To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1173
- compare with another revision
- download diff
- download tarball
- view history from revision 1173
- Committer: Teddy Hogeborn
- Date: 2019-09-01 04:27:59 UTC
- Revision ID: teddy@recompile.se-20190901042759-dgadz8cg7x9y83ci
Fix minor Python 3 bytes/str mixups
* mandos (PGPEngine.__init__): Use byte string literals, not strings,
when working with byte strings.
(main): When restoring persistent state from a file created by
Python 2, also convert the "checker_command" setting from a
byte string to a string, the same as "name" and "host".
* mandos (PGPEngine.__init__): Use byte string literals, not strings,
when working with byte strings.
(main): When restoring persistent state from a file created by
Python 2, also convert the "checker_command" setting from a
byte string to a string, the same as "name" and "host".
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -b
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
76
77
import itertools
77
78
import collections
78
79
import codecs
80
import unittest
79
81
80
82
import dbus
81
83
import dbus.service
82
try:
83
from gi.repository import GObject
84
except ImportError:
85
import gobject as GObject
84
import gi
85
from gi.repository import GLib
86
86
from dbus.mainloop.glib import DBusGMainLoop
87
87
import ctypes
88
88
import ctypes.util
89
89
import xml.dom.minidom
90
90
import inspect
91
91
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
95
# Show warnings by default
96
if not sys.warnoptions:
97
import warnings
98
warnings.simplefilter("default")
99
100
# Try to find the value of SO_BINDTODEVICE:
92
101
try:
102
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
103
# newer, and it is also the most natural place for it:
93
104
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
105
except AttributeError:
95
106
try:
107
# This is where SO_BINDTODEVICE was up to and including Python
108
# 2.6, and also 3.2:
96
109
from IN import SO_BINDTODEVICE
97
110
except ImportError:
98
SO_BINDTODEVICE = None
111
# In Python 2.7 it seems to have been removed entirely.
112
# Try running the C preprocessor:
113
try:
114
cc = subprocess.Popen(["cc", "--language=c", "-E",
115
"/dev/stdin"],
116
stdin=subprocess.PIPE,
117
stdout=subprocess.PIPE)
118
stdout = cc.communicate(
119
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
120
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
121
except (OSError, ValueError, IndexError):
122
# No value found
123
SO_BINDTODEVICE = None
99
124
100
125
if sys.version_info.major == 2:
101
126
str = unicode
102
127
103
version = "1.7.5"
128
if sys.version_info < (3, 2):
129
configparser.Configparser = configparser.SafeConfigParser
130
131
version = "1.8.8"
104
132
stored_state_file = "clients.pickle"
105
133
106
134
logger = logging.getLogger()
135
logging.captureWarnings(True) # Show warnings via the logging system
107
136
syslogger = None
108
137
109
138
try:
110
139
if_nametoindex = ctypes.cdll.LoadLibrary(
111
140
ctypes.util.find_library("c")).if_nametoindex
112
141
except (OSError, AttributeError):
113
142
114
143
def if_nametoindex(interface):
115
144
"Get an interface index the hard way, i.e. using fcntl()"
116
145
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
139
168
140
169
def initlogger(debug, level=logging.WARNING):
141
170
"""init logger and add loglevel"""
142
171
143
172
global syslogger
144
173
syslogger = (logging.handlers.SysLogHandler(
145
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
146
address = "/dev/log"))
174
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
address="/dev/log"))
147
176
syslogger.setFormatter(logging.Formatter
148
177
('Mandos [%(process)d]: %(levelname)s:'
149
178
' %(message)s'))
150
179
logger.addHandler(syslogger)
151
180
152
181
if debug:
153
182
console = logging.StreamHandler()
154
183
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
164
193
pass
165
194
166
195
167
class PGPEngine(object):
196
class PGPEngine:
168
197
"""A simple class for OpenPGP symmetric encryption & decryption"""
169
198
170
199
def __init__(self):
171
200
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
172
201
self.gpg = "gpg"
174
203
output = subprocess.check_output(["gpgconf"])
175
204
for line in output.splitlines():
176
205
name, text, path = line.split(b":")
177
if name == "gpg":
206
if name == b"gpg":
178
207
self.gpg = path
179
208
break
180
209
except OSError as e:
183
212
self.gnupgargs = ['--batch',
184
213
'--homedir', self.tempdir,
185
214
'--force-mdc',
186
'--quiet',
187
'--no-use-agent']
188
215
'--quiet']
216
# Only GPG version 1 has the --no-use-agent option.
217
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
218
self.gnupgargs.append("--no-use-agent")
219
189
220
def __enter__(self):
190
221
return self
191
222
192
223
def __exit__(self, exc_type, exc_value, traceback):
193
224
self._cleanup()
194
225
return False
195
226
196
227
def __del__(self):
197
228
self._cleanup()
198
229
199
230
def _cleanup(self):
200
231
if self.tempdir is not None:
201
232
# Delete contents of tempdir
202
233
for root, dirs, files in os.walk(self.tempdir,
203
topdown = False):
234
topdown=False):
204
235
for filename in files:
205
236
os.remove(os.path.join(root, filename))
206
237
for dirname in dirs:
208
239
# Remove tempdir
209
240
os.rmdir(self.tempdir)
210
241
self.tempdir = None
211
242
212
243
def password_encode(self, password):
213
244
# Passphrase can not be empty and can not contain newlines or
214
245
# NUL bytes. So we prefix it and hex encode it.
219
250
.replace(b"\n", b"\\n")
220
251
.replace(b"\0", b"\\x00"))
221
252
return encoded
222
253
223
254
def encrypt(self, data, password):
224
255
passphrase = self.password_encode(password)
225
256
with tempfile.NamedTemporaryFile(
230
261
'--passphrase-file',
231
262
passfile.name]
232
263
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
237
268
if proc.returncode != 0:
238
269
raise PGPError(err)
239
270
return ciphertext
240
271
241
272
def decrypt(self, data, password):
242
273
passphrase = self.password_encode(password)
243
274
with tempfile.NamedTemporaryFile(
244
dir = self.tempdir) as passfile:
275
dir=self.tempdir) as passfile:
245
276
passfile.write(passphrase)
246
277
passfile.flush()
247
278
proc = subprocess.Popen([self.gpg, '--decrypt',
248
279
'--passphrase-file',
249
280
passfile.name]
250
281
+ self.gnupgargs,
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
255
286
if proc.returncode != 0:
256
287
raise PGPError(err)
257
288
return decrypted_plaintext
258
289
290
259
291
# Pretend that we have an Avahi module
260
class Avahi(object):
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
292
class avahi:
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
267
298
DBUS_NAME = "org.freedesktop.Avahi"
268
299
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
269
300
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
270
301
DBUS_PATH_SERVER = "/"
271
def string_array_to_txt_array(self, t):
302
303
@staticmethod
304
def string_array_to_txt_array(t):
272
305
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
273
306
for s in t), signature="ay")
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
282
avahi = Avahi()
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
315
283
316
284
317
class AvahiError(Exception):
285
318
def __init__(self, value, *args, **kwargs):
296
329
pass
297
330
298
331
299
class AvahiService(object):
332
class AvahiService:
300
333
"""An Avahi (Zeroconf) service.
301
334
302
335
Attributes:
303
336
interface: integer; avahi.IF_UNSPEC or an interface index.
304
337
Used to optionally bind to the specified interface.
316
349
server: D-Bus Server
317
350
bus: dbus.SystemBus()
318
351
"""
319
352
320
353
def __init__(self,
321
interface = avahi.IF_UNSPEC,
322
name = None,
323
servicetype = None,
324
port = None,
325
TXT = None,
326
domain = "",
327
host = "",
328
max_renames = 32768,
329
protocol = avahi.PROTO_UNSPEC,
330
bus = None):
354
interface=avahi.IF_UNSPEC,
355
name=None,
356
servicetype=None,
357
port=None,
358
TXT=None,
359
domain="",
360
host="",
361
max_renames=32768,
362
protocol=avahi.PROTO_UNSPEC,
363
bus=None):
331
364
self.interface = interface
332
365
self.name = name
333
366
self.type = servicetype
342
375
self.server = None
343
376
self.bus = bus
344
377
self.entry_group_state_changed_match = None
345
378
346
379
def rename(self, remove=True):
347
380
"""Derived from the Avahi example code"""
348
381
if self.rename_count >= self.max_renames:
368
401
logger.critical("D-Bus Exception", exc_info=error)
369
402
self.cleanup()
370
403
os._exit(1)
371
404
372
405
def remove(self):
373
406
"""Derived from the Avahi example code"""
374
407
if self.entry_group_state_changed_match is not None:
376
409
self.entry_group_state_changed_match = None
377
410
if self.group is not None:
378
411
self.group.Reset()
379
412
380
413
def add(self):
381
414
"""Derived from the Avahi example code"""
382
415
self.remove()
399
432
dbus.UInt16(self.port),
400
433
avahi.string_array_to_txt_array(self.TXT))
401
434
self.group.Commit()
402
435
403
436
def entry_group_state_changed(self, state, error):
404
437
"""Derived from the Avahi example code"""
405
438
logger.debug("Avahi entry group state change: %i", state)
406
439
407
440
if state == avahi.ENTRY_GROUP_ESTABLISHED:
408
441
logger.debug("Zeroconf service established.")
409
442
elif state == avahi.ENTRY_GROUP_COLLISION:
413
446
logger.critical("Avahi: Error in group state changed %s",
414
447
str(error))
415
448
raise AvahiGroupError("State changed: {!s}".format(error))
416
449
417
450
def cleanup(self):
418
451
"""Derived from the Avahi example code"""
419
452
if self.group is not None:
424
457
pass
425
458
self.group = None
426
459
self.remove()
427
460
428
461
def server_state_changed(self, state, error=None):
429
462
"""Derived from the Avahi example code"""
430
463
logger.debug("Avahi server state change: %i", state)
459
492
logger.debug("Unknown state: %r", state)
460
493
else:
461
494
logger.debug("Unknown state: %r: %r", state, error)
462
495
463
496
def activate(self):
464
497
"""Derived from the Avahi example code"""
465
498
if self.server is None:
476
509
class AvahiServiceToSyslog(AvahiService):
477
510
def rename(self, *args, **kwargs):
478
511
"""Add the new name to the syslog messages"""
479
ret = AvahiService.rename(self, *args, **kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
480
513
syslogger.setFormatter(logging.Formatter(
481
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
482
515
.format(self.name)))
483
516
return ret
484
517
518
485
519
# Pretend that we have a GnuTLS module
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
489
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
493
def __init__(self):
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
496
# happens.
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
500
520
class gnutls:
521
"""This isn't so much a class as it is a module-like namespace."""
522
523
library = ctypes.util.find_library("gnutls")
524
if library is None:
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
527
del library
528
501
529
# Unless otherwise indicated, the constants and types below are
502
530
# all from the gnutls/gnutls.h C header file.
503
531
504
532
# Constants
505
533
E_SUCCESS = 0
506
534
E_INTERRUPTED = -52
507
535
E_AGAIN = -28
508
536
CRT_OPENPGP = 2
537
CRT_RAWPK = 3
509
538
CLIENT = 2
510
539
SHUT_RDWR = 0
511
540
CRD_CERTIFICATE = 1
512
541
E_NO_CERTIFICATE_FOUND = -49
542
X509_FMT_DER = 0
543
NO_TICKETS = 1<<10
544
ENABLE_RAWPK = 1<<18
545
CTYPE_PEERS = 3
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
513
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
514
548
515
549
# Types
516
550
class session_int(ctypes.Structure):
517
551
_fields_ = []
518
552
session_t = ctypes.POINTER(session_int)
553
519
554
class certificate_credentials_st(ctypes.Structure):
520
555
_fields_ = []
521
556
certificate_credentials_t = ctypes.POINTER(
522
557
certificate_credentials_st)
523
558
certificate_type_t = ctypes.c_int
559
524
560
class datum_t(ctypes.Structure):
525
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
562
('size', ctypes.c_uint)]
563
527
564
class openpgp_crt_int(ctypes.Structure):
528
565
_fields_ = []
529
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
531
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
532
569
credentials_type_t = ctypes.c_int
533
570
transport_ptr_t = ctypes.c_void_p
534
571
close_request_t = ctypes.c_int
535
572
536
573
# Exceptions
537
574
class Error(Exception):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
575
def __init__(self, message=None, code=None, args=()):
543
576
# Default usage is by a message string, but if a return
544
577
# code is passed, convert it to a string with
545
578
# gnutls.strerror()
546
579
self.code = code
547
580
if message is None and code is not None:
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
550
583
message, *args)
551
584
552
585
class CertificateSecurityError(Error):
553
586
pass
554
587
555
588
# Classes
556
class Credentials(object):
589
class Credentials:
557
590
def __init__(self):
558
591
self._c_object = gnutls.certificate_credentials_t()
559
592
gnutls.certificate_allocate_credentials(
560
593
ctypes.byref(self._c_object))
561
594
self.type = gnutls.CRD_CERTIFICATE
562
595
563
596
def __del__(self):
564
597
gnutls.certificate_free_credentials(self._c_object)
565
566
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
598
599
class ClientSession:
600
def __init__(self, socket, credentials=None):
568
601
self._c_object = gnutls.session_t()
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
605
if gnutls.has_rawpk:
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
608
del gnutls_flags
570
609
gnutls.set_default_priority(self._c_object)
571
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
572
611
gnutls.handshake_set_private_extensions(self._c_object,
578
617
ctypes.cast(credentials._c_object,
579
618
ctypes.c_void_p))
580
619
self.credentials = credentials
581
620
582
621
def __del__(self):
583
622
gnutls.deinit(self._c_object)
584
623
585
624
def handshake(self):
586
625
return gnutls.handshake(self._c_object)
587
626
588
627
def send(self, data):
589
628
data = bytes(data)
590
629
data_len = len(data)
592
631
data_len -= gnutls.record_send(self._c_object,
593
632
data[-data_len:],
594
633
data_len)
595
634
596
635
def bye(self):
597
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
598
637
599
638
# Error handling functions
600
639
def _error_code(result):
601
640
"""A function to raise exceptions on errors, suitable
603
642
if result >= 0:
604
643
return result
605
644
if result == gnutls.E_NO_CERTIFICATE_FOUND:
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
608
645
raise gnutls.CertificateSecurityError(code=result)
646
raise gnutls.Error(code=result)
647
609
648
def _retry_on_error(result, func, arguments):
610
649
"""A function to retry on some errors, suitable
611
650
for the 'errcheck' attribute on ctypes functions"""
614
653
return _error_code(result)
615
654
result = func(*arguments)
