To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1194
- compare with another revision
- download diff
- download tarball
- view history from revision 1194
- Committer: teddy at recompile
- Date: 2019-12-05 03:38:07 UTC
- Revision ID: teddy@recompile.se-20191205033807-6awt45zpgp194vl1
From: Frans Spiesschaert <Frans.Spiesschaert@yucom.be>
Add Dutch debconf translation
* debian/po/nl.po: New.
Acked-by: Teddy Hogeborn <teddy@recompile.se>
Add Dutch debconf translation
* debian/po/nl.po: New.
Acked-by: Teddy Hogeborn <teddy@recompile.se>
- files added:
- bugs.xml
- debian/tests
- debian/upstream
- dracut-module
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
import SocketServer as socketserver
43
try:
44
import SocketServer as socketserver
45
except ImportError:
46
import socketserver
40
47
import socket
41
48
import argparse
42
49
import datetime
43
50
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
try:
52
import ConfigParser as configparser
53
except ImportError:
54
import configparser
51
55
import sys
52
56
import re
53
57
import os
62
66
import struct
63
67
import fcntl
64
68
import functools
65
import cPickle as pickle
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
78
import collections
79
import codecs
80
import unittest
71
81
72
82
import dbus
73
83
import dbus.service
74
import gobject
75
import avahi
84
import gi
85
from gi.repository import GLib
76
86
from dbus.mainloop.glib import DBusGMainLoop
77
87
import ctypes
78
88
import ctypes.util
79
89
import xml.dom.minidom
80
90
import inspect
81
import GnuPGInterface
82
91
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
str = unicode
95
96
# Show warnings by default
97
if not sys.warnoptions:
98
import warnings
99
warnings.simplefilter("default")
100
101
# Try to find the value of SO_BINDTODEVICE:
83
102
try:
103
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
104
# newer, and it is also the most natural place for it:
84
105
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
106
except AttributeError:
86
107
try:
108
# This is where SO_BINDTODEVICE was up to and including Python
109
# 2.6, and also 3.2:
87
110
from IN import SO_BINDTODEVICE
88
111
except ImportError:
89
SO_BINDTODEVICE = None
90
91
version = "1.5.4"
112
# In Python 2.7 it seems to have been removed entirely.
113
# Try running the C preprocessor:
114
try:
115
cc = subprocess.Popen(["cc", "--language=c", "-E",
116
"/dev/stdin"],
117
stdin=subprocess.PIPE,
118
stdout=subprocess.PIPE)
119
stdout = cc.communicate(
120
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
121
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
122
except (OSError, ValueError, IndexError):
123
# No value found
124
SO_BINDTODEVICE = None
125
126
if sys.version_info < (3, 2):
127
configparser.Configparser = configparser.SafeConfigParser
128
129
version = "1.8.9"
92
130
stored_state_file = "clients.pickle"
93
131
94
132
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
133
logging.captureWarnings(True) # Show warnings via the logging system
134
syslogger = None
98
135
99
136
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
137
if_nametoindex = ctypes.cdll.LoadLibrary(
138
ctypes.util.find_library("c")).if_nametoindex
103
139
except (OSError, AttributeError):
140
104
141
def if_nametoindex(interface):
105
142
"Get an interface index the hard way, i.e. using fcntl()"
106
143
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
144
with contextlib.closing(socket.socket()) as s:
108
145
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
146
struct.pack(b"16s16x", interface))
147
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
148
return interface_index
114
149
115
150
151
def copy_function(func):
152
"""Make a copy of a function"""
153
if sys.version_info.major == 2:
154
return types.FunctionType(func.func_code,
155
func.func_globals,
156
func.func_name,
157
func.func_defaults,
158
func.func_closure)
159
else:
160
return types.FunctionType(func.__code__,
161
func.__globals__,
162
func.__name__,
163
func.__defaults__,
164
func.__closure__)
165
166
116
167
def initlogger(debug, level=logging.WARNING):
117
168
"""init logger and add loglevel"""
118
169
170
global syslogger
171
syslogger = (logging.handlers.SysLogHandler(
172
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
173
address="/dev/log"))
119
174
syslogger.setFormatter(logging.Formatter
120
175
('Mandos [%(process)d]: %(levelname)s:'
121
176
' %(message)s'))
122
177
logger.addHandler(syslogger)
123
178
124
179
if debug:
125
180
console = logging.StreamHandler()
126
181
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
136
191
pass
137
192
138
193
139
class PGPEngine(object):
194
class PGPEngine:
140
195
"""A simple class for OpenPGP symmetric encryption & decryption"""
196
141
197
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
143
198
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
150
199
self.gpg = "gpg"
200
try:
201
output = subprocess.check_output(["gpgconf"])
202
for line in output.splitlines():
203
name, text, path = line.split(b":")
204
if name == b"gpg":
205
self.gpg = path
206
break
207
except OSError as e:
208
if e.errno != errno.ENOENT:
209
raise
210
self.gnupgargs = ['--batch',
211
'--homedir', self.tempdir,
212
'--force-mdc',
213
'--quiet']
214
# Only GPG version 1 has the --no-use-agent option.
215
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
216
self.gnupgargs.append("--no-use-agent")
217
151
218
def __enter__(self):
152
219
return self
153
220
154
221
def __exit__(self, exc_type, exc_value, traceback):
155
222
self._cleanup()
156
223
return False
157
224
158
225
def __del__(self):
159
226
self._cleanup()
160
227
161
228
def _cleanup(self):
162
229
if self.tempdir is not None:
163
230
# Delete contents of tempdir
164
231
for root, dirs, files in os.walk(self.tempdir,
165
topdown = False):
232
topdown=False):
166
233
for filename in files:
167
234
os.remove(os.path.join(root, filename))
168
235
for dirname in dirs:
170
237
# Remove tempdir
171
238
os.rmdir(self.tempdir)
172
239
self.tempdir = None
173
240
174
241
def password_encode(self, password):
175
242
# Passphrase can not be empty and can not contain newlines or
176
243
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
178
244
encoded = b"mandos" + binascii.hexlify(password)
245
if len(encoded) > 2048:
246
# GnuPG can't handle long passwords, so encode differently
247
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
248
.replace(b"\n", b"\\n")
249
.replace(b"\0", b"\\x00"))
250
return encoded
251
179
252
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
253
passphrase = self.password_encode(password)
254
with tempfile.NamedTemporaryFile(
255
dir=self.tempdir) as passfile:
256
passfile.write(passphrase)
257
passfile.flush()
258
proc = subprocess.Popen([self.gpg, '--symmetric',
259
'--passphrase-file',
260
passfile.name]
261
+ self.gnupgargs,
262
stdin=subprocess.PIPE,
263
stdout=subprocess.PIPE,
264
stderr=subprocess.PIPE)
265
ciphertext, err = proc.communicate(input=data)
266
if proc.returncode != 0:
267
raise PGPError(err)
194
268
return ciphertext
195
269
196
270
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
271
passphrase = self.password_encode(password)
272
with tempfile.NamedTemporaryFile(
273
dir=self.tempdir) as passfile:
274
passfile.write(passphrase)
275
passfile.flush()
276
proc = subprocess.Popen([self.gpg, '--decrypt',
277
'--passphrase-file',
278
passfile.name]
279
+ self.gnupgargs,
280
stdin=subprocess.PIPE,
281
stdout=subprocess.PIPE,
282
stderr=subprocess.PIPE)
283
decrypted_plaintext, err = proc.communicate(input=data)
284
if proc.returncode != 0:
285
raise PGPError(err)
211
286
return decrypted_plaintext
212
287
213
288
289
# Pretend that we have an Avahi module
290
class avahi:
291
"""This isn't so much a class as it is a module-like namespace."""
292
IF_UNSPEC = -1 # avahi-common/address.h
293
PROTO_UNSPEC = -1 # avahi-common/address.h
294
PROTO_INET = 0 # avahi-common/address.h
295
PROTO_INET6 = 1 # avahi-common/address.h
296
DBUS_NAME = "org.freedesktop.Avahi"
297
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
298
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
299
DBUS_PATH_SERVER = "/"
300
301
@staticmethod
302
def string_array_to_txt_array(t):
303
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
304
for s in t), signature="ay")
305
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
306
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
307
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
308
SERVER_INVALID = 0 # avahi-common/defs.h
309
SERVER_REGISTERING = 1 # avahi-common/defs.h
310
SERVER_RUNNING = 2 # avahi-common/defs.h
311
SERVER_COLLISION = 3 # avahi-common/defs.h
312
SERVER_FAILURE = 4 # avahi-common/defs.h
313
314
214
315
class AvahiError(Exception):
215
316
def __init__(self, value, *args, **kwargs):
216
317
self.value = value
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
318
return super(AvahiError, self).__init__(value, *args,
319
**kwargs)
320
220
321
221
322
class AvahiServiceError(AvahiError):
222
323
pass
223
324
325
224
326
class AvahiGroupError(AvahiError):
225
327
pass
226
328
227
329
228
class AvahiService(object):
330
class AvahiService:
229
331
"""An Avahi (Zeroconf) service.
230
332
231
333
Attributes:
232
334
interface: integer; avahi.IF_UNSPEC or an interface index.
233
335
Used to optionally bind to the specified interface.
234
336
name: string; Example: 'Mandos'
235
337
type: string; Example: '_mandos._tcp'.
236
See <http://www.dns-sd.org/ServiceTypes.html>
338
See <https://www.iana.org/assignments/service-names-port-numbers>
237
339
port: integer; what port to announce
238
340
TXT: list of strings; TXT record for the service
239
341
domain: string; Domain to publish on, default to .local if empty.
245
347
server: D-Bus Server
246
348
bus: dbus.SystemBus()
247
349
"""
248
249
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
servicetype = None, port = None, TXT = None,
251
domain = "", host = "", max_renames = 32768,
252
protocol = avahi.PROTO_UNSPEC, bus = None):
350
351
def __init__(self,
352
interface=avahi.IF_UNSPEC,
353
name=None,
354
servicetype=None,
355
port=None,
356
TXT=None,
357
domain="",
358
host="",
359
max_renames=32768,
360
protocol=avahi.PROTO_UNSPEC,
361
bus=None):
253
362
self.interface = interface
254
363
self.name = name
255
364
self.type = servicetype
264
373
self.server = None
265
374
self.bus = bus
266
375
self.entry_group_state_changed_match = None
267
268
def rename(self):
376
377
def rename(self, remove=True):
269
378
"""Derived from the Avahi example code"""
270
379
if self.rename_count >= self.max_renames:
271
380
logger.critical("No suitable Zeroconf service name found"
272
381
" after %i retries, exiting.",
273
382
self.rename_count)
274
383
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
384
self.name = str(
385
self.server.GetAlternativeServiceName(self.name))
386
self.rename_count += 1
277
387
logger.info("Changing Zeroconf service name to %r ...",
278
388
self.name)
279
self.remove()
389
if remove:
390
self.remove()
280
391
try:
281
392
self.add()
282
393
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
284
self.cleanup()
285
os._exit(1)
286
self.rename_count += 1
287
394
if (error.get_dbus_name()
395
== "org.freedesktop.Avahi.CollisionError"):
396
logger.info("Local Zeroconf service name collision.")
397
return self.rename(remove=False)
398
else:
399
logger.critical("D-Bus Exception", exc_info=error)
400
self.cleanup()
401
os._exit(1)
402
288
403
def remove(self):
289
404
"""Derived from the Avahi example code"""
290
405
if self.entry_group_state_changed_match is not None:
292
407
self.entry_group_state_changed_match = None
293
408
if self.group is not None:
294
409
self.group.Reset()
295
410
296
411
def add(self):
297
412
"""Derived from the Avahi example code"""
298
413
self.remove()
315
430
dbus.UInt16(self.port),
316
431
avahi.string_array_to_txt_array(self.TXT))
317
432
self.group.Commit()
318
433
319
434
def entry_group_state_changed(self, state, error):
320
435
"""Derived from the Avahi example code"""
321
436
logger.debug("Avahi entry group state change: %i", state)
322
437
323
438
if state == avahi.ENTRY_GROUP_ESTABLISHED:
324
439
logger.debug("Zeroconf service established.")
325
440
elif state == avahi.ENTRY_GROUP_COLLISION:
327
442
self.rename()
328
443
elif state == avahi.ENTRY_GROUP_FAILURE:
329
444
logger.critical("Avahi: Error in group state changed %s",
330
unicode(error))
331
raise AvahiGroupError("State changed: {0!s}"
332
.format(error))
333
445
str(error))
446
raise AvahiGroupError("State changed: {!s}".format(error))
447
334
448
def cleanup(self):
335
449
"""Derived from the Avahi example code"""
336
450
if self.group is not None:
341
455
pass
342
456
self.group = None
343
457
self.remove()
344
458
345
459
def server_state_changed(self, state, error=None):
346
460
"""Derived from the Avahi example code"""
347
461
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
462
bad_states = {
463
avahi.SERVER_INVALID: "Zeroconf server invalid",
464
avahi.SERVER_REGISTERING: None,
465
avahi.SERVER_COLLISION: "Zeroconf server name collision",
466
avahi.SERVER_FAILURE: "Zeroconf server failure",
467
}
355
468
if state in bad_states:
356
469
if bad_states[state] is not None:
357
470
if error is None:
360
473
logger.error(bad_states[state] + ": %r", error)
361
474
self.cleanup()
362
475
elif state == avahi.SERVER_RUNNING:
363
self.add()
476
try:
477
self.add()
478
except dbus.exceptions.DBusException as error:
479
if (error.get_dbus_name()
480
== "org.freedesktop.Avahi.CollisionError"):
481
logger.info("Local Zeroconf service name"
482
" collision.")
483
return self.rename(remove=False)
484
else:
485
logger.critical("D-Bus Exception", exc_info=error)
486
self.cleanup()
487
os._exit(1)
364
488
else:
365
489
if error is None:
366
490
logger.debug("Unknown state: %r", state)
367
491
else:
368
492
logger.debug("Unknown state: %r: %r", state, error)
369
493
370
494
def activate(self):
371
495
"""Derived from the Avahi example code"""
372
496
if self.server is None:
376
500
follow_name_owner_changes=True),
377
501
avahi.DBUS_INTERFACE_SERVER)
378
502
self.server.connect_to_signal("StateChanged",
379
self.server_state_changed)
503
self.server_state_changed)
380
504
self.server_state_changed(self.server.GetState())
381
505
382
506
383
507
class AvahiServiceToSyslog(AvahiService):
384
def rename(self):
508
def rename(self, *args, **kwargs):
385
509
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
390
.format(self.name)))
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
511
syslogger.setFormatter(logging.Formatter(
512
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
513
.format(self.name)))
391
514
return ret
392
515
393
516
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
399
400
401
class Client(object):
517
# Pretend that we have a GnuTLS module
518
class gnutls:
519
"""This isn't so much a class as it is a module-like namespace."""
520
521
library = ctypes.util.find_library("gnutls")
522
if library is None:
523
library = ctypes.util.find_library("gnutls-deb0")
524
_library = ctypes.cdll.LoadLibrary(library)
525
del library
526
527
# Unless otherwise indicated, the constants and types below are
528
# all from the gnutls/gnutls.h C header file.
529
530
# Constants
531
E_SUCCESS = 0
532
E_INTERRUPTED = -52
533
E_AGAIN = -28
534
CRT_OPENPGP = 2
535
CRT_RAWPK = 3
536
CLIENT = 2
537
SHUT_RDWR = 0
538
CRD_CERTIFICATE = 1
539
E_NO_CERTIFICATE_FOUND = -49
540
X509_FMT_DER = 0
541
NO_TICKETS = 1<<10
542
ENABLE_RAWPK = 1<<18
543
CTYPE_PEERS = 3
544
KEYID_USE_SHA256 = 1 # gnutls/x509.h
545
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
546
547
# Types
548
class session_int(ctypes.Structure):
549
_fields_ = []
550
session_t = ctypes.POINTER(session_int)
551
552
class certificate_credentials_st(ctypes.Structure):
553
_fields_ = []
554
certificate_credentials_t = ctypes.POINTER(
555
certificate_credentials_st)
556
certificate_type_t = ctypes.c_int
557
558
class datum_t(ctypes.Structure):
559
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
('size', ctypes.c_uint)]
561
562
class openpgp_crt_int(ctypes.Structure):
563
_fields_ = []
564
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
565
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
566
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
credentials_type_t = ctypes.c_int
568
transport_ptr_t = ctypes.c_void_p
569
close_request_t = ctypes.c_int
570
571
# Exceptions
572
class Error(Exception):
573
def __init__(self, message=None, code=None, args=()):
574
# Default usage is by a message string, but if a return
575
# code is passed, convert it to a string with
576
# gnutls.strerror()
577
self.code = code
578
if message is None and code is not None:
579
message = gnutls.strerror(code)
580
return super(gnutls.Error, self).__init__(
581
message, *args)
582
583
class CertificateSecurityError(Error):
584
pass
585
586
# Classes
587
class Credentials:
588
def __init__(self):
589
self._c_object = gnutls.certificate_credentials_t()
590
gnutls.certificate_allocate_credentials(
591
ctypes.byref(self._c_object))
592
self.type = gnutls.CRD_CERTIFICATE
593
594
def __del__(self):
595
gnutls.certificate_free_credentials(self._c_object)
596
597
class ClientSession:
598
def __init__(self, socket, credentials=None):
599
self._c_object = gnutls.session_t()
600
gnutls_flags = gnutls.CLIENT
601
if gnutls.check_version(b"3.5.6"):
602
gnutls_flags |= gnutls.NO_TICKETS
603
if gnutls.has_rawpk:
604
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
606
del gnutls_flags
607
gnutls.set_default_priority(self._c_object)
608
gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
gnutls.handshake_set_private_extensions(self._c_object,
610
True)
611
self.socket = socket
612
if credentials is None:
613
credentials = gnutls.Credentials()
614
gnutls.credentials_set(self._c_object, credentials.type,
615
ctypes.cast(credentials._c_object,
616
ctypes.c_void_p))
617
self.credentials = credentials
618
619
def __del__(self):
620
gnutls.deinit(self._c_object)
621
622
def handshake(self):
623
return gnutls.handshake(self._c_object)
624
625
def send(self, data):
626
data = bytes(data)
627
data_len = len(data)
628
while data_len > 0:
629
data_len -= gnutls.record_send(self._c_object,
630
data[-data_len:],
631
data_len)
632
633
def bye(self):
634
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
635
636
# Error handling functions
637
def _error_code(result):
638
"""A function to raise exceptions on errors, suitable
639
for the 'restype' attribute on ctypes functions"""
640
if result >= 0:
641
return result
642
if result == gnutls.E_NO_CERTIFICATE_FOUND:
643
raise gnutls.CertificateSecurityError(code=result)
644
raise gnutls.Error(code=result)
645
646
def _retry_on_error(result, func, arguments):
647
"""A function to retry on some errors, suitable
648
for the 'errcheck' attribute on ctypes functions"""
649
while result < 0:
650
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
651
return _error_code(result)
652
result = func(*arguments)
