To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1158
- compare with another revision
- download diff
- download tarball
- view history from revision 1158
- Committer: Teddy Hogeborn
- Date: 2019-08-18 00:05:36 UTC
- Revision ID: teddy@recompile.se-20190818000536-cqmaqpo3h6574u1r
Debian package: Only reload dbus daemon if necessary
* debian/mandos.postinst (configure): Only reload dbus daemon if the
_mandos user was renamed or
created.
* debian/mandos.postinst (configure): Only reload dbus daemon if the
_mandos user was renamed or
created.
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
79
80
80
81
import dbus
81
82
import dbus.service
83
import gi
82
84
from gi.repository import GLib
83
85
from dbus.mainloop.glib import DBusGMainLoop
84
86
import ctypes
86
88
import xml.dom.minidom
87
89
import inspect
88
90
91
if sys.version_info.major == 2:
92
__metaclass__ = type
93
89
94
# Try to find the value of SO_BINDTODEVICE:
90
95
try:
91
96
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
114
119
if sys.version_info.major == 2:
115
120
str = unicode
116
121
117
version = "1.7.7"
122
if sys.version_info < (3, 2):
123
configparser.Configparser = configparser.SafeConfigParser
124
125
version = "1.8.7"
118
126
stored_state_file = "clients.pickle"
119
127
120
128
logger = logging.getLogger()
124
132
if_nametoindex = ctypes.cdll.LoadLibrary(
125
133
ctypes.util.find_library("c")).if_nametoindex
126
134
except (OSError, AttributeError):
127
135
128
136
def if_nametoindex(interface):
129
137
"Get an interface index the hard way, i.e. using fcntl()"
130
138
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
153
161
154
162
def initlogger(debug, level=logging.WARNING):
155
163
"""init logger and add loglevel"""
156
164
157
165
global syslogger
158
166
syslogger = (logging.handlers.SysLogHandler(
159
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
160
address = "/dev/log"))
167
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
168
address="/dev/log"))
161
169
syslogger.setFormatter(logging.Formatter
162
170
('Mandos [%(process)d]: %(levelname)s:'
163
171
' %(message)s'))
164
172
logger.addHandler(syslogger)
165
173
166
174
if debug:
167
175
console = logging.StreamHandler()
168
176
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
178
186
pass
179
187
180
188
181
class PGPEngine(object):
189
class PGPEngine:
182
190
"""A simple class for OpenPGP symmetric encryption & decryption"""
183
191
184
192
def __init__(self):
185
193
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
194
self.gpg = "gpg"
201
209
# Only GPG version 1 has the --no-use-agent option.
202
210
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
211
self.gnupgargs.append("--no-use-agent")
204
212
205
213
def __enter__(self):
206
214
return self
207
215
208
216
def __exit__(self, exc_type, exc_value, traceback):
209
217
self._cleanup()
210
218
return False
211
219
212
220
def __del__(self):
213
221
self._cleanup()
214
222
215
223
def _cleanup(self):
216
224
if self.tempdir is not None:
217
225
# Delete contents of tempdir
218
226
for root, dirs, files in os.walk(self.tempdir,
219
topdown = False):
227
topdown=False):
220
228
for filename in files:
221
229
os.remove(os.path.join(root, filename))
222
230
for dirname in dirs:
224
232
# Remove tempdir
225
233
os.rmdir(self.tempdir)
226
234
self.tempdir = None
227
235
228
236
def password_encode(self, password):
229
237
# Passphrase can not be empty and can not contain newlines or
230
238
# NUL bytes. So we prefix it and hex encode it.
235
243
.replace(b"\n", b"\\n")
236
244
.replace(b"\0", b"\\x00"))
237
245
return encoded
238
246
239
247
def encrypt(self, data, password):
240
248
passphrase = self.password_encode(password)
241
249
with tempfile.NamedTemporaryFile(
246
254
'--passphrase-file',
247
255
passfile.name]
248
256
+ self.gnupgargs,
249
stdin = subprocess.PIPE,
250
stdout = subprocess.PIPE,
251
stderr = subprocess.PIPE)
252
ciphertext, err = proc.communicate(input = data)
257
stdin=subprocess.PIPE,
258
stdout=subprocess.PIPE,
259
stderr=subprocess.PIPE)
260
ciphertext, err = proc.communicate(input=data)
253
261
if proc.returncode != 0:
254
262
raise PGPError(err)
255
263
return ciphertext
256
264
257
265
def decrypt(self, data, password):
258
266
passphrase = self.password_encode(password)
259
267
with tempfile.NamedTemporaryFile(
260
dir = self.tempdir) as passfile:
268
dir=self.tempdir) as passfile:
261
269
passfile.write(passphrase)
262
270
passfile.flush()
263
271
proc = subprocess.Popen([self.gpg, '--decrypt',
264
272
'--passphrase-file',
265
273
passfile.name]
266
274
+ self.gnupgargs,
267
stdin = subprocess.PIPE,
268
stdout = subprocess.PIPE,
269
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
275
stdin=subprocess.PIPE,
276
stdout=subprocess.PIPE,
277
stderr=subprocess.PIPE)
278
decrypted_plaintext, err = proc.communicate(input=data)
271
279
if proc.returncode != 0:
272
280
raise PGPError(err)
273
281
return decrypted_plaintext
274
282
283
275
284
# Pretend that we have an Avahi module
276
class Avahi(object):
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
285
class avahi:
286
"""This isn't so much a class as it is a module-like namespace."""
287
IF_UNSPEC = -1 # avahi-common/address.h
288
PROTO_UNSPEC = -1 # avahi-common/address.h
289
PROTO_INET = 0 # avahi-common/address.h
290
PROTO_INET6 = 1 # avahi-common/address.h
283
291
DBUS_NAME = "org.freedesktop.Avahi"
284
292
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
285
293
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
286
294
DBUS_PATH_SERVER = "/"
287
def string_array_to_txt_array(self, t):
295
296
@staticmethod
297
def string_array_to_txt_array(t):
288
298
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
289
299
for s in t), signature="ay")
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
298
avahi = Avahi()
300
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
301
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
302
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
303
SERVER_INVALID = 0 # avahi-common/defs.h
304
SERVER_REGISTERING = 1 # avahi-common/defs.h
305
SERVER_RUNNING = 2 # avahi-common/defs.h
306
SERVER_COLLISION = 3 # avahi-common/defs.h
307
SERVER_FAILURE = 4 # avahi-common/defs.h
308
299
309
300
310
class AvahiError(Exception):
301
311
def __init__(self, value, *args, **kwargs):
312
322
pass
313
323
314
324
315
class AvahiService(object):
325
class AvahiService:
316
326
"""An Avahi (Zeroconf) service.
317
327
318
328
Attributes:
319
329
interface: integer; avahi.IF_UNSPEC or an interface index.
320
330
Used to optionally bind to the specified interface.
332
342
server: D-Bus Server
333
343
bus: dbus.SystemBus()
334
344
"""
335
345
336
346
def __init__(self,
337
interface = avahi.IF_UNSPEC,
338
name = None,
339
servicetype = None,
340
port = None,
341
TXT = None,
342
domain = "",
343
host = "",
344
max_renames = 32768,
345
protocol = avahi.PROTO_UNSPEC,
346
bus = None):
347
interface=avahi.IF_UNSPEC,
348
name=None,
349
servicetype=None,
350
port=None,
351
TXT=None,
352
domain="",
353
host="",
354
max_renames=32768,
355
protocol=avahi.PROTO_UNSPEC,
356
bus=None):
347
357
self.interface = interface
348
358
self.name = name
349
359
self.type = servicetype
358
368
self.server = None
359
369
self.bus = bus
360
370
self.entry_group_state_changed_match = None
361
371
362
372
def rename(self, remove=True):
363
373
"""Derived from the Avahi example code"""
364
374
if self.rename_count >= self.max_renames:
384
394
logger.critical("D-Bus Exception", exc_info=error)
385
395
self.cleanup()
386
396
os._exit(1)
387
397
388
398
def remove(self):
389
399
"""Derived from the Avahi example code"""
390
400
if self.entry_group_state_changed_match is not None:
392
402
self.entry_group_state_changed_match = None
393
403
if self.group is not None:
394
404
self.group.Reset()
395
405
396
406
def add(self):
397
407
"""Derived from the Avahi example code"""
398
408
self.remove()
415
425
dbus.UInt16(self.port),
416
426
avahi.string_array_to_txt_array(self.TXT))
417
427
self.group.Commit()
418
428
419
429
def entry_group_state_changed(self, state, error):
420
430
"""Derived from the Avahi example code"""
421
431
logger.debug("Avahi entry group state change: %i", state)
422
432
423
433
if state == avahi.ENTRY_GROUP_ESTABLISHED:
424
434
logger.debug("Zeroconf service established.")
425
435
elif state == avahi.ENTRY_GROUP_COLLISION:
429
439
logger.critical("Avahi: Error in group state changed %s",
430
440
str(error))
431
441
raise AvahiGroupError("State changed: {!s}".format(error))
432
442
433
443
def cleanup(self):
434
444
"""Derived from the Avahi example code"""
435
445
if self.group is not None:
440
450
pass
441
451
self.group = None
442
452
self.remove()
443
453
444
454
def server_state_changed(self, state, error=None):
445
455
"""Derived from the Avahi example code"""
446
456
logger.debug("Avahi server state change: %i", state)
475
485
logger.debug("Unknown state: %r", state)
476
486
else:
477
487
logger.debug("Unknown state: %r: %r", state, error)
478
488
479
489
def activate(self):
480
490
"""Derived from the Avahi example code"""
481
491
if self.server is None:
492
502
class AvahiServiceToSyslog(AvahiService):
493
503
def rename(self, *args, **kwargs):
494
504
"""Add the new name to the syslog messages"""
495
ret = AvahiService.rename(self, *args, **kwargs)
505
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
496
506
syslogger.setFormatter(logging.Formatter(
497
507
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
498
508
.format(self.name)))
499
509
return ret
500
510
511
501
512
# Pretend that we have a GnuTLS module
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
505
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
509
def __init__(self):
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
512
# happens.
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
516
513
class gnutls:
514
"""This isn't so much a class as it is a module-like namespace."""
515
516
library = ctypes.util.find_library("gnutls")
517
if library is None:
518
library = ctypes.util.find_library("gnutls-deb0")
519
_library = ctypes.cdll.LoadLibrary(library)
520
del library
521
517
522
# Unless otherwise indicated, the constants and types below are
518
523
# all from the gnutls/gnutls.h C header file.
519
524
520
525
# Constants
521
526
E_SUCCESS = 0
522
527
E_INTERRUPTED = -52
523
528
E_AGAIN = -28
524
529
CRT_OPENPGP = 2
530
CRT_RAWPK = 3
525
531
CLIENT = 2
526
532
SHUT_RDWR = 0
527
533
CRD_CERTIFICATE = 1
528
534
E_NO_CERTIFICATE_FOUND = -49
535
X509_FMT_DER = 0
536
NO_TICKETS = 1<<10
537
ENABLE_RAWPK = 1<<18
538
CTYPE_PEERS = 3
539
KEYID_USE_SHA256 = 1 # gnutls/x509.h
529
540
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
530
541
531
542
# Types
532
543
class session_int(ctypes.Structure):
533
544
_fields_ = []
534
545
session_t = ctypes.POINTER(session_int)
546
535
547
class certificate_credentials_st(ctypes.Structure):
536
548
_fields_ = []
537
549
certificate_credentials_t = ctypes.POINTER(
538
550
certificate_credentials_st)
539
551
certificate_type_t = ctypes.c_int
552
540
553
class datum_t(ctypes.Structure):
541
554
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
555
('size', ctypes.c_uint)]
556
543
557
class openpgp_crt_int(ctypes.Structure):
544
558
_fields_ = []
545
559
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
560
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
547
561
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
548
562
credentials_type_t = ctypes.c_int
549
563
transport_ptr_t = ctypes.c_void_p
550
564
close_request_t = ctypes.c_int
551
565
552
566
# Exceptions
553
567
class Error(Exception):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
568
def __init__(self, message=None, code=None, args=()):
559
569
# Default usage is by a message string, but if a return
560
570
# code is passed, convert it to a string with
561
571
# gnutls.strerror()
562
572
self.code = code
563
573
if message is None and code is not None:
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
574
message = gnutls.strerror(code)
575
return super(gnutls.Error, self).__init__(
566
576
message, *args)
567
577
568
578
class CertificateSecurityError(Error):
569
579
pass
570
580
571
581
# Classes
572
class Credentials(object):
582
class Credentials:
573
583
def __init__(self):
574
584
self._c_object = gnutls.certificate_credentials_t()
575
585
gnutls.certificate_allocate_credentials(
576
586
ctypes.byref(self._c_object))
577
587
self.type = gnutls.CRD_CERTIFICATE
578
588
579
589
def __del__(self):
580
590
gnutls.certificate_free_credentials(self._c_object)
581
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
591
592
class ClientSession:
593
def __init__(self, socket, credentials=None):
584
594
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
595
gnutls_flags = gnutls.CLIENT
596
if gnutls.check_version(b"3.5.6"):
597
gnutls_flags |= gnutls.NO_TICKETS
598
if gnutls.has_rawpk:
599
gnutls_flags |= gnutls.ENABLE_RAWPK
600
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
601
del gnutls_flags
586
602
gnutls.set_default_priority(self._c_object)
587
603
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
604
gnutls.handshake_set_private_extensions(self._c_object,
594
610
ctypes.cast(credentials._c_object,
595
611
ctypes.c_void_p))
596
612
self.credentials = credentials
597
613
598
614
def __del__(self):
599
615
gnutls.deinit(self._c_object)
600
616
601
617
def handshake(self):
602
618
return gnutls.handshake(self._c_object)
603
619
604
620
def send(self, data):
605
621
data = bytes(data)
606
622
data_len = len(data)
608
624
data_len -= gnutls.record_send(self._c_object,
609
625
data[-data_len:],
610
626
data_len)
611
627
612
628
def bye(self):
613
629
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
614
630
615
631
# Error handling functions
616
632
def _error_code(result):
617
633
"""A function to raise exceptions on errors, suitable
619
635
if result >= 0:
620
636
return result
621
637
if result == gnutls.E_NO_CERTIFICATE_FOUND:
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
624
638
raise gnutls.CertificateSecurityError(code=result)
639
raise gnutls.Error(code=result)
640
625
641
def _retry_on_error(result, func, arguments):
626
642
"""A function to retry on some errors, suitable
627
643
for the 'errcheck' attribute on ctypes functions"""
630
646
return _error_code(result)
631
647
result = func(*arguments)