616
655
return result
617
656
618
657
# Unless otherwise indicated, the function declarations below are
619
658
# all from the gnutls/gnutls.h C header file.
620
659
621
660
# Functions
622
661
priority_set_direct = _library.gnutls_priority_set_direct
623
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
624
663
ctypes.POINTER(ctypes.c_char_p)]
625
664
priority_set_direct.restype = _error_code
626
665
627
666
init = _library.gnutls_init
628
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
629
668
init.restype = _error_code
630
669
631
670
set_default_priority = _library.gnutls_set_default_priority
632
671
set_default_priority.argtypes = [session_t]
633
672
set_default_priority.restype = _error_code
634
673
635
674
record_send = _library.gnutls_record_send
636
675
record_send.argtypes = [session_t, ctypes.c_void_p,
637
676
ctypes.c_size_t]
638
677
record_send.restype = ctypes.c_ssize_t
639
678
record_send.errcheck = _retry_on_error
640
679
641
680
certificate_allocate_credentials = (
642
681
_library.gnutls_certificate_allocate_credentials)
643
682
certificate_allocate_credentials.argtypes = [
644
683
ctypes.POINTER(certificate_credentials_t)]
645
684
certificate_allocate_credentials.restype = _error_code
646
685
647
686
certificate_free_credentials = (
648
687
_library.gnutls_certificate_free_credentials)
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
650
690
certificate_free_credentials.restype = None
651
691
652
692
handshake_set_private_extensions = (
653
693
_library.gnutls_handshake_set_private_extensions)
654
694
handshake_set_private_extensions.argtypes = [session_t,
655
695
ctypes.c_int]
656
696
handshake_set_private_extensions.restype = None
657
697
658
698
credentials_set = _library.gnutls_credentials_set
659
699
credentials_set.argtypes = [session_t, credentials_type_t,
660
700
ctypes.c_void_p]
661
701
credentials_set.restype = _error_code
662
702
663
703
strerror = _library.gnutls_strerror
664
704
strerror.argtypes = [ctypes.c_int]
665
705
strerror.restype = ctypes.c_char_p
666
706
667
707
certificate_type_get = _library.gnutls_certificate_type_get
668
708
certificate_type_get.argtypes = [session_t]
669
709
certificate_type_get.restype = _error_code
670
710
671
711
certificate_get_peers = _library.gnutls_certificate_get_peers
672
712
certificate_get_peers.argtypes = [session_t,
673
713
ctypes.POINTER(ctypes.c_uint)]
674
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
675
715
676
716
global_set_log_level = _library.gnutls_global_set_log_level
677
717
global_set_log_level.argtypes = [ctypes.c_int]
678
718
global_set_log_level.restype = None
679
719
680
720
global_set_log_function = _library.gnutls_global_set_log_function
681
721
global_set_log_function.argtypes = [log_func]
682
722
global_set_log_function.restype = None
683
723
684
724
deinit = _library.gnutls_deinit
685
725
deinit.argtypes = [session_t]
686
726
deinit.restype = None
687
727
688
728
handshake = _library.gnutls_handshake
689
729
handshake.argtypes = [session_t]
690
730
handshake.restype = _error_code
691
731
handshake.errcheck = _retry_on_error
692
732
693
733
transport_set_ptr = _library.gnutls_transport_set_ptr
694
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
695
735
transport_set_ptr.restype = None
696
736
697
737
bye = _library.gnutls_bye
698
738
bye.argtypes = [session_t, close_request_t]
699
739
bye.restype = _error_code
700
740
bye.errcheck = _retry_on_error
701
741
702
742
check_version = _library.gnutls_check_version
703
743
check_version.argtypes = [ctypes.c_char_p]
704
744
check_version.restype = ctypes.c_char_p
705
706
# All the function declarations below are from gnutls/openpgp.h
707
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
711
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
715
openpgp_crt_fmt_t]
716
openpgp_crt_import.restype = _error_code
717
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
722
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
726
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
ctypes.c_void_p,
731
ctypes.POINTER(
732
ctypes.c_size_t)]
733
openpgp_crt_get_fingerprint.restype = _error_code
734
745
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
750
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
753
754
if has_rawpk:
755
# Types
756
class pubkey_st(ctypes.Structure):
757
_fields = []
758
pubkey_t = ctypes.POINTER(pubkey_st)
759
760
x509_crt_fmt_t = ctypes.c_int
761
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
766
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
769
x509_crt_fmt_t]
770
pubkey_import.restype = _error_code
771
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
777
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
781
else:
782
# All the function declarations below are from gnutls/openpgp.h
783
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
787
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
791
openpgp_crt_fmt_t]
792
openpgp_crt_import.restype = _error_code
793
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
798
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
802
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
806
ctypes.c_void_p,
807
ctypes.POINTER(
808
ctypes.c_size_t)]
809
openpgp_crt_get_fingerprint.restype = _error_code
810
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
815
735
816
# Remove non-public functions
736
817
del _error_code, _retry_on_error
737
# Create the global "gnutls" object, simulating a module
738
gnutls = GnuTLS()
818
739
819
740
820
def call_pipe(connection, # : multiprocessing.Connection
741
821
func, *args, **kwargs):
742
822
"""This function is meant to be called by multiprocessing.Process
743
823
744
824
This function runs func(*args, **kwargs), and writes the resulting
745
825
return value on the provided multiprocessing.Connection.
746
826
"""
747
827
connection.send(func(*args, **kwargs))
748
828
connection.close()
749
829
750
class Client(object):
830
831
class Client:
751
832
"""A representation of a client host served by this server.
752
833
753
834
Attributes:
754
835
approved: bool(); 'None' if not yet approved/disapproved
755
836
approval_delay: datetime.timedelta(); Time to wait for approval
756
837
approval_duration: datetime.timedelta(); Duration of one approval
757
checker: subprocess.Popen(); a running checker process used
758
to see if the client lives.
759
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
840
running.
841
checker_callback_tag: a GLib event source tag, or None
761
842
checker_command: string; External command which is run to check
762
843
if client lives. %() expansions are done at
763
844
runtime with vars(self) as dict, so that for
764
845
instance %(name)s can be used in the command.
765
checker_initiator_tag: a GObject event source tag, or None
846
checker_initiator_tag: a GLib event source tag, or None
766
847
created: datetime.datetime(); (UTC) object creation
767
848
client_structure: Object describing what attributes a client has
768
849
and is used for storing the client at exit
769
850
current_checker_command: string; current running checker_command
770
disable_initiator_tag: a GObject event source tag, or None
851
disable_initiator_tag: a GLib event source tag, or None
771
852
enabled: bool()
772
853
fingerprint: string (40 or 32 hexadecimal digits); used to
773
uniquely identify the client
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
774
857
host: string; available for use by the checker command
775
858
interval: datetime.timedelta(); How often to start a new checker
776
859
last_approval_request: datetime.datetime(); (UTC) or None
792
875
disabled, or None
793
876
server_settings: The server_settings dict from main()
794
877
"""
795
878
796
879
runtime_expansions = ("approval_delay", "approval_duration",
797
"created", "enabled", "expires",
880
"created", "enabled", "expires", "key_id",
798
881
"fingerprint", "host", "interval",
799
882
"last_approval_request", "last_checked_ok",
800
883
"last_enabled", "name", "timeout")
809
892
"approved_by_default": "True",
810
893
"enabled": "True",
811
894
}
812
895
813
896
@staticmethod
814
897
def config_parser(config):
815
898
"""Construct a new dict of client settings of this form:
822
905
for client_name in config.sections():
823
906
section = dict(config.items(client_name))
824
907
client = settings[client_name] = {}
825
908
826
909
client["host"] = section["host"]
827
910
# Reformat values from string types to Python types
828
911
client["approved_by_default"] = config.getboolean(
829
912
client_name, "approved_by_default")
830
913
client["enabled"] = config.getboolean(client_name,
831
914
"enabled")
832
833
# Uppercase and remove spaces from fingerprint for later
834
# comparison purposes with return value from the
835
# fingerprint() function
915
916
# Uppercase and remove spaces from key_id and fingerprint
917
# for later comparison purposes with return value from the
918
# key_id() and fingerprint() functions
919
client["key_id"] = (section.get("key_id", "").upper()
920
.replace(" ", ""))
836
921
client["fingerprint"] = (section["fingerprint"].upper()
837
922
.replace(" ", ""))
838
923
if "secret" in section:
859
944
client["last_approval_request"] = None
860
945
client["last_checked_ok"] = None
861
946
client["last_checker_status"] = -2
862
947
863
948
return settings
864
865
def __init__(self, settings, name = None, server_settings=None):
949
950
def __init__(self, settings, name=None, server_settings=None):
866
951
self.name = name
867
952
if server_settings is None:
868
953
server_settings = {}
870
955
# adding all client settings
871
956
for setting, value in settings.items():
872
957
setattr(self, setting, value)
873
958
874
959
if self.enabled:
875
960
if not hasattr(self, "last_enabled"):
876
961
self.last_enabled = datetime.datetime.utcnow()
880
965
else:
881
966
self.last_enabled = None
882
967
self.expires = None
883
968
884
969
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
885
971
logger.debug(" Fingerprint: %s", self.fingerprint)
886
972
self.created = settings.get("created",
887
973
datetime.datetime.utcnow())
888
974
889
975
# attributes specific for this server instance
890
976
self.checker = None
891
977
self.checker_initiator_tag = None
900
986
for attr in self.__dict__.keys()
901
987
if not attr.startswith("_")]
902
988
self.client_structure.append("client_structure")
903
989
904
990
for name, t in inspect.getmembers(
905
991
type(self), lambda obj: isinstance(obj, property)):
906
992
if not name.startswith("_"):
907
993
self.client_structure.append(name)
908
994
909
995
# Send notice to process children that client state has changed
910
996
def send_changedstate(self):
911
997
with self.changedstate:
912
998
self.changedstate.notify_all()
913
999
914
1000
def enable(self):
915
1001
"""Start this client's checker and timeout hooks"""
916
1002
if getattr(self, "enabled", False):
921
1007
self.last_enabled = datetime.datetime.utcnow()
922
1008
self.init_checker()
923
1009
self.send_changedstate()
924
1010
925
1011
def disable(self, quiet=True):
926
1012
"""Disable this client."""
927
1013
if not getattr(self, "enabled", False):
929
1015
if not quiet:
930
1016
logger.info("Disabling client %s", self.name)
931
1017
if getattr(self, "disable_initiator_tag", None) is not None:
932
GObject.source_remove(self.disable_initiator_tag)
1018
GLib.source_remove(self.disable_initiator_tag)
933
1019
self.disable_initiator_tag = None
934
1020
self.expires = None
935
1021
if getattr(self, "checker_initiator_tag", None) is not None:
936
GObject.source_remove(self.checker_initiator_tag)
1022
GLib.source_remove(self.checker_initiator_tag)
937
1023
self.checker_initiator_tag = None
938
1024
self.stop_checker()
939
1025
self.enabled = False
940
1026
if not quiet:
941
1027
self.send_changedstate()
942
# Do not run this again if called by a GObject.timeout_add
1028
# Do not run this again if called by a GLib.timeout_add
943
1029
return False
944
1030
945
1031
def __del__(self):
946
1032
self.disable()
947
1033
948
1034
def init_checker(self):
949
1035
# Schedule a new checker to be started an 'interval' from now,
950
1036
# and every interval from then on.
951
1037
if self.checker_initiator_tag is not None:
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
1038
GLib.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = GLib.timeout_add(
954
1040
int(self.interval.total_seconds() * 1000),
955
1041
self.start_checker)
956
1042
# Schedule a disable() when 'timeout' has passed
957
1043
if self.disable_initiator_tag is not None:
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
960
1046
int(self.timeout.total_seconds() * 1000), self.disable)
961
1047
# Also start a new checker *right now*.
962
1048
self.start_checker()
963
1049
964
1050
def checker_callback(self, source, condition, connection,
965
1051
command):
966
1052
"""The checker has completed, so take appropriate actions."""
