To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1234
- compare with another revision
- download diff
- download tarball
- view history from revision 1234
- Committer: Teddy Hogeborn
- Date: 2021-02-03 08:33:43 UTC
- Revision ID: teddy@recompile.se-20210203083343-spdbhxgd5v8e3lv9
Update copyright year
* debian/copyright: Update copyright year to 2021.
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: Update copyright year to 2020.
* intro.xml: - '' -
* plugin-helpers/mandos-client-iprouteadddel.c: Update copyright year
to 2021.
* plugin-runner.c: - '' -
* plugins.d/askpass-fifo.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/plymouth.c: - '' -
* plugins.d/splashy.c: - '' -
* plugins.d/usplash.c: - '' -
* debian/copyright: Update copyright year to 2021.
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: Update copyright year to 2020.
* intro.xml: - '' -
* plugin-helpers/mandos-client-iprouteadddel.c: Update copyright year
to 2021.
* plugin-runner.c: - '' -
* plugins.d/askpass-fifo.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/plymouth.c: - '' -
* plugins.d/splashy.c: - '' -
* plugins.d/usplash.c: - '' -
- files added:
- bugs.xml
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
73
77
import itertools
74
78
import collections
75
79
import codecs
80
import unittest
81
import random
82
import shlex
76
83
77
84
import dbus
78
85
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
86
import gi
87
from gi.repository import GLib
84
88
from dbus.mainloop.glib import DBusGMainLoop
85
89
import ctypes
86
90
import ctypes.util
87
91
import xml.dom.minidom
88
92
import inspect
89
93
90
try:
94
if sys.version_info.major == 2:
95
__metaclass__ = type
96
str = unicode
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
91
122
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
123
except AttributeError:
93
124
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
94
127
from IN import SO_BINDTODEVICE
95
128
except ImportError:
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.2"
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.13"
102
147
stored_state_file = "clients.pickle"
103
148
104
149
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
105
151
syslogger = None
106
152
107
153
try:
108
154
if_nametoindex = ctypes.cdll.LoadLibrary(
109
155
ctypes.util.find_library("c")).if_nametoindex
110
156
except (OSError, AttributeError):
111
157
112
158
def if_nametoindex(interface):
113
159
"Get an interface index the hard way, i.e. using fcntl()"
114
160
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
165
return interface_index
120
166
121
167
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
122
184
def initlogger(debug, level=logging.WARNING):
123
185
"""init logger and add loglevel"""
124
186
125
187
global syslogger
126
188
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
129
191
syslogger.setFormatter(logging.Formatter
130
192
('Mandos [%(process)d]: %(levelname)s:'
131
193
' %(message)s'))
132
194
logger.addHandler(syslogger)
133
195
134
196
if debug:
135
197
console = logging.StreamHandler()
136
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
208
pass
147
209
148
210
149
class PGPEngine(object):
211
class PGPEngine:
150
212
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
213
152
214
def __init__(self):
153
215
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
216
self.gpg = "gpg"
155
217
try:
156
218
output = subprocess.check_output(["gpgconf"])
157
219
for line in output.splitlines():
158
name, text, path = line.split(":")
159
if name == "gpg":
220
name, text, path = line.split(b":")
221
if name == b"gpg":
160
222
self.gpg = path
161
223
break
162
224
except OSError as e:
165
227
self.gnupgargs = ['--batch',
166
228
'--homedir', self.tempdir,
167
229
'--force-mdc',
168
'--quiet',
169
'--no-use-agent']
170
230
'--quiet']
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
171
235
def __enter__(self):
172
236
return self
173
237
174
238
def __exit__(self, exc_type, exc_value, traceback):
175
239
self._cleanup()
176
240
return False
177
241
178
242
def __del__(self):
179
243
self._cleanup()
180
244
181
245
def _cleanup(self):
182
246
if self.tempdir is not None:
183
247
# Delete contents of tempdir
184
248
for root, dirs, files in os.walk(self.tempdir,
185
topdown = False):
249
topdown=False):
186
250
for filename in files:
187
251
os.remove(os.path.join(root, filename))
188
252
for dirname in dirs:
190
254
# Remove tempdir
191
255
os.rmdir(self.tempdir)
192
256
self.tempdir = None
193
257
194
258
def password_encode(self, password):
195
259
# Passphrase can not be empty and can not contain newlines or
196
260
# NUL bytes. So we prefix it and hex encode it.
201
265
.replace(b"\n", b"\\n")
202
266
.replace(b"\0", b"\\x00"))
203
267
return encoded
204
268
205
269
def encrypt(self, data, password):
206
270
passphrase = self.password_encode(password)
207
271
with tempfile.NamedTemporaryFile(
212
276
'--passphrase-file',
213
277
passfile.name]
214
278
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
219
283
if proc.returncode != 0:
220
284
raise PGPError(err)
221
285
return ciphertext
222
286
223
287
def decrypt(self, data, password):
224
288
passphrase = self.password_encode(password)
225
289
with tempfile.NamedTemporaryFile(
226
dir = self.tempdir) as passfile:
290
dir=self.tempdir) as passfile:
227
291
passfile.write(passphrase)
228
292
passfile.flush()
229
293
proc = subprocess.Popen([self.gpg, '--decrypt',
230
294
'--passphrase-file',
231
295
passfile.name]
232
296
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
237
301
if proc.returncode != 0:
238
302
raise PGPError(err)
239
303
return decrypted_plaintext
240
304
241
305
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
242
332
class AvahiError(Exception):
243
333
def __init__(self, value, *args, **kwargs):
244
334
self.value = value
254
344
pass
255
345
256
346
257
class AvahiService(object):
347
class AvahiService:
258
348
"""An Avahi (Zeroconf) service.
259
349
260
350
Attributes:
261
351
interface: integer; avahi.IF_UNSPEC or an interface index.
262
352
Used to optionally bind to the specified interface.
274
364
server: D-Bus Server
275
365
bus: dbus.SystemBus()
276
366
"""
277
367
278
368
def __init__(self,
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
289
379
self.interface = interface
290
380
self.name = name
291
381
self.type = servicetype
300
390
self.server = None
301
391
self.bus = bus
302
392
self.entry_group_state_changed_match = None
303
393
304
394
def rename(self, remove=True):
305
395
"""Derived from the Avahi example code"""
306
396
if self.rename_count >= self.max_renames:
326
416
logger.critical("D-Bus Exception", exc_info=error)
327
417
self.cleanup()
328
418
os._exit(1)
329
419
330
420
def remove(self):
331
421
"""Derived from the Avahi example code"""
332
422
if self.entry_group_state_changed_match is not None:
334
424
self.entry_group_state_changed_match = None
335
425
if self.group is not None:
336
426
self.group.Reset()
337
427
338
428
def add(self):
339
429
"""Derived from the Avahi example code"""
340
430
self.remove()
357
447
dbus.UInt16(self.port),
358
448
avahi.string_array_to_txt_array(self.TXT))
359
449
self.group.Commit()
360
450
361
451
def entry_group_state_changed(self, state, error):
362
452
"""Derived from the Avahi example code"""
363
453
logger.debug("Avahi entry group state change: %i", state)
364
454
365
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
366
456
logger.debug("Zeroconf service established.")
