE not found, trying 25")
2596
SO_BINDTODEVICE = 25
2597
try:
2598
self.socket.setsockopt(
2599
socket.SOL_SOCKET, SO_BINDTODEVICE,
2600
(self.interface + "\0").encode("utf-8"))
2601
except socket.error as error:
2602
if error.errno == errno.EPERM:
2603
logger.error("No permission to bind to"
2604
" interface %s", self.interface)
2605
elif error.errno == errno.ENOPROTOOPT:
2606
logger.error("SO_BINDTODEVICE not available;"
2607
" cannot bind to interface %s",
2608
self.interface)
2609
elif error.errno == errno.ENODEV:
2610
logger.error("Interface %s does not exist,"
2611
" cannot bind", self.interface)
2612
else:
2613
raise
1977
2614
# Only bind(2) the socket if we really need to.
1978
2615
if self.server_address[0] or self.server_address[1]:
2616
if self.server_address[1]:
2617
self.allow_reuse_address = True
1979
2618
if not self.server_address[0]:
1980
2619
if self.address_family == socket.AF_INET6:
1981
any_address = "::" # in6addr_any
2620
any_address = "::" # in6addr_any
1982
2621
else:
1983
any_address = "0.0.0.0" # INADDR_ANY
2622
any_address = "0.0.0.0" # INADDR_ANY
1984
2623
self.server_address = (any_address,
1985
2624
self.server_address[1])
1986
2625
elif not self.server_address[1]:
1987
self.server_address = (self.server_address[0],
1988
0)
2626
self.server_address = (self.server_address[0], 0)
1989
2627
# if self.interface:
1990
2628
# self.server_address = (self.server_address[0],
1991
2629
# 0, # port
1997
2635
1998
2636
class MandosServer(IPv6_TCPServer):
1999
2637
"""Mandos server.
2000
2638
2001
2639
Attributes:
2002
2640
clients: set of Client objects
2003
2641
gnutls_priority GnuTLS priority string
2004
2642
use_dbus: Boolean; to emit D-Bus signals or not
2005
2006
Assumes a gobject.MainLoop event loop.
2643
2644
Assumes a GLib.MainLoop event loop.
2007
2645
"""
2646
2008
2647
def __init__(self, server_address, RequestHandlerClass,
2009
interface=None, use_ipv6=True, clients=None,
2010
gnutls_priority=None, use_dbus=True, socketfd=None):
2648
interface=None,
2649
use_ipv6=True,
2650
clients=None,
2651
gnutls_priority=None,
2652
use_dbus=True,
2653
socketfd=None):
2011
2654
self.enabled = False
2012
2655
self.clients = clients
2013
2656
if self.clients is None:
2016
2659
self.gnutls_priority = gnutls_priority
2017
2660
IPv6_TCPServer.__init__(self, server_address,
2018
2661
RequestHandlerClass,
2019
interface = interface,
2020
use_ipv6 = use_ipv6,
2021
socketfd = socketfd)
2662
interface=interface,
2663
use_ipv6=use_ipv6,
2664
socketfd=socketfd)
2665
2022
2666
def server_activate(self):
2023
2667
if self.enabled:
2024
2668
return socketserver.TCPServer.server_activate(self)
2025
2669
2026
2670
def enable(self):
2027
2671
self.enabled = True
2028
2672
2029
2673
def add_pipe(self, parent_pipe, proc):
2030
2674
# Call "handle_ipc" for both data and EOF events
2031
gobject.io_add_watch(parent_pipe.fileno(),
2032
gobject.IO_IN | gobject.IO_HUP,
2033
functools.partial(self.handle_ipc,
2034
parent_pipe =
2035
parent_pipe,
2036
proc = proc))
2037
2038
def handle_ipc(self, source, condition, parent_pipe=None,
2039
proc = None, client_object=None):
2675
GLib.io_add_watch(
2676
parent_pipe.fileno(),
2677
GLib.IO_IN | GLib.IO_HUP,
2678
functools.partial(self.handle_ipc,
2679
parent_pipe=parent_pipe,
2680
proc=proc))
2681
2682
def handle_ipc(self, source, condition,
2683
parent_pipe=None,
2684
proc=None,
2685
client_object=None):
2040
2686
# error, or the other end of multiprocessing.Pipe has closed
2041
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2687
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2042
2688
# Wait for other process to exit
2043
2689
proc.join()
2044
2690
return False
2045
2691
2046
2692
# Read a request from the child
2047
2693
request = parent_pipe.recv()
2048
2694
command = request[0]
2049
2695
2050
2696
if command == 'init':
2051
fpr = request[1]
2052
address = request[2]
2053
2054
for c in self.clients.itervalues():
2055
if c.fingerprint == fpr:
2697
key_id = request[1].decode("ascii")
2698
fpr = request[2].decode("ascii")
2699
address = request[3]
2700
2701
for c in self.clients.values():
2702
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2703
continue
2704
if key_id and c.key_id == key_id:
2705
client = c
2706
break
2707
if fpr and c.fingerprint == fpr:
2056
2708
client = c
2057
2709
break
2058
2710
else:
2059
logger.info("Client not found for fingerprint: %s, ad"
2060
"dress: %s", fpr, address)
2711
logger.info("Client not found for key ID: %s, address"
2712
": %s", key_id or fpr, address)
2061
2713
if self.use_dbus:
2062
2714
# Emit D-Bus signal
2063
mandos_dbus_service.ClientNotFound(fpr,
2715
mandos_dbus_service.ClientNotFound(key_id or fpr,
2064
2716
address[0])
2065
2717
parent_pipe.send(False)
2066
2718
return False
2067
2068
gobject.io_add_watch(parent_pipe.fileno(),
2069
gobject.IO_IN | gobject.IO_HUP,
2070
functools.partial(self.handle_ipc,
2071
parent_pipe =
2072
parent_pipe,
2073
proc = proc,
2074
client_object =
2075
client))
2719
2720
GLib.io_add_watch(
2721
parent_pipe.fileno(),
2722
GLib.IO_IN | GLib.IO_HUP,
2723
functools.partial(self.handle_ipc,
2724
parent_pipe=parent_pipe,
2725
proc=proc,
2726
client_object=client))
2076
2727
parent_pipe.send(True)
2077
2728
# remove the old hook in favor of the new above hook on
2078