632
648
return result
633
649
634
650
# Unless otherwise indicated, the function declarations below are
635
651
# all from the gnutls/gnutls.h C header file.
636
652
637
653
# Functions
638
654
priority_set_direct = _library.gnutls_priority_set_direct
639
655
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
640
656
ctypes.POINTER(ctypes.c_char_p)]
641
657
priority_set_direct.restype = _error_code
642
658
643
659
init = _library.gnutls_init
644
660
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
645
661
init.restype = _error_code
646
662
647
663
set_default_priority = _library.gnutls_set_default_priority
648
664
set_default_priority.argtypes = [session_t]
649
665
set_default_priority.restype = _error_code
650
666
651
667
record_send = _library.gnutls_record_send
652
668
record_send.argtypes = [session_t, ctypes.c_void_p,
653
669
ctypes.c_size_t]
654
670
record_send.restype = ctypes.c_ssize_t
655
671
record_send.errcheck = _retry_on_error
656
672
657
673
certificate_allocate_credentials = (
658
674
_library.gnutls_certificate_allocate_credentials)
659
675
certificate_allocate_credentials.argtypes = [
660
676
ctypes.POINTER(certificate_credentials_t)]
661
677
certificate_allocate_credentials.restype = _error_code
662
678
663
679
certificate_free_credentials = (
664
680
_library.gnutls_certificate_free_credentials)
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
681
certificate_free_credentials.argtypes = [
682
certificate_credentials_t]
666
683
certificate_free_credentials.restype = None
667
684
668
685
handshake_set_private_extensions = (
669
686
_library.gnutls_handshake_set_private_extensions)
670
687
handshake_set_private_extensions.argtypes = [session_t,
671
688
ctypes.c_int]
672
689
handshake_set_private_extensions.restype = None
673
690
674
691
credentials_set = _library.gnutls_credentials_set
675
692
credentials_set.argtypes = [session_t, credentials_type_t,
676
693
ctypes.c_void_p]
677
694
credentials_set.restype = _error_code
678
695
679
696
strerror = _library.gnutls_strerror
680
697
strerror.argtypes = [ctypes.c_int]
681
698
strerror.restype = ctypes.c_char_p
682
699
683
700
certificate_type_get = _library.gnutls_certificate_type_get
684
701
certificate_type_get.argtypes = [session_t]
685
702
certificate_type_get.restype = _error_code
686
703
687
704
certificate_get_peers = _library.gnutls_certificate_get_peers
688
705
certificate_get_peers.argtypes = [session_t,
689
706
ctypes.POINTER(ctypes.c_uint)]
690
707
certificate_get_peers.restype = ctypes.POINTER(datum_t)
691
708
692
709
global_set_log_level = _library.gnutls_global_set_log_level
693
710
global_set_log_level.argtypes = [ctypes.c_int]
694
711
global_set_log_level.restype = None
695
712
696
713
global_set_log_function = _library.gnutls_global_set_log_function
697
714
global_set_log_function.argtypes = [log_func]
698
715
global_set_log_function.restype = None
699
716
700
717
deinit = _library.gnutls_deinit
701
718
deinit.argtypes = [session_t]
702
719
deinit.restype = None
703
720
704
721
handshake = _library.gnutls_handshake
705
722
handshake.argtypes = [session_t]
706
723
handshake.restype = _error_code
707
724
handshake.errcheck = _retry_on_error
708
725
709
726
transport_set_ptr = _library.gnutls_transport_set_ptr
710
727
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
711
728
transport_set_ptr.restype = None
712
729
713
730
bye = _library.gnutls_bye
714
731
bye.argtypes = [session_t, close_request_t]
715
732
bye.restype = _error_code
716
733
bye.errcheck = _retry_on_error
717
734
718
735
check_version = _library.gnutls_check_version
719
736
check_version.argtypes = [ctypes.c_char_p]
720
737
check_version.restype = ctypes.c_char_p
721
722
# All the function declarations below are from gnutls/openpgp.h
723
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
727
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
731
openpgp_crt_fmt_t]
732
openpgp_crt_import.restype = _error_code
733
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
738
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
742
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
746
ctypes.c_void_p,
747
ctypes.POINTER(
748
ctypes.c_size_t)]
749
openpgp_crt_get_fingerprint.restype = _error_code
750
738
739
_need_version = b"3.3.0"
740
if check_version(_need_version) is None:
741
raise self.Error("Needs GnuTLS {} or later"
742
.format(_need_version))
743
744
_tls_rawpk_version = b"3.6.6"
745
has_rawpk = bool(check_version(_tls_rawpk_version))
746
747
if has_rawpk:
748
# Types
749
class pubkey_st(ctypes.Structure):
750
_fields = []
751
pubkey_t = ctypes.POINTER(pubkey_st)
752
753
x509_crt_fmt_t = ctypes.c_int
754
755
# All the function declarations below are from gnutls/abstract.h
756
pubkey_init = _library.gnutls_pubkey_init
757
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
758
pubkey_init.restype = _error_code
759
760
pubkey_import = _library.gnutls_pubkey_import
761
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
762
x509_crt_fmt_t]
763
pubkey_import.restype = _error_code
764
765
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
766
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
767
ctypes.POINTER(ctypes.c_ubyte),
768
ctypes.POINTER(ctypes.c_size_t)]
769
pubkey_get_key_id.restype = _error_code
770
771
pubkey_deinit = _library.gnutls_pubkey_deinit
772
pubkey_deinit.argtypes = [pubkey_t]
773
pubkey_deinit.restype = None
774
else:
775
# All the function declarations below are from gnutls/openpgp.h
776
777
openpgp_crt_init = _library.gnutls_openpgp_crt_init
778
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
779
openpgp_crt_init.restype = _error_code
780
781
openpgp_crt_import = _library.gnutls_openpgp_crt_import
782
openpgp_crt_import.argtypes = [openpgp_crt_t,
783
ctypes.POINTER(datum_t),
784
openpgp_crt_fmt_t]
785
openpgp_crt_import.restype = _error_code
786
787
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
788
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
789
ctypes.POINTER(ctypes.c_uint)]
790
openpgp_crt_verify_self.restype = _error_code
791
792
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
793
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
794
openpgp_crt_deinit.restype = None
795
796
openpgp_crt_get_fingerprint = (
797
_library.gnutls_openpgp_crt_get_fingerprint)
798
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
ctypes.c_void_p,
800
ctypes.POINTER(
801
ctypes.c_size_t)]
802
openpgp_crt_get_fingerprint.restype = _error_code
803
804
if check_version(b"3.6.4"):
805
certificate_type_get2 = _library.gnutls_certificate_type_get2
806
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
807
certificate_type_get2.restype = _error_code
808
751
809
# Remove non-public functions
752
810
del _error_code, _retry_on_error
753
# Create the global "gnutls" object, simulating a module
754
gnutls = GnuTLS()
811
755
812
756
813
def call_pipe(connection, # : multiprocessing.Connection
757
814
func, *args, **kwargs):
758
815
"""This function is meant to be called by multiprocessing.Process
759
816
760
817
This function runs func(*args, **kwargs), and writes the resulting
761
818
return value on the provided multiprocessing.Connection.
762
819
"""
763
820
connection.send(func(*args, **kwargs))
764
821
connection.close()
765
822
766
class Client(object):
823
824
class Client:
767
825
"""A representation of a client host served by this server.
768
826
769
827
Attributes:
770
828
approved: bool(); 'None' if not yet approved/disapproved
771
829
approval_delay: datetime.timedelta(); Time to wait for approval
772
830
approval_duration: datetime.timedelta(); Duration of one approval
773
checker: subprocess.Popen(); a running checker process used
774
to see if the client lives.
775
'None' if no process is running.
831
checker: multiprocessing.Process(); a running checker process used
832
to see if the client lives. 'None' if no process is
833
running.
776
834
checker_callback_tag: a GLib event source tag, or None
777
835
checker_command: string; External command which is run to check
778
836
if client lives. %() expansions are done at
786
844
disable_initiator_tag: a GLib event source tag, or None
787
845
enabled: bool()
788
846
fingerprint: string (40 or 32 hexadecimal digits); used to
789
uniquely identify the client
847
uniquely identify an OpenPGP client
848
key_id: string (64 hexadecimal digits); used to uniquely identify
849
a client using raw public keys
790
850
host: string; available for use by the checker command
791
851
interval: datetime.timedelta(); How often to start a new checker
792
852
last_approval_request: datetime.datetime(); (UTC) or None
808
868
disabled, or None
809
869
server_settings: The server_settings dict from main()
810
870
"""
811
871
812
872
runtime_expansions = ("approval_delay", "approval_duration",
813
"created", "enabled", "expires",
873
"created", "enabled", "expires", "key_id",
814
874
"fingerprint", "host", "interval",
815
875
"last_approval_request", "last_checked_ok",
816
876
"last_enabled", "name", "timeout")
825
885
"approved_by_default": "True",
826
886
"enabled": "True",
827
887
}
828
888
829
889
@staticmethod
830
890
def config_parser(config):
831
891
"""Construct a new dict of client settings of this form:
838
898
for client_name in config.sections():
839
899
section = dict(config.items(client_name))
840
900
client = settings[client_name] = {}
841
901
842
902
client["host"] = section["host"]
843
903
# Reformat values from string types to Python types
844
904
client["approved_by_default"] = config.getboolean(
845
905
client_name, "approved_by_default")
846
906
client["enabled"] = config.getboolean(client_name,
847
907
"enabled")
848
849
# Uppercase and remove spaces from fingerprint for later
850
# comparison purposes with return value from the
851
# fingerprint() function
908
909
# Uppercase and remove spaces from key_id and fingerprint
910
# for later comparison purposes with return value from the
911
# key_id() and fingerprint() functions
912
client["key_id"] = (section.get("key_id", "").upper()
913
.replace(" ", ""))
852
914
client["fingerprint"] = (section["fingerprint"].upper()
853
915
.replace(" ", ""))
854
916
if "secret" in section:
875
937
client["last_approval_request"] = None
876
938
client["last_checked_ok"] = None
877
939
client["last_checker_status"] = -2
878
940
879
941
return settings
880
881
def __init__(self, settings, name = None, server_settings=None):
942
943
def __init__(self, settings, name=None, server_settings=None):
882
944
self.name = name
883
945
if server_settings is None:
884
946
server_settings = {}
886
948
# adding all client settings
887
949
for setting, value in settings.items():
888
950
setattr(self, setting, value)
889
951
890
952
if self.enabled:
891
953
if not hasattr(self, "last_enabled"):
892
954
self.last_enabled = datetime.datetime.utcnow()
896
958
else:
897
959
self.last_enabled = None
898
960
self.expires = None
899
961
900
962
logger.debug("Creating client %r", self.name)
963
logger.debug(" Key ID: %s", self.key_id)
901
964
logger.debug(" Fingerprint: %s", self.fingerprint)
902
965
self.created = settings.get("created",
903
966
datetime.datetime.utcnow())
904
967
905
968
# attributes specific for this server instance
906
969
self.checker = None
907
970
self.checker_initiator_tag = None
916
979
for attr in self.__dict__.keys()
917
980
if not attr.startswith("_")]
918
981
self.client_structure.append("client_structure")
919
982
920
983
for name, t in inspect.getmembers(
921
984
type(self), lambda obj: isinstance(obj, property)):
922
985
if not name.startswith("_"):
923
986
self.client_structure.append(name)
924
987
925
988
# Send notice to process children that client state has changed
926
989
def send_changedstate(self):
927
990
with self.changedstate:
928
991
self.changedstate.notify_all()
929
992
930
993
def enable(self):
931
994
"""Start this client's checker and timeout hooks"""
932
995
if getattr(self, "enabled", False):
937
1000
self.last_enabled = datetime.datetime.utcnow()
938
1001
self.init_checker()
939
1002
self.send_changedstate()
940
1003
941
1004
def disable(self, quiet=True):
942
1005
"""Disable this client."""