653
return result
654
655
# Unless otherwise indicated, the function declarations below are
656
# all from the gnutls/gnutls.h C header file.
657
658
# Functions
659
priority_set_direct = _library.gnutls_priority_set_direct
660
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
661
ctypes.POINTER(ctypes.c_char_p)]
662
priority_set_direct.restype = _error_code
663
664
init = _library.gnutls_init
665
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
666
init.restype = _error_code
667
668
set_default_priority = _library.gnutls_set_default_priority
669
set_default_priority.argtypes = [session_t]
670
set_default_priority.restype = _error_code
671
672
record_send = _library.gnutls_record_send
673
record_send.argtypes = [session_t, ctypes.c_void_p,
674
ctypes.c_size_t]
675
record_send.restype = ctypes.c_ssize_t
676
record_send.errcheck = _retry_on_error
677
678
certificate_allocate_credentials = (
679
_library.gnutls_certificate_allocate_credentials)
680
certificate_allocate_credentials.argtypes = [
681
ctypes.POINTER(certificate_credentials_t)]
682
certificate_allocate_credentials.restype = _error_code
683
684
certificate_free_credentials = (
685
_library.gnutls_certificate_free_credentials)
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
688
certificate_free_credentials.restype = None
689
690
handshake_set_private_extensions = (
691
_library.gnutls_handshake_set_private_extensions)
692
handshake_set_private_extensions.argtypes = [session_t,
693
ctypes.c_int]
694
handshake_set_private_extensions.restype = None
695
696
credentials_set = _library.gnutls_credentials_set
697
credentials_set.argtypes = [session_t, credentials_type_t,
698
ctypes.c_void_p]
699
credentials_set.restype = _error_code
700
701
strerror = _library.gnutls_strerror
702
strerror.argtypes = [ctypes.c_int]
703
strerror.restype = ctypes.c_char_p
704
705
certificate_type_get = _library.gnutls_certificate_type_get
706
certificate_type_get.argtypes = [session_t]
707
certificate_type_get.restype = _error_code
708
709
certificate_get_peers = _library.gnutls_certificate_get_peers
710
certificate_get_peers.argtypes = [session_t,
711
ctypes.POINTER(ctypes.c_uint)]
712
certificate_get_peers.restype = ctypes.POINTER(datum_t)
713
714
global_set_log_level = _library.gnutls_global_set_log_level
715
global_set_log_level.argtypes = [ctypes.c_int]
716
global_set_log_level.restype = None
717
718
global_set_log_function = _library.gnutls_global_set_log_function
719
global_set_log_function.argtypes = [log_func]
720
global_set_log_function.restype = None
721
722
deinit = _library.gnutls_deinit
723
deinit.argtypes = [session_t]
724
deinit.restype = None
725
726
handshake = _library.gnutls_handshake
727
handshake.argtypes = [session_t]
728
handshake.restype = _error_code
729
handshake.errcheck = _retry_on_error
730
731
transport_set_ptr = _library.gnutls_transport_set_ptr
732
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
733
transport_set_ptr.restype = None
734
735
bye = _library.gnutls_bye
736
bye.argtypes = [session_t, close_request_t]
737
bye.restype = _error_code
738
bye.errcheck = _retry_on_error
739
740
check_version = _library.gnutls_check_version
741
check_version.argtypes = [ctypes.c_char_p]
742
check_version.restype = ctypes.c_char_p
743
744
_need_version = b"3.3.0"
745
if check_version(_need_version) is None:
746
raise self.Error("Needs GnuTLS {} or later"
747
.format(_need_version))
748
749
_tls_rawpk_version = b"3.6.6"
750
has_rawpk = bool(check_version(_tls_rawpk_version))
751
752
if has_rawpk:
753
# Types
754
class pubkey_st(ctypes.Structure):
755
_fields = []
756
pubkey_t = ctypes.POINTER(pubkey_st)
757
758
x509_crt_fmt_t = ctypes.c_int
759
760
# All the function declarations below are from gnutls/abstract.h
761
pubkey_init = _library.gnutls_pubkey_init
762
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
pubkey_init.restype = _error_code
764
765
pubkey_import = _library.gnutls_pubkey_import
766
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
767
x509_crt_fmt_t]
768
pubkey_import.restype = _error_code
769
770
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
771
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
772
ctypes.POINTER(ctypes.c_ubyte),
773
ctypes.POINTER(ctypes.c_size_t)]
774
pubkey_get_key_id.restype = _error_code
775
776
pubkey_deinit = _library.gnutls_pubkey_deinit
777
pubkey_deinit.argtypes = [pubkey_t]
778
pubkey_deinit.restype = None
779
else:
780
# All the function declarations below are from gnutls/openpgp.h
781
782
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
784
openpgp_crt_init.restype = _error_code
785
786
openpgp_crt_import = _library.gnutls_openpgp_crt_import
787
openpgp_crt_import.argtypes = [openpgp_crt_t,
788
ctypes.POINTER(datum_t),
789
openpgp_crt_fmt_t]
790
openpgp_crt_import.restype = _error_code
791
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
795
openpgp_crt_verify_self.restype = _error_code
796
797
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
798
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
799
openpgp_crt_deinit.restype = None
800
801
openpgp_crt_get_fingerprint = (
802
_library.gnutls_openpgp_crt_get_fingerprint)
803
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
804
ctypes.c_void_p,
805
ctypes.POINTER(
806
ctypes.c_size_t)]
807
openpgp_crt_get_fingerprint.restype = _error_code
808
809
if check_version(b"3.6.4"):
810
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
812
certificate_type_get2.restype = _error_code
813
814
# Remove non-public functions
815
del _error_code, _retry_on_error
816
817
818
def call_pipe(connection, # : multiprocessing.Connection
819
func, *args, **kwargs):
820
"""This function is meant to be called by multiprocessing.Process
821
822
This function runs func(*args, **kwargs), and writes the resulting
823
return value on the provided multiprocessing.Connection.
824
"""
825
connection.send(func(*args, **kwargs))
826
connection.close()
827
828
829
class Client:
402
830
"""A representation of a client host served by this server.
403
831
404
832
Attributes:
405
833
approved: bool(); 'None' if not yet approved/disapproved
406
834
approval_delay: datetime.timedelta(); Time to wait for approval
407
835
approval_duration: datetime.timedelta(); Duration of one approval
408
checker: subprocess.Popen(); a running checker process used
409
to see if the client lives.
410
'None' if no process is running.
411
checker_callback_tag: a gobject event source tag, or None
836
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
838
running.
839
checker_callback_tag: a GLib event source tag, or None
412
840
checker_command: string; External command which is run to check
413
841
if client lives. %() expansions are done at
414
842
runtime with vars(self) as dict, so that for
415
843
instance %(name)s can be used in the command.
416
checker_initiator_tag: a gobject event source tag, or None
844
checker_initiator_tag: a GLib event source tag, or None
417
845
created: datetime.datetime(); (UTC) object creation
418
846
client_structure: Object describing what attributes a client has
419
847
and is used for storing the client at exit
420
848
current_checker_command: string; current running checker_command
421
disable_initiator_tag: a gobject event source tag, or None
849
disable_initiator_tag: a GLib event source tag, or None
422
850
enabled: bool()
423
851
fingerprint: string (40 or 32 hexadecimal digits); used to
424
uniquely identify the client
852
uniquely identify an OpenPGP client
853
key_id: string (64 hexadecimal digits); used to uniquely identify
854
a client using raw public keys
425
855
host: string; available for use by the checker command
426
856
interval: datetime.timedelta(); How often to start a new checker
427
857
last_approval_request: datetime.datetime(); (UTC) or None
429
859
last_checker_status: integer between 0 and 255 reflecting exit
430
860
status of last checker. -1 reflects crashed
431
861
checker, -2 means no checker completed yet.
862
last_checker_signal: The signal which killed the last checker, if
863
last_checker_status is -1
432
864
last_enabled: datetime.datetime(); (UTC) or None
433
865
name: string; from the config file, used in log messages and
434
866
D-Bus identifiers
439
871
runtime_expansions: Allowed attributes for runtime expansion.
440
872
expires: datetime.datetime(); time (UTC) when a client will be
441
873
disabled, or None
874
server_settings: The server_settings dict from main()
442
875
"""
443
876
444
877
runtime_expansions = ("approval_delay", "approval_duration",
445
"created", "enabled", "expires",
878
"created", "enabled", "expires", "key_id",
446
879
"fingerprint", "host", "interval",
447
880
"last_approval_request", "last_checked_ok",
448
881
"last_enabled", "name", "timeout")
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
451
"interval": "2m",
452
"checker": "fping -q -- %%(host)s",
453
"host": "",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
457
"enabled": "True",
458
}
459
460
def timeout_milliseconds(self):
461
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
463
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
467
468
def interval_milliseconds(self):
469
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
471
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
474
882
client_defaults = {
883
"timeout": "PT5M",
884
"extended_timeout": "PT15M",
885
"interval": "PT2M",
886
"checker": "fping -q -- %%(host)s",
887
"host": "",
888
"approval_delay": "PT0S",
889
"approval_duration": "PT1S",
890
"approved_by_default": "True",
891
"enabled": "True",
892
}
893
475
894
@staticmethod
476
895
def config_parser(config):
477
896
"""Construct a new dict of client settings of this form:
484
903
for client_name in config.sections():
485
904
section = dict(config.items(client_name))
486
905
client = settings[client_name] = {}
487
906
488
907
client["host"] = section["host"]
489
908
# Reformat values from string types to Python types
490
909
client["approved_by_default"] = config.getboolean(
491
910
client_name, "approved_by_default")
492
911
client["enabled"] = config.getboolean(client_name,
493
912
"enabled")
494
913
914
# Uppercase and remove spaces from key_id and fingerprint
915
# for later comparison purposes with return value from the
916
# key_id() and fingerprint() functions
917
client["key_id"] = (section.get("key_id", "").upper()
918
.replace(" ", ""))
495
919
client["fingerprint"] = (section["fingerprint"].upper()
496
920
.replace(" ", ""))
497
921
if "secret" in section:
498
client["secret"] = section["secret"].decode("base64")
922
client["secret"] = codecs.decode(section["secret"]
923
.encode("utf-8"),
924
"base64")
499
925
elif "secfile" in section:
500
926
with open(os.path.expanduser(os.path.expandvars
501
927
(section["secfile"])),
502
928
"rb") as secfile:
503
929
client["secret"] = secfile.read()
504
930
else:
505
raise TypeError("No secret or secfile for section {0}"
931
raise TypeError("No secret or secfile for section {}"
506
932
.format(section))
507
933
client["timeout"] = string_to_delta(section["timeout"])
508
934
client["extended_timeout"] = string_to_delta(
516
942
client["last_approval_request"] = None
517
943
client["last_checked_ok"] = None
518
944
client["last_checker_status"] = -2
519
945
520
946
return settings
521
522
def __init__(self, settings, name = None):
947
948
def __init__(self, settings, name=None, server_settings=None):
523
949
self.name = name
950
if server_settings is None:
951
server_settings = {}
952
self.server_settings = server_settings
524
953
# adding all client settings
525
for setting, value in settings.iteritems():
954
for setting, value in settings.items():
526
955
setattr(self, setting, value)
527
956
528
957
if self.enabled:
529
958
if not hasattr(self, "last_enabled"):
530
959
self.last_enabled = datetime.datetime.utcnow()
534
963
else:
535
964
self.last_enabled = None
536
965
self.expires = None
537
966
538
967
logger.debug("Creating client %r", self.name)
539
# Uppercase and remove spaces from fingerprint for later
540
# comparison purposes with return value from the fingerprint()
541
# function
968
logger.debug(" Key ID: %s", self.key_id)
542
969
logger.debug(" Fingerprint: %s", self.fingerprint)
543
970
self.created = settings.get("created",
544
971
datetime.datetime.utcnow())
545
972
546
973
# attributes specific for this server instance
547
974
self.checker = None
548
975
self.checker_initiator_tag = None
551
978
self.current_checker_command = None
552
979
self.approved = None
553
980
self.approvals_pending = 0
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
556
.Lock()))
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
981
self.changedstate = multiprocessing_manager.Condition(
982
multiprocessing_manager.Lock())
983
self.client_structure = [attr
984
for attr in self.__dict__.keys()
559
985
if not attr.startswith("_")]
560
986
self.client_structure.append("client_structure")
561
562
for name, t in inspect.getmembers(type(self),
563
lambda obj:
564
isinstance(obj,
565
property)):
987
988
for name, t in inspect.getmembers(
989
type(self), lambda obj: isinstance(obj, property)):
566
990
if not name.startswith("_"):
567
991
self.client_structure.append(name)
568
992
569
993
# Send notice to process children that client state has changed
570
994
def send_changedstate(self):
571
995
with self.changedstate:
572
996
self.changedstate.notify_all()
573
997
574
998
def enable(self):
575
999
"""Start this client's checker and timeout hooks"""
576
1000
if getattr(self, "enabled", False):
581
1005
self.last_enabled = datetime.datetime.utcnow()
582
1006
self.init_checker()
583
1007
self.send_changedstate()
584
1008
585
1009
def disable(self, quiet=True):
586
1010
"""Disable this client."""
587
1011
if not getattr(self, "enabled", False):
589
1013
if not quiet:
590
1014
logger.info("Disabling client %s", self.name)
591
1015
if getattr(self, "disable_initiator_tag", None) is not None:
592
gobject.source_remove(self.disable_initiator_tag)
1016
GLib.source_remove(self.disable_initiator_tag)
593
1017
self.disable_initiator_tag = None
594
1018
self.expires = None
595
1019
if getattr(self, "checker_initiator_tag", None) is not None:
596
gobject.source_remove(self.checker_initiator_tag)
1020
GLib.source_remove(self.checker_initiator_tag)
597
1021
self.checker_initiator_tag = None
598
1022
self.stop_checker()
599
1023
self.enabled = False
600
1024
if not quiet:
601
1025
self.send_changedstate()
602
# Do not run this again if called by a gobject.timeout_add
1026
# Do not run this again if called by a GLib.timeout_add
603
1027
return False
604
1028
605
1029
def __del__(self):
606
1030
self.disable()
607
1031
608
1032
def init_checker(self):
609
1033
# Schedule a new checker to be started an 'interval' from now,
610
1034
# and every interval from then on.
611
1035
if self.checker_initiator_tag is not None:
612
gobject.source_remove(self.checker_initiator_tag)
613
self.checker_initiator_tag = (gobject.timeout_add
614
(self.interval_milliseconds(),
615
self.start_checker))
1036
GLib.source_remove(self.checker_initiator_tag)
1037
self.checker_initiator_tag = GLib.timeout_add(
1038
int(self.interval.total_seconds() * 1000),
1039
self.start_checker)
616
1040
# Schedule a disable() when 'timeout' has passed
617
1041
if self.disable_initiator_tag is not None:
618
gobject.source_remove(self.disable_initiator_tag)
619
self.disable_initiator_tag = (gobject.timeout_add
620
(self.timeout_milliseconds(),
621
self.disable))
1042
GLib.source_remove(self.disable_initiator_tag)
1043
self.disable_initiator_tag = GLib.timeout_add(
1044
int(self.timeout.total_seconds() * 1000), self.disable)
622
1045
# Also start a new checker *right now*.
623
1046
self.start_checker()
624
625
def checker_callback(self, pid, condition, command):
1047
1048
def checker_callback(self, source, condition, connection,
1049
command):
626
1050
"""The checker has completed, so take appropriate actions."""
1051
# Read return code from connection (see call_pipe)
1052
returncode = connection.recv()
1053
connection.close()
1054
if self.checker is not None:
1055
self.checker.join()
627
1056
self.checker_callback_tag = None
628
1057
self.checker = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
1058
1059
if returncode >= 0:
1060
self.last_checker_status = returncode
1061
self.last_checker_signal = None
631
1062
if self.last_checker_status == 0:
632
1063
logger.info("Checker for %(name)s succeeded",
633
1064
vars(self))
634
1065
self.checked_ok()
635
1066
else:
636
logger.info("Checker for %(name)s failed",
637
vars(self))
1067
logger.info("Checker for %(name)s failed", vars(self))
638
1068
else:
639
1069
self.last_checker_status = -1
1070
self.last_checker_signal = -returncode
640
1071
logger.warning("Checker for %(name)s crashed?",
641
1072
vars(self))
642
1073
return False
1074
643
1075
def checked_ok(self):
644
1076
"""Assert that the client has been seen, alive and well."""
645
1077
self.last_checked_ok = datetime.datetime.utcnow()
646
1078
self.last_checker_status = 0
1079
self.last_checker_signal = None
647
1080
self.bump_timeout()
648
1081
649
1082
def bump_timeout(self, timeout=None):
650
1083
"""Bump up the timeout for this client."""
651
1084
if timeout is None:
652
1085
timeout = self.timeout
653
1086
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
1087
GLib.source_remove(self.disable_initiator_tag)
655
1088
self.disable_initiator_tag = None
656
1089
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(timedelta_to_milliseconds
659
(timeout), self.disable))
1090
self.disable_initiator_tag = GLib.timeout_add(
1091
int(timeout.total_seconds() * 1000), self.disable)
660
1092
self.expires = datetime.datetime.utcnow() + timeout
661
1093
662
1094
def need_approval(self):
663
1095
self.last_approval_request = datetime.datetime.utcnow()
664
1096
665
1097
def start_checker(self):
666
1098
"""Start a new checker subprocess if one is not running.