2729
# same fileno
2081
2732
funcname = request[1]
2082
2733
args = request[2]
2083
2734
kwargs = request[3]
2084
2735
2085
2736
parent_pipe.send(('data', getattr(client_object,
2086
2737
funcname)(*args,
2087
**kwargs)))
2088
2738
**kwargs)))
2739
2089
2740
if command == 'getattr':
2090
2741
attrname = request[1]
2091
if callable(client_object.__getattribute__(attrname)):
2092
parent_pipe.send(('function',))
2742
if isinstance(client_object.__getattribute__(attrname),
2743
collections.Callable):
2744
parent_pipe.send(('function', ))
2093
2745
else:
2094
parent_pipe.send(('data', client_object
2095
.__getattribute__(attrname)))
2096
2746
parent_pipe.send((
2747
'data', client_object.__getattribute__(attrname)))
2748
2097
2749
if command == 'setattr':
2098
2750
attrname = request[1]
2099
2751
value = request[2]
2100
2752
setattr(client_object, attrname, value)
2101
2753
2102
2754
return True
2103
2755
2104
2756
2105
2757
def rfc3339_duration_to_delta(duration):
2106
2758
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2107
2759
2108
2760
>>> rfc3339_duration_to_delta("P7D")
2109
2761
datetime.timedelta(7)
2110
2762
>>> rfc3339_duration_to_delta("PT60S")
2120
2772
>>> rfc3339_duration_to_delta("P1DT3M20S")
2121
2773
datetime.timedelta(1, 200)
2122
2774
"""
2123
2775
2124
2776
# Parsing an RFC 3339 duration with regular expressions is not
2125
2777
# possible - there would have to be multiple places for the same
2126
2778
# values, like seconds. The current code, while more esoteric, is
2127
2779
# cleaner without depending on a parsing library. If Python had a
2128
2780
# built-in library for parsing we would use it, but we'd like to
2129
2781
# avoid excessive use of external libraries.
2130
2782
2131
2783
# New type for defining tokens, syntax, and semantics all-in-one
2132
Token = collections.namedtuple("Token",
2133
("regexp", # To match token; if
2134
# "value" is not None,
2135
# must have a "group"
2136
# containing digits
2137
"value", # datetime.timedelta or
2138
# None
2139
"followers")) # Tokens valid after
2140
# this token
2784
Token = collections.namedtuple("Token", (
2785
"regexp", # To match token; if "value" is not None, must have
2786
# a "group" containing digits
2787
"value", # datetime.timedelta or None
2788
"followers")) # Tokens valid after this token
2141
2789
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2142
2790
# the "duration" ABNF definition in RFC 3339, Appendix A.
2143
2791
token_end = Token(re.compile(r"$"), None, frozenset())
2144
2792
token_second = Token(re.compile(r"(\d+)S"),
2145
2793
datetime.timedelta(seconds=1),
2146
frozenset((token_end,)))
2794
frozenset((token_end, )))
2147
2795
token_minute = Token(re.compile(r"(\d+)M"),
2148
2796
datetime.timedelta(minutes=1),
2149
2797
frozenset((token_second, token_end)))
2165
2813
frozenset((token_month, token_end)))
2166
2814
token_week = Token(re.compile(r"(\d+)W"),
2167
2815
datetime.timedelta(weeks=1),
2168
frozenset((token_end,)))
2816
frozenset((token_end, )))
2169
2817
token_duration = Token(re.compile(r"P"), None,
2170
2818
frozenset((token_year, token_month,
2171
2819
token_day, token_time,
2172
2820
token_week)))
2173
# Define starting values
2174
value = datetime.timedelta() # Value so far
2821
# Define starting values:
2822
# Value so far
2823
value = datetime.timedelta()
2175
2824
found_token = None
2176
followers = frozenset((token_duration,)) # Following valid tokens
2177
s = duration # String left to parse
2825
# Following valid tokens
2826
followers = frozenset((token_duration, ))
2827
# String left to parse
2828
s = duration
2178
2829
# Loop until end token is found
2179
2830
while found_token is not token_end:
2180
2831
# Search for any currently valid tokens
2196
2847
break
2197
2848
else:
2198
2849
# No currently valid tokens were found
2199
raise ValueError("Invalid RFC 3339 duration")
2850
raise ValueError("Invalid RFC 3339 duration: {!r}"
2851
.format(duration))
2200
2852
# End token found
2201
2853
return value
2202
2854
2203
2855
2204
2856
def string_to_delta(interval):
2205
2857
"""Parse a string and return a datetime.timedelta
2206
2858
2207
2859
>>> string_to_delta('7d')
2208
2860
datetime.timedelta(7)
2209
2861
>>> string_to_delta('60s')
2217
2869
>>> string_to_delta('5m 30s')
2218
2870
datetime.timedelta(0, 330)
2219
2871
"""
2220
2872
2221
2873
try:
2222
2874
return rfc3339_duration_to_delta(interval)
2223
2875
except ValueError:
2224
2876
pass
2225
2877
2226
2878
timevalue = datetime.timedelta(0)
2227
2879
for s in interval.split():
2228
2880
try:
2229
suffix = unicode(s[-1])
2881
suffix = s[-1]
2230
2882
value = int(s[:-1])
2231
2883
if suffix == "d":
2232
2884
delta = datetime.timedelta(value)
2239
2891
elif suffix == "w":
2240
2892
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2241
2893
else:
2242
raise ValueError("Unknown suffix {!r}"
2243
.format(suffix))
2894
raise ValueError("Unknown suffix {!r}".format(suffix))
2244
2895
except IndexError as e:
2245
2896
raise ValueError(*(e.args))
2246
2897
timevalue += delta
2247
2898
return timevalue
2248
2899
2249
2900
2250
def daemon(nochdir = False, noclose = False):
2901
def daemon(nochdir=False, noclose=False):
2251
2902
"""See daemon(3). Standard BSD Unix function.