367
457
elif state == avahi.ENTRY_GROUP_COLLISION:
371
461
logger.critical("Avahi: Error in group state changed %s",
372
462
str(error))
373
463
raise AvahiGroupError("State changed: {!s}".format(error))
374
464
375
465
def cleanup(self):
376
466
"""Derived from the Avahi example code"""
377
467
if self.group is not None:
382
472
pass
383
473
self.group = None
384
474
self.remove()
385
475
386
476
def server_state_changed(self, state, error=None):
387
477
"""Derived from the Avahi example code"""
388
478
logger.debug("Avahi server state change: %i", state)
417
507
logger.debug("Unknown state: %r", state)
418
508
else:
419
509
logger.debug("Unknown state: %r: %r", state, error)
420
510
421
511
def activate(self):
422
512
"""Derived from the Avahi example code"""
423
513
if self.server is None:
434
524
class AvahiServiceToSyslog(AvahiService):
435
525
def rename(self, *args, **kwargs):
436
526
"""Add the new name to the syslog messages"""
437
ret = AvahiService.rename(self, *args, **kwargs)
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
**kwargs)
438
529
syslogger.setFormatter(logging.Formatter(
439
530
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
440
531
.format(self.name)))
441
532
return ret
442
533
534
443
535
# Pretend that we have a GnuTLS module
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
536
class gnutls:
537
"""This isn't so much a class as it is a module-like namespace."""
538
539
library = ctypes.util.find_library("gnutls")
540
if library is None:
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
543
del library
544
459
545
# Unless otherwise indicated, the constants and types below are
460
546
# all from the gnutls/gnutls.h C header file.
461
547
462
548
# Constants
463
549
E_SUCCESS = 0
464
550
E_INTERRUPTED = -52
465
551
E_AGAIN = -28
466
552
CRT_OPENPGP = 2
553
CRT_RAWPK = 3
467
554
CLIENT = 2
468
555
SHUT_RDWR = 0
469
556
CRD_CERTIFICATE = 1
470
557
E_NO_CERTIFICATE_FOUND = -49
558
X509_FMT_DER = 0
559
NO_TICKETS = 1<<10
560
ENABLE_RAWPK = 1<<18
561
CTYPE_PEERS = 3
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
471
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
472
564
473
565
# Types
474
566
class session_int(ctypes.Structure):
475
567
_fields_ = []
476
568
session_t = ctypes.POINTER(session_int)
569
477
570
class certificate_credentials_st(ctypes.Structure):
478
571
_fields_ = []
479
572
certificate_credentials_t = ctypes.POINTER(
480
573
certificate_credentials_st)
481
574
certificate_type_t = ctypes.c_int
575
482
576
class datum_t(ctypes.Structure):
483
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
578
('size', ctypes.c_uint)]
579
485
580
class openpgp_crt_int(ctypes.Structure):
486
581
_fields_ = []
487
582
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
credentials_type_t = ctypes.c_int #
585
credentials_type_t = ctypes.c_int
491
586
transport_ptr_t = ctypes.c_void_p
492
587
close_request_t = ctypes.c_int
493
588
494
589
# Exceptions
495
590
class Error(Exception):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
591
def __init__(self, message=None, code=None, args=()):
501
592
# Default usage is by a message string, but if a return
502
593
# code is passed, convert it to a string with
503
594
# gnutls.strerror()
504
595
self.code = code
505
596
if message is None and code is not None:
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
597
message = gnutls.strerror(code)
598
return super(gnutls.Error, self).__init__(
508
599
message, *args)
509
600
510
601
class CertificateSecurityError(Error):
511
602
pass
512
603
513
604
# Classes
514
class Credentials(object):
605
class Credentials:
515
606
def __init__(self):
516
607
self._c_object = gnutls.certificate_credentials_t()
517
608
gnutls.certificate_allocate_credentials(
518
609
ctypes.byref(self._c_object))
519
610
self.type = gnutls.CRD_CERTIFICATE
520
611
521
612
def __del__(self):
522
613
gnutls.certificate_free_credentials(self._c_object)
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
614
615
class ClientSession:
616
def __init__(self, socket, credentials=None):
526
617
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
618
gnutls_flags = gnutls.CLIENT
619
if gnutls.check_version(b"3.5.6"):
620
gnutls_flags |= gnutls.NO_TICKETS
621
if gnutls.has_rawpk:
622
gnutls_flags |= gnutls.ENABLE_RAWPK
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
624
del gnutls_flags
528
625
gnutls.set_default_priority(self._c_object)
529
626
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
627
gnutls.handshake_set_private_extensions(self._c_object,
536
633
ctypes.cast(credentials._c_object,
537
634
ctypes.c_void_p))
538
635
self.credentials = credentials
539
636
540
637
def __del__(self):
541
638
gnutls.deinit(self._c_object)
542
639
543
640
def handshake(self):
544
641
return gnutls.handshake(self._c_object)
545
642
546
643
def send(self, data):
547
644
data = bytes(data)
548
645
data_len = len(data)
550
647
data_len -= gnutls.record_send(self._c_object,
551
648
data[-data_len:],
552
649
data_len)
553
650
554
651
def bye(self):
555
652
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
653
557
654
# Error handling functions
558
655
def _error_code(result):
559
656
"""A function to raise exceptions on errors, suitable
561
658
if result >= 0:
562
659
return result
563
660
if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
661
raise gnutls.CertificateSecurityError(code=result)
662
raise gnutls.Error(code=result)
663
567
664
def _retry_on_error(result, func, arguments):
568
665
"""A function to retry on some errors, suitable
569
666
for the 'errcheck' attribute on ctypes functions"""
572
669
return _error_code(result)
573
670
result = func(*arguments)