967
self.checker_callback_tag = None
968
self.checker = None
969
1053
# Read return code from connection (see call_pipe)
970
1054
returncode = connection.recv()
971
1055
connection.close()
972
1056
self.checker.join()
1057
self.checker_callback_tag = None
1058
self.checker = None
1059
973
1060
if returncode >= 0:
974
1061
self.last_checker_status = returncode
975
1062
self.last_checker_signal = None
985
1072
logger.warning("Checker for %(name)s crashed?",
986
1073
vars(self))
987
1074
return False
988
1075
989
1076
def checked_ok(self):
990
1077
"""Assert that the client has been seen, alive and well."""
991
1078
self.last_checked_ok = datetime.datetime.utcnow()
992
1079
self.last_checker_status = 0
993
1080
self.last_checker_signal = None
994
1081
self.bump_timeout()
995
1082
996
1083
def bump_timeout(self, timeout=None):
997
1084
"""Bump up the timeout for this client."""
998
1085
if timeout is None:
999
1086
timeout = self.timeout
1000
1087
if self.disable_initiator_tag is not None:
1001
GObject.source_remove(self.disable_initiator_tag)
1088
GLib.source_remove(self.disable_initiator_tag)
1002
1089
self.disable_initiator_tag = None
1003
1090
if getattr(self, "enabled", False):
1004
self.disable_initiator_tag = GObject.timeout_add(
1091
self.disable_initiator_tag = GLib.timeout_add(
1005
1092
int(timeout.total_seconds() * 1000), self.disable)
1006
1093
self.expires = datetime.datetime.utcnow() + timeout
1007
1094
1008
1095
def need_approval(self):
1009
1096
self.last_approval_request = datetime.datetime.utcnow()
1010
1097
1011
1098
def start_checker(self):
1012
1099
"""Start a new checker subprocess if one is not running.
1013
1100
1014
1101
If a checker already exists, leave it running and do
1015
1102
nothing."""
1016
1103
# The reason for not killing a running checker is that if we
1021
1108
# checkers alone, the checker would have to take more time
1022
1109
# than 'timeout' for the client to be disabled, which is as it
1023
1110
# should be.
1024
1111
1025
1112
if self.checker is not None and not self.checker.is_alive():
1026
1113
logger.warning("Checker was not alive; joining")
1027
1114
self.checker.join()
1031
1118
# Escape attributes for the shell
1032
1119
escaped_attrs = {
1033
1120
attr: re.escape(str(getattr(self, attr)))
1034
for attr in self.runtime_expansions }
1121
for attr in self.runtime_expansions}
1035
1122
try:
1036
1123
command = self.checker_command % escaped_attrs
1037
1124
except TypeError as error:
1049
1136
# The exception is when not debugging but nevertheless
1050
1137
# running in the foreground; use the previously
1051
1138
# created wnull.
1052
popen_args = { "close_fds": True,
1053
"shell": True,
1054
"cwd": "/" }
1139
popen_args = {"close_fds": True,
1140
"shell": True,
1141
"cwd": "/"}
1055
1142
if (not self.server_settings["debug"]
1056
1143
and self.server_settings["foreground"]):
1057
1144
popen_args.update({"stdout": wnull,
1058
"stderr": wnull })
1059
pipe = multiprocessing.Pipe(duplex = False)
1145
"stderr": wnull})
1146
pipe = multiprocessing.Pipe(duplex=False)
1060
1147
self.checker = multiprocessing.Process(
1061
target = call_pipe,
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1148
target=call_pipe,
1149
args=(pipe[1], subprocess.call, command),
1150
kwargs=popen_args)
1064
1151
self.checker.start()
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1152
self.checker_callback_tag = GLib.io_add_watch(
1153
GLib.IOChannel.unix_new(pipe[0].fileno()),
1154
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1067
1155
self.checker_callback, pipe[0], command)
1068
# Re-run this periodically if run by GObject.timeout_add
1156
# Re-run this periodically if run by GLib.timeout_add
1069
1157
return True
1070
1158
1071
1159
def stop_checker(self):
1072
1160
"""Force the checker process, if any, to stop."""
1073
1161
if self.checker_callback_tag:
1074
GObject.source_remove(self.checker_callback_tag)
1162
GLib.source_remove(self.checker_callback_tag)
1075
1163
self.checker_callback_tag = None
1076
1164
if getattr(self, "checker", None) is None:
1077
1165
return
1086
1174
byte_arrays=False):
1087
1175
"""Decorators for marking methods of a DBusObjectWithProperties to
1088
1176
become properties on the D-Bus.
1089
1177
1090
1178
The decorated method will be called with no arguments by "Get"
1091
1179
and with one argument by "Set".
1092
1180
1093
1181
The parameters, where they are supported, are the same as
1094
1182
dbus.service.method, except there is only "signature", since the
1095
1183
type from Get() and the type sent to Set() is the same.
1099
1187
if byte_arrays and signature != "ay":
1100
1188
raise ValueError("Byte arrays not supported for non-'ay'"
1101
1189
" signature {!r}".format(signature))
1102
1190
1103
1191
def decorator(func):
1104
1192
func._dbus_is_property = True
1105
1193
func._dbus_interface = dbus_interface
1108
1196
func._dbus_name = func.__name__
1109
1197
if func._dbus_name.endswith("_dbus_property"):
1110
1198
func._dbus_name = func._dbus_name[:-14]
1111
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1199
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1112
1200
return func
1113
1201
1114
1202
return decorator
1115
1203
1116
1204
1117
1205
def dbus_interface_annotations(dbus_interface):
1118
1206
"""Decorator for marking functions returning interface annotations
1119
1207
1120
1208
Usage:
1121
1209
1122
1210
@dbus_interface_annotations("org.example.Interface")
1123
1211
def _foo(self): # Function name does not matter
1124
1212
return {"org.freedesktop.DBus.Deprecated": "true",
1125
1213
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1126
1214
"false"}
1127
1215
"""
1128
1216
1129
1217
def decorator(func):
1130
1218
func._dbus_is_interface = True
1131
1219
func._dbus_interface = dbus_interface
1132
1220
func._dbus_name = dbus_interface
1133
1221
return func
1134
1222
1135
1223
return decorator
1136
1224
1137
1225
1138
1226
def dbus_annotations(annotations):
1139
1227
"""Decorator to annotate D-Bus methods, signals or properties
1140
1228
Usage:
1141
1229
1142
1230
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1143
1231
"org.freedesktop.DBus.Property."
1144
1232
"EmitsChangedSignal": "false"})
1146
1234
access="r")
1147
1235
def Property_dbus_property(self):
1148
1236
return dbus.Boolean(False)
1149
1237
1150
1238
See also the DBusObjectWithAnnotations class.
1151
1239
"""
1152
1240
1153
1241
def decorator(func):
1154
1242
func._dbus_annotations = annotations
1155
1243
return func
1156
1244
1157
1245
return decorator
1158
1246
1159
1247
1177
1265
1178
1266
class DBusObjectWithAnnotations(dbus.service.Object):
1179
1267
"""A D-Bus object with annotations.
1180
1268
1181
1269
Classes inheriting from this can use the dbus_annotations
1182
1270
decorator to add annotations to methods or signals.
1183
1271
"""
1184
1272
1185
1273
@staticmethod
1186
1274
def _is_dbus_thing(thing):
1187
1275
"""Returns a function testing if an attribute is a D-Bus thing
1188
1276
1189
1277
If called like _is_dbus_thing("method") it returns a function
1190
1278
suitable for use as predicate to inspect.getmembers().
1191
1279
"""
1192
1280
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1193
1281
False)
1194
1282
1195
1283
def _get_all_dbus_things(self, thing):
1196
1284
"""Returns a generator of (name, attribute) pairs
1197
1285
"""
1200
1288
for cls in self.__class__.__mro__
1201
1289
for name, athing in
1202
1290
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1203
1291
1204
1292
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1293
out_signature="s",
1294
path_keyword='object_path',
1295
connection_keyword='connection')
1208
1296
def Introspect(self, object_path, connection):
1209
1297
"""Overloading of standard D-Bus method.
1210
1298
1211
1299
Inserts annotation tags on methods and signals.
1212
1300
"""
1213
1301
xmlstring = dbus.service.Object.Introspect(self, object_path,
1214
1302
connection)
1215
1303
try:
1216
1304
document = xml.dom.minidom.parseString(xmlstring)
1217
1305
1218
1306
for if_tag in document.getElementsByTagName("interface"):
1219
1307
# Add annotation tags
1220
1308
for typ in ("method", "signal"):
1247
1335
if_tag.appendChild(ann_tag)
1248
1336
# Fix argument name for the Introspect method itself
1249
1337
if (if_tag.getAttribute("name")
1250
== dbus.INTROSPECTABLE_IFACE):
1338
== dbus.INTROSPECTABLE_IFACE):
1251
1339
for cn in if_tag.getElementsByTagName("method"):
1252
1340
if cn.getAttribute("name") == "Introspect":
1253
1341
for arg in cn.getElementsByTagName("arg"):
1266
1354
1267
1355
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1268
1356
"""A D-Bus object with properties.
1269
1357
1270
1358
Classes inheriting from this can use the dbus_service_property
1271
1359
decorator to expose methods as D-Bus properties. It exposes the
1272
1360
standard Get(), Set(), and GetAll() methods on the D-Bus.
1273
1361
"""
1274
1362
1275
1363
def _get_dbus_property(self, interface_name, property_name):
1276
1364
"""Returns a bound method if one exists which is a D-Bus
1277
1365
property with the specified name and interface.
1282
1370
if (value._dbus_name == property_name
1283
1371
and value._dbus_interface == interface_name):
1284
1372
return value.__get__(self)
1285
1373
1286
1374
# No such property
1287
1375
raise DBusPropertyNotFound("{}:{}.{}".format(
1288
1376
self.dbus_object_path, interface_name, property_name))
1289
1377
1290
1378
@classmethod
1291
1379
def _get_all_interface_names(cls):
1292
1380
"""Get a sequence of all interfaces supported by an object"""
1295
1383
for x in (inspect.getmro(cls))
1296
1384
for attr in dir(x))
1297
1385
if name is not None)
1298
1386
1299
1387
@dbus.service.method(dbus.PROPERTIES_IFACE,
1300
1388
in_signature="ss",
1301
1389
out_signature="v")
1309
1397
if not hasattr(value, "variant_level"):
1310
1398
return value
1311
1399
return type(value)(value, variant_level=value.variant_level+1)
1312
1400
1313
1401
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1314
1402
def Set(self, interface_name, property_name, value):
1315
1403
"""Standard D-Bus property Set() method, see D-Bus standard.
1327
1415
value = dbus.ByteArray(b''.join(chr(byte)
1328
1416
for byte in value))
1329
1417
prop(value)
1330
1418
1331
1419
@dbus.service.method(dbus.PROPERTIES_IFACE,
1332
1420
in_signature="s",
1333
1421
out_signature="a{sv}")
1334
1422
def GetAll(self, interface_name):
1335
1423
"""Standard D-Bus property GetAll() method, see D-Bus
1336
1424
standard.
1337
1425
1338
1426
Note: Will not include properties with access="write".
1339
1427
"""
1340
1428
properties = {}
1351
1439
properties[name] = value
1352
1440
continue
1353
1441
properties[name] = type(value)(
1354
value, variant_level = value.variant_level + 1)
1442
value, variant_level=value.variant_level + 1)
1355
1443
return dbus.Dictionary(properties, signature="sv")
1356
1444
1357
1445
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1358
1446
def PropertiesChanged(self, interface_name, changed_properties,
1359
1447
invalidated_properties):
1361
1449
standard.
1362
1450
"""
1363
1451
pass
1364
1452
1365
1453
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1366
1454
out_signature="s",
1367
1455
path_keyword='object_path',
1368
1456
connection_keyword='connection')
1369
1457
def Introspect(self, object_path, connection):
1370
1458
"""Overloading of standard D-Bus method.
1371
1459
1372
1460
Inserts property tags and interface annotation tags.
1373
1461
"""
1374
1462
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1376
1464
connection)
1377
1465
try:
1378
1466
document = xml.dom.minidom.parseString(xmlstring)
1379
1467
1380
1468
def make_tag(document, name, prop):
1381
1469
e = document.createElement("property")
1382
1470
e.setAttribute("name", name)
1383
1471
e.setAttribute("type", prop._dbus_signature)
1384
1472
e.setAttribute("access", prop._dbus_access)
1385
1473
return e
1386
1474
1387
1475
for if_tag in document.getElementsByTagName("interface"):
1388
1476
# Add property tags
1389
1477
for tag in (make_tag(document, name, prop)
1431
1519
exc_info=error)
1432
1520
return xmlstring
1433
1521
1522
1434
1523
try:
1435
1524
dbus.OBJECT_MANAGER_IFACE
1436
1525
except AttributeError:
1437
1526
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1438
1527
1528
1439
1529
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1440
1530
"""A D-Bus object with an ObjectManager.
