To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1221
- compare with another revision
- download diff
- download tarball
- view history from revision 1221
- Committer: teddy at recompile
- Date: 2020-11-29 21:54:00 UTC
- Revision ID: teddy@recompile.se-20201129215400-1zkzmiadisa8whx2
Change URL of systemd "Password Agents" specification
The URL of the systemd "Password Agents" specification changed from
<https://www.freedesktop.org/wiki/Software/systemd/PasswordAgents> to
<https://systemd.io/PASSWORD_AGENTS/>.
* dracut-module/password-agent.c: Change URL in code comments.
* dracut-module/password-agent.xml: Change URL.
* intro.xml (SYSTEMD): - '' -
The URL of the systemd "Password Agents" specification changed from
<https://www.freedesktop.org/wiki/Software/systemd/PasswordAgents> to
<https://systemd.io/PASSWORD_AGENTS/>.
* dracut-module/password-agent.c: Change URL in code comments.
* dracut-module/password-agent.xml: Change URL.
* intro.xml (SYSTEMD): - '' -
- files added:
- bugs.xml
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
73
77
import itertools
74
78
import collections
75
79
import codecs
80
import unittest
81
import random
82
import shlex
76
83
77
84
import dbus
78
85
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
86
import gi
87
from gi.repository import GLib
84
88
from dbus.mainloop.glib import DBusGMainLoop
85
89
import ctypes
86
90
import ctypes.util
87
91
import xml.dom.minidom
88
92
import inspect
89
93
90
try:
94
if sys.version_info.major == 2:
95
__metaclass__ = type
96
str = unicode
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
91
122
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
123
except AttributeError:
93
124
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
94
127
from IN import SO_BINDTODEVICE
95
128
except ImportError:
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.12"
102
147
stored_state_file = "clients.pickle"
103
148
104
149
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
105
151
syslogger = None
106
152
107
153
try:
108
154
if_nametoindex = ctypes.cdll.LoadLibrary(
109
155
ctypes.util.find_library("c")).if_nametoindex
110
156
except (OSError, AttributeError):
111
157
112
158
def if_nametoindex(interface):
113
159
"Get an interface index the hard way, i.e. using fcntl()"
114
160
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
165
return interface_index
120
166
121
167
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
122
184
def initlogger(debug, level=logging.WARNING):
123
185
"""init logger and add loglevel"""
124
186
125
187
global syslogger
126
188
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
129
191
syslogger.setFormatter(logging.Formatter
130
192
('Mandos [%(process)d]: %(levelname)s:'
131
193
' %(message)s'))
132
194
logger.addHandler(syslogger)
133
195
134
196
if debug:
135
197
console = logging.StreamHandler()
136
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
208
pass
147
209
148
210
149
class PGPEngine(object):
211
class PGPEngine:
150
212
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
213
152
214
def __init__(self):
153
215
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
216
self.gpg = "gpg"
217
try:
218
output = subprocess.check_output(["gpgconf"])
219
for line in output.splitlines():
220
name, text, path = line.split(b":")
221
if name == b"gpg":
222
self.gpg = path
223
break
224
except OSError as e:
225
if e.errno != errno.ENOENT:
226
raise
154
227
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
228
'--homedir', self.tempdir,
156
229
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
230
'--quiet']
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
160
235
def __enter__(self):
161
236
return self
162
237
163
238
def __exit__(self, exc_type, exc_value, traceback):
164
239
self._cleanup()
165
240
return False
166
241
167
242
def __del__(self):
168
243
self._cleanup()
169
244
170
245
def _cleanup(self):
171
246
if self.tempdir is not None:
172
247
# Delete contents of tempdir
173
248
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
249
topdown=False):
175
250
for filename in files:
176
251
os.remove(os.path.join(root, filename))
177
252
for dirname in dirs:
179
254
# Remove tempdir
180
255
os.rmdir(self.tempdir)
181
256
self.tempdir = None
182
257
183
258
def password_encode(self, password):
184
259
# Passphrase can not be empty and can not contain newlines or
185
260
# NUL bytes. So we prefix it and hex encode it.
190
265
.replace(b"\n", b"\\n")
191
266
.replace(b"\0", b"\\x00"))
192
267
return encoded
193
268
194
269
def encrypt(self, data, password):
195
270
passphrase = self.password_encode(password)
196
271
with tempfile.NamedTemporaryFile(
197
272
dir=self.tempdir) as passfile:
198
273
passfile.write(passphrase)
199
274
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
275
proc = subprocess.Popen([self.gpg, '--symmetric',
201
276
'--passphrase-file',
202
277
passfile.name]
203
278
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
208
283
if proc.returncode != 0:
209
284
raise PGPError(err)
210
285
return ciphertext
211
286
212
287
def decrypt(self, data, password):
213
288
passphrase = self.password_encode(password)
214
289
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
290
dir=self.tempdir) as passfile:
216
291
passfile.write(passphrase)
217
292
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
293
proc = subprocess.Popen([self.gpg, '--decrypt',
219
294
'--passphrase-file',
220
295
passfile.name]
221
296
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
226
301
if proc.returncode != 0:
227
302
raise PGPError(err)
228
303
return decrypted_plaintext
229
304
230
305
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
231
332
class AvahiError(Exception):
232
333
def __init__(self, value, *args, **kwargs):
233
334
self.value = value
243
344
pass
244
345
245
346
246
class AvahiService(object):
347
class AvahiService:
247
348
"""An Avahi (Zeroconf) service.
248
349
249
350
Attributes:
250
351
interface: integer; avahi.IF_UNSPEC or an interface index.
251
352
Used to optionally bind to the specified interface.
263
364
server: D-Bus Server
264
365
bus: dbus.SystemBus()
265
366
"""
266
367
267
368
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
278
379
self.interface = interface
279
380
self.name = name
280
381
self.type = servicetype
289
390
self.server = None
290
391
self.bus = bus
291
392
self.entry_group_state_changed_match = None
292
393
293
394
def rename(self, remove=True):
294
395
"""Derived from the Avahi example code"""
295
396
if self.rename_count >= self.max_renames:
315
416
logger.critical("D-Bus Exception", exc_info=error)
316
417
self.cleanup()
317
418
os._exit(1)
318
419
319
420
def remove(self):
320
421
"""Derived from the Avahi example code"""
321
422
if self.entry_group_state_changed_match is not None:
323
424
self.entry_group_state_changed_match = None
324
425
if self.group is not None:
325
426
self.group.Reset()
326
427
327
428
def add(self):
328
429
"""Derived from the Avahi example code"""
329
430
self.remove()
346
447
dbus.UInt16(self.port),
347
448
avahi.string_array_to_txt_array(self.TXT))
348
449
self.group.Commit()
349
450
350
451
def entry_group_state_changed(self, state, error):
351
452
"""Derived from the Avahi example code"""
352
453
logger.debug("Avahi entry group state change: %i", state)
353
454
354
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
456
logger.debug("Zeroconf service established.")
356
457
elif state == avahi.ENTRY_GROUP_COLLISION:
360
461
logger.critical("Avahi: Error in group state changed %s",
361
462
str(error))
362
463
raise AvahiGroupError("State changed: {!s}".format(error))
363
464
364
465
def cleanup(self):
365
466
"""Derived from the Avahi example code"""
366
467
if self.group is not None:
371
472
pass
372
473
self.group = None
373
474
self.remove()
374
475
375
476
def server_state_changed(self, state, error=None):
376
477
"""Derived from the Avahi example code"""
377
478
logger.debug("Avahi server state change: %i", state)
406
507
logger.debug("Unknown state: %r", state)
407
508
else:
408
509
logger.debug("Unknown state: %r: %r", state, error)
409
510
410
511
def activate(self):
411
512
"""Derived from the Avahi example code"""
412
513
if self.server is None:
423
524
class AvahiServiceToSyslog(AvahiService):
424
525
def rename(self, *args, **kwargs):
425
526
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
**kwargs)
427
529
syslogger.setFormatter(logging.Formatter(
428
530
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
531
.format(self.name)))
430
532
return ret
431
533
534
432
535
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
536
class gnutls:
537
"""This isn't so much a class as it is a module-like namespace."""
538
539
library = ctypes.util.find_library("gnutls")
540
if library is None:
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
543
del library
544
448
545
# Unless otherwise indicated, the constants and types below are
449
546
# all from the gnutls/gnutls.h C header file.
450
547
451
548
# Constants
452
549
E_SUCCESS = 0
453
550
E_INTERRUPTED = -52
454
551
E_AGAIN = -28
455
552
CRT_OPENPGP = 2
553
CRT_RAWPK = 3
456
554
CLIENT = 2
457
555
SHUT_RDWR = 0
458
556
CRD_CERTIFICATE = 1
459
557
E_NO_CERTIFICATE_FOUND = -49
558
X509_FMT_DER = 0
559
NO_TICKETS = 1<<10
560
ENABLE_RAWPK = 1<<18
561
CTYPE_PEERS = 3
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
460
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
564
462
565
# Types
463
566
class session_int(ctypes.Structure):
464
567
_fields_ = []
465
568
session_t = ctypes.POINTER(session_int)
569
466
570
class certificate_credentials_st(ctypes.Structure):
467
571
_fields_ = []
468
572
certificate_credentials_t = ctypes.POINTER(
469
573
certificate_credentials_st)
470
574
certificate_type_t = ctypes.c_int
575
471
576
class datum_t(ctypes.Structure):
472
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
578
('size', ctypes.c_uint)]
579
474
580
class openpgp_crt_int(ctypes.Structure):
475
581
_fields_ = []
476
582
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
585
credentials_type_t = ctypes.c_int
480
586
transport_ptr_t = ctypes.c_void_p
481
587
close_request_t = ctypes.c_int
482
588
483
589
# Exceptions
484
590
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
591
def __init__(self, message=None, code=None, args=()):
490
592
# Default usage is by a message string, but if a return
491
593
# code is passed, convert it to a string with
492
594
# gnutls.strerror()
493
595
self.code = code
494
596
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
597
message = gnutls.strerror(code)
598
return super(gnutls.Error, self).__init__(
497
599
message, *args)
498
600
499
601
class CertificateSecurityError(Error):
500
602
pass
501
603
502
604
# Classes
503
class Credentials(object):
605
class Credentials:
504
606
def __init__(self):
505
607
self._c_object = gnutls.certificate_credentials_t()
506
608
gnutls.certificate_allocate_credentials(
507
609
ctypes.byref(self._c_object))
508
610
self.type = gnutls.CRD_CERTIFICATE
509
611
510
612
def __del__(self):
511
613
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
614
615
class ClientSession:
616
def __init__(self, socket, credentials=None):
515
617
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
618
gnutls_flags = gnutls.CLIENT
619
if gnutls.check_version(b"3.5.6"):
620
gnutls_flags |= gnutls.NO_TICKETS
621
if gnutls.has_rawpk:
622
gnutls_flags |= gnutls.ENABLE_RAWPK
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
624
del gnutls_flags
517
625
gnutls.set_default_priority(self._c_object)
518
626
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
627
gnutls.handshake_set_private_extensions(self._c_object,
525
633
ctypes.cast(credentials._c_object,
526
634
ctypes.c_void_p))
527
635
self.credentials = credentials
528
636
529
637
def __del__(self):
530
638
gnutls.deinit(self._c_object)
531
639
532
640
def handshake(self):
533
641
return gnutls.handshake(self._c_object)
534
642
535
643
def send(self, data):
536
644
data = bytes(data)
537
645
data_len = len(data)
539
647
data_len -= gnutls.record_send(self._c_object,
540
648
data[-data_len:],
541
649
data_len)
542
650
543
651
def bye(self):
544
652
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
653
546
654
# Error handling functions
547
655
def _error_code(result):
548
656
"""A function to raise exceptions on errors, suitable
550
658
if result >= 0:
551
659
return result
552
660
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
661
raise gnutls.CertificateSecurityError(code=result)
662
raise gnutls.Error(code=result)
663
556
664
def _retry_on_error(result, func, arguments):
557
665
"""A function to retry on some errors, suitable
558
666
for the 'errcheck' attribute on ctypes functions"""
561
669
return _error_code(result)
562
670
result = func(*arguments)