943
1006
if not getattr(self, "enabled", False):
957
1020
self.send_changedstate()
958
1021
# Do not run this again if called by a GLib.timeout_add
959
1022
return False
960
1023
961
1024
def __del__(self):
962
1025
self.disable()
963
1026
964
1027
def init_checker(self):
965
1028
# Schedule a new checker to be started an 'interval' from now,
966
1029
# and every interval from then on.
976
1039
int(self.timeout.total_seconds() * 1000), self.disable)
977
1040
# Also start a new checker *right now*.
978
1041
self.start_checker()
979
1042
980
1043
def checker_callback(self, source, condition, connection,
981
1044
command):
982
1045
"""The checker has completed, so take appropriate actions."""
983
self.checker_callback_tag = None
984
self.checker = None
985
1046
# Read return code from connection (see call_pipe)
986
1047
returncode = connection.recv()
987
1048
connection.close()
988
1049
self.checker.join()
1050
self.checker_callback_tag = None
1051
self.checker = None
1052
989
1053
if returncode >= 0:
990
1054
self.last_checker_status = returncode
991
1055
self.last_checker_signal = None
1001
1065
logger.warning("Checker for %(name)s crashed?",
1002
1066
vars(self))
1003
1067
return False
1004
1068
1005
1069
def checked_ok(self):
1006
1070
"""Assert that the client has been seen, alive and well."""
1007
1071
self.last_checked_ok = datetime.datetime.utcnow()
1008
1072
self.last_checker_status = 0
1009
1073
self.last_checker_signal = None
1010
1074
self.bump_timeout()
1011
1075
1012
1076
def bump_timeout(self, timeout=None):
1013
1077
"""Bump up the timeout for this client."""
1014
1078
if timeout is None:
1020
1084
self.disable_initiator_tag = GLib.timeout_add(
1021
1085
int(timeout.total_seconds() * 1000), self.disable)
1022
1086
self.expires = datetime.datetime.utcnow() + timeout
1023
1087
1024
1088
def need_approval(self):
1025
1089
self.last_approval_request = datetime.datetime.utcnow()
1026
1090
1027
1091
def start_checker(self):
1028
1092
"""Start a new checker subprocess if one is not running.
1029
1093
1030
1094
If a checker already exists, leave it running and do
1031
1095
nothing."""
1032
1096
# The reason for not killing a running checker is that if we
1037
1101
# checkers alone, the checker would have to take more time
1038
1102
# than 'timeout' for the client to be disabled, which is as it
1039
1103
# should be.
1040
1104
1041
1105
if self.checker is not None and not self.checker.is_alive():
1042
1106
logger.warning("Checker was not alive; joining")
1043
1107
self.checker.join()
1047
1111
# Escape attributes for the shell
1048
1112
escaped_attrs = {
1049
1113
attr: re.escape(str(getattr(self, attr)))
1050
for attr in self.runtime_expansions }
1114
for attr in self.runtime_expansions}
1051
1115
try:
1052
1116
command = self.checker_command % escaped_attrs
1053
1117
except TypeError as error:
1065
1129
# The exception is when not debugging but nevertheless
1066
1130
# running in the foreground; use the previously
1067
1131
# created wnull.
1068
popen_args = { "close_fds": True,
1069
"shell": True,
1070
"cwd": "/" }
1132
popen_args = {"close_fds": True,
1133
"shell": True,
1134
"cwd": "/"}
1071
1135
if (not self.server_settings["debug"]
1072
1136
and self.server_settings["foreground"]):
1073
1137
popen_args.update({"stdout": wnull,
1074
"stderr": wnull })
1075
pipe = multiprocessing.Pipe(duplex = False)
1138
"stderr": wnull})
1139
pipe = multiprocessing.Pipe(duplex=False)
1076
1140
self.checker = multiprocessing.Process(
1077
target = call_pipe,
1078
args = (pipe[1], subprocess.call, command),
1079
kwargs = popen_args)
1141
target=call_pipe,
1142
args=(pipe[1], subprocess.call, command),
1143
kwargs=popen_args)
1080
1144
self.checker.start()
1081
1145
self.checker_callback_tag = GLib.io_add_watch(
1082
1146
pipe[0].fileno(), GLib.IO_IN,
1083
1147
self.checker_callback, pipe[0], command)
1084
1148
# Re-run this periodically if run by GLib.timeout_add
1085
1149
return True
1086
1150
1087
1151
def stop_checker(self):
1088
1152
"""Force the checker process, if any, to stop."""
1089
1153
if self.checker_callback_tag:
1102
1166
byte_arrays=False):
1103
1167
"""Decorators for marking methods of a DBusObjectWithProperties to
1104
1168
become properties on the D-Bus.
1105
1169
1106
1170
The decorated method will be called with no arguments by "Get"
1107
1171
and with one argument by "Set".
1108
1172
1109
1173
The parameters, where they are supported, are the same as
1110
1174
dbus.service.method, except there is only "signature", since the
1111
1175
type from Get() and the type sent to Set() is the same.
1115
1179
if byte_arrays and signature != "ay":
1116
1180
raise ValueError("Byte arrays not supported for non-'ay'"
1117
1181
" signature {!r}".format(signature))
1118
1182
1119
1183
def decorator(func):
1120
1184
func._dbus_is_property = True
1121
1185
func._dbus_interface = dbus_interface
1124
1188
func._dbus_name = func.__name__
1125
1189
if func._dbus_name.endswith("_dbus_property"):
1126
1190
func._dbus_name = func._dbus_name[:-14]
1127
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1191
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1128
1192
return func
1129
1193
1130
1194
return decorator
1131
1195
1132
1196
1133
1197
def dbus_interface_annotations(dbus_interface):
1134
1198
"""Decorator for marking functions returning interface annotations
1135
1199
1136
1200
Usage:
1137
1201
1138
1202
@dbus_interface_annotations("org.example.Interface")
1139
1203
def _foo(self): # Function name does not matter
1140
1204
return {"org.freedesktop.DBus.Deprecated": "true",
1141
1205
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1142
1206
"false"}
1143
1207
"""
1144
1208
1145
1209
def decorator(func):
1146
1210
func._dbus_is_interface = True
1147
1211
func._dbus_interface = dbus_interface
1148
1212
func._dbus_name = dbus_interface
1149
1213
return func
1150
1214
1151
1215
return decorator
1152
1216
1153
1217
1154
1218
def dbus_annotations(annotations):
1155
1219
"""Decorator to annotate D-Bus methods, signals or properties
1156
1220
Usage:
1157
1221
1158
1222
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1159
1223
"org.freedesktop.DBus.Property."
1160
1224
"EmitsChangedSignal": "false"})
1162
1226
access="r")
1163
1227
def Property_dbus_property(self):
1164
1228
return dbus.Boolean(False)
1165
1229
1166
1230
See also the DBusObjectWithAnnotations class.
1167
1231
"""
1168
1232
1169
1233
def decorator(func):
1170
1234
func._dbus_annotations = annotations
1171
1235
return func
1172
1236
1173
1237
return decorator
1174
1238
1175
1239
1193
1257
1194
1258
class DBusObjectWithAnnotations(dbus.service.Object):
1195
1259
"""A D-Bus object with annotations.
1196
1260
1197
1261
Classes inheriting from this can use the dbus_annotations
1198
1262
decorator to add annotations to methods or signals.
1199
1263
"""
1200
1264
1201
1265
@staticmethod
1202
1266
def _is_dbus_thing(thing):
1203
1267
"""Returns a function testing if an attribute is a D-Bus thing
1204
1268
1205
1269
If called like _is_dbus_thing("method") it returns a function
1206
1270
suitable for use as predicate to inspect.getmembers().
1207
1271
"""
1208
1272
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1209
1273
False)
1210
1274
1211
1275
def _get_all_dbus_things(self, thing):
1212
1276
"""Returns a generator of (name, attribute) pairs
1213
1277
"""
1216
1280
for cls in self.__class__.__mro__
1217
1281
for name, athing in
1218
1282
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1219
1283
1220
1284
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1221
out_signature = "s",
1222
path_keyword = 'object_path',
1223
connection_keyword = 'connection')
1285
out_signature="s",
1286
path_keyword='object_path',
1287
connection_keyword='connection')
1224
1288
def Introspect(self, object_path, connection):
1225
1289
"""Overloading of standard D-Bus method.
1226
1290
1227
1291
Inserts annotation tags on methods and signals.
1228
1292
"""
1229
1293
xmlstring = dbus.service.Object.Introspect(self, object_path,
1230
1294
connection)
1231
1295
try:
1232
1296
document = xml.dom.minidom.parseString(xmlstring)
1233
1297
1234
1298
for if_tag in document.getElementsByTagName("interface"):
1235
1299
# Add annotation tags
1236
1300
for typ in ("method", "signal"):
1263
1327
if_tag.appendChild(ann_tag)
1264
1328
# Fix argument name for the Introspect method itself
1265
1329
if (if_tag.getAttribute("name")
1266
== dbus.INTROSPECTABLE_IFACE):
1330
== dbus.INTROSPECTABLE_IFACE):
1267
1331
for cn in if_tag.getElementsByTagName("method"):
1268
1332
if cn.getAttribute("name") == "Introspect":
1269
1333
for arg in cn.getElementsByTagName("arg"):
1282
1346
1283
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1284
1348
"""A D-Bus object with properties.
1285
1349
1286
1350
Classes inheriting from this can use the dbus_service_property
1287
1351
decorator to expose methods as D-Bus properties. It exposes the
1288
1352
standard Get(), Set(), and GetAll() methods on the D-Bus.
1289
1353
"""
1290
1354
1291
1355
def _get_dbus_property(self, interface_name, property_name):
1292
1356
"""Returns a bound method if one exists which is a D-Bus
1293
1357
property with the specified name and interface.
1298
1362
if (value._dbus_name == property_name
1299
1363
and value._dbus_interface == interface_name):
1300
1364
return value.__get__(self)
1301
1365
1302
1366
# No such property
1303
1367
raise DBusPropertyNotFound("{}:{}.{}".format(
1304
1368
self.dbus_object_path, interface_name, property_name))
1305
1369
1306
1370
@classmethod
1307
1371
def _get_all_interface_names(cls):
1308
1372
"""Get a sequence of all interfaces supported by an object"""
1311
1375
for x in (inspect.getmro(cls))
1312
1376
for attr in dir(x))
1313
1377
if name is not None)
1314
1378
1315
1379
@dbus.service.method(dbus.PROPERTIES_IFACE,
1316
1380
in_signature="ss",
1317
1381
out_signature="v")
1325
1389
if not hasattr(value, "variant_level"):
1326
1390
return value
1327
1391
return type(value)(value, variant_level=value.variant_level+1)
1328
1392
1329
1393
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1330
1394
def Set(self, interface_name, property_name, value):
1331
1395
"""Standard D-Bus property Set() method, see D-Bus standard.
1343
1407
value = dbus.ByteArray(b''.join(chr(byte)
1344
1408
for byte in value))
1345
1409
prop(value)
1346
1410
1347
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1348
1412
in_signature="s",
1349
1413
out_signature="a{sv}")
1350
1414
def GetAll(self, interface_name):
1351
1415
"""Standard D-Bus property GetAll() method, see D-Bus
1352
1416
standard.
1353
1417
1354
1418
Note: Will not include properties with access="write".
1355
1419
"""
1356
1420
properties = {}
1367
1431
properties[name] = value
1368
1432
continue
1369
1433
properties[name] = type(value)(
1370
value, variant_level = value.variant_level + 1)
1434
value, variant_level=value.variant_level + 1)
1371
1435
return dbus.Dictionary(properties, signature="sv")
1372
1436
1373
1437
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1374
1438
def PropertiesChanged(self, interface_name, changed_properties,
1375
1439
invalidated_properties):
1377
1441
standard.