1441
1531
1442
1532
Classes inheriting from this exposes the standard
1443
1533
GetManagedObjects call and the InterfacesAdded and
1444
1534
InterfacesRemoved signals on the standard
1445
1535
"org.freedesktop.DBus.ObjectManager" interface.
1446
1536
1447
1537
Note: No signals are sent automatically; they must be sent
1448
1538
manually.
1449
1539
"""
1450
1540
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1451
out_signature = "a{oa{sa{sv}}}")
1541
out_signature="a{oa{sa{sv}}}")
1452
1542
def GetManagedObjects(self):
1453
1543
"""This function must be overridden"""
1454
1544
raise NotImplementedError()
1455
1545
1456
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1457
signature = "oa{sa{sv}}")
1547
signature="oa{sa{sv}}")
1458
1548
def InterfacesAdded(self, object_path, interfaces_and_properties):
1459
1549
pass
1460
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1550
1551
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1462
1552
def InterfacesRemoved(self, object_path, interfaces):
1463
1553
pass
1464
1554
1465
1555
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1556
out_signature="s",
1557
path_keyword='object_path',
1558
connection_keyword='connection')
1469
1559
def Introspect(self, object_path, connection):
1470
1560
"""Overloading of standard D-Bus method.
1471
1561
1472
1562
Override return argument name of GetManagedObjects to be
1473
1563
"objpath_interfaces_and_properties"
1474
1564
"""
1477
1567
connection)
1478
1568
try:
1479
1569
document = xml.dom.minidom.parseString(xmlstring)
1480
1570
1481
1571
for if_tag in document.getElementsByTagName("interface"):
1482
1572
# Fix argument name for the GetManagedObjects method
1483
1573
if (if_tag.getAttribute("name")
1484
== dbus.OBJECT_MANAGER_IFACE):
1574
== dbus.OBJECT_MANAGER_IFACE):
1485
1575
for cn in if_tag.getElementsByTagName("method"):
1486
1576
if (cn.getAttribute("name")
1487
1577
== "GetManagedObjects"):
1497
1587
except (AttributeError, xml.dom.DOMException,
1498
1588
xml.parsers.expat.ExpatError) as error:
1499
1589
logger.error("Failed to override Introspection method",
1500
exc_info = error)
1590
exc_info=error)
1501
1591
return xmlstring
1502
1592
1593
1503
1594
def datetime_to_dbus(dt, variant_level=0):
1504
1595
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1505
1596
if dt is None:
1506
return dbus.String("", variant_level = variant_level)
1597
return dbus.String("", variant_level=variant_level)
1507
1598
return dbus.String(dt.isoformat(), variant_level=variant_level)
1508
1599
1509
1600
1512
1603
dbus.service.Object, it will add alternate D-Bus attributes with
1513
1604
interface names according to the "alt_interface_names" mapping.
1514
1605
Usage:
1515
1606
1516
1607
@alternate_dbus_interfaces({"org.example.Interface":
1517
1608
"net.example.AlternateInterface"})
1518
1609
class SampleDBusObject(dbus.service.Object):
1519
1610
@dbus.service.method("org.example.Interface")
1520
1611
def SampleDBusMethod():
1521
1612
pass
1522
1613
1523
1614
The above "SampleDBusMethod" on "SampleDBusObject" will be
1524
1615
reachable via two interfaces: "org.example.Interface" and
1525
1616
"net.example.AlternateInterface", the latter of which will have
1526
1617
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1527
1618
"true", unless "deprecate" is passed with a False value.
1528
1619
1529
1620
This works for methods and signals, and also for D-Bus properties
1530
1621
(from DBusObjectWithProperties) and interfaces (from the
1531
1622
dbus_interface_annotations decorator).
1532
1623
"""
1533
1624
1534
1625
def wrapper(cls):
1535
1626
for orig_interface_name, alt_interface_name in (
1536
1627
alt_interface_names.items()):
1576
1667
attribute._dbus_annotations)
1577
1668
except AttributeError:
1578
1669
pass
1670
1579
1671
# Define a creator of a function to call both the
1580
1672
# original and alternate functions, so both the
1581
1673
# original and alternate signals gets sent when
1584
1676
"""This function is a scope container to pass
1585
1677
func1 and func2 to the "call_both" function
1586
1678
outside of its arguments"""
1587
1679
1588
1680
@functools.wraps(func2)
1589
1681
def call_both(*args, **kwargs):
1590
1682
"""This function will emit two D-Bus
1591
1683
signals by calling func1 and func2"""
1592
1684
func1(*args, **kwargs)
1593
1685
func2(*args, **kwargs)
1594
# Make wrapper function look like a D-Bus signal
1686
# Make wrapper function look like a D-Bus
1687
# signal
1595
1688
for name, attr in inspect.getmembers(func2):
1596
1689
if name.startswith("_dbus_"):
1597
1690
setattr(call_both, name, attr)
1598
1691
1599
1692
return call_both
1600
1693
# Create the "call_both" function and add it to
1601
1694
# the class
1647
1740
(copy_function(attribute)))
1648
1741
if deprecate:
1649
1742
# Deprecate all alternate interfaces
1650
iname="_AlternateDBusNames_interface_annotation{}"
1743
iname = "_AlternateDBusNames_interface_annotation{}"
1651
1744
for interface_name in interface_names:
1652
1745
1653
1746
@dbus_interface_annotations(interface_name)
1654
1747
def func(self):
1655
return { "org.freedesktop.DBus.Deprecated":
1656
"true" }
1748
return {"org.freedesktop.DBus.Deprecated":
1749
"true"}
1657
1750
# Find an unused name
1658
1751
for aname in (iname.format(i)
1659
1752
for i in itertools.count()):
1670
1763
cls = type("{}Alternate".format(cls.__name__),
1671
1764
(cls, ), attr)
1672
1765
return cls
1673
1766
1674
1767
return wrapper
1675
1768
1676
1769
1678
1771
"se.bsnet.fukt.Mandos"})
1679
1772
class ClientDBus(Client, DBusObjectWithProperties):
1680
1773
"""A Client class using D-Bus
1681
1774
1682
1775
Attributes:
1683
1776
dbus_object_path: dbus.ObjectPath
1684
1777
bus: dbus.SystemBus()
1685
1778
"""
1686
1779
1687
1780
runtime_expansions = (Client.runtime_expansions
1688
1781
+ ("dbus_object_path", ))
1689
1782
1690
1783
_interface = "se.recompile.Mandos.Client"
1691
1784
1692
1785
# dbus.service.Object doesn't use super(), so we can't either.
1693
1694
def __init__(self, bus = None, *args, **kwargs):
1786
1787
def __init__(self, bus=None, *args, **kwargs):
1695
1788
self.bus = bus
1696
1789
Client.__init__(self, *args, **kwargs)
1697
1790
# Only now, when this client is initialized, can it show up on
1703
1796
"/clients/" + client_object_name)
1704
1797
DBusObjectWithProperties.__init__(self, self.bus,
1705
1798
self.dbus_object_path)
1706
1799
1707
1800
def notifychangeproperty(transform_func, dbus_name,
1708
1801
type_func=lambda x: x,
1709
1802
variant_level=1,
1711
1804
_interface=_interface):
1712
1805
""" Modify a variable so that it's a property which announces
1713
1806
its changes to DBus.
1714
1807
1715
1808
transform_fun: Function that takes a value and a variant_level
1716
1809
and transforms it to a D-Bus type.
1717
1810
dbus_name: D-Bus name of the variable
1720
1813
variant_level: D-Bus variant level. Default: 1
1721
1814
"""
1722
1815
attrname = "_{}".format(dbus_name)
1723
1816
1724
1817
def setter(self, value):
1725
1818
if hasattr(self, "dbus_object_path"):
1726
1819
if (not hasattr(self, attrname) or
1733
1826
else:
1734
1827
dbus_value = transform_func(
1735
1828
type_func(value),
1736
variant_level = variant_level)
1829
variant_level=variant_level)
1737
1830
self.PropertyChanged(dbus.String(dbus_name),
1738
1831
dbus_value)
1739
1832
self.PropertiesChanged(
1740
1833
_interface,
1741
dbus.Dictionary({ dbus.String(dbus_name):
1742
dbus_value }),
1834
dbus.Dictionary({dbus.String(dbus_name):
1835
dbus_value}),
1743
1836
dbus.Array())
1744
1837
setattr(self, attrname, value)
1745
1838
1746
1839
return property(lambda self: getattr(self, attrname), setter)
1747
1840
1748
1841
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1749
1842
approvals_pending = notifychangeproperty(dbus.Boolean,
1750
1843
"ApprovalPending",
1751
type_func = bool)
1844
type_func=bool)
1752
1845
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1753
1846
last_enabled = notifychangeproperty(datetime_to_dbus,
1754
1847
"LastEnabled")
1755
1848
checker = notifychangeproperty(
1756
1849
dbus.Boolean, "CheckerRunning",
1757
type_func = lambda checker: checker is not None)
1850
type_func=lambda checker: checker is not None)
1758
1851
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1759
1852
"LastCheckedOK")
1760
1853
last_checker_status = notifychangeproperty(dbus.Int16,
1765
1858
"ApprovedByDefault")
1766
1859
approval_delay = notifychangeproperty(
1767
1860
dbus.UInt64, "ApprovalDelay",
1768
type_func = lambda td: td.total_seconds() * 1000)
1861
type_func=lambda td: td.total_seconds() * 1000)
1769
1862
approval_duration = notifychangeproperty(
1770
1863
dbus.UInt64, "ApprovalDuration",
1771
type_func = lambda td: td.total_seconds() * 1000)
1864
type_func=lambda td: td.total_seconds() * 1000)
1772
1865
host = notifychangeproperty(dbus.String, "Host")
1773
1866
timeout = notifychangeproperty(
1774
1867
dbus.UInt64, "Timeout",
1775
type_func = lambda td: td.total_seconds() * 1000)
1868
type_func=lambda td: td.total_seconds() * 1000)
1776
1869
extended_timeout = notifychangeproperty(
1777
1870
dbus.UInt64, "ExtendedTimeout",
1778
type_func = lambda td: td.total_seconds() * 1000)
1871
type_func=lambda td: td.total_seconds() * 1000)
1779
1872
interval = notifychangeproperty(
1780
1873
dbus.UInt64, "Interval",
1781
type_func = lambda td: td.total_seconds() * 1000)
1874
type_func=lambda td: td.total_seconds() * 1000)
1782
1875
checker_command = notifychangeproperty(dbus.String, "Checker")
1783
1876
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1784
1877
invalidate_only=True)
1785
1878
1786
1879
del notifychangeproperty
1787
1880
1788
1881
def __del__(self, *args, **kwargs):
1789
1882
try:
1790
1883
self.remove_from_connection()
1793
1886
if hasattr(DBusObjectWithProperties, "__del__"):
1794
1887
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1795
1888
Client.__del__(self, *args, **kwargs)
1796
1889
1797
1890
def checker_callback(self, source, condition,
1798
1891
connection, command, *args, **kwargs):
1799
1892
ret = Client.checker_callback(self, source, condition,
1815
1908
| self.last_checker_signal),
1816
1909
dbus.String(command))
1817
1910
return ret
1818
1911
1819
1912
def start_checker(self, *args, **kwargs):
1820
1913
old_checker_pid = getattr(self.checker, "pid", None)
1821
1914
r = Client.start_checker(self, *args, **kwargs)
1825
1918
# Emit D-Bus signal
1826
1919
self.CheckerStarted(self.current_checker_command)
1827
1920
return r
1828
1921
1829
1922
def _reset_approved(self):
1830
1923
self.approved = None
1831
1924
return False
1832
1925
1833
1926
def approve(self, value=True):
1834
1927
self.approved = value
1835
GObject.timeout_add(int(self.approval_duration.total_seconds()
1836
* 1000), self._reset_approved)
1928
GLib.timeout_add(int(self.approval_duration.total_seconds()
1929
* 1000), self._reset_approved)
1837
1930
self.send_changedstate()
1838
1839
## D-Bus methods, signals & properties
1840
1841
## Interfaces
1842
1843
## Signals
1844
1931
1932
# D-Bus methods, signals & properties
1933
1934
# Interfaces
1935
1936
# Signals
1937
1845
1938
# CheckerCompleted - signal
1846
1939
@dbus.service.signal(_interface, signature="nxs")
1847
1940
def CheckerCompleted(self, exitcode, waitstatus, command):
1848
1941
"D-Bus signal"
1849
1942
pass
1850
1943
1851
1944
# CheckerStarted - signal
1852
1945
@dbus.service.signal(_interface, signature="s")
1853
1946
def CheckerStarted(self, command):
1854
1947
"D-Bus signal"
1855
1948
pass
1856
1949
1857
1950
# PropertyChanged - signal
1858
1951
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1859
1952
@dbus.service.signal(_interface, signature="sv")
1860
1953
def PropertyChanged(self, property, value):
1861
1954
"D-Bus signal"
1862
1955
pass
1863
1956
1864
1957
# GotSecret - signal
1865
1958
@dbus.service.signal(_interface)
1866
1959
def GotSecret(self):
1869
1962
server to mandos-client
1870
1963
"""
1871
1964
pass
1872
1965
1873
1966
# Rejected - signal
1874
1967
@dbus.service.signal(_interface, signature="s")
1875
1968
def Rejected(self, reason):
1876
1969
"D-Bus signal"
1877
1970
pass
1878
1971
1879
1972
# NeedApproval - signal
1880
1973
@dbus.service.signal(_interface, signature="tb")
1881
1974
def NeedApproval(self, timeout, default):
1882
1975
"D-Bus signal"
1883
1976
return self.need_approval()
1884
1885
## Methods
1886
1977
1978
# Methods
1979
1887
1980
# Approve - method
1888
1981
@dbus.service.method(_interface, in_signature="b")
1889
1982
def Approve(self, value):
1890
1983
self.approve(value)
1891
1984
1892
1985
# CheckedOK - method
1893