563
671
return result
564
672
565
673
# Unless otherwise indicated, the function declarations below are
566
674
# all from the gnutls/gnutls.h C header file.
567
675
568
676
# Functions
569
677
priority_set_direct = _library.gnutls_priority_set_direct
570
678
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
679
ctypes.POINTER(ctypes.c_char_p)]
572
680
priority_set_direct.restype = _error_code
573
681
574
682
init = _library.gnutls_init
575
683
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
684
init.restype = _error_code
577
685
578
686
set_default_priority = _library.gnutls_set_default_priority
579
687
set_default_priority.argtypes = [session_t]
580
688
set_default_priority.restype = _error_code
581
689
582
690
record_send = _library.gnutls_record_send
583
691
record_send.argtypes = [session_t, ctypes.c_void_p,
584
692
ctypes.c_size_t]
585
693
record_send.restype = ctypes.c_ssize_t
586
694
record_send.errcheck = _retry_on_error
587
695
588
696
certificate_allocate_credentials = (
589
697
_library.gnutls_certificate_allocate_credentials)
590
698
certificate_allocate_credentials.argtypes = [
591
699
ctypes.POINTER(certificate_credentials_t)]
592
700
certificate_allocate_credentials.restype = _error_code
593
701
594
702
certificate_free_credentials = (
595
703
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
704
certificate_free_credentials.argtypes = [
705
certificate_credentials_t]
597
706
certificate_free_credentials.restype = None
598
707
599
708
handshake_set_private_extensions = (
600
709
_library.gnutls_handshake_set_private_extensions)
601
710
handshake_set_private_extensions.argtypes = [session_t,
602
711
ctypes.c_int]
603
712
handshake_set_private_extensions.restype = None
604
713
605
714
credentials_set = _library.gnutls_credentials_set
606
715
credentials_set.argtypes = [session_t, credentials_type_t,
607
716
ctypes.c_void_p]
608
717
credentials_set.restype = _error_code
609
718
610
719
strerror = _library.gnutls_strerror
611
720
strerror.argtypes = [ctypes.c_int]
612
721
strerror.restype = ctypes.c_char_p
613
722
614
723
certificate_type_get = _library.gnutls_certificate_type_get
615
724
certificate_type_get.argtypes = [session_t]
616
725
certificate_type_get.restype = _error_code
617
726
618
727
certificate_get_peers = _library.gnutls_certificate_get_peers
619
728
certificate_get_peers.argtypes = [session_t,
620
729
ctypes.POINTER(ctypes.c_uint)]
621
730
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
731
623
732
global_set_log_level = _library.gnutls_global_set_log_level
624
733
global_set_log_level.argtypes = [ctypes.c_int]
625
734
global_set_log_level.restype = None
626
735
627
736
global_set_log_function = _library.gnutls_global_set_log_function
628
737
global_set_log_function.argtypes = [log_func]
629
738
global_set_log_function.restype = None
630
739
631
740
deinit = _library.gnutls_deinit
632
741
deinit.argtypes = [session_t]
633
742
deinit.restype = None
634
743
635
744
handshake = _library.gnutls_handshake
636
745
handshake.argtypes = [session_t]
637
746
handshake.restype = _error_code
638
747
handshake.errcheck = _retry_on_error
639
748
640
749
transport_set_ptr = _library.gnutls_transport_set_ptr
641
750
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
751
transport_set_ptr.restype = None
643
752
644
753
bye = _library.gnutls_bye
645
754
bye.argtypes = [session_t, close_request_t]
646
755
bye.restype = _error_code
647
756
bye.errcheck = _retry_on_error
648
757
649
758
check_version = _library.gnutls_check_version
650
759
check_version.argtypes = [ctypes.c_char_p]
651
760
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
761
762
_need_version = b"3.3.0"
763
if check_version(_need_version) is None:
764
raise self.Error("Needs GnuTLS {} or later"
765
.format(_need_version))
766
767
_tls_rawpk_version = b"3.6.6"
768
has_rawpk = bool(check_version(_tls_rawpk_version))
769
770
if has_rawpk:
771
# Types
772
class pubkey_st(ctypes.Structure):
773
_fields = []
774
pubkey_t = ctypes.POINTER(pubkey_st)
775
776
x509_crt_fmt_t = ctypes.c_int
777
778
# All the function declarations below are from
779
# gnutls/abstract.h
780
pubkey_init = _library.gnutls_pubkey_init
781
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
782
pubkey_init.restype = _error_code
783
784
pubkey_import = _library.gnutls_pubkey_import
785
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
786
x509_crt_fmt_t]
787
pubkey_import.restype = _error_code
788
789
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
790
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
791
ctypes.POINTER(ctypes.c_ubyte),
792
ctypes.POINTER(ctypes.c_size_t)]
793
pubkey_get_key_id.restype = _error_code
794
795
pubkey_deinit = _library.gnutls_pubkey_deinit
796
pubkey_deinit.argtypes = [pubkey_t]
797
pubkey_deinit.restype = None
798
else:
799
# All the function declarations below are from
800
# gnutls/openpgp.h
801
802
openpgp_crt_init = _library.gnutls_openpgp_crt_init
803
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
804
openpgp_crt_init.restype = _error_code
805
806
openpgp_crt_import = _library.gnutls_openpgp_crt_import
807
openpgp_crt_import.argtypes = [openpgp_crt_t,
808
ctypes.POINTER(datum_t),
809
openpgp_crt_fmt_t]
810
openpgp_crt_import.restype = _error_code
811
812
openpgp_crt_verify_self = \
813
_library.gnutls_openpgp_crt_verify_self
814
openpgp_crt_verify_self.argtypes = [
815
openpgp_crt_t,
816
ctypes.c_uint,
817
ctypes.POINTER(ctypes.c_uint),
818
]
819
openpgp_crt_verify_self.restype = _error_code
820
821
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
822
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
823
openpgp_crt_deinit.restype = None
824
825
openpgp_crt_get_fingerprint = (
826
_library.gnutls_openpgp_crt_get_fingerprint)
827
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
828
ctypes.c_void_p,
829
ctypes.POINTER(
830
ctypes.c_size_t)]
831
openpgp_crt_get_fingerprint.restype = _error_code
832
833
if check_version(b"3.6.4"):
834
certificate_type_get2 = _library.gnutls_certificate_type_get2
835
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
836
certificate_type_get2.restype = _error_code
837
682
838
# Remove non-public functions
683
839
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
840
686
841
687
842
def call_pipe(connection, # : multiprocessing.Connection
688
843
func, *args, **kwargs):
689
844
"""This function is meant to be called by multiprocessing.Process
690
845
691
846
This function runs func(*args, **kwargs), and writes the resulting
692
847
return value on the provided multiprocessing.Connection.
693
848
"""
694
849
connection.send(func(*args, **kwargs))
695
850
connection.close()
696
851
697
class Client(object):
852
853
class Client:
698
854
"""A representation of a client host served by this server.
699
855
700
856
Attributes:
701
857
approved: bool(); 'None' if not yet approved/disapproved
702
858
approval_delay: datetime.timedelta(); Time to wait for approval
703
859
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
860
checker: multiprocessing.Process(); a running checker process used
861
to see if the client lives. 'None' if no process is
862
running.
863
checker_callback_tag: a GLib event source tag, or None
708
864
checker_command: string; External command which is run to check
709
865
if client lives. %() expansions are done at
710
866
runtime with vars(self) as dict, so that for
711
867
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
868
checker_initiator_tag: a GLib event source tag, or None
713
869
created: datetime.datetime(); (UTC) object creation
714
870
client_structure: Object describing what attributes a client has
715
871
and is used for storing the client at exit
716
872
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
873
disable_initiator_tag: a GLib event source tag, or None
718
874
enabled: bool()
719
875
fingerprint: string (40 or 32 hexadecimal digits); used to
720
uniquely identify the client
876
uniquely identify an OpenPGP client
877
key_id: string (64 hexadecimal digits); used to uniquely identify
878
a client using raw public keys
721
879
host: string; available for use by the checker command
722
880
interval: datetime.timedelta(); How often to start a new checker
723
881
last_approval_request: datetime.datetime(); (UTC) or None
739
897
disabled, or None
740
898
server_settings: The server_settings dict from main()
741
899
"""
742
900
743
901
runtime_expansions = ("approval_delay", "approval_duration",
744
"created", "enabled", "expires",
902
"created", "enabled", "expires", "key_id",
745
903
"fingerprint", "host", "interval",
746
904
"last_approval_request", "last_checked_ok",
747
905
"last_enabled", "name", "timeout")
756
914
"approved_by_default": "True",
757
915
"enabled": "True",
758
916
}
759
917
760
918
@staticmethod
761
919
def config_parser(config):
762
920
"""Construct a new dict of client settings of this form:
769
927
for client_name in config.sections():
770
928
section = dict(config.items(client_name))
771
929
client = settings[client_name] = {}
772
930
773
931
client["host"] = section["host"]
774
932
# Reformat values from string types to Python types
775
933
client["approved_by_default"] = config.getboolean(
776
934
client_name, "approved_by_default")
777
935
client["enabled"] = config.getboolean(client_name,
778
936
"enabled")
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
937
938
# Uppercase and remove spaces from key_id and fingerprint
939
# for later comparison purposes with return value from the
940
# key_id() and fingerprint() functions
941
client["key_id"] = (section.get("key_id", "").upper()
942
.replace(" ", ""))
783
943
client["fingerprint"] = (section["fingerprint"].upper()
784
944
.replace(" ", ""))
785
945
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
946
client["secret"] = codecs.decode(section["secret"]
947
.encode("utf-8"),
948
"base64")
787
949
elif "secfile" in section:
788
950
with open(os.path.expanduser(os.path.expandvars
789
951
(section["secfile"])),
804
966
client["last_approval_request"] = None
805
967
client["last_checked_ok"] = None
806
968
client["last_checker_status"] = -2
807
969
808
970
return settings
809
810
def __init__(self, settings, name = None, server_settings=None):
971
972
def __init__(self, settings, name=None, server_settings=None):
811
973
self.name = name
812
974
if server_settings is None:
813
975
server_settings = {}
815
977
# adding all client settings
816
978
for setting, value in settings.items():
817
979
setattr(self, setting, value)
818
980
819
981
if self.enabled:
820
982
if not hasattr(self, "last_enabled"):
821
983
self.last_enabled = datetime.datetime.utcnow()
825
987
else:
826
988
self.last_enabled = None
827
989
self.expires = None
828
990
829
991
logger.debug("Creating client %r", self.name)
992
logger.debug(" Key ID: %s", self.key_id)
830
993
logger.debug(" Fingerprint: %s", self.fingerprint)
831
994
self.created = settings.get("created",
832
995
datetime.datetime.utcnow())
833
996
834
997
# attributes specific for this server instance
835
998
self.checker = None
836
999
self.checker_initiator_tag = None
842
1005
self.changedstate = multiprocessing_manager.Condition(
843
1006
multiprocessing_manager.Lock())
844
1007
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
1008
for attr in self.__dict__.keys()
846
1009
if not attr.startswith("_")]
847
1010
self.client_structure.append("client_structure")
848
1011
849
1012
for name, t in inspect.getmembers(
850
1013
type(self), lambda obj: isinstance(obj, property)):
851
1014
if not name.startswith("_"):
852
1015
self.client_structure.append(name)
853
1016
854
1017
# Send notice to process children that client state has changed
855
1018
def send_changedstate(self):
856
1019
with self.changedstate:
857
1020
self.changedstate.notify_all()
858
1021
859
1022
def enable(self):
860
1023
"""Start this client's checker and timeout hooks"""
861
1024
if getattr(self, "enabled", False):
866
1029
self.last_enabled = datetime.datetime.utcnow()
867
1030
self.init_checker()
868
1031
self.send_changedstate()
869
1032
870
1033
def disable(self, quiet=True):
871
1034
"""Disable this client."""