1378
1442
"""
1379
1443
pass
1380
1444
1381
1445
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1382
1446
out_signature="s",
1383
1447
path_keyword='object_path',
1384
1448
connection_keyword='connection')
1385
1449
def Introspect(self, object_path, connection):
1386
1450
"""Overloading of standard D-Bus method.
1387
1451
1388
1452
Inserts property tags and interface annotation tags.
1389
1453
"""
1390
1454
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1392
1456
connection)
1393
1457
try:
1394
1458
document = xml.dom.minidom.parseString(xmlstring)
1395
1459
1396
1460
def make_tag(document, name, prop):
1397
1461
e = document.createElement("property")
1398
1462
e.setAttribute("name", name)
1399
1463
e.setAttribute("type", prop._dbus_signature)
1400
1464
e.setAttribute("access", prop._dbus_access)
1401
1465
return e
1402
1466
1403
1467
for if_tag in document.getElementsByTagName("interface"):
1404
1468
# Add property tags
1405
1469
for tag in (make_tag(document, name, prop)
1447
1511
exc_info=error)
1448
1512
return xmlstring
1449
1513
1514
1450
1515
try:
1451
1516
dbus.OBJECT_MANAGER_IFACE
1452
1517
except AttributeError:
1453
1518
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1454
1519
1520
1455
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1456
1522
"""A D-Bus object with an ObjectManager.
1457
1523
1458
1524
Classes inheriting from this exposes the standard
1459
1525
GetManagedObjects call and the InterfacesAdded and
1460
1526
InterfacesRemoved signals on the standard
1461
1527
"org.freedesktop.DBus.ObjectManager" interface.
1462
1528
1463
1529
Note: No signals are sent automatically; they must be sent
1464
1530
manually.
1465
1531
"""
1466
1532
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1467
out_signature = "a{oa{sa{sv}}}")
1533
out_signature="a{oa{sa{sv}}}")
1468
1534
def GetManagedObjects(self):
1469
1535
"""This function must be overridden"""
1470
1536
raise NotImplementedError()
1471
1537
1472
1538
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1473
signature = "oa{sa{sv}}")
1539
signature="oa{sa{sv}}")
1474
1540
def InterfacesAdded(self, object_path, interfaces_and_properties):
1475
1541
pass
1476
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1542
1543
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1478
1544
def InterfacesRemoved(self, object_path, interfaces):
1479
1545
pass
1480
1546
1481
1547
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1548
out_signature="s",
1549
path_keyword='object_path',
1550
connection_keyword='connection')
1485
1551
def Introspect(self, object_path, connection):
1486
1552
"""Overloading of standard D-Bus method.
1487
1553
1488
1554
Override return argument name of GetManagedObjects to be
1489
1555
"objpath_interfaces_and_properties"
1490
1556
"""
1493
1559
connection)
1494
1560
try:
1495
1561
document = xml.dom.minidom.parseString(xmlstring)
1496
1562
1497
1563
for if_tag in document.getElementsByTagName("interface"):
1498
1564
# Fix argument name for the GetManagedObjects method
1499
1565
if (if_tag.getAttribute("name")
1500
== dbus.OBJECT_MANAGER_IFACE):
1566
== dbus.OBJECT_MANAGER_IFACE):
1501
1567
for cn in if_tag.getElementsByTagName("method"):
1502
1568
if (cn.getAttribute("name")
1503
1569
== "GetManagedObjects"):
1513
1579
except (AttributeError, xml.dom.DOMException,
1514
1580
xml.parsers.expat.ExpatError) as error:
1515
1581
logger.error("Failed to override Introspection method",
1516
exc_info = error)
1582
exc_info=error)
1517
1583
return xmlstring
1518
1584
1585
1519
1586
def datetime_to_dbus(dt, variant_level=0):
1520
1587
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1521
1588
if dt is None:
1522
return dbus.String("", variant_level = variant_level)
1589
return dbus.String("", variant_level=variant_level)
1523
1590
return dbus.String(dt.isoformat(), variant_level=variant_level)
1524
1591
1525
1592
1528
1595
dbus.service.Object, it will add alternate D-Bus attributes with
1529
1596
interface names according to the "alt_interface_names" mapping.
1530
1597
Usage:
1531
1598
1532
1599
@alternate_dbus_interfaces({"org.example.Interface":
1533
1600
"net.example.AlternateInterface"})
1534
1601
class SampleDBusObject(dbus.service.Object):
1535
1602
@dbus.service.method("org.example.Interface")
1536
1603
def SampleDBusMethod():
1537
1604
pass
1538
1605
1539
1606
The above "SampleDBusMethod" on "SampleDBusObject" will be
1540
1607
reachable via two interfaces: "org.example.Interface" and
1541
1608
"net.example.AlternateInterface", the latter of which will have
1542
1609
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1543
1610
"true", unless "deprecate" is passed with a False value.
1544
1611
1545
1612
This works for methods and signals, and also for D-Bus properties
1546
1613
(from DBusObjectWithProperties) and interfaces (from the
1547
1614
dbus_interface_annotations decorator).
1548
1615
"""
1549
1616
1550
1617
def wrapper(cls):
1551
1618
for orig_interface_name, alt_interface_name in (
1552
1619
alt_interface_names.items()):
1592
1659
attribute._dbus_annotations)
1593
1660
except AttributeError:
1594
1661
pass
1662
1595
1663
# Define a creator of a function to call both the
1596
1664
# original and alternate functions, so both the
1597
1665
# original and alternate signals gets sent when
1600
1668
"""This function is a scope container to pass
1601
1669
func1 and func2 to the "call_both" function
1602
1670
outside of its arguments"""
1603
1671
1604
1672
@functools.wraps(func2)
1605
1673
def call_both(*args, **kwargs):
1606
1674
"""This function will emit two D-Bus
1607
1675
signals by calling func1 and func2"""
1608
1676
func1(*args, **kwargs)
1609
1677
func2(*args, **kwargs)
1610
# Make wrapper function look like a D-Bus signal
1678
# Make wrapper function look like a D-Bus
1679
# signal
1611
1680
for name, attr in inspect.getmembers(func2):
1612
1681
if name.startswith("_dbus_"):
1613
1682
setattr(call_both, name, attr)
1614
1683
1615
1684
return call_both
1616
1685
# Create the "call_both" function and add it to
1617
1686
# the class
1663
1732
(copy_function(attribute)))
1664
1733
if deprecate:
1665
1734
# Deprecate all alternate interfaces
1666
iname="_AlternateDBusNames_interface_annotation{}"
1735
iname = "_AlternateDBusNames_interface_annotation{}"
1667
1736
for interface_name in interface_names:
1668
1737
1669
1738
@dbus_interface_annotations(interface_name)
1670
1739
def func(self):
1671
return { "org.freedesktop.DBus.Deprecated":
1672
"true" }
1740
return {"org.freedesktop.DBus.Deprecated":
1741
"true"}
1673
1742
# Find an unused name
1674
1743
for aname in (iname.format(i)
1675
1744
for i in itertools.count()):
1686
1755
cls = type("{}Alternate".format(cls.__name__),
1687
1756
(cls, ), attr)
1688
1757
return cls
1689
1758
1690
1759
return wrapper
1691
1760
1692
1761
1694
1763
"se.bsnet.fukt.Mandos"})
1695
1764
class ClientDBus(Client, DBusObjectWithProperties):
1696
1765
"""A Client class using D-Bus
1697
1766
1698
1767
Attributes:
1699
1768
dbus_object_path: dbus.ObjectPath
1700
1769
bus: dbus.SystemBus()
1701
1770
"""
1702
1771
1703
1772
runtime_expansions = (Client.runtime_expansions
1704
1773
+ ("dbus_object_path", ))
1705
1774
1706
1775
_interface = "se.recompile.Mandos.Client"
1707
1776
1708
1777
# dbus.service.Object doesn't use super(), so we can't either.
1709
1710
def __init__(self, bus = None, *args, **kwargs):
1778
1779
def __init__(self, bus=None, *args, **kwargs):
1711
1780
self.bus = bus
1712
1781
Client.__init__(self, *args, **kwargs)
1713
1782
# Only now, when this client is initialized, can it show up on
1719
1788
"/clients/" + client_object_name)
1720
1789
DBusObjectWithProperties.__init__(self, self.bus,
1721
1790
self.dbus_object_path)
1722
1791
1723
1792
def notifychangeproperty(transform_func, dbus_name,
1724
1793
type_func=lambda x: x,
1725
1794
variant_level=1,
1727
1796
_interface=_interface):
1728
1797
""" Modify a variable so that it's a property which announces
1729
1798
its changes to DBus.
1730
1799
1731
1800
transform_fun: Function that takes a value and a variant_level
1732
1801
and transforms it to a D-Bus type.
1733
1802
dbus_name: D-Bus name of the variable
1736
1805
variant_level: D-Bus variant level. Default: 1
1737
1806
"""
1738
1807
attrname = "_{}".format(dbus_name)
1739
1808
1740
1809
def setter(self, value):
1741
1810
if hasattr(self, "dbus_object_path"):
1742
1811
if (not hasattr(self, attrname) or
1749
1818
else:
1750
1819
dbus_value = transform_func(
1751
1820
type_func(value),
1752
variant_level = variant_level)
1821
variant_level=variant_level)
1753
1822
self.PropertyChanged(dbus.String(dbus_name),
1754
1823
dbus_value)
1755
1824
self.PropertiesChanged(
1756
1825
_interface,
1757
dbus.Dictionary({ dbus.String(dbus_name):
1758
dbus_value }),
1826
dbus.Dictionary({dbus.String(dbus_name):
1827
dbus_value}),
1759
1828
dbus.Array())
1760
1829
setattr(self, attrname, value)
1761
1830
1762
1831
return property(lambda self: getattr(self, attrname), setter)
1763
1832
1764
1833
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1765
1834
approvals_pending = notifychangeproperty(dbus.Boolean,
1766
1835
"ApprovalPending",
1767
type_func = bool)
1836
type_func=bool)
1768
1837
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1769
1838
last_enabled = notifychangeproperty(datetime_to_dbus,
1770
1839
"LastEnabled")
1771
1840
checker = notifychangeproperty(
1772
1841
dbus.Boolean, "CheckerRunning",
1773
type_func = lambda checker: checker is not None)
1842
type_func=lambda checker: checker is not None)
1774
1843
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1775
1844
"LastCheckedOK")
1776
1845
last_checker_status = notifychangeproperty(dbus.Int16,
1781
1850
"ApprovedByDefault")
1782
1851
approval_delay = notifychangeproperty(
1783
1852
dbus.UInt64, "ApprovalDelay",
1784
type_func = lambda td: td.total_seconds() * 1000)
1853
type_func=lambda td: td.total_seconds() * 1000)
1785
1854
approval_duration = notifychangeproperty(
1786
1855
dbus.UInt64, "ApprovalDuration",
1787
type_func = lambda td: td.total_seconds() * 1000)
1856
type_func=lambda td: td.total_seconds() * 1000)
1788
1857
host = notifychangeproperty(dbus.String, "Host")
1789
1858
timeout = notifychangeproperty(
1790
1859
dbus.UInt64, "Timeout",
1791
type_func = lambda td: td.total_seconds() * 1000)
1860
type_func=lambda td: td.total_seconds() * 1000)
1792
1861
extended_timeout = notifychangeproperty(
1793
1862
dbus.UInt64, "ExtendedTimeout",
1794
type_func = lambda td: td.total_seconds() * 1000)
1863
type_func=lambda td: td.total_seconds() * 1000)
1795
1864
interval = notifychangeproperty(
1796
1865
dbus.UInt64, "Interval",
1797
type_func = lambda td: td.total_seconds() * 1000)
1866
type_func=lambda td: td.total_seconds() * 1000)
1798
1867
checker_command = notifychangeproperty(dbus.String, "Checker")
1799
1868
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1800