667
1099
668
1100
If a checker already exists, leave it running and do
669
1101
nothing."""
670
1102
# The reason for not killing a running checker is that if we
675
1107
# checkers alone, the checker would have to take more time
676
1108
# than 'timeout' for the client to be disabled, which is as it
677
1109
# should be.
678
679
# If a checker exists, make sure it is not a zombie
680
try:
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except (AttributeError, OSError) as error:
683
if (isinstance(error, OSError)
684
and error.errno != errno.ECHILD):
685
raise error
686
else:
687
if pid:
688
logger.warning("Checker was a zombie")
689
gobject.source_remove(self.checker_callback_tag)
690
self.checker_callback(pid, status,
691
self.current_checker_command)
1110
1111
if self.checker is not None and not self.checker.is_alive():
1112
logger.warning("Checker was not alive; joining")
1113
self.checker.join()
1114
self.checker = None
692
1115
# Start a new checker if needed
693
1116
if self.checker is None:
694
1117
# Escape attributes for the shell
695
escaped_attrs = dict(
696
(attr, re.escape(unicode(getattr(self, attr))))
697
for attr in
698
self.runtime_expansions)
1118
escaped_attrs = {
1119
attr: re.escape(str(getattr(self, attr)))
1120
for attr in self.runtime_expansions}
699
1121
try:
700
1122
command = self.checker_command % escaped_attrs
701
1123
except TypeError as error:
702
1124
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
1125
self.checker_command,
1126
exc_info=error)
1127
return True # Try again later
705
1128
self.current_checker_command = command
706
try:
707
logger.info("Starting checker %r for %s",
708
command, self.name)
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
self.checker = subprocess.Popen(command,
714
close_fds=True,
715
shell=True, cwd="/")
716
except OSError as error:
717
logger.error("Failed to start subprocess",
718
exc_info=error)
719
self.checker_callback_tag = (gobject.child_watch_add
720
(self.checker.pid,
721
self.checker_callback,
722
data=command))
723
# The checker may have completed before the gobject
724
# watch was added. Check for this.
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
726
if pid:
727
gobject.source_remove(self.checker_callback_tag)
728
self.checker_callback(pid, status, command)
729
# Re-run this periodically if run by gobject.timeout_add
1129
logger.info("Starting checker %r for %s", command,
1130
self.name)
1131
# We don't need to redirect stdout and stderr, since
1132
# in normal mode, that is already done by daemon(),
1133
# and in debug mode we don't want to. (Stdin is
1134
# always replaced by /dev/null.)
1135
# The exception is when not debugging but nevertheless
1136
# running in the foreground; use the previously
1137
# created wnull.
1138
popen_args = {"close_fds": True,
1139
"shell": True,
1140
"cwd": "/"}
1141
if (not self.server_settings["debug"]
1142
and self.server_settings["foreground"]):
1143
popen_args.update({"stdout": wnull,
1144
"stderr": wnull})
1145
pipe = multiprocessing.Pipe(duplex=False)
1146
self.checker = multiprocessing.Process(
1147
target=call_pipe,
1148
args=(pipe[1], subprocess.call, command),
1149
kwargs=popen_args)
1150
self.checker.start()
1151
self.checker_callback_tag = GLib.io_add_watch(
1152
GLib.IOChannel.unix_new(pipe[0].fileno()),
1153
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1154
self.checker_callback, pipe[0], command)
1155
# Re-run this periodically if run by GLib.timeout_add
730
1156
return True
731
1157
732
1158
def stop_checker(self):
733
1159
"""Force the checker process, if any, to stop."""
734
1160
if self.checker_callback_tag:
735
gobject.source_remove(self.checker_callback_tag)
1161
GLib.source_remove(self.checker_callback_tag)
736
1162
self.checker_callback_tag = None
737
1163
if getattr(self, "checker", None) is None:
738
1164
return
739
1165
logger.debug("Stopping checker for %(name)s", vars(self))
740
try:
741
self.checker.terminate()
742
#time.sleep(0.5)
743
#if self.checker.poll() is None:
744
# self.checker.kill()
745
except OSError as error:
746
if error.errno != errno.ESRCH: # No such process
747
raise
1166
self.checker.terminate()
748
1167
self.checker = None
749
1168
750
1169
751
def dbus_service_property(dbus_interface, signature="v",
752
access="readwrite", byte_arrays=False):
1170
def dbus_service_property(dbus_interface,
1171
signature="v",
1172
access="readwrite",
1173
byte_arrays=False):
753
1174
"""Decorators for marking methods of a DBusObjectWithProperties to
754
1175
become properties on the D-Bus.
755
1176
756
1177
The decorated method will be called with no arguments by "Get"
757
1178
and with one argument by "Set".
758
1179
759
1180
The parameters, where they are supported, are the same as
760
1181
dbus.service.method, except there is only "signature", since the
761
1182
type from Get() and the type sent to Set() is the same.
764
1185
# "Set" method, so we fail early here:
765
1186
if byte_arrays and signature != "ay":
766
1187
raise ValueError("Byte arrays not supported for non-'ay'"
767
" signature {0!r}".format(signature))
1188
" signature {!r}".format(signature))
1189
768
1190
def decorator(func):
769
1191
func._dbus_is_property = True
770
1192
func._dbus_interface = dbus_interface
773
1195
func._dbus_name = func.__name__
774
1196
if func._dbus_name.endswith("_dbus_property"):
775
1197
func._dbus_name = func._dbus_name[:-14]
776
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1198
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
777
1199
return func
1200
778
1201
return decorator
779
1202
780
1203
781
1204
def dbus_interface_annotations(dbus_interface):
782
1205
"""Decorator for marking functions returning interface annotations
783
1206
784
1207
Usage:
785
1208
786
1209
@dbus_interface_annotations("org.example.Interface")
787
1210
def _foo(self): # Function name does not matter
788
1211
return {"org.freedesktop.DBus.Deprecated": "true",
789
1212
"org.freedesktop.DBus.Property.EmitsChangedSignal":
790
1213
"false"}
791
1214
"""
1215
792
1216
def decorator(func):
793
1217
func._dbus_is_interface = True
794
1218
func._dbus_interface = dbus_interface
795
1219
func._dbus_name = dbus_interface
796
1220
return func
1221
797
1222
return decorator
798
1223
799
1224
800
1225
def dbus_annotations(annotations):
801
1226
"""Decorator to annotate D-Bus methods, signals or properties
802
1227
Usage:
803
1228
1229
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1230
"org.freedesktop.DBus.Property."
1231
"EmitsChangedSignal": "false"})
804
1232
@dbus_service_property("org.example.Interface", signature="b",
805
1233
access="r")
806
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
"org.freedesktop.DBus.Property."
808
"EmitsChangedSignal": "false"})
809
1234
def Property_dbus_property(self):
810
1235
return dbus.Boolean(False)
1236
1237
See also the DBusObjectWithAnnotations class.
811
1238
"""
1239
812
1240
def decorator(func):
813
1241
func._dbus_annotations = annotations
814
1242
return func
1243
815
1244
return decorator
816
1245
817
1246
818
1247
class DBusPropertyException(dbus.exceptions.DBusException):
819
1248
"""A base class for D-Bus property-related exceptions
820
1249
"""
821
def __unicode__(self):
822
return unicode(str(self))
1250
pass
823
1251
824
1252
825
1253
class DBusPropertyAccessException(DBusPropertyException):
834
1262
pass
835
1263
836
1264
837
class DBusObjectWithProperties(dbus.service.Object):
838
"""A D-Bus object with properties.
839
840
Classes inheriting from this can use the dbus_service_property
841
decorator to expose methods as D-Bus properties. It exposes the
842
standard Get(), Set(), and GetAll() methods on the D-Bus.
1265
class DBusObjectWithAnnotations(dbus.service.Object):
1266
"""A D-Bus object with annotations.
1267
1268
Classes inheriting from this can use the dbus_annotations
1269
decorator to add annotations to methods or signals.
843
1270
"""
844
1271
845
1272
@staticmethod
846
1273
def _is_dbus_thing(thing):
847
1274
"""Returns a function testing if an attribute is a D-Bus thing
848
1275
849
1276
If called like _is_dbus_thing("method") it returns a function
850
1277
suitable for use as predicate to inspect.getmembers().
851
1278
"""
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1279
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
853
1280
False)
854
1281
855
1282
def _get_all_dbus_things(self, thing):
856
1283
"""Returns a generator of (name, attribute) pairs
857
1284
"""
858
return ((getattr(athing.__get__(self), "_dbus_name",
859
name),
1285
return ((getattr(athing.__get__(self), "_dbus_name", name),
860
1286
athing.__get__(self))
861
1287
for cls in self.__class__.__mro__
862
1288
for name, athing in
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
865
1289
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1290
1291
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1292
out_signature="s",
1293
path_keyword='object_path',
1294
connection_keyword='connection')
1295
def Introspect(self, object_path, connection):
1296
"""Overloading of standard D-Bus method.
1297
1298
Inserts annotation tags on methods and signals.
1299
"""
1300
xmlstring = dbus.service.Object.Introspect(self, object_path,
1301
connection)
1302
try:
1303
document = xml.dom.minidom.parseString(xmlstring)
1304
1305
for if_tag in document.getElementsByTagName("interface"):
1306
# Add annotation tags
1307
for typ in ("method", "signal"):
1308
for tag in if_tag.getElementsByTagName(typ):
1309
annots = dict()
1310
for name, prop in (self.
1311
_get_all_dbus_things(typ)):
1312
if (name == tag.getAttribute("name")
1313
and prop._dbus_interface
1314
== if_tag.getAttribute("name")):
1315
annots.update(getattr(
1316
prop, "_dbus_annotations", {}))
1317
for name, value in annots.items():
1318
ann_tag = document.createElement(
1319
"annotation")
1320
ann_tag.setAttribute("name", name)
1321
ann_tag.setAttribute("value", value)
1322
tag.appendChild(ann_tag)
1323
# Add interface annotation tags
1324
for annotation, value in dict(
1325
itertools.chain.from_iterable(
1326
annotations().items()
1327
for name, annotations
1328
in self._get_all_dbus_things("interface")
1329
if name == if_tag.getAttribute("name")
1330
)).items():
1331
ann_tag = document.createElement("annotation")
1332
ann_tag.setAttribute("name", annotation)
1333
ann_tag.setAttribute("value", value)
1334
if_tag.appendChild(ann_tag)
1335
# Fix argument name for the Introspect method itself
1336
if (if_tag.getAttribute("name")
1337
== dbus.INTROSPECTABLE_IFACE):
1338
for cn in if_tag.getElementsByTagName("method"):
1339
if cn.getAttribute("name") == "Introspect":
1340
for arg in cn.getElementsByTagName("arg"):
1341
if (arg.getAttribute("direction")
1342
== "out"):
1343
arg.setAttribute("name",
1344
"xml_data")
1345
xmlstring = document.toxml("utf-8")
1346
document.unlink()
1347
except (AttributeError, xml.dom.DOMException,
1348
xml.parsers.expat.ExpatError) as error:
1349
logger.error("Failed to override Introspection method",
1350
exc_info=error)
1351
return xmlstring
1352
1353
1354
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1355
"""A D-Bus object with properties.
1356
1357
Classes inheriting from this can use the dbus_service_property
1358
decorator to expose methods as D-Bus properties. It exposes the
1359
standard Get(), Set(), and GetAll() methods on the D-Bus.
1360
"""
1361
866
1362
def _get_dbus_property(self, interface_name, property_name):
867
1363
"""Returns a bound method if one exists which is a D-Bus
868
1364
property with the specified name and interface.
869
1365
"""
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
872
(cls,
873
self._is_dbus_thing("property"))):
1366
for cls in self.__class__.__mro__:
1367
for name, value in inspect.getmembers(
1368
cls, self._is_dbus_thing("property")):
874
1369
if (value._dbus_name == property_name
875
1370
and value._dbus_interface == interface_name):
876
1371
return value.__get__(self)
877
1372
878
1373
# No such property
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
881
+ property_name)
882
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1374
raise DBusPropertyNotFound("{}:{}.{}".format(
1375
self.dbus_object_path, interface_name, property_name))
1376
1377
@classmethod
1378
def _get_all_interface_names(cls):
1379
"""Get a sequence of all interfaces supported by an object"""
1380
return (name for name in set(getattr(getattr(x, attr),
1381
"_dbus_interface", None)
1382
for x in (inspect.getmro(cls))
1383
for attr in dir(x))
1384
if name is not None)
1385
1386
@dbus.service.method(dbus.PROPERTIES_IFACE,
1387
in_signature="ss",
884
1388
out_signature="v")
885
1389
def Get(self, interface_name, property_name):
886
1390
"""Standard D-Bus property Get() method, see D-Bus standard.
892
1396
if not hasattr(value, "variant_level"):
893
1397
return value
894
1398
return type(value)(value, variant_level=value.variant_level+1)
895
1399
896
1400
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
897
1401
def Set(self, interface_name, property_name, value):
898
1402
"""Standard D-Bus property Set() method, see D-Bus standard.
904
1408
# The byte_arrays option is not supported yet on
905
1409
# signatures other than "ay".
906
1410
if prop._dbus_signature != "ay":
907
raise ValueError
908
value = dbus.ByteArray(b''.join(chr(byte)
909
for byte in value))
1411
raise ValueError("Byte arrays not supported for non-"
1412
"'ay' signature {!r}"
1413
.format(prop._dbus_signature))
1414
value = dbus.ByteArray(bytes(value))
910
1415
prop(value)
911
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1416
1417
@dbus.service.method(dbus.PROPERTIES_IFACE,
1418
in_signature="s",
913
1419
out_signature="a{sv}")
914
1420
def GetAll(self, interface_name):
915
1421
"""Standard D-Bus property GetAll() method, see D-Bus
916
1422
standard.
917
1423
918
1424
Note: Will not include properties with access="write".
919
1425
"""
920
1426
properties = {}
930
1436
if not hasattr(value, "variant_level"):
931
1437
properties[name] = value
932
1438
continue
933
properties[name] = type(value)(value, variant_level=
934
value.variant_level+1)
1439
properties[name] = type(value)(
1440
value, variant_level=value.variant_level + 1)
935
1441
return dbus.Dictionary(properties, signature="sv")
936
1442
1443
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1444
def PropertiesChanged(self, interface_name, changed_properties,
1445
invalidated_properties):
1446
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1447
standard.
1448
"""
1449
pass
1450
937
1451
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
938
1452
out_signature="s",
939
1453
path_keyword='object_path',
940
1454
connection_keyword='connection')
941
1455
def Introspect(self, object_path, connection):
942
1456
"""Overloading of standard D-Bus method.
943
1457
944
1458
Inserts property tags and interface annotation tags.
945
1459
"""
946
xmlstring = dbus.service.Object.Introspect(self, object_path,
947
connection)
1460
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1461
object_path,
1462
connection)
948
1463
try:
949
1464
document = xml.dom.minidom.parseString(xmlstring)
1465
950
1466
def make_tag(document, name, prop):
951
1467
e = document.createElement("property")
952
1468
e.setAttribute("name", name)
953
1469
e.setAttribute("type", prop._dbus_signature)
954
1470
e.setAttribute("access", prop._dbus_access)
955
1471
return e
1472
956
1473
for if_tag in document.getElementsByTagName("interface"):
957
1474
# Add property tags
958
1475
for tag in (make_tag(document, name, prop)
961
1478
if prop._dbus_interface
962
1479
== if_tag.getAttribute("name")):
963
1480
if_tag.appendChild(tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
967
annots = dict()
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
974
(prop,
975
"_dbus_annotations",
976
{}))
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
979
"annotation")
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
990
)).iteritems():
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
1481
# Add annotation tags for properties
1482
for tag in if_tag.getElementsByTagName("property"):
1483
annots = dict()
1484
for name, prop in self._get_all_dbus_things(
1485
"property"):
1486
if (name == tag.getAttribute("name")
1487
and prop._dbus_interface
1488
== if_tag.getAttribute("name")):
1489
annots.update(getattr(
1490
prop, "_dbus_annotations", {}))
1491
for name, value in annots.items():
1492
ann_tag = document.createElement(
1493
"annotation")
1494
ann_tag.setAttribute("name", name)
1495
ann_tag.setAttribute("value", value)
1496
tag.appendChild(ann_tag)
995
1497
# Add the names to the return values for the
996
1498
# "org.freedesktop.DBus.Properties" methods
997
1499
if (if_tag.getAttribute("name")
1016
1518
return xmlstring
1017
1519
1018
1520
1521
try:
1522
dbus.OBJECT_MANAGER_IFACE
1523
except AttributeError:
1524
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1525
1526
1527
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1528
"""A D-Bus object with an ObjectManager.
1529
1530
Classes inheriting from this exposes the standard
1531
GetManagedObjects call and the InterfacesAdded and
1532
InterfacesRemoved signals on the standard
1533
"org.freedesktop.DBus.ObjectManager" interface.
1534
1535
Note: No signals are sent automatically; they must be sent
1536
manually.
1537
"""
1538
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1539
out_signature="a{oa{sa{sv}}}")
1540
def GetManagedObjects(self):
1541
"""This function must be overridden"""
1542
raise NotImplementedError()
1543
1544
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1545
signature="oa{sa{sv}}")
1546
def InterfacesAdded(self, object_path, interfaces_and_properties):
1547
pass
1548
1549
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1550
def InterfacesRemoved(self, object_path, interfaces):
1551
pass
1552
1553
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1554
out_signature="s",
1555
path_keyword='object_path',
1556
connection_keyword='connection')
1557
def Introspect(self, object_path, connection):
1558
"""Overloading of standard D-Bus method.