1986
@dbus.service.method(_interface)
1894
1987
def CheckedOK(self):
1895
1988
self.checked_ok()
1896
1989
1897
1990
# Enable - method
1898
1991
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1899
1992
@dbus.service.method(_interface)
1900
1993
def Enable(self):
1901
1994
"D-Bus method"
1902
1995
self.enable()
1903
1996
1904
1997
# StartChecker - method
1905
1998
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1906
1999
@dbus.service.method(_interface)
1907
2000
def StartChecker(self):
1908
2001
"D-Bus method"
1909
2002
self.start_checker()
1910
2003
1911
2004
# Disable - method
1912
2005
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1913
2006
@dbus.service.method(_interface)
1914
2007
def Disable(self):
1915
2008
"D-Bus method"
1916
2009
self.disable()
1917
2010
1918
2011
# StopChecker - method
1919
2012
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1920
2013
@dbus.service.method(_interface)
1921
2014
def StopChecker(self):
1922
2015
self.stop_checker()
1923
1924
## Properties
1925
2016
2017
# Properties
2018
1926
2019
# ApprovalPending - property
1927
2020
@dbus_service_property(_interface, signature="b", access="read")
1928
2021
def ApprovalPending_dbus_property(self):
1929
2022
return dbus.Boolean(bool(self.approvals_pending))
1930
2023
1931
2024
# ApprovedByDefault - property
1932
2025
@dbus_service_property(_interface,
1933
2026
signature="b",
1936
2029
if value is None: # get
1937
2030
return dbus.Boolean(self.approved_by_default)
1938
2031
self.approved_by_default = bool(value)
1939
2032
1940
2033
# ApprovalDelay - property
1941
2034
@dbus_service_property(_interface,
1942
2035
signature="t",
1946
2039
return dbus.UInt64(self.approval_delay.total_seconds()
1947
2040
* 1000)
1948
2041
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1949
2042
1950
2043
# ApprovalDuration - property
1951
2044
@dbus_service_property(_interface,
1952
2045
signature="t",
1956
2049
return dbus.UInt64(self.approval_duration.total_seconds()
1957
2050
* 1000)
1958
2051
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1959
2052
1960
2053
# Name - property
1961
2054
@dbus_annotations(
1962
2055
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1963
2056
@dbus_service_property(_interface, signature="s", access="read")
1964
2057
def Name_dbus_property(self):
1965
2058
return dbus.String(self.name)
1966
2059
2060
# KeyID - property
2061
@dbus_annotations(
2062
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2063
@dbus_service_property(_interface, signature="s", access="read")
2064
def KeyID_dbus_property(self):
2065
return dbus.String(self.key_id)
2066
1967
2067
# Fingerprint - property
1968
2068
@dbus_annotations(
1969
2069
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1970
2070
@dbus_service_property(_interface, signature="s", access="read")
1971
2071
def Fingerprint_dbus_property(self):
1972
2072
return dbus.String(self.fingerprint)
1973
2073
1974
2074
# Host - property
1975
2075
@dbus_service_property(_interface,
1976
2076
signature="s",
1979
2079
if value is None: # get
1980
2080
return dbus.String(self.host)
1981
2081
self.host = str(value)
1982
2082
1983
2083
# Created - property
1984
2084
@dbus_annotations(
1985
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
2086
@dbus_service_property(_interface, signature="s", access="read")
1987
2087
def Created_dbus_property(self):
1988
2088
return datetime_to_dbus(self.created)
1989
2089
1990
2090
# LastEnabled - property
1991
2091
@dbus_service_property(_interface, signature="s", access="read")
1992
2092
def LastEnabled_dbus_property(self):
1993
2093
return datetime_to_dbus(self.last_enabled)
1994
2094
1995
2095
# Enabled - property
1996
2096
@dbus_service_property(_interface,
1997
2097
signature="b",
2003
2103
self.enable()
2004
2104
else:
2005
2105
self.disable()
2006
2106
2007
2107
# LastCheckedOK - property
2008
2108
@dbus_service_property(_interface,
2009
2109
signature="s",
2013
2113
self.checked_ok()
2014
2114
return
2015
2115
return datetime_to_dbus(self.last_checked_ok)
2016
2116
2017
2117
# LastCheckerStatus - property
2018
2118
@dbus_service_property(_interface, signature="n", access="read")
2019
2119
def LastCheckerStatus_dbus_property(self):
2020
2120
return dbus.Int16(self.last_checker_status)
2021
2121
2022
2122
# Expires - property
2023
2123
@dbus_service_property(_interface, signature="s", access="read")
2024
2124
def Expires_dbus_property(self):
2025
2125
return datetime_to_dbus(self.expires)
2026
2126
2027
2127
# LastApprovalRequest - property
2028
2128
@dbus_service_property(_interface, signature="s", access="read")
2029
2129
def LastApprovalRequest_dbus_property(self):
2030
2130
return datetime_to_dbus(self.last_approval_request)
2031
2131
2032
2132
# Timeout - property
2033
2133
@dbus_service_property(_interface,
2034
2134
signature="t",
2049
2149
if (getattr(self, "disable_initiator_tag", None)
2050
2150
is None):
2051
2151
return
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2152
GLib.source_remove(self.disable_initiator_tag)
2153
self.disable_initiator_tag = GLib.timeout_add(
2054
2154
int((self.expires - now).total_seconds() * 1000),
2055
2155
self.disable)
2056
2156
2057
2157
# ExtendedTimeout - property
2058
2158
@dbus_service_property(_interface,
2059
2159
signature="t",
2063
2163
return dbus.UInt64(self.extended_timeout.total_seconds()
2064
2164
* 1000)
2065
2165
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2066
2166
2067
2167
# Interval - property
2068
2168
@dbus_service_property(_interface,
2069
2169
signature="t",
2076
2176
return
2077
2177
if self.enabled:
2078
2178
# Reschedule checker run
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2179
GLib.source_remove(self.checker_initiator_tag)
2180
self.checker_initiator_tag = GLib.timeout_add(
2081
2181
value, self.start_checker)
2082
self.start_checker() # Start one now, too
2083
2182
self.start_checker() # Start one now, too
2183
2084
2184
# Checker - property
2085
2185
@dbus_service_property(_interface,
2086
2186
signature="s",
2089
2189
if value is None: # get
2090
2190
return dbus.String(self.checker_command)
2091
2191
self.checker_command = str(value)
2092
2192
2093
2193
# CheckerRunning - property
2094
2194
@dbus_service_property(_interface,
2095
2195
signature="b",
2101
2201
self.start_checker()
2102
2202
else:
2103
2203
self.stop_checker()
2104
2204
2105
2205
# ObjectPath - property
2106
2206
@dbus_annotations(
2107
2207
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2108
2208
"org.freedesktop.DBus.Deprecated": "true"})
2109
2209
@dbus_service_property(_interface, signature="o", access="read")
2110
2210
def ObjectPath_dbus_property(self):
2111
return self.dbus_object_path # is already a dbus.ObjectPath
2112
2211
return self.dbus_object_path # is already a dbus.ObjectPath
2212
2113
2213
# Secret = property
2114
2214
@dbus_annotations(
2115
2215
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2120
2220
byte_arrays=True)
2121
2221
def Secret_dbus_property(self, value):
2122
2222
self.secret = bytes(value)
2123
2223
2124
2224
del _interface
2125
2225
2126
2226
2127
class ProxyClient(object):
2128
def __init__(self, child_pipe, fpr, address):
2227
class ProxyClient:
2228
def __init__(self, child_pipe, key_id, fpr, address):
2129
2229
self._pipe = child_pipe
2130
self._pipe.send(('init', fpr, address))
2230
self._pipe.send(('init', key_id, fpr, address))
2131
2231
if not self._pipe.recv():
2132
raise KeyError(fpr)
2133
2232
raise KeyError(key_id or fpr)
2233
2134
2234
def __getattribute__(self, name):
2135
2235
if name == '_pipe':
2136
2236
return super(ProxyClient, self).__getattribute__(name)
2139
2239
if data[0] == 'data':
2140
2240
return data[1]
2141
2241
if data[0] == 'function':
2142
2242
2143
2243
def func(*args, **kwargs):
2144
2244
self._pipe.send(('funcall', name, args, kwargs))
2145
2245
return self._pipe.recv()[1]
2146
2246
2147
2247
return func
2148
2248
2149
2249
def __setattr__(self, name, value):
2150
2250
if name == '_pipe':
2151
2251
return super(ProxyClient, self).__setattr__(name, value)
2154
2254
2155
2255
class ClientHandler(socketserver.BaseRequestHandler, object):
2156
2256
"""A class to handle client connections.
2157
2257
2158
2258
Instantiated once for each connection to handle it.
2159
2259
Note: This will run in its own forked process."""
2160
2260
2161
2261
def handle(self):
2162
2262
with contextlib.closing(self.server.child_pipe) as child_pipe:
2163
2263
logger.info("TCP connection from: %s",
2164
2264
str(self.client_address))
2165
2265
logger.debug("Pipe FD: %d",
2166
2266
self.server.child_pipe.fileno())
2167
2267
2168
2268
session = gnutls.ClientSession(self.request)
2169
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2173
# "+DHE-DSS"))
2269
2270
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2271
# "+AES-256-CBC", "+SHA1",
2272
# "+COMP-NULL", "+CTYPE-OPENPGP",
2273
# "+DHE-DSS"))
2174
2274
# Use a fallback default, since this MUST be set.
2175
2275
priority = self.server.gnutls_priority
2176
2276
if priority is None:
2177
2277
priority = "NORMAL"
2178
gnutls.priority_set_direct(session._c_object, priority,
2278
gnutls.priority_set_direct(session._c_object,
2279
priority.encode("utf-8"),
2179
2280
None)
2180
2281
2181
2282
# Start communication using the Mandos protocol
2182
2283
# Get protocol number
2183
2284
line = self.request.makefile().readline()
2188
2289
except (ValueError, IndexError, RuntimeError) as error:
2189
2290
logger.error("Unknown protocol version: %s", error)
2190
2291
return
2191
2292
2192
2293
# Start GnuTLS connection
2193
2294
try:
2194
2295
session.handshake()
2198
2299
# established. Just abandon the request.
2199
2300
return
2200
2301
logger.debug("Handshake succeeded")
2201
2302
2202
2303
approval_required = False
2203
2304
try:
2204
try:
2205
fpr = self.fingerprint(
2206
self.peer_certificate(session))
2207
except (TypeError, gnutls.Error) as error:
2208
logger.warning("Bad certificate: %s", error)
2209
return
2210
logger.debug("Fingerprint: %s", fpr)
2211
2212
try:
2213
client = ProxyClient(child_pipe, fpr,
2305
if gnutls.has_rawpk:
2306
fpr = b""
2307
try:
2308
key_id = self.key_id(
2309
self.peer_certificate(session))
2310
except (TypeError, gnutls.Error) as error:
2311
logger.warning("Bad certificate: %s", error)
2312
return
2313
logger.debug("Key ID: %s", key_id)
2314
2315
else:
2316
key_id = b""
2317
try:
2318
fpr = self.fingerprint(
2319
self.peer_certificate(session))
2320
except (TypeError, gnutls.Error) as error:
2321
logger.warning("Bad certificate: %s", error)
2322
return
2323
logger.debug("Fingerprint: %s", fpr)
2324
2325
try:
2326
client = ProxyClient(child_pipe, key_id, fpr,
2214
2327
self.client_address)
2215
2328
except KeyError:
2216
2329
return
2217
2330
2218
2331
if client.approval_delay:
2219
2332
delay = client.approval_delay
2220
2333
client.approvals_pending += 1
2221
2334
approval_required = True
2222
2335
2223
2336
while True:
2224
2337
if not client.enabled:
2225
2338
logger.info("Client %s is disabled",
2228
2341
# Emit D-Bus signal
2229
2342
client.Rejected("Disabled")
2230
2343
return
2231
2344
2232
2345
if client.approved or not client.approval_delay:
2233
#We are approved or approval is disabled
2346
# We are approved or approval is disabled
2234
2347
break
2235
2348
elif client.approved is None:
2236
2349
logger.info("Client %s needs approval",
2247
2360
# Emit D-Bus signal
2248
2361
client.Rejected("Denied")
2249
2362
return
2250
2251
#wait until timeout or approved
2363
2364
# wait until timeout or approved
2252
2365
time = datetime.datetime.now()
2253
2366
client.changedstate.acquire()
2254
2367
client.changedstate.wait(delay.total_seconds())
2267
2380
break
2268
2381
else:
2269
2382
delay -= time2 - time
2270
2383
2271
2384
try:
2272
2385
session.send(client.secret)
2273
2386
except gnutls.Error as error:
2274
2387
logger.warning("gnutls send failed",
2275
exc_info = error)
2388
exc_info=error)
2276
2389
return
2277
2390
2278
2391
logger.info("Sending secret to %s", client.name)
2279
2392
# bump the timeout using extended_timeout
2280
2393
client.bump_timeout(client.extended_timeout)
2281
2394
if self.server.use_dbus:
2282
2395
# Emit D-Bus signal
2283
2396
client.GotSecret()
2284
2397
2285
2398
finally:
2286
2399
if approval_required:
2287
2400
client.approvals_pending -= 1
2290
2403
except gnutls.Error as error:
2291
2404
logger.warning("GnuTLS bye failed",
2292
2405
exc_info=error)
2293
2406
2294
2407
@staticmethod
2295
2408
def peer_certificate(session):
2296
"Return the peer's OpenPGP certificate as a bytestring"