1869
invalidate_only=True)
1801
1870
1802
1871
del notifychangeproperty
1803
1872
1804
1873
def __del__(self, *args, **kwargs):
1805
1874
try:
1806
1875
self.remove_from_connection()
1809
1878
if hasattr(DBusObjectWithProperties, "__del__"):
1810
1879
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1811
1880
Client.__del__(self, *args, **kwargs)
1812
1881
1813
1882
def checker_callback(self, source, condition,
1814
1883
connection, command, *args, **kwargs):
1815
1884
ret = Client.checker_callback(self, source, condition,
1831
1900
| self.last_checker_signal),
1832
1901
dbus.String(command))
1833
1902
return ret
1834
1903
1835
1904
def start_checker(self, *args, **kwargs):
1836
1905
old_checker_pid = getattr(self.checker, "pid", None)
1837
1906
r = Client.start_checker(self, *args, **kwargs)
1841
1910
# Emit D-Bus signal
1842
1911
self.CheckerStarted(self.current_checker_command)
1843
1912
return r
1844
1913
1845
1914
def _reset_approved(self):
1846
1915
self.approved = None
1847
1916
return False
1848
1917
1849
1918
def approve(self, value=True):
1850
1919
self.approved = value
1851
1920
GLib.timeout_add(int(self.approval_duration.total_seconds()
1852
1921
* 1000), self._reset_approved)
1853
1922
self.send_changedstate()
1854
1855
## D-Bus methods, signals & properties
1856
1857
## Interfaces
1858
1859
## Signals
1860
1923
1924
# D-Bus methods, signals & properties
1925
1926
# Interfaces
1927
1928
# Signals
1929
1861
1930
# CheckerCompleted - signal
1862
1931
@dbus.service.signal(_interface, signature="nxs")
1863
1932
def CheckerCompleted(self, exitcode, waitstatus, command):
1864
1933
"D-Bus signal"
1865
1934
pass
1866
1935
1867
1936
# CheckerStarted - signal
1868
1937
@dbus.service.signal(_interface, signature="s")
1869
1938
def CheckerStarted(self, command):
1870
1939
"D-Bus signal"
1871
1940
pass
1872
1941
1873
1942
# PropertyChanged - signal
1874
1943
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1875
1944
@dbus.service.signal(_interface, signature="sv")
1876
1945
def PropertyChanged(self, property, value):
1877
1946
"D-Bus signal"
1878
1947
pass
1879
1948
1880
1949
# GotSecret - signal
1881
1950
@dbus.service.signal(_interface)
1882
1951
def GotSecret(self):
1885
1954
server to mandos-client
1886
1955
"""
1887
1956
pass
1888
1957
1889
1958
# Rejected - signal
1890
1959
@dbus.service.signal(_interface, signature="s")
1891
1960
def Rejected(self, reason):
1892
1961
"D-Bus signal"
1893
1962
pass
1894
1963
1895
1964
# NeedApproval - signal
1896
1965
@dbus.service.signal(_interface, signature="tb")
1897
1966
def NeedApproval(self, timeout, default):
1898
1967
"D-Bus signal"
1899
1968
return self.need_approval()
1900
1901
## Methods
1902
1969
1970
# Methods
1971
1903
1972
# Approve - method
1904
1973
@dbus.service.method(_interface, in_signature="b")
1905
1974
def Approve(self, value):
1906
1975
self.approve(value)
1907
1976
1908
1977
# CheckedOK - method
1909
1978
@dbus.service.method(_interface)
1910
1979
def CheckedOK(self):
1911
1980
self.checked_ok()
1912
1981
1913
1982
# Enable - method
1914
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1915
1984
@dbus.service.method(_interface)
1916
1985
def Enable(self):
1917
1986
"D-Bus method"
1918
1987
self.enable()
1919
1988
1920
1989
# StartChecker - method
1921
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1922
1991
@dbus.service.method(_interface)
1923
1992
def StartChecker(self):
1924
1993
"D-Bus method"
1925
1994
self.start_checker()
1926
1995
1927
1996
# Disable - method
1928
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1929
1998
@dbus.service.method(_interface)
1930
1999
def Disable(self):
1931
2000
"D-Bus method"
1932
2001
self.disable()
1933
2002
1934
2003
# StopChecker - method
1935
2004
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1936
2005
@dbus.service.method(_interface)
1937
2006
def StopChecker(self):
1938
2007
self.stop_checker()
1939
1940
## Properties
1941
2008
2009
# Properties
2010
1942
2011
# ApprovalPending - property
1943
2012
@dbus_service_property(_interface, signature="b", access="read")
1944
2013
def ApprovalPending_dbus_property(self):
1945
2014
return dbus.Boolean(bool(self.approvals_pending))
1946
2015
1947
2016
# ApprovedByDefault - property
1948
2017
@dbus_service_property(_interface,
1949
2018
signature="b",
1952
2021
if value is None: # get
1953
2022
return dbus.Boolean(self.approved_by_default)
1954
2023
self.approved_by_default = bool(value)
1955
2024
1956
2025
# ApprovalDelay - property
1957
2026
@dbus_service_property(_interface,
1958
2027
signature="t",
1962
2031
return dbus.UInt64(self.approval_delay.total_seconds()
1963
2032
* 1000)
1964
2033
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1965
2034
1966
2035
# ApprovalDuration - property
1967
2036
@dbus_service_property(_interface,
1968
2037
signature="t",
1972
2041
return dbus.UInt64(self.approval_duration.total_seconds()
1973
2042
* 1000)
1974
2043
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1975
2044
1976
2045
# Name - property
1977
2046
@dbus_annotations(
1978
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1979
2048
@dbus_service_property(_interface, signature="s", access="read")
1980
2049
def Name_dbus_property(self):
1981
2050
return dbus.String(self.name)
1982
2051
2052
# KeyID - property
2053
@dbus_annotations(
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2055
@dbus_service_property(_interface, signature="s", access="read")
2056
def KeyID_dbus_property(self):
2057
return dbus.String(self.key_id)
2058
1983
2059
# Fingerprint - property
1984
2060
@dbus_annotations(
1985
2061
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
2062
@dbus_service_property(_interface, signature="s", access="read")
1987
2063
def Fingerprint_dbus_property(self):
1988
2064
return dbus.String(self.fingerprint)
1989
2065
1990
2066
# Host - property
1991
2067
@dbus_service_property(_interface,
1992
2068
signature="s",
1995
2071
if value is None: # get
1996
2072
return dbus.String(self.host)
1997
2073
self.host = str(value)
1998
2074
1999
2075
# Created - property
2000
2076
@dbus_annotations(
2001
2077
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2002
2078
@dbus_service_property(_interface, signature="s", access="read")
2003
2079
def Created_dbus_property(self):
2004
2080
return datetime_to_dbus(self.created)
2005
2081
2006
2082
# LastEnabled - property
2007
2083
@dbus_service_property(_interface, signature="s", access="read")
2008
2084
def LastEnabled_dbus_property(self):
2009
2085
return datetime_to_dbus(self.last_enabled)
2010
2086
2011
2087
# Enabled - property
2012
2088
@dbus_service_property(_interface,
2013
2089
signature="b",
2019
2095
self.enable()
2020
2096
else:
2021
2097
self.disable()
2022
2098
2023
2099
# LastCheckedOK - property
2024
2100
@dbus_service_property(_interface,
2025
2101
signature="s",
2029
2105
self.checked_ok()
2030
2106
return
2031
2107
return datetime_to_dbus(self.last_checked_ok)
2032
2108
2033
2109
# LastCheckerStatus - property
2034
2110
@dbus_service_property(_interface, signature="n", access="read")
2035
2111
def LastCheckerStatus_dbus_property(self):
2036
2112
return dbus.Int16(self.last_checker_status)
2037
2113
2038
2114
# Expires - property
2039
2115
@dbus_service_property(_interface, signature="s", access="read")
2040
2116
def Expires_dbus_property(self):
2041
2117
return datetime_to_dbus(self.expires)
2042
2118
2043
2119
# LastApprovalRequest - property
2044
2120
@dbus_service_property(_interface, signature="s", access="read")
2045
2121
def LastApprovalRequest_dbus_property(self):
2046
2122
return datetime_to_dbus(self.last_approval_request)
2047
2123
2048
2124
# Timeout - property
2049
2125
@dbus_service_property(_interface,
2050
2126
signature="t",
2069
2145
self.disable_initiator_tag = GLib.timeout_add(
2070
2146
int((self.expires - now).total_seconds() * 1000),
2071
2147
self.disable)
2072
2148
2073
2149
# ExtendedTimeout - property
2074
2150
@dbus_service_property(_interface,
2075
2151
signature="t",
2079
2155
return dbus.UInt64(self.extended_timeout.total_seconds()
2080
2156
* 1000)
2081
2157
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2082
2158
2083
2159
# Interval - property
2084
2160
@dbus_service_property(_interface,
2085
2161
signature="t",
2095
2171
GLib.source_remove(self.checker_initiator_tag)
2096
2172
self.checker_initiator_tag = GLib.timeout_add(
2097
2173
value, self.start_checker)
2098
self.start_checker() # Start one now, too
2099
2174
self.start_checker() # Start one now, too
2175
2100
2176
# Checker - property
2101
2177
@dbus_service_property(_interface,
2102
2178
signature="s",
2105
2181
if value is None: # get
2106
2182
return dbus.String(self.checker_command)
2107
2183
self.checker_command = str(value)
2108
2184
2109
2185
# CheckerRunning - property
2110
2186
@dbus_service_property(_interface,
2111
2187
signature="b",
2117
2193
self.start_checker()
2118
2194
else:
2119
2195
self.stop_checker()
2120
2196
2121
2197
# ObjectPath - property
2122
2198
@dbus_annotations(
2123
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2124
2200
"org.freedesktop.DBus.Deprecated": "true"})
2125
2201
@dbus_service_property(_interface, signature="o", access="read")
2126
2202
def ObjectPath_dbus_property(self):
2127
return self.dbus_object_path # is already a dbus.ObjectPath
2128
2203
return self.dbus_object_path # is already a dbus.ObjectPath
2204
2129
2205
# Secret = property
2130
2206
@dbus_annotations(
2131
2207
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2136
2212
byte_arrays=True)
2137
2213
def Secret_dbus_property(self, value):
2138
2214
self.secret = bytes(value)
2139
2215
2140
2216
del _interface
2141
2217
2142
2218
2143
class ProxyClient(object):
2144
def __init__(self, child_pipe, fpr, address):
2219
class ProxyClient:
2220
def __init__(self, child_pipe, key_id, fpr, address):
2145
2221
self._pipe = child_pipe
2146
self._pipe.send(('init', fpr, address))
2222
self._pipe.send(('init', key_id, fpr, address))
2147
2223
if not self._pipe.recv():
2148
raise KeyError(fpr)
2149
2224
raise KeyError(key_id or fpr)
2225
2150
2226
def __getattribute__(self, name):
2151
2227
if name == '_pipe':
2152
2228
return super(ProxyClient, self).__getattribute__(name)
2155
2231
if data[0] == 'data':
2156
2232
return data[1]
2157
2233
if data[0] == 'function':
2158
2234
2159
2235
def func(*args, **kwargs):
2160
2236
self._pipe.send(('funcall', name, args, kwargs))
2161
2237
return self._pipe.recv()[1]
2162
2238
2163
2239
return func
2164
2240
2165
2241
def __setattr__(self, name, value):
2166
2242
if name == '_pipe':
2167
2243
return super(ProxyClient, self).__setattr__(name, value)
2170
2246
2171
2247
class ClientHandler(socketserver.BaseRequestHandler, object):
2172
2248
"""A class to handle client connections.
2173
2249
2174
2250
Instantiated once for each connection to handle it.
2175
2251
Note: This will run in its own forked process."""
