To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1214
- compare with another revision
- download diff
- download tarball
- view history from revision 1214
- Committer: teddy at recompile
- Date: 2020-04-08 19:15:13 UTC
- mfrom: (237.4.130 release)
- Revision ID: teddy@recompile.se-20200408191513-n0ke303478rw1g0b
Merge from release branch
- files added:
- bugs.xml
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
73
77
import itertools
74
78
import collections
75
79
import codecs
80
import unittest
81
import random
82
import shlex
76
83
77
84
import dbus
78
85
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
86
import gi
87
from gi.repository import GLib
84
88
from dbus.mainloop.glib import DBusGMainLoop
85
89
import ctypes
86
90
import ctypes.util
87
91
import xml.dom.minidom
88
92
import inspect
89
93
90
try:
94
if sys.version_info.major == 2:
95
__metaclass__ = type
96
str = unicode
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
91
122
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
123
except AttributeError:
93
124
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
94
127
from IN import SO_BINDTODEVICE
95
128
except ImportError:
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.11"
102
147
stored_state_file = "clients.pickle"
103
148
104
149
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
105
151
syslogger = None
106
152
107
153
try:
108
154
if_nametoindex = ctypes.cdll.LoadLibrary(
109
155
ctypes.util.find_library("c")).if_nametoindex
110
156
except (OSError, AttributeError):
111
157
112
158
def if_nametoindex(interface):
113
159
"Get an interface index the hard way, i.e. using fcntl()"
114
160
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
165
return interface_index
120
166
121
167
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
122
184
def initlogger(debug, level=logging.WARNING):
123
185
"""init logger and add loglevel"""
124
186
125
187
global syslogger
126
188
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
129
191
syslogger.setFormatter(logging.Formatter
130
192
('Mandos [%(process)d]: %(levelname)s:'
131
193
' %(message)s'))
132
194
logger.addHandler(syslogger)
133
195
134
196
if debug:
135
197
console = logging.StreamHandler()
136
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
208
pass
147
209
148
210
149
class PGPEngine(object):
211
class PGPEngine:
150
212
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
213
152
214
def __init__(self):
153
215
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
216
self.gpg = "gpg"
217
try:
218
output = subprocess.check_output(["gpgconf"])
219
for line in output.splitlines():
220
name, text, path = line.split(b":")
221
if name == b"gpg":
222
self.gpg = path
223
break
224
except OSError as e:
225
if e.errno != errno.ENOENT:
226
raise
154
227
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
228
'--homedir', self.tempdir,
156
229
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
230
'--quiet']
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
160
235
def __enter__(self):
161
236
return self
162
237
163
238
def __exit__(self, exc_type, exc_value, traceback):
164
239
self._cleanup()
165
240
return False
166
241
167
242
def __del__(self):
168
243
self._cleanup()
169
244
170
245
def _cleanup(self):
171
246
if self.tempdir is not None:
172
247
# Delete contents of tempdir
173
248
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
249
topdown=False):
175
250
for filename in files:
176
251
os.remove(os.path.join(root, filename))
177
252
for dirname in dirs:
179
254
# Remove tempdir
180
255
os.rmdir(self.tempdir)
181
256
self.tempdir = None
182
257
183
258
def password_encode(self, password):
184
259
# Passphrase can not be empty and can not contain newlines or
185
260
# NUL bytes. So we prefix it and hex encode it.
190
265
.replace(b"\n", b"\\n")
191
266
.replace(b"\0", b"\\x00"))
192
267
return encoded
193
268
194
269
def encrypt(self, data, password):
195
270
passphrase = self.password_encode(password)
196
271
with tempfile.NamedTemporaryFile(
197
272
dir=self.tempdir) as passfile:
198
273
passfile.write(passphrase)
199
274
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
275
proc = subprocess.Popen([self.gpg, '--symmetric',
201
276
'--passphrase-file',
202
277
passfile.name]
203
278
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
208
283
if proc.returncode != 0:
209
284
raise PGPError(err)
210
285
return ciphertext
211
286
212
287
def decrypt(self, data, password):
213
288
passphrase = self.password_encode(password)
214
289
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
290
dir=self.tempdir) as passfile:
216
291
passfile.write(passphrase)
217
292
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
293
proc = subprocess.Popen([self.gpg, '--decrypt',
219
294
'--passphrase-file',
220
295
passfile.name]
221
296
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
226
301
if proc.returncode != 0:
227
302
raise PGPError(err)
228
303
return decrypted_plaintext
229
304
230
305
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
231
332
class AvahiError(Exception):
232
333
def __init__(self, value, *args, **kwargs):
233
334
self.value = value
243
344
pass
244
345
245
346
246
class AvahiService(object):
347
class AvahiService:
247
348
"""An Avahi (Zeroconf) service.
248
349
249
350
Attributes:
250
351
interface: integer; avahi.IF_UNSPEC or an interface index.
251
352
Used to optionally bind to the specified interface.
263
364
server: D-Bus Server
264
365
bus: dbus.SystemBus()
265
366
"""
266
367
267
368
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
278
379
self.interface = interface
279
380
self.name = name
280
381
self.type = servicetype
289
390
self.server = None
290
391
self.bus = bus
291
392
self.entry_group_state_changed_match = None
292
393
293
394
def rename(self, remove=True):
294
395
"""Derived from the Avahi example code"""
295
396
if self.rename_count >= self.max_renames:
315
416
logger.critical("D-Bus Exception", exc_info=error)
316
417
self.cleanup()
317
418
os._exit(1)
318
419
319
420
def remove(self):
320
421
"""Derived from the Avahi example code"""
321
422
if self.entry_group_state_changed_match is not None:
323
424
self.entry_group_state_changed_match = None
324
425
if self.group is not None:
325
426
self.group.Reset()
326
427
327
428
def add(self):
328
429
"""Derived from the Avahi example code"""
329
430
self.remove()
346
447
dbus.UInt16(self.port),
347
448
avahi.string_array_to_txt_array(self.TXT))
348
449
self.group.Commit()
349
450
350
451
def entry_group_state_changed(self, state, error):
351
452
"""Derived from the Avahi example code"""
352
453
logger.debug("Avahi entry group state change: %i", state)
353
454
354
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
456
logger.debug("Zeroconf service established.")
356
457
elif state == avahi.ENTRY_GROUP_COLLISION:
360
461
logger.critical("Avahi: Error in group state changed %s",
361
462
str(error))
362
463
raise AvahiGroupError("State changed: {!s}".format(error))
363
464
364
465
def cleanup(self):
365
466
"""Derived from the Avahi example code"""
366
467
if self.group is not None:
371
472
pass
372
473
self.group = None
373
474
self.remove()
374
475
375
476
def server_state_changed(self, state, error=None):
376
477
"""Derived from the Avahi example code"""
377
478
logger.debug("Avahi server state change: %i", state)
406
507
logger.debug("Unknown state: %r", state)
407
508
else:
408
509
logger.debug("Unknown state: %r: %r", state, error)
409
510
410
511
def activate(self):
411
512
"""Derived from the Avahi example code"""
412
513
if self.server is None:
423
524
class AvahiServiceToSyslog(AvahiService):
424
525
def rename(self, *args, **kwargs):
425
526
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
527
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
427
528
syslogger.setFormatter(logging.Formatter(
428
529
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
530
.format(self.name)))
430
531
return ret
431
532
533
432
534
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
537
538
library = ctypes.util.find_library("gnutls")
539
if library is None:
540
library = ctypes.util.find_library("gnutls-deb0")
541
_library = ctypes.cdll.LoadLibrary(library)
542
del library
543
448
544
# Unless otherwise indicated, the constants and types below are
449
545
# all from the gnutls/gnutls.h C header file.
450
546
451
547
# Constants
452
548
E_SUCCESS = 0
453
549
E_INTERRUPTED = -52
454
550
E_AGAIN = -28
455
551
CRT_OPENPGP = 2
552
CRT_RAWPK = 3
456
553
CLIENT = 2
457
554
SHUT_RDWR = 0
458
555
CRD_CERTIFICATE = 1
459
556
E_NO_CERTIFICATE_FOUND = -49
557
X509_FMT_DER = 0
558
NO_TICKETS = 1<<10
559
ENABLE_RAWPK = 1<<18
560
CTYPE_PEERS = 3
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
460
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
563
462
564
# Types
463
565
class session_int(ctypes.Structure):
464
566
_fields_ = []
465
567
session_t = ctypes.POINTER(session_int)
568
466
569
class certificate_credentials_st(ctypes.Structure):
467
570
_fields_ = []
468
571
certificate_credentials_t = ctypes.POINTER(
469
572
certificate_credentials_st)
470
573
certificate_type_t = ctypes.c_int
574
471
575
class datum_t(ctypes.Structure):
472
576
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
577
('size', ctypes.c_uint)]
578
474
579
class openpgp_crt_int(ctypes.Structure):
475
580
_fields_ = []
476
581
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
584
credentials_type_t = ctypes.c_int
480
585
transport_ptr_t = ctypes.c_void_p
481
586
close_request_t = ctypes.c_int
482
587
483
588
# Exceptions
484
589
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
590
def __init__(self, message=None, code=None, args=()):
490
591
# Default usage is by a message string, but if a return
491
592
# code is passed, convert it to a string with
492
593
# gnutls.strerror()
493
594
self.code = code
494
595
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
596
message = gnutls.strerror(code)
597
return super(gnutls.Error, self).__init__(
497
598
message, *args)
498
599
499
600
class CertificateSecurityError(Error):
500
601
pass
501
602
502
603
# Classes
503
class Credentials(object):
604
class Credentials:
504
605
def __init__(self):
505
606
self._c_object = gnutls.certificate_credentials_t()
506
607
gnutls.certificate_allocate_credentials(
507
608
ctypes.byref(self._c_object))
508
609
self.type = gnutls.CRD_CERTIFICATE
509
610
510
611
def __del__(self):
511
612
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
613
614
class ClientSession:
615
def __init__(self, socket, credentials=None):
515
616
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
617
gnutls_flags = gnutls.CLIENT
618
if gnutls.check_version(b"3.5.6"):
619
gnutls_flags |= gnutls.NO_TICKETS
620
if gnutls.has_rawpk:
621
gnutls_flags |= gnutls.ENABLE_RAWPK
622
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
623
del gnutls_flags
517
624
gnutls.set_default_priority(self._c_object)
518
625
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
626
gnutls.handshake_set_private_extensions(self._c_object,
525
632
ctypes.cast(credentials._c_object,
526
633
ctypes.c_void_p))
527
634
self.credentials = credentials
528
635
529
636
def __del__(self):
530
637
gnutls.deinit(self._c_object)
531
638
532
639
def handshake(self):
533
640
return gnutls.handshake(self._c_object)
534
641
535
642
def send(self, data):
536
643
data = bytes(data)
537
644
data_len = len(data)
539
646
data_len -= gnutls.record_send(self._c_object,
540
647
data[-data_len:],
541
648
data_len)
542
649
543
650
def bye(self):
544
651
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
652
546
653
# Error handling functions
547
654
def _error_code(result):
548
655
"""A function to raise exceptions on errors, suitable
550
657
if result >= 0:
551
658
return result
552
659
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
660
raise gnutls.CertificateSecurityError(code=result)
661
raise gnutls.Error(code=result)
662
556
663
def _retry_on_error(result, func, arguments):
557
664
"""A function to retry on some errors, suitable
558
665
for the 'errcheck' attribute on ctypes functions"""
561
668
return _error_code(result)
562
669
result = func(*arguments)