872
1035
if not getattr(self, "enabled", False):
874
1037
if not quiet:
875
1038
logger.info("Disabling client %s", self.name)
876
1039
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
1040
GLib.source_remove(self.disable_initiator_tag)
878
1041
self.disable_initiator_tag = None
879
1042
self.expires = None
880
1043
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
1044
GLib.source_remove(self.checker_initiator_tag)
882
1045
self.checker_initiator_tag = None
883
1046
self.stop_checker()
884
1047
self.enabled = False
885
1048
if not quiet:
886
1049
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
1050
# Do not run this again if called by a GLib.timeout_add
888
1051
return False
889
1052
890
1053
def __del__(self):
891
1054
self.disable()
892
1055
893
1056
def init_checker(self):
894
1057
# Schedule a new checker to be started an 'interval' from now,
895
1058
# and every interval from then on.
896
1059
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
1060
GLib.source_remove(self.checker_initiator_tag)
1061
self.checker_initiator_tag = GLib.timeout_add(
1062
random.randrange(int(self.interval.total_seconds() * 1000
1063
+ 1)),
900
1064
self.start_checker)
901
1065
# Schedule a disable() when 'timeout' has passed
902
1066
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
1067
GLib.source_remove(self.disable_initiator_tag)
1068
self.disable_initiator_tag = GLib.timeout_add(
905
1069
int(self.timeout.total_seconds() * 1000), self.disable)
906
1070
# Also start a new checker *right now*.
907
1071
self.start_checker()
908
1072
909
1073
def checker_callback(self, source, condition, connection,
910
1074
command):
911
1075
"""The checker has completed, so take appropriate actions."""
912
self.checker_callback_tag = None
913
self.checker = None
914
1076
# Read return code from connection (see call_pipe)
915
1077
returncode = connection.recv()
916
1078
connection.close()
917
1079
if self.checker is not None:
1080
self.checker.join()
1081
self.checker_callback_tag = None
1082
self.checker = None
1083
918
1084
if returncode >= 0:
919
1085
self.last_checker_status = returncode
920
1086
self.last_checker_signal = None
930
1096
logger.warning("Checker for %(name)s crashed?",
931
1097
vars(self))
932
1098
return False
933
1099
934
1100
def checked_ok(self):
935
1101
"""Assert that the client has been seen, alive and well."""
936
1102
self.last_checked_ok = datetime.datetime.utcnow()
937
1103
self.last_checker_status = 0
938
1104
self.last_checker_signal = None
939
1105
self.bump_timeout()
940
1106
941
1107
def bump_timeout(self, timeout=None):
942
1108
"""Bump up the timeout for this client."""
943
1109
if timeout is None:
944
1110
timeout = self.timeout
945
1111
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1112
GLib.source_remove(self.disable_initiator_tag)
947
1113
self.disable_initiator_tag = None
948
1114
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1115
self.disable_initiator_tag = GLib.timeout_add(
950
1116
int(timeout.total_seconds() * 1000), self.disable)
951
1117
self.expires = datetime.datetime.utcnow() + timeout
952
1118
953
1119
def need_approval(self):
954
1120
self.last_approval_request = datetime.datetime.utcnow()
955
1121
956
1122
def start_checker(self):
957
1123
"""Start a new checker subprocess if one is not running.
958
1124
959
1125
If a checker already exists, leave it running and do
960
1126
nothing."""
961
1127
# The reason for not killing a running checker is that if we
966
1132
# checkers alone, the checker would have to take more time
967
1133
# than 'timeout' for the client to be disabled, which is as it
968
1134
# should be.
969
1135
970
1136
if self.checker is not None and not self.checker.is_alive():
971
1137
logger.warning("Checker was not alive; joining")
972
1138
self.checker.join()
975
1141
if self.checker is None:
976
1142
# Escape attributes for the shell
977
1143
escaped_attrs = {
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
1144
attr: shlex.quote(str(getattr(self, attr)))
1145
for attr in self.runtime_expansions}
980
1146
try:
981
1147
command = self.checker_command % escaped_attrs
982
1148
except TypeError as error:
994
1160
# The exception is when not debugging but nevertheless
995
1161
# running in the foreground; use the previously
996
1162
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1163
popen_args = {"close_fds": True,
1164
"shell": True,
1165
"cwd": "/"}
1000
1166
if (not self.server_settings["debug"]
1001
1167
and self.server_settings["foreground"]):
1002
1168
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1169
"stderr": wnull})
1170
pipe = multiprocessing.Pipe(duplex=False)
1005
1171
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1172
target=call_pipe,
1173
args=(pipe[1], subprocess.call, command),
1174
kwargs=popen_args)
1009
1175
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1176
self.checker_callback_tag = GLib.io_add_watch(
1177
GLib.IOChannel.unix_new(pipe[0].fileno()),
1178
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1012
1179
self.checker_callback, pipe[0], command)
1013
# Re-run this periodically if run by gobject.timeout_add
1180
# Re-run this periodically if run by GLib.timeout_add
1014
1181
return True
1015
1182
1016
1183
def stop_checker(self):
1017
1184
"""Force the checker process, if any, to stop."""
1018
1185
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1186
GLib.source_remove(self.checker_callback_tag)
1020
1187
self.checker_callback_tag = None
1021
1188
if getattr(self, "checker", None) is None:
1022
1189
return
1031
1198
byte_arrays=False):
1032
1199
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
1200
become properties on the D-Bus.
1034
1201
1035
1202
The decorated method will be called with no arguments by "Get"
1036
1203
and with one argument by "Set".
1037
1204
1038
1205
The parameters, where they are supported, are the same as
1039
1206
dbus.service.method, except there is only "signature", since the
1040
1207
type from Get() and the type sent to Set() is the same.
1044
1211
if byte_arrays and signature != "ay":
1045
1212
raise ValueError("Byte arrays not supported for non-'ay'"
1046
1213
" signature {!r}".format(signature))
1047
1214
1048
1215
def decorator(func):
1049
1216
func._dbus_is_property = True
1050
1217
func._dbus_interface = dbus_interface
1053
1220
func._dbus_name = func.__name__
1054
1221
if func._dbus_name.endswith("_dbus_property"):
1055
1222
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1223
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1057
1224
return func
1058
1225
1059
1226
return decorator
1060
1227
1061
1228
1062
1229
def dbus_interface_annotations(dbus_interface):
1063
1230
"""Decorator for marking functions returning interface annotations
1064
1231
1065
1232
Usage:
1066
1233
1067
1234
@dbus_interface_annotations("org.example.Interface")
1068
1235
def _foo(self): # Function name does not matter
1069
1236
return {"org.freedesktop.DBus.Deprecated": "true",
1070
1237
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
1238
"false"}
1072
1239
"""
1073
1240
1074
1241
def decorator(func):
1075
1242
func._dbus_is_interface = True
1076
1243
func._dbus_interface = dbus_interface
1077
1244
func._dbus_name = dbus_interface
1078
1245
return func
1079
1246
1080
1247
return decorator
1081
1248
1082
1249
1083
1250
def dbus_annotations(annotations):
1084
1251
"""Decorator to annotate D-Bus methods, signals or properties
1085
1252
Usage:
1086
1253
1087
1254
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
1255
"org.freedesktop.DBus.Property."
1089
1256
"EmitsChangedSignal": "false"})
1091
1258
access="r")
1092
1259
def Property_dbus_property(self):
1093
1260
return dbus.Boolean(False)
1094
1261
1095
1262
See also the DBusObjectWithAnnotations class.
1096
1263
"""
1097
1264
1098
1265
def decorator(func):
1099
1266
func._dbus_annotations = annotations
1100
1267
return func
1101
1268
1102
1269
return decorator
1103
1270
1104
1271
1122
1289
1123
1290
class DBusObjectWithAnnotations(dbus.service.Object):
1124
1291
"""A D-Bus object with annotations.
1125
1292
1126
1293
Classes inheriting from this can use the dbus_annotations
1127
1294
decorator to add annotations to methods or signals.
1128
1295
"""
1129
1296
1130
1297
@staticmethod
1131
1298
def _is_dbus_thing(thing):
1132
1299
"""Returns a function testing if an attribute is a D-Bus thing
1133
1300
1134
1301
If called like _is_dbus_thing("method") it returns a function
1135
1302
suitable for use as predicate to inspect.getmembers().
1136
1303
"""
1137
1304
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1138
1305
False)
1139
1306
1140
1307
def _get_all_dbus_things(self, thing):
1141
1308
"""Returns a generator of (name, attribute) pairs
1142
1309
"""
1145
1312
for cls in self.__class__.__mro__
1146
1313
for name, athing in
1147
1314
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1315
1149
1316
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1317
out_signature="s",
1318
path_keyword='object_path',
1319
connection_keyword='connection')
1153
1320
def Introspect(self, object_path, connection):
1154
1321
"""Overloading of standard D-Bus method.
1155
1322
1156
1323
Inserts annotation tags on methods and signals.
1157
1324
"""
1158
1325
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
1326
connection)
1160
1327
try:
1161
1328
document = xml.dom.minidom.parseString(xmlstring)
1162
1329
1163
1330
for if_tag in document.getElementsByTagName("interface"):
1164
1331
# Add annotation tags
1165
1332
for typ in ("method", "signal"):
1192
1359
if_tag.appendChild(ann_tag)
1193
1360
# Fix argument name for the Introspect method itself
1194
1361
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1362
== dbus.INTROSPECTABLE_IFACE):
1196
1363
for cn in if_tag.getElementsByTagName("method"):
1197
1364
if cn.getAttribute("name") == "Introspect":
1198
1365
for arg in cn.getElementsByTagName("arg"):
1211
1378
1212
1379
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
1380
"""A D-Bus object with properties.
1214
1381
1215
1382
Classes inheriting from this can use the dbus_service_property
1216
1383
decorator to expose methods as D-Bus properties. It exposes the
1217
1384
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
1385
"""
1219
1386
1220
1387
def _get_dbus_property(self, interface_name, property_name):
1221
1388
"""Returns a bound method if one exists which is a D-Bus
1222
1389
property with the specified name and interface.
1227
1394
if (value._dbus_name == property_name
1228
1395
and value._dbus_interface == interface_name):
1229
1396
return value.__get__(self)
1230
1397
1231
1398
# No such property
1232
1399
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
1400
self.dbus_object_path, interface_name, property_name))
1234
1401
1235
1402
@classmethod
1236
1403
def _get_all_interface_names(cls):
1237
1404
"""Get a sequence of all interfaces supported by an object"""
1240
1407
for x in (inspect.getmro(cls))
1241
1408
for attr in dir(x))
1242
1409
if name is not None)
1243
1410
1244
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
1412
in_signature="ss",
1246
1413
out_signature="v")
1254
1421
if not hasattr(value, "variant_level"):
1255
1422
return value
1256
1423
return type(value)(value, variant_level=value.variant_level+1)
1257
1424
1258
1425
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
1426
def Set(self, interface_name, property_name, value):
1260
1427
"""Standard D-Bus property Set() method, see D-Bus standard.
1269
1436
raise ValueError("Byte arrays not supported for non-"
1270
1437
"'ay' signature {!r}"
1271
1438
.format(prop._dbus_signature))
1272
value = dbus.ByteArray(b''.join(chr(byte)
1273
for byte in value))
1439
value = dbus.ByteArray(bytes(value))
1274
1440
prop(value)
1275
1441
1276
1442
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
1443
in_signature="s",
1278
1444
out_signature="a{sv}")
1279
1445
def GetAll(self, interface_name):
1280
1446
"""Standard D-Bus property GetAll() method, see D-Bus
1281
1447
standard.
1282
1448
1283
1449
Note: Will not include properties with access="write".
1284
1450
"""
1285
1451
properties = {}
1296
1462
properties[name] = value
1297
1463
continue
1298
1464
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1465
value, variant_level=value.variant_level + 1)
1300
1466
return dbus.Dictionary(properties, signature="sv")
1301
1467
1302
1468
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
1469
def PropertiesChanged(self, interface_name, changed_properties,
1304
1470
invalidated_properties):
1306
1472
standard.
1307
1473
"""
1308
1474
pass
1309
1475
1310
1476
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
1477
out_signature="s",
1312
1478
path_keyword='object_path',
1313
1479
connection_keyword='connection')
1314
1480
def Introspect(self, object_path, connection):
1315
1481
"""Overloading of standard D-Bus method.
1316
1482
1317
1483
Inserts property tags and interface annotation tags.
1318
1484
"""
1319
1485
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1321
1487
connection)
1322
1488
try:
1323
1489
document = xml.dom.minidom.parseString(xmlstring)
1324
1490
1325
1491
def make_tag(document, name, prop):
1326
1492
e = document.createElement("property")
1327
1493
e.setAttribute("name", name)
1328
1494
e.setAttribute("type", prop._dbus_signature)
1329
1495
e.setAttribute("access", prop._dbus_access)
1330
1496
return e
1331
1497
1332
1498
for if_tag in document.getElementsByTagName("interface"):
1333
1499
# Add property tags
1334
1500
for tag in (make_tag(document, name, prop)
1376
1542
exc_info=error)
1377
1543
return xmlstring
1378
1544
1545
1379
1546
try:
1380
1547
dbus.OBJECT_MANAGER_IFACE
1381
1548
except AttributeError:
1382
1549
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1550
1551
1384
1552
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1553
"""A D-Bus object with an ObjectManager.