2176
2252
2177
2253
def handle(self):
2178
2254
with contextlib.closing(self.server.child_pipe) as child_pipe:
2179
2255
logger.info("TCP connection from: %s",
2180
2256
str(self.client_address))
2181
2257
logger.debug("Pipe FD: %d",
2182
2258
self.server.child_pipe.fileno())
2183
2259
2184
2260
session = gnutls.ClientSession(self.request)
2185
2186
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
# "+AES-256-CBC", "+SHA1",
2188
# "+COMP-NULL", "+CTYPE-OPENPGP",
2189
# "+DHE-DSS"))
2261
2262
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2263
# "+AES-256-CBC", "+SHA1",
2264
# "+COMP-NULL", "+CTYPE-OPENPGP",
2265
# "+DHE-DSS"))
2190
2266
# Use a fallback default, since this MUST be set.
2191
2267
priority = self.server.gnutls_priority
2192
2268
if priority is None:
2194
2270
gnutls.priority_set_direct(session._c_object,
2195
2271
priority.encode("utf-8"),
2196
2272
None)
2197
2273
2198
2274
# Start communication using the Mandos protocol
2199
2275
# Get protocol number
2200
2276
line = self.request.makefile().readline()
2205
2281
except (ValueError, IndexError, RuntimeError) as error:
2206
2282
logger.error("Unknown protocol version: %s", error)
2207
2283
return
2208
2284
2209
2285
# Start GnuTLS connection
2210
2286
try:
2211
2287
session.handshake()
2215
2291
# established. Just abandon the request.
2216
2292
return
2217
2293
logger.debug("Handshake succeeded")
2218
2294
2219
2295
approval_required = False
2220
2296
try:
2221
try:
2222
fpr = self.fingerprint(
2223
self.peer_certificate(session))
2224
except (TypeError, gnutls.Error) as error:
2225
logger.warning("Bad certificate: %s", error)
2226
return
2227
logger.debug("Fingerprint: %s", fpr)
2228
2229
try:
2230
client = ProxyClient(child_pipe, fpr,
2297
if gnutls.has_rawpk:
2298
fpr = b""
2299
try:
2300
key_id = self.key_id(
2301
self.peer_certificate(session))
2302
except (TypeError, gnutls.Error) as error:
2303
logger.warning("Bad certificate: %s", error)
2304
return
2305
logger.debug("Key ID: %s", key_id)
2306
2307
else:
2308
key_id = b""
2309
try:
2310
fpr = self.fingerprint(
2311
self.peer_certificate(session))
2312
except (TypeError, gnutls.Error) as error:
2313
logger.warning("Bad certificate: %s", error)
2314
return
2315
logger.debug("Fingerprint: %s", fpr)
2316
2317
try:
2318
client = ProxyClient(child_pipe, key_id, fpr,
2231
2319
self.client_address)
2232
2320
except KeyError:
2233
2321
return
2234
2322
2235
2323
if client.approval_delay:
2236
2324
delay = client.approval_delay
2237
2325
client.approvals_pending += 1
2238
2326
approval_required = True
2239
2327
2240
2328
while True:
2241
2329
if not client.enabled:
2242
2330
logger.info("Client %s is disabled",
2245
2333
# Emit D-Bus signal
2246
2334
client.Rejected("Disabled")
2247
2335
return
2248
2336
2249
2337
if client.approved or not client.approval_delay:
2250
#We are approved or approval is disabled
2338
# We are approved or approval is disabled
2251
2339
break
2252
2340
elif client.approved is None:
2253
2341
logger.info("Client %s needs approval",
2264
2352
# Emit D-Bus signal
2265
2353
client.Rejected("Denied")
2266
2354
return
2267
2268
#wait until timeout or approved
2355
2356
# wait until timeout or approved
2269
2357
time = datetime.datetime.now()
2270
2358
client.changedstate.acquire()
2271
2359
client.changedstate.wait(delay.total_seconds())
2284
2372
break
2285
2373
else:
2286
2374
delay -= time2 - time
2287
2375
2288
2376
try:
2289
2377
session.send(client.secret)
2290
2378
except gnutls.Error as error:
2291
2379
logger.warning("gnutls send failed",
2292
exc_info = error)
2380
exc_info=error)
2293
2381
return
2294
2382
2295
2383
logger.info("Sending secret to %s", client.name)
2296
2384
# bump the timeout using extended_timeout
2297
2385
client.bump_timeout(client.extended_timeout)
2298
2386
if self.server.use_dbus:
2299
2387
# Emit D-Bus signal
2300
2388
client.GotSecret()
2301
2389
2302
2390
finally:
2303
2391
if approval_required:
2304
2392
client.approvals_pending -= 1
2307
2395
except gnutls.Error as error:
2308
2396
logger.warning("GnuTLS bye failed",
2309
2397
exc_info=error)
2310
2398
2311
2399
@staticmethod
2312
2400
def peer_certificate(session):
2313
"Return the peer's OpenPGP certificate as a bytestring"
2314
# If not an OpenPGP certificate...
2315
if (gnutls.certificate_type_get(session._c_object)
2316
!= gnutls.CRT_OPENPGP):
2401
"Return the peer's certificate as a bytestring"
2402
try:
2403
cert_type = gnutls.certificate_type_get2(session._c_object,
2404
gnutls.CTYPE_PEERS)
2405
except AttributeError:
2406
cert_type = gnutls.certificate_type_get(session._c_object)
2407
if gnutls.has_rawpk:
2408
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2409
else:
2410
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2411
# If not a valid certificate type...
2412
if cert_type not in valid_cert_types:
2413
logger.info("Cert type %r not in %r", cert_type,
2414
valid_cert_types)
2317
2415
# ...return invalid data
2318
2416
return b""
2319
2417
list_size = ctypes.c_uint(1)
2325
2423
return None
2326
2424
cert = cert_list[0]
2327
2425
return ctypes.string_at(cert.data, cert.size)
2328
2426
2427
@staticmethod
2428
def key_id(certificate):
2429
"Convert a certificate bytestring to a hexdigit key ID"
2430
# New GnuTLS "datum" with the public key
2431
datum = gnutls.datum_t(
2432
ctypes.cast(ctypes.c_char_p(certificate),
2433
ctypes.POINTER(ctypes.c_ubyte)),
2434
ctypes.c_uint(len(certificate)))
2435
# XXX all these need to be created in the gnutls "module"
2436
# New empty GnuTLS certificate
2437
pubkey = gnutls.pubkey_t()
2438
gnutls.pubkey_init(ctypes.byref(pubkey))
2439
# Import the raw public key into the certificate
2440
gnutls.pubkey_import(pubkey,
2441
ctypes.byref(datum),
2442
gnutls.X509_FMT_DER)
2443
# New buffer for the key ID
2444
buf = ctypes.create_string_buffer(32)
2445
buf_len = ctypes.c_size_t(len(buf))
2446
# Get the key ID from the raw public key into the buffer
2447
gnutls.pubkey_get_key_id(pubkey,
2448
gnutls.KEYID_USE_SHA256,
2449
ctypes.cast(ctypes.byref(buf),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.byref(buf_len))
2452
# Deinit the certificate
2453
gnutls.pubkey_deinit(pubkey)
2454
2455
# Convert the buffer to a Python bytestring
2456
key_id = ctypes.string_at(buf, buf_len.value)
2457
# Convert the bytestring to hexadecimal notation
2458
hex_key_id = binascii.hexlify(key_id).upper()
2459
return hex_key_id
2460
2329
2461
@staticmethod
2330
2462
def fingerprint(openpgp):
2331
2463
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2346
2478
ctypes.byref(crtverify))
2347
2479
if crtverify.value != 0:
2348
2480
gnutls.openpgp_crt_deinit(crt)
2349
raise gnutls.CertificateSecurityError("Verify failed")
2481
raise gnutls.CertificateSecurityError(code
2482
=crtverify.value)
2350
2483
# New buffer for the fingerprint
2351
2484
buf = ctypes.create_string_buffer(20)
2352
2485
buf_len = ctypes.c_size_t()
2362
2495
return hex_fpr
2363
2496
2364
2497
2365
class MultiprocessingMixIn(object):
2498
class MultiprocessingMixIn:
2366
2499
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2367
2500
2368
2501
def sub_process_main(self, request, address):
2369
2502
try:
2370
2503
self.finish_request(request, address)
2371
2504
except Exception:
2372
2505
self.handle_error(request, address)
2373
2506
self.close_request(request)
2374
2507
2375
2508
def process_request(self, request, address):
2376
2509
"""Start a new process to process the request."""
2377
proc = multiprocessing.Process(target = self.sub_process_main,
2378
args = (request, address))
2510
proc = multiprocessing.Process(target=self.sub_process_main,
2511
args=(request, address))
2379
2512
proc.start()
2380
2513
return proc
2381
2514
2382
2515
2383
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2384
2517
""" adds a pipe to the MixIn """
2385
2518
2386
2519
def process_request(self, request, client_address):
2387
2520
"""Overrides and wraps the original process_request().
2388
2521
2389
2522
This function creates a new pipe in self.pipe
2390
2523
"""
2391
2524
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2392
2525
2393
2526
proc = MultiprocessingMixIn.process_request(self, request,
2394
2527
client_address)
2395
2528
self.child_pipe.close()
2396
2529
self.add_pipe(parent_pipe, proc)
2397
2530
2398
2531
def add_pipe(self, parent_pipe, proc):
2399
2532
"""Dummy function; override as necessary"""
2400
2533
raise NotImplementedError()
2401
2534
2402
2535
2403
2536
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2404
socketserver.TCPServer, object):
2537
socketserver.TCPServer):
2405
2538
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2406
2539
2407
2540
Attributes:
2408
2541
enabled: Boolean; whether this server is activated yet
2409
2542
interface: None or a network interface name (string)
2410
2543
use_ipv6: Boolean; to use IPv6 or not
2411
2544
"""
2412
2545
2413
2546
def __init__(self, server_address, RequestHandlerClass,
2414
2547
interface=None,
2415
2548
use_ipv6=True,
2425
2558
self.socketfd = socketfd
2426
2559
# Save the original socket.socket() function
2427
2560
self.socket_socket = socket.socket
2561
2428
2562
# To implement --socket, we monkey patch socket.socket.
2429
#
2563
#
2430
2564
# (When socketserver.TCPServer is a new-style class, we
2431
2565
# could make self.socket into a property instead of monkey
2432
2566
# patching socket.socket.)
2433
#
2567
#
2434
2568
# Create a one-time-only replacement for socket.socket()
2435
2569
@functools.wraps(socket.socket)
2436
2570
def socket_wrapper(*args, **kwargs):
2448
2582
# socket_wrapper(), if socketfd was set.
2449
2583
socketserver.TCPServer.__init__(self, server_address,
2450
2584
RequestHandlerClass)
2451
2585
2452
2586
def server_bind(self):
2453
2587
"""This overrides the normal server_bind() function
2454
2588
to bind to an interface if one was specified, and also NOT to
2455
2589
bind to an address or port if they were not specified."""
2590
global SO_BINDTODEVICE
2456
2591
if self.interface is not None:
2457
2592
if SO_BINDTODEVICE is None:
2458
2593
# Fall back to a hard-coded value which seems to be
2478
2613
raise
2479
2614
# Only bind(2) the socket if we really need to.
2480
2615
if self.server_address[0] or self.server_address[1]:
2616
if self.server_address[1]:
2617
self.allow_reuse_address = True
2481
2618
if not self.server_address[0]:
2482
2619
if self.address_family == socket.AF_INET6:
2483
any_address = "::" # in6addr_any
2620
any_address = "::" # in6addr_any
2484
2621
else:
2485
any_address = "0.0.0.0" # INADDR_ANY
2622
any_address = "0.0.0.0" # INADDR_ANY
2486
2623
self.server_address = (any_address,
2487
2624
self.server_address[1])
2488
2625
elif not self.server_address[1]:
2498
2635
2499
2636
class MandosServer(IPv6_TCPServer):
2500
2637
"""Mandos server.
2501
2638
2502
2639
Attributes:
2503
2640
clients: set of Client objects
2504
2641
gnutls_priority GnuTLS priority string
2505
2642
use_dbus: Boolean; to emit D-Bus signals or not
2506
2643
2507
2644
Assumes a GLib.MainLoop event loop.