574
671
return result
575
672
576
673
# Unless otherwise indicated, the function declarations below are
577
674
# all from the gnutls/gnutls.h C header file.
578
675
579
676
# Functions
580
677
priority_set_direct = _library.gnutls_priority_set_direct
581
678
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
679
ctypes.POINTER(ctypes.c_char_p)]
583
680
priority_set_direct.restype = _error_code
584
681
585
682
init = _library.gnutls_init
586
683
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
684
init.restype = _error_code
588
685
589
686
set_default_priority = _library.gnutls_set_default_priority
590
687
set_default_priority.argtypes = [session_t]
591
688
set_default_priority.restype = _error_code
592
689
593
690
record_send = _library.gnutls_record_send
594
691
record_send.argtypes = [session_t, ctypes.c_void_p,
595
692
ctypes.c_size_t]
596
693
record_send.restype = ctypes.c_ssize_t
597
694
record_send.errcheck = _retry_on_error
598
695
599
696
certificate_allocate_credentials = (
600
697
_library.gnutls_certificate_allocate_credentials)
601
698
certificate_allocate_credentials.argtypes = [
602
699
ctypes.POINTER(certificate_credentials_t)]
603
700
certificate_allocate_credentials.restype = _error_code
604
701
605
702
certificate_free_credentials = (
606
703
_library.gnutls_certificate_free_credentials)
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
704
certificate_free_credentials.argtypes = [
705
certificate_credentials_t]
608
706
certificate_free_credentials.restype = None
609
707
610
708
handshake_set_private_extensions = (
611
709
_library.gnutls_handshake_set_private_extensions)
612
710
handshake_set_private_extensions.argtypes = [session_t,
613
711
ctypes.c_int]
614
712
handshake_set_private_extensions.restype = None
615
713
616
714
credentials_set = _library.gnutls_credentials_set
617
715
credentials_set.argtypes = [session_t, credentials_type_t,
618
716
ctypes.c_void_p]
619
717
credentials_set.restype = _error_code
620
718
621
719
strerror = _library.gnutls_strerror
622
720
strerror.argtypes = [ctypes.c_int]
623
721
strerror.restype = ctypes.c_char_p
624
722
625
723
certificate_type_get = _library.gnutls_certificate_type_get
626
724
certificate_type_get.argtypes = [session_t]
627
725
certificate_type_get.restype = _error_code
628
726
629
727
certificate_get_peers = _library.gnutls_certificate_get_peers
630
728
certificate_get_peers.argtypes = [session_t,
631
729
ctypes.POINTER(ctypes.c_uint)]
632
730
certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
731
634
732
global_set_log_level = _library.gnutls_global_set_log_level
635
733
global_set_log_level.argtypes = [ctypes.c_int]
636
734
global_set_log_level.restype = None
637
735
638
736
global_set_log_function = _library.gnutls_global_set_log_function
639
737
global_set_log_function.argtypes = [log_func]
640
738
global_set_log_function.restype = None
641
739
642
740
deinit = _library.gnutls_deinit
643
741
deinit.argtypes = [session_t]
644
742
deinit.restype = None
645
743
646
744
handshake = _library.gnutls_handshake
647
745
handshake.argtypes = [session_t]
648
746
handshake.restype = _error_code
649
747
handshake.errcheck = _retry_on_error
650
748
651
749
transport_set_ptr = _library.gnutls_transport_set_ptr
652
750
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
751
transport_set_ptr.restype = None
654
752
655
753
bye = _library.gnutls_bye
656
754
bye.argtypes = [session_t, close_request_t]
657
755
bye.restype = _error_code
658
756
bye.errcheck = _retry_on_error
659
757
660
758
check_version = _library.gnutls_check_version
661
759
check_version.argtypes = [ctypes.c_char_p]
662
760
check_version.restype = ctypes.c_char_p
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
761
762
_need_version = b"3.3.0"
763
if check_version(_need_version) is None:
764
raise self.Error("Needs GnuTLS {} or later"
765
.format(_need_version))
766
767
_tls_rawpk_version = b"3.6.6"
768
has_rawpk = bool(check_version(_tls_rawpk_version))
769
770
if has_rawpk:
771
# Types
772
class pubkey_st(ctypes.Structure):
773
_fields = []
774
pubkey_t = ctypes.POINTER(pubkey_st)
775
776
x509_crt_fmt_t = ctypes.c_int
777
778
# All the function declarations below are from
779
# gnutls/abstract.h
780
pubkey_init = _library.gnutls_pubkey_init
781
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
782
pubkey_init.restype = _error_code
783
784
pubkey_import = _library.gnutls_pubkey_import
785
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
786
x509_crt_fmt_t]
787
pubkey_import.restype = _error_code
788
789
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
790
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
791
ctypes.POINTER(ctypes.c_ubyte),
792
ctypes.POINTER(ctypes.c_size_t)]
793
pubkey_get_key_id.restype = _error_code
794
795
pubkey_deinit = _library.gnutls_pubkey_deinit
796
pubkey_deinit.argtypes = [pubkey_t]
797
pubkey_deinit.restype = None
798
else:
799
# All the function declarations below are from
800
# gnutls/openpgp.h
801
802
openpgp_crt_init = _library.gnutls_openpgp_crt_init
803
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
804
openpgp_crt_init.restype = _error_code
805
806
openpgp_crt_import = _library.gnutls_openpgp_crt_import
807
openpgp_crt_import.argtypes = [openpgp_crt_t,
808
ctypes.POINTER(datum_t),
809
openpgp_crt_fmt_t]
810
openpgp_crt_import.restype = _error_code
811
812
openpgp_crt_verify_self = \
813
_library.gnutls_openpgp_crt_verify_self
814
openpgp_crt_verify_self.argtypes = [
815
openpgp_crt_t,
816
ctypes.c_uint,
817
ctypes.POINTER(ctypes.c_uint),
818
]
819
openpgp_crt_verify_self.restype = _error_code
820
821
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
822
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
823
openpgp_crt_deinit.restype = None
824
825
openpgp_crt_get_fingerprint = (
826
_library.gnutls_openpgp_crt_get_fingerprint)
827
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
828
ctypes.c_void_p,
829
ctypes.POINTER(
830
ctypes.c_size_t)]
831
openpgp_crt_get_fingerprint.restype = _error_code
832
833
if check_version(b"3.6.4"):
834
certificate_type_get2 = _library.gnutls_certificate_type_get2
835
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
836
certificate_type_get2.restype = _error_code
837
693
838
# Remove non-public functions
694
839
del _error_code, _retry_on_error
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
840
697
841
698
842
def call_pipe(connection, # : multiprocessing.Connection
699
843
func, *args, **kwargs):
700
844
"""This function is meant to be called by multiprocessing.Process
701
845
702
846
This function runs func(*args, **kwargs), and writes the resulting
703
847
return value on the provided multiprocessing.Connection.