1386
1554
1387
1555
Classes inheriting from this exposes the standard
1388
1556
GetManagedObjects call and the InterfacesAdded and
1389
1557
InterfacesRemoved signals on the standard
1390
1558
"org.freedesktop.DBus.ObjectManager" interface.
1391
1559
1392
1560
Note: No signals are sent automatically; they must be sent
1393
1561
manually.
1394
1562
"""
1395
1563
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1564
out_signature="a{oa{sa{sv}}}")
1397
1565
def GetManagedObjects(self):
1398
1566
"""This function must be overridden"""
1399
1567
raise NotImplementedError()
1400
1568
1401
1569
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1570
signature="oa{sa{sv}}")
1403
1571
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
1572
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1573
1574
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1575
def InterfacesRemoved(self, object_path, interfaces):
1408
1576
pass
1409
1577
1410
1578
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1579
out_signature="s",
1580
path_keyword='object_path',
1581
connection_keyword='connection')
1414
1582
def Introspect(self, object_path, connection):
1415
1583
"""Overloading of standard D-Bus method.
1416
1584
1417
1585
Override return argument name of GetManagedObjects to be
1418
1586
"objpath_interfaces_and_properties"
1419
1587
"""
1422
1590
connection)
1423
1591
try:
1424
1592
document = xml.dom.minidom.parseString(xmlstring)
1425
1593
1426
1594
for if_tag in document.getElementsByTagName("interface"):
1427
1595
# Fix argument name for the GetManagedObjects method
1428
1596
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1597
== dbus.OBJECT_MANAGER_IFACE):
1430
1598
for cn in if_tag.getElementsByTagName("method"):
1431
1599
if (cn.getAttribute("name")
1432
1600
== "GetManagedObjects"):
1442
1610
except (AttributeError, xml.dom.DOMException,
1443
1611
xml.parsers.expat.ExpatError) as error:
1444
1612
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1613
exc_info=error)
1446
1614
return xmlstring
1447
1615
1616
1448
1617
def datetime_to_dbus(dt, variant_level=0):
1449
1618
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1619
if dt is None:
1451
return dbus.String("", variant_level = variant_level)
1620
return dbus.String("", variant_level=variant_level)
1452
1621
return dbus.String(dt.isoformat(), variant_level=variant_level)
1453
1622
1454
1623
1457
1626
dbus.service.Object, it will add alternate D-Bus attributes with
1458
1627
interface names according to the "alt_interface_names" mapping.
1459
1628
Usage:
1460
1629
1461
1630
@alternate_dbus_interfaces({"org.example.Interface":
1462
1631
"net.example.AlternateInterface"})
1463
1632
class SampleDBusObject(dbus.service.Object):
1464
1633
@dbus.service.method("org.example.Interface")
1465
1634
def SampleDBusMethod():
1466
1635
pass
1467
1636
1468
1637
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
1638
reachable via two interfaces: "org.example.Interface" and
1470
1639
"net.example.AlternateInterface", the latter of which will have
1471
1640
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
1641
"true", unless "deprecate" is passed with a False value.
1473
1642
1474
1643
This works for methods and signals, and also for D-Bus properties
1475
1644
(from DBusObjectWithProperties) and interfaces (from the
1476
1645
dbus_interface_annotations decorator).
1477
1646
"""
1478
1647
1479
1648
def wrapper(cls):
1480
1649
for orig_interface_name, alt_interface_name in (
1481
1650
alt_interface_names.items()):
1496
1665
interface_names.add(alt_interface)
1497
1666
# Is this a D-Bus signal?
1498
1667
if getattr(attribute, "_dbus_is_signal", False):
1668
# Extract the original non-method undecorated
1669
# function by black magic
1499
1670
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
1671
nonmethod_func = (dict(
1503
1672
zip(attribute.func_code.co_freevars,
1504
1673
attribute.__closure__))
1505
1674
["func"].cell_contents)
1506
1675
else:
1507
nonmethod_func = attribute
1676
nonmethod_func = (dict(
1677
zip(attribute.__code__.co_freevars,
1678
attribute.__closure__))
1679
["func"].cell_contents)
1508
1680
# Create a new, but exactly alike, function
1509
1681
# object, and decorate it to be a new D-Bus signal
1510
1682
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1683
new_function = copy_function(nonmethod_func)
1525
1684
new_function = (dbus.service.signal(
1526
1685
alt_interface,
1527
1686
attribute._dbus_signature)(new_function))
1531
1690
attribute._dbus_annotations)
1532
1691
except AttributeError:
1533
1692
pass
1693
1534
1694
# Define a creator of a function to call both the
1535
1695
# original and alternate functions, so both the
1536
1696
# original and alternate signals gets sent when
1539
1699
"""This function is a scope container to pass
1540
1700
func1 and func2 to the "call_both" function
1541
1701
outside of its arguments"""
1542
1702
1543
1703
@functools.wraps(func2)
1544
1704
def call_both(*args, **kwargs):
1545
1705
"""This function will emit two D-Bus
1546
1706
signals by calling func1 and func2"""
1547
1707
func1(*args, **kwargs)
1548
1708
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1709
# Make wrapper function look like a D-Bus
1710
# signal
1550
1711
for name, attr in inspect.getmembers(func2):
1551
1712
if name.startswith("_dbus_"):
1552
1713
setattr(call_both, name, attr)
1553
1714
1554
1715
return call_both
1555
1716
# Create the "call_both" function and add it to
1556
1717
# the class
1566
1727
alt_interface,
1567
1728
attribute._dbus_in_signature,
1568
1729
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1730
(copy_function(attribute)))
1574
1731
# Copy annotations, if any
1575
1732
try:
1576
1733
attr[attrname]._dbus_annotations = dict(
1588
1745
attribute._dbus_access,
1589
1746
attribute._dbus_get_args_options
1590
1747
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1748
(copy_function(attribute)))
1597
1749
# Copy annotations, if any
1598
1750
try:
1599
1751
attr[attrname]._dbus_annotations = dict(
1608
1760
# to the class.
1609
1761
attr[attrname] = (
1610
1762
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1763
(copy_function(attribute)))
1616
1764
if deprecate:
1617
1765
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1766
iname = "_AlternateDBusNames_interface_annotation{}"
1619
1767
for interface_name in interface_names:
1620
1768
1621
1769
@dbus_interface_annotations(interface_name)
1622
1770
def func(self):
1623
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1771
return {"org.freedesktop.DBus.Deprecated":
1772
"true"}
1625
1773
# Find an unused name
1626
1774
for aname in (iname.format(i)
1627
1775
for i in itertools.count()):
1631
1779
if interface_names:
1632
1780
# Replace the class with a new subclass of it with
1633
1781
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1782
if sys.version_info.major == 2:
1783
cls = type(b"{}Alternate".format(cls.__name__),
1784
(cls, ), attr)
1785
else:
1786
cls = type("{}Alternate".format(cls.__name__),
1787
(cls, ), attr)
1636
1788
return cls
1637
1789
1638
1790
return wrapper
1639
1791
1640
1792
1642
1794
"se.bsnet.fukt.Mandos"})
1643
1795
class ClientDBus(Client, DBusObjectWithProperties):
1644
1796
"""A Client class using D-Bus
1645
1797
1646
1798
Attributes:
1647
1799
dbus_object_path: dbus.ObjectPath
1648
1800
bus: dbus.SystemBus()
1649
1801
"""
1650
1802
1651
1803
runtime_expansions = (Client.runtime_expansions
1652
1804
+ ("dbus_object_path", ))
1653
1805
1654
1806
_interface = "se.recompile.Mandos.Client"
1655
1807
1656
1808
# dbus.service.Object doesn't use super(), so we can't either.
1657
1658
def __init__(self, bus = None, *args, **kwargs):
1809
1810
def __init__(self, bus=None, *args, **kwargs):
1659
1811
self.bus = bus
1660
1812
Client.__init__(self, *args, **kwargs)
1661
1813
# Only now, when this client is initialized, can it show up on
1667
1819
"/clients/" + client_object_name)
1668
1820
DBusObjectWithProperties.__init__(self, self.bus,
1669
1821
self.dbus_object_path)
1670
1822
1671
1823
def notifychangeproperty(transform_func, dbus_name,
1672
1824
type_func=lambda x: x,
1673
1825
variant_level=1,
1675
1827
_interface=_interface):
1676
1828
""" Modify a variable so that it's a property which announces
1677
1829
its changes to DBus.
1678
1830
1679
1831
transform_fun: Function that takes a value and a variant_level
1680
1832
and transforms it to a D-Bus type.