2508
2645
"""
2509
2646
2510
2647
def __init__(self, server_address, RequestHandlerClass,
2511
2648
interface=None,
2512
2649
use_ipv6=True,
2522
2659
self.gnutls_priority = gnutls_priority
2523
2660
IPv6_TCPServer.__init__(self, server_address,
2524
2661
RequestHandlerClass,
2525
interface = interface,
2526
use_ipv6 = use_ipv6,
2527
socketfd = socketfd)
2528
2662
interface=interface,
2663
use_ipv6=use_ipv6,
2664
socketfd=socketfd)
2665
2529
2666
def server_activate(self):
2530
2667
if self.enabled:
2531
2668
return socketserver.TCPServer.server_activate(self)
2532
2669
2533
2670
def enable(self):
2534
2671
self.enabled = True
2535
2672
2536
2673
def add_pipe(self, parent_pipe, proc):
2537
2674
# Call "handle_ipc" for both data and EOF events
2538
2675
GLib.io_add_watch(
2539
2676
parent_pipe.fileno(),
2540
2677
GLib.IO_IN | GLib.IO_HUP,
2541
2678
functools.partial(self.handle_ipc,
2542
parent_pipe = parent_pipe,
2543
proc = proc))
2544
2679
parent_pipe=parent_pipe,
2680
proc=proc))
2681
2545
2682
def handle_ipc(self, source, condition,
2546
2683
parent_pipe=None,
2547
proc = None,
2684
proc=None,
2548
2685
client_object=None):
2549
2686
# error, or the other end of multiprocessing.Pipe has closed
2550
2687
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2551
2688
# Wait for other process to exit
2552
2689
proc.join()
2553
2690
return False
2554
2691
2555
2692
# Read a request from the child
2556
2693
request = parent_pipe.recv()
2557
2694
command = request[0]
2558
2695
2559
2696
if command == 'init':
2560
fpr = request[1]
2561
address = request[2]
2562
2697
key_id = request[1].decode("ascii")
2698
fpr = request[2].decode("ascii")
2699
address = request[3]
2700
2563
2701
for c in self.clients.values():
2564
if c.fingerprint == fpr:
2702
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2703
continue
2704
if key_id and c.key_id == key_id:
2705
client = c
2706
break
2707
if fpr and c.fingerprint == fpr:
2565
2708
client = c
2566
2709
break
2567
2710
else:
2568
logger.info("Client not found for fingerprint: %s, ad"
2569
"dress: %s", fpr, address)
2711
logger.info("Client not found for key ID: %s, address"
2712
": %s", key_id or fpr, address)
2570
2713
if self.use_dbus:
2571
2714
# Emit D-Bus signal
2572
mandos_dbus_service.ClientNotFound(fpr,
2715
mandos_dbus_service.ClientNotFound(key_id or fpr,
2573
2716
address[0])
2574
2717
parent_pipe.send(False)
2575
2718
return False
2576
2719
2577
2720
GLib.io_add_watch(
2578
2721
parent_pipe.fileno(),
2579
2722
GLib.IO_IN | GLib.IO_HUP,
2580
2723
functools.partial(self.handle_ipc,
2581
parent_pipe = parent_pipe,
2582
proc = proc,
2583
client_object = client))
2724
parent_pipe=parent_pipe,
2725
proc=proc,
2726
client_object=client))
2584
2727
parent_pipe.send(True)
2585
2728
# remove the old hook in favor of the new above hook on
2586
2729
# same fileno
2589
2732
funcname = request[1]
2590
2733
args = request[2]
2591
2734
kwargs = request[3]
2592
2735
2593
2736
parent_pipe.send(('data', getattr(client_object,
2594
2737
funcname)(*args,
2595
2738
**kwargs)))
2596
2739
2597
2740
if command == 'getattr':
2598
2741
attrname = request[1]
2599
2742
if isinstance(client_object.__getattribute__(attrname),
2602
2745
else:
2603
2746
parent_pipe.send((
2604
2747
'data', client_object.__getattribute__(attrname)))
2605
2748
2606
2749
if command == 'setattr':
2607
2750
attrname = request[1]
2608
2751
value = request[2]
2609
2752
setattr(client_object, attrname, value)
2610
2753
2611
2754
return True
2612
2755
2613
2756
2614
2757
def rfc3339_duration_to_delta(duration):
2615
2758
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2616
2759
2617
2760
>>> rfc3339_duration_to_delta("P7D")
2618
2761
datetime.timedelta(7)
2619
2762
>>> rfc3339_duration_to_delta("PT60S")
2629
2772
>>> rfc3339_duration_to_delta("P1DT3M20S")
2630
2773
datetime.timedelta(1, 200)
2631
2774
"""
2632
2775
2633
2776
# Parsing an RFC 3339 duration with regular expressions is not
2634
2777
# possible - there would have to be multiple places for the same
2635
2778
# values, like seconds. The current code, while more esoteric, is
2636
2779
# cleaner without depending on a parsing library. If Python had a
2637
2780
# built-in library for parsing we would use it, but we'd like to
2638
2781
# avoid excessive use of external libraries.
2639
2782
2640
2783
# New type for defining tokens, syntax, and semantics all-in-one
2641
2784
Token = collections.namedtuple("Token", (
2642
2785
"regexp", # To match token; if "value" is not None, must have
2675
2818
frozenset((token_year, token_month,
2676
2819
token_day, token_time,
2677
2820
token_week)))
2678
# Define starting values
2679
value = datetime.timedelta() # Value so far
2821
# Define starting values:
2822
# Value so far
2823
value = datetime.timedelta()
2680
2824
found_token = None
2681
followers = frozenset((token_duration, )) # Following valid tokens
2682
s = duration # String left to parse
2825
# Following valid tokens
2826
followers = frozenset((token_duration, ))
2827
# String left to parse
2828
s = duration
2683
2829
# Loop until end token is found
2684
2830
while found_token is not token_end:
2685
2831
# Search for any currently valid tokens
2709
2855
2710
2856
def string_to_delta(interval):
2711
2857
"""Parse a string and return a datetime.timedelta
2712
2858
2713
2859
>>> string_to_delta('7d')
2714
2860
datetime.timedelta(7)
2715
2861
>>> string_to_delta('60s')
2723
2869
>>> string_to_delta('5m 30s')
2724
2870
datetime.timedelta(0, 330)
2725
2871
"""
2726
2872
2727
2873
try:
2728
2874
return rfc3339_duration_to_delta(interval)
2729
2875
except ValueError:
2730
2876
pass
2731
2877
2732
2878
timevalue = datetime.timedelta(0)
2733
2879
for s in interval.split():
2734
2880
try:
2752
2898
return timevalue
2753
2899
2754
2900
2755
def daemon(nochdir = False, noclose = False):
2901
def daemon(nochdir=False, noclose=False):
2756
2902
"""See daemon(3). Standard BSD Unix function.
2757
2903
2758
2904
This should really exist as os.daemon, but it doesn't (yet)."""
2759
2905
if os.fork():
2760
2906
sys.exit()
2778
2924
2779
2925
2780
2926
def main():
2781
2927
2782
2928
##################################################################
2783
2929
# Parsing of options, both command line and config file
2784
2930
2785
2931
parser = argparse.ArgumentParser()
2786
2932
parser.add_argument("-v", "--version", action="version",
2787
version = "%(prog)s {}".format(version),
2933
version="%(prog)s {}".format(version),
2788
2934
help="show version number and exit")
2789
2935
parser.add_argument("-i", "--interface", metavar="IF",
2790
2936
help="Bind to interface IF")
2826
2972
parser.add_argument("--no-zeroconf", action="store_false",
2827
2973
dest="zeroconf", help="Do not use Zeroconf",
2828
2974
default=None)
2829
2975
2830
2976
options = parser.parse_args()
2831
2977
2832
2978
if options.check:
2833
2979
import doctest
2834
2980
fail_count, test_count = doctest.testmod()
2835
2981
sys.exit(os.EX_OK if fail_count == 0 else 1)
2836
2982
2837
2983
# Default values for config file for server-global settings
2838
server_defaults = { "interface": "",
2839
"address": "",
2840
"port": "",
2841
"debug": "False",
2842
"priority":
2843
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2844
":+SIGN-DSA-SHA256",
2845
"servicename": "Mandos",
2846
"use_dbus": "True",
2847
"use_ipv6": "True",
2848
"debuglevel": "",
2849
"restore": "True",
2850
"socket": "",
2851
"statedir": "/var/lib/mandos",
2852
"foreground": "False",
2853
"zeroconf": "True",
2854
}
2855
2984
if gnutls.has_rawpk:
2985
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2986
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2987
else:
2988
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2989
":+SIGN-DSA-SHA256")
2990
server_defaults = {"interface": "",
2991
"address": "",
2992
"port": "",
2993
"debug": "False",
2994
"priority": priority,
2995
"servicename": "Mandos",
2996
"use_dbus": "True",
2997
"use_ipv6": "True",
2998
"debuglevel": "",
2999
"restore": "True",
3000
"socket": "",
3001
"statedir": "/var/lib/mandos",
3002
"foreground": "False",
3003
"zeroconf": "True",
3004
}
3005
del priority
3006
2856
3007
# Parse config file for server-global settings
2857
server_config = configparser.SafeConfigParser(server_defaults)
3008
server_config = configparser.ConfigParser(server_defaults)
2858
3009
del server_defaults
2859
3010
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2860
# Convert the SafeConfigParser object to a dict
3011
# Convert the ConfigParser object to a dict
2861
3012
server_settings = server_config.defaults()
2862
3013
# Use the appropriate methods on the non-string config options
2863
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3014
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3015
"foreground", "zeroconf"):
2864
3016
server_settings[option] = server_config.getboolean("DEFAULT",
2865
3017
option)
2866
3018
if server_settings["port"]:
2876
3028
server_settings["socket"] = os.dup(server_settings
2877
3029
["socket"])
2878
3030
del server_config
2879
3031
2880
3032
# Override the settings from the config file with command line
2881
3033
# options, if set.
2882
3034
for option in ("interface", "address", "port", "debug",
2900
3052
if server_settings["debug"]:
2901
3053
server_settings["foreground"] = True
2902
3054
# Now we have our good server settings in "server_settings"
2903
3055
2904
3056
##################################################################
2905
3057
2906
3058
if (not server_settings["zeroconf"]
2907
3059
and not (server_settings["port"]
2908
3060
or server_settings["socket"] != "")):
2909
3061
parser.error("Needs port or socket to work without Zeroconf")
2910
3062
2911
3063
# For convenience
2912
3064
debug = server_settings["debug"]
2913
3065
debuglevel = server_settings["debuglevel"]
2917
3069
stored_state_file)
2918
3070
foreground = server_settings["foreground"]
2919
3071
zeroconf = server_settings["zeroconf"]
2920
3072
2921
3073
if debug:
2922
3074
initlogger(debug, logging.DEBUG)
2923
3075
else:
2926
3078
else:
2927
3079
level = getattr(logging, debuglevel.upper())
2928
3080
initlogger(debug, level)
2929
3081
2930
3082
if server_settings["servicename"] != "Mandos":
2931
3083
syslogger.setFormatter(
2932
3084
logging.Formatter('Mandos ({}) [%(process)d]:'
2933
3085
' %(levelname)s: %(message)s'.format(
2934
3086
server_settings["servicename"])))
2935
3087
2936
3088
# Parse config file with clients
2937
client_config = configparser.SafeConfigParser(Client
2938
.client_defaults)
3089
client_config = configparser.ConfigParser(Client.client_defaults)
2939
3090
client_config.read(os.path.join(server_settings["configdir"],
2940
3091
"clients.conf"))
2941
3092
2942
3093
global mandos_dbus_service
2943
3094
mandos_dbus_service = None
2944
3095
2945
3096
socketfd = None
2946
3097
if server_settings["socket"] != "":
2947
3098
socketfd = server_settings["socket"]
2963
3114
except IOError as e:
2964
3115
logger.error("Could not open file %r", pidfilename,
2965
3116
exc_info=e)
2966
3117
2967
3118
for name, group in (("_mandos", "_mandos"),
2968
3119
("mandos", "mandos"),
2969
3120
("nobody", "nogroup")):
2987
3138
.format(uid, gid, os.strerror(error.errno)))
2988
3139
if error.errno != errno.EPERM:
2989
3140
raise
2990
3141
2991
3142
if debug:
2992
3143
# Enable all possible GnuTLS debugging
2993
3144
2994
3145
# "Use a log level over 10 to enable all debugging options."
2995
3146
# - GnuTLS manual
2996
3147
gnutls.global_set_log_level(11)
2997
3148
2998
3149
@gnutls.log_func
2999
3150
def debug_gnutls(level, string):
3000
3151
logger.debug("GnuTLS: %s", string[:-1])
3001
3152
3002
3153
gnutls.global_set_log_function(debug_gnutls)
3003
3154
3004
3155
# Redirect stdin so all checkers get /dev/null
3005
3156
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3006
3157
os.dup2(null, sys.stdin.fileno())
3007
3158
if null > 2:
3008
3159
os.close(null)
3009
3160
3010
3161
# Need to fork before connecting to D-Bus
3011
3162
if not foreground:
3012
3163
# Close all input and output, do double fork, etc.
3013
3164
daemon()
3014
3015
# multiprocessing will use threads, so before we use GLib we need
3016
# to inform GLib that threads will be used.
3017
GLib.threads_init()
3018
3165
3166
if gi.version_info < (3, 10, 2):
3167
# multiprocessing will use threads, so before we use GLib we
3168
# need to inform GLib that threads will be used.
3169
GLib.threads_init()
3170
3019
3171
global main_loop
3020
3172
# From the Avahi example code
3021
3173
DBusGMainLoop(set_as_default=True)
3038
3190
if zeroconf:
3039
3191
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3040
3192
service = AvahiServiceToSyslog(
3041
name = server_settings["servicename"],
3042
servicetype = "_mandos._tcp",
3043
protocol = protocol,
3044
bus = bus)
3193
name=server_settings["servicename"],
3194
servicetype="_mandos._tcp",
3195
protocol=protocol,
3196
bus=bus)
3045
3197
if server_settings["interface"]:
3046
3198
service.interface = if_nametoindex(
3047
3199
server_settings["interface"].encode("utf-8"))
3048
3200
3049
3201
global multiprocessing_manager
3050
3202
multiprocessing_manager = multiprocessing.Manager()
3051
3203
3052
3204
client_class = Client
3053
3205
if use_dbus:
3054
client_class = functools.partial(ClientDBus, bus = bus)
3055
3206
client_class = functools.partial(ClientDBus, bus=bus)
3207
3056
3208
client_settings = Client.config_parser(client_config)
3057
3209
old_client_settings = {}
3058
3210
clients_data = {}
3059
3211
3060
3212
# This is used to redirect stdout and stderr for checker processes
3061
3213
global wnull
3062
wnull = open(os.devnull, "w") # A writable /dev/null
3214
wnull = open(os.devnull, "w") # A writable /dev/null
3063
3215
# Only used if server is running in foreground but not in debug
3064
3216
# mode
3065
3217
if debug or not foreground:
3066
3218
wnull.close()