704
848
"""
705
849
connection.send(func(*args, **kwargs))
706
850
connection.close()
707
851
708
class Client(object):
852
853
class Client:
709
854
"""A representation of a client host served by this server.
710
855
711
856
Attributes:
712
857
approved: bool(); 'None' if not yet approved/disapproved
713
858
approval_delay: datetime.timedelta(); Time to wait for approval
714
859
approval_duration: datetime.timedelta(); Duration of one approval
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a gobject event source tag, or None
860
checker: multiprocessing.Process(); a running checker process used
861
to see if the client lives. 'None' if no process is
862
running.
863
checker_callback_tag: a GLib event source tag, or None
719
864
checker_command: string; External command which is run to check
720
865
if client lives. %() expansions are done at
721
866
runtime with vars(self) as dict, so that for
722
867
instance %(name)s can be used in the command.
723
checker_initiator_tag: a gobject event source tag, or None
868
checker_initiator_tag: a GLib event source tag, or None
724
869
created: datetime.datetime(); (UTC) object creation
725
870
client_structure: Object describing what attributes a client has
726
871
and is used for storing the client at exit
727
872
current_checker_command: string; current running checker_command
728
disable_initiator_tag: a gobject event source tag, or None
873
disable_initiator_tag: a GLib event source tag, or None
729
874
enabled: bool()
730
875
fingerprint: string (40 or 32 hexadecimal digits); used to
731
uniquely identify the client
876
uniquely identify an OpenPGP client
877
key_id: string (64 hexadecimal digits); used to uniquely identify
878
a client using raw public keys
732
879
host: string; available for use by the checker command
733
880
interval: datetime.timedelta(); How often to start a new checker
734
881
last_approval_request: datetime.datetime(); (UTC) or None
750
897
disabled, or None
751
898
server_settings: The server_settings dict from main()
752
899
"""
753
900
754
901
runtime_expansions = ("approval_delay", "approval_duration",
755
"created", "enabled", "expires",
902
"created", "enabled", "expires", "key_id",
756
903
"fingerprint", "host", "interval",
757
904
"last_approval_request", "last_checked_ok",
758
905
"last_enabled", "name", "timeout")
767
914
"approved_by_default": "True",
768
915
"enabled": "True",
769
916
}
770
917
771
918
@staticmethod
772
919
def config_parser(config):
773
920
"""Construct a new dict of client settings of this form:
780
927
for client_name in config.sections():
781
928
section = dict(config.items(client_name))
782
929
client = settings[client_name] = {}
783
930
784
931
client["host"] = section["host"]
785
932
# Reformat values from string types to Python types
786
933
client["approved_by_default"] = config.getboolean(
787
934
client_name, "approved_by_default")
788
935
client["enabled"] = config.getboolean(client_name,
789
936
"enabled")
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
937
938
# Uppercase and remove spaces from key_id and fingerprint
939
# for later comparison purposes with return value from the
940
# key_id() and fingerprint() functions
941
client["key_id"] = (section.get("key_id", "").upper()
942
.replace(" ", ""))
794
943
client["fingerprint"] = (section["fingerprint"].upper()
795
944
.replace(" ", ""))
796
945
if "secret" in section:
797
client["secret"] = section["secret"].decode("base64")
946
client["secret"] = codecs.decode(section["secret"]
947
.encode("utf-8"),
948
"base64")
798
949
elif "secfile" in section:
799
950
with open(os.path.expanduser(os.path.expandvars
800
951
(section["secfile"])),
815
966
client["last_approval_request"] = None
816
967
client["last_checked_ok"] = None
817
968
client["last_checker_status"] = -2
818
969
819
970
return settings
820
821
def __init__(self, settings, name = None, server_settings=None):
971
972
def __init__(self, settings, name=None, server_settings=None):
822
973
self.name = name
823
974
if server_settings is None:
824
975
server_settings = {}
826
977
# adding all client settings
827
978
for setting, value in settings.items():
828
979
setattr(self, setting, value)
829
980
830
981
if self.enabled:
831
982
if not hasattr(self, "last_enabled"):
832
983
self.last_enabled = datetime.datetime.utcnow()
836
987
else:
837
988
self.last_enabled = None
838
989
self.expires = None
839
990
840
991
logger.debug("Creating client %r", self.name)
992
logger.debug(" Key ID: %s", self.key_id)
841
993
logger.debug(" Fingerprint: %s", self.fingerprint)
842
994
self.created = settings.get("created",
843
995
datetime.datetime.utcnow())
844
996
845
997
# attributes specific for this server instance
846
998
self.checker = None
847
999
self.checker_initiator_tag = None
853
1005
self.changedstate = multiprocessing_manager.Condition(
854
1006
multiprocessing_manager.Lock())
855
1007
self.client_structure = [attr
856
for attr in self.__dict__.iterkeys()
1008
for attr in self.__dict__.keys()
857
1009
if not attr.startswith("_")]
858
1010
self.client_structure.append("client_structure")
859
1011
860
1012
for name, t in inspect.getmembers(
861
1013
type(self), lambda obj: isinstance(obj, property)):
862
1014
if not name.startswith("_"):
863
1015
self.client_structure.append(name)
864
1016
865
1017
# Send notice to process children that client state has changed
866
1018
def send_changedstate(self):
867
1019
with self.changedstate:
868
1020
self.changedstate.notify_all()
869
1021
870
1022
def enable(self):
871
1023
"""Start this client's checker and timeout hooks"""
872
1024
if getattr(self, "enabled", False):
877
1029
self.last_enabled = datetime.datetime.utcnow()
878
1030
self.init_checker()
879
1031
self.send_changedstate()
880
1032
881
1033
def disable(self, quiet=True):
882
1034
"""Disable this client."""