1559
1560
Override return argument name of GetManagedObjects to be
1561
"objpath_interfaces_and_properties"
1562
"""
1563
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1564
object_path,
1565
connection)
1566
try:
1567
document = xml.dom.minidom.parseString(xmlstring)
1568
1569
for if_tag in document.getElementsByTagName("interface"):
1570
# Fix argument name for the GetManagedObjects method
1571
if (if_tag.getAttribute("name")
1572
== dbus.OBJECT_MANAGER_IFACE):
1573
for cn in if_tag.getElementsByTagName("method"):
1574
if (cn.getAttribute("name")
1575
== "GetManagedObjects"):
1576
for arg in cn.getElementsByTagName("arg"):
1577
if (arg.getAttribute("direction")
1578
== "out"):
1579
arg.setAttribute(
1580
"name",
1581
"objpath_interfaces"
1582
"_and_properties")
1583
xmlstring = document.toxml("utf-8")
1584
document.unlink()
1585
except (AttributeError, xml.dom.DOMException,
1586
xml.parsers.expat.ExpatError) as error:
1587
logger.error("Failed to override Introspection method",
1588
exc_info=error)
1589
return xmlstring
1590
1591
1019
1592
def datetime_to_dbus(dt, variant_level=0):
1020
1593
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1021
1594
if dt is None:
1022
return dbus.String("", variant_level = variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1595
return dbus.String("", variant_level=variant_level)
1596
return dbus.String(dt.isoformat(), variant_level=variant_level)
1025
1597
1026
1598
1027
1599
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1029
1601
dbus.service.Object, it will add alternate D-Bus attributes with
1030
1602
interface names according to the "alt_interface_names" mapping.
1031
1603
Usage:
1032
1604
1033
1605
@alternate_dbus_interfaces({"org.example.Interface":
1034
1606
"net.example.AlternateInterface"})
1035
1607
class SampleDBusObject(dbus.service.Object):
1036
1608
@dbus.service.method("org.example.Interface")
1037
1609
def SampleDBusMethod():
1038
1610
pass
1039
1611
1040
1612
The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
1613
reachable via two interfaces: "org.example.Interface" and
1042
1614
"net.example.AlternateInterface", the latter of which will have
1043
1615
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
1616
"true", unless "deprecate" is passed with a False value.
1045
1617
1046
1618
This works for methods and signals, and also for D-Bus properties
1047
1619
(from DBusObjectWithProperties) and interfaces (from the
1048
1620
dbus_interface_annotations decorator).
1049
1621
"""
1622
1050
1623
def wrapper(cls):
1051
1624
for orig_interface_name, alt_interface_name in (
1052
alt_interface_names.iteritems()):
1625
alt_interface_names.items()):
1053
1626
attr = {}
1054
1627
interface_names = set()
1055
1628
# Go though all attributes of the class
1057
1630
# Ignore non-D-Bus attributes, and D-Bus attributes
1058
1631
# with the wrong interface name
1059
1632
if (not hasattr(attribute, "_dbus_interface")
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1633
or not attribute._dbus_interface.startswith(
1634
orig_interface_name)):
1062
1635
continue
1063
1636
# Create an alternate D-Bus interface name based on
1064
1637
# the current name
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1638
alt_interface = attribute._dbus_interface.replace(
1639
orig_interface_name, alt_interface_name)
1068
1640
interface_names.add(alt_interface)
1069
1641
# Is this a D-Bus signal?
1070
1642
if getattr(attribute, "_dbus_is_signal", False):
1071
# Extract the original non-method function by
1072
# black magic
1073
nonmethod_func = (dict(
1643
# Extract the original non-method undecorated
1644
# function by black magic
1645
if sys.version_info.major == 2:
1646
nonmethod_func = (dict(
1074
1647
zip(attribute.func_code.co_freevars,
1075
attribute.__closure__))["func"]
1076
.cell_contents)
1648
attribute.__closure__))
1649
["func"].cell_contents)
1650
else:
1651
nonmethod_func = (dict(
1652
zip(attribute.__code__.co_freevars,
1653
attribute.__closure__))
1654
["func"].cell_contents)
1077
1655
# Create a new, but exactly alike, function
1078
1656
# object, and decorate it to be a new D-Bus signal
1079
1657
# with the alternate D-Bus interface name
1080
new_function = (dbus.service.signal
1081
(alt_interface,
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1658
new_function = copy_function(nonmethod_func)
1659
new_function = (dbus.service.signal(
1660
alt_interface,
1661
attribute._dbus_signature)(new_function))
1089
1662
# Copy annotations, if any
1090
1663
try:
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1664
new_function._dbus_annotations = dict(
1665
attribute._dbus_annotations)
1093
1666
except AttributeError:
1094
1667
pass
1668
1095
1669
# Define a creator of a function to call both the
1096
1670
# original and alternate functions, so both the
1097
1671
# original and alternate signals gets sent when
1100
1674
"""This function is a scope container to pass
1101
1675
func1 and func2 to the "call_both" function
1102
1676
outside of its arguments"""
1677
1678
@functools.wraps(func2)
1103
1679
def call_both(*args, **kwargs):
1104
1680
"""This function will emit two D-Bus
1105
1681
signals by calling func1 and func2"""
1106
1682
func1(*args, **kwargs)
1107
1683
func2(*args, **kwargs)
1684
# Make wrapper function look like a D-Bus
1685
# signal
1686
for name, attr in inspect.getmembers(func2):
1687
if name.startswith("_dbus_"):
1688
setattr(call_both, name, attr)
1689
1108
1690
return call_both
1109
1691
# Create the "call_both" function and add it to
1110
1692
# the class
1115
1697
# object. Decorate it to be a new D-Bus method
1116
1698
# with the alternate D-Bus interface name. Add it
1117
1699
# to the class.
1118
attr[attrname] = (dbus.service.method
1119
(alt_interface,
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1122
(types.FunctionType
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1700
attr[attrname] = (
1701
dbus.service.method(
1702
alt_interface,
1703
attribute._dbus_in_signature,
1704
attribute._dbus_out_signature)
1705
(copy_function(attribute)))
1128
1706
# Copy annotations, if any
1129
1707
try:
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1708
attr[attrname]._dbus_annotations = dict(
1709
attribute._dbus_annotations)
1132
1710
except AttributeError:
1133
1711
pass
1134
1712
# Is this a D-Bus property?
1137
1715
# object, and decorate it to be a new D-Bus
1138
1716
# property with the alternate D-Bus interface
1139
1717
# name. Add it to the class.
1140
attr[attrname] = (dbus_service_property
1141
(alt_interface,
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1144
attribute
1145
._dbus_get_args_options
1146
["byte_arrays"])
1147
(types.FunctionType
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1718
attr[attrname] = (dbus_service_property(
1719
alt_interface, attribute._dbus_signature,
1720
attribute._dbus_access,
1721
attribute._dbus_get_args_options
1722
["byte_arrays"])
1723
(copy_function(attribute)))
1153
1724
# Copy annotations, if any
1154
1725
try:
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1726
attr[attrname]._dbus_annotations = dict(
1727
attribute._dbus_annotations)
1157
1728
except AttributeError:
1158
1729
pass
1159
1730
# Is this a D-Bus interface?
1162
1733
# object. Decorate it to be a new D-Bus interface
1163
1734
# with the alternate D-Bus interface name. Add it
1164
1735
# to the class.
1165
attr[attrname] = (dbus_interface_annotations
1166
(alt_interface)
1167
(types.FunctionType
1168
(attribute.func_code,
1169
attribute.func_globals,
1170
attribute.func_name,
1171
attribute.func_defaults,
1172
attribute.func_closure)))
1736
attr[attrname] = (
1737
dbus_interface_annotations(alt_interface)
1738
(copy_function(attribute)))
1173
1739
if deprecate:
1174
1740
# Deprecate all alternate interfaces
1175
iname="_AlternateDBusNames_interface_annotation{0}"
1741
iname = "_AlternateDBusNames_interface_annotation{}"
1176
1742
for interface_name in interface_names:
1743
1177
1744
@dbus_interface_annotations(interface_name)
1178
1745
def func(self):
1179
return { "org.freedesktop.DBus.Deprecated":
1180
"true" }
1746
return {"org.freedesktop.DBus.Deprecated":
1747
"true"}
1181
1748
# Find an unused name
1182
1749
for aname in (iname.format(i)
1183
1750
for i in itertools.count()):
1187
1754
if interface_names:
1188
1755
# Replace the class with a new subclass of it with
1189
1756
# methods, signals, etc. as created above.
1190
cls = type(b"{0}Alternate".format(cls.__name__),
1191
(cls,), attr)
1757
if sys.version_info.major == 2:
1758
cls = type(b"{}Alternate".format(cls.__name__),
1759
(cls, ), attr)
1760
else:
1761
cls = type("{}Alternate".format(cls.__name__),
1762
(cls, ), attr)
1192
1763
return cls
1764
1193
1765
return wrapper
1194
1766
1195
1767
1196
1768
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
"se.bsnet.fukt.Mandos"})
1769
"se.bsnet.fukt.Mandos"})
1198
1770
class ClientDBus(Client, DBusObjectWithProperties):
1199
1771
"""A Client class using D-Bus
1200
1772
1201
1773
Attributes:
1202
1774
dbus_object_path: dbus.ObjectPath
1203
1775
bus: dbus.SystemBus()
1204
1776
"""
1205
1777
1206
1778
runtime_expansions = (Client.runtime_expansions
1207
+ ("dbus_object_path",))
1208
1779
+ ("dbus_object_path", ))
1780
1781
_interface = "se.recompile.Mandos.Client"
1782
1209
1783
# dbus.service.Object doesn't use super(), so we can't either.
1210
1211
def __init__(self, bus = None, *args, **kwargs):
1784
1785
def __init__(self, bus=None, *args, **kwargs):
1212
1786
self.bus = bus
1213
1787
Client.__init__(self, *args, **kwargs)
1214
1788
# Only now, when this client is initialized, can it show up on
1215
1789
# the D-Bus
1216
client_object_name = unicode(self.name).translate(
1790
client_object_name = str(self.name).translate(
1217
1791
{ord("."): ord("_"),
1218
1792
ord("-"): ord("_")})
1219
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
1793
self.dbus_object_path = dbus.ObjectPath(
1794
"/clients/" + client_object_name)
1221
1795
DBusObjectWithProperties.__init__(self, self.bus,
1222
1796
self.dbus_object_path)
1223
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1226
variant_level=1):
1797
1798
def notifychangeproperty(transform_func, dbus_name,
1799
type_func=lambda x: x,
1800
variant_level=1,
1801
invalidate_only=False,
1802
_interface=_interface):
1227
1803
""" Modify a variable so that it's a property which announces
1228
1804
its changes to DBus.
1229
1805
1230
1806
transform_fun: Function that takes a value and a variant_level
1231
1807
and transforms it to a D-Bus type.
1232
1808
dbus_name: D-Bus name of the variable
1234
1810
to the D-Bus. Default: no transform
1235
1811
variant_level: D-Bus variant level. Default: 1
1236
1812
"""
1237
attrname = "_{0}".format(dbus_name)
1813
attrname = "_{}".format(dbus_name)
1814
1238
1815
def setter(self, value):
1239
1816
if hasattr(self, "dbus_object_path"):
1240
1817
if (not hasattr(self, attrname) or
1241
1818
type_func(getattr(self, attrname, None))
1242
1819
!= type_func(value)):
1243
dbus_value = transform_func(type_func(value),
1244
variant_level
1245
=variant_level)
1246
self.PropertyChanged(dbus.String(dbus_name),
1247
dbus_value)
1820
if invalidate_only:
1821
self.PropertiesChanged(
1822
_interface, dbus.Dictionary(),
1823
dbus.Array((dbus_name, )))
1824
else:
1825
dbus_value = transform_func(
1826
type_func(value),
1827
variant_level=variant_level)
1828
self.PropertyChanged(dbus.String(dbus_name),
1829
dbus_value)
1830
self.PropertiesChanged(
1831
_interface,
1832
dbus.Dictionary({dbus.String(dbus_name):
1833
dbus_value}),
1834
dbus.Array())
1248
1835
setattr(self, attrname, value)
1249
1836
1250
1837
return property(lambda self: getattr(self, attrname), setter)
1251
1838
1252
1839
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
1840
approvals_pending = notifychangeproperty(dbus.Boolean,
1254
1841
"ApprovalPending",
1255
type_func = bool)
1842
type_func=bool)
1256
1843
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
1844
last_enabled = notifychangeproperty(datetime_to_dbus,
1258
1845
"LastEnabled")
1259
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1260
type_func = lambda checker:
1261
checker is not None)
1846
checker = notifychangeproperty(
1847
dbus.Boolean, "CheckerRunning",
1848
type_func=lambda checker: checker is not None)
1262
1849
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1263
1850
"LastCheckedOK")
1264
1851
last_checker_status = notifychangeproperty(dbus.Int16,
1267
1854
datetime_to_dbus, "LastApprovalRequest")
1268
1855
approved_by_default = notifychangeproperty(dbus.Boolean,
1269
1856
"ApprovedByDefault")
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1271
"ApprovalDelay",
1272
type_func =
1273
timedelta_to_milliseconds)
1857
approval_delay = notifychangeproperty(
1858
dbus.UInt64, "ApprovalDelay",
1859
type_func=lambda td: td.total_seconds() * 1000)
1274
1860
approval_duration = notifychangeproperty(
1275
1861
dbus.UInt64, "ApprovalDuration",
1276
type_func = timedelta_to_milliseconds)
1862
type_func=lambda td: td.total_seconds() * 1000)
1277
1863
host = notifychangeproperty(dbus.String, "Host")
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1279
type_func =
1280
timedelta_to_milliseconds)
1864
timeout = notifychangeproperty(
1865
dbus.UInt64, "Timeout",
1866
type_func=lambda td: td.total_seconds() * 1000)
1281
1867
extended_timeout = notifychangeproperty(
1282
1868
dbus.UInt64, "ExtendedTimeout",
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1285
"Interval",
1286
type_func =
1287
timedelta_to_milliseconds)
1869
type_func=lambda td: td.total_seconds() * 1000)
1870
interval = notifychangeproperty(
1871
dbus.UInt64, "Interval",
1872
type_func=lambda td: td.total_seconds() * 1000)
1288
1873
checker_command = notifychangeproperty(dbus.String, "Checker")
1289
1874
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1875
invalidate_only=True)
1876
1290
1877
del notifychangeproperty
1291
1878
1292
1879
def __del__(self, *args, **kwargs):
1293
1880
try:
1294
1881
self.remove_from_connection()
1297
1884
if hasattr(DBusObjectWithProperties, "__del__"):
1298
1885
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1299
1886
Client.__del__(self, *args, **kwargs)
1300
1301
def checker_callback(self, pid, condition, command,
1302
*args, **kwargs):
1303
self.checker_callback_tag = None
1304
self.checker = None
1305
if os.WIFEXITED(condition):
1306
exitstatus = os.WEXITSTATUS(condition)
1887
1888
def checker_callback(self, source, condition,
1889
connection, command, *args, **kwargs):
1890
ret = Client.checker_callback(self, source, condition,
1891
connection, command, *args,
1892
**kwargs)
1893
exitstatus = self.last_checker_status
1894
if exitstatus >= 0:
1307
1895
# Emit D-Bus signal
1308
1896
self.CheckerCompleted(dbus.Int16(exitstatus),
1309
dbus.Int64(condition),
1897
# This is specific to GNU libC
1898
dbus.Int64(exitstatus << 8),
1310
1899
dbus.String(command))
1311
1900
else:
1312
1901
# Emit D-Bus signal
1313
1902
self.CheckerCompleted(dbus.Int16(-1),
1314
dbus.Int64(condition),
1903
dbus.Int64(
1904
# This is specific to GNU libC
1905
(exitstatus << 8)
1906
| self.last_checker_signal),
1315
1907
dbus.String(command))
1316
1317
return Client.checker_callback(self, pid, condition, command,
1318
*args, **kwargs)
1319
1908
return ret
1909
1320
1910
def start_checker(self, *args, **kwargs):
1321
old_checker = self.checker
1322
if self.checker is not None:
1323
old_checker_pid = self.checker.pid
1324
else:
1325
old_checker_pid = None
1911
old_checker_pid = getattr(self.checker, "pid", None)
1326
1912
r = Client.start_checker(self, *args, **kwargs)
1327
1913
# Only if new checker process was started
1328
1914
if (self.checker is not None
1330
1916
# Emit D-Bus signal
1331
1917
self.CheckerStarted(self.current_checker_command)
1332
1918
return r
1333
1919
1334
1920
def _reset_approved(self):
1335
1921
self.approved = None
1336
1922
return False
1337
1923
1338
1924
def approve(self, value=True):
1339
1925
self.approved = value
1340
gobject.timeout_add(timedelta_to_milliseconds
1341
(self.approval_duration),
1342
self._reset_approved)
1926
GLib.timeout_add(int(self.approval_duration.total_seconds()
1927
* 1000), self._reset_approved)
1343
1928
self.send_changedstate()
1344
1345
## D-Bus methods, signals & properties
1346
_interface = "se.recompile.Mandos.Client"
1347
1348
## Interfaces
1349
1350
@dbus_interface_annotations(_interface)
1351
def _foo(self):
1352
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
"false"}
1354
1355
## Signals
1356
1929
1930
# D-Bus methods, signals & properties
1931
1932
# Interfaces
1933
1934
# Signals
1935
1357
1936
# CheckerCompleted - signal
1358
1937
@dbus.service.signal(_interface, signature="nxs")
1359
1938
def CheckerCompleted(self, exitcode, waitstatus, command):
1360
1939
"D-Bus signal"
1361
1940
pass
1362
1941
1363
1942
# CheckerStarted - signal
1364
1943
@dbus.service.signal(_interface, signature="s")
1365
1944
def CheckerStarted(self, command):
1366
1945
"D-Bus signal"
1367
1946
pass
1368
1947
1369
1948
# PropertyChanged - signal
1949
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1370
1950
@dbus.service.signal(_interface, signature="sv")
1371
1951
def PropertyChanged(self, property, value):
1372
1952
"D-Bus signal"
1373
1953
pass
1374
1954
1375
1955
# GotSecret - signal
1376
1956
@dbus.service.signal(_interface)
1377
1957
def GotSecret(self):
1380
1960
server to mandos-client
1381
1961
"""
1382
1962
pass
1383
1963
1384
1964
# Rejected - signal
1385
1965
@dbus.service.signal(_interface, signature="s")
1386
1966
def Rejected(self, reason):
1387
1967
"D-Bus signal"