563
670
return result
564
671
565
672
# Unless otherwise indicated, the function declarations below are
566
673
# all from the gnutls/gnutls.h C header file.
567
674
568
675
# Functions
569
676
priority_set_direct = _library.gnutls_priority_set_direct
570
677
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
678
ctypes.POINTER(ctypes.c_char_p)]
572
679
priority_set_direct.restype = _error_code
573
680
574
681
init = _library.gnutls_init
575
682
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
683
init.restype = _error_code
577
684
578
685
set_default_priority = _library.gnutls_set_default_priority
579
686
set_default_priority.argtypes = [session_t]
580
687
set_default_priority.restype = _error_code
581
688
582
689
record_send = _library.gnutls_record_send
583
690
record_send.argtypes = [session_t, ctypes.c_void_p,
584
691
ctypes.c_size_t]
585
692
record_send.restype = ctypes.c_ssize_t
586
693
record_send.errcheck = _retry_on_error
587
694
588
695
certificate_allocate_credentials = (
589
696
_library.gnutls_certificate_allocate_credentials)
590
697
certificate_allocate_credentials.argtypes = [
591
698
ctypes.POINTER(certificate_credentials_t)]
592
699
certificate_allocate_credentials.restype = _error_code
593
700
594
701
certificate_free_credentials = (
595
702
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
703
certificate_free_credentials.argtypes = [
704
certificate_credentials_t]
597
705
certificate_free_credentials.restype = None
598
706
599
707
handshake_set_private_extensions = (
600
708
_library.gnutls_handshake_set_private_extensions)
601
709
handshake_set_private_extensions.argtypes = [session_t,
602
710
ctypes.c_int]
603
711
handshake_set_private_extensions.restype = None
604
712
605
713
credentials_set = _library.gnutls_credentials_set
606
714
credentials_set.argtypes = [session_t, credentials_type_t,
607
715
ctypes.c_void_p]
608
716
credentials_set.restype = _error_code
609
717
610
718
strerror = _library.gnutls_strerror
611
719
strerror.argtypes = [ctypes.c_int]
612
720
strerror.restype = ctypes.c_char_p
613
721
614
722
certificate_type_get = _library.gnutls_certificate_type_get
615
723
certificate_type_get.argtypes = [session_t]
616
724
certificate_type_get.restype = _error_code
617
725
618
726
certificate_get_peers = _library.gnutls_certificate_get_peers
619
727
certificate_get_peers.argtypes = [session_t,
620
728
ctypes.POINTER(ctypes.c_uint)]
621
729
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
730
623
731
global_set_log_level = _library.gnutls_global_set_log_level
624
732
global_set_log_level.argtypes = [ctypes.c_int]
625
733
global_set_log_level.restype = None
626
734
627
735
global_set_log_function = _library.gnutls_global_set_log_function
628
736
global_set_log_function.argtypes = [log_func]
629
737
global_set_log_function.restype = None
630
738
631
739
deinit = _library.gnutls_deinit
632
740
deinit.argtypes = [session_t]
633
741
deinit.restype = None
634
742
635
743
handshake = _library.gnutls_handshake
636
744
handshake.argtypes = [session_t]
637
745
handshake.restype = _error_code
638
746
handshake.errcheck = _retry_on_error
639
747
640
748
transport_set_ptr = _library.gnutls_transport_set_ptr
641
749
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
750
transport_set_ptr.restype = None
643
751
644
752
bye = _library.gnutls_bye
645
753
bye.argtypes = [session_t, close_request_t]
646
754
bye.restype = _error_code
647
755
bye.errcheck = _retry_on_error
648
756
649
757
check_version = _library.gnutls_check_version
650
758
check_version.argtypes = [ctypes.c_char_p]
651
759
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
760
761
_need_version = b"3.3.0"
762
if check_version(_need_version) is None:
763
raise self.Error("Needs GnuTLS {} or later"
764
.format(_need_version))
765
766
_tls_rawpk_version = b"3.6.6"
767
has_rawpk = bool(check_version(_tls_rawpk_version))
768
769
if has_rawpk:
770
# Types
771
class pubkey_st(ctypes.Structure):
772
_fields = []
773
pubkey_t = ctypes.POINTER(pubkey_st)
774
775
x509_crt_fmt_t = ctypes.c_int
776
777
# All the function declarations below are from gnutls/abstract.h
778
pubkey_init = _library.gnutls_pubkey_init
779
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
780
pubkey_init.restype = _error_code
781
782
pubkey_import = _library.gnutls_pubkey_import
783
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
784
x509_crt_fmt_t]
785
pubkey_import.restype = _error_code
786
787
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
788
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
789
ctypes.POINTER(ctypes.c_ubyte),
790
ctypes.POINTER(ctypes.c_size_t)]
791
pubkey_get_key_id.restype = _error_code
792
793
pubkey_deinit = _library.gnutls_pubkey_deinit
794
pubkey_deinit.argtypes = [pubkey_t]
795
pubkey_deinit.restype = None
796
else:
797
# All the function declarations below are from gnutls/openpgp.h
798
799
openpgp_crt_init = _library.gnutls_openpgp_crt_init
800
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
801
openpgp_crt_init.restype = _error_code
802
803
openpgp_crt_import = _library.gnutls_openpgp_crt_import
804
openpgp_crt_import.argtypes = [openpgp_crt_t,
805
ctypes.POINTER(datum_t),
806
openpgp_crt_fmt_t]
807
openpgp_crt_import.restype = _error_code
808
809
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
810
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
811
ctypes.POINTER(ctypes.c_uint)]
812
openpgp_crt_verify_self.restype = _error_code
813
814
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
815
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
816
openpgp_crt_deinit.restype = None
817
818
openpgp_crt_get_fingerprint = (
819
_library.gnutls_openpgp_crt_get_fingerprint)
820
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
821
ctypes.c_void_p,
822
ctypes.POINTER(
823
ctypes.c_size_t)]
824
openpgp_crt_get_fingerprint.restype = _error_code
825
826
if check_version(b"3.6.4"):
827
certificate_type_get2 = _library.gnutls_certificate_type_get2
828
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
829
certificate_type_get2.restype = _error_code
830
682
831
# Remove non-public functions
683
832
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
833
686
834
687
835
def call_pipe(connection, # : multiprocessing.Connection
688
836
func, *args, **kwargs):
689
837
"""This function is meant to be called by multiprocessing.Process
690
838
691
839
This function runs func(*args, **kwargs), and writes the resulting
692
840
return value on the provided multiprocessing.Connection.
693
841
"""
694
842
connection.send(func(*args, **kwargs))
695
843
connection.close()
696
844
697
class Client(object):
845
846
class Client:
698
847
"""A representation of a client host served by this server.
699
848
700
849
Attributes:
701
850
approved: bool(); 'None' if not yet approved/disapproved
702
851
approval_delay: datetime.timedelta(); Time to wait for approval
703
852
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
853
checker: multiprocessing.Process(); a running checker process used
854
to see if the client lives. 'None' if no process is
855
running.
856
checker_callback_tag: a GLib event source tag, or None
708
857
checker_command: string; External command which is run to check
709
858
if client lives. %() expansions are done at
710
859
runtime with vars(self) as dict, so that for
711
860
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
861
checker_initiator_tag: a GLib event source tag, or None
713
862
created: datetime.datetime(); (UTC) object creation
714
863
client_structure: Object describing what attributes a client has
715
864
and is used for storing the client at exit
716
865
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
866
disable_initiator_tag: a GLib event source tag, or None
718
867
enabled: bool()
719
868
fingerprint: string (40 or 32 hexadecimal digits); used to
720
uniquely identify the client
869
uniquely identify an OpenPGP client
870
key_id: string (64 hexadecimal digits); used to uniquely identify
871
a client using raw public keys
721
872
host: string; available for use by the checker command
722
873
interval: datetime.timedelta(); How often to start a new checker
723
874
last_approval_request: datetime.datetime(); (UTC) or None
739
890
disabled, or None
740
891
server_settings: The server_settings dict from main()
741
892
"""
742
893
743
894
runtime_expansions = ("approval_delay", "approval_duration",
744
"created", "enabled", "expires",
895
"created", "enabled", "expires", "key_id",
745
896
"fingerprint", "host", "interval",
746
897
"last_approval_request", "last_checked_ok",
747
898
"last_enabled", "name", "timeout")
756
907
"approved_by_default": "True",
757
908
"enabled": "True",
758
909
}
759
910
760
911
@staticmethod
761
912
def config_parser(config):
762
913
"""Construct a new dict of client settings of this form:
769
920
for client_name in config.sections():
770
921
section = dict(config.items(client_name))
771
922
client = settings[client_name] = {}
772
923
773
924
client["host"] = section["host"]
774
925
# Reformat values from string types to Python types
775
926
client["approved_by_default"] = config.getboolean(
776
927
client_name, "approved_by_default")
777
928
client["enabled"] = config.getboolean(client_name,
778
929
"enabled")
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
930
931
# Uppercase and remove spaces from key_id and fingerprint
932
# for later comparison purposes with return value from the
933
# key_id() and fingerprint() functions
934
client["key_id"] = (section.get("key_id", "").upper()
935
.replace(" ", ""))
783
936
client["fingerprint"] = (section["fingerprint"].upper()
784
937
.replace(" ", ""))
785
938
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
939
client["secret"] = codecs.decode(section["secret"]
940
.encode("utf-8"),
941
"base64")
787
942
elif "secfile" in section:
788
943
with open(os.path.expanduser(os.path.expandvars
789
944
(section["secfile"])),
804
959
client["last_approval_request"] = None
805
960
client["last_checked_ok"] = None
806
961
client["last_checker_status"] = -2
807
962
808
963
return settings
809
810
def __init__(self, settings, name = None, server_settings=None):
964
965
def __init__(self, settings, name=None, server_settings=None):
811
966
self.name = name
812
967
if server_settings is None:
813
968
server_settings = {}
815
970
# adding all client settings
816
971
for setting, value in settings.items():
817
972
setattr(self, setting, value)
818
973
819
974
if self.enabled:
820
975
if not hasattr(self, "last_enabled"):
821
976
self.last_enabled = datetime.datetime.utcnow()
825
980
else:
826
981
self.last_enabled = None
827
982
self.expires = None
828
983
829
984
logger.debug("Creating client %r", self.name)
985
logger.debug(" Key ID: %s", self.key_id)
830
986
logger.debug(" Fingerprint: %s", self.fingerprint)
831
987
self.created = settings.get("created",
832
988
datetime.datetime.utcnow())
833
989
834
990
# attributes specific for this server instance
835
991
self.checker = None
836
992
self.checker_initiator_tag = None
842
998
self.changedstate = multiprocessing_manager.Condition(
843
999
multiprocessing_manager.Lock())
844
1000
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
1001
for attr in self.__dict__.keys()
846
1002
if not attr.startswith("_")]
847
1003
self.client_structure.append("client_structure")
848
1004
849
1005
for name, t in inspect.getmembers(
850
1006
type(self), lambda obj: isinstance(obj, property)):
851
1007
if not name.startswith("_"):
852
1008
self.client_structure.append(name)
853
1009
854
1010
# Send notice to process children that client state has changed
855
1011
def send_changedstate(self):
856
1012
with self.changedstate:
857
1013
self.changedstate.notify_all()
858
1014
859
1015
def enable(self):
860
1016
"""Start this client's checker and timeout hooks"""
861
1017
if getattr(self, "enabled", False):
866
1022
self.last_enabled = datetime.datetime.utcnow()
867
1023
self.init_checker()
868
1024
self.send_changedstate()
869
1025
870
1026
def disable(self, quiet=True):
871
1027
"""Disable this client."""
872
1028
if not getattr(self, "enabled", False):
874
1030
if not quiet:
875
1031
logger.info("Disabling client %s", self.name)
876
1032
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
1033
GLib.source_remove(self.disable_initiator_tag)
878
1034
self.disable_initiator_tag = None
879
1035
self.expires = None
880
1036
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
1037
GLib.source_remove(self.checker_initiator_tag)
882
1038
self.checker_initiator_tag = None
883
1039
self.stop_checker()
884
1040
self.enabled = False
885
1041
if not quiet:
886
1042
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
1043
# Do not run this again if called by a GLib.timeout_add
888
1044
return False
889
1045
890
1046
def __del__(self):
891
1047
self.disable()
892
1048
893
1049
def init_checker(self):
894
1050
# Schedule a new checker to be started an 'interval' from now,
895
1051
# and every interval from then on.
896
1052
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
1053
GLib.source_remove(self.checker_initiator_tag)
1054
self.checker_initiator_tag = GLib.timeout_add(
1055
random.randrange(int(self.interval.total_seconds() * 1000
1056
+ 1)),
900
1057
self.start_checker)
901
1058
# Schedule a disable() when 'timeout' has passed
902
1059
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
1060
GLib.source_remove(self.disable_initiator_tag)
1061
self.disable_initiator_tag = GLib.timeout_add(
905
1062
int(self.timeout.total_seconds() * 1000), self.disable)
906
1063
# Also start a new checker *right now*.
907
1064
self.start_checker()
908
1065
909
1066
def checker_callback(self, source, condition, connection,
910
1067
command):
911
1068
"""The checker has completed, so take appropriate actions."""