883
1035
if not getattr(self, "enabled", False):
885
1037
if not quiet:
886
1038
logger.info("Disabling client %s", self.name)
887
1039
if getattr(self, "disable_initiator_tag", None) is not None:
888
gobject.source_remove(self.disable_initiator_tag)
1040
GLib.source_remove(self.disable_initiator_tag)
889
1041
self.disable_initiator_tag = None
890
1042
self.expires = None
891
1043
if getattr(self, "checker_initiator_tag", None) is not None:
892
gobject.source_remove(self.checker_initiator_tag)
1044
GLib.source_remove(self.checker_initiator_tag)
893
1045
self.checker_initiator_tag = None
894
1046
self.stop_checker()
895
1047
self.enabled = False
896
1048
if not quiet:
897
1049
self.send_changedstate()
898
# Do not run this again if called by a gobject.timeout_add
1050
# Do not run this again if called by a GLib.timeout_add
899
1051
return False
900
1052
901
1053
def __del__(self):
902
1054
self.disable()
903
1055
904
1056
def init_checker(self):
905
1057
# Schedule a new checker to be started an 'interval' from now,
906
1058
# and every interval from then on.
907
1059
if self.checker_initiator_tag is not None:
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
910
int(self.interval.total_seconds() * 1000),
1060
GLib.source_remove(self.checker_initiator_tag)
1061
self.checker_initiator_tag = GLib.timeout_add(
1062
random.randrange(int(self.interval.total_seconds() * 1000
1063
+ 1)),
911
1064
self.start_checker)
912
1065
# Schedule a disable() when 'timeout' has passed
913
1066
if self.disable_initiator_tag is not None:
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
1067
GLib.source_remove(self.disable_initiator_tag)
1068
self.disable_initiator_tag = GLib.timeout_add(
916
1069
int(self.timeout.total_seconds() * 1000), self.disable)
917
1070
# Also start a new checker *right now*.
918
1071
self.start_checker()
919
1072
920
1073
def checker_callback(self, source, condition, connection,
921
1074
command):
922
1075
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
924
self.checker = None
925
1076
# Read return code from connection (see call_pipe)
926
1077
returncode = connection.recv()
927
1078
connection.close()
928
1079
if self.checker is not None:
1080
self.checker.join()
1081
self.checker_callback_tag = None
1082
self.checker = None
1083
929
1084
if returncode >= 0:
930
1085
self.last_checker_status = returncode
931
1086
self.last_checker_signal = None
941
1096
logger.warning("Checker for %(name)s crashed?",
942
1097
vars(self))
943
1098
return False
944
1099
945
1100
def checked_ok(self):
946
1101
"""Assert that the client has been seen, alive and well."""
947
1102
self.last_checked_ok = datetime.datetime.utcnow()
948
1103
self.last_checker_status = 0
949
1104
self.last_checker_signal = None
950
1105
self.bump_timeout()
951
1106
952
1107
def bump_timeout(self, timeout=None):
953
1108
"""Bump up the timeout for this client."""
954
1109
if timeout is None:
955
1110
timeout = self.timeout
956
1111
if self.disable_initiator_tag is not None:
957
gobject.source_remove(self.disable_initiator_tag)
1112
GLib.source_remove(self.disable_initiator_tag)
958
1113
self.disable_initiator_tag = None
959
1114
if getattr(self, "enabled", False):
960
self.disable_initiator_tag = gobject.timeout_add(
1115
self.disable_initiator_tag = GLib.timeout_add(
961
1116
int(timeout.total_seconds() * 1000), self.disable)
962
1117
self.expires = datetime.datetime.utcnow() + timeout
963
1118
964
1119
def need_approval(self):
965
1120
self.last_approval_request = datetime.datetime.utcnow()
966
1121
967
1122
def start_checker(self):
968
1123
"""Start a new checker subprocess if one is not running.
969
1124
970
1125
If a checker already exists, leave it running and do
971
1126
nothing."""
972
1127
# The reason for not killing a running checker is that if we
977
1132
# checkers alone, the checker would have to take more time
978
1133
# than 'timeout' for the client to be disabled, which is as it
979
1134
# should be.
980
1135
981
1136
if self.checker is not None and not self.checker.is_alive():
982
1137
logger.warning("Checker was not alive; joining")
983
1138
self.checker.join()
986
1141
if self.checker is None:
987
1142
# Escape attributes for the shell
988
1143
escaped_attrs = {
989
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
1144
attr: shlex.quote(str(getattr(self, attr)))
1145
for attr in self.runtime_expansions}
991
1146
try:
992
1147
command = self.checker_command % escaped_attrs
993
1148
except TypeError as error:
1005
1160
# The exception is when not debugging but nevertheless
1006
1161
# running in the foreground; use the previously
1007
1162
# created wnull.
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1163
popen_args = {"close_fds": True,
1164
"shell": True,
1165
"cwd": "/"}
1011
1166
if (not self.server_settings["debug"]
1012
1167
and self.server_settings["foreground"]):
1013
1168
popen_args.update({"stdout": wnull,
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1169
"stderr": wnull})
1170
pipe = multiprocessing.Pipe(duplex=False)
1016
1171
self.checker = multiprocessing.Process(
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1172
target=call_pipe,
1173
args=(pipe[1], subprocess.call, command),
1174
kwargs=popen_args)
1020
1175
self.checker.start()
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1176
self.checker_callback_tag = GLib.io_add_watch(
1177
GLib.IOChannel.unix_new(pipe[0].fileno()),
1178
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1023
1179
self.checker_callback, pipe[0], command)
1024
# Re-run this periodically if run by gobject.timeout_add
1180
# Re-run this periodically if run by GLib.timeout_add
1025
1181
return True
1026
1182
1027
1183
def stop_checker(self):
1028
1184
"""Force the checker process, if any, to stop."""
1029
1185
if self.checker_callback_tag:
1030
gobject.source_remove(self.checker_callback_tag)
1186
GLib.source_remove(self.checker_callback_tag)
1031
1187
self.checker_callback_tag = None
1032
1188
if getattr(self, "checker", None) is None:
1033
1189
return
1042
1198
byte_arrays=False):
1043
1199
"""Decorators for marking methods of a DBusObjectWithProperties to
1044
1200
become properties on the D-Bus.
1045
1201
1046
1202
The decorated method will be called with no arguments by "Get"
1047
1203
and with one argument by "Set".
1048
1204
1049
1205
The parameters, where they are supported, are the same as
1050
1206
dbus.service.method, except there is only "signature", since the
1051
1207
type from Get() and the type sent to Set() is the same.
1055
1211
if byte_arrays and signature != "ay":
1056
1212
raise ValueError("Byte arrays not supported for non-'ay'"
1057
1213
" signature {!r}".format(signature))
1058
1214
1059
1215
def decorator(func):
1060
1216
func._dbus_is_property = True
1061
1217
func._dbus_interface = dbus_interface
1064
1220
func._dbus_name = func.__name__
1065
1221
if func._dbus_name.endswith("_dbus_property"):
1066
1222
func._dbus_name = func._dbus_name[:-14]
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1223
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1068
1224
return func
1069
1225
1070
1226
return decorator
1071
1227
1072
1228
1073
1229
def dbus_interface_annotations(dbus_interface):
1074
1230
"""Decorator for marking functions returning interface annotations
1075
1231
1076
1232
Usage:
1077
1233
1078
1234
@dbus_interface_annotations("org.example.Interface")
1079
1235
def _foo(self): # Function name does not matter
1080
1236
return {"org.freedesktop.DBus.Deprecated": "true",
1081
1237
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1082
1238
"false"}
1083
1239
"""
1084
1240
1085
1241
def decorator(func):
1086
1242
func._dbus_is_interface = True
1087
1243
func._dbus_interface = dbus_interface
1088
1244
func._dbus_name = dbus_interface
1089
1245
return func
1090
1246
1091
1247
return decorator
1092
1248
1093
1249
1094
1250
def dbus_annotations(annotations):
1095
1251
"""Decorator to annotate D-Bus methods, signals or properties
1096
1252
Usage:
1097
1253
1098
1254
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1099
1255
"org.freedesktop.DBus.Property."