1681
1833
dbus_name: D-Bus name of the variable
1684
1836
variant_level: D-Bus variant level. Default: 1
1685
1837
"""
1686
1838
attrname = "_{}".format(dbus_name)
1687
1839
1688
1840
def setter(self, value):
1689
1841
if hasattr(self, "dbus_object_path"):
1690
1842
if (not hasattr(self, attrname) or
1697
1849
else:
1698
1850
dbus_value = transform_func(
1699
1851
type_func(value),
1700
variant_level = variant_level)
1852
variant_level=variant_level)
1701
1853
self.PropertyChanged(dbus.String(dbus_name),
1702
1854
dbus_value)
1703
1855
self.PropertiesChanged(
1704
1856
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1857
dbus.Dictionary({dbus.String(dbus_name):
1858
dbus_value}),
1707
1859
dbus.Array())
1708
1860
setattr(self, attrname, value)
1709
1861
1710
1862
return property(lambda self: getattr(self, attrname), setter)
1711
1863
1712
1864
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
1865
approvals_pending = notifychangeproperty(dbus.Boolean,
1714
1866
"ApprovalPending",
1715
type_func = bool)
1867
type_func=bool)
1716
1868
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1869
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1870
"LastEnabled")
1719
1871
checker = notifychangeproperty(
1720
1872
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1873
type_func=lambda checker: checker is not None)
1722
1874
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1875
"LastCheckedOK")
1724
1876
last_checker_status = notifychangeproperty(dbus.Int16,
1729
1881
"ApprovedByDefault")
1730
1882
approval_delay = notifychangeproperty(
1731
1883
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1884
type_func=lambda td: td.total_seconds() * 1000)
1733
1885
approval_duration = notifychangeproperty(
1734
1886
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1887
type_func=lambda td: td.total_seconds() * 1000)
1736
1888
host = notifychangeproperty(dbus.String, "Host")
1737
1889
timeout = notifychangeproperty(
1738
1890
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1891
type_func=lambda td: td.total_seconds() * 1000)
1740
1892
extended_timeout = notifychangeproperty(
1741
1893
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1894
type_func=lambda td: td.total_seconds() * 1000)
1743
1895
interval = notifychangeproperty(
1744
1896
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1897
type_func=lambda td: td.total_seconds() * 1000)
1746
1898
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
1899
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
1900
invalidate_only=True)
1749
1901
1750
1902
del notifychangeproperty
1751
1903
1752
1904
def __del__(self, *args, **kwargs):
1753
1905
try:
1754
1906
self.remove_from_connection()
1757
1909
if hasattr(DBusObjectWithProperties, "__del__"):
1758
1910
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1911
Client.__del__(self, *args, **kwargs)
1760
1912
1761
1913
def checker_callback(self, source, condition,
1762
1914
connection, command, *args, **kwargs):
1763
1915
ret = Client.checker_callback(self, source, condition,
1779
1931
| self.last_checker_signal),
1780
1932
dbus.String(command))
1781
1933
return ret
1782
1934
1783
1935
def start_checker(self, *args, **kwargs):
1784
1936
old_checker_pid = getattr(self.checker, "pid", None)
1785
1937
r = Client.start_checker(self, *args, **kwargs)
1789
1941
# Emit D-Bus signal
1790
1942
self.CheckerStarted(self.current_checker_command)
1791
1943
return r
1792
1944
1793
1945
def _reset_approved(self):
1794
1946
self.approved = None
1795
1947
return False
1796
1948
1797
1949
def approve(self, value=True):
1798
1950
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1951
GLib.timeout_add(int(self.approval_duration.total_seconds()
1952
* 1000), self._reset_approved)
1801
1953
self.send_changedstate()
1802
1803
## D-Bus methods, signals & properties
1804
1805
## Interfaces
1806
1807
## Signals
1808
1954
1955
# D-Bus methods, signals & properties
1956
1957
# Interfaces
1958
1959
# Signals
1960
1809
1961
# CheckerCompleted - signal
1810
1962
@dbus.service.signal(_interface, signature="nxs")
1811
1963
def CheckerCompleted(self, exitcode, waitstatus, command):
1812
1964
"D-Bus signal"
1813
1965
pass
1814
1966
1815
1967
# CheckerStarted - signal
1816
1968
@dbus.service.signal(_interface, signature="s")
1817
1969
def CheckerStarted(self, command):
1818
1970
"D-Bus signal"
1819
1971
pass
1820
1972
1821
1973
# PropertyChanged - signal
1822
1974
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
1975
@dbus.service.signal(_interface, signature="sv")
1824
1976
def PropertyChanged(self, property, value):
1825
1977
"D-Bus signal"
1826
1978
pass
1827
1979
1828
1980
# GotSecret - signal
1829
1981
@dbus.service.signal(_interface)
1830
1982
def GotSecret(self):
1833
1985
server to mandos-client
1834
1986
"""
1835
1987
pass
1836
1988
1837
1989
# Rejected - signal
1838
1990
@dbus.service.signal(_interface, signature="s")
1839
1991
def Rejected(self, reason):
1840
1992
"D-Bus signal"
1841
1993
pass
1842
1994
1843
1995
# NeedApproval - signal
1844
1996
@dbus.service.signal(_interface, signature="tb")
1845
1997
def NeedApproval(self, timeout, default):
1846
1998
"D-Bus signal"
1847
1999
return self.need_approval()
1848
1849
## Methods
1850
2000
2001
# Methods
2002
1851
2003
# Approve - method
1852
2004
@dbus.service.method(_interface, in_signature="b")
1853
2005
def Approve(self, value):
1854
2006
self.approve(value)
1855
2007
1856
2008
# CheckedOK - method
1857
2009
@dbus.service.method(_interface)
1858
2010
def CheckedOK(self):
1859
2011
self.checked_ok()
1860
2012
1861
2013
# Enable - method
1862
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
2015
@dbus.service.method(_interface)
1864
2016
def Enable(self):
1865
2017
"D-Bus method"
1866
2018
self.enable()
1867
2019
1868
2020
# StartChecker - method
1869
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
2022
@dbus.service.method(_interface)
1871
2023
def StartChecker(self):
1872
2024
"D-Bus method"
1873
2025
self.start_checker()
1874
2026
1875
2027
# Disable - method
1876
2028
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
2029
@dbus.service.method(_interface)
1878
2030
def Disable(self):
1879
2031
"D-Bus method"
1880
2032
self.disable()
1881
2033
1882
2034
# StopChecker - method
1883
2035
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
2036
@dbus.service.method(_interface)
1885
2037
def StopChecker(self):
1886
2038
self.stop_checker()
1887
1888
## Properties
1889
2039
2040
# Properties
2041
1890
2042
# ApprovalPending - property
1891
2043
@dbus_service_property(_interface, signature="b", access="read")
1892
2044
def ApprovalPending_dbus_property(self):
1893
2045
return dbus.Boolean(bool(self.approvals_pending))
1894
2046
1895
2047
# ApprovedByDefault - property
1896
2048
@dbus_service_property(_interface,
1897
2049
signature="b",
1900
2052
if value is None: # get
1901
2053
return dbus.Boolean(self.approved_by_default)
1902
2054
self.approved_by_default = bool(value)
1903
2055
1904
2056
# ApprovalDelay - property
1905
2057
@dbus_service_property(_interface,
1906
2058
signature="t",
1910
2062
return dbus.UInt64(self.approval_delay.total_seconds()
1911
2063
* 1000)
1912
2064
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
2065
1914
2066
# ApprovalDuration - property
1915
2067
@dbus_service_property(_interface,
1916
2068
signature="t",
1920
2072
return dbus.UInt64(self.approval_duration.total_seconds()
1921
2073
* 1000)
1922
2074
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
2075
1924
2076
# Name - property
1925
2077
@dbus_annotations(
1926
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
2079
@dbus_service_property(_interface, signature="s", access="read")
1928
2080
def Name_dbus_property(self):
1929
2081
return dbus.String(self.name)
1930
2082
2083
# KeyID - property
2084
@dbus_annotations(
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2086
@dbus_service_property(_interface, signature="s", access="read")
2087
def KeyID_dbus_property(self):
2088
return dbus.String(self.key_id)
2089
1931
2090
# Fingerprint - property
1932
2091
@dbus_annotations(
1933
2092
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
2093
@dbus_service_property(_interface, signature="s", access="read")
1935
2094
def Fingerprint_dbus_property(self):
1936
2095
return dbus.String(self.fingerprint)
1937
2096
1938
2097
# Host - property
1939
2098
@dbus_service_property(_interface,
1940
2099
signature="s",
1943
2102
if value is None: # get
1944
2103
return dbus.String(self.host)
1945
2104
self.host = str(value)
1946
2105
1947
2106
# Created - property
1948
2107
@dbus_annotations(
1949
2108
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
2109
@dbus_service_property(_interface, signature="s", access="read")
1951
2110
def Created_dbus_property(self):
1952
2111
return datetime_to_dbus(self.created)
1953
2112
1954
2113
# LastEnabled - property
1955
2114
@dbus_service_property(_interface, signature="s", access="read")
1956
2115
def LastEnabled_dbus_property(self):
1957
2116
return datetime_to_dbus(self.last_enabled)
1958
2117
1959
2118
# Enabled - property
1960
2119
@dbus_service_property(_interface,
1961
2120
signature="b",
1967
2126
self.enable()
1968
2127
else:
1969
2128
self.disable()
1970
2129
1971
2130
# LastCheckedOK - property
1972
2131
@dbus_service_property(_interface,
1973
2132
signature="s",
1977
2136
self.checked_ok()
1978
2137
return
1979
2138
return datetime_to_dbus(self.last_checked_ok)
1980
2139
1981
2140
# LastCheckerStatus - property
1982
2141
@dbus_service_property(_interface, signature="n", access="read")
1983
2142
def LastCheckerStatus_dbus_property(self):
1984
2143
return dbus.Int16(self.last_checker_status)
1985
2144
1986
2145
# Expires - property
1987
2146
@dbus_service_property(_interface, signature="s", access="read")
1988
2147
def Expires_dbus_property(self):
1989
2148
return datetime_to_dbus(self.expires)
1990
2149
1991
2150
# LastApprovalRequest - property
1992
2151
@dbus_service_property(_interface, signature="s", access="read")
1993
2152
def LastApprovalRequest_dbus_property(self):
1994
2153
return datetime_to_dbus(self.last_approval_request)
1995
2154
1996
2155
# Timeout - property
1997
2156
@dbus_service_property(_interface,
1998
2157
signature="t",
2013
2172
if (getattr(self, "disable_initiator_tag", None)
2014
2173
is None):
2015
2174
return
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2175
GLib.source_remove(self.disable_initiator_tag)
2176
self.disable_initiator_tag = GLib.timeout_add(
2018
2177
int((self.expires - now).total_seconds() * 1000),
2019
2178
self.disable)
2020
2179
2021
2180
# ExtendedTimeout - property
2022
2181
@dbus_service_property(_interface,
2023
2182
signature="t",
2027
2186
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
2187
* 1000)
2029
2188
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
2189
2031
2190
# Interval - property
2032
2191
@dbus_service_property(_interface,
2033
2192
signature="t",
2040
2199
return
2041
2200
if self.enabled:
2042
2201
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2202
GLib.source_remove(self.checker_initiator_tag)
2203
self.checker_initiator_tag = GLib.timeout_add(
2045
2204
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2047
2205
self.start_checker() # Start one now, too
2206
2048
2207
# Checker - property
2049
2208
@dbus_service_property(_interface,
2050
2209
signature="s",
2053
2212
if value is None: # get
2054
2213
return dbus.String(self.checker_command)
2055
2214
self.checker_command = str(value)
2056
2215
2057
2216
# CheckerRunning - property
2058
2217
@dbus_service_property(_interface,
2059
2218
signature="b",
2065
2224
self.start_checker()
2066
2225
else:
2067
2226
self.stop_checker()
2068
2227
2069
2228
# ObjectPath - property
2070
2229
@dbus_annotations(
2071
2230
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
2231
"org.freedesktop.DBus.Deprecated": "true"})
2073
2232
@dbus_service_property(_interface, signature="o", access="read")
2074
2233
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2076
2234
return self.dbus_object_path # is already a dbus.ObjectPath
2235
2077
2236
# Secret = property
2078
2237
@dbus_annotations(
2079
2238
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2084
2243
byte_arrays=True)
2085
2244
def Secret_dbus_property(self, value):
2086
2245
self.secret = bytes(value)
2087
2246
2088
2247
del _interface
2089
2248
2090
2249
2091
class ProxyClient(object):
2092
def __init__(self, child_pipe, fpr, address):
2250
class ProxyClient:
2251
def __init__(self, child_pipe, key_id, fpr, address):
2093
2252
self._pipe = child_pipe
2094
self._pipe.send(('init', fpr, address))
2253
self._pipe.send(('init', key_id, fpr, address))
2095
2254
if not self._pipe.recv():
2096
raise KeyError(fpr)
2097
2255
raise KeyError(key_id or fpr)
2256
2098
2257
def __getattribute__(self, name):
2099
2258
if name == '_pipe':
2100
2259
return super(ProxyClient, self).__getattribute__(name)
2103
2262
if data[0] == 'data':
2104
2263
return data[1]
2105
2264
if data[0] == 'function':
2106
2265
2107
2266
def func(*args, **kwargs):
2108
2267
self._pipe.send(('funcall', name, args, kwargs))
2109
2268
return self._pipe.recv()[1]
2110
2269
2111
2270
return func
2112
2271
2113
2272
def __setattr__(self, name, value):
2114
2273
if name == '_pipe':
2115
2274
return super(ProxyClient, self).__setattr__(name, value)
2118
2277
2119
2278
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2279
"""A class to handle client connections.
2121
2280
2122
2281
Instantiated once for each connection to handle it.
2123
2282
Note: This will run in its own forked process."""
2124
2283
2125
2284
def handle(self):
2126
2285
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
2286
logger.info("TCP connection from: %s",
2128
2287
str(self.client_address))
2129
2288
logger.debug("Pipe FD: %d",
2130
2289
self.server.child_pipe.fileno())
2131
2290
2132
2291
session = gnutls.ClientSession(self.request)
2133
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2137
# "+DHE-DSS"))
2292
2293
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2294
# "+AES-256-CBC", "+SHA1",
2295
# "+COMP-NULL", "+CTYPE-OPENPGP",
2296
# "+DHE-DSS"))
2138
2297
# Use a fallback default, since this MUST be set.
2139
2298
priority = self.server.gnutls_priority
2140
2299
if priority is None:
2141
2300
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2301
gnutls.priority_set_direct(session._c_object,
2302
priority.encode("utf-8"),
2143
2303
None)
2144
2304
2145
2305
# Start communication using the Mandos protocol
2146
2306
# Get protocol number
2147
2307
line = self.request.makefile().readline()
2152
2312
except (ValueError, IndexError, RuntimeError) as error:
2153
2313
logger.error("Unknown protocol version: %s", error)
2154
2314
return
2155
2315
2156
2316
# Start GnuTLS connection
2157
2317
try:
2158
2318
session.handshake()