912
self.checker_callback_tag = None
913
self.checker = None
914
1069
# Read return code from connection (see call_pipe)
915
1070
returncode = connection.recv()
916
1071
connection.close()
917
1072
if self.checker is not None:
1073
self.checker.join()
1074
self.checker_callback_tag = None
1075
self.checker = None
1076
918
1077
if returncode >= 0:
919
1078
self.last_checker_status = returncode
920
1079
self.last_checker_signal = None
930
1089
logger.warning("Checker for %(name)s crashed?",
931
1090
vars(self))
932
1091
return False
933
1092
934
1093
def checked_ok(self):
935
1094
"""Assert that the client has been seen, alive and well."""
936
1095
self.last_checked_ok = datetime.datetime.utcnow()
937
1096
self.last_checker_status = 0
938
1097
self.last_checker_signal = None
939
1098
self.bump_timeout()
940
1099
941
1100
def bump_timeout(self, timeout=None):
942
1101
"""Bump up the timeout for this client."""
943
1102
if timeout is None:
944
1103
timeout = self.timeout
945
1104
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1105
GLib.source_remove(self.disable_initiator_tag)
947
1106
self.disable_initiator_tag = None
948
1107
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1108
self.disable_initiator_tag = GLib.timeout_add(
950
1109
int(timeout.total_seconds() * 1000), self.disable)
951
1110
self.expires = datetime.datetime.utcnow() + timeout
952
1111
953
1112
def need_approval(self):
954
1113
self.last_approval_request = datetime.datetime.utcnow()
955
1114
956
1115
def start_checker(self):
957
1116
"""Start a new checker subprocess if one is not running.
958
1117
959
1118
If a checker already exists, leave it running and do
960
1119
nothing."""
961
1120
# The reason for not killing a running checker is that if we
966
1125
# checkers alone, the checker would have to take more time
967
1126
# than 'timeout' for the client to be disabled, which is as it
968
1127
# should be.
969
1128
970
1129
if self.checker is not None and not self.checker.is_alive():
971
1130
logger.warning("Checker was not alive; joining")
972
1131
self.checker.join()
975
1134
if self.checker is None:
976
1135
# Escape attributes for the shell
977
1136
escaped_attrs = {
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
1137
attr: shlex.quote(str(getattr(self, attr)))
1138
for attr in self.runtime_expansions}
980
1139
try:
981
1140
command = self.checker_command % escaped_attrs
982
1141
except TypeError as error:
994
1153
# The exception is when not debugging but nevertheless
995
1154
# running in the foreground; use the previously
996
1155
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1156
popen_args = {"close_fds": True,
1157
"shell": True,
1158
"cwd": "/"}
1000
1159
if (not self.server_settings["debug"]
1001
1160
and self.server_settings["foreground"]):
1002
1161
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1162
"stderr": wnull})
1163
pipe = multiprocessing.Pipe(duplex=False)
1005
1164
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1165
target=call_pipe,
1166
args=(pipe[1], subprocess.call, command),
1167
kwargs=popen_args)
1009
1168
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1169
self.checker_callback_tag = GLib.io_add_watch(
1170
GLib.IOChannel.unix_new(pipe[0].fileno()),
1171
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1012
1172
self.checker_callback, pipe[0], command)
1013
# Re-run this periodically if run by gobject.timeout_add
1173
# Re-run this periodically if run by GLib.timeout_add
1014
1174
return True
1015
1175
1016
1176
def stop_checker(self):
1017
1177
"""Force the checker process, if any, to stop."""
1018
1178
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1179
GLib.source_remove(self.checker_callback_tag)
1020
1180
self.checker_callback_tag = None
1021
1181
if getattr(self, "checker", None) is None:
1022
1182
return
1031
1191
byte_arrays=False):
1032
1192
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
1193
become properties on the D-Bus.
1034
1194
1035
1195
The decorated method will be called with no arguments by "Get"
1036
1196
and with one argument by "Set".
1037
1197
1038
1198
The parameters, where they are supported, are the same as
1039
1199
dbus.service.method, except there is only "signature", since the
1040
1200
type from Get() and the type sent to Set() is the same.
1044
1204
if byte_arrays and signature != "ay":
1045
1205
raise ValueError("Byte arrays not supported for non-'ay'"
1046
1206
" signature {!r}".format(signature))
1047
1207
1048
1208
def decorator(func):
1049
1209
func._dbus_is_property = True
1050
1210
func._dbus_interface = dbus_interface
1053
1213
func._dbus_name = func.__name__
1054
1214
if func._dbus_name.endswith("_dbus_property"):
1055
1215
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1216
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1057
1217
return func
1058
1218
1059
1219
return decorator
1060
1220
1061
1221
1062
1222
def dbus_interface_annotations(dbus_interface):
1063
1223
"""Decorator for marking functions returning interface annotations
1064
1224
1065
1225
Usage:
1066
1226
1067
1227
@dbus_interface_annotations("org.example.Interface")
1068
1228
def _foo(self): # Function name does not matter
1069
1229
return {"org.freedesktop.DBus.Deprecated": "true",
1070
1230
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
1231
"false"}
1072
1232
"""
1073
1233
1074
1234
def decorator(func):
1075
1235
func._dbus_is_interface = True
1076
1236
func._dbus_interface = dbus_interface
1077
1237
func._dbus_name = dbus_interface
1078
1238
return func
1079
1239
1080
1240
return decorator
1081
1241
1082
1242
1083
1243
def dbus_annotations(annotations):
1084
1244
"""Decorator to annotate D-Bus methods, signals or properties
1085
1245
Usage:
1086
1246
1087
1247
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
1248
"org.freedesktop.DBus.Property."
1089
1249
"EmitsChangedSignal": "false"})
1091
1251
access="r")
1092
1252
def Property_dbus_property(self):
1093
1253
return dbus.Boolean(False)
1094
1254
1095
1255
See also the DBusObjectWithAnnotations class.
1096
1256
"""
1097
1257
1098
1258
def decorator(func):
1099
1259
func._dbus_annotations = annotations
1100
1260
return func
1101
1261
1102
1262
return decorator
1103
1263
1104
1264
1122
1282
1123
1283
class DBusObjectWithAnnotations(dbus.service.Object):
1124
1284
"""A D-Bus object with annotations.
1125
1285
1126
1286
Classes inheriting from this can use the dbus_annotations
1127
1287
decorator to add annotations to methods or signals.
1128
1288
"""
1129
1289
1130
1290
@staticmethod
1131
1291
def _is_dbus_thing(thing):
1132
1292
"""Returns a function testing if an attribute is a D-Bus thing
1133
1293
1134
1294
If called like _is_dbus_thing("method") it returns a function
1135
1295
suitable for use as predicate to inspect.getmembers().
1136
1296
"""
1137
1297
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1138
1298
False)
1139
1299
1140
1300
def _get_all_dbus_things(self, thing):
1141
1301
"""Returns a generator of (name, attribute) pairs
1142
1302
"""
1145
1305
for cls in self.__class__.__mro__
1146
1306
for name, athing in
1147
1307
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1308
1149
1309
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1310
out_signature="s",
1311
path_keyword='object_path',
1312
connection_keyword='connection')
1153
1313
def Introspect(self, object_path, connection):
1154
1314
"""Overloading of standard D-Bus method.
1155
1315
1156
1316
Inserts annotation tags on methods and signals.
1157
1317
"""
1158
1318
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
1319
connection)
1160
1320
try:
1161
1321
document = xml.dom.minidom.parseString(xmlstring)
1162
1322
1163
1323
for if_tag in document.getElementsByTagName("interface"):
1164
1324
# Add annotation tags
1165
1325
for typ in ("method", "signal"):
1192
1352
if_tag.appendChild(ann_tag)
1193
1353
# Fix argument name for the Introspect method itself
1194
1354
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1355
== dbus.INTROSPECTABLE_IFACE):
1196
1356
for cn in if_tag.getElementsByTagName("method"):
1197
1357
if cn.getAttribute("name") == "Introspect":
1198
1358
for arg in cn.getElementsByTagName("arg"):
1211
1371
1212
1372
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
1373
"""A D-Bus object with properties.
1214
1374
1215
1375
Classes inheriting from this can use the dbus_service_property
1216
1376
decorator to expose methods as D-Bus properties. It exposes the
1217
1377
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
1378
"""
1219
1379
1220
1380
def _get_dbus_property(self, interface_name, property_name):
1221
1381
"""Returns a bound method if one exists which is a D-Bus
1222
1382
property with the specified name and interface.
1227
1387
if (value._dbus_name == property_name
1228
1388
and value._dbus_interface == interface_name):
1229
1389
return value.__get__(self)
1230
1390
1231
1391
# No such property
1232
1392
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
1393
self.dbus_object_path, interface_name, property_name))
1234
1394
1235
1395
@classmethod
1236
1396
def _get_all_interface_names(cls):
1237
1397
"""Get a sequence of all interfaces supported by an object"""
1240
1400
for x in (inspect.getmro(cls))
1241
1401
for attr in dir(x))
1242
1402
if name is not None)
1243
1403
1244
1404
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
1405
in_signature="ss",
1246
1406
out_signature="v")
1254
1414
if not hasattr(value, "variant_level"):
1255
1415
return value
1256
1416
return type(value)(value, variant_level=value.variant_level+1)
1257
1417
1258
1418
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
1419
def Set(self, interface_name, property_name, value):
1260
1420
"""Standard D-Bus property Set() method, see D-Bus standard.
1269
1429
raise ValueError("Byte arrays not supported for non-"
1270
1430
"'ay' signature {!r}"
1271
1431
.format(prop._dbus_signature))
1272
value = dbus.ByteArray(b''.join(chr(byte)
1273
for byte in value))
1432
value = dbus.ByteArray(bytes(value))
1274
1433
prop(value)
1275
1434
1276
1435
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
1436
in_signature="s",
1278
1437
out_signature="a{sv}")
1279
1438
def GetAll(self, interface_name):
1280
1439
"""Standard D-Bus property GetAll() method, see D-Bus
1281
1440
standard.
1282
1441
1283
1442
Note: Will not include properties with access="write".
1284
1443
"""
1285
1444
properties = {}
1296
1455
properties[name] = value
1297
1456
continue
1298
1457
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1458
value, variant_level=value.variant_level + 1)
1300
1459
return dbus.Dictionary(properties, signature="sv")
1301
1460
1302
1461
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
1462
def PropertiesChanged(self, interface_name, changed_properties,
1304
1463
invalidated_properties):
1306
1465
standard.
1307
1466
"""
1308
1467
pass
1309
1468
1310
1469
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
1470
out_signature="s",
1312
1471
path_keyword='object_path',
1313
1472
connection_keyword='connection')
1314
1473
def Introspect(self, object_path, connection):
1315
1474
"""Overloading of standard D-Bus method.
1316
1475
1317
1476
Inserts property tags and interface annotation tags.
1318
1477
"""
1319
1478
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1321
1480
connection)
1322
1481
try:
1323
1482
document = xml.dom.minidom.parseString(xmlstring)
1324
1483
1325
1484
def make_tag(document, name, prop):
1326
1485
e = document.createElement("property")
1327
1486
e.setAttribute("name", name)
1328
1487
e.setAttribute("type", prop._dbus_signature)
1329
1488
e.setAttribute("access", prop._dbus_access)
1330
1489
return e
1331
1490
1332
1491
for if_tag in document.getElementsByTagName("interface"):
1333
1492
# Add property tags
1334
1493
for tag in (make_tag(document, name, prop)
1376
1535
exc_info=error)
1377
1536
return xmlstring
1378
1537
1538
1379
1539
try:
1380
1540
dbus.OBJECT_MANAGER_IFACE
1381
1541
except AttributeError:
1382
1542
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1543
1544
1384
1545
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1546
"""A D-Bus object with an ObjectManager.
1386
1547
1387
1548
Classes inheriting from this exposes the standard
1388
1549
GetManagedObjects call and the InterfacesAdded and
1389
1550
InterfacesRemoved signals on the standard
1390
1551
"org.freedesktop.DBus.ObjectManager" interface.