1388
1968
pass
1389
1969
1390
1970
# NeedApproval - signal
1391
1971
@dbus.service.signal(_interface, signature="tb")
1392
1972
def NeedApproval(self, timeout, default):
1393
1973
"D-Bus signal"
1394
1974
return self.need_approval()
1395
1396
## Methods
1397
1975
1976
# Methods
1977
1398
1978
# Approve - method
1399
1979
@dbus.service.method(_interface, in_signature="b")
1400
1980
def Approve(self, value):
1401
1981
self.approve(value)
1402
1982
1403
1983
# CheckedOK - method
1404
1984
@dbus.service.method(_interface)
1405
1985
def CheckedOK(self):
1406
1986
self.checked_ok()
1407
1987
1408
1988
# Enable - method
1989
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1409
1990
@dbus.service.method(_interface)
1410
1991
def Enable(self):
1411
1992
"D-Bus method"
1412
1993
self.enable()
1413
1994
1414
1995
# StartChecker - method
1996
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1415
1997
@dbus.service.method(_interface)
1416
1998
def StartChecker(self):
1417
1999
"D-Bus method"
1418
2000
self.start_checker()
1419
2001
1420
2002
# Disable - method
2003
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1421
2004
@dbus.service.method(_interface)
1422
2005
def Disable(self):
1423
2006
"D-Bus method"
1424
2007
self.disable()
1425
2008
1426
2009
# StopChecker - method
2010
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1427
2011
@dbus.service.method(_interface)
1428
2012
def StopChecker(self):
1429
2013
self.stop_checker()
1430
1431
## Properties
1432
2014
2015
# Properties
2016
1433
2017
# ApprovalPending - property
1434
2018
@dbus_service_property(_interface, signature="b", access="read")
1435
2019
def ApprovalPending_dbus_property(self):
1436
2020
return dbus.Boolean(bool(self.approvals_pending))
1437
2021
1438
2022
# ApprovedByDefault - property
1439
@dbus_service_property(_interface, signature="b",
2023
@dbus_service_property(_interface,
2024
signature="b",
1440
2025
access="readwrite")
1441
2026
def ApprovedByDefault_dbus_property(self, value=None):
1442
2027
if value is None: # get
1443
2028
return dbus.Boolean(self.approved_by_default)
1444
2029
self.approved_by_default = bool(value)
1445
2030
1446
2031
# ApprovalDelay - property
1447
@dbus_service_property(_interface, signature="t",
2032
@dbus_service_property(_interface,
2033
signature="t",
1448
2034
access="readwrite")
1449
2035
def ApprovalDelay_dbus_property(self, value=None):
1450
2036
if value is None: # get
1451
return dbus.UInt64(self.approval_delay_milliseconds())
2037
return dbus.UInt64(self.approval_delay.total_seconds()
2038
* 1000)
1452
2039
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1453
2040
1454
2041
# ApprovalDuration - property
1455
@dbus_service_property(_interface, signature="t",
2042
@dbus_service_property(_interface,
2043
signature="t",
1456
2044
access="readwrite")
1457
2045
def ApprovalDuration_dbus_property(self, value=None):
1458
2046
if value is None: # get
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
2047
return dbus.UInt64(self.approval_duration.total_seconds()
2048
* 1000)
1461
2049
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1462
2050
1463
2051
# Name - property
2052
@dbus_annotations(
2053
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1464
2054
@dbus_service_property(_interface, signature="s", access="read")
1465
2055
def Name_dbus_property(self):
1466
2056
return dbus.String(self.name)
1467
2057
2058
# KeyID - property
2059
@dbus_annotations(
2060
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2061
@dbus_service_property(_interface, signature="s", access="read")
2062
def KeyID_dbus_property(self):
2063
return dbus.String(self.key_id)
2064
1468
2065
# Fingerprint - property
2066
@dbus_annotations(
2067
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1469
2068
@dbus_service_property(_interface, signature="s", access="read")
1470
2069
def Fingerprint_dbus_property(self):
1471
2070
return dbus.String(self.fingerprint)
1472
2071
1473
2072
# Host - property
1474
@dbus_service_property(_interface, signature="s",
2073
@dbus_service_property(_interface,
2074
signature="s",
1475
2075
access="readwrite")
1476
2076
def Host_dbus_property(self, value=None):
1477
2077
if value is None: # get
1478
2078
return dbus.String(self.host)
1479
self.host = unicode(value)
1480
2079
self.host = str(value)
2080
1481
2081
# Created - property
2082
@dbus_annotations(
2083
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1482
2084
@dbus_service_property(_interface, signature="s", access="read")
1483
2085
def Created_dbus_property(self):
1484
2086
return datetime_to_dbus(self.created)
1485
2087
1486
2088
# LastEnabled - property
1487
2089
@dbus_service_property(_interface, signature="s", access="read")
1488
2090
def LastEnabled_dbus_property(self):
1489
2091
return datetime_to_dbus(self.last_enabled)
1490
2092
1491
2093
# Enabled - property
1492
@dbus_service_property(_interface, signature="b",
2094
@dbus_service_property(_interface,
2095
signature="b",
1493
2096
access="readwrite")
1494
2097
def Enabled_dbus_property(self, value=None):
1495
2098
if value is None: # get
1498
2101
self.enable()
1499
2102
else:
1500
2103
self.disable()
1501
2104
1502
2105
# LastCheckedOK - property
1503
@dbus_service_property(_interface, signature="s",
2106
@dbus_service_property(_interface,
2107
signature="s",
1504
2108
access="readwrite")
1505
2109
def LastCheckedOK_dbus_property(self, value=None):
1506
2110
if value is not None:
1507
2111
self.checked_ok()
1508
2112
return
1509
2113
return datetime_to_dbus(self.last_checked_ok)
1510
2114
1511
2115
# LastCheckerStatus - property
1512
@dbus_service_property(_interface, signature="n",
1513
access="read")
2116
@dbus_service_property(_interface, signature="n", access="read")
1514
2117
def LastCheckerStatus_dbus_property(self):
1515
2118
return dbus.Int16(self.last_checker_status)
1516
2119
1517
2120
# Expires - property
1518
2121
@dbus_service_property(_interface, signature="s", access="read")
1519
2122
def Expires_dbus_property(self):
1520
2123
return datetime_to_dbus(self.expires)
1521
2124
1522
2125
# LastApprovalRequest - property
1523
2126
@dbus_service_property(_interface, signature="s", access="read")
1524
2127
def LastApprovalRequest_dbus_property(self):
1525
2128
return datetime_to_dbus(self.last_approval_request)
1526
2129
1527
2130
# Timeout - property
1528
@dbus_service_property(_interface, signature="t",
2131
@dbus_service_property(_interface,
2132
signature="t",
1529
2133
access="readwrite")
1530
2134
def Timeout_dbus_property(self, value=None):
1531
2135
if value is None: # get
1532
return dbus.UInt64(self.timeout_milliseconds())
2136
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1533
2137
old_timeout = self.timeout
1534
2138
self.timeout = datetime.timedelta(0, 0, 0, value)
1535
2139
# Reschedule disabling
1543
2147
if (getattr(self, "disable_initiator_tag", None)
1544
2148
is None):
1545
2149
return
1546
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1550
self.disable))
1551
2150
GLib.source_remove(self.disable_initiator_tag)
2151
self.disable_initiator_tag = GLib.timeout_add(
2152
int((self.expires - now).total_seconds() * 1000),
2153
self.disable)
2154
1552
2155
# ExtendedTimeout - property
1553
@dbus_service_property(_interface, signature="t",
2156
@dbus_service_property(_interface,
2157
signature="t",
1554
2158
access="readwrite")
1555
2159
def ExtendedTimeout_dbus_property(self, value=None):
1556
2160
if value is None: # get
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
2161
return dbus.UInt64(self.extended_timeout.total_seconds()
2162
* 1000)
1558
2163
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1559
2164
1560
2165
# Interval - property
1561
@dbus_service_property(_interface, signature="t",
2166
@dbus_service_property(_interface,
2167
signature="t",
1562
2168
access="readwrite")
1563
2169
def Interval_dbus_property(self, value=None):
1564
2170
if value is None: # get
1565
return dbus.UInt64(self.interval_milliseconds())
2171
return dbus.UInt64(self.interval.total_seconds() * 1000)
1566
2172
self.interval = datetime.timedelta(0, 0, 0, value)
1567
2173
if getattr(self, "checker_initiator_tag", None) is None:
1568
2174
return
1569
2175
if self.enabled:
1570
2176
# Reschedule checker run
1571
gobject.source_remove(self.checker_initiator_tag)
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1575
2177
GLib.source_remove(self.checker_initiator_tag)
2178
self.checker_initiator_tag = GLib.timeout_add(
2179
value, self.start_checker)
2180
self.start_checker() # Start one now, too
2181
1576
2182
# Checker - property
1577
@dbus_service_property(_interface, signature="s",
2183
@dbus_service_property(_interface,
2184
signature="s",
1578
2185
access="readwrite")
1579
2186
def Checker_dbus_property(self, value=None):
1580
2187
if value is None: # get
1581
2188
return dbus.String(self.checker_command)
1582
self.checker_command = unicode(value)
1583
2189
self.checker_command = str(value)
2190
1584
2191
# CheckerRunning - property
1585
@dbus_service_property(_interface, signature="b",
2192
@dbus_service_property(_interface,
2193
signature="b",
1586
2194
access="readwrite")
1587
2195
def CheckerRunning_dbus_property(self, value=None):
1588
2196
if value is None: # get
1591
2199
self.start_checker()
1592
2200
else:
1593
2201
self.stop_checker()
1594
2202
1595
2203
# ObjectPath - property
2204
@dbus_annotations(
2205
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2206
"org.freedesktop.DBus.Deprecated": "true"})
1596
2207
@dbus_service_property(_interface, signature="o", access="read")
1597
2208
def ObjectPath_dbus_property(self):
1598
return self.dbus_object_path # is already a dbus.ObjectPath
1599
2209
return self.dbus_object_path # is already a dbus.ObjectPath
2210
1600
2211
# Secret = property
1601
@dbus_service_property(_interface, signature="ay",
1602
access="write", byte_arrays=True)
2212
@dbus_annotations(
2213
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2214
"invalidates"})
2215
@dbus_service_property(_interface,
2216
signature="ay",
2217
access="write",
2218
byte_arrays=True)
1603
2219
def Secret_dbus_property(self, value):
1604
self.secret = str(value)
1605
2220
self.secret = bytes(value)
2221
1606
2222
del _interface
1607
2223
1608
2224
1609
class ProxyClient(object):
1610
def __init__(self, child_pipe, fpr, address):
2225
class ProxyClient:
2226
def __init__(self, child_pipe, key_id, fpr, address):
1611
2227
self._pipe = child_pipe
1612
self._pipe.send(('init', fpr, address))
2228
self._pipe.send(('init', key_id, fpr, address))
1613
2229
if not self._pipe.recv():
1614
raise KeyError()
1615
2230
raise KeyError(key_id or fpr)
2231
1616
2232
def __getattribute__(self, name):
1617
2233
if name == '_pipe':
1618
2234
return super(ProxyClient, self).__getattribute__(name)
1621
2237
if data[0] == 'data':
1622
2238
return data[1]
1623
2239
if data[0] == 'function':
2240
1624
2241
def func(*args, **kwargs):
1625
2242
self._pipe.send(('funcall', name, args, kwargs))
1626
2243
return self._pipe.recv()[1]
2244
1627
2245
return func
1628
2246
1629
2247
def __setattr__(self, name, value):
1630
2248
if name == '_pipe':
1631
2249
return super(ProxyClient, self).__setattr__(name, value)
1634
2252
1635
2253
class ClientHandler(socketserver.BaseRequestHandler, object):
1636
2254
"""A class to handle client connections.
1637
2255
1638
2256
Instantiated once for each connection to handle it.
1639
2257
Note: This will run in its own forked process."""
1640
2258
1641
2259
def handle(self):
1642
2260
with contextlib.closing(self.server.child_pipe) as child_pipe:
1643
2261
logger.info("TCP connection from: %s",
1644
unicode(self.client_address))
2262
str(self.client_address))
1645
2263
logger.debug("Pipe FD: %d",
1646
2264
self.server.child_pipe.fileno())
1647
1648
session = (gnutls.connection
1649
.ClientSession(self.request,
1650
gnutls.connection
1651
.X509Credentials()))
1652
1653
# Note: gnutls.connection.X509Credentials is really a
1654
# generic GnuTLS certificate credentials object so long as
1655
# no X.509 keys are added to it. Therefore, we can use it
1656
# here despite using OpenPGP certificates.
1657
1658
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1659
# "+AES-256-CBC", "+SHA1",
1660
# "+COMP-NULL", "+CTYPE-OPENPGP",
1661
# "+DHE-DSS"))
2265
2266
session = gnutls.ClientSession(self.request)
2267
2268
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2269
# "+AES-256-CBC", "+SHA1",
2270
# "+COMP-NULL", "+CTYPE-OPENPGP",
2271
# "+DHE-DSS"))
1662
2272
# Use a fallback default, since this MUST be set.
1663
2273
priority = self.server.gnutls_priority
1664
2274
if priority is None:
1665
2275
priority = "NORMAL"
1666
(gnutls.library.functions
1667
.gnutls_priority_set_direct(session._c_object,
1668
priority, None))
1669
2276
gnutls.priority_set_direct(session._c_object,
2277
priority.encode("utf-8"),
2278
None)
2279
1670
2280
# Start communication using the Mandos protocol
1671
2281
# Get protocol number
1672
2282
line = self.request.makefile().readline()
1673
2283
logger.debug("Protocol version: %r", line)
1674
2284
try:
1675
2285
if int(line.strip().split()[0]) > 1:
1676
raise RuntimeError
2286
raise RuntimeError(line)
1677
2287
except (ValueError, IndexError, RuntimeError) as error:
1678
2288
logger.error("Unknown protocol version: %s", error)
1679
2289
return
1680
2290
1681
2291
# Start GnuTLS connection
1682
2292
try:
1683
2293
session.handshake()
1684
except gnutls.errors.GNUTLSError as error:
2294
except gnutls.Error as error:
1685
2295
logger.warning("Handshake failed: %s", error)
1686
2296
# Do not run session.bye() here: the session is not
1687
2297
# established. Just abandon the request.
1688
2298
return
1689
2299
logger.debug("Handshake succeeded")
1690
2300
1691
2301
approval_required = False
1692
2302
try:
1693
try:
1694
fpr = self.fingerprint(self.peer_certificate
1695
(session))
1696
except (TypeError,
1697
gnutls.errors.GNUTLSError) as error:
1698
logger.warning("Bad certificate: %s", error)
1699
return
1700
logger.debug("Fingerprint: %s", fpr)
1701
1702
try:
1703
client = ProxyClient(child_pipe, fpr,
2303
if gnutls.has_rawpk:
2304
fpr = b""
2305
try:
2306
key_id = self.key_id(
2307
self.peer_certificate(session))
2308
except (TypeError, gnutls.Error) as error:
2309
logger.warning("Bad certificate: %s", error)
2310
return
2311
logger.debug("Key ID: %s", key_id)
2312
2313
else:
2314
key_id = b""
2315
try:
2316
fpr = self.fingerprint(
2317
self.peer_certificate(session))
2318
except (TypeError, gnutls.Error) as error:
2319
logger.warning("Bad certificate: %s", error)
2320
return
2321
logger.debug("Fingerprint: %s", fpr)
2322
2323
try:
2324
client = ProxyClient(child_pipe, key_id, fpr,
1704
2325
self.client_address)
1705
2326
except KeyError:
1706
2327
return
1707
2328
1708
2329
if client.approval_delay:
1709
2330
delay = client.approval_delay
1710
2331
client.approvals_pending += 1
1711
2332
approval_required = True
1712
2333
1713
2334
while True:
1714
2335
if not client.enabled:
1715
2336
logger.info("Client %s is disabled",
1716
client.name)
2337
client.name)
1717
2338
if self.server.use_dbus:
1718
2339
# Emit D-Bus signal
1719
2340
client.Rejected("Disabled")
1720
2341
return
1721
2342
1722
2343
if client.approved or not client.approval_delay:
1723
#We are approved or approval is disabled
2344
# We are approved or approval is disabled
1724
2345
break
1725
2346
elif client.approved is None:
1726
2347
logger.info("Client %s needs approval",
1728
2349
if self.server.use_dbus:
1729
2350
# Emit D-Bus signal
1730
2351
client.NeedApproval(
1731
client.approval_delay_milliseconds(),
1732
client.approved_by_default)
2352
client.approval_delay.total_seconds()
2353
* 1000, client.approved_by_default)
1733
2354
else:
1734
2355
logger.warning("Client %s was not approved",
1735
2356
client.name)
1737
2358
# Emit D-Bus signal
1738
2359
client.Rejected("Denied")
1739
2360
return
1740
1741
#wait until timeout or approved
2361
2362
# wait until timeout or approved
1742
2363
time = datetime.datetime.now()
1743
2364
client.changedstate.acquire()
1744
client.changedstate.wait(
1745
float(timedelta_to_milliseconds(delay)
1746
/ 1000))
2365
client.changedstate.wait(delay.total_seconds())
1747
2366
client.changedstate.release()
1748
2367
time2 = datetime.datetime.now()
1749
2368
if (time2 - time) >= delay:
1759
2378
break
1760
2379
else:
1761
2380
delay -= time2 - time
1762
1763
sent_size = 0
1764
while sent_size < len(client.secret):
1765
try:
1766
sent = session.send(client.secret[sent_size:])
1767
except gnutls.errors.GNUTLSError as error:
1768
logger.warning("gnutls send failed",
1769
exc_info=error)
1770
return
1771
logger.debug("Sent: %d, remaining: %d",
1772
sent, len(client.secret)
1773
- (sent_size + sent))
1774
sent_size += sent
1775
2381
2382
try:
2383
session.send(client.secret)
2384
except gnutls.Error as error:
2385
logger.warning("gnutls send failed",
2386
exc_info=error)
2387
return
2388
1776
2389
logger.info("Sending secret to %s", client.name)
1777
2390
# bump the timeout using extended_timeout
1778
2391
client.bump_timeout(client.extended_timeout)
1779
2392
if self.server.use_dbus:
1780
2393
# Emit D-Bus signal
1781
2394
client.GotSecret()
1782
2395
1783
2396
finally:
1784
2397
if approval_required:
1785
2398
client.approvals_pending -= 1
1786
2399
try:
1787
2400
session.bye()
1788
except gnutls.errors.GNUTLSError as error:
2401
except gnutls.Error as error:
1789
2402
logger.warning("GnuTLS bye failed",
1790
2403
exc_info=error)
1791
2404
1792
2405
@staticmethod
1793
2406
def peer_certificate(session):
1794
"Return the peer's OpenPGP certificate as a bytestring"