2162
2322
# established. Just abandon the request.
2163
2323
return
2164
2324
logger.debug("Handshake succeeded")
2165
2325
2166
2326
approval_required = False
2167
2327
try:
2168
try:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
2172
logger.warning("Bad certificate: %s", error)
2173
return
2174
logger.debug("Fingerprint: %s", fpr)
2175
2176
try:
2177
client = ProxyClient(child_pipe, fpr,
2328
if gnutls.has_rawpk:
2329
fpr = b""
2330
try:
2331
key_id = self.key_id(
2332
self.peer_certificate(session))
2333
except (TypeError, gnutls.Error) as error:
2334
logger.warning("Bad certificate: %s", error)
2335
return
2336
logger.debug("Key ID: %s", key_id)
2337
2338
else:
2339
key_id = b""
2340
try:
2341
fpr = self.fingerprint(
2342
self.peer_certificate(session))
2343
except (TypeError, gnutls.Error) as error:
2344
logger.warning("Bad certificate: %s", error)
2345
return
2346
logger.debug("Fingerprint: %s", fpr)
2347
2348
try:
2349
client = ProxyClient(child_pipe, key_id, fpr,
2178
2350
self.client_address)
2179
2351
except KeyError:
2180
2352
return
2181
2353
2182
2354
if client.approval_delay:
2183
2355
delay = client.approval_delay
2184
2356
client.approvals_pending += 1
2185
2357
approval_required = True
2186
2358
2187
2359
while True:
2188
2360
if not client.enabled:
2189
2361
logger.info("Client %s is disabled",
2192
2364
# Emit D-Bus signal
2193
2365
client.Rejected("Disabled")
2194
2366
return
2195
2367
2196
2368
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2369
# We are approved or approval is disabled
2198
2370
break
2199
2371
elif client.approved is None:
2200
2372
logger.info("Client %s needs approval",
2211
2383
# Emit D-Bus signal
2212
2384
client.Rejected("Denied")
2213
2385
return
2214
2215
#wait until timeout or approved
2386
2387
# wait until timeout or approved
2216
2388
time = datetime.datetime.now()
2217
2389
client.changedstate.acquire()
2218
2390
client.changedstate.wait(delay.total_seconds())
2231
2403
break
2232
2404
else:
2233
2405
delay -= time2 - time
2234
2406
2235
2407
try:
2236
2408
session.send(client.secret)
2237
2409
except gnutls.Error as error:
2238
2410
logger.warning("gnutls send failed",
2239
exc_info = error)
2411
exc_info=error)
2240
2412
return
2241
2413
2242
2414
logger.info("Sending secret to %s", client.name)
2243
2415
# bump the timeout using extended_timeout
2244
2416
client.bump_timeout(client.extended_timeout)
2245
2417
if self.server.use_dbus:
2246
2418
# Emit D-Bus signal
2247
2419
client.GotSecret()
2248
2420
2249
2421
finally:
2250
2422
if approval_required:
2251
2423
client.approvals_pending -= 1
2254
2426
except gnutls.Error as error:
2255
2427
logger.warning("GnuTLS bye failed",
2256
2428
exc_info=error)
2257
2429
2258
2430
@staticmethod
2259
2431
def peer_certificate(session):
2260
"Return the peer's OpenPGP certificate as a bytestring"
2261
# If not an OpenPGP certificate...
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2432
"Return the peer's certificate as a bytestring"
2433
try:
2434
cert_type = gnutls.certificate_type_get2(session._c_object,
2435
gnutls.CTYPE_PEERS)
2436
except AttributeError:
2437
cert_type = gnutls.certificate_type_get(session._c_object)
2438
if gnutls.has_rawpk:
2439
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
else:
2441
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2442
# If not a valid certificate type...
2443
if cert_type not in valid_cert_types:
2444
logger.info("Cert type %r not in %r", cert_type,
2445
valid_cert_types)
2264
2446
# ...return invalid data
2265
2447
return b""
2266
2448
list_size = ctypes.c_uint(1)
2272
2454
return None
2273
2455
cert = cert_list[0]
2274
2456
return ctypes.string_at(cert.data, cert.size)
2275
2457
2458
@staticmethod
2459
def key_id(certificate):
2460
"Convert a certificate bytestring to a hexdigit key ID"
2461
# New GnuTLS "datum" with the public key
2462
datum = gnutls.datum_t(
2463
ctypes.cast(ctypes.c_char_p(certificate),
2464
ctypes.POINTER(ctypes.c_ubyte)),
2465
ctypes.c_uint(len(certificate)))
2466
# XXX all these need to be created in the gnutls "module"
2467
# New empty GnuTLS certificate
2468
pubkey = gnutls.pubkey_t()
2469
gnutls.pubkey_init(ctypes.byref(pubkey))
2470
# Import the raw public key into the certificate
2471
gnutls.pubkey_import(pubkey,
2472
ctypes.byref(datum),
2473
gnutls.X509_FMT_DER)
2474
# New buffer for the key ID
2475
buf = ctypes.create_string_buffer(32)
2476
buf_len = ctypes.c_size_t(len(buf))
2477
# Get the key ID from the raw public key into the buffer
2478
gnutls.pubkey_get_key_id(
2479
pubkey,
2480
gnutls.KEYID_USE_SHA256,
2481
ctypes.cast(ctypes.byref(buf),
2482
ctypes.POINTER(ctypes.c_ubyte)),
2483
ctypes.byref(buf_len))
2484
# Deinit the certificate
2485
gnutls.pubkey_deinit(pubkey)
2486
2487
# Convert the buffer to a Python bytestring
2488
key_id = ctypes.string_at(buf, buf_len.value)
2489
# Convert the bytestring to hexadecimal notation
2490
hex_key_id = binascii.hexlify(key_id).upper()
2491
return hex_key_id
2492
2276
2493
@staticmethod
2277
2494
def fingerprint(openpgp):
2278
2495
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2293
2510
ctypes.byref(crtverify))
2294
2511
if crtverify.value != 0:
2295
2512
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
2513
raise gnutls.CertificateSecurityError(code
2514
=crtverify.value)
2297
2515
# New buffer for the fingerprint
2298
2516
buf = ctypes.create_string_buffer(20)
2299
2517
buf_len = ctypes.c_size_t()
2309
2527
return hex_fpr
2310
2528
2311
2529
2312
class MultiprocessingMixIn(object):
2530
class MultiprocessingMixIn:
2313
2531
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2532
2315
2533
def sub_process_main(self, request, address):
2316
2534
try:
2317
2535
self.finish_request(request, address)
2318
2536
except Exception:
2319
2537
self.handle_error(request, address)
2320
2538
self.close_request(request)
2321
2539
2322
2540
def process_request(self, request, address):
2323
2541
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2542
proc = multiprocessing.Process(target=self.sub_process_main,
2543
args=(request, address))
2326
2544
proc.start()
2327
2545
return proc
2328
2546
2329
2547
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2548
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2331
2549
""" adds a pipe to the MixIn """
2332
2550
2333
2551
def process_request(self, request, client_address):
2334
2552
"""Overrides and wraps the original process_request().
2335
2553
2336
2554
This function creates a new pipe in self.pipe
2337
2555
"""
2338
2556
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2339
2557
2340
2558
proc = MultiprocessingMixIn.process_request(self, request,
2341
2559
client_address)
2342
2560
self.child_pipe.close()
2343
2561
self.add_pipe(parent_pipe, proc)
2344
2562
2345
2563
def add_pipe(self, parent_pipe, proc):
2346
2564
"""Dummy function; override as necessary"""
2347
2565
raise NotImplementedError()
2348
2566
2349
2567
2350
2568
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
socketserver.TCPServer, object):
2569
socketserver.TCPServer):
2352
2570
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2353
2571
2354
2572
Attributes:
2355
2573
enabled: Boolean; whether this server is activated yet
2356
2574
interface: None or a network interface name (string)
2357
2575
use_ipv6: Boolean; to use IPv6 or not
2358
2576
"""
2359
2577
2360
2578
def __init__(self, server_address, RequestHandlerClass,
2361
2579
interface=None,
2362
2580
use_ipv6=True,
2372
2590
self.socketfd = socketfd
2373
2591
# Save the original socket.socket() function
2374
2592
self.socket_socket = socket.socket
2593
2375
2594
# To implement --socket, we monkey patch socket.socket.
2376
#
2595
#
2377
2596
# (When socketserver.TCPServer is a new-style class, we
2378
2597
# could make self.socket into a property instead of monkey
2379
2598
# patching socket.socket.)
2380
#
2599
#
2381
2600
# Create a one-time-only replacement for socket.socket()
2382
2601
@functools.wraps(socket.socket)
2383
2602
def socket_wrapper(*args, **kwargs):
2395
2614
# socket_wrapper(), if socketfd was set.
2396
2615
socketserver.TCPServer.__init__(self, server_address,
2397
2616
RequestHandlerClass)
2398
2617
2399
2618
def server_bind(self):
2400
2619
"""This overrides the normal server_bind() function
2401
2620
to bind to an interface if one was specified, and also NOT to
2402
2621
bind to an address or port if they were not specified."""
2622
global SO_BINDTODEVICE
2403
2623
if self.interface is not None:
2404
2624
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2407
self.interface)
2408
else:
2409
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2420
self.interface)
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2424
else:
2425
raise
2625
# Fall back to a hard-coded value which seems to be
2626
# common enough.
2627
logger.warning("SO_BINDTODEVICE not found, trying 25")
2628
SO_BINDTODEVICE = 25
2629
try:
2630
self.socket.setsockopt(
2631
socket.SOL_SOCKET, SO_BINDTODEVICE,
2632
(self.interface + "\0").encode("utf-8"))
2633
except socket.error as error:
2634
if error.errno == errno.EPERM:
2635
logger.error("No permission to bind to"
2636
" interface %s", self.interface)
2637
elif error.errno == errno.ENOPROTOOPT:
2638
logger.error("SO_BINDTODEVICE not available;"
2639
" cannot bind to interface %s",
2640
self.interface)
2641
elif error.errno == errno.ENODEV:
2642
logger.error("Interface %s does not exist,"
2643
" cannot bind", self.interface)
2644
else:
2645
raise
2426
2646
# Only bind(2) the socket if we really need to.
2427
2647
if self.server_address[0] or self.server_address[1]:
2648
if self.server_address[1]:
2649
self.allow_reuse_address = True
2428
2650
if not self.server_address[0]:
2429
2651
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2652
any_address = "::" # in6addr_any
2431
2653
else:
2432
any_address = "0.0.0.0" # INADDR_ANY
2654
any_address = "0.0.0.0" # INADDR_ANY
2433
2655
self.server_address = (any_address,
2434
2656
self.server_address[1])
2435
2657
elif not self.server_address[1]:
2445
2667
2446
2668
class MandosServer(IPv6_TCPServer):
2447
2669
"""Mandos server.
2448
2670
2449
2671
Attributes:
2450
2672
clients: set of Client objects
2451
2673
gnutls_priority GnuTLS priority string
2452
2674
use_dbus: Boolean; to emit D-Bus signals or not
2453
2454
Assumes a gobject.MainLoop event loop.
2675
2676
Assumes a GLib.MainLoop event loop.