3067
3219
3068
3220
# Get client data and settings from last running state.
3069
3221
if server_settings["restore"]:
3070
3222
try:
3071
3223
with open(stored_state_path, "rb") as stored_state:
3072
if sys.version_info.major == 2:
3224
if sys.version_info.major == 2:
3073
3225
clients_data, old_client_settings = pickle.load(
3074
3226
stored_state)
3075
3227
else:
3076
3228
bytes_clients_data, bytes_old_client_settings = (
3077
pickle.load(stored_state, encoding = "bytes"))
3078
### Fix bytes to strings
3079
## clients_data
3229
pickle.load(stored_state, encoding="bytes"))
3230
# Fix bytes to strings
3231
# clients_data
3080
3232
# .keys()
3081
clients_data = { (key.decode("utf-8")
3082
if isinstance(key, bytes)
3083
else key): value
3084
for key, value in
3085
bytes_clients_data.items() }
3233
clients_data = {(key.decode("utf-8")
3234
if isinstance(key, bytes)
3235
else key): value
3236
for key, value in
3237
bytes_clients_data.items()}
3086
3238
del bytes_clients_data
3087
3239
for key in clients_data:
3088
value = { (k.decode("utf-8")
3089
if isinstance(k, bytes) else k): v
3090
for k, v in
3091
clients_data[key].items() }
3240
value = {(k.decode("utf-8")
3241
if isinstance(k, bytes) else k): v
3242
for k, v in
3243
clients_data[key].items()}
3092
3244
clients_data[key] = value
3093
3245
# .client_structure
3094
3246
value["client_structure"] = [
3095
3247
(s.decode("utf-8")
3096
3248
if isinstance(s, bytes)
3097
3249
else s) for s in
3098
value["client_structure"] ]
3250
value["client_structure"]]
3099
3251
# .name & .host
3100
3252
for k in ("name", "host"):
3101
3253
if isinstance(value[k], bytes):
3102
3254
value[k] = value[k].decode("utf-8")
3103
## old_client_settings
3255
if "key_id" not in value:
3256
value["key_id"] = ""
3257
elif "fingerprint" not in value:
3258
value["fingerprint"] = ""
3259
# old_client_settings
3104
3260
# .keys()
3105
3261
old_client_settings = {
3106
3262
(key.decode("utf-8")
3107
3263
if isinstance(key, bytes)
3108
3264
else key): value
3109
3265
for key, value in
3110
bytes_old_client_settings.items() }
3266
bytes_old_client_settings.items()}
3111
3267
del bytes_old_client_settings
3112
3268
# .host
3113
3269
for value in old_client_settings.values():
3127
3283
logger.warning("Could not load persistent state: "
3128
3284
"EOFError:",
3129
3285
exc_info=e)
3130
3286
3131
3287
with PGPEngine() as pgp:
3132
3288
for client_name, client in clients_data.items():
3133
3289
# Skip removed clients
3134
3290
if client_name not in client_settings:
3135
3291
continue
3136
3292
3137
3293
# Decide which value to use after restoring saved state.
3138
3294
# We have three different values: Old config file,
3139
3295
# new config file, and saved state.
3150
3306
client[name] = value
3151
3307
except KeyError:
3152
3308
pass
3153
3309
3154
3310
# Clients who has passed its expire date can still be
3155
3311
# enabled if its last checker was successful. A Client
3156
3312
# whose checker succeeded before we stored its state is
3189
3345
client_name))
3190
3346
client["secret"] = (client_settings[client_name]
3191
3347
["secret"])
3192
3348
3193
3349
# Add/remove clients based on new changes made to config
3194
3350
for client_name in (set(old_client_settings)
3195
3351
- set(client_settings)):
3197
3353
for client_name in (set(client_settings)
3198
3354
- set(old_client_settings)):
3199
3355
clients_data[client_name] = client_settings[client_name]
3200
3356
3201
3357
# Create all client objects
3202
3358
for client_name, client in clients_data.items():
3203
3359
tcp_server.clients[client_name] = client_class(
3204
name = client_name,
3205
settings = client,
3206
server_settings = server_settings)
3207
3360
name=client_name,
3361
settings=client,
3362
server_settings=server_settings)
3363
3208
3364
if not tcp_server.clients:
3209
3365
logger.warning("No clients defined")
3210
3366
3211
3367
if not foreground:
3212
3368
if pidfile is not None:
3213
3369
pid = os.getpid()
3219
3375
pidfilename, pid)
3220
3376
del pidfile
3221
3377
del pidfilename
3222
3378
3223
3379
for termsig in (signal.SIGHUP, signal.SIGTERM):
3224
3380
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3225
3381
lambda: main_loop.quit() and False)
3226
3382
3227
3383
if use_dbus:
3228
3384
3229
3385
@alternate_dbus_interfaces(
3230
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3386
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3231
3387
class MandosDBusService(DBusObjectWithObjectManager):
3232
3388
"""A D-Bus proxy object"""
3233
3389
3234
3390
def __init__(self):
3235
3391
dbus.service.Object.__init__(self, bus, "/")
3236
3392
3237
3393
_interface = "se.recompile.Mandos"
3238
3394
3239
3395
@dbus.service.signal(_interface, signature="o")
3240
3396
def ClientAdded(self, objpath):
3241
3397
"D-Bus signal"
3242
3398
pass
3243
3399
3244
3400
@dbus.service.signal(_interface, signature="ss")
3245
def ClientNotFound(self, fingerprint, address):
3401
def ClientNotFound(self, key_id, address):
3246
3402
"D-Bus signal"
3247
3403
pass
3248
3404
3249
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3250
3406
"true"})
3251
3407
@dbus.service.signal(_interface, signature="os")
3252
3408
def ClientRemoved(self, objpath, name):
3253
3409
"D-Bus signal"
3254
3410
pass
3255
3411
3256
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3257
3413
"true"})
3258
3414
@dbus.service.method(_interface, out_signature="ao")
3260
3416
"D-Bus method"
3261
3417
return dbus.Array(c.dbus_object_path for c in
3262
3418
tcp_server.clients.values())
3263
3419
3264
3420
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3265
3421
"true"})
3266
3422
@dbus.service.method(_interface,
3268
3424
def GetAllClientsWithProperties(self):
3269
3425
"D-Bus method"
3270
3426
return dbus.Dictionary(
3271
{ c.dbus_object_path: c.GetAll(
3427
{c.dbus_object_path: c.GetAll(
3272
3428
"se.recompile.Mandos.Client")
3273
for c in tcp_server.clients.values() },
3429
for c in tcp_server.clients.values()},
3274
3430
signature="oa{sv}")
3275
3431
3276
3432
@dbus.service.method(_interface, in_signature="o")
3277
3433
def RemoveClient(self, object_path):
3278
3434
"D-Bus method"
3286
3442
self.client_removed_signal(c)
3287
3443
return
3288
3444
raise KeyError(object_path)
3289
3445
3290
3446
del _interface
3291
3447
3292
3448
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3293
out_signature = "a{oa{sa{sv}}}")
3449
out_signature="a{oa{sa{sv}}}")
3294
3450
def GetManagedObjects(self):
3295
3451
"""D-Bus method"""
3296
3452
return dbus.Dictionary(
3297
{ client.dbus_object_path:
3298
dbus.Dictionary(
3299
{ interface: client.GetAll(interface)
3300
for interface in
3301
client._get_all_interface_names()})
3302
for client in tcp_server.clients.values()})
3303
3453
{client.dbus_object_path:
3454
dbus.Dictionary(
3455
{interface: client.GetAll(interface)
3456
for interface in
3457
client._get_all_interface_names()})
3458
for client in tcp_server.clients.values()})
3459
3304
3460
def client_added_signal(self, client):
3305
3461
"""Send the new standard signal and the old signal"""
3306
3462
if use_dbus:
3308
3464
self.InterfacesAdded(
3309
3465
client.dbus_object_path,
3310
3466
dbus.Dictionary(
3311
{ interface: client.GetAll(interface)
3312
for interface in
3313
client._get_all_interface_names()}))
3467
{interface: client.GetAll(interface)
3468
for interface in
3469
client._get_all_interface_names()}))
3314
3470
# Old signal
3315
3471
self.ClientAdded(client.dbus_object_path)
3316
3472
3317
3473
def client_removed_signal(self, client):
3318
3474
"""Send the new standard signal and the old signal"""
3319
3475
if use_dbus:
3324
3480
# Old signal
3325
3481
self.ClientRemoved(client.dbus_object_path,
3326
3482
client.name)
3327
3483
3328
3484
mandos_dbus_service = MandosDBusService()
3329
3485
3330
3486
# Save modules to variables to exempt the modules from being
3331
3487
# unloaded before the function registered with atexit() is run.
3332
3488
mp = multiprocessing
3333
3489
wn = wnull
3490
3334
3491
def cleanup():
3335
3492
"Cleanup function; run on exit"
3336
3493
if zeroconf:
3337
3494
service.cleanup()
3338
3495
3339
3496
mp.active_children()
3340
3497
wn.close()
3341
3498
if not (tcp_server.clients or client_settings):
3342
3499
return
3343
3500
3344
3501
# Store client before exiting. Secrets are encrypted with key
3345
3502
# based on what config file has. If config file is
3346
3503
# removed/edited, old secret will thus be unrecovable.
3351
3508
client.encrypted_secret = pgp.encrypt(client.secret,
3352
3509
key)
3353
3510
client_dict = {}
3354
3511
3355
3512
# A list of attributes that can not be pickled
3356
3513
# + secret.
3357
exclude = { "bus", "changedstate", "secret",
3358
"checker", "server_settings" }
3514
exclude = {"bus", "changedstate", "secret",
3515
"checker", "server_settings"}
3359
3516
for name, typ in inspect.getmembers(dbus.service
3360
3517
.Object):
3361
3518
exclude.add(name)
3362
3519
3363
3520
client_dict["encrypted_secret"] = (client
3364
3521
.encrypted_secret)
3365
3522
for attr in client.client_structure:
3366
3523
if attr not in exclude:
3367
3524
client_dict[attr] = getattr(client, attr)
3368
3525
3369
3526
clients[client.name] = client_dict
3370
3527
del client_settings[client.name]["secret"]
3371
3528
3372
3529
try:
3373
3530
with tempfile.NamedTemporaryFile(
3374
3531
mode='wb',
3377
3534
dir=os.path.dirname(stored_state_path),
3378
3535
delete=False) as stored_state:
3379
3536
pickle.dump((clients, client_settings), stored_state,
3380
protocol = 2)
3537
protocol=2)
3381
3538
tempname = stored_state.name
3382
3539
os.rename(tempname, stored_state_path)
3383
3540
except (IOError, OSError) as e:
3393
3550
logger.warning("Could not save persistent state:",
3394
3551
exc_info=e)
3395
3552
raise
3396
3553
3397
3554
# Delete all clients, and settings from config
3398
3555
while tcp_server.clients:
3399
3556
name, client = tcp_server.clients.popitem()
3405
3562
if use_dbus:
3406
3563
mandos_dbus_service.client_removed_signal(client)
3407
3564
client_settings.clear()
3408
3565
3409
3566
atexit.register(cleanup)
3410
3567
3411
3568
for client in tcp_server.clients.values():
3412
3569
if use_dbus:
3413
3570
# Emit D-Bus signal for adding
3415
3572
# Need to initiate checking of clients
3416
3573
if client.enabled:
3417
3574
client.init_checker()
3418
3575
3419
3576
tcp_server.enable()
3420
3577
tcp_server.server_activate()
3421
3578
3422
3579
# Find out what port we got
3423
3580
if zeroconf:
3424
3581
service.port = tcp_server.socket.getsockname()[1]
3429
3586
else: # IPv4
3430
3587
logger.info("Now listening on address %r, port %d",
3431
3588
*tcp_server.socket.getsockname())
3432
3433
#service.interface = tcp_server.socket.getsockname()[3]
3434
3589
3590
# service.interface = tcp_server.socket.getsockname()[3]
3591
3435
3592
try:
3436
3593
if zeroconf:
3437
3594
# From the Avahi example code
3442
3599
cleanup()
3443
3600
sys.exit(1)
3444
3601
# End of Avahi example code
3445
3602
3446
3603
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3447
3604
lambda *args, **kwargs:
3448
3605
(tcp_server.handle_request
3449
3606
(*args[2:], **kwargs) or True))
3450
3607
3451
3608
logger.debug("Starting main loop")
3452
3609
main_loop.run()
3453
3610
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0