1795
# If not an OpenPGP certificate...
1796
if (gnutls.library.functions
1797
.gnutls_certificate_type_get(session._c_object)
1798
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1799
# ...do the normal thing
1800
return session.peer_certificate
2407
"Return the peer's certificate as a bytestring"
2408
try:
2409
cert_type = gnutls.certificate_type_get2(session._c_object,
2410
gnutls.CTYPE_PEERS)
2411
except AttributeError:
2412
cert_type = gnutls.certificate_type_get(session._c_object)
2413
if gnutls.has_rawpk:
2414
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2415
else:
2416
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2417
# If not a valid certificate type...
2418
if cert_type not in valid_cert_types:
2419
logger.info("Cert type %r not in %r", cert_type,
2420
valid_cert_types)
2421
# ...return invalid data
2422
return b""
1801
2423
list_size = ctypes.c_uint(1)
1802
cert_list = (gnutls.library.functions
1803
.gnutls_certificate_get_peers
2424
cert_list = (gnutls.certificate_get_peers
1804
2425
(session._c_object, ctypes.byref(list_size)))
1805
2426
if not bool(cert_list) and list_size.value != 0:
1806
raise gnutls.errors.GNUTLSError("error getting peer"
1807
" certificate")
2427
raise gnutls.Error("error getting peer certificate")
1808
2428
if list_size.value == 0:
1809
2429
return None
1810
2430
cert = cert_list[0]
1811
2431
return ctypes.string_at(cert.data, cert.size)
1812
2432
2433
@staticmethod
2434
def key_id(certificate):
2435
"Convert a certificate bytestring to a hexdigit key ID"
2436
# New GnuTLS "datum" with the public key
2437
datum = gnutls.datum_t(
2438
ctypes.cast(ctypes.c_char_p(certificate),
2439
ctypes.POINTER(ctypes.c_ubyte)),
2440
ctypes.c_uint(len(certificate)))
2441
# XXX all these need to be created in the gnutls "module"
2442
# New empty GnuTLS certificate
2443
pubkey = gnutls.pubkey_t()
2444
gnutls.pubkey_init(ctypes.byref(pubkey))
2445
# Import the raw public key into the certificate
2446
gnutls.pubkey_import(pubkey,
2447
ctypes.byref(datum),
2448
gnutls.X509_FMT_DER)
2449
# New buffer for the key ID
2450
buf = ctypes.create_string_buffer(32)
2451
buf_len = ctypes.c_size_t(len(buf))
2452
# Get the key ID from the raw public key into the buffer
2453
gnutls.pubkey_get_key_id(pubkey,
2454
gnutls.KEYID_USE_SHA256,
2455
ctypes.cast(ctypes.byref(buf),
2456
ctypes.POINTER(ctypes.c_ubyte)),
2457
ctypes.byref(buf_len))
2458
# Deinit the certificate
2459
gnutls.pubkey_deinit(pubkey)
2460
2461
# Convert the buffer to a Python bytestring
2462
key_id = ctypes.string_at(buf, buf_len.value)
2463
# Convert the bytestring to hexadecimal notation
2464
hex_key_id = binascii.hexlify(key_id).upper()
2465
return hex_key_id
2466
1813
2467
@staticmethod
1814
2468
def fingerprint(openpgp):
1815
2469
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1816
2470
# New GnuTLS "datum" with the OpenPGP public key
1817
datum = (gnutls.library.types
1818
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1819
ctypes.POINTER
1820
(ctypes.c_ubyte)),
1821
ctypes.c_uint(len(openpgp))))
2471
datum = gnutls.datum_t(
2472
ctypes.cast(ctypes.c_char_p(openpgp),
2473
ctypes.POINTER(ctypes.c_ubyte)),
2474
ctypes.c_uint(len(openpgp)))
1822
2475
# New empty GnuTLS certificate
1823
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1824
(gnutls.library.functions
1825
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2476
crt = gnutls.openpgp_crt_t()
2477
gnutls.openpgp_crt_init(ctypes.byref(crt))
1826
2478
# Import the OpenPGP public key into the certificate
1827
(gnutls.library.functions
1828
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
gnutls.library.constants
1830
.GNUTLS_OPENPGP_FMT_RAW))
2479
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2480
gnutls.OPENPGP_FMT_RAW)
1831
2481
# Verify the self signature in the key
1832
2482
crtverify = ctypes.c_uint()
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_verify_self(crt, 0,
1835
ctypes.byref(crtverify)))
2483
gnutls.openpgp_crt_verify_self(crt, 0,
2484
ctypes.byref(crtverify))
1836
2485
if crtverify.value != 0:
1837
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1838
raise (gnutls.errors.CertificateSecurityError
1839
("Verify failed"))
2486
gnutls.openpgp_crt_deinit(crt)
2487
raise gnutls.CertificateSecurityError(code
2488
=crtverify.value)
1840
2489
# New buffer for the fingerprint
1841
2490
buf = ctypes.create_string_buffer(20)
1842
2491
buf_len = ctypes.c_size_t()
1843
2492
# Get the fingerprint from the certificate into the buffer
1844
(gnutls.library.functions
1845
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
ctypes.byref(buf_len)))
2493
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2494
ctypes.byref(buf_len))
1847
2495
# Deinit the certificate
1848
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2496
gnutls.openpgp_crt_deinit(crt)
1849
2497
# Convert the buffer to a Python bytestring
1850
2498
fpr = ctypes.string_at(buf, buf_len.value)
1851
2499
# Convert the bytestring to hexadecimal notation
1853
2501
return hex_fpr
1854
2502
1855
2503
1856
class MultiprocessingMixIn(object):
2504
class MultiprocessingMixIn:
1857
2505
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2506
1858
2507
def sub_process_main(self, request, address):
1859
2508
try:
1860
2509
self.finish_request(request, address)
1861
2510
except Exception:
1862
2511
self.handle_error(request, address)
1863
2512
self.close_request(request)
1864
2513
1865
2514
def process_request(self, request, address):
1866
2515
"""Start a new process to process the request."""
1867
proc = multiprocessing.Process(target = self.sub_process_main,
1868
args = (request, address))
2516
proc = multiprocessing.Process(target=self.sub_process_main,
2517
args=(request, address))
1869
2518
proc.start()
1870
2519
return proc
1871
2520
1872
2521
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2522
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1874
2523
""" adds a pipe to the MixIn """
2524
1875
2525
def process_request(self, request, client_address):
1876
2526
"""Overrides and wraps the original process_request().
1877
2527
1878
2528
This function creates a new pipe in self.pipe
1879
2529
"""
1880
2530
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1881
2531
1882
2532
proc = MultiprocessingMixIn.process_request(self, request,
1883
2533
client_address)
1884
2534
self.child_pipe.close()
1885
2535
self.add_pipe(parent_pipe, proc)
1886
2536
1887
2537
def add_pipe(self, parent_pipe, proc):
1888
2538
"""Dummy function; override as necessary"""
1889
raise NotImplementedError
2539
raise NotImplementedError()
1890
2540
1891
2541
1892
2542
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1893
socketserver.TCPServer, object):
2543
socketserver.TCPServer):
1894
2544
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1895
2545
1896
2546
Attributes:
1897
2547
enabled: Boolean; whether this server is activated yet
1898
2548
interface: None or a network interface name (string)
1899
2549
use_ipv6: Boolean; to use IPv6 or not
1900
2550
"""
2551
1901
2552
def __init__(self, server_address, RequestHandlerClass,
1902
interface=None, use_ipv6=True):
2553
interface=None,
2554
use_ipv6=True,
2555
socketfd=None):
2556
"""If socketfd is set, use that file descriptor instead of
2557
creating a new one with socket.socket().
2558
"""
1903
2559
self.interface = interface
1904
2560
if use_ipv6:
1905
2561
self.address_family = socket.AF_INET6
2562
if socketfd is not None:
2563
# Save the file descriptor
2564
self.socketfd = socketfd
2565
# Save the original socket.socket() function
2566
self.socket_socket = socket.socket
2567
2568
# To implement --socket, we monkey patch socket.socket.
2569
#
2570
# (When socketserver.TCPServer is a new-style class, we
2571
# could make self.socket into a property instead of monkey
2572
# patching socket.socket.)
2573
#
2574
# Create a one-time-only replacement for socket.socket()
2575
@functools.wraps(socket.socket)
2576
def socket_wrapper(*args, **kwargs):
2577
# Restore original function so subsequent calls are
2578
# not affected.
2579
socket.socket = self.socket_socket
2580
del self.socket_socket
2581
# This time only, return a new socket object from the
2582
# saved file descriptor.
2583
return socket.fromfd(self.socketfd, *args, **kwargs)
2584
# Replace socket.socket() function with wrapper
2585
socket.socket = socket_wrapper
2586
# The socketserver.TCPServer.__init__ will call
2587
# socket.socket(), which might be our replacement,
2588
# socket_wrapper(), if socketfd was set.
1906
2589
socketserver.TCPServer.__init__(self, server_address,
1907
2590
RequestHandlerClass)
2591
1908
2592
def server_bind(self):
1909
2593
"""This overrides the normal server_bind() function
1910
2594
to bind to an interface if one was specified, and also NOT to
1911
2595
bind to an address or port if they were not specified."""
2596
global SO_BINDTODEVICE
1912
2597
if self.interface is not None:
1913
2598
if SO_BINDTODEVICE is None:
1914
logger.error("SO_BINDTODEVICE does not exist;"
1915
" cannot bind to interface %s",
1916
self.interface)
1917
else:
1918
try:
1919
self.socket.setsockopt(socket.SOL_SOCKET,
1920
SO_BINDTODEVICE,
1921
str(self.interface
1922
+ '\0'))
1923
except socket.error as error:
1924
if error.errno == errno.EPERM:
1925
logger.error("No permission to"
1926
" bind to interface %s",
1927
self.interface)
1928
elif error.errno == errno.ENOPROTOOPT:
1929
logger.error("SO_BINDTODEVICE not available;"
1930
" cannot bind to interface %s",
1931
self.interface)
1932
elif error.errno == errno.ENODEV:
1933
logger.error("Interface %s does not"
1934
" exist, cannot bind",
1935
self.interface)
1936
else:
1937
raise
2599
# Fall back to a hard-coded value which seems to be
2600
# common enough.
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2602
SO_BINDTODEVICE = 25
2603
try:
2604
self.socket.setsockopt(
2605
socket.SOL_SOCKET, SO_BINDTODEVICE,
2606
(self.interface + "\0").encode("utf-8"))
2607
except socket.error as error:
2608
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2611
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2614
self.interface)
2615
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2618
else:
2619
raise
1938
2620
# Only bind(2) the socket if we really need to.
1939
2621
if self.server_address[0] or self.server_address[1]:
2622
if self.server_address[1]:
2623
self.allow_reuse_address = True
1940
2624
if not self.server_address[0]:
1941
2625
if self.address_family == socket.AF_INET6:
1942
any_address = "::" # in6addr_any
2626
any_address = "::" # in6addr_any
1943
2627
else:
1944
any_address = socket.INADDR_ANY
2628
any_address = "0.0.0.0" # INADDR_ANY
1945
2629
self.server_address = (any_address,
1946
2630
self.server_address[1])
1947
2631
elif not self.server_address[1]:
1948
self.server_address = (self.server_address[0],
1949
0)
2632
self.server_address = (self.server_address[0], 0)
1950
2633
# if self.interface:
1951
2634
# self.server_address = (self.server_address[0],
1952
2635
# 0, # port
1958
2641
1959
2642
class MandosServer(IPv6_TCPServer):
1960
2643
"""Mandos server.
1961
2644
1962
2645
Attributes:
1963
2646
clients: set of Client objects
1964
2647
gnutls_priority GnuTLS priority string
1965
2648
use_dbus: Boolean; to emit D-Bus signals or not
1966
1967
Assumes a gobject.MainLoop event loop.
2649
2650
Assumes a GLib.MainLoop event loop.
1968
2651
"""
2652
1969
2653
def __init__(self, server_address, RequestHandlerClass,
1970
interface=None, use_ipv6=True, clients=None,
1971
gnutls_priority=None, use_dbus=True):
2654
interface=None,
2655
use_ipv6=True,
2656
clients=None,
2657
gnutls_priority=None,
2658
use_dbus=True,
2659
socketfd=None):
1972
2660
self.enabled = False
1973
2661
self.clients = clients
1974
2662
if self.clients is None:
1977
2665
self.gnutls_priority = gnutls_priority
1978
2666
IPv6_TCPServer.__init__(self, server_address,
1979
2667
RequestHandlerClass,
1980
interface = interface,
1981
use_ipv6 = use_ipv6)
2668
interface=interface,
2669
use_ipv6=use_ipv6,
2670
socketfd=socketfd)
2671
1982
2672
def server_activate(self):
1983
2673
if self.enabled:
1984
2674
return socketserver.TCPServer.server_activate(self)
1985
2675
1986
2676
def enable(self):
1987
2677
self.enabled = True
1988
2678
1989
2679
def add_pipe(self, parent_pipe, proc):
1990
2680
# Call "handle_ipc" for both data and EOF events
1991
gobject.io_add_watch(parent_pipe.fileno(),
1992
gobject.IO_IN | gobject.IO_HUP,
1993
functools.partial(self.handle_ipc,
1994
parent_pipe =
1995
parent_pipe,
1996
proc = proc))
1997
1998
def handle_ipc(self, source, condition, parent_pipe=None,
1999
proc = None, client_object=None):
2681
GLib.io_add_watch(
2682
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2683
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2684
functools.partial(self.handle_ipc,
2685
parent_pipe=parent_pipe,
2686
proc=proc))
2687
2688
def handle_ipc(self, source, condition,
2689
parent_pipe=None,
2690
proc=None,
2691
client_object=None):
2000
2692
# error, or the other end of multiprocessing.Pipe has closed
2001
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2693
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2002
2694
# Wait for other process to exit
2003
2695
proc.join()
2004
2696
return False
2005
2697
2006
2698
# Read a request from the child
2007
2699
request = parent_pipe.recv()
2008
2700
command = request[0]
2009
2701
2010
2702
if command == 'init':
2011
fpr = request[1]
2012
address = request[2]
2013
2014
for c in self.clients.itervalues():
2015
if c.fingerprint == fpr:
2703
key_id = request[1].decode("ascii")
2704
fpr = request[2].decode("ascii")
2705
address = request[3]
2706
2707
for c in self.clients.values():
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2709
continue
2710
if key_id and c.key_id == key_id:
2711
client = c
2712
break
2713
if fpr and c.fingerprint == fpr:
2016
2714
client = c
2017
2715
break
2018
2716
else:
2019
logger.info("Client not found for fingerprint: %s, ad"
2020
"dress: %s", fpr, address)
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2021
2719
if self.use_dbus:
2022
2720
# Emit D-Bus signal
2023
mandos_dbus_service.ClientNotFound(fpr,
2721
mandos_dbus_service.ClientNotFound(key_id or fpr,
2024
2722
address[0])
2025
2723
parent_pipe.send(False)
2026
2724
return False
2027
2028
gobject.io_add_watch(parent_pipe.fileno(),
2029
gobject.IO_IN | gobject.IO_HUP,
2030
functools.partial(self.handle_ipc,
2031
parent_pipe =
2032
parent_pipe,
2033
proc = proc,
2034
client_object =
2035
client))
2725
2726
GLib.io_add_watch(
2727
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2728
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2729
functools.partial(self.handle_ipc,
2730
parent_pipe=parent_pipe,
2731
proc=proc,
2732
client_object=client))
2036
2733
parent_pipe.send(True)
2037
2734
# remove the old hook in favor of the new above hook on
2038
2735
# same fileno
2041
2738
funcname = request[1]
2042
2739
args = request[2]
2043
2740
kwargs = request[3]
2044
2741
2045
2742
parent_pipe.send(('data', getattr(client_object,
2046
2743
funcname)(*args,
2047
**kwargs)))
2048
2744
**kwargs)))
2745
2049
2746
if command == 'getattr':
2050
2747
attrname = request[1]
2051
if callable(client_object.__getattribute__(attrname)):
2052
parent_pipe.send(('function',))
2748
if isinstance(client_object.__getattribute__(attrname),
2749
collections.Callable):
2750
parent_pipe.send(('function', ))
2053
2751
else:
2054
parent_pipe.send(('data', client_object
2055
.__getattribute__(attrname)))
2056
2752
parent_pipe.send((
2753
'data', client_object.__getattribute__(attrname)))
2754
2057
2755
if command == 'setattr':
2058
2756
attrname = request[1]
2059
2757
value = request[2]
2060
2758
setattr(client_object, attrname, value)
2061
2759
2062
2760
return True
2063
2761
2064
2762
2763
def rfc3339_duration_to_delta(duration):
2764
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2765
2766
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2767
True
2768
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2769
True
2770
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2771
True
2772
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2773
True
2774
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2775
True
2776
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2777
True
2778
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2779
True
2780
"""