2455
2677
"""
2456
2678
2457
2679
def __init__(self, server_address, RequestHandlerClass,
2458
2680
interface=None,
2459
2681
use_ipv6=True,
2469
2691
self.gnutls_priority = gnutls_priority
2470
2692
IPv6_TCPServer.__init__(self, server_address,
2471
2693
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2475
2694
interface=interface,
2695
use_ipv6=use_ipv6,
2696
socketfd=socketfd)
2697
2476
2698
def server_activate(self):
2477
2699
if self.enabled:
2478
2700
return socketserver.TCPServer.server_activate(self)
2479
2701
2480
2702
def enable(self):
2481
2703
self.enabled = True
2482
2704
2483
2705
def add_pipe(self, parent_pipe, proc):
2484
2706
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2707
GLib.io_add_watch(
2708
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2709
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2488
2710
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2491
2711
parent_pipe=parent_pipe,
2712
proc=proc))
2713
2492
2714
def handle_ipc(self, source, condition,
2493
2715
parent_pipe=None,
2494
proc = None,
2716
proc=None,
2495
2717
client_object=None):
2496
2718
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2719
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2720
# Wait for other process to exit
2499
2721
proc.join()
2500
2722
return False
2501
2723
2502
2724
# Read a request from the child
2503
2725
request = parent_pipe.recv()
2504
2726
command = request[0]
2505
2727
2506
2728
if command == 'init':
2507
fpr = request[1]
2508
address = request[2]
2509
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2729
key_id = request[1].decode("ascii")
2730
fpr = request[2].decode("ascii")
2731
address = request[3]
2732
2733
for c in self.clients.values():
2734
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2735
"27AE41E4649B934CA495991B7852B855"):
2736
continue
2737
if key_id and c.key_id == key_id:
2738
client = c
2739
break
2740
if fpr and c.fingerprint == fpr:
2512
2741
client = c
2513
2742
break
2514
2743
else:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2744
logger.info("Client not found for key ID: %s, address"
2745
": %s", key_id or fpr, address)
2517
2746
if self.use_dbus:
2518
2747
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
2748
mandos_dbus_service.ClientNotFound(key_id or fpr,
2520
2749
address[0])
2521
2750
parent_pipe.send(False)
2522
2751
return False
2523
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2752
2753
GLib.io_add_watch(
2754
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2755
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2527
2756
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2757
parent_pipe=parent_pipe,
2758
proc=proc,
2759
client_object=client))
2531
2760
parent_pipe.send(True)
2532
2761
# remove the old hook in favor of the new above hook on
2533
2762
# same fileno
2536
2765
funcname = request[1]
2537
2766
args = request[2]
2538
2767
kwargs = request[3]
2539
2768
2540
2769
parent_pipe.send(('data', getattr(client_object,
2541
2770
funcname)(*args,
2542
2771
**kwargs)))
2543
2772
2544
2773
if command == 'getattr':
2545
2774
attrname = request[1]
2546
2775
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2776
collections.abc.Callable):
2548
2777
parent_pipe.send(('function', ))
2549
2778
else:
2550
2779
parent_pipe.send((
2551
2780
'data', client_object.__getattribute__(attrname)))
2552
2781
2553
2782
if command == 'setattr':
2554
2783
attrname = request[1]
2555
2784
value = request[2]
2556
2785
setattr(client_object, attrname, value)
2557
2786
2558
2787
return True
2559
2788
2560
2789
2561
2790
def rfc3339_duration_to_delta(duration):
2562
2791
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2563
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2792
2793
>>> timedelta = datetime.timedelta
2794
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2795
True
2796
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2797
True
2798
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2799
True
2800
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2801
True
2802
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2803
True
2804
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2805
True
2806
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2807
True
2808
>>> del timedelta
2578
2809
"""
2579
2810
2580
2811
# Parsing an RFC 3339 duration with regular expressions is not
2581
2812
# possible - there would have to be multiple places for the same
2582
2813
# values, like seconds. The current code, while more esoteric, is
2583
2814
# cleaner without depending on a parsing library. If Python had a
2584
2815
# built-in library for parsing we would use it, but we'd like to
2585
2816
# avoid excessive use of external libraries.
2586
2817
2587
2818
# New type for defining tokens, syntax, and semantics all-in-one
2588
2819
Token = collections.namedtuple("Token", (
2589
2820
"regexp", # To match token; if "value" is not None, must have
2622
2853
frozenset((token_year, token_month,
2623
2854
token_day, token_time,
2624
2855
token_week)))
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2856
# Define starting values:
2857
# Value so far
2858
value = datetime.timedelta()
2627
2859
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2860
# Following valid tokens
2861
followers = frozenset((token_duration, ))
2862
# String left to parse
2863
s = duration
2630
2864
# Loop until end token is found
2631
2865
while found_token is not token_end:
2632
2866
# Search for any currently valid tokens
2656
2890
2657
2891
def string_to_delta(interval):
2658
2892
"""Parse a string and return a datetime.timedelta
2659
2660
>>> string_to_delta('7d')
2661
datetime.timedelta(7)
2662
>>> string_to_delta('60s')
2663
datetime.timedelta(0, 60)
2664
>>> string_to_delta('60m')
2665
datetime.timedelta(0, 3600)
2666
>>> string_to_delta('24h')
2667
datetime.timedelta(1)
2668
>>> string_to_delta('1w')
2669
datetime.timedelta(7)
2670
>>> string_to_delta('5m 30s')
2671
datetime.timedelta(0, 330)
2893
2894
>>> string_to_delta('7d') == datetime.timedelta(7)
2895
True
2896
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
True
2898
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
True
2900
>>> string_to_delta('24h') == datetime.timedelta(1)
2901
True
2902
>>> string_to_delta('1w') == datetime.timedelta(7)
2903
True
2904
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2905
True
2672
2906
"""
2673
2907
2674
2908
try:
2675
2909
return rfc3339_duration_to_delta(interval)
2676
2910
except ValueError:
2677
2911
pass
2678
2912
2679
2913
timevalue = datetime.timedelta(0)
2680
2914
for s in interval.split():
2681
2915
try:
2699
2933
return timevalue
2700
2934
2701
2935
2702
def daemon(nochdir = False, noclose = False):
2936
def daemon(nochdir=False, noclose=False):
2703
2937
"""See daemon(3). Standard BSD Unix function.
2704
2938
2705
2939
This should really exist as os.daemon, but it doesn't (yet)."""
2706
2940
if os.fork():
2707
2941
sys.exit()
2725
2959
2726
2960
2727
2961
def main():
2728
2962
2729
2963
##################################################################
2730
2964
# Parsing of options, both command line and config file
2731
2965
2732
2966
parser = argparse.ArgumentParser()
2733
2967
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2968
version="%(prog)s {}".format(version),
2735
2969
help="show version number and exit")
2736
2970
parser.add_argument("-i", "--interface", metavar="IF",
2737
2971
help="Bind to interface IF")
2773
3007
parser.add_argument("--no-zeroconf", action="store_false",
2774
3008
dest="zeroconf", help="Do not use Zeroconf",
2775
3009
default=None)
2776
3010
2777
3011
options = parser.parse_args()
2778
2779
if options.check:
2780
import doctest
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2783
3012
2784
3013
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2786
"address": "",
2787
"port": "",
2788
"debug": "False",
2789
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2793
"use_dbus": "True",
2794
"use_ipv6": "True",
2795
"debuglevel": "",
2796
"restore": "True",
2797
"socket": "",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2802
3014
if gnutls.has_rawpk:
3015
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3016
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3017
else:
3018
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3019
":+SIGN-DSA-SHA256")
3020
server_defaults = {"interface": "",
3021
"address": "",
3022
"port": "",
3023
"debug": "False",
3024
"priority": priority,
3025
"servicename": "Mandos",
3026
"use_dbus": "True",
3027
"use_ipv6": "True",
3028
"debuglevel": "",
3029
"restore": "True",
3030
"socket": "",
3031
"statedir": "/var/lib/mandos",
3032
"foreground": "False",
3033
"zeroconf": "True",
3034
}
3035
del priority
3036
2803
3037
# Parse config file for server-global settings
2804
server_config = configparser.SafeConfigParser(server_defaults)
3038
server_config = configparser.ConfigParser(server_defaults)
2805
3039
del server_defaults
2806
3040
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2807
# Convert the SafeConfigParser object to a dict
3041
# Convert the ConfigParser object to a dict
2808
3042
server_settings = server_config.defaults()
2809
3043
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3044
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3045
"foreground", "zeroconf"):
2811
3046
server_settings[option] = server_config.getboolean("DEFAULT",
2812
3047
option)
2813
3048
if server_settings["port"]:
2823
3058
server_settings["socket"] = os.dup(server_settings
2824
3059
["socket"])
2825
3060
del server_config
2826
3061
2827
3062
# Override the settings from the config file with command line
2828
3063
# options, if set.
2829
3064
for option in ("interface", "address", "port", "debug",
2847
3082
if server_settings["debug"]:
2848
3083
server_settings["foreground"] = True
2849
3084
# Now we have our good server settings in "server_settings"
2850
3085
2851
3086
##################################################################
2852
3087
2853
3088
if (not server_settings["zeroconf"]
2854
3089
and not (server_settings["port"]
2855
3090
or server_settings["socket"] != "")):
2856
3091
parser.error("Needs port or socket to work without Zeroconf")
2857
3092
2858
3093
# For convenience
2859
3094
debug = server_settings["debug"]
2860
3095
debuglevel = server_settings["debuglevel"]
2864
3099
stored_state_file)
2865
3100
foreground = server_settings["foreground"]
2866
3101
zeroconf = server_settings["zeroconf"]
2867
3102
2868
3103
if debug:
2869
3104
initlogger(debug, logging.DEBUG)
2870
3105
else:
2873
3108
else:
2874
3109
level = getattr(logging, debuglevel.upper())
2875
3110
initlogger(debug, level)
2876
3111
2877
3112
if server_settings["servicename"] != "Mandos":
2878
3113
syslogger.setFormatter(
2879
3114
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
3115
' %(levelname)s: %(message)s'.format(
2881
3116
server_settings["servicename"])))
2882
3117
2883
3118
# Parse config file with clients
2884
client_config = configparser.SafeConfigParser(Client
2885
.client_defaults)
3119
client_config = configparser.ConfigParser(Client.client_defaults)
2886
3120
client_config.read(os.path.join(server_settings["configdir"],
2887
3121
"clients.conf"))
2888
3122
2889
3123
global mandos_dbus_service
2890
3124
mandos_dbus_service = None
2891
3125
2892
3126
socketfd = None
2893
3127
if server_settings["socket"] != "":
2894
3128
socketfd = server_settings["socket"]
2910
3144
except IOError as e:
2911
3145
logger.error("Could not open file %r", pidfilename,
2912
3146
exc_info=e)
2913
2914
for name in ("_mandos", "mandos", "nobody"):
3147
3148
for name, group in (("_mandos", "_mandos"),
3149
("mandos", "mandos"),
3150
("nobody", "nogroup")):
2915
3151
try:
2916
3152
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
3153
gid = pwd.getpwnam(group).pw_gid
2918
3154
break
2919
3155
except KeyError:
2920
3156
continue
2924
3160
try:
2925
3161
os.setgid(gid)
2926
3162
os.setuid(uid)
3163
if debug:
3164
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3165
gid))
2927
3166
except OSError as error:
3167
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3168
.format(uid, gid, os.strerror(error.errno)))
2928
3169
if error.errno != errno.EPERM:
2929
3170
raise
2930
3171
2931
3172
if debug:
2932
3173
# Enable all possible GnuTLS debugging
2933
3174
2934
3175
# "Use a log level over 10 to enable all debugging options."
2935
3176
# - GnuTLS manual
2936
3177
gnutls.global_set_log_level(11)
2937
3178
2938
3179
@gnutls.log_func
2939
3180
def debug_gnutls(level, string):
2940
3181
logger.debug("GnuTLS: %s", string[:-1])
2941
3182
2942
3183
gnutls.global_set_log_function(debug_gnutls)
2943
3184
2944
3185
# Redirect stdin so all checkers get /dev/null
2945
3186
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
3187
os.dup2(null, sys.stdin.fileno())
2947
3188
if null > 2:
2948
3189
os.close(null)
2949
3190
2950
3191
# Need to fork before connecting to D-Bus
2951
3192
if not foreground:
2952
3193
# Close all input and output, do double fork, etc.
2953
3194
daemon()
2954
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2958
3195
3196
if gi.version_info < (3, 10, 2):
3197
# multiprocessing will use threads, so before we use GLib we
3198
# need to inform GLib that threads will be used.
3199
GLib.threads_init()
3200
2959
3201
global main_loop
2960
3202
# From the Avahi example code
2961
3203
DBusGMainLoop(set_as_default=True)
2962
main_loop = gobject.MainLoop()
3204
main_loop = GLib.MainLoop()
2963
3205
bus = dbus.SystemBus()
2964
3206
# End of Avahi example code
2965
3207
if use_dbus:
2978
3220
if zeroconf:
2979
3221
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3222
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
3223
name=server_settings["servicename"],
3224
servicetype="_mandos._tcp",
3225
protocol=protocol,
3226
bus=bus)
2985
3227
if server_settings["interface"]:
2986
3228
service.interface = if_nametoindex(
2987
3229
server_settings["interface"].encode("utf-8"))
2988
3230
2989
3231
global multiprocessing_manager
2990
3232
multiprocessing_manager = multiprocessing.Manager()
2991
3233
2992
3234
client_class = Client
2993
3235
if use_dbus:
2994
client_class = functools.partial(ClientDBus, bus = bus)
2995
3236
client_class = functools.partial(ClientDBus, bus=bus)
3237
2996
3238
client_settings = Client.config_parser(client_config)
2997
3239
old_client_settings = {}
2998
3240
clients_data = {}
2999
3241
3000
3242
# This is used to redirect stdout and stderr for checker processes
3001
3243
global wnull
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3244
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3245
# Only used if server is running in foreground but not in debug
3004
3246
# mode
3005
3247
if debug or not foreground:
3006
3248
wnull.close()