2252
2903
2253
2904
This should really exist as os.daemon, but it doesn't (yet)."""
2254
2905
if os.fork():
2255
2906
sys.exit()
2262
2913
# Close all standard open file descriptors
2263
2914
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2264
2915
if not stat.S_ISCHR(os.fstat(null).st_mode):
2265
raise OSError(errno.ENODEV, "{} not a character device"
2916
raise OSError(errno.ENODEV,
2917
"{} not a character device"
2266
2918
.format(os.devnull))
2267
2919
os.dup2(null, sys.stdin.fileno())
2268
2920
os.dup2(null, sys.stdout.fileno())
2272
2924
2273
2925
2274
2926
def main():
2275
2927
2276
2928
##################################################################
2277
2929
# Parsing of options, both command line and config file
2278
2930
2279
2931
parser = argparse.ArgumentParser()
2280
2932
parser.add_argument("-v", "--version", action="version",
2281
version = "%(prog)s {}".format(version),
2933
version="%(prog)s {}".format(version),
2282
2934
help="show version number and exit")
2283
2935
parser.add_argument("-i", "--interface", metavar="IF",
2284
2936
help="Bind to interface IF")
2320
2972
parser.add_argument("--no-zeroconf", action="store_false",
2321
2973
dest="zeroconf", help="Do not use Zeroconf",
2322
2974
default=None)
2323
2975
2324
2976
options = parser.parse_args()
2325
2977
2326
2978
if options.check:
2327
2979
import doctest
2328
2980
fail_count, test_count = doctest.testmod()
2329
2981
sys.exit(os.EX_OK if fail_count == 0 else 1)
2330
2982
2331
2983
# Default values for config file for server-global settings
2332
server_defaults = { "interface": "",
2333
"address": "",
2334
"port": "",
2335
"debug": "False",
2336
"priority":
2337
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2338
"servicename": "Mandos",
2339
"use_dbus": "True",
2340
"use_ipv6": "True",
2341
"debuglevel": "",
2342
"restore": "True",
2343
"socket": "",
2344
"statedir": "/var/lib/mandos",
2345
"foreground": "False",
2346
"zeroconf": "True",
2347
}
2348
2984
if gnutls.has_rawpk:
2985
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2986
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2987
else:
2988
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2989
":+SIGN-DSA-SHA256")
2990
server_defaults = {"interface": "",
2991
"address": "",
2992
"port": "",
2993
"debug": "False",
2994
"priority": priority,
2995
"servicename": "Mandos",
2996
"use_dbus": "True",
2997
"use_ipv6": "True",
2998
"debuglevel": "",
2999
"restore": "True",
3000
"socket": "",
3001
"statedir": "/var/lib/mandos",
3002
"foreground": "False",
3003
"zeroconf": "True",
3004
}
3005
del priority
3006
2349
3007
# Parse config file for server-global settings
2350
server_config = configparser.SafeConfigParser(server_defaults)
3008
server_config = configparser.ConfigParser(server_defaults)
2351
3009
del server_defaults
2352
server_config.read(os.path.join(options.configdir,
2353
"mandos.conf"))
2354
# Convert the SafeConfigParser object to a dict
3010
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3011
# Convert the ConfigParser object to a dict
2355
3012
server_settings = server_config.defaults()
2356
3013
# Use the appropriate methods on the non-string config options
2357
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3014
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3015
"foreground", "zeroconf"):
2358
3016
server_settings[option] = server_config.getboolean("DEFAULT",
2359
3017
option)
2360
3018
if server_settings["port"]:
2370
3028
server_settings["socket"] = os.dup(server_settings
2371
3029
["socket"])