1391
1552
1392
1553
Note: No signals are sent automatically; they must be sent
1393
1554
manually.
1394
1555
"""
1395
1556
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1557
out_signature="a{oa{sa{sv}}}")
1397
1558
def GetManagedObjects(self):
1398
1559
"""This function must be overridden"""
1399
1560
raise NotImplementedError()
1400
1561
1401
1562
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1563
signature="oa{sa{sv}}")
1403
1564
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
1565
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1566
1567
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1568
def InterfacesRemoved(self, object_path, interfaces):
1408
1569
pass
1409
1570
1410
1571
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1572
out_signature="s",
1573
path_keyword='object_path',
1574
connection_keyword='connection')
1414
1575
def Introspect(self, object_path, connection):
1415
1576
"""Overloading of standard D-Bus method.
1416
1577
1417
1578
Override return argument name of GetManagedObjects to be
1418
1579
"objpath_interfaces_and_properties"
1419
1580
"""
1422
1583
connection)
1423
1584
try:
1424
1585
document = xml.dom.minidom.parseString(xmlstring)
1425
1586
1426
1587
for if_tag in document.getElementsByTagName("interface"):
1427
1588
# Fix argument name for the GetManagedObjects method
1428
1589
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1590
== dbus.OBJECT_MANAGER_IFACE):
1430
1591
for cn in if_tag.getElementsByTagName("method"):
1431
1592
if (cn.getAttribute("name")
1432
1593
== "GetManagedObjects"):
1442
1603
except (AttributeError, xml.dom.DOMException,
1443
1604
xml.parsers.expat.ExpatError) as error:
1444
1605
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1606
exc_info=error)
1446
1607
return xmlstring
1447
1608
1609
1448
1610
def datetime_to_dbus(dt, variant_level=0):
1449
1611
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1612
if dt is None:
1451
return dbus.String("", variant_level = variant_level)
1613
return dbus.String("", variant_level=variant_level)
1452
1614
return dbus.String(dt.isoformat(), variant_level=variant_level)
1453
1615
1454
1616
1457
1619
dbus.service.Object, it will add alternate D-Bus attributes with
1458
1620
interface names according to the "alt_interface_names" mapping.
1459
1621
Usage:
1460
1622
1461
1623
@alternate_dbus_interfaces({"org.example.Interface":
1462
1624
"net.example.AlternateInterface"})
1463
1625
class SampleDBusObject(dbus.service.Object):
1464
1626
@dbus.service.method("org.example.Interface")
1465
1627
def SampleDBusMethod():
1466
1628
pass
1467
1629
1468
1630
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
1631
reachable via two interfaces: "org.example.Interface" and
1470
1632
"net.example.AlternateInterface", the latter of which will have
1471
1633
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
1634
"true", unless "deprecate" is passed with a False value.
1473
1635
1474
1636
This works for methods and signals, and also for D-Bus properties
1475
1637
(from DBusObjectWithProperties) and interfaces (from the
1476
1638
dbus_interface_annotations decorator).
1477
1639
"""
1478
1640
1479
1641
def wrapper(cls):
1480
1642
for orig_interface_name, alt_interface_name in (
1481
1643
alt_interface_names.items()):
1496
1658
interface_names.add(alt_interface)
1497
1659
# Is this a D-Bus signal?
1498
1660
if getattr(attribute, "_dbus_is_signal", False):
1661
# Extract the original non-method undecorated
1662
# function by black magic
1499
1663
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
1664
nonmethod_func = (dict(
1503
1665
zip(attribute.func_code.co_freevars,
1504
1666
attribute.__closure__))
1505
1667
["func"].cell_contents)
1506
1668
else:
1507
nonmethod_func = attribute
1669
nonmethod_func = (dict(
1670
zip(attribute.__code__.co_freevars,
1671
attribute.__closure__))
1672
["func"].cell_contents)
1508
1673
# Create a new, but exactly alike, function
1509
1674
# object, and decorate it to be a new D-Bus signal
1510
1675
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1676
new_function = copy_function(nonmethod_func)
1525
1677
new_function = (dbus.service.signal(
1526
1678
alt_interface,
1527
1679
attribute._dbus_signature)(new_function))
1531
1683
attribute._dbus_annotations)
1532
1684
except AttributeError:
1533
1685
pass
1686
1534
1687
# Define a creator of a function to call both the
1535
1688
# original and alternate functions, so both the
1536
1689
# original and alternate signals gets sent when
1539
1692
"""This function is a scope container to pass
1540
1693
func1 and func2 to the "call_both" function
1541
1694
outside of its arguments"""
1542
1695
1543
1696
@functools.wraps(func2)
1544
1697
def call_both(*args, **kwargs):
1545
1698
"""This function will emit two D-Bus
1546
1699
signals by calling func1 and func2"""
1547
1700
func1(*args, **kwargs)
1548
1701
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1702
# Make wrapper function look like a D-Bus
1703
# signal
1550
1704
for name, attr in inspect.getmembers(func2):
1551
1705
if name.startswith("_dbus_"):
1552
1706
setattr(call_both, name, attr)
1553
1707
1554
1708
return call_both
1555
1709
# Create the "call_both" function and add it to
1556
1710
# the class
1566
1720
alt_interface,
1567
1721
attribute._dbus_in_signature,
1568
1722
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1723
(copy_function(attribute)))
1574
1724
# Copy annotations, if any
1575
1725
try:
1576
1726
attr[attrname]._dbus_annotations = dict(
1588
1738
attribute._dbus_access,
1589
1739
attribute._dbus_get_args_options
1590
1740
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1741
(copy_function(attribute)))
1597
1742
# Copy annotations, if any
1598
1743
try:
1599
1744
attr[attrname]._dbus_annotations = dict(
1608
1753
# to the class.
1609
1754
attr[attrname] = (
1610
1755
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1756
(copy_function(attribute)))
1616
1757
if deprecate:
1617
1758
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1759
iname = "_AlternateDBusNames_interface_annotation{}"
1619
1760
for interface_name in interface_names:
1620
1761
1621
1762
@dbus_interface_annotations(interface_name)
1622
1763
def func(self):
1623
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1764
return {"org.freedesktop.DBus.Deprecated":
1765
"true"}
1625
1766
# Find an unused name
1626
1767
for aname in (iname.format(i)
1627
1768
for i in itertools.count()):
1631
1772
if interface_names:
1632
1773
# Replace the class with a new subclass of it with
1633
1774
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1775
if sys.version_info.major == 2:
1776
cls = type(b"{}Alternate".format(cls.__name__),
1777
(cls, ), attr)
1778
else:
1779
cls = type("{}Alternate".format(cls.__name__),
1780
(cls, ), attr)
1636
1781
return cls
1637
1782
1638
1783
return wrapper
1639
1784
1640
1785
1642
1787
"se.bsnet.fukt.Mandos"})
1643
1788
class ClientDBus(Client, DBusObjectWithProperties):
1644
1789
"""A Client class using D-Bus
1645
1790
1646
1791
Attributes:
1647
1792
dbus_object_path: dbus.ObjectPath
1648
1793
bus: dbus.SystemBus()
1649
1794
"""
1650
1795
1651
1796
runtime_expansions = (Client.runtime_expansions
1652
1797
+ ("dbus_object_path", ))
1653
1798
1654
1799
_interface = "se.recompile.Mandos.Client"
1655
1800
1656
1801
# dbus.service.Object doesn't use super(), so we can't either.
1657
1658
def __init__(self, bus = None, *args, **kwargs):
1802
1803
def __init__(self, bus=None, *args, **kwargs):
1659
1804
self.bus = bus
1660
1805
Client.__init__(self, *args, **kwargs)
1661
1806
# Only now, when this client is initialized, can it show up on
1667
1812
"/clients/" + client_object_name)
1668
1813
DBusObjectWithProperties.__init__(self, self.bus,
1669
1814
self.dbus_object_path)
1670
1815
1671
1816
def notifychangeproperty(transform_func, dbus_name,
1672
1817
type_func=lambda x: x,
1673
1818
variant_level=1,
1675
1820
_interface=_interface):
1676
1821
""" Modify a variable so that it's a property which announces
1677
1822
its changes to DBus.
1678
1823
1679
1824
transform_fun: Function that takes a value and a variant_level
1680
1825
and transforms it to a D-Bus type.
1681
1826
dbus_name: D-Bus name of the variable
1684
1829
variant_level: D-Bus variant level. Default: 1
1685
1830
"""
1686
1831
attrname = "_{}".format(dbus_name)
1687
1832
1688
1833
def setter(self, value):
1689
1834
if hasattr(self, "dbus_object_path"):
1690
1835
if (not hasattr(self, attrname) or
1697
1842
else:
1698
1843
dbus_value = transform_func(
1699
1844
type_func(value),
1700
variant_level = variant_level)
1845
variant_level=variant_level)
1701
1846
self.PropertyChanged(dbus.String(dbus_name),
1702
1847
dbus_value)
1703
1848
self.PropertiesChanged(
1704
1849
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1850
dbus.Dictionary({dbus.String(dbus_name):
1851
dbus_value}),
1707
1852
dbus.Array())
1708
1853
setattr(self, attrname, value)
1709
1854
1710
1855
return property(lambda self: getattr(self, attrname), setter)
1711
1856
1712
1857
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
1858
approvals_pending = notifychangeproperty(dbus.Boolean,
1714
1859
"ApprovalPending",
1715
type_func = bool)
1860
type_func=bool)
1716
1861
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1862
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1863
"LastEnabled")
1719
1864
checker = notifychangeproperty(
1720
1865
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1866
type_func=lambda checker: checker is not None)
1722
1867
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1868
"LastCheckedOK")
1724
1869
last_checker_status = notifychangeproperty(dbus.Int16,
1729
1874
"ApprovedByDefault")
1730
1875
approval_delay = notifychangeproperty(
1731
1876
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1877
type_func=lambda td: td.total_seconds() * 1000)
1733
1878
approval_duration = notifychangeproperty(
1734
1879
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1880
type_func=lambda td: td.total_seconds() * 1000)
1736
1881
host = notifychangeproperty(dbus.String, "Host")
1737
1882
timeout = notifychangeproperty(
1738
1883
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1884
type_func=lambda td: td.total_seconds() * 1000)
1740
1885
extended_timeout = notifychangeproperty(
1741
1886
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1887
type_func=lambda td: td.total_seconds() * 1000)
1743
1888
interval = notifychangeproperty(
1744
1889
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1890
type_func=lambda td: td.total_seconds() * 1000)
1746
1891
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
1892
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
1893
invalidate_only=True)
1749
1894
1750
1895
del notifychangeproperty
1751
1896
1752
1897
def __del__(self, *args, **kwargs):
1753
1898
try:
1754
1899
self.remove_from_connection()
1757
1902
if hasattr(DBusObjectWithProperties, "__del__"):
1758
1903
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1904
Client.__del__(self, *args, **kwargs)
1760
1905
1761
1906
def checker_callback(self, source, condition,
1762
1907
connection, command, *args, **kwargs):
1763
1908
ret = Client.checker_callback(self, source, condition,
1779
1924
| self.last_checker_signal),
1780
1925
dbus.String(command))
1781
1926
return ret
1782
1927
1783
1928
def start_checker(self, *args, **kwargs):
1784
1929
old_checker_pid = getattr(self.checker, "pid", None)
1785
1930
r = Client.start_checker(self, *args, **kwargs)