2297
# If not an OpenPGP certificate...
2298
if (gnutls.certificate_type_get(session._c_object)
2299
!= gnutls.CRT_OPENPGP):
2409
"Return the peer's certificate as a bytestring"
2410
try:
2411
cert_type = gnutls.certificate_type_get2(session._c_object,
2412
gnutls.CTYPE_PEERS)
2413
except AttributeError:
2414
cert_type = gnutls.certificate_type_get(session._c_object)
2415
if gnutls.has_rawpk:
2416
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2417
else:
2418
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2419
# If not a valid certificate type...
2420
if cert_type not in valid_cert_types:
2421
logger.info("Cert type %r not in %r", cert_type,
2422
valid_cert_types)
2300
2423
# ...return invalid data
2301
2424
return b""
2302
2425
list_size = ctypes.c_uint(1)
2308
2431
return None
2309
2432
cert = cert_list[0]
2310
2433
return ctypes.string_at(cert.data, cert.size)
2311
2434
2435
@staticmethod
2436
def key_id(certificate):
2437
"Convert a certificate bytestring to a hexdigit key ID"
2438
# New GnuTLS "datum" with the public key
2439
datum = gnutls.datum_t(
2440
ctypes.cast(ctypes.c_char_p(certificate),
2441
ctypes.POINTER(ctypes.c_ubyte)),
2442
ctypes.c_uint(len(certificate)))
2443
# XXX all these need to be created in the gnutls "module"
2444
# New empty GnuTLS certificate
2445
pubkey = gnutls.pubkey_t()
2446
gnutls.pubkey_init(ctypes.byref(pubkey))
2447
# Import the raw public key into the certificate
2448
gnutls.pubkey_import(pubkey,
2449
ctypes.byref(datum),
2450
gnutls.X509_FMT_DER)
2451
# New buffer for the key ID
2452
buf = ctypes.create_string_buffer(32)
2453
buf_len = ctypes.c_size_t(len(buf))
2454
# Get the key ID from the raw public key into the buffer
2455
gnutls.pubkey_get_key_id(pubkey,
2456
gnutls.KEYID_USE_SHA256,
2457
ctypes.cast(ctypes.byref(buf),
2458
ctypes.POINTER(ctypes.c_ubyte)),
2459
ctypes.byref(buf_len))
2460
# Deinit the certificate
2461
gnutls.pubkey_deinit(pubkey)
2462
2463
# Convert the buffer to a Python bytestring
2464
key_id = ctypes.string_at(buf, buf_len.value)
2465
# Convert the bytestring to hexadecimal notation
2466
hex_key_id = binascii.hexlify(key_id).upper()
2467
return hex_key_id
2468
2312
2469
@staticmethod
2313
2470
def fingerprint(openpgp):
2314
2471
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2329
2486
ctypes.byref(crtverify))
2330
2487
if crtverify.value != 0:
2331
2488
gnutls.openpgp_crt_deinit(crt)
2332
raise gnutls.CertificateSecurityError("Verify failed")
2489
raise gnutls.CertificateSecurityError(code
2490
=crtverify.value)
2333
2491
# New buffer for the fingerprint
2334
2492
buf = ctypes.create_string_buffer(20)
2335
2493
buf_len = ctypes.c_size_t()
2345
2503
return hex_fpr
2346
2504
2347
2505
2348
class MultiprocessingMixIn(object):
2506
class MultiprocessingMixIn:
2349
2507
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2350
2508
2351
2509
def sub_process_main(self, request, address):
2352
2510
try:
2353
2511
self.finish_request(request, address)
2354
2512
except Exception:
2355
2513
self.handle_error(request, address)
2356
2514
self.close_request(request)
2357
2515
2358
2516
def process_request(self, request, address):
2359
2517
"""Start a new process to process the request."""
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2518
proc = multiprocessing.Process(target=self.sub_process_main,
2519
args=(request, address))
2362
2520
proc.start()
2363
2521
return proc
2364
2522
2365
2523
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2524
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2367
2525
""" adds a pipe to the MixIn """
2368
2526
2369
2527
def process_request(self, request, client_address):
2370
2528
"""Overrides and wraps the original process_request().
2371
2529
2372
2530
This function creates a new pipe in self.pipe
2373
2531
"""
2374
2532
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2375
2533
2376
2534
proc = MultiprocessingMixIn.process_request(self, request,
2377
2535
client_address)
2378
2536
self.child_pipe.close()
2379
2537
self.add_pipe(parent_pipe, proc)
2380
2538
2381
2539
def add_pipe(self, parent_pipe, proc):
2382
2540
"""Dummy function; override as necessary"""
2383
2541
raise NotImplementedError()
2384
2542
2385
2543
2386
2544
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2387
socketserver.TCPServer, object):
2545
socketserver.TCPServer):
2388
2546
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2389
2547
2390
2548
Attributes:
2391
2549
enabled: Boolean; whether this server is activated yet
2392
2550
interface: None or a network interface name (string)
2393
2551
use_ipv6: Boolean; to use IPv6 or not
2394
2552
"""
2395
2553
2396
2554
def __init__(self, server_address, RequestHandlerClass,
2397
2555
interface=None,
2398
2556
use_ipv6=True,
2408
2566
self.socketfd = socketfd
2409
2567
# Save the original socket.socket() function
2410
2568
self.socket_socket = socket.socket
2569
2411
2570
# To implement --socket, we monkey patch socket.socket.
2412
#
2571
#
2413
2572
# (When socketserver.TCPServer is a new-style class, we
2414
2573
# could make self.socket into a property instead of monkey
2415
2574
# patching socket.socket.)
2416
#
2575
#
2417
2576
# Create a one-time-only replacement for socket.socket()
2418
2577
@functools.wraps(socket.socket)
2419
2578
def socket_wrapper(*args, **kwargs):
2431
2590
# socket_wrapper(), if socketfd was set.
2432
2591
socketserver.TCPServer.__init__(self, server_address,
2433
2592
RequestHandlerClass)
2434
2593
2435
2594
def server_bind(self):
2436
2595
"""This overrides the normal server_bind() function
2437
2596
to bind to an interface if one was specified, and also NOT to
2438
2597
bind to an address or port if they were not specified."""
2598
global SO_BINDTODEVICE
2439
2599
if self.interface is not None:
2440
2600
if SO_BINDTODEVICE is None:
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2443
self.interface)
2444
else:
2445
try:
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2456
self.interface)
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2460
else:
2461
raise
2601
# Fall back to a hard-coded value which seems to be
2602
# common enough.
2603
logger.warning("SO_BINDTODEVICE not found, trying 25")
2604
SO_BINDTODEVICE = 25
2605
try:
2606
self.socket.setsockopt(
2607
socket.SOL_SOCKET, SO_BINDTODEVICE,
2608
(self.interface + "\0").encode("utf-8"))
2609
except socket.error as error:
2610
if error.errno == errno.EPERM:
2611
logger.error("No permission to bind to"
2612
" interface %s", self.interface)
2613
elif error.errno == errno.ENOPROTOOPT:
2614
logger.error("SO_BINDTODEVICE not available;"
2615
" cannot bind to interface %s",
2616
self.interface)
2617
elif error.errno == errno.ENODEV:
2618
logger.error("Interface %s does not exist,"
2619
" cannot bind", self.interface)
2620
else:
2621
raise
2462
2622
# Only bind(2) the socket if we really need to.
2463
2623
if self.server_address[0] or self.server_address[1]:
2624
if self.server_address[1]:
2625
self.allow_reuse_address = True
2464
2626
if not self.server_address[0]:
2465
2627
if self.address_family == socket.AF_INET6:
2466
any_address = "::" # in6addr_any
2628
any_address = "::" # in6addr_any
2467
2629
else:
2468
any_address = "0.0.0.0" # INADDR_ANY
2630
any_address = "0.0.0.0" # INADDR_ANY
2469
2631
self.server_address = (any_address,
2470
2632
self.server_address[1])
2471
2633
elif not self.server_address[1]:
2481
2643
2482
2644
class MandosServer(IPv6_TCPServer):
2483
2645
"""Mandos server.
2484
2646
2485
2647
Attributes:
2486
2648
clients: set of Client objects
2487
2649
gnutls_priority GnuTLS priority string
2488
2650
use_dbus: Boolean; to emit D-Bus signals or not
2489
2490
Assumes a GObject.MainLoop event loop.
2651
2652
Assumes a GLib.MainLoop event loop.
2491
2653
"""
2492
2654
2493
2655
def __init__(self, server_address, RequestHandlerClass,
2494
2656
interface=None,
2495
2657
use_ipv6=True,
2505
2667
self.gnutls_priority = gnutls_priority
2506
2668
IPv6_TCPServer.__init__(self, server_address,
2507
2669
RequestHandlerClass,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2511
2670
interface=interface,
2671
use_ipv6=use_ipv6,
2672
socketfd=socketfd)
2673
2512
2674
def server_activate(self):
2513
2675
if self.enabled:
2514
2676
return socketserver.TCPServer.server_activate(self)
2515
2677
2516
2678
def enable(self):
2517
2679
self.enabled = True
2518
2680
2519
2681
def add_pipe(self, parent_pipe, proc):
2520
2682
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2522
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2683
GLib.io_add_watch(
2684
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2685
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2524
2686
functools.partial(self.handle_ipc,
2525
parent_pipe = parent_pipe,
2526
proc = proc))
2527
2687
parent_pipe=parent_pipe,
2688
proc=proc))
2689
2528
2690
def handle_ipc(self, source, condition,
2529
2691
parent_pipe=None,
2530
proc = None,
2692
proc=None,
2531
2693
client_object=None):
2532
2694
# error, or the other end of multiprocessing.Pipe has closed
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2695
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2534
2696
# Wait for other process to exit
2535
2697
proc.join()
2536
2698
return False
2537
2699
2538
2700
# Read a request from the child
2539
2701
request = parent_pipe.recv()
2540
2702
command = request[0]
2541
2703
2542
2704
if command == 'init':
2543
fpr = request[1]
2544
address = request[2]
2545
2705
key_id = request[1].decode("ascii")
2706
fpr = request[2].decode("ascii")
2707
address = request[3]
2708
2546
2709
for c in self.clients.values():
2547
if c.fingerprint == fpr:
2710
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2711
continue
2712
if key_id and c.key_id == key_id:
2713
client = c
2714
break
2715
if fpr and c.fingerprint == fpr:
2548
2716
client = c
2549
2717
break
2550
2718
else:
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2719
logger.info("Client not found for key ID: %s, address"
2720
": %s", key_id or fpr, address)
2553
2721
if self.use_dbus:
2554
2722
# Emit D-Bus signal
2555
mandos_dbus_service.ClientNotFound(fpr,
2723
mandos_dbus_service.ClientNotFound(key_id or fpr,
2556
2724
address[0])
2557
2725
parent_pipe.send(False)
2558
2726
return False
2559
2560
GObject.io_add_watch(
2561
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2727
2728
GLib.io_add_watch(
2729
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2730
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2563
2731
functools.partial(self.handle_ipc,
2564
parent_pipe = parent_pipe,
2565
proc = proc,
2566
client_object = client))
2732
parent_pipe=parent_pipe,
2733
proc=proc,
2734
client_object=client))
2567
2735
parent_pipe.send(True)
2568
2736
# remove the old hook in favor of the new above hook on
2569
2737
# same fileno
2572
2740
funcname = request[1]
2573
2741
args = request[2]
2574
2742
kwargs = request[3]
2575
2743
2576
2744
parent_pipe.send(('data', getattr(client_object,
2577
2745
funcname)(*args,
2578
2746
**kwargs)))
2579
2747
2580
2748
if command == 'getattr':
2581
2749
attrname = request[1]
2582
2750
if isinstance(client_object.__getattribute__(attrname),
2585
2753
else:
2586
2754
parent_pipe.send((
2587
2755
'data', client_object.__getattribute__(attrname)))
2588
2756
2589
2757
if command == 'setattr':
2590
2758
attrname = request[1]
2591
2759
value = request[2]
2592
2760
setattr(client_object, attrname, value)
2593
2761
2594
2762
return True
2595
2763
2596
2764
2597
2765
def rfc3339_duration_to_delta(duration):
2598
2766
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2599
2600
>>> rfc3339_duration_to_delta("P7D")
2601
datetime.timedelta(7)
2602
>>> rfc3339_duration_to_delta("PT60S")
2603
datetime.timedelta(0, 60)
2604
>>> rfc3339_duration_to_delta("PT60M")
2605
datetime.timedelta(0, 3600)
2606
>>> rfc3339_duration_to_delta("PT24H")
2607
datetime.timedelta(1)
2608
>>> rfc3339_duration_to_delta("P1W")
2609
datetime.timedelta(7)
2610
>>> rfc3339_duration_to_delta("PT5M30S")
2611
datetime.timedelta(0, 330)
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
datetime.timedelta(1, 200)
2767
2768
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2769
True
2770
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2771
True
2772
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2773
True
2774
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2775
True
2776
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2777
True
2778
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2779
True
2780
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2781
True
2614
2782
"""