2372
3030
del server_config
2373
3031
2374
3032
# Override the settings from the config file with command line
2375
3033
# options, if set.
2376
3034
for option in ("interface", "address", "port", "debug",
2377
"priority", "servicename", "configdir",
2378
"use_dbus", "use_ipv6", "debuglevel", "restore",
2379
"statedir", "socket", "foreground", "zeroconf"):
3035
"priority", "servicename", "configdir", "use_dbus",
3036
"use_ipv6", "debuglevel", "restore", "statedir",
3037
"socket", "foreground", "zeroconf"):
2380
3038
value = getattr(options, option)
2381
3039
if value is not None:
2382
3040
server_settings[option] = value
2383
3041
del options
2384
3042
# Force all strings to be unicode
2385
3043
for option in server_settings.keys():
2386
if type(server_settings[option]) is str:
2387
server_settings[option] = unicode(server_settings[option])
3044
if isinstance(server_settings[option], bytes):
3045
server_settings[option] = (server_settings[option]
3046
.decode("utf-8"))
2388
3047
# Force all boolean options to be boolean
2389
3048
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2390
3049
"foreground", "zeroconf"):
2393
3052
if server_settings["debug"]:
2394
3053
server_settings["foreground"] = True
2395
3054
# Now we have our good server settings in "server_settings"
2396
3055
2397
3056
##################################################################
2398
2399
if (not server_settings["zeroconf"] and
2400
not (server_settings["port"]
2401
or server_settings["socket"] != "")):
2402
parser.error("Needs port or socket to work without"
2403
" Zeroconf")
2404
3057
3058
if (not server_settings["zeroconf"]
3059
and not (server_settings["port"]
3060
or server_settings["socket"] != "")):
3061
parser.error("Needs port or socket to work without Zeroconf")
3062
2405
3063
# For convenience
2406
3064
debug = server_settings["debug"]
2407
3065
debuglevel = server_settings["debuglevel"]
2411
3069
stored_state_file)
2412
3070
foreground = server_settings["foreground"]
2413
3071
zeroconf = server_settings["zeroconf"]
2414
3072
2415
3073
if debug:
2416
3074
initlogger(debug, logging.DEBUG)
2417
3075
else:
2420
3078
else:
2421
3079
level = getattr(logging, debuglevel.upper())
2422
3080
initlogger(debug, level)
2423
3081
2424
3082
if server_settings["servicename"] != "Mandos":
2425
syslogger.setFormatter(logging.Formatter
2426
('Mandos ({}) [%(process)d]:'
2427
' %(levelname)s: %(message)s'
2428
.format(server_settings
2429
["servicename"])))
2430
3083
syslogger.setFormatter(
3084
logging.Formatter('Mandos ({}) [%(process)d]:'
3085
' %(levelname)s: %(message)s'.format(
3086
server_settings["servicename"])))
3087
2431
3088
# Parse config file with clients
2432
client_config = configparser.SafeConfigParser(Client
2433
.client_defaults)
3089
client_config = configparser.ConfigParser(Client.client_defaults)
2434
3090
client_config.read(os.path.join(server_settings["configdir"],
2435
3091
"clients.conf"))
2436
3092
2437
3093
global mandos_dbus_service
2438
3094
mandos_dbus_service = None
2439
3095
2440
3096
socketfd = None
2441
3097
if server_settings["socket"] != "":
2442
3098
socketfd = server_settings["socket"]
2443
tcp_server = MandosServer((server_settings["address"],
2444
server_settings["port"]),
2445
ClientHandler,
2446
interface=(server_settings["interface"]
2447
or None),
2448
use_ipv6=use_ipv6,
2449
gnutls_priority=
2450
server_settings["priority"],
2451
use_dbus=use_dbus,
2452
socketfd=socketfd)
3099
tcp_server = MandosServer(
3100
(server_settings["address"], server_settings["port"]),
3101
ClientHandler,
3102
interface=(server_settings["interface"] or None),
3103
use_ipv6=use_ipv6,
3104
gnutls_priority=server_settings["priority"],
3105
use_dbus=use_dbus,
3106
socketfd=socketfd)
2453
3107
if not foreground:
2454
3108
pidfilename = "/run/mandos.pid"
2455
3109
if not os.path.isdir("/run/."):
2456
3110
pidfilename = "/var/run/mandos.pid"
2457
3111
pidfile = None
2458
3112
try:
2459
pidfile = open(pidfilename, "w")
3113
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2460
3114
except IOError as e:
2461
3115
logger.error("Could not open file %r", pidfilename,
2462
3116
exc_info=e)
2463
2464
for name in ("_mandos", "mandos", "nobody"):
3117
3118
for name, group in (("_mandos", "_mandos"),
3119
("mandos", "mandos"),
3120
("nobody", "nogroup")):
2465
3121
try:
2466
3122
uid = pwd.getpwnam(name).pw_uid
2467
gid = pwd.getpwnam(name).pw_gid
3123
gid = pwd.getpwnam(group).pw_gid
2468
3124
break
2469
3125
except KeyError:
2470
3126
continue
2474
3130
try:
2475
3131
os.setgid(gid)
2476
3132
os.setuid(uid)
3133
if debug:
3134
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3135
gid))
2477
3136
except OSError as error:
3137
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3138
.format(uid, gid, os.strerror(error.errno)))
2478
3139
if error.errno != errno.EPERM:
2479
3140
raise
2480
3141
2481
3142
if debug:
2482
3143
# Enable all possible GnuTLS debugging
2483
3144
2484
3145
# "Use a log level over 10 to enable all debugging options."
2485
3146
# - GnuTLS manual
2486
gnutls.library.functions.gnutls_global_set_log_level(11)
2487
2488
@gnutls.library.types.gnutls_log_func
3147
gnutls.global_set_log_level(11)
3148
3149
@gnutls.log_func
2489
3150
def debug_gnutls(level, string):
2490
3151
logger.debug("GnuTLS: %s", string[:-1])
2491
2492
(gnutls.library.functions
2493
.gnutls_global_set_log_function(debug_gnutls))
2494
3152
3153
gnutls.global_set_log_function(debug_gnutls)
3154
2495
3155
# Redirect stdin so all checkers get /dev/null
2496
3156
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2497
3157
os.dup2(null, sys.stdin.fileno())
2498
3158
if null > 2:
2499
3159
os.close(null)
2500
3160
2501
3161
# Need to fork before connecting to D-Bus
2502
3162
if not foreground:
2503
3163
# Close all input and output, do double fork, etc.
2504
3164
daemon()
2505
2506
# multiprocessing will use threads, so before we use gobject we
2507
# need to inform gobject that threads will be used.
2508
gobject.threads_init()
2509
3165
3166
if gi.version_info < (3, 10, 2):
3167
# multiprocessing will use threads, so before we use GLib we
3168
# need to inform GLib that threads will be used.
3169
GLib.threads_init()
3170
2510
3171
global main_loop
2511
3172
# From the Avahi example code
2512
3173
DBusGMainLoop(set_as_default=True)
2513
main_loop = gobject.MainLoop()
3174
main_loop = GLib.MainLoop()
2514
3175
bus = dbus.SystemBus()
2515
3176
# End of Avahi example code
2516
3177
if use_dbus:
2517
3178
try:
2518
3179
bus_name = dbus.service.BusName("se.recompile.Mandos",
2519
bus, do_not_queue=True)
2520
old_bus_name = (dbus.service.BusName
2521
("se.bsnet.fukt.Mandos", bus,
2522
do_not_queue=True))
2523
except dbus.exceptions.NameExistsException as e:
3180
bus,
3181
do_not_queue=True)
3182
old_bus_name = dbus.service.BusName(
3183
"se.bsnet.fukt.Mandos", bus,
3184
do_not_queue=True)
3185
except dbus.exceptions.DBusException as e:
2524
3186
logger.error("Disabling D-Bus:", exc_info=e)
2525
3187
use_dbus = False
2526
3188
server_settings["use_dbus"] = False
2527
3189
tcp_server.use_dbus = False
2528
3190
if zeroconf:
2529
3191
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2530
service = AvahiServiceToSyslog(name =
2531
server_settings["servicename"],
2532
servicetype = "_mandos._tcp",
2533
protocol = protocol, bus = bus)
3192
service = AvahiServiceToSyslog(
3193
name=server_settings["servicename"],
3194
servicetype="_mandos._tcp",
3195
protocol=protocol,
3196
bus=bus)
2534
3197
if server_settings["interface"]:
2535
service.interface = (if_nametoindex
2536
(str(server_settings["interface"])))
2537
3198
service.interface = if_nametoindex(
3199
server_settings["interface"].encode("utf-8"))
3200
2538
3201
global multiprocessing_manager
2539
3202
multiprocessing_manager = multiprocessing.Manager()
2540
3203
2541
3204
client_class = Client
2542
3205
if use_dbus:
2543
client_class = functools.partial(ClientDBus, bus = bus)
2544
3206
client_class = functools.partial(ClientDBus, bus=bus)
3207
2545
3208
client_settings = Client.config_parser(client_config)
2546
3209
old_client_settings = {}
2547
3210
clients_data = {}
2548
3211
2549
3212
# This is used to redirect stdout and stderr for checker processes
2550
3213
global wnull
2551
wnull = open(os.devnull, "w") # A writable /dev/null
3214
wnull = open(os.devnull, "w") # A writable /dev/null
2552
3215
# Only used if server is running in foreground but not in debug
2553
3216
# mode
2554
3217
if debug or not foreground:
2555
3218
wnull.close()