1789
1934
# Emit D-Bus signal
1790
1935
self.CheckerStarted(self.current_checker_command)
1791
1936
return r
1792
1937
1793
1938
def _reset_approved(self):
1794
1939
self.approved = None
1795
1940
return False
1796
1941
1797
1942
def approve(self, value=True):
1798
1943
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1944
GLib.timeout_add(int(self.approval_duration.total_seconds()
1945
* 1000), self._reset_approved)
1801
1946
self.send_changedstate()
1802
1803
## D-Bus methods, signals & properties
1804
1805
## Interfaces
1806
1807
## Signals
1808
1947
1948
# D-Bus methods, signals & properties
1949
1950
# Interfaces
1951
1952
# Signals
1953
1809
1954
# CheckerCompleted - signal
1810
1955
@dbus.service.signal(_interface, signature="nxs")
1811
1956
def CheckerCompleted(self, exitcode, waitstatus, command):
1812
1957
"D-Bus signal"
1813
1958
pass
1814
1959
1815
1960
# CheckerStarted - signal
1816
1961
@dbus.service.signal(_interface, signature="s")
1817
1962
def CheckerStarted(self, command):
1818
1963
"D-Bus signal"
1819
1964
pass
1820
1965
1821
1966
# PropertyChanged - signal
1822
1967
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
1968
@dbus.service.signal(_interface, signature="sv")
1824
1969
def PropertyChanged(self, property, value):
1825
1970
"D-Bus signal"
1826
1971
pass
1827
1972
1828
1973
# GotSecret - signal
1829
1974
@dbus.service.signal(_interface)
1830
1975
def GotSecret(self):
1833
1978
server to mandos-client
1834
1979
"""
1835
1980
pass
1836
1981
1837
1982
# Rejected - signal
1838
1983
@dbus.service.signal(_interface, signature="s")
1839
1984
def Rejected(self, reason):
1840
1985
"D-Bus signal"
1841
1986
pass
1842
1987
1843
1988
# NeedApproval - signal
1844
1989
@dbus.service.signal(_interface, signature="tb")
1845
1990
def NeedApproval(self, timeout, default):
1846
1991
"D-Bus signal"
1847
1992
return self.need_approval()
1848
1849
## Methods
1850
1993
1994
# Methods
1995
1851
1996
# Approve - method
1852
1997
@dbus.service.method(_interface, in_signature="b")
1853
1998
def Approve(self, value):
1854
1999
self.approve(value)
1855
2000
1856
2001
# CheckedOK - method
1857
2002
@dbus.service.method(_interface)
1858
2003
def CheckedOK(self):
1859
2004
self.checked_ok()
1860
2005
1861
2006
# Enable - method
1862
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
2008
@dbus.service.method(_interface)
1864
2009
def Enable(self):
1865
2010
"D-Bus method"
1866
2011
self.enable()
1867
2012
1868
2013
# StartChecker - method
1869
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
2015
@dbus.service.method(_interface)
1871
2016
def StartChecker(self):
1872
2017
"D-Bus method"
1873
2018
self.start_checker()
1874
2019
1875
2020
# Disable - method
1876
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
2022
@dbus.service.method(_interface)
1878
2023
def Disable(self):
1879
2024
"D-Bus method"
1880
2025
self.disable()
1881
2026
1882
2027
# StopChecker - method
1883
2028
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
2029
@dbus.service.method(_interface)
1885
2030
def StopChecker(self):
1886
2031
self.stop_checker()
1887
1888
## Properties
1889
2032
2033
# Properties
2034
1890
2035
# ApprovalPending - property
1891
2036
@dbus_service_property(_interface, signature="b", access="read")
1892
2037
def ApprovalPending_dbus_property(self):
1893
2038
return dbus.Boolean(bool(self.approvals_pending))
1894
2039
1895
2040
# ApprovedByDefault - property
1896
2041
@dbus_service_property(_interface,
1897
2042
signature="b",
1900
2045
if value is None: # get
1901
2046
return dbus.Boolean(self.approved_by_default)
1902
2047
self.approved_by_default = bool(value)
1903
2048
1904
2049
# ApprovalDelay - property
1905
2050
@dbus_service_property(_interface,
1906
2051
signature="t",
1910
2055
return dbus.UInt64(self.approval_delay.total_seconds()
1911
2056
* 1000)
1912
2057
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
2058
1914
2059
# ApprovalDuration - property
1915
2060
@dbus_service_property(_interface,
1916
2061
signature="t",
1920
2065
return dbus.UInt64(self.approval_duration.total_seconds()
1921
2066
* 1000)
1922
2067
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
2068
1924
2069
# Name - property
1925
2070
@dbus_annotations(
1926
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
2072
@dbus_service_property(_interface, signature="s", access="read")
1928
2073
def Name_dbus_property(self):
1929
2074
return dbus.String(self.name)
1930
2075
2076
# KeyID - property
2077
@dbus_annotations(
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2079
@dbus_service_property(_interface, signature="s", access="read")
2080
def KeyID_dbus_property(self):
2081
return dbus.String(self.key_id)
2082
1931
2083
# Fingerprint - property
1932
2084
@dbus_annotations(
1933
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
2086
@dbus_service_property(_interface, signature="s", access="read")
1935
2087
def Fingerprint_dbus_property(self):
1936
2088
return dbus.String(self.fingerprint)
1937
2089
1938
2090
# Host - property
1939
2091
@dbus_service_property(_interface,
1940
2092
signature="s",
1943
2095
if value is None: # get
1944
2096
return dbus.String(self.host)
1945
2097
self.host = str(value)
1946
2098
1947
2099
# Created - property
1948
2100
@dbus_annotations(
1949
2101
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
2102
@dbus_service_property(_interface, signature="s", access="read")
1951
2103
def Created_dbus_property(self):
1952
2104
return datetime_to_dbus(self.created)
1953
2105
1954
2106
# LastEnabled - property
1955
2107
@dbus_service_property(_interface, signature="s", access="read")
1956
2108
def LastEnabled_dbus_property(self):
1957
2109
return datetime_to_dbus(self.last_enabled)
1958
2110
1959
2111
# Enabled - property
1960
2112
@dbus_service_property(_interface,
1961
2113
signature="b",
1967
2119
self.enable()
1968
2120
else:
1969
2121
self.disable()
1970
2122
1971
2123
# LastCheckedOK - property
1972
2124
@dbus_service_property(_interface,
1973
2125
signature="s",
1977
2129
self.checked_ok()
1978
2130
return
1979
2131
return datetime_to_dbus(self.last_checked_ok)
1980
2132
1981
2133
# LastCheckerStatus - property
1982
2134
@dbus_service_property(_interface, signature="n", access="read")
1983
2135
def LastCheckerStatus_dbus_property(self):
1984
2136
return dbus.Int16(self.last_checker_status)
1985
2137
1986
2138
# Expires - property
1987
2139
@dbus_service_property(_interface, signature="s", access="read")
1988
2140
def Expires_dbus_property(self):
1989
2141
return datetime_to_dbus(self.expires)
1990
2142
1991
2143
# LastApprovalRequest - property
1992
2144
@dbus_service_property(_interface, signature="s", access="read")
1993
2145
def LastApprovalRequest_dbus_property(self):
1994
2146
return datetime_to_dbus(self.last_approval_request)
1995
2147
1996
2148
# Timeout - property
1997
2149
@dbus_service_property(_interface,
1998
2150
signature="t",
2013
2165
if (getattr(self, "disable_initiator_tag", None)
2014
2166
is None):
2015
2167
return
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2168
GLib.source_remove(self.disable_initiator_tag)
2169
self.disable_initiator_tag = GLib.timeout_add(
2018
2170
int((self.expires - now).total_seconds() * 1000),
2019
2171
self.disable)
2020
2172
2021
2173
# ExtendedTimeout - property
2022
2174
@dbus_service_property(_interface,
2023
2175
signature="t",
2027
2179
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
2180
* 1000)
2029
2181
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
2182
2031
2183
# Interval - property
2032
2184
@dbus_service_property(_interface,
2033
2185
signature="t",
2040
2192
return
2041
2193
if self.enabled:
2042
2194
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2195
GLib.source_remove(self.checker_initiator_tag)
2196
self.checker_initiator_tag = GLib.timeout_add(
2045
2197
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2047
2198
self.start_checker() # Start one now, too
2199
2048
2200
# Checker - property
2049
2201
@dbus_service_property(_interface,
2050
2202
signature="s",
2053
2205
if value is None: # get
2054
2206
return dbus.String(self.checker_command)
2055
2207
self.checker_command = str(value)
2056
2208
2057
2209
# CheckerRunning - property
2058
2210
@dbus_service_property(_interface,
2059
2211
signature="b",
2065
2217
self.start_checker()
2066
2218
else:
2067
2219
self.stop_checker()
2068
2220
2069
2221
# ObjectPath - property
2070
2222
@dbus_annotations(
2071
2223
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
2224
"org.freedesktop.DBus.Deprecated": "true"})
2073
2225
@dbus_service_property(_interface, signature="o", access="read")
2074
2226
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2076
2227
return self.dbus_object_path # is already a dbus.ObjectPath
2228
2077
2229
# Secret = property
2078
2230
@dbus_annotations(
2079
2231
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2084
2236
byte_arrays=True)
2085
2237
def Secret_dbus_property(self, value):
2086
2238
self.secret = bytes(value)
2087
2239
2088
2240
del _interface
2089
2241
2090
2242
2091
class ProxyClient(object):
2092
def __init__(self, child_pipe, fpr, address):
2243
class ProxyClient:
2244
def __init__(self, child_pipe, key_id, fpr, address):
2093
2245
self._pipe = child_pipe
2094
self._pipe.send(('init', fpr, address))
2246
self._pipe.send(('init', key_id, fpr, address))
2095
2247
if not self._pipe.recv():
2096
raise KeyError(fpr)
2097
2248
raise KeyError(key_id or fpr)
2249
2098
2250
def __getattribute__(self, name):
2099
2251
if name == '_pipe':
2100
2252
return super(ProxyClient, self).__getattribute__(name)
2103
2255
if data[0] == 'data':
2104
2256
return data[1]
2105
2257
if data[0] == 'function':
2106
2258
2107
2259
def func(*args, **kwargs):
2108
2260
self._pipe.send(('funcall', name, args, kwargs))
2109
2261
return self._pipe.recv()[1]
2110
2262
2111
2263
return func
2112
2264
2113
2265
def __setattr__(self, name, value):
2114
2266
if name == '_pipe':
2115
2267
return super(ProxyClient, self).__setattr__(name, value)
2118
2270
2119
2271
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2272
"""A class to handle client connections.
2121
2273
2122
2274
Instantiated once for each connection to handle it.
2123
2275
Note: This will run in its own forked process."""
2124
2276
2125
2277
def handle(self):
2126
2278
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
2279
logger.info("TCP connection from: %s",
2128
2280
str(self.client_address))
2129
2281
logger.debug("Pipe FD: %d",
2130
2282
self.server.child_pipe.fileno())
2131
2283
2132
2284
session = gnutls.ClientSession(self.request)
2133
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2137
# "+DHE-DSS"))
2285
2286
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2287
# "+AES-256-CBC", "+SHA1",
2288
# "+COMP-NULL", "+CTYPE-OPENPGP",
2289
# "+DHE-DSS"))
2138
2290
# Use a fallback default, since this MUST be set.
2139
2291
priority = self.server.gnutls_priority
2140
2292
if priority is None:
2141
2293
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2294
gnutls.priority_set_direct(session._c_object,
2295
priority.encode("utf-8"),
2143
2296
None)
2144
2297
2145
2298
# Start communication using the Mandos protocol
2146
2299
# Get protocol number
2147
2300
line = self.request.makefile().readline()
2152
2305
except (ValueError, IndexError, RuntimeError) as error:
2153
2306
logger.error("Unknown protocol version: %s", error)
2154
2307
return
2155
2308
2156
2309
# Start GnuTLS connection
2157
2310
try:
2158
2311
session.handshake()