2615
2783
2616
2784
# Parsing an RFC 3339 duration with regular expressions is not
2617
2785
# possible - there would have to be multiple places for the same
2618
2786
# values, like seconds. The current code, while more esoteric, is
2619
2787
# cleaner without depending on a parsing library. If Python had a
2620
2788
# built-in library for parsing we would use it, but we'd like to
2621
2789
# avoid excessive use of external libraries.
2622
2790
2623
2791
# New type for defining tokens, syntax, and semantics all-in-one
2624
2792
Token = collections.namedtuple("Token", (
2625
2793
"regexp", # To match token; if "value" is not None, must have
2658
2826
frozenset((token_year, token_month,
2659
2827
token_day, token_time,
2660
2828
token_week)))
2661
# Define starting values
2662
value = datetime.timedelta() # Value so far
2829
# Define starting values:
2830
# Value so far
2831
value = datetime.timedelta()
2663
2832
found_token = None
2664
followers = frozenset((token_duration, )) # Following valid tokens
2665
s = duration # String left to parse
2833
# Following valid tokens
2834
followers = frozenset((token_duration, ))
2835
# String left to parse
2836
s = duration
2666
2837
# Loop until end token is found
2667
2838
while found_token is not token_end:
2668
2839
# Search for any currently valid tokens
2692
2863
2693
2864
def string_to_delta(interval):
2694
2865
"""Parse a string and return a datetime.timedelta
2695
2696
>>> string_to_delta('7d')
2697
datetime.timedelta(7)
2698
>>> string_to_delta('60s')
2699
datetime.timedelta(0, 60)
2700
>>> string_to_delta('60m')
2701
datetime.timedelta(0, 3600)
2702
>>> string_to_delta('24h')
2703
datetime.timedelta(1)
2704
>>> string_to_delta('1w')
2705
datetime.timedelta(7)
2706
>>> string_to_delta('5m 30s')
2707
datetime.timedelta(0, 330)
2866
2867
>>> string_to_delta('7d') == datetime.timedelta(7)
2868
True
2869
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2870
True
2871
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2872
True
2873
>>> string_to_delta('24h') == datetime.timedelta(1)
2874
True
2875
>>> string_to_delta('1w') == datetime.timedelta(7)
2876
True
2877
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2878
True
2708
2879
"""
2709
2880
2710
2881
try:
2711
2882
return rfc3339_duration_to_delta(interval)
2712
2883
except ValueError:
2713
2884
pass
2714
2885
2715
2886
timevalue = datetime.timedelta(0)
2716
2887
for s in interval.split():
2717
2888
try:
2735
2906
return timevalue
2736
2907
2737
2908
2738
def daemon(nochdir = False, noclose = False):
2909
def daemon(nochdir=False, noclose=False):
2739
2910
"""See daemon(3). Standard BSD Unix function.
2740
2911
2741
2912
This should really exist as os.daemon, but it doesn't (yet)."""
2742
2913
if os.fork():
2743
2914
sys.exit()
2761
2932
2762
2933
2763
2934
def main():
2764
2935
2765
2936
##################################################################
2766
2937
# Parsing of options, both command line and config file
2767
2938
2768
2939
parser = argparse.ArgumentParser()
2769
2940
parser.add_argument("-v", "--version", action="version",
2770
version = "%(prog)s {}".format(version),
2941
version="%(prog)s {}".format(version),
2771
2942
help="show version number and exit")
2772
2943
parser.add_argument("-i", "--interface", metavar="IF",
2773
2944
help="Bind to interface IF")
2809
2980
parser.add_argument("--no-zeroconf", action="store_false",
2810
2981
dest="zeroconf", help="Do not use Zeroconf",
2811
2982
default=None)
2812
2983
2813
2984
options = parser.parse_args()
2814
2815
if options.check:
2816
import doctest
2817
fail_count, test_count = doctest.testmod()
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2819
2985
2820
2986
# Default values for config file for server-global settings
2821
server_defaults = { "interface": "",
2822
"address": "",
2823
"port": "",
2824
"debug": "False",
2825
"priority":
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2829
"use_dbus": "True",
2830
"use_ipv6": "True",
2831
"debuglevel": "",
2832
"restore": "True",
2833
"socket": "",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2836
"zeroconf": "True",
2837
}
2838
2987
if gnutls.has_rawpk:
2988
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2989
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2990
else:
2991
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2992
":+SIGN-DSA-SHA256")
2993
server_defaults = {"interface": "",
2994
"address": "",
2995
"port": "",
2996
"debug": "False",
2997
"priority": priority,
2998
"servicename": "Mandos",
2999
"use_dbus": "True",
3000
"use_ipv6": "True",
3001
"debuglevel": "",
3002
"restore": "True",
3003
"socket": "",
3004
"statedir": "/var/lib/mandos",
3005
"foreground": "False",
3006
"zeroconf": "True",
3007
}
3008
del priority
3009
2839
3010
# Parse config file for server-global settings
2840
server_config = configparser.SafeConfigParser(server_defaults)
3011
server_config = configparser.ConfigParser(server_defaults)
2841
3012
del server_defaults
2842
3013
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2843
# Convert the SafeConfigParser object to a dict
3014
# Convert the ConfigParser object to a dict
2844
3015
server_settings = server_config.defaults()
2845
3016
# Use the appropriate methods on the non-string config options
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3017
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3018
"foreground", "zeroconf"):
2847
3019
server_settings[option] = server_config.getboolean("DEFAULT",
2848
3020
option)
2849
3021
if server_settings["port"]:
2859
3031
server_settings["socket"] = os.dup(server_settings
2860
3032
["socket"])
2861
3033
del server_config
2862
3034
2863
3035
# Override the settings from the config file with command line
2864
3036
# options, if set.
2865
3037
for option in ("interface", "address", "port", "debug",
2883
3055
if server_settings["debug"]:
2884
3056
server_settings["foreground"] = True
2885
3057
# Now we have our good server settings in "server_settings"
2886
3058
2887
3059
##################################################################
2888
3060
2889
3061
if (not server_settings["zeroconf"]
2890
3062
and not (server_settings["port"]
2891
3063
or server_settings["socket"] != "")):
2892
3064
parser.error("Needs port or socket to work without Zeroconf")
2893
3065
2894
3066
# For convenience
2895
3067
debug = server_settings["debug"]
2896
3068
debuglevel = server_settings["debuglevel"]
2900
3072
stored_state_file)
2901
3073
foreground = server_settings["foreground"]
2902
3074
zeroconf = server_settings["zeroconf"]
2903
3075
2904
3076
if debug:
2905
3077
initlogger(debug, logging.DEBUG)
2906
3078
else:
2909
3081
else:
2910
3082
level = getattr(logging, debuglevel.upper())
2911
3083
initlogger(debug, level)
2912
3084
2913
3085
if server_settings["servicename"] != "Mandos":
2914
3086
syslogger.setFormatter(
2915
3087
logging.Formatter('Mandos ({}) [%(process)d]:'
2916
3088
' %(levelname)s: %(message)s'.format(
2917
3089
server_settings["servicename"])))
2918
3090
2919
3091
# Parse config file with clients
2920
client_config = configparser.SafeConfigParser(Client
2921
.client_defaults)
3092
client_config = configparser.ConfigParser(Client.client_defaults)
2922
3093
client_config.read(os.path.join(server_settings["configdir"],
2923
3094
"clients.conf"))
2924
3095
2925
3096
global mandos_dbus_service
2926
3097
mandos_dbus_service = None
2927
3098
2928
3099
socketfd = None
2929
3100
if server_settings["socket"] != "":
2930
3101
socketfd = server_settings["socket"]
2946
3117
except IOError as e:
2947
3118
logger.error("Could not open file %r", pidfilename,
2948
3119
exc_info=e)
2949
3120
2950
3121
for name, group in (("_mandos", "_mandos"),
2951
3122
("mandos", "mandos"),
2952
3123
("nobody", "nogroup")):
2970
3141
.format(uid, gid, os.strerror(error.errno)))
2971
3142
if error.errno != errno.EPERM:
2972
3143
raise
2973
3144
2974
3145
if debug:
2975
3146
# Enable all possible GnuTLS debugging
2976
3147
2977
3148
# "Use a log level over 10 to enable all debugging options."
2978
3149
# - GnuTLS manual
2979
3150
gnutls.global_set_log_level(11)
2980
3151
2981
3152
@gnutls.log_func
2982
3153
def debug_gnutls(level, string):
2983
3154
logger.debug("GnuTLS: %s", string[:-1])
2984
3155
2985
3156
gnutls.global_set_log_function(debug_gnutls)
2986
3157
2987
3158
# Redirect stdin so all checkers get /dev/null
2988
3159
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2989
3160
os.dup2(null, sys.stdin.fileno())
2990
3161
if null > 2:
2991
3162
os.close(null)
2992
3163
2993
3164
# Need to fork before connecting to D-Bus
2994
3165
if not foreground:
2995
3166
# Close all input and output, do double fork, etc.
2996
3167
daemon()
2997
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
3001
3168
3169
if gi.version_info < (3, 10, 2):
3170
# multiprocessing will use threads, so before we use GLib we
3171
# need to inform GLib that threads will be used.
3172
GLib.threads_init()
3173
3002
3174
global main_loop
3003
3175
# From the Avahi example code
3004
3176
DBusGMainLoop(set_as_default=True)
3005
main_loop = GObject.MainLoop()
3177
main_loop = GLib.MainLoop()
3006
3178
bus = dbus.SystemBus()
3007
3179
# End of Avahi example code
3008
3180
if use_dbus:
3021
3193
if zeroconf:
3022
3194
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3023
3195
service = AvahiServiceToSyslog(
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3027
bus = bus)
3196
name=server_settings["servicename"],
3197
servicetype="_mandos._tcp",
3198
protocol=protocol,
3199
bus=bus)
3028
3200
if server_settings["interface"]:
3029
3201
service.interface = if_nametoindex(
3030
3202
server_settings["interface"].encode("utf-8"))
3031
3203
3032
3204
global multiprocessing_manager
3033
3205
multiprocessing_manager = multiprocessing.Manager()
3034
3206
3035
3207
client_class = Client
3036
3208
if use_dbus:
3037
client_class = functools.partial(ClientDBus, bus = bus)
3038
3209
client_class = functools.partial(ClientDBus, bus=bus)
3210
3039
3211
client_settings = Client.config_parser(client_config)
3040
3212
old_client_settings = {}
3041
3213
clients_data = {}
3042
3214
3043
3215
# This is used to redirect stdout and stderr for checker processes
3044
3216
global wnull
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3217
wnull = open(os.devnull, "w") # A writable /dev/null
3046
3218
# Only used if server is running in foreground but not in debug
3047
3219
# mode
3048
3220
if debug or not foreground:
3049
3221
wnull.close()