2556
3219
2557
3220
# Get client data and settings from last running state.
2558
3221
if server_settings["restore"]:
2559
3222
try:
2560
3223
with open(stored_state_path, "rb") as stored_state:
2561
clients_data, old_client_settings = (pickle.load
2562
(stored_state))
3224
if sys.version_info.major == 2:
3225
clients_data, old_client_settings = pickle.load(
3226
stored_state)
3227
else:
3228
bytes_clients_data, bytes_old_client_settings = (
3229
pickle.load(stored_state, encoding="bytes"))
3230
# Fix bytes to strings
3231
# clients_data
3232
# .keys()
3233
clients_data = {(key.decode("utf-8")
3234
if isinstance(key, bytes)
3235
else key): value
3236
for key, value in
3237
bytes_clients_data.items()}
3238
del bytes_clients_data
3239
for key in clients_data:
3240
value = {(k.decode("utf-8")
3241
if isinstance(k, bytes) else k): v
3242
for k, v in
3243
clients_data[key].items()}
3244
clients_data[key] = value
3245
# .client_structure
3246
value["client_structure"] = [
3247
(s.decode("utf-8")
3248
if isinstance(s, bytes)
3249
else s) for s in
3250
value["client_structure"]]
3251
# .name & .host
3252
for k in ("name", "host"):
3253
if isinstance(value[k], bytes):
3254
value[k] = value[k].decode("utf-8")
3255
if "key_id" not in value:
3256
value["key_id"] = ""
3257
elif "fingerprint" not in value:
3258
value["fingerprint"] = ""
3259
# old_client_settings
3260
# .keys()
3261
old_client_settings = {
3262
(key.decode("utf-8")
3263
if isinstance(key, bytes)
3264
else key): value
3265
for key, value in
3266
bytes_old_client_settings.items()}
3267
del bytes_old_client_settings
3268
# .host
3269
for value in old_client_settings.values():
3270
if isinstance(value["host"], bytes):
3271
value["host"] = (value["host"]
3272
.decode("utf-8"))
2563
3273
os.remove(stored_state_path)
2564
3274
except IOError as e:
2565
3275
if e.errno == errno.ENOENT:
2566
logger.warning("Could not load persistent state: {}"
2567
.format(os.strerror(e.errno)))
3276
logger.warning("Could not load persistent state:"
3277
" {}".format(os.strerror(e.errno)))
2568
3278
else:
2569
3279
logger.critical("Could not load persistent state:",
2570
3280
exc_info=e)
2571
3281
raise
2572
3282
except EOFError as e:
2573
3283
logger.warning("Could not load persistent state: "
2574
"EOFError:", exc_info=e)
2575
3284
"EOFError:",
3285
exc_info=e)
3286
2576
3287
with PGPEngine() as pgp:
2577
3288
for client_name, client in clients_data.items():
2578
3289
# Skip removed clients
2579
3290
if client_name not in client_settings:
2580
3291
continue
2581
3292
2582
3293
# Decide which value to use after restoring saved state.
2583
3294
# We have three different values: Old config file,
2584
3295
# new config file, and saved state.
2589
3300
# For each value in new config, check if it
2590
3301
# differs from the old config value (Except for
2591
3302
# the "secret" attribute)
2592
if (name != "secret" and
2593
value != old_client_settings[client_name]
2594
[name]):
3303
if (name != "secret"
3304
and (value !=
3305
old_client_settings[client_name][name])):
2595
3306
client[name] = value
2596
3307
except KeyError:
2597
3308
pass
2598
3309
2599
3310
# Clients who has passed its expire date can still be
2600
# enabled if its last checker was successful. Clients
3311
# enabled if its last checker was successful. A Client
2601
3312
# whose checker succeeded before we stored its state is
2602
3313
# assumed to have successfully run all checkers during
2603
3314
# downtime.
2606
3317
if not client["last_checked_ok"]:
2607
3318
logger.warning(
2608
3319
"disabling client {} - Client never "
2609
"performed a successful checker"
2610
.format(client_name))
3320
"performed a successful checker".format(
3321
client_name))
2611
3322
client["enabled"] = False
2612
3323
elif client["last_checker_status"] != 0:
2613
3324
logger.warning(
2614
3325
"disabling client {} - Client last"
2615
" checker failed with error code {}"
2616
.format(client_name,
2617
client["last_checker_status"]))
3326
" checker failed with error code"
3327
" {}".format(
3328
client_name,
3329
client["last_checker_status"]))
2618
3330
client["enabled"] = False
2619
3331
else:
2620
client["expires"] = (datetime.datetime
2621
.utcnow()
2622
+ client["timeout"])
3332
client["expires"] = (
3333
datetime.datetime.utcnow()
3334
+ client["timeout"])
2623
3335
logger.debug("Last checker succeeded,"
2624
" keeping {} enabled"
2625
.format(client_name))
3336
" keeping {} enabled".format(
3337
client_name))
2626
3338
try:
2627
client["secret"] = (
2628
pgp.decrypt(client["encrypted_secret"],
2629
client_settings[client_name]
2630
["secret"]))
3339
client["secret"] = pgp.decrypt(
3340
client["encrypted_secret"],
3341
client_settings[client_name]["secret"])
2631
3342
except PGPError:
2632
3343
# If decryption fails, we use secret from new settings
2633
logger.debug("Failed to decrypt {} old secret"
2634
.format(client_name))
2635
client["secret"] = (
2636
client_settings[client_name]["secret"])
2637
3344
logger.debug("Failed to decrypt {} old secret".format(
3345
client_name))
3346
client["secret"] = (client_settings[client_name]
3347
["secret"])
3348
2638
3349
# Add/remove clients based on new changes made to config
2639
3350
for client_name in (set(old_client_settings)
2640
3351
- set(client_settings)):
2642
3353