2162
2315
# established. Just abandon the request.
2163
2316
return
2164
2317
logger.debug("Handshake succeeded")
2165
2318
2166
2319
approval_required = False
2167
2320
try:
2168
try:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
2172
logger.warning("Bad certificate: %s", error)
2173
return
2174
logger.debug("Fingerprint: %s", fpr)
2175
2176
try:
2177
client = ProxyClient(child_pipe, fpr,
2321
if gnutls.has_rawpk:
2322
fpr = b""
2323
try:
2324
key_id = self.key_id(
2325
self.peer_certificate(session))
2326
except (TypeError, gnutls.Error) as error:
2327
logger.warning("Bad certificate: %s", error)
2328
return
2329
logger.debug("Key ID: %s", key_id)
2330
2331
else:
2332
key_id = b""
2333
try:
2334
fpr = self.fingerprint(
2335
self.peer_certificate(session))
2336
except (TypeError, gnutls.Error) as error:
2337
logger.warning("Bad certificate: %s", error)
2338
return
2339
logger.debug("Fingerprint: %s", fpr)
2340
2341
try:
2342
client = ProxyClient(child_pipe, key_id, fpr,
2178
2343
self.client_address)
2179
2344
except KeyError:
2180
2345
return
2181
2346
2182
2347
if client.approval_delay:
2183
2348
delay = client.approval_delay
2184
2349
client.approvals_pending += 1
2185
2350
approval_required = True
2186
2351
2187
2352
while True:
2188
2353
if not client.enabled:
2189
2354
logger.info("Client %s is disabled",
2192
2357
# Emit D-Bus signal
2193
2358
client.Rejected("Disabled")
2194
2359
return
2195
2360
2196
2361
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2362
# We are approved or approval is disabled
2198
2363
break
2199
2364
elif client.approved is None:
2200
2365
logger.info("Client %s needs approval",
2211
2376
# Emit D-Bus signal
2212
2377
client.Rejected("Denied")
2213
2378
return
2214
2215
#wait until timeout or approved
2379
2380
# wait until timeout or approved
2216
2381
time = datetime.datetime.now()
2217
2382
client.changedstate.acquire()
2218
2383
client.changedstate.wait(delay.total_seconds())
2231
2396
break
2232
2397
else:
2233
2398
delay -= time2 - time
2234
2399
2235
2400
try:
2236
2401
session.send(client.secret)
2237
2402
except gnutls.Error as error:
2238
2403
logger.warning("gnutls send failed",
2239
exc_info = error)
2404
exc_info=error)
2240
2405
return
2241
2406
2242
2407
logger.info("Sending secret to %s", client.name)
2243
2408
# bump the timeout using extended_timeout
2244
2409
client.bump_timeout(client.extended_timeout)
2245
2410
if self.server.use_dbus:
2246
2411
# Emit D-Bus signal
2247
2412
client.GotSecret()
2248
2413
2249
2414
finally:
2250
2415
if approval_required:
2251
2416
client.approvals_pending -= 1
2254
2419
except gnutls.Error as error:
2255
2420
logger.warning("GnuTLS bye failed",
2256
2421
exc_info=error)
2257
2422
2258
2423
@staticmethod
2259
2424
def peer_certificate(session):
2260
"Return the peer's OpenPGP certificate as a bytestring"
2261
# If not an OpenPGP certificate...
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2425
"Return the peer's certificate as a bytestring"
2426
try:
2427
cert_type = gnutls.certificate_type_get2(session._c_object,
2428
gnutls.CTYPE_PEERS)
2429
except AttributeError:
2430
cert_type = gnutls.certificate_type_get(session._c_object)
2431
if gnutls.has_rawpk:
2432
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2433
else:
2434
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2435
# If not a valid certificate type...
2436
if cert_type not in valid_cert_types:
2437
logger.info("Cert type %r not in %r", cert_type,
2438
valid_cert_types)
2264
2439
# ...return invalid data
2265
2440
return b""
2266
2441
list_size = ctypes.c_uint(1)
2272
2447
return None
2273
2448
cert = cert_list[0]
2274
2449
return ctypes.string_at(cert.data, cert.size)
2275
2450
2451
@staticmethod
2452
def key_id(certificate):
2453
"Convert a certificate bytestring to a hexdigit key ID"
2454
# New GnuTLS "datum" with the public key
2455
datum = gnutls.datum_t(
2456
ctypes.cast(ctypes.c_char_p(certificate),
2457
ctypes.POINTER(ctypes.c_ubyte)),
2458
ctypes.c_uint(len(certificate)))
2459
# XXX all these need to be created in the gnutls "module"
2460
# New empty GnuTLS certificate
2461
pubkey = gnutls.pubkey_t()
2462
gnutls.pubkey_init(ctypes.byref(pubkey))
2463
# Import the raw public key into the certificate
2464
gnutls.pubkey_import(pubkey,
2465
ctypes.byref(datum),
2466
gnutls.X509_FMT_DER)
2467
# New buffer for the key ID
2468
buf = ctypes.create_string_buffer(32)
2469
buf_len = ctypes.c_size_t(len(buf))
2470
# Get the key ID from the raw public key into the buffer
2471
gnutls.pubkey_get_key_id(pubkey,
2472
gnutls.KEYID_USE_SHA256,
2473
ctypes.cast(ctypes.byref(buf),
2474
ctypes.POINTER(ctypes.c_ubyte)),
2475
ctypes.byref(buf_len))
2476
# Deinit the certificate
2477
gnutls.pubkey_deinit(pubkey)
2478
2479
# Convert the buffer to a Python bytestring
2480
key_id = ctypes.string_at(buf, buf_len.value)
2481
# Convert the bytestring to hexadecimal notation
2482
hex_key_id = binascii.hexlify(key_id).upper()
2483
return hex_key_id
2484
2276
2485
@staticmethod
2277
2486
def fingerprint(openpgp):
2278
2487
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2293
2502
ctypes.byref(crtverify))
2294
2503
if crtverify.value != 0:
2295
2504
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
2505
raise gnutls.CertificateSecurityError(code
2506
=crtverify.value)
2297
2507
# New buffer for the fingerprint
2298
2508
buf = ctypes.create_string_buffer(20)
2299
2509
buf_len = ctypes.c_size_t()
2309
2519
return hex_fpr
2310
2520
2311
2521
2312
class MultiprocessingMixIn(object):
2522
class MultiprocessingMixIn:
2313
2523
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2524
2315
2525
def sub_process_main(self, request, address):
2316
2526
try:
2317
2527
self.finish_request(request, address)
2318
2528
except Exception:
2319
2529
self.handle_error(request, address)
2320
2530
self.close_request(request)
2321
2531
2322
2532
def process_request(self, request, address):
2323
2533
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2534
proc = multiprocessing.Process(target=self.sub_process_main,
2535
args=(request, address))
2326
2536
proc.start()
2327
2537
return proc
2328
2538
2329
2539
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2540
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2331
2541
""" adds a pipe to the MixIn """
2332
2542
2333
2543
def process_request(self, request, client_address):
2334
2544
"""Overrides and wraps the original process_request().
2335
2545
2336
2546
This function creates a new pipe in self.pipe
2337
2547
"""
2338
2548
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2339
2549
2340
2550
proc = MultiprocessingMixIn.process_request(self, request,
2341
2551
client_address)
2342
2552
self.child_pipe.close()
2343
2553
self.add_pipe(parent_pipe, proc)
2344
2554
2345
2555
def add_pipe(self, parent_pipe, proc):
2346
2556
"""Dummy function; override as necessary"""
2347
2557
raise NotImplementedError()
2348
2558
2349
2559
2350
2560
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
socketserver.TCPServer, object):
2561
socketserver.TCPServer):
2352
2562
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2353
2563
2354
2564
Attributes:
2355
2565
enabled: Boolean; whether this server is activated yet
2356
2566
interface: None or a network interface name (string)
2357
2567
use_ipv6: Boolean; to use IPv6 or not
2358
2568
"""
2359
2569
2360
2570
def __init__(self, server_address, RequestHandlerClass,
2361
2571
interface=None,
2362
2572
use_ipv6=True,
2372
2582
self.socketfd = socketfd
2373
2583
# Save the original socket.socket() function
2374
2584
self.socket_socket = socket.socket
2585
2375
2586
# To implement --socket, we monkey patch socket.socket.
2376
#
2587
#
2377
2588
# (When socketserver.TCPServer is a new-style class, we
2378
2589
# could make self.socket into a property instead of monkey
2379
2590
# patching socket.socket.)
2380
#
2591
#
2381
2592
# Create a one-time-only replacement for socket.socket()
2382
2593
@functools.wraps(socket.socket)
2383
2594
def socket_wrapper(*args, **kwargs):
2395
2606
# socket_wrapper(), if socketfd was set.
2396
2607
socketserver.TCPServer.__init__(self, server_address,
2397
2608
RequestHandlerClass)
2398
2609
2399
2610
def server_bind(self):
2400
2611
"""This overrides the normal server_bind() function
2401
2612
to bind to an interface if one was specified, and also NOT to
2402
2613
bind to an address or port if they were not specified."""
2614
global SO_BINDTODEVICE
2403
2615
if self.interface is not None:
2404
2616
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2407
self.interface)
2408
else:
2409
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2420
self.interface)
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2424
else:
2425
raise
2617
# Fall back to a hard-coded value which seems to be
2618
# common enough.
2619
logger.warning("SO_BINDTODEVICE not found, trying 25")
2620
SO_BINDTODEVICE = 25
2621
try:
2622
self.socket.setsockopt(
2623
socket.SOL_SOCKET, SO_BINDTODEVICE,
2624
(self.interface + "\0").encode("utf-8"))
2625
except socket.error as error:
2626
if error.errno == errno.EPERM:
2627
logger.error("No permission to bind to"
2628
" interface %s", self.interface)
2629
elif error.errno == errno.ENOPROTOOPT:
2630
logger.error("SO_BINDTODEVICE not available;"
2631
" cannot bind to interface %s",
2632
self.interface)
2633
elif error.errno == errno.ENODEV:
2634
logger.error("Interface %s does not exist,"
2635
" cannot bind", self.interface)
2636
else:
2637
raise
2426
2638
# Only bind(2) the socket if we really need to.
2427
2639
if self.server_address[0] or self.server_address[1]:
2640
if self.server_address[1]:
2641
self.allow_reuse_address = True
2428
2642
if not self.server_address[0]:
2429
2643
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2644
any_address = "::" # in6addr_any
2431
2645
else:
2432
any_address = "0.0.0.0" # INADDR_ANY
2646
any_address = "0.0.0.0" # INADDR_ANY
2433
2647
self.server_address = (any_address,
2434
2648
self.server_address[1])
2435
2649
elif not self.server_address[1]:
2445
2659
2446
2660
class MandosServer(IPv6_TCPServer):
2447
2661
"""Mandos server.
2448
2662
2449
2663
Attributes:
2450
2664
clients: set of Client objects
2451
2665
gnutls_priority GnuTLS priority string
2452
2666
use_dbus: Boolean; to emit D-Bus signals or not
2453
2454
Assumes a gobject.MainLoop event loop.
2667
2668
Assumes a GLib.MainLoop event loop.
2455
2669
"""
2456
2670
2457
2671
def __init__(self, server_address, RequestHandlerClass,
2458
2672
interface=None,
2459
2673
use_ipv6=True,
2469
2683
self.gnutls_priority = gnutls_priority
2470
2684
IPv6_TCPServer.__init__(self, server_address,
2471
2685
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2475
2686
interface=interface,
2687
use_ipv6=use_ipv6,
2688
socketfd=socketfd)
2689
2476
2690
def server_activate(self):
2477
2691
if self.enabled:
2478
2692
return socketserver.TCPServer.server_activate(self)
2479
2693
2480
2694
def enable(self):
2481
2695
self.enabled = True
2482
2696
2483
2697
def add_pipe(self, parent_pipe, proc):
2484
2698
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2699
GLib.io_add_watch(
2700
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2701
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2488
2702
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2491
2703
parent_pipe=parent_pipe,
2704
proc=proc))
2705
2492
2706
def handle_ipc(self, source, condition,
2493
2707
parent_pipe=None,
2494
proc = None,
2708
proc=None,
2495
2709
client_object=None):
2496
2710
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2711
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2712
# Wait for other process to exit
2499
2713
proc.join()
2500
2714
return False
2501
2715
2502
2716
# Read a request from the child
2503
2717
request = parent_pipe.recv()
2504
2718
command = request[0]
2505
2719
2506
2720
if command == 'init':
2507
fpr = request[1]
2508
address = request[2]
2509
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2721
key_id = request[1].decode("ascii")
2722
fpr = request[2].decode("ascii")
2723
address = request[3]
2724
2725
for c in self.clients.values():
2726
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2727
continue
2728
if key_id and c.key_id == key_id:
2729
client = c
2730
break
2731
if fpr and c.fingerprint == fpr:
2512
2732
client = c
2513
2733
break
2514
2734
else:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2735
logger.info("Client not found for key ID: %s, address"
2736
": %s", key_id or fpr, address)
2517
2737
if self.use_dbus:
2518
2738
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
2739
mandos_dbus_service.ClientNotFound(key_id or fpr,
2520
2740
address[0])
2521
2741
parent_pipe.send(False)
2522
2742
return False
2523
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2743
2744
GLib.io_add_watch(
2745
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2746
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2527
2747
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2748
parent_pipe=parent_pipe,
2749
proc=proc,
2750
client_object=client))
2531
2751
parent_pipe.send(True)
2532
2752
# remove the old hook in favor of the new above hook on
2533
2753
# same fileno
2536
2756
funcname = request[1]
2537
2757
args = request[2]
2538
2758
kwargs = request[3]
2539
2759
2540
2760
parent_pipe.send(('data', getattr(client_object,
2541
2761
funcname)(*args,
2542
2762
**kwargs)))
2543
2763
2544
2764
if command == 'getattr':
2545
2765
attrname = request[1]
2546
2766
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2767
collections.abc.Callable):
2548
2768
parent_pipe.send(('function', ))
2549
2769
else:
2550
2770
parent_pipe.send((
2551
2771
'data', client_object.__getattribute__(attrname)))
2552
2772
2553
2773
if command == 'setattr':
2554
2774
attrname = request[1]
2555
2775
value = request[2]
2556
2776
setattr(client_object, attrname, value)
2557
2777
2558
2778
return True
2559
2779
2560
2780
2561
2781
def rfc3339_duration_to_delta(duration):
2562
2782
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2563
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2783
2784
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2785
True
2786
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2787
True
2788
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2789
True
2790
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2791
True
2792
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2793
True
2794
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2795
True
2796
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2797
True
2578
2798
"""