3007
3249
3008
3250
# Get client data and settings from last running state.
3009
3251
if server_settings["restore"]:
3010
3252
try:
3011
3253
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
3254
if sys.version_info.major == 2:
3255
clients_data, old_client_settings = pickle.load(
3256
stored_state)
3257
else:
3258
bytes_clients_data, bytes_old_client_settings = (
3259
pickle.load(stored_state, encoding="bytes"))
3260
# Fix bytes to strings
3261
# clients_data
3262
# .keys()
3263
clients_data = {(key.decode("utf-8")
3264
if isinstance(key, bytes)
3265
else key): value
3266
for key, value in
3267
bytes_clients_data.items()}
3268
del bytes_clients_data
3269
for key in clients_data:
3270
value = {(k.decode("utf-8")
3271
if isinstance(k, bytes) else k): v
3272
for k, v in
3273
clients_data[key].items()}
3274
clients_data[key] = value
3275
# .client_structure
3276
value["client_structure"] = [
3277
(s.decode("utf-8")
3278
if isinstance(s, bytes)
3279
else s) for s in
3280
value["client_structure"]]
3281
# .name, .host, and .checker_command
3282
for k in ("name", "host", "checker_command"):
3283
if isinstance(value[k], bytes):
3284
value[k] = value[k].decode("utf-8")
3285
if "key_id" not in value:
3286
value["key_id"] = ""
3287
elif "fingerprint" not in value:
3288
value["fingerprint"] = ""
3289
# old_client_settings
3290
# .keys()
3291
old_client_settings = {
3292
(key.decode("utf-8")
3293
if isinstance(key, bytes)
3294
else key): value
3295
for key, value in
3296
bytes_old_client_settings.items()}
3297
del bytes_old_client_settings
3298
# .host and .checker_command
3299
for value in old_client_settings.values():
3300
for attribute in ("host", "checker_command"):
3301
if isinstance(value[attribute], bytes):
3302
value[attribute] = (value[attribute]
3303
.decode("utf-8"))
3014
3304
os.remove(stored_state_path)
3015
3305
except IOError as e:
3016
3306
if e.errno == errno.ENOENT:
3024
3314
logger.warning("Could not load persistent state: "
3025
3315
"EOFError:",
3026
3316
exc_info=e)
3027
3317
3028
3318
with PGPEngine() as pgp:
3029
3319
for client_name, client in clients_data.items():
3030
3320
# Skip removed clients
3031
3321
if client_name not in client_settings:
3032
3322
continue
3033
3323
3034
3324
# Decide which value to use after restoring saved state.
3035
3325
# We have three different values: Old config file,
3036
3326
# new config file, and saved state.
3047
3337
client[name] = value
3048
3338
except KeyError:
3049
3339
pass
3050
3340
3051
3341
# Clients who has passed its expire date can still be
3052
3342
# enabled if its last checker was successful. A Client
3053
3343
# whose checker succeeded before we stored its state is
3086
3376
client_name))
3087
3377
client["secret"] = (client_settings[client_name]
3088
3378
["secret"])
3089
3379
3090
3380
# Add/remove clients based on new changes made to config
3091
3381
for client_name in (set(old_client_settings)
3092
3382
- set(client_settings)):
3094
3384
for client_name in (set(client_settings)
3095
3385
- set(old_client_settings)):
3096
3386
clients_data[client_name] = client_settings[client_name]
3097
3387
3098
3388
# Create all client objects
3099
3389
for client_name, client in clients_data.items():
3100
3390
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
3103
server_settings = server_settings)
3104
3391
name=client_name,
3392
settings=client,
3393
server_settings=server_settings)
3394
3105
3395
if not tcp_server.clients:
3106
3396
logger.warning("No clients defined")
3107
3397
3108
3398
if not foreground:
3109
3399
if pidfile is not None:
3110
3400
pid = os.getpid()
3116
3406
pidfilename, pid)
3117
3407
del pidfile
3118
3408
del pidfilename
3119
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
3409
3410
for termsig in (signal.SIGHUP, signal.SIGTERM):
3411
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3412
lambda: main_loop.quit() and False)
3413
3123
3414
if use_dbus:
3124
3415
3125
3416
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3417
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3418
class MandosDBusService(DBusObjectWithObjectManager):
3128
3419
"""A D-Bus proxy object"""
3129
3420
3130
3421
def __init__(self):
3131
3422
dbus.service.Object.__init__(self, bus, "/")
3132
3423
3133
3424
_interface = "se.recompile.Mandos"
3134
3425
3135
3426
@dbus.service.signal(_interface, signature="o")
3136
3427
def ClientAdded(self, objpath):
3137
3428
"D-Bus signal"
3138
3429
pass
3139
3430
3140
3431
@dbus.service.signal(_interface, signature="ss")
3141
def ClientNotFound(self, fingerprint, address):
3432
def ClientNotFound(self, key_id, address):
3142
3433
"D-Bus signal"
3143
3434
pass
3144
3435
3145
3436
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
3437
"true"})
3147
3438
@dbus.service.signal(_interface, signature="os")
3148
3439
def ClientRemoved(self, objpath, name):
3149
3440
"D-Bus signal"
3150
3441
pass
3151
3442
3152
3443
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
3444
"true"})
3154
3445
@dbus.service.method(_interface, out_signature="ao")
3155
3446
def GetAllClients(self):
3156
3447
"D-Bus method"
3157
3448
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3159
3449
tcp_server.clients.values())
3450
3160
3451
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
3452
"true"})
3162
3453
@dbus.service.method(_interface,
3164
3455
def GetAllClientsWithProperties(self):
3165
3456
"D-Bus method"
3166
3457
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3458
{c.dbus_object_path: c.GetAll(
3168
3459
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3460
for c in tcp_server.clients.values()},
3170
3461
signature="oa{sv}")
3171
3462
3172
3463
@dbus.service.method(_interface, in_signature="o")
3173
3464
def RemoveClient(self, object_path):
3174
3465
"D-Bus method"
3175
for c in tcp_server.clients.itervalues():
3466
for c in tcp_server.clients.values():
3176
3467
if c.dbus_object_path == object_path:
3177
3468
del tcp_server.clients[c.name]
3178
3469
c.remove_from_connection()
3182
3473
self.client_removed_signal(c)
3183
3474
return
3184
3475
raise KeyError(object_path)
3185
3476
3186
3477
del _interface
3187
3478
3188
3479
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3480
out_signature="a{oa{sa{sv}}}")
3190
3481
def GetManagedObjects(self):
3191
3482
"""D-Bus method"""
3192
3483
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3484
{client.dbus_object_path:
3485
dbus.Dictionary(
3486
{interface: client.GetAll(interface)
3487
for interface in
3488
client._get_all_interface_names()})
3489
for client in tcp_server.clients.values()})
3490
3200
3491
def client_added_signal(self, client):
3201
3492
"""Send the new standard signal and the old signal"""
3202
3493
if use_dbus:
3204
3495
self.InterfacesAdded(
3205
3496
client.dbus_object_path,
3206
3497
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3498
{interface: client.GetAll(interface)
3499
for interface in
3500
client._get_all_interface_names()}))
3210
3501
# Old signal
3211
3502
self.ClientAdded(client.dbus_object_path)
3212
3503
3213
3504
def client_removed_signal(self, client):
3214
3505
"""Send the new standard signal and the old signal"""
3215
3506
if use_dbus:
3220
3511
# Old signal
3221
3512
self.ClientRemoved(client.dbus_object_path,
3222
3513
client.name)
3223
3514
3224
3515
mandos_dbus_service = MandosDBusService()
3225
3516
3517
# Save modules to variables to exempt the modules from being
3518
# unloaded before the function registered with atexit() is run.
3519
mp = multiprocessing
3520
wn = wnull
3521
3226
3522
def cleanup():
3227
3523
"Cleanup function; run on exit"
3228
3524
if zeroconf:
3229
3525
service.cleanup()
3230
3231
multiprocessing.active_children()
3232
wnull.close()
3526
3527
mp.active_children()
3528
wn.close()
3233
3529
if not (tcp_server.clients or client_settings):
3234
3530
return
3235
3531
3236
3532
# Store client before exiting. Secrets are encrypted with key
3237
3533
# based on what config file has. If config file is
3238
3534
# removed/edited, old secret will thus be unrecovable.
3239
3535
clients = {}
3240
3536
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3537
for client in tcp_server.clients.values():
3242
3538
key = client_settings[client.name]["secret"]
3243
3539
client.encrypted_secret = pgp.encrypt(client.secret,
3244
3540
key)
3245
3541
client_dict = {}
3246
3542
3247
3543
# A list of attributes that can not be pickled
3248
3544
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3545
exclude = {"bus", "changedstate", "secret",
3546
"checker", "server_settings"}
3251
3547
for name, typ in inspect.getmembers(dbus.service
3252
3548
.Object):
3253
3549
exclude.add(name)
3254
3550
3255
3551
client_dict["encrypted_secret"] = (client
3256
3552
.encrypted_secret)
3257
3553
for attr in client.client_structure:
3258
3554
if attr not in exclude:
3259
3555
client_dict[attr] = getattr(client, attr)
3260
3556
3261
3557
clients[client.name] = client_dict
3262
3558
del client_settings[client.name]["secret"]
3263
3559
3264
3560
try:
3265
3561
with tempfile.NamedTemporaryFile(
3266
3562
mode='wb',
3268
3564
prefix='clients-',
3269
3565
dir=os.path.dirname(stored_state_path),
3270
3566
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3567
pickle.dump((clients, client_settings), stored_state,
3568
protocol=2)
3272
3569
tempname = stored_state.name
3273
3570
os.rename(tempname, stored_state_path)
3274
3571
except (IOError, OSError) as e:
3284
3581
logger.warning("Could not save persistent state:",
3285
3582
exc_info=e)
3286
3583
raise
3287
3584
3288
3585
# Delete all clients, and settings from config
3289
3586
while tcp_server.clients:
3290
3587
name, client = tcp_server.clients.popitem()
3296
3593
if use_dbus:
3297
3594
mandos_dbus_service.client_removed_signal(client)
3298
3595
client_settings.clear()
3299
3596
3300
3597
atexit.register(cleanup)
3301
3302
for client in tcp_server.clients.itervalues():
3598
3599
for client in tcp_server.clients.values():
3303
3600
if use_dbus:
3304
3601
# Emit D-Bus signal for adding
3305
3602
mandos_dbus_service.client_added_signal(client)
3306
3603
# Need to initiate checking of clients
3307
3604
if client.enabled:
3308
3605
client.init_checker()
3309
3606
3310
3607
tcp_server.enable()
3311
3608
tcp_server.server_activate()
3312
3609
3313
3610
# Find out what port we got
3314
3611
if zeroconf:
3315
3612
service.port = tcp_server.socket.getsockname()[1]
3320
3617
else: # IPv4
3321
3618
logger.info("Now listening on address %r, port %d",
3322
3619
*tcp_server.socket.getsockname())
3323
3324
#service.interface = tcp_server.socket.getsockname()[3]
3325
3620
3621
# service.interface = tcp_server.socket.getsockname()[3]
3622
3326
3623
try:
3327
3624
if zeroconf:
3328
3625
# From the Avahi example code
3333
3630
cleanup()
3334
3631
sys.exit(1)
3335
3632
# End of Avahi example code
3336
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3341
3633
3634
GLib.io_add_watch(
3635
GLib.IOChannel.unix_new(tcp_server.fileno()),
3636
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3637
lambda *args, **kwargs: (tcp_server.handle_request
3638
(*args[2:], **kwargs) or True))
3639
3342
3640
logger.debug("Starting main loop")
3343
3641
main_loop.run()
3344
3642
except AvahiError as error:
3353
3651
# Must run before the D-Bus bus name gets deregistered
3354
3652
cleanup()
3355
3653
3654
3655
def should_only_run_tests():
3656
parser = argparse.ArgumentParser(add_help=False)
3657
parser.add_argument("--check", action='store_true')
3658
args, unknown_args = parser.parse_known_args()
3659
run_tests = args.check
3660
if run_tests:
3661
# Remove --check argument from sys.argv
3662
sys.argv[1:] = unknown_args
3663
return run_tests
3664
3665
# Add all tests from doctest strings
3666
def load_tests(loader, tests, none):
3667
import doctest
3668
tests.addTests(doctest.DocTestSuite())
3669
return tests
3356
3670
3357
3671
if __name__ == '__main__':
3358
main()
3672
try:
3673
if should_only_run_tests():
3674
# Call using ./mandos --check [--verbose]
3675
unittest.main()
3676
else:
3677
main()
3678
finally:
3679
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0