1100
1256
"EmitsChangedSignal": "false"})
1102
1258
access="r")
1103
1259
def Property_dbus_property(self):
1104
1260
return dbus.Boolean(False)
1105
1261
1106
1262
See also the DBusObjectWithAnnotations class.
1107
1263
"""
1108
1264
1109
1265
def decorator(func):
1110
1266
func._dbus_annotations = annotations
1111
1267
return func
1112
1268
1113
1269
return decorator
1114
1270
1115
1271
1133
1289
1134
1290
class DBusObjectWithAnnotations(dbus.service.Object):
1135
1291
"""A D-Bus object with annotations.
1136
1292
1137
1293
Classes inheriting from this can use the dbus_annotations
1138
1294
decorator to add annotations to methods or signals.
1139
1295
"""
1140
1296
1141
1297
@staticmethod
1142
1298
def _is_dbus_thing(thing):
1143
1299
"""Returns a function testing if an attribute is a D-Bus thing
1144
1300
1145
1301
If called like _is_dbus_thing("method") it returns a function
1146
1302
suitable for use as predicate to inspect.getmembers().
1147
1303
"""
1148
1304
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1149
1305
False)
1150
1306
1151
1307
def _get_all_dbus_things(self, thing):
1152
1308
"""Returns a generator of (name, attribute) pairs
1153
1309
"""
1156
1312
for cls in self.__class__.__mro__
1157
1313
for name, athing in
1158
1314
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
1315
1160
1316
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1317
out_signature="s",
1318
path_keyword='object_path',
1319
connection_keyword='connection')
1164
1320
def Introspect(self, object_path, connection):
1165
1321
"""Overloading of standard D-Bus method.
1166
1322
1167
1323
Inserts annotation tags on methods and signals.
1168
1324
"""
1169
1325
xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
1326
connection)
1171
1327
try:
1172
1328
document = xml.dom.minidom.parseString(xmlstring)
1173
1329
1174
1330
for if_tag in document.getElementsByTagName("interface"):
1175
1331
# Add annotation tags
1176
1332
for typ in ("method", "signal"):
1203
1359
if_tag.appendChild(ann_tag)
1204
1360
# Fix argument name for the Introspect method itself
1205
1361
if (if_tag.getAttribute("name")
1206
== dbus.INTROSPECTABLE_IFACE):
1362
== dbus.INTROSPECTABLE_IFACE):
1207
1363
for cn in if_tag.getElementsByTagName("method"):
1208
1364
if cn.getAttribute("name") == "Introspect":
1209
1365
for arg in cn.getElementsByTagName("arg"):
1222
1378
1223
1379
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
1380
"""A D-Bus object with properties.
1225
1381
1226
1382
Classes inheriting from this can use the dbus_service_property
1227
1383
decorator to expose methods as D-Bus properties. It exposes the
1228
1384
standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
1385
"""
1230
1386
1231
1387
def _get_dbus_property(self, interface_name, property_name):
1232
1388
"""Returns a bound method if one exists which is a D-Bus
1233
1389
property with the specified name and interface.
1238
1394
if (value._dbus_name == property_name
1239
1395
and value._dbus_interface == interface_name):
1240
1396
return value.__get__(self)
1241
1397
1242
1398
# No such property
1243
1399
raise DBusPropertyNotFound("{}:{}.{}".format(
1244
1400
self.dbus_object_path, interface_name, property_name))
1245
1401
1246
1402
@classmethod
1247
1403
def _get_all_interface_names(cls):
1248
1404
"""Get a sequence of all interfaces supported by an object"""
1251
1407
for x in (inspect.getmro(cls))
1252
1408
for attr in dir(x))
1253
1409
if name is not None)
1254
1410
1255
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1256
1412
in_signature="ss",
1257
1413
out_signature="v")
1265
1421
if not hasattr(value, "variant_level"):
1266
1422
return value
1267
1423
return type(value)(value, variant_level=value.variant_level+1)
1268
1424
1269
1425
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1270
1426
def Set(self, interface_name, property_name, value):
1271
1427
"""Standard D-Bus property Set() method, see D-Bus standard.
1280
1436
raise ValueError("Byte arrays not supported for non-"
1281
1437
"'ay' signature {!r}"
1282
1438
.format(prop._dbus_signature))
1283
value = dbus.ByteArray(b''.join(chr(byte)
1284
for byte in value))
1439
value = dbus.ByteArray(bytes(value))
1285
1440
prop(value)
1286
1441
1287
1442
@dbus.service.method(dbus.PROPERTIES_IFACE,
1288
1443
in_signature="s",
1289
1444
out_signature="a{sv}")
1290
1445
def GetAll(self, interface_name):
1291
1446
"""Standard D-Bus property GetAll() method, see D-Bus
1292
1447
standard.
1293
1448
1294
1449
Note: Will not include properties with access="write".
1295
1450
"""
1296
1451
properties = {}
1307
1462
properties[name] = value
1308
1463
continue
1309
1464
properties[name] = type(value)(
1310
value, variant_level = value.variant_level + 1)
1465
value, variant_level=value.variant_level + 1)
1311
1466
return dbus.Dictionary(properties, signature="sv")
1312
1467
1313
1468
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1314
1469
def PropertiesChanged(self, interface_name, changed_properties,
1315
1470
invalidated_properties):
1317
1472
standard.
1318
1473
"""
1319
1474
pass
1320
1475
1321
1476
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1322
1477
out_signature="s",
1323
1478
path_keyword='object_path',
1324
1479
connection_keyword='connection')
1325
1480
def Introspect(self, object_path, connection):
1326
1481
"""Overloading of standard D-Bus method.
1327
1482
1328
1483
Inserts property tags and interface annotation tags.