2579
2799
2580
2800
# Parsing an RFC 3339 duration with regular expressions is not
2581
2801
# possible - there would have to be multiple places for the same
2582
2802
# values, like seconds. The current code, while more esoteric, is
2583
2803
# cleaner without depending on a parsing library. If Python had a
2584
2804
# built-in library for parsing we would use it, but we'd like to
2585
2805
# avoid excessive use of external libraries.
2586
2806
2587
2807
# New type for defining tokens, syntax, and semantics all-in-one
2588
2808
Token = collections.namedtuple("Token", (
2589
2809
"regexp", # To match token; if "value" is not None, must have
2622
2842
frozenset((token_year, token_month,
2623
2843
token_day, token_time,
2624
2844
token_week)))
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2845
# Define starting values:
2846
# Value so far
2847
value = datetime.timedelta()
2627
2848
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2849
# Following valid tokens
2850
followers = frozenset((token_duration, ))
2851
# String left to parse
2852
s = duration
2630
2853
# Loop until end token is found
2631
2854
while found_token is not token_end:
2632
2855
# Search for any currently valid tokens
2656
2879
2657
2880
def string_to_delta(interval):
2658
2881
"""Parse a string and return a datetime.timedelta
2659
2660
>>> string_to_delta('7d')
2661
datetime.timedelta(7)
2662
>>> string_to_delta('60s')
2663
datetime.timedelta(0, 60)
2664
>>> string_to_delta('60m')
2665
datetime.timedelta(0, 3600)
2666
>>> string_to_delta('24h')
2667
datetime.timedelta(1)
2668
>>> string_to_delta('1w')
2669
datetime.timedelta(7)
2670
>>> string_to_delta('5m 30s')
2671
datetime.timedelta(0, 330)
2882
2883
>>> string_to_delta('7d') == datetime.timedelta(7)
2884
True
2885
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2886
True
2887
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2888
True
2889
>>> string_to_delta('24h') == datetime.timedelta(1)
2890
True
2891
>>> string_to_delta('1w') == datetime.timedelta(7)
2892
True
2893
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2894
True
2672
2895
"""
2673
2896
2674
2897
try:
2675
2898
return rfc3339_duration_to_delta(interval)
2676
2899
except ValueError:
2677
2900
pass
2678
2901
2679
2902
timevalue = datetime.timedelta(0)
2680
2903
for s in interval.split():
2681
2904
try:
2699
2922
return timevalue
2700
2923
2701
2924
2702
def daemon(nochdir = False, noclose = False):
2925
def daemon(nochdir=False, noclose=False):
2703
2926
"""See daemon(3). Standard BSD Unix function.
2704
2927
2705
2928
This should really exist as os.daemon, but it doesn't (yet)."""
2706
2929
if os.fork():
2707
2930
sys.exit()
2725
2948
2726
2949
2727
2950
def main():
2728
2951
2729
2952
##################################################################
2730
2953
# Parsing of options, both command line and config file
2731
2954
2732
2955
parser = argparse.ArgumentParser()
2733
2956
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2957
version="%(prog)s {}".format(version),
2735
2958
help="show version number and exit")
2736
2959
parser.add_argument("-i", "--interface", metavar="IF",
2737
2960
help="Bind to interface IF")
2773
2996
parser.add_argument("--no-zeroconf", action="store_false",
2774
2997
dest="zeroconf", help="Do not use Zeroconf",
2775
2998
default=None)
2776
2999
2777
3000
options = parser.parse_args()
2778
2779
if options.check:
2780
import doctest
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2783
3001
2784
3002
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2786
"address": "",
2787
"port": "",
2788
"debug": "False",
2789
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2793
"use_dbus": "True",
2794
"use_ipv6": "True",
2795
"debuglevel": "",
2796
"restore": "True",
2797
"socket": "",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2802
3003
if gnutls.has_rawpk:
3004
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3005
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3006
else:
3007
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3008
":+SIGN-DSA-SHA256")
3009
server_defaults = {"interface": "",
3010
"address": "",
3011
"port": "",
3012
"debug": "False",
3013
"priority": priority,
3014
"servicename": "Mandos",
3015
"use_dbus": "True",
3016
"use_ipv6": "True",
3017
"debuglevel": "",
3018
"restore": "True",
3019
"socket": "",
3020
"statedir": "/var/lib/mandos",
3021
"foreground": "False",
3022
"zeroconf": "True",
3023
}
3024
del priority
3025
2803
3026
# Parse config file for server-global settings
2804
server_config = configparser.SafeConfigParser(server_defaults)
3027
server_config = configparser.ConfigParser(server_defaults)
2805
3028
del server_defaults
2806
3029
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2807
# Convert the SafeConfigParser object to a dict
3030
# Convert the ConfigParser object to a dict
2808
3031
server_settings = server_config.defaults()
2809
3032
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3033
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3034
"foreground", "zeroconf"):
2811
3035
server_settings[option] = server_config.getboolean("DEFAULT",
2812
3036
option)
2813
3037
if server_settings["port"]:
2823
3047
server_settings["socket"] = os.dup(server_settings
2824
3048
["socket"])
2825
3049
del server_config
2826
3050
2827
3051
# Override the settings from the config file with command line
2828
3052
# options, if set.
2829
3053
for option in ("interface", "address", "port", "debug",
2847
3071
if server_settings["debug"]:
2848
3072
server_settings["foreground"] = True
2849
3073
# Now we have our good server settings in "server_settings"
2850
3074
2851
3075
##################################################################
2852
3076
2853
3077
if (not server_settings["zeroconf"]
2854
3078
and not (server_settings["port"]
2855
3079
or server_settings["socket"] != "")):
2856
3080
parser.error("Needs port or socket to work without Zeroconf")
2857
3081
2858
3082
# For convenience
2859
3083
debug = server_settings["debug"]
2860
3084
debuglevel = server_settings["debuglevel"]
2864
3088
stored_state_file)
2865
3089
foreground = server_settings["foreground"]
2866
3090
zeroconf = server_settings["zeroconf"]
2867
3091
2868
3092
if debug:
2869
3093
initlogger(debug, logging.DEBUG)
2870
3094
else:
2873
3097
else:
2874
3098
level = getattr(logging, debuglevel.upper())
2875
3099
initlogger(debug, level)
2876
3100
2877
3101
if server_settings["servicename"] != "Mandos":
2878
3102
syslogger.setFormatter(
2879
3103
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
3104
' %(levelname)s: %(message)s'.format(
2881
3105
server_settings["servicename"])))
2882
3106
2883
3107
# Parse config file with clients
2884
client_config = configparser.SafeConfigParser(Client
2885
.client_defaults)
3108
client_config = configparser.ConfigParser(Client.client_defaults)
2886
3109
client_config.read(os.path.join(server_settings["configdir"],
2887
3110
"clients.conf"))
2888
3111
2889
3112
global mandos_dbus_service
2890
3113
mandos_dbus_service = None
2891
3114
2892
3115
socketfd = None
2893
3116
if server_settings["socket"] != "":
2894
3117
socketfd = server_settings["socket"]
2910
3133
except IOError as e:
2911
3134
logger.error("Could not open file %r", pidfilename,
2912
3135
exc_info=e)
2913
2914
for name in ("_mandos", "mandos", "nobody"):
3136
3137
for name, group in (("_mandos", "_mandos"),
3138
("mandos", "mandos"),
3139
("nobody", "nogroup")):
2915
3140
try:
2916
3141
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
3142
gid = pwd.getpwnam(group).pw_gid
2918
3143
break
2919
3144
except KeyError:
2920
3145
continue
2924
3149
try:
2925
3150
os.setgid(gid)
2926
3151
os.setuid(uid)
3152
if debug:
3153
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3154
gid))
2927
3155
except OSError as error:
3156
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3157
.format(uid, gid, os.strerror(error.errno)))
2928
3158
if error.errno != errno.EPERM:
2929
3159
raise
2930
3160
2931
3161
if debug:
2932
3162
# Enable all possible GnuTLS debugging
2933
3163
2934
3164
# "Use a log level over 10 to enable all debugging options."
2935
3165
# - GnuTLS manual
2936
3166
gnutls.global_set_log_level(11)
2937
3167
2938
3168
@gnutls.log_func
2939
3169
def debug_gnutls(level, string):
2940
3170
logger.debug("GnuTLS: %s", string[:-1])
2941
3171
2942
3172
gnutls.global_set_log_function(debug_gnutls)
2943
3173
2944
3174
# Redirect stdin so all checkers get /dev/null
2945
3175
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
3176
os.dup2(null, sys.stdin.fileno())
2947
3177
if null > 2:
2948
3178
os.close(null)
2949
3179
2950
3180
# Need to fork before connecting to D-Bus
2951
3181
if not foreground:
2952
3182
# Close all input and output, do double fork, etc.
2953
3183
daemon()
2954
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2958
3184
3185
if gi.version_info < (3, 10, 2):
3186
# multiprocessing will use threads, so before we use GLib we
3187
# need to inform GLib that threads will be used.
3188
GLib.threads_init()
3189
2959
3190
global main_loop
2960
3191
# From the Avahi example code
2961
3192
DBusGMainLoop(set_as_default=True)
2962
main_loop = gobject.MainLoop()
3193
main_loop = GLib.MainLoop()
2963
3194
bus = dbus.SystemBus()
2964
3195
# End of Avahi example code
2965
3196
if use_dbus:
2978
3209
if zeroconf:
2979
3210
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3211
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
3212
name=server_settings["servicename"],
3213
servicetype="_mandos._tcp",
3214
protocol=protocol,
3215
bus=bus)
2985
3216
if server_settings["interface"]:
2986
3217
service.interface = if_nametoindex(
2987
3218
server_settings["interface"].encode("utf-8"))
2988
3219
2989
3220
global multiprocessing_manager
2990
3221
multiprocessing_manager = multiprocessing.Manager()
2991
3222
2992
3223
client_class = Client
2993
3224
if use_dbus:
2994
client_class = functools.partial(ClientDBus, bus = bus)
2995
3225
client_class = functools.partial(ClientDBus, bus=bus)
3226
2996
3227
client_settings = Client.config_parser(client_config)
2997
3228
old_client_settings = {}
2998
3229
clients_data = {}
2999
3230
3000
3231
# This is used to redirect stdout and stderr for checker processes
3001
3232
global wnull
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3233
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3234
# Only used if server is running in foreground but not in debug
3004
3235
# mode
3005
3236
if debug or not foreground:
3006
3237
wnull.close()