2781
2782
# Parsing an RFC 3339 duration with regular expressions is not
2783
# possible - there would have to be multiple places for the same
2784
# values, like seconds. The current code, while more esoteric, is
2785
# cleaner without depending on a parsing library. If Python had a
2786
# built-in library for parsing we would use it, but we'd like to
2787
# avoid excessive use of external libraries.
2788
2789
# New type for defining tokens, syntax, and semantics all-in-one
2790
Token = collections.namedtuple("Token", (
2791
"regexp", # To match token; if "value" is not None, must have
2792
# a "group" containing digits
2793
"value", # datetime.timedelta or None
2794
"followers")) # Tokens valid after this token
2795
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2796
# the "duration" ABNF definition in RFC 3339, Appendix A.
2797
token_end = Token(re.compile(r"$"), None, frozenset())
2798
token_second = Token(re.compile(r"(\d+)S"),
2799
datetime.timedelta(seconds=1),
2800
frozenset((token_end, )))
2801
token_minute = Token(re.compile(r"(\d+)M"),
2802
datetime.timedelta(minutes=1),
2803
frozenset((token_second, token_end)))
2804
token_hour = Token(re.compile(r"(\d+)H"),
2805
datetime.timedelta(hours=1),
2806
frozenset((token_minute, token_end)))
2807
token_time = Token(re.compile(r"T"),
2808
None,
2809
frozenset((token_hour, token_minute,
2810
token_second)))
2811
token_day = Token(re.compile(r"(\d+)D"),
2812
datetime.timedelta(days=1),
2813
frozenset((token_time, token_end)))
2814
token_month = Token(re.compile(r"(\d+)M"),
2815
datetime.timedelta(weeks=4),
2816
frozenset((token_day, token_end)))
2817
token_year = Token(re.compile(r"(\d+)Y"),
2818
datetime.timedelta(weeks=52),
2819
frozenset((token_month, token_end)))
2820
token_week = Token(re.compile(r"(\d+)W"),
2821
datetime.timedelta(weeks=1),
2822
frozenset((token_end, )))
2823
token_duration = Token(re.compile(r"P"), None,
2824
frozenset((token_year, token_month,
2825
token_day, token_time,
2826
token_week)))
2827
# Define starting values:
2828
# Value so far
2829
value = datetime.timedelta()
2830
found_token = None
2831
# Following valid tokens
2832
followers = frozenset((token_duration, ))
2833
# String left to parse
2834
s = duration
2835
# Loop until end token is found
2836
while found_token is not token_end:
2837
# Search for any currently valid tokens
2838
for token in followers:
2839
match = token.regexp.match(s)
2840
if match is not None:
2841
# Token found
2842
if token.value is not None:
2843
# Value found, parse digits
2844
factor = int(match.group(1), 10)
2845
# Add to value so far
2846
value += factor * token.value
2847
# Strip token from string
2848
s = token.regexp.sub("", s, 1)
2849
# Go to found token
2850
found_token = token
2851
# Set valid next tokens
2852
followers = found_token.followers
2853
break
2854
else:
2855
# No currently valid tokens were found
2856
raise ValueError("Invalid RFC 3339 duration: {!r}"
2857
.format(duration))
2858
# End token found
2859
return value
2860
2861
2065
2862
def string_to_delta(interval):
2066
2863
"""Parse a string and return a datetime.timedelta
2067
2068
>>> string_to_delta('7d')
2069
datetime.timedelta(7)
2070
>>> string_to_delta('60s')
2071
datetime.timedelta(0, 60)
2072
>>> string_to_delta('60m')
2073
datetime.timedelta(0, 3600)
2074
>>> string_to_delta('24h')
2075
datetime.timedelta(1)
2076
>>> string_to_delta('1w')
2077
datetime.timedelta(7)
2078
>>> string_to_delta('5m 30s')
2079
datetime.timedelta(0, 330)
2864
2865
>>> string_to_delta('7d') == datetime.timedelta(7)
2866
True
2867
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2868
True
2869
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2870
True
2871
>>> string_to_delta('24h') == datetime.timedelta(1)
2872
True
2873
>>> string_to_delta('1w') == datetime.timedelta(7)
2874
True
2875
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2876
True
2080
2877
"""
2878
2879
try:
2880
return rfc3339_duration_to_delta(interval)
2881
except ValueError:
2882
pass
2883
2081
2884
timevalue = datetime.timedelta(0)
2082
2885
for s in interval.split():
2083
2886
try:
2084
suffix = unicode(s[-1])
2887
suffix = s[-1]
2085
2888
value = int(s[:-1])
2086
2889
if suffix == "d":
2087
2890
delta = datetime.timedelta(value)
2094
2897
elif suffix == "w":
2095
2898
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2096
2899
else:
2097
raise ValueError("Unknown suffix {0!r}"
2098
.format(suffix))
2099
except (ValueError, IndexError) as e:
2900
raise ValueError("Unknown suffix {!r}".format(suffix))
2901
except IndexError as e:
2100
2902
raise ValueError(*(e.args))
2101
2903
timevalue += delta
2102
2904
return timevalue
2103
2905
2104
2906
2105
def daemon(nochdir = False, noclose = False):
2907
def daemon(nochdir=False, noclose=False):
2106
2908
"""See daemon(3). Standard BSD Unix function.
2107
2909
2108
2910
This should really exist as os.daemon, but it doesn't (yet)."""
2109
2911
if os.fork():
2110
2912
sys.exit()
2118
2920
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2119
2921
if not stat.S_ISCHR(os.fstat(null).st_mode):
2120
2922
raise OSError(errno.ENODEV,
2121
"{0} not a character device"
2923
"{} not a character device"
2122
2924
.format(os.devnull))
2123
2925
os.dup2(null, sys.stdin.fileno())
2124
2926
os.dup2(null, sys.stdout.fileno())
2128
2930
2129
2931
2130
2932
def main():
2131
2933
2132
2934
##################################################################
2133
2935
# Parsing of options, both command line and config file
2134
2936
2135
2937
parser = argparse.ArgumentParser()
2136
2938
parser.add_argument("-v", "--version", action="version",
2137
version = "%(prog)s {0}".format(version),
2939
version="%(prog)s {}".format(version),
2138
2940
help="show version number and exit")
2139
2941
parser.add_argument("-i", "--interface", metavar="IF",
2140
2942
help="Bind to interface IF")
2146
2948
help="Run self-test")
2147
2949
parser.add_argument("--debug", action="store_true",
2148
2950
help="Debug mode; run in foreground and log"
2149
" to terminal")
2951
" to terminal", default=None)
2150
2952
parser.add_argument("--debuglevel", metavar="LEVEL",
2151
2953
help="Debug level for stdout output")
2152
2954
parser.add_argument("--priority", help="GnuTLS"
2159
2961
" files")
2160
2962
parser.add_argument("--no-dbus", action="store_false",
2161
2963
dest="use_dbus", help="Do not provide D-Bus"
2162
" system bus interface")
2964
" system bus interface", default=None)
2163
2965
parser.add_argument("--no-ipv6", action="store_false",
2164
dest="use_ipv6", help="Do not use IPv6")
2966
dest="use_ipv6", help="Do not use IPv6",
2967
default=None)
2165
2968
parser.add_argument("--no-restore", action="store_false",
2166
2969
dest="restore", help="Do not restore stored"
2167
" state")
2970
" state", default=None)
2971
parser.add_argument("--socket", type=int,
2972
help="Specify a file descriptor to a network"
2973
" socket to use instead of creating one")
2168
2974
parser.add_argument("--statedir", metavar="DIR",
2169
2975
help="Directory to save/restore state in")
2170
2976
parser.add_argument("--foreground", action="store_true",
2977
help="Run in foreground", default=None)
2978
parser.add_argument("--no-zeroconf", action="store_false",
2979
dest="zeroconf", help="Do not use Zeroconf",
2980
default=None)
2981
2171
2982
options = parser.parse_args()
2172
2173
if options.check:
2174
import doctest
2175
doctest.testmod()
2176
sys.exit()
2177
2983
2178
2984
# Default values for config file for server-global settings
2179
server_defaults = { "interface": "",
2180
"address": "",
2181
"port": "",
2182
"debug": "False",
2183
"priority":
2184
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2185
"servicename": "Mandos",
2186
"use_dbus": "True",
2187
"use_ipv6": "True",
2188
"debuglevel": "",
2189
"restore": "True",
2190
"statedir": "/var/lib/mandos"
2191
}
2192
2985
if gnutls.has_rawpk:
2986
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2987
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2988
else:
2989
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2990
":+SIGN-DSA-SHA256")
2991
server_defaults = {"interface": "",
2992
"address": "",
2993
"port": "",
2994
"debug": "False",
2995
"priority": priority,
2996
"servicename": "Mandos",
2997
"use_dbus": "True",
2998
"use_ipv6": "True",
2999
"debuglevel": "",
3000
"restore": "True",
3001
"socket": "",
3002
"statedir": "/var/lib/mandos",
3003
"foreground": "False",
3004
"zeroconf": "True",
3005
}
3006
del priority
3007
2193
3008
# Parse config file for server-global settings
2194
server_config = configparser.SafeConfigParser(server_defaults)
3009
server_config = configparser.ConfigParser(server_defaults)
2195
3010
del server_defaults
2196
server_config.read(os.path.join(options.configdir,
2197
"mandos.conf"))
2198
# Convert the SafeConfigParser object to a dict
3011
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3012
# Convert the ConfigParser object to a dict
2199
3013
server_settings = server_config.defaults()
2200
3014
# Use the appropriate methods on the non-string config options
2201
for option in ("debug", "use_dbus", "use_ipv6"):
3015
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3016
"foreground", "zeroconf"):
2202
3017
server_settings[option] = server_config.getboolean("DEFAULT",
2203
3018
option)
2204
3019
if server_settings["port"]:
2205
3020
server_settings["port"] = server_config.getint("DEFAULT",
2206
3021
"port")
3022
if server_settings["socket"]:
3023
server_settings["socket"] = server_config.getint("DEFAULT",
3024
"socket")
3025
# Later, stdin will, and stdout and stderr might, be dup'ed
3026
# over with an opened os.devnull. But we don't want this to
3027
# happen with a supplied network socket.
3028
if 0 <= server_settings["socket"] <= 2:
3029
server_settings["socket"] = os.dup(server_settings
3030
["socket"])
2207
3031
del server_config
2208
3032
2209
3033
# Override the settings from the config file with command line
2210
3034
# options, if set.
2211
3035
for option in ("interface", "address", "port", "debug",
2212
"priority", "servicename", "configdir",
2213
"use_dbus", "use_ipv6", "debuglevel", "restore",
2214
"statedir"):
3036
"priority", "servicename", "configdir", "use_dbus",
3037
"use_ipv6", "debuglevel", "restore", "statedir",
3038
"socket", "foreground", "zeroconf"):
2215
3039
value = getattr(options, option)
2216
3040
if value is not None:
2217
3041
server_settings[option] = value
2218
3042
del options
2219
3043
# Force all strings to be unicode
2220
3044
for option in server_settings.keys():
2221
if type(server_settings[option]) is str:
2222
server_settings[option] = unicode(server_settings[option])
3045
if isinstance(server_settings[option], bytes):
3046
server_settings[option] = (server_settings[option]
3047
.decode("utf-8"))
3048
# Force all boolean options to be boolean
3049
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3050
"foreground", "zeroconf"):
3051
server_settings[option] = bool(server_settings[option])
3052
# Debug implies foreground
3053
if server_settings["debug"]:
3054
server_settings["foreground"] = True
2223
3055
# Now we have our good server settings in "server_settings"
2224
3056
2225
3057
##################################################################
2226
3058
3059
if (not server_settings["zeroconf"]
3060
and not (server_settings["port"]
3061
or server_settings["socket"] != "")):
3062
parser.error("Needs port or socket to work without Zeroconf")
3063
2227
3064
# For convenience
2228
3065
debug = server_settings["debug"]
2229
3066
debuglevel = server_settings["debuglevel"]
2231
3068
use_ipv6 = server_settings["use_ipv6"]
2232
3069
stored_state_path = os.path.join(server_settings["statedir"],
2233
3070
stored_state_file)
2234
3071
foreground = server_settings["foreground"]
3072
zeroconf = server_settings["zeroconf"]
3073
2235
3074
if debug:
2236
3075
initlogger(debug, logging.DEBUG)
2237
3076
else:
2240
3079
else:
2241
3080
level = getattr(logging, debuglevel.upper())
2242
3081
initlogger(debug, level)
2243
3082
2244
3083
if server_settings["servicename"] != "Mandos":
2245
syslogger.setFormatter(logging.Formatter
2246
('Mandos ({0}) [%(process)d]:'
2247
' %(levelname)s: %(message)s'
2248
.format(server_settings
2249
["servicename"])))
2250
3084
syslogger.setFormatter(
3085
logging.Formatter('Mandos ({}) [%(process)d]:'
3086
' %(levelname)s: %(message)s'.format(
3087
server_settings["servicename"])))
3088
2251
3089
# Parse config file with clients
2252
client_config = configparser.SafeConfigParser(Client
2253
.client_defaults)
3090
client_config = configparser.ConfigParser(Client.client_defaults)
2254
3091
client_config.read(os.path.join(server_settings["configdir"],
2255
3092
"clients.conf"))
2256
3093
2257
3094
global mandos_dbus_service
2258
3095
mandos_dbus_service = None
2259
2260
tcp_server = MandosServer((server_settings["address"],
2261
server_settings["port"]),
2262
ClientHandler,
2263
interface=(server_settings["interface"]
2264
or None),
2265
use_ipv6=use_ipv6,
2266
gnutls_priority=
2267
server_settings["priority"],
2268
use_dbus=use_dbus)
2269
if not debug:
2270
pidfilename = "/var/run/mandos.pid"
3096
3097
socketfd = None
3098
if server_settings["socket"] != "":
3099
socketfd = server_settings["socket"]
3100
tcp_server = MandosServer(
3101
(server_settings["address"], server_settings["port"]),
3102
ClientHandler,
3103
interface=(server_settings["interface"] or None),
3104
use_ipv6=use_ipv6,
3105
gnutls_priority=server_settings["priority"],
3106
use_dbus=use_dbus,
3107
socketfd=socketfd)
3108
if not foreground:
3109
pidfilename = "/run/mandos.pid"
3110
if not os.path.isdir("/run/."):
3111
pidfilename = "/var/run/mandos.pid"
3112
pidfile = None
2271
3113
try:
2272
pidfile = open(pidfilename, "w")
3114
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2273
3115
except IOError as e:
2274
3116
logger.error("Could not open file %r", pidfilename,
2275
3117
exc_info=e)
2276
2277
for name in ("_mandos", "mandos", "nobody"):
3118
3119
for name, group in (("_mandos", "_mandos"),
3120
("mandos", "mandos"),
3121
("nobody", "nogroup")):
2278
3122
try:
2279
3123
uid = pwd.getpwnam(name).pw_uid
2280
gid = pwd.getpwnam(name).pw_gid
3124
gid = pwd.getpwnam(group).pw_gid
2281
3125
break
2282
3126
except KeyError:
2283
3127
continue
2287
3131
try:
2288
3132
os.setgid(gid)
2289
3133
os.setuid(uid)
3134
if debug:
3135
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3136
gid))
2290
3137
except OSError as error:
3138
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3139
.format(uid, gid, os.strerror(error.errno)))
2291
3140
if error.errno != errno.EPERM:
2292
raise error
2293
3141
raise
3142
2294
3143
if debug:
2295
3144
# Enable all possible GnuTLS debugging
2296
3145
2297
3146
# "Use a log level over 10 to enable all debugging options."
2298
3147
# - GnuTLS manual
2299
gnutls.library.functions.gnutls_global_set_log_level(11)
2300
2301
@gnutls.library.types.gnutls_log_func
3148
gnutls.global_set_log_level(11)
3149
3150
@gnutls.log_func
2302
3151
def debug_gnutls(level, string):
2303
3152
logger.debug("GnuTLS: %s", string[:-1])
2304
2305
(gnutls.library.functions
2306
.gnutls_global_set_log_function(debug_gnutls))
2307
3153
3154
gnutls.global_set_log_function(debug_gnutls)
3155
2308
3156
# Redirect stdin so all checkers get /dev/null
2309
3157
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2310
3158
os.dup2(null, sys.stdin.fileno())
2311
3159
if null > 2:
2312
3160
os.close(null)
2313
3161
2314
3162
# Need to fork before connecting to D-Bus
2315
if not debug:
3163
if not foreground:
2316
3164
# Close all input and output, do double fork, etc.
2317
3165
daemon()
2318
2319
# multiprocessing will use threads, so before we use gobject we
2320
# need to inform gobject that threads will be used.
2321
gobject.threads_init()
2322
3166
3167
if gi.version_info < (3, 10, 2):
3168
# multiprocessing will use threads, so before we use GLib we
3169
# need to inform GLib that threads will be used.
3170
GLib.threads_init()
3171
2323
3172
global main_loop
2324
3173
# From the Avahi example code
2325
3174
DBusGMainLoop(set_as_default=True)
2326
main_loop = gobject.MainLoop()
3175
main_loop = GLib.MainLoop()
2327
3176
bus = dbus.SystemBus()
2328
3177
# End of Avahi example code
2329
3178
if use_dbus:
2330
3179
try:
2331
3180
bus_name = dbus.service.BusName("se.recompile.Mandos",
2332
bus, do_not_queue=True)
2333
old_bus_name = (dbus.service.BusName
2334
("se.bsnet.fukt.Mandos", bus,
2335
do_not_queue=True))
2336
except dbus.exceptions.NameExistsException as e:
3181
bus,
3182
do_not_queue=True)
3183
old_bus_name = dbus.service.BusName(
3184
"se.bsnet.fukt.Mandos", bus,
3185
do_not_queue=True)
3186
except dbus.exceptions.DBusException as e:
2337
3187
logger.error("Disabling D-Bus:", exc_info=e)
2338
3188
use_dbus = False
2339
3189
server_settings["use_dbus"] = False
2340
3190
tcp_server.use_dbus = False
2341
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2342
service = AvahiServiceToSyslog(name =
2343
server_settings["servicename"],
2344
servicetype = "_mandos._tcp",
2345
protocol = protocol, bus = bus)
2346
if server_settings["interface"]:
2347
service.interface = (if_nametoindex
2348
(str(server_settings["interface"])))
2349
3191
if zeroconf:
3192
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
3196
protocol=protocol,
3197
bus=bus)
3198
if server_settings["interface"]:
3199
service.interface = if_nametoindex(
3200
server_settings["interface"].encode("utf-8"))
3201
2350
3202
global multiprocessing_manager
2351
3203
multiprocessing_manager = multiprocessing.Manager()
2352
3204
2353
3205
client_class = Client
2354
3206
if use_dbus:
2355
client_class = functools.partial(ClientDBus, bus = bus)
2356
3207
client_class = functools.partial(ClientDBus, bus=bus)
3208
2357
3209
client_settings = Client.config_parser(client_config)
2358
3210
old_client_settings = {}
2359
3211
clients_data = {}
2360
3212
3213
# This is used to redirect stdout and stderr for checker processes
3214
global wnull
3215
wnull = open(os.devnull, "w") # A writable /dev/null
3216
# Only used if server is running in foreground but not in debug
3217
# mode
3218
if debug or not foreground:
3219
wnull.close()