3050
3222
3051
3223
# Get client data and settings from last running state.
3052
3224
if server_settings["restore"]:
3053
3225
try:
3054
3226
with open(stored_state_path, "rb") as stored_state:
3055
if sys.version_info.major == 2:
3227
if sys.version_info.major == 2:
3056
3228
clients_data, old_client_settings = pickle.load(
3057
3229
stored_state)
3058
3230
else:
3059
3231
bytes_clients_data, bytes_old_client_settings = (
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3062
## clients_data
3232
pickle.load(stored_state, encoding="bytes"))
3233
# Fix bytes to strings
3234
# clients_data
3063
3235
# .keys()
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3066
else key): value
3067
for key, value in
3068
bytes_clients_data.items() }
3236
clients_data = {(key.decode("utf-8")
3237
if isinstance(key, bytes)
3238
else key): value
3239
for key, value in
3240
bytes_clients_data.items()}
3069
3241
del bytes_clients_data
3070
3242
for key in clients_data:
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3073
for k, v in
3074
clients_data[key].items() }
3243
value = {(k.decode("utf-8")
3244
if isinstance(k, bytes) else k): v
3245
for k, v in
3246
clients_data[key].items()}
3075
3247
clients_data[key] = value
3076
3248
# .client_structure
3077
3249
value["client_structure"] = [
3078
3250
(s.decode("utf-8")
3079
3251
if isinstance(s, bytes)
3080
3252
else s) for s in
3081
value["client_structure"] ]
3082
# .name & .host
3083
for k in ("name", "host"):
3253
value["client_structure"]]
3254
# .name, .host, and .checker_command
3255
for k in ("name", "host", "checker_command"):
3084
3256
if isinstance(value[k], bytes):
3085
3257
value[k] = value[k].decode("utf-8")
3086
## old_client_settings
3258
if "key_id" not in value:
3259
value["key_id"] = ""
3260
elif "fingerprint" not in value:
3261
value["fingerprint"] = ""
3262
# old_client_settings
3087
3263
# .keys()
3088
3264
old_client_settings = {
3089
3265
(key.decode("utf-8")
3090
3266
if isinstance(key, bytes)
3091
3267
else key): value
3092
3268
for key, value in
3093
bytes_old_client_settings.items() }
3269
bytes_old_client_settings.items()}
3094
3270
del bytes_old_client_settings
3095
# .host
3271
# .host and .checker_command
3096
3272
for value in old_client_settings.values():
3097
if isinstance(value["host"], bytes):
3098
value["host"] = (value["host"]
3099
.decode("utf-8"))
3273
for attribute in ("host", "checker_command"):
3274
if isinstance(value[attribute], bytes):
3275
value[attribute] = (value[attribute]
3276
.decode("utf-8"))
3100
3277
os.remove(stored_state_path)
3101
3278
except IOError as e:
3102
3279
if e.errno == errno.ENOENT:
3110
3287
logger.warning("Could not load persistent state: "
3111
3288
"EOFError:",
3112
3289
exc_info=e)
3113
3290
3114
3291
with PGPEngine() as pgp:
3115
3292
for client_name, client in clients_data.items():
3116
3293
# Skip removed clients
3117
3294
if client_name not in client_settings:
3118
3295
continue
3119
3296
3120
3297
# Decide which value to use after restoring saved state.
3121
3298
# We have three different values: Old config file,
3122
3299
# new config file, and saved state.
3133
3310
client[name] = value
3134
3311
except KeyError:
3135
3312
pass
3136
3313
3137
3314
# Clients who has passed its expire date can still be
3138
3315
# enabled if its last checker was successful. A Client
3139
3316
# whose checker succeeded before we stored its state is
3172
3349
client_name))
3173
3350
client["secret"] = (client_settings[client_name]
3174
3351
["secret"])
3175
3352
3176
3353
# Add/remove clients based on new changes made to config
3177
3354
for client_name in (set(old_client_settings)
3178
3355
- set(client_settings)):
3180
3357
for client_name in (set(client_settings)
3181
3358
- set(old_client_settings)):
3182
3359
clients_data[client_name] = client_settings[client_name]
3183
3360
3184
3361
# Create all client objects
3185
3362
for client_name, client in clients_data.items():
3186
3363
tcp_server.clients[client_name] = client_class(
3187
name = client_name,
3188
settings = client,
3189
server_settings = server_settings)
3190
3364
name=client_name,
3365
settings=client,
3366
server_settings=server_settings)
3367
3191
3368
if not tcp_server.clients:
3192
3369
logger.warning("No clients defined")
3193
3370
3194
3371
if not foreground:
3195
3372
if pidfile is not None:
3196
3373
pid = os.getpid()
3202
3379
pidfilename, pid)
3203
3380
del pidfile
3204
3381
del pidfilename
3205
3206
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3207
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3208
3382
3383
for termsig in (signal.SIGHUP, signal.SIGTERM):
3384
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3385
lambda: main_loop.quit() and False)
3386
3209
3387
if use_dbus:
3210
3388
3211
3389
@alternate_dbus_interfaces(
3212
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3390
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3213
3391
class MandosDBusService(DBusObjectWithObjectManager):
3214
3392
"""A D-Bus proxy object"""
3215
3393
3216
3394
def __init__(self):
3217
3395
dbus.service.Object.__init__(self, bus, "/")
3218
3396
3219
3397
_interface = "se.recompile.Mandos"
3220
3398
3221
3399
@dbus.service.signal(_interface, signature="o")
3222
3400
def ClientAdded(self, objpath):
3223
3401
"D-Bus signal"
3224
3402
pass
3225
3403
3226
3404
@dbus.service.signal(_interface, signature="ss")
3227
def ClientNotFound(self, fingerprint, address):
3405
def ClientNotFound(self, key_id, address):
3228
3406
"D-Bus signal"
3229
3407
pass
3230
3408
3231
3409
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3232
3410
"true"})
3233
3411
@dbus.service.signal(_interface, signature="os")
3234
3412
def ClientRemoved(self, objpath, name):
3235
3413
"D-Bus signal"
3236
3414
pass
3237
3415
3238
3416
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3239
3417
"true"})
3240
3418
@dbus.service.method(_interface, out_signature="ao")
3242
3420
"D-Bus method"
3243
3421
return dbus.Array(c.dbus_object_path for c in
3244
3422
tcp_server.clients.values())
3245
3423
3246
3424
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3247
3425
"true"})
3248
3426
@dbus.service.method(_interface,
3250
3428
def GetAllClientsWithProperties(self):
3251
3429
"D-Bus method"
3252
3430
return dbus.Dictionary(
3253
{ c.dbus_object_path: c.GetAll(
3431
{c.dbus_object_path: c.GetAll(
3254
3432
"se.recompile.Mandos.Client")
3255
for c in tcp_server.clients.values() },
3433
for c in tcp_server.clients.values()},
3256
3434
signature="oa{sv}")
3257
3435
3258
3436
@dbus.service.method(_interface, in_signature="o")
3259
3437
def RemoveClient(self, object_path):
3260
3438
"D-Bus method"
3268
3446
self.client_removed_signal(c)
3269
3447
return
3270
3448
raise KeyError(object_path)
3271
3449
3272
3450
del _interface
3273
3451
3274
3452
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3275
out_signature = "a{oa{sa{sv}}}")
3453
out_signature="a{oa{sa{sv}}}")
3276
3454
def GetManagedObjects(self):
3277
3455
"""D-Bus method"""
3278
3456
return dbus.Dictionary(
3279
{ client.dbus_object_path:
3280
dbus.Dictionary(
3281
{ interface: client.GetAll(interface)
3282
for interface in
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3285
3457
{client.dbus_object_path:
3458
dbus.Dictionary(
3459
{interface: client.GetAll(interface)
3460
for interface in
3461
client._get_all_interface_names()})
3462
for client in tcp_server.clients.values()})
3463
3286
3464
def client_added_signal(self, client):
3287
3465
"""Send the new standard signal and the old signal"""
3288
3466
if use_dbus:
3290
3468
self.InterfacesAdded(
3291
3469
client.dbus_object_path,
3292
3470
dbus.Dictionary(
3293
{ interface: client.GetAll(interface)
3294
for interface in
3295
client._get_all_interface_names()}))
3471
{interface: client.GetAll(interface)
3472
for interface in
3473
client._get_all_interface_names()}))
3296
3474
# Old signal
3297
3475
self.ClientAdded(client.dbus_object_path)
3298
3476
3299
3477
def client_removed_signal(self, client):
3300
3478
"""Send the new standard signal and the old signal"""
3301
3479
if use_dbus:
3306
3484
# Old signal
3307
3485
self.ClientRemoved(client.dbus_object_path,
3308
3486
client.name)
3309
3487
3310
3488
mandos_dbus_service = MandosDBusService()
3311
3489
3490
# Save modules to variables to exempt the modules from being
3491
# unloaded before the function registered with atexit() is run.
3492
mp = multiprocessing
3493
wn = wnull
3494
3312
3495
def cleanup():
3313
3496
"Cleanup function; run on exit"
3314
3497
if zeroconf:
3315
3498
service.cleanup()
3316
3317
multiprocessing.active_children()
3318
wnull.close()
3499
3500
mp.active_children()
3501
wn.close()
3319
3502
if not (tcp_server.clients or client_settings):
3320
3503
return
3321
3504
3322
3505
# Store client before exiting. Secrets are encrypted with key
3323
3506
# based on what config file has. If config file is
3324
3507
# removed/edited, old secret will thus be unrecovable.
3329
3512
client.encrypted_secret = pgp.encrypt(client.secret,
3330
3513
key)
3331
3514
client_dict = {}
3332
3515
3333
3516
# A list of attributes that can not be pickled
3334
3517
# + secret.
3335
exclude = { "bus", "changedstate", "secret",
3336
"checker", "server_settings" }
3518
exclude = {"bus", "changedstate", "secret",
3519
"checker", "server_settings"}
3337
3520
for name, typ in inspect.getmembers(dbus.service
3338
3521
.Object):
3339
3522
exclude.add(name)
3340
3523
3341
3524
client_dict["encrypted_secret"] = (client
3342
3525
.encrypted_secret)
3343
3526
for attr in client.client_structure:
3344
3527
if attr not in exclude:
3345
3528
client_dict[attr] = getattr(client, attr)
3346
3529
3347
3530
clients[client.name] = client_dict
3348
3531
del client_settings[client.name]["secret"]
3349
3532
3350
3533
try:
3351
3534
with tempfile.NamedTemporaryFile(
3352
3535
mode='wb',
3355
3538
dir=os.path.dirname(stored_state_path),
3356
3539
delete=False) as stored_state:
3357
3540
pickle.dump((clients, client_settings), stored_state,
3358
protocol = 2)
3541
protocol=2)
3359
3542
tempname = stored_state.name
3360
3543
os.rename(tempname, stored_state_path)
3361
3544
except (IOError, OSError) as e:
3371
3554
logger.warning("Could not save persistent state:",
3372
3555
exc_info=e)
3373
3556
raise
3374
3557
3375
3558
# Delete all clients, and settings from config
3376
3559
while tcp_server.clients:
3377
3560
name, client = tcp_server.clients.popitem()
3383
3566
if use_dbus:
3384
3567
mandos_dbus_service.client_removed_signal(client)
3385
3568
client_settings.clear()
3386
3569
3387
3570
atexit.register(cleanup)
3388
3571
3389
3572
for client in tcp_server.clients.values():
3390
3573
if use_dbus:
3391
3574
# Emit D-Bus signal for adding
3393
3576
# Need to initiate checking of clients
3394
3577
if client.enabled:
3395
3578
client.init_checker()
3396
3579
3397
3580
tcp_server.enable()
3398
3581
tcp_server.server_activate()
3399
3582
3400
3583
# Find out what port we got
3401
3584
if zeroconf:
3402
3585
service.port = tcp_server.socket.getsockname()[1]
3407
3590
else: # IPv4
3408
3591
logger.info("Now listening on address %r, port %d",
3409
3592
*tcp_server.socket.getsockname())
3410
3411
#service.interface = tcp_server.socket.getsockname()[3]
3412
3593
3594
# service.interface = tcp_server.socket.getsockname()[3]
3595
3413
3596
try:
3414
3597
if zeroconf:
3415
3598
# From the Avahi example code
3420
3603
cleanup()
3421
3604
sys.exit(1)
3422
3605
# End of Avahi example code
3423
3424
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3425
lambda *args, **kwargs:
3426
(tcp_server.handle_request
3427
(*args[2:], **kwargs) or True))
3428
3606
3607
GLib.io_add_watch(
3608
GLib.IOChannel.unix_new(tcp_server.fileno()),
3609
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3610
lambda *args, **kwargs: (tcp_server.handle_request
3611
(*args[2:], **kwargs) or True))
3612
3429
3613
logger.debug("Starting main loop")
3430
3614
main_loop.run()
3431
3615
except AvahiError as error:
3440
3624
# Must run before the D-Bus bus name gets deregistered
3441
3625
cleanup()
3442
3626
3627
3628
def should_only_run_tests():
3629
parser = argparse.ArgumentParser(add_help=False)
3630
parser.add_argument("--check", action='store_true')
3631
args, unknown_args = parser.parse_known_args()
3632
run_tests = args.check
3633
if run_tests:
3634
# Remove --check argument from sys.argv
3635
sys.argv[1:] = unknown_args
3636
return run_tests
3637
3638
# Add all tests from doctest strings
3639
def load_tests(loader, tests, none):
3640
import doctest
3641
tests.addTests(doctest.DocTestSuite())
3642
return tests
3443
3643
3444
3644
if __name__ == '__main__':
3445
main()
3645
try:
3646
if should_only_run_tests():
3647
# Call using ./mandos --check [--verbose]
3648
unittest.main()
3649
else:
3650
main()
3651
finally:
3652
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0