3007
3238
3008
3239
# Get client data and settings from last running state.
3009
3240
if server_settings["restore"]:
3010
3241
try:
3011
3242
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
3243
if sys.version_info.major == 2:
3244
clients_data, old_client_settings = pickle.load(
3245
stored_state)
3246
else:
3247
bytes_clients_data, bytes_old_client_settings = (
3248
pickle.load(stored_state, encoding="bytes"))
3249
# Fix bytes to strings
3250
# clients_data
3251
# .keys()
3252
clients_data = {(key.decode("utf-8")
3253
if isinstance(key, bytes)
3254
else key): value
3255
for key, value in
3256
bytes_clients_data.items()}
3257
del bytes_clients_data
3258
for key in clients_data:
3259
value = {(k.decode("utf-8")
3260
if isinstance(k, bytes) else k): v
3261
for k, v in
3262
clients_data[key].items()}
3263
clients_data[key] = value
3264
# .client_structure
3265
value["client_structure"] = [
3266
(s.decode("utf-8")
3267
if isinstance(s, bytes)
3268
else s) for s in
3269
value["client_structure"]]
3270
# .name, .host, and .checker_command
3271
for k in ("name", "host", "checker_command"):
3272
if isinstance(value[k], bytes):
3273
value[k] = value[k].decode("utf-8")
3274
if "key_id" not in value:
3275
value["key_id"] = ""
3276
elif "fingerprint" not in value:
3277
value["fingerprint"] = ""
3278
# old_client_settings
3279
# .keys()
3280
old_client_settings = {
3281
(key.decode("utf-8")
3282
if isinstance(key, bytes)
3283
else key): value
3284
for key, value in
3285
bytes_old_client_settings.items()}
3286
del bytes_old_client_settings
3287
# .host and .checker_command
3288
for value in old_client_settings.values():
3289
for attribute in ("host", "checker_command"):
3290
if isinstance(value[attribute], bytes):
3291
value[attribute] = (value[attribute]
3292
.decode("utf-8"))
3014
3293
os.remove(stored_state_path)
3015
3294
except IOError as e:
3016
3295
if e.errno == errno.ENOENT:
3024
3303
logger.warning("Could not load persistent state: "
3025
3304
"EOFError:",
3026
3305
exc_info=e)
3027
3306
3028
3307
with PGPEngine() as pgp:
3029
3308
for client_name, client in clients_data.items():
3030
3309
# Skip removed clients
3031
3310
if client_name not in client_settings:
3032
3311
continue
3033
3312
3034
3313
# Decide which value to use after restoring saved state.
3035
3314
# We have three different values: Old config file,
3036
3315
# new config file, and saved state.
3047
3326
client[name] = value
3048
3327
except KeyError:
3049
3328
pass
3050
3329
3051
3330
# Clients who has passed its expire date can still be
3052
3331
# enabled if its last checker was successful. A Client
3053
3332
# whose checker succeeded before we stored its state is
3086
3365
client_name))
3087
3366
client["secret"] = (client_settings[client_name]
3088
3367
["secret"])
3089
3368
3090
3369
# Add/remove clients based on new changes made to config
3091
3370
for client_name in (set(old_client_settings)
3092
3371
- set(client_settings)):
3094
3373
for client_name in (set(client_settings)
3095
3374
- set(old_client_settings)):
3096
3375
clients_data[client_name] = client_settings[client_name]
3097
3376
3098
3377
# Create all client objects
3099
3378
for client_name, client in clients_data.items():
3100
3379
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
3103
server_settings = server_settings)
3104
3380
name=client_name,
3381
settings=client,
3382
server_settings=server_settings)
3383
3105
3384
if not tcp_server.clients:
3106
3385
logger.warning("No clients defined")
3107
3386
3108
3387
if not foreground:
3109
3388
if pidfile is not None:
3110
3389
pid = os.getpid()
3116
3395
pidfilename, pid)
3117
3396
del pidfile
3118
3397
del pidfilename
3119
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
3398
3399
for termsig in (signal.SIGHUP, signal.SIGTERM):
3400
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3401
lambda: main_loop.quit() and False)
3402
3123
3403
if use_dbus:
3124
3404
3125
3405
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3406
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3407
class MandosDBusService(DBusObjectWithObjectManager):
3128
3408
"""A D-Bus proxy object"""
3129
3409
3130
3410
def __init__(self):
3131
3411
dbus.service.Object.__init__(self, bus, "/")
3132
3412
3133
3413
_interface = "se.recompile.Mandos"
3134
3414
3135
3415
@dbus.service.signal(_interface, signature="o")
3136
3416
def ClientAdded(self, objpath):
3137
3417
"D-Bus signal"
3138
3418
pass
3139
3419
3140
3420
@dbus.service.signal(_interface, signature="ss")
3141
def ClientNotFound(self, fingerprint, address):
3421
def ClientNotFound(self, key_id, address):
3142
3422
"D-Bus signal"
3143
3423
pass
3144
3424
3145
3425
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
3426
"true"})
3147
3427
@dbus.service.signal(_interface, signature="os")
3148
3428
def ClientRemoved(self, objpath, name):
3149
3429
"D-Bus signal"
3150
3430
pass
3151
3431
3152
3432
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
3433
"true"})
3154
3434
@dbus.service.method(_interface, out_signature="ao")
3155
3435
def GetAllClients(self):
3156
3436
"D-Bus method"
3157
3437
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3159
3438
tcp_server.clients.values())
3439
3160
3440
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
3441
"true"})
3162
3442
@dbus.service.method(_interface,
3164
3444
def GetAllClientsWithProperties(self):
3165
3445
"D-Bus method"
3166
3446
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3447
{c.dbus_object_path: c.GetAll(
3168
3448
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3449
for c in tcp_server.clients.values()},
3170
3450
signature="oa{sv}")
3171
3451
3172
3452
@dbus.service.method(_interface, in_signature="o")
3173
3453
def RemoveClient(self, object_path):
3174
3454
"D-Bus method"
3175
for c in tcp_server.clients.itervalues():
3455
for c in tcp_server.clients.values():
3176
3456
if c.dbus_object_path == object_path:
3177
3457
del tcp_server.clients[c.name]
3178
3458
c.remove_from_connection()
3182
3462
self.client_removed_signal(c)
3183
3463
return
3184
3464
raise KeyError(object_path)
3185
3465
3186
3466
del _interface
3187
3467
3188
3468
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3469
out_signature="a{oa{sa{sv}}}")
3190
3470
def GetManagedObjects(self):
3191
3471
"""D-Bus method"""
3192
3472
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3473
{client.dbus_object_path:
3474
dbus.Dictionary(
3475
{interface: client.GetAll(interface)
3476
for interface in
3477
client._get_all_interface_names()})
3478
for client in tcp_server.clients.values()})
3479
3200
3480
def client_added_signal(self, client):
3201
3481
"""Send the new standard signal and the old signal"""
3202
3482
if use_dbus:
3204
3484
self.InterfacesAdded(
3205
3485
client.dbus_object_path,
3206
3486
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3487
{interface: client.GetAll(interface)
3488
for interface in
3489
client._get_all_interface_names()}))
3210
3490
# Old signal
3211
3491
self.ClientAdded(client.dbus_object_path)
3212
3492
3213
3493
def client_removed_signal(self, client):
3214
3494
"""Send the new standard signal and the old signal"""
3215
3495
if use_dbus:
3220
3500
# Old signal
3221
3501
self.ClientRemoved(client.dbus_object_path,
3222
3502
client.name)
3223
3503
3224
3504
mandos_dbus_service = MandosDBusService()
3225
3505
3506
# Save modules to variables to exempt the modules from being
3507
# unloaded before the function registered with atexit() is run.
3508
mp = multiprocessing
3509
wn = wnull
3510
3226
3511
def cleanup():
3227
3512
"Cleanup function; run on exit"
3228
3513
if zeroconf:
3229
3514
service.cleanup()
3230
3231
multiprocessing.active_children()
3232
wnull.close()
3515
3516
mp.active_children()
3517
wn.close()
3233
3518
if not (tcp_server.clients or client_settings):
3234
3519
return
3235
3520
3236
3521
# Store client before exiting. Secrets are encrypted with key
3237
3522
# based on what config file has. If config file is
3238
3523
# removed/edited, old secret will thus be unrecovable.
3239
3524
clients = {}
3240
3525
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3526
for client in tcp_server.clients.values():
3242
3527
key = client_settings[client.name]["secret"]
3243
3528
client.encrypted_secret = pgp.encrypt(client.secret,
3244
3529
key)
3245
3530
client_dict = {}
3246
3531
3247
3532
# A list of attributes that can not be pickled
3248
3533
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3534
exclude = {"bus", "changedstate", "secret",
3535
"checker", "server_settings"}
3251
3536
for name, typ in inspect.getmembers(dbus.service
3252
3537
.Object):
3253
3538
exclude.add(name)
3254
3539
3255
3540
client_dict["encrypted_secret"] = (client
3256
3541
.encrypted_secret)
3257
3542
for attr in client.client_structure:
3258
3543
if attr not in exclude:
3259
3544
client_dict[attr] = getattr(client, attr)
3260
3545
3261
3546
clients[client.name] = client_dict
3262
3547
del client_settings[client.name]["secret"]
3263
3548
3264
3549
try:
3265
3550
with tempfile.NamedTemporaryFile(
3266
3551
mode='wb',
3268
3553
prefix='clients-',
3269
3554
dir=os.path.dirname(stored_state_path),
3270
3555
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3556
pickle.dump((clients, client_settings), stored_state,
3557
protocol=2)
3272
3558
tempname = stored_state.name
3273
3559
os.rename(tempname, stored_state_path)
3274
3560
except (IOError, OSError) as e:
3284
3570
logger.warning("Could not save persistent state:",
3285
3571
exc_info=e)
3286
3572
raise
3287
3573
3288
3574
# Delete all clients, and settings from config
3289
3575
while tcp_server.clients:
3290
3576
name, client = tcp_server.clients.popitem()
3296
3582
if use_dbus:
3297
3583
mandos_dbus_service.client_removed_signal(client)
3298
3584
client_settings.clear()
3299
3585
3300
3586
atexit.register(cleanup)
3301
3302
for client in tcp_server.clients.itervalues():
3587
3588
for client in tcp_server.clients.values():
3303
3589
if use_dbus:
3304
3590
# Emit D-Bus signal for adding
3305
3591
mandos_dbus_service.client_added_signal(client)
3306
3592
# Need to initiate checking of clients
3307
3593
if client.enabled:
3308
3594
client.init_checker()
3309
3595
3310
3596
tcp_server.enable()
3311
3597
tcp_server.server_activate()
3312
3598
3313
3599
# Find out what port we got
3314
3600
if zeroconf:
3315
3601
service.port = tcp_server.socket.getsockname()[1]
3320
3606
else: # IPv4
3321
3607
logger.info("Now listening on address %r, port %d",
3322
3608
*tcp_server.socket.getsockname())
3323
3324
#service.interface = tcp_server.socket.getsockname()[3]
3325
3609
3610
# service.interface = tcp_server.socket.getsockname()[3]
3611
3326
3612
try:
3327
3613
if zeroconf:
3328
3614
# From the Avahi example code
3333
3619
cleanup()
3334
3620
sys.exit(1)
3335
3621
# End of Avahi example code
3336
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3341
3622
3623
GLib.io_add_watch(
3624
GLib.IOChannel.unix_new(tcp_server.fileno()),
3625
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3626
lambda *args, **kwargs: (tcp_server.handle_request
3627
(*args[2:], **kwargs) or True))
3628
3342
3629
logger.debug("Starting main loop")
3343
3630
main_loop.run()
3344
3631
except AvahiError as error:
3353
3640
# Must run before the D-Bus bus name gets deregistered
3354
3641
cleanup()
3355
3642
3643
3644
def should_only_run_tests():
3645
parser = argparse.ArgumentParser(add_help=False)
3646
parser.add_argument("--check", action='store_true')
3647
args, unknown_args = parser.parse_known_args()
3648
run_tests = args.check
3649
if run_tests:
3650
# Remove --check argument from sys.argv
3651
sys.argv[1:] = unknown_args
3652
return run_tests
3653
3654
# Add all tests from doctest strings
3655
def load_tests(loader, tests, none):
3656
import doctest
3657
tests.addTests(doctest.DocTestSuite())
3658
return tests
3356
3659
3357
3660
if __name__ == '__main__':
3358
main()
3661
try:
3662
if should_only_run_tests():
3663
# Call using ./mandos --check [--verbose]
3664
unittest.main()
3665
else:
3666
main()
3667
finally:
3668
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0