3220
2361
3221
# Get client data and settings from last running state.
2362
3222
if server_settings["restore"]:
2363
3223
try:
2364
3224
with open(stored_state_path, "rb") as stored_state:
2365
clients_data, old_client_settings = (pickle.load
2366
(stored_state))
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3227
stored_state)
3228
else:
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3232
# clients_data
3233
# .keys()
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3236
else key): value
3237
for key, value in
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3243
for k, v in
3244
clients_data[key].items()}
3245
clients_data[key] = value
3246
# .client_structure
3247
value["client_structure"] = [
3248
(s.decode("utf-8")
3249
if isinstance(s, bytes)
3250
else s) for s in
3251
value["client_structure"]]
3252
# .name, .host, and .checker_command
3253
for k in ("name", "host", "checker_command"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if "key_id" not in value:
3257
value["key_id"] = ""
3258
elif "fingerprint" not in value:
3259
value["fingerprint"] = ""
3260
# old_client_settings
3261
# .keys()
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3265
else key): value
3266
for key, value in
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3269
# .host and .checker_command
3270
for value in old_client_settings.values():
3271
for attribute in ("host", "checker_command"):
3272
if isinstance(value[attribute], bytes):
3273
value[attribute] = (value[attribute]
3274
.decode("utf-8"))
2367
3275
os.remove(stored_state_path)
2368
3276
except IOError as e:
2369
3277
if e.errno == errno.ENOENT:
2370
logger.warning("Could not load persistent state: {0}"
2371
.format(os.strerror(e.errno)))
3278
logger.warning("Could not load persistent state:"
3279
" {}".format(os.strerror(e.errno)))
2372
3280
else:
2373
3281
logger.critical("Could not load persistent state:",
2374
3282
exc_info=e)
2375
3283
raise
2376
3284
except EOFError as e:
2377
3285
logger.warning("Could not load persistent state: "
2378
"EOFError:", exc_info=e)
2379
3286
"EOFError:",
3287
exc_info=e)
3288
2380
3289
with PGPEngine() as pgp:
2381
for client_name, client in clients_data.iteritems():
3290
for client_name, client in clients_data.items():
3291
# Skip removed clients
3292
if client_name not in client_settings:
3293
continue
3294
2382
3295
# Decide which value to use after restoring saved state.
2383
3296
# We have three different values: Old config file,
2384
3297
# new config file, and saved state.
2389
3302
# For each value in new config, check if it
2390
3303
# differs from the old config value (Except for
2391
3304
# the "secret" attribute)
2392
if (name != "secret" and
2393
value != old_client_settings[client_name]
2394
[name]):
3305
if (name != "secret"
3306
and (value !=
3307
old_client_settings[client_name][name])):
2395
3308
client[name] = value
2396
3309
except KeyError:
2397
3310
pass
2398
3311
2399
3312
# Clients who has passed its expire date can still be
2400
# enabled if its last checker was successful. Clients
3313
# enabled if its last checker was successful. A Client
2401
3314
# whose checker succeeded before we stored its state is
2402
3315
# assumed to have successfully run all checkers during
2403
3316
# downtime.
2405
3318
if datetime.datetime.utcnow() >= client["expires"]:
2406
3319
if not client["last_checked_ok"]:
2407
3320
logger.warning(
2408
"disabling client {0} - Client never "
2409
"performed a successful checker"
2410
.format(client_name))
3321
"disabling client {} - Client never "
3322
"performed a successful checker".format(
3323
client_name))
2411
3324
client["enabled"] = False
2412
3325
elif client["last_checker_status"] != 0:
2413
3326
logger.warning(
2414
"disabling client {0} - Client "
2415
"last checker failed with error code {1}"
2416
.format(client_name,
2417
client["last_checker_status"]))
3327
"disabling client {} - Client last"
3328
" checker failed with error code"
3329
" {}".format(
3330
client_name,
3331
client["last_checker_status"]))
2418
3332
client["enabled"] = False
2419
3333
else:
2420
client["expires"] = (datetime.datetime
2421
.utcnow()
2422
+ client["timeout"])
3334
client["expires"] = (
3335
datetime.datetime.utcnow()
3336
+ client["timeout"])
2423
3337
logger.debug("Last checker succeeded,"
2424
" keeping {0} enabled"
2425
.format(client_name))
3338
" keeping {} enabled".format(
3339
client_name))
2426
3340
try:
2427
client["secret"] = (
2428
pgp.decrypt(client["encrypted_secret"],
2429
client_settings[client_name]
2430
["secret"]))
3341
client["secret"] = pgp.decrypt(
3342
client["encrypted_secret"],
3343
client_settings[client_name]["secret"])
2431
3344
except PGPError:
2432
3345
# If decryption fails, we use secret from new settings
2433
logger.debug("Failed to decrypt {0} old secret"
2434
.format(client_name))
2435
client["secret"] = (
2436
client_settings[client_name]["secret"])
2437
3346
logger.debug("Failed to decrypt {} old secret".format(
3347
client_name))
3348
client["secret"] = (client_settings[client_name]
3349
["secret"])
3350
2438
3351
# Add/remove clients based on new changes made to config
2439
3352
for client_name in (set(old_client_settings)
2440
3353
- set(client_settings)):
2442
3355
for client_name in (set(client_settings)
2443
3356
- set(old_client_settings)):
2444
3357
clients_data[client_name] = client_settings[client_name]
2445
3358
2446
3359
# Create all client objects
2447
for client_name, client in clients_data.iteritems():
3360
for client_name, client in clients_data.items():
2448
3361
tcp_server.clients[client_name] = client_class(
2449
name = client_name, settings = client)
2450
3362
name=client_name,
3363
settings=client,
3364
server_settings=server_settings)
3365
2451
3366
if not tcp_server.clients:
2452
3367
logger.warning("No clients defined")
2453
2454
if not debug:
2455
try:
2456
with pidfile:
2457
pid = os.getpid()
2458
pidfile.write(str(pid) + "\n".encode("utf-8"))
2459
del pidfile
2460
except IOError:
2461
logger.error("Could not write to file %r with PID %d",
2462
pidfilename, pid)
2463
except NameError:
2464
# "pidfile" was never created
2465
pass
3368
3369
if not foreground:
3370
if pidfile is not None:
3371
pid = os.getpid()
3372
try:
3373
with pidfile:
3374
print(pid, file=pidfile)
3375
except IOError:
3376
logger.error("Could not write to file %r with PID %d",
3377
pidfilename, pid)
3378
del pidfile
2466
3379
del pidfilename
2467
2468
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2469
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2470
3380
3381
for termsig in (signal.SIGHUP, signal.SIGTERM):
3382
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3383
lambda: main_loop.quit() and False)
3384
2471
3385
if use_dbus:
2472
@alternate_dbus_interfaces({"se.recompile.Mandos":
2473
"se.bsnet.fukt.Mandos"})
2474
class MandosDBusService(DBusObjectWithProperties):
3386
3387
@alternate_dbus_interfaces(
3388
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3389
class MandosDBusService(DBusObjectWithObjectManager):
2475
3390
"""A D-Bus proxy object"""
3391
2476
3392
def __init__(self):
2477
3393
dbus.service.Object.__init__(self, bus, "/")
3394
2478
3395
_interface = "se.recompile.Mandos"
2479
2480
@dbus_interface_annotations(_interface)
2481
def _foo(self):
2482
return { "org.freedesktop.DBus.Property"
2483
".EmitsChangedSignal":
2484
"false"}
2485
3396
2486
3397
@dbus.service.signal(_interface, signature="o")
2487
3398
def ClientAdded(self, objpath):
2488
3399
"D-Bus signal"
2489
3400
pass
2490
3401
2491
3402
@dbus.service.signal(_interface, signature="ss")
2492
def ClientNotFound(self, fingerprint, address):
3403
def ClientNotFound(self, key_id, address):
2493
3404
"D-Bus signal"
2494
3405
pass
2495
3406
3407
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3408
"true"})
2496
3409
@dbus.service.signal(_interface, signature="os")
2497
3410
def ClientRemoved(self, objpath, name):
2498
3411
"D-Bus signal"
2499
3412
pass
2500
3413
3414
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3415
"true"})
2501
3416
@dbus.service.method(_interface, out_signature="ao")
2502
3417
def GetAllClients(self):
2503
3418
"D-Bus method"
2504
return dbus.Array(c.dbus_object_path
2505
for c in
2506
tcp_server.clients.itervalues())
2507
3419
return dbus.Array(c.dbus_object_path for c in
3420
tcp_server.clients.values())
3421
3422
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3423
"true"})
2508
3424
@dbus.service.method(_interface,
2509
3425
out_signature="a{oa{sv}}")
2510
3426
def GetAllClientsWithProperties(self):
2511
3427
"D-Bus method"
2512
3428
return dbus.Dictionary(
2513
((c.dbus_object_path, c.GetAll(""))
2514
for c in tcp_server.clients.itervalues()),
3429
{c.dbus_object_path: c.GetAll(
3430
"se.recompile.Mandos.Client")
3431
for c in tcp_server.clients.values()},
2515
3432
signature="oa{sv}")
2516
3433
2517
3434
@dbus.service.method(_interface, in_signature="o")
2518
3435
def RemoveClient(self, object_path):
2519
3436
"D-Bus method"
2520
for c in tcp_server.clients.itervalues():
3437
for c in tcp_server.clients.values():
2521
3438
if c.dbus_object_path == object_path:
2522
3439
del tcp_server.clients[c.name]
2523
3440
c.remove_from_connection()
2524
# Don't signal anything except ClientRemoved
3441
# Don't signal the disabling
2525
3442
c.disable(quiet=True)
2526
# Emit D-Bus signal
2527
self.ClientRemoved(object_path, c.name)
3443
# Emit D-Bus signal for removal
3444
self.client_removed_signal(c)
2528
3445
return
2529
3446
raise KeyError(object_path)
2530
3447
2531
3448
del _interface
2532
3449
3450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3451
out_signature="a{oa{sa{sv}}}")
3452
def GetManagedObjects(self):
3453
"""D-Bus method"""
3454
return dbus.Dictionary(
3455
{client.dbus_object_path:
3456
dbus.Dictionary(
3457
{interface: client.GetAll(interface)
3458
for interface in
3459
client._get_all_interface_names()})
3460
for client in tcp_server.clients.values()})
3461
3462
def client_added_signal(self, client):
3463
"""Send the new standard signal and the old signal"""
3464
if use_dbus:
3465
# New standard signal
3466
self.InterfacesAdded(
3467
client.dbus_object_path,
3468
dbus.Dictionary(
3469
{interface: client.GetAll(interface)
3470
for interface in
3471
client._get_all_interface_names()}))
3472
# Old signal
3473
self.ClientAdded(client.dbus_object_path)
3474
3475
def client_removed_signal(self, client):
3476
"""Send the new standard signal and the old signal"""
3477
if use_dbus:
3478
# New standard signal
3479
self.InterfacesRemoved(
3480
client.dbus_object_path,
3481
client._get_all_interface_names())
3482
# Old signal
3483
self.ClientRemoved(client.dbus_object_path,
3484
client.name)
3485
2533
3486
mandos_dbus_service = MandosDBusService()
2534
3487
3488
# Save modules to variables to exempt the modules from being
3489
# unloaded before the function registered with atexit() is run.
3490
mp = multiprocessing
3491
wn = wnull
3492
2535
3493
def cleanup():
2536
3494
"Cleanup function; run on exit"
2537
service.cleanup()
2538
2539
multiprocessing.active_children()
3495
if zeroconf:
3496
service.cleanup()
3497
3498
mp.active_children()
3499
wn.close()
2540
3500
if not (tcp_server.clients or client_settings):
2541
3501
return
2542
3502
2543
3503
# Store client before exiting. Secrets are encrypted with key
2544
3504
# based on what config file has. If config file is
2545
3505
# removed/edited, old secret will thus be unrecovable.
2546
3506
clients = {}
2547
3507
with PGPEngine() as pgp:
2548
for client in tcp_server.clients.itervalues():
3508
for client in tcp_server.clients.values():
2549
3509
key = client_settings[client.name]["secret"]
2550
3510
client.encrypted_secret = pgp.encrypt(client.secret,
2551
3511
key)
2552
3512
client_dict = {}
2553
3513
2554
3514
# A list of attributes that can not be pickled
2555
3515
# + secret.
2556
exclude = set(("bus", "changedstate", "secret",
2557
"checker"))
2558
for name, typ in (inspect.getmembers
2559
(dbus.service.Object)):
3516
exclude = {"bus", "changedstate", "secret",
3517
"checker", "server_settings"}
3518
for name, typ in inspect.getmembers(dbus.service
3519
.Object):
2560
3520
exclude.add(name)
2561
3521
2562
3522
client_dict["encrypted_secret"] = (client
2563
3523
.encrypted_secret)
2564
3524
for attr in client.client_structure:
2565
3525
if attr not in exclude:
2566
3526
client_dict[attr] = getattr(client, attr)
2567
3527
2568
3528
clients[client.name] = client_dict
2569
3529
del client_settings[client.name]["secret"]
2570
3530
2571
3531
try:
2572
with (tempfile.NamedTemporaryFile
2573
(mode='wb', suffix=".pickle", prefix='clients-',
2574
dir=os.path.dirname(stored_state_path),
2575
delete=False)) as stored_state:
2576
pickle.dump((clients, client_settings), stored_state)
2577
tempname=stored_state.name
3532
with tempfile.NamedTemporaryFile(
3533
mode='wb',
3534
suffix=".pickle",
3535
prefix='clients-',
3536
dir=os.path.dirname(stored_state_path),
3537
delete=False) as stored_state:
3538
pickle.dump((clients, client_settings), stored_state,
3539
protocol=2)
3540
tempname = stored_state.name
2578
3541
os.rename(tempname, stored_state_path)
2579
3542
except (IOError, OSError) as e:
2580
3543
if not debug:
2583
3546
except NameError:
2584
3547
pass
2585
3548
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2586
logger.warning("Could not save persistent state: {0}"
3549
logger.warning("Could not save persistent state: {}"
2587
3550
.format(os.strerror(e.errno)))
2588
3551
else:
2589
3552
logger.warning("Could not save persistent state:",
2590
3553
exc_info=e)
2591
raise e
2592
3554
raise
3555
2593
3556
# Delete all clients, and settings from config
2594
3557
while tcp_server.clients:
2595
3558
name, client = tcp_server.clients.popitem()
2596
3559
if use_dbus:
2597
3560
client.remove_from_connection()
2598
# Don't signal anything except ClientRemoved
3561
# Don't signal the disabling
2599
3562
client.disable(quiet=True)
3563
# Emit D-Bus signal for removal
2600
3564
if use_dbus:
2601
# Emit D-Bus signal
2602
mandos_dbus_service.ClientRemoved(client
2603
.dbus_object_path,
2604
client.name)
3565
mandos_dbus_service.client_removed_signal(client)
2605
3566
client_settings.clear()
2606
3567
2607
3568
atexit.register(cleanup)
2608
2609
for client in tcp_server.clients.itervalues():
3569
3570
for client in tcp_server.clients.values():
2610
3571
if use_dbus:
2611
# Emit D-Bus signal
2612
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3572
# Emit D-Bus signal for adding
3573
mandos_dbus_service.client_added_signal(client)
2613
3574
# Need to initiate checking of clients
2614
3575
if client.enabled:
2615
3576
client.init_checker()
2616
3577
2617
3578
tcp_server.enable()
2618
3579
tcp_server.server_activate()
2619
3580
2620
3581
# Find out what port we got
2621
service.port = tcp_server.socket.getsockname()[1]
3582
if zeroconf:
3583
service.port = tcp_server.socket.getsockname()[1]
2622
3584
if use_ipv6:
2623
3585
logger.info("Now listening on address %r, port %d,"
2624
3586
" flowinfo %d, scope_id %d",
2626
3588
else: # IPv4
2627
3589
logger.info("Now listening on address %r, port %d",
2628
3590
*tcp_server.socket.getsockname())
2629
2630
#service.interface = tcp_server.socket.getsockname()[3]
2631
3591
3592
# service.interface = tcp_server.socket.getsockname()[3]
3593
2632
3594
try:
2633
# From the Avahi example code
2634
try:
2635
service.activate()
2636
except dbus.exceptions.DBusException as error:
2637
logger.critical("D-Bus Exception", exc_info=error)
2638
cleanup()
2639
sys.exit(1)
2640
# End of Avahi example code
2641
2642
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2643
lambda *args, **kwargs:
2644
(tcp_server.handle_request
2645
(*args[2:], **kwargs) or True))
2646
3595
if zeroconf:
3596
# From the Avahi example code
3597
try:
3598
service.activate()
3599
except dbus.exceptions.DBusException as error:
3600
logger.critical("D-Bus Exception", exc_info=error)
3601
cleanup()
3602
sys.exit(1)
3603
# End of Avahi example code
3604
3605
GLib.io_add_watch(
3606
GLib.IOChannel.unix_new(tcp_server.fileno()),
3607
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3608
lambda *args, **kwargs: (tcp_server.handle_request
3609
(*args[2:], **kwargs) or True))
3610
2647
3611
logger.debug("Starting main loop")
2648
3612
main_loop.run()
2649
3613
except AvahiError as error:
2658
3622
# Must run before the D-Bus bus name gets deregistered
2659
3623
cleanup()
2660
3624
3625
3626
def should_only_run_tests():
3627
parser = argparse.ArgumentParser(add_help=False)
3628
parser.add_argument("--check", action='store_true')
3629
args, unknown_args = parser.parse_known_args()
3630
run_tests = args.check
3631
if run_tests:
3632
# Remove --check argument from sys.argv
3633
sys.argv[1:] = unknown_args
3634
return run_tests
3635
3636
# Add all tests from doctest strings
3637
def load_tests(loader, tests, none):
3638
import doctest
3639
tests.addTests(doctest.DocTestSuite())
3640
return tests
3641
2661
3642
if __name__ == '__main__':
2662
main()
3643
try:
3644
if should_only_run_tests():
3645
# Call using ./mandos --check [--verbose]
3646
unittest.main()
3647
else:
3648
main()
3649
finally:
3650
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0