for client_name in (set(client_settings)
2643
3354
- set(old_client_settings)):
2644
3355
clients_data[client_name] = client_settings[client_name]
2645
3356
2646
3357
# Create all client objects
2647
3358
for client_name, client in clients_data.items():
2648
3359
tcp_server.clients[client_name] = client_class(
2649
name = client_name, settings = client,
2650
server_settings = server_settings)
2651
3360
name=client_name,
3361
settings=client,
3362
server_settings=server_settings)
3363
2652
3364
if not tcp_server.clients:
2653
3365
logger.warning("No clients defined")
2654
3366
2655
3367
if not foreground:
2656
3368
if pidfile is not None:
3369
pid = os.getpid()
2657
3370
try:
2658
3371
with pidfile:
2659
pid = os.getpid()
2660
pidfile.write(str(pid) + "\n".encode("utf-8"))
3372
print(pid, file=pidfile)
2661
3373
except IOError:
2662
3374
logger.error("Could not write to file %r with PID %d",
2663
3375
pidfilename, pid)
2664
3376
del pidfile
2665
3377
del pidfilename
2666
2667
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2668
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2669
3378
3379
for termsig in (signal.SIGHUP, signal.SIGTERM):
3380
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3381
lambda: main_loop.quit() and False)
3382
2670
3383
if use_dbus:
2671
@alternate_dbus_interfaces({"se.recompile.Mandos":
2672
"se.bsnet.fukt.Mandos"})
2673
class MandosDBusService(DBusObjectWithProperties):
3384
3385
@alternate_dbus_interfaces(
3386
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3387
class MandosDBusService(DBusObjectWithObjectManager):
2674
3388
"""A D-Bus proxy object"""
3389
2675
3390
def __init__(self):
2676
3391
dbus.service.Object.__init__(self, bus, "/")
3392
2677
3393
_interface = "se.recompile.Mandos"
2678
2679
@dbus_interface_annotations(_interface)
2680
def _foo(self):
2681
return { "org.freedesktop.DBus.Property"
2682
".EmitsChangedSignal":
2683
"false"}
2684
3394
2685
3395
@dbus.service.signal(_interface, signature="o")
2686
3396
def ClientAdded(self, objpath):
2687
3397
"D-Bus signal"
2688
3398
pass
2689
3399
2690
3400
@dbus.service.signal(_interface, signature="ss")
2691
def ClientNotFound(self, fingerprint, address):
3401
def ClientNotFound(self, key_id, address):
2692
3402
"D-Bus signal"
2693
3403
pass
2694
3404
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3406
"true"})
2695
3407
@dbus.service.signal(_interface, signature="os")
2696
3408
def ClientRemoved(self, objpath, name):
2697
3409
"D-Bus signal"
2698
3410
pass
2699
3411
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3413
"true"})
2700
3414
@dbus.service.method(_interface, out_signature="ao")
2701
3415
def GetAllClients(self):
2702
3416
"D-Bus method"
2703
return dbus.Array(c.dbus_object_path
2704
for c in
2705
tcp_server.clients.itervalues())
2706
3417
return dbus.Array(c.dbus_object_path for c in
3418
tcp_server.clients.values())
3419
3420
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3421
"true"})
2707
3422
@dbus.service.method(_interface,
2708
3423
out_signature="a{oa{sv}}")
2709
3424
def GetAllClientsWithProperties(self):
2710
3425
"D-Bus method"
2711
3426
return dbus.Dictionary(
2712
((c.dbus_object_path, c.GetAll(""))
2713
for c in tcp_server.clients.itervalues()),
3427
{c.dbus_object_path: c.GetAll(
3428
"se.recompile.Mandos.Client")
3429
for c in tcp_server.clients.values()},
2714
3430
signature="oa{sv}")
2715
3431
2716
3432
@dbus.service.method(_interface, in_signature="o")
2717
3433
def RemoveClient(self, object_path):
2718
3434
"D-Bus method"
2719
for c in tcp_server.clients.itervalues():
3435
for c in tcp_server.clients.values():
2720
3436
if c.dbus_object_path == object_path:
2721
3437
del tcp_server.clients[c.name]
2722
3438
c.remove_from_connection()
2723
# Don't signal anything except ClientRemoved
3439
# Don't signal the disabling
2724
3440
c.disable(quiet=True)
2725
# Emit D-Bus signal
2726
self.ClientRemoved(object_path, c.name)
3441
# Emit D-Bus signal for removal
3442
self.client_removed_signal(c)
2727
3443
return
2728
3444
raise KeyError(object_path)
2729
3445
2730
3446
del _interface
2731
3447
3448
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3449
out_signature="a{oa{sa{sv}}}")
3450
def GetManagedObjects(self):
3451
"""D-Bus method"""
3452
return dbus.Dictionary(
3453
{client.dbus_object_path:
3454
dbus.Dictionary(
3455
{interface: client.GetAll(interface)
3456
for interface in
3457
client._get_all_interface_names()})
3458
for client in tcp_server.clients.values()})
3459
3460
def client_added_signal(self, client):
3461
"""Send the new standard signal and the old signal"""
3462
if use_dbus:
3463
# New standard signal
3464
self.InterfacesAdded(
3465
client.dbus_object_path,
3466
dbus.Dictionary(
3467
{interface: client.GetAll(interface)
3468
for interface in
3469
client._get_all_interface_names()}))
3470
# Old signal
3471
self.ClientAdded(client.dbus_object_path)
3472
3473
def client_removed_signal(self, client):
3474
"""Send the new standard signal and the old signal"""
3475
if use_dbus:
3476
# New standard signal
3477
self.InterfacesRemoved(
3478
client.dbus_object_path,
3479
client._get_all_interface_names())
3480
# Old signal
3481
self.ClientRemoved(client.dbus_object_path,
3482
client.name)
3483
2732
3484
mandos_dbus_service = MandosDBusService()
2733
3485
3486
# Save modules to variables to exempt the modules from being
3487
# unloaded before the function registered with atexit() is run.
3488
mp = multiprocessing
3489
wn = wnull
3490
2734
3491
def cleanup():
2735
3492
"Cleanup function; run on exit"
2736
3493
if zeroconf:
2737
3494
service.cleanup()
2738
2739
multiprocessing.active_children()
2740
wnull.close()
3495
3496
mp.active_children()
3497
wn.close()
2741
3498
if not (tcp_server.clients or client_settings):
2742
3499
return
2743
3500
2744
3501
# Store client before exiting. Secrets are encrypted with key
2745
3502
# based on what config file has. If config file is
2746
3503
# removed/edited, old secret will thus be unrecovable.
2747
3504
clients = {}
2748
3505
with PGPEngine() as pgp:
2749
for client in tcp_server.clients.itervalues():
3506
for client in tcp_server.clients.values():
2750
3507
key = client_settings[client.name]["secret"]
2751
3508
client.encrypted_secret = pgp.encrypt(client.secret,
2752
3509
key)
2753
3510
client_dict = {}
2754
3511
2755
3512
# A list of attributes that can not be pickled
2756
3513
# + secret.
2757
exclude = { "bus", "changedstate", "secret",
2758
"checker", "server_settings" }
2759
for name, typ in (inspect.getmembers
2760
(dbus.service.Object)):
3514
exclude = {"bus", "changedstate", "secret",
3515
"checker", "server_settings"}
3516
for name, typ in inspect.getmembers(dbus.service
3517
.Object):
2761
3518
exclude.add(name)
2762
3519
2763
3520
client_dict["encrypted_secret"] = (client
2764
3521
.encrypted_secret)
2765
3522
for attr in client.client_structure:
2766
3523
if attr not in exclude:
2767
3524
client_dict[attr] = getattr(client, attr)
2768
3525
2769
3526
clients[client.name] = client_dict
2770
3527
del client_settings[client.name]["secret"]
2771
3528
2772
3529
try:
2773
with (tempfile.NamedTemporaryFile
2774
(mode='wb', suffix=".pickle", prefix='clients-',
2775
dir=os.path.dirname(stored_state_path),
2776
delete=False)) as stored_state:
2777
pickle.dump((clients, client_settings), stored_state)
2778
tempname=stored_state.name
3530
with tempfile.NamedTemporaryFile(
3531
mode='wb',
3532
suffix=".pickle",
3533
prefix='clients-',
3534
dir=os.path.dirname(stored_state_path),
3535
delete=False) as stored_state:
3536
pickle.dump((clients, client_settings), stored_state,
3537
protocol=2)
3538
tempname = stored_state.name
2779
3539
os.rename(tempname, stored_state_path)
2780
3540
except (IOError, OSError) as e:
2781
3541
if not debug:
2790
3550
logger.warning("Could not save persistent state:",
2791
3551
exc_info=e)
2792
3552
raise
2793
3553
2794
3554
# Delete all clients, and settings from config
2795
3555
while tcp_server.clients:
2796
3556
name, client = tcp_server.clients.popitem()
2797
3557
if use_dbus:
2798
3558
client.remove_from_connection()
2799
# Don't signal anything except ClientRemoved
3559
# Don't signal the disabling
2800
3560
client.disable(quiet=True)
3561
# Emit D-Bus signal for removal
2801
3562
if use_dbus:
2802
# Emit D-Bus signal
2803
mandos_dbus_service.ClientRemoved(client
2804
.dbus_object_path,
2805
client.name)
3563
mandos_dbus_service.client_removed_signal(client)
2806
3564
client_settings.clear()
2807
3565
2808
3566
atexit.register(cleanup)
2809
2810
for client in tcp_server.clients.itervalues():
3567
3568
for client in tcp_server.clients.values():
2811
3569
if use_dbus:
2812
# Emit D-Bus signal
2813
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3570
# Emit D-Bus signal for adding
3571
mandos_dbus_service.client_added_signal(client)
2814
3572
# Need to initiate checking of clients
2815
3573
if client.enabled:
2816
3574
client.init_checker()
2817
3575
2818
3576
tcp_server.enable()
2819
3577
tcp_server.server_activate()
2820
3578
2821
3579
# Find out what port we got
2822
3580
if zeroconf:
2823
3581
service.port = tcp_server.socket.getsockname()[1]
2828
3586
else: # IPv4
2829
3587
logger.info("Now listening on address %r, port %d",
2830
3588
*tcp_server.socket.getsockname())
2831
2832
#service.interface = tcp_server.socket.getsockname()[3]
2833
3589
3590
# service.interface = tcp_server.socket.getsockname()[3]
3591
2834
3592
try:
2835
3593
if zeroconf:
2836
3594
# From the Avahi example code
2841
3599
cleanup()
2842
3600
sys.exit(1)
2843
3601
# End of Avahi example code
2844
2845
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2846
lambda *args, **kwargs:
2847
(tcp_server.handle_request
2848
(*args[2:], **kwargs) or True))
2849
3602
3603
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3604
lambda *args, **kwargs:
3605
(tcp_server.handle_request
3606
(*args[2:], **kwargs) or True))
3607
2850
3608
logger.debug("Starting main loop")
2851
3609
main_loop.run()
2852
3610
except AvahiError as error:
2861
3619
# Must run before the D-Bus bus name gets deregistered
2862
3620
cleanup()
2863
3621
3622
2864
3623
if __name__ == '__main__':
2865
3624
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0