1329
1484
"""
1330
1485
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1332
1487
connection)
1333
1488
try:
1334
1489
document = xml.dom.minidom.parseString(xmlstring)
1335
1490
1336
1491
def make_tag(document, name, prop):
1337
1492
e = document.createElement("property")
1338
1493
e.setAttribute("name", name)
1339
1494
e.setAttribute("type", prop._dbus_signature)
1340
1495
e.setAttribute("access", prop._dbus_access)
1341
1496
return e
1342
1497
1343
1498
for if_tag in document.getElementsByTagName("interface"):
1344
1499
# Add property tags
1345
1500
for tag in (make_tag(document, name, prop)
1387
1542
exc_info=error)
1388
1543
return xmlstring
1389
1544
1545
1390
1546
try:
1391
1547
dbus.OBJECT_MANAGER_IFACE
1392
1548
except AttributeError:
1393
1549
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
1550
1551
1395
1552
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
1553
"""A D-Bus object with an ObjectManager.
1397
1554
1398
1555
Classes inheriting from this exposes the standard
1399
1556
GetManagedObjects call and the InterfacesAdded and
1400
1557
InterfacesRemoved signals on the standard
1401
1558
"org.freedesktop.DBus.ObjectManager" interface.
1402
1559
1403
1560
Note: No signals are sent automatically; they must be sent
1404
1561
manually.
1405
1562
"""
1406
1563
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
out_signature = "a{oa{sa{sv}}}")
1564
out_signature="a{oa{sa{sv}}}")
1408
1565
def GetManagedObjects(self):
1409
1566
"""This function must be overridden"""
1410
1567
raise NotImplementedError()
1411
1568
1412
1569
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
signature = "oa{sa{sv}}")
1570
signature="oa{sa{sv}}")
1414
1571
def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
1572
pass
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1573
1574
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1418
1575
def InterfacesRemoved(self, object_path, interfaces):
1419
1576
pass
1420
1577
1421
1578
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1579
out_signature="s",
1580
path_keyword='object_path',
1581
connection_keyword='connection')
1425
1582
def Introspect(self, object_path, connection):
1426
1583
"""Overloading of standard D-Bus method.
1427
1584
1428
1585
Override return argument name of GetManagedObjects to be
1429
1586
"objpath_interfaces_and_properties"
1430
1587
"""
1433
1590
connection)
1434
1591
try:
1435
1592
document = xml.dom.minidom.parseString(xmlstring)
1436
1593
1437
1594
for if_tag in document.getElementsByTagName("interface"):
1438
1595
# Fix argument name for the GetManagedObjects method
1439
1596
if (if_tag.getAttribute("name")
1440
== dbus.OBJECT_MANAGER_IFACE):
1597
== dbus.OBJECT_MANAGER_IFACE):
1441
1598
for cn in if_tag.getElementsByTagName("method"):
1442
1599
if (cn.getAttribute("name")
1443
1600
== "GetManagedObjects"):
1453
1610
except (AttributeError, xml.dom.DOMException,
1454
1611
xml.parsers.expat.ExpatError) as error:
1455
1612
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1613
exc_info=error)
1457
1614
return xmlstring
1458
1615
1616
1459
1617
def datetime_to_dbus(dt, variant_level=0):
1460
1618
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1461
1619
if dt is None:
1462
return dbus.String("", variant_level = variant_level)
1620
return dbus.String("", variant_level=variant_level)
1463
1621
return dbus.String(dt.isoformat(), variant_level=variant_level)
1464
1622
1465
1623
1468
1626
dbus.service.Object, it will add alternate D-Bus attributes with
1469
1627
interface names according to the "alt_interface_names" mapping.
1470
1628
Usage:
1471
1629
1472
1630
@alternate_dbus_interfaces({"org.example.Interface":
1473
1631
"net.example.AlternateInterface"})
1474
1632
class SampleDBusObject(dbus.service.Object):
1475
1633
@dbus.service.method("org.example.Interface")
1476
1634
def SampleDBusMethod():
1477
1635
pass
1478
1636
1479
1637
The above "SampleDBusMethod" on "SampleDBusObject" will be
1480
1638
reachable via two interfaces: "org.example.Interface" and
1481
1639
"net.example.AlternateInterface", the latter of which will have
1482
1640
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1483
1641
"true", unless "deprecate" is passed with a False value.
1484
1642
1485
1643
This works for methods and signals, and also for D-Bus properties
1486
1644
(from DBusObjectWithProperties) and interfaces (from the
1487
1645
dbus_interface_annotations decorator).
1488
1646
"""
1489
1647
1490
1648
def wrapper(cls):
1491
1649
for orig_interface_name, alt_interface_name in (
1492
1650
alt_interface_names.items()):
1507
1665
interface_names.add(alt_interface)
1508
1666
# Is this a D-Bus signal?
1509
1667
if getattr(attribute, "_dbus_is_signal", False):
1668
# Extract the original non-method undecorated
1669
# function by black magic
1510
1670
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1513
1671
nonmethod_func = (dict(
1514
1672
zip(attribute.func_code.co_freevars,
1515
1673
attribute.__closure__))
1516
1674
["func"].cell_contents)
1517
1675
else:
1518
nonmethod_func = attribute
1676
nonmethod_func = (dict(
1677
zip(attribute.__code__.co_freevars,
1678
attribute.__closure__))
1679
["func"].cell_contents)
1519
1680
# Create a new, but exactly alike, function
1520
1681
# object, and decorate it to be a new D-Bus signal
1521
1682
# with the alternate D-Bus interface name
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1683
new_function = copy_function(nonmethod_func)
1536
1684
new_function = (dbus.service.signal(
1537
1685
alt_interface,
1538
1686
attribute._dbus_signature)(new_function))
1542
1690
attribute._dbus_annotations)
1543
1691
except AttributeError:
1544
1692
pass
1693
1545
1694
# Define a creator of a function to call both the
1546
1695
# original and alternate functions, so both the
1547
1696
# original and alternate signals gets sent when
1550
1699
"""This function is a scope container to pass
1551
1700
func1 and func2 to the "call_both" function
1552
1701
outside of its arguments"""
1553
1702
1554
1703
@functools.wraps(func2)
1555
1704
def call_both(*args, **kwargs):
1556
1705
"""This function will emit two D-Bus
1557
1706
signals by calling func1 and func2"""
1558
1707
func1(*args, **kwargs)
1559
1708
func2(*args, **kwargs)
1560
# Make wrapper function look like a D-Bus signal
1709
# Make wrapper function look like a D-Bus
1710
# signal
1561
1711
for name, attr in inspect.getmembers(func2):
1562
1712
if name.startswith("_dbus_"):
1563
1713
setattr(call_both, name, attr)
1564
1714
1565
1715
return call_both
1566
1716
# Create the "call_both" function and add it to
1567
1717
# the class
1577
1727
alt_interface,
1578
1728
attribute._dbus_in_signature,
1579
1729
attribute._dbus_out_signature)
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1730
(copy_function(attribute)))
1585
1731
# Copy annotations, if any
1586
1732
try:
1587
1733
attr[attrname]._dbus_annotations = dict(
1599
1745
attribute._dbus_access,
1600
1746
attribute._dbus_get_args_options
1601
1747
["byte_arrays"])
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1748
(copy_function(attribute)))
1608
1749
# Copy annotations, if any
1609
1750
try:
1610
1751
attr[attrname]._dbus_annotations = dict(
1619
1760
# to the class.
1620
1761
attr[attrname] = (
1621
1762
dbus_interface_annotations(alt_interface)
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1763
(copy_function(attribute)))
1627
1764
if deprecate:
1628
1765
# Deprecate all alternate interfaces
1629
iname="_AlternateDBusNames_interface_annotation{}"
1766
iname = "_AlternateDBusNames_interface_annotation{}"
1630
1767
for interface_name in interface_names:
1631
1768
1632
1769
@dbus_interface_annotations(interface_name)
1633
1770
def func(self):
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1771
return {"org.freedesktop.DBus.Deprecated":
1772
"true"}
1636
1773
# Find an unused name
1637
1774
for aname in (iname.format(i)
1638
1775
for i in itertools.count()):
1642
1779
if interface_names:
1643
1780
# Replace the class with a new subclass of it with
1644
1781
# methods, signals, etc. as created above.
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1782
if sys.version_info.major == 2:
1783
cls = type(b"{}Alternate".format(cls.__name__),
1784
(cls, ), attr)
1785
else:
1786
cls = type("{}Alternate".format(cls.__name__),
1787
(cls, ), attr)
1647
1788
return cls
1648
1789
1649
1790
return wrapper
1650
1791
1651
1792
1653
1794
"se.bsnet.fukt.Mandos"})
1654
1795
class ClientDBus(Client, DBusObjectWithProperties):
1655
1796
"""A Client class using D-Bus
1656
1797
1657
1798
Attributes:
1658
1799
dbus_object_path: dbus.ObjectPath
1659
1800
bus: dbus.SystemBus()
1660
1801
"""
1661
1802
1662
1803
runtime_expansions = (Client.runtime_expansions
1663
1804
+ ("dbus_object_path", ))
1664
1805
1665
1806
_interface = "se.recompile.Mandos.Client"
1666
1807
1667
1808
# dbus.service.Object doesn't use super(), so we can't either.
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1809
1810
def __init__(self, bus=None, *args, **kwargs):
1670
1811
self.bus = bus
1671
1812
Client.__init__(self, *args, **kwargs)
1672
1813
# Only now, when this client is initialized, can it show up on
1678
1819
"/clients/" + client_object_name)
1679
1820
DBusObjectWithProperties.__init__(self, self.bus,
1680
1821
self.dbus_object_path)
1681
1822
1682
1823
def notifychangeproperty(transform_func, dbus_name,
1683
1824
type_func=lambda x: x,
1684
1825
variant_level=1,
1686
1827
_interface=_interface):
1687
1828
""" Modify a variable so that it's a property which announces
1688
1829
its changes to DBus.
1689
1830
1690
1831
transform_fun: Function that takes a value and a variant_level
1691
1832
and transforms it to a D-Bus type.
1692
1833
dbus_name: D-Bus name of the variable
1695
1836
variant_level: D-Bus variant level. Default: 1
1696
1837
"""
1697
1838
attrname = "_{}".format(dbus_name)
1698
1839
1699
1840
def setter(self, value):
1700
1841
if hasattr(self, "dbus_object_path"):
1701
1842
if (not hasattr(self, attrname) or
1708
1849
else:
1709
1850
dbus_value = transform_func(
1710
1851
type_func(value),
1711
variant_level = variant_level)
1852
variant_level=variant_level)
1712
1853
self.PropertyChanged(dbus.String(dbus_name),
1713
1854
dbus_value)
1714
1855
self.PropertiesChanged(
1715
1856
_interface,
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1857
dbus.Dictionary({dbus.String(dbus_name):
1858
dbus_value}),
1718
1859
dbus.Array())
1719
1860
setattr(self, attrname, value)
1720
1861
1721
1862
return property(lambda self: getattr(self, attrname), setter)
1722
1863
1723
1864
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1724
1865
approvals_pending = notifychangeproperty(dbus.Boolean,
1725
1866
"ApprovalPending",
1726
type_func = bool)
1867
type_func=bool)
1727
1868
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1728
1869
last_enabled = notifychangeproperty(datetime_to_dbus,
1729
1870
"LastEnabled")
1730
1871
checker = notifychangeproperty(
1731
1872
dbus.Boolean, "CheckerRunning",
1732
type_func = lambda checker: checker is not None)
1873
type_func=lambda checker: checker is not None)
1733
1874
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1734
1875
"LastCheckedOK")
1735
1876
last_checker_status = notifychangeproperty(dbus.Int16,
1740
1881
"ApprovedByDefault")
1741
1882
approval_delay = notifychangeproperty(
1742
1883
dbus.UInt64, "ApprovalDelay",
1743
type_func = lambda td: td.total_seconds() * 1000)
1884
type_func=lambda td: td.total_seconds() * 1000)
1744
1885
approval_duration = notifychangeproperty(
1745
1886
dbus.UInt64, "ApprovalDuration",
1746
type_func = lambda td: td.total_seconds() * 1000)
1887
type_func=lambda td: td.total_seconds() * 1000)
1747
1888
host = notifychangeproperty(dbus.String, "Host")
1748
1889
timeout = notifychangeproperty(
1749
1890
dbus.UInt64, "Timeout",
1750
type_func = lambda td: td.total_seconds() * 1000)
1891
type_func=lambda td: td.total_seconds() * 1000)
1751
1892
extended_timeout = notifychangeproperty(
1752
1893
dbus.UInt64, "ExtendedTimeout",
1753
type_func = lambda td: td.total_seconds() * 1000)
1894
type_func=lambda td: td.total_seconds() * 1000)
1754
1895
interval = notifychangeproperty(
1755
1896
dbus.UInt64, "Interval",
1756
type_func = lambda td: td.total_seconds() * 1000)
1897
type_func=lambda td: td.total_seconds() * 1000)
1757
1898
checker_command = notifychangeproperty(dbus.String, "Checker")
1758
1899
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1759
1900
invalidate_only=True)
1760
1901
1761
1902
del notifychangeproperty
1762
1903
1763
1904
def __del__(self, *args, **kwargs):
1764
1905
try:
1765
1906
self.remove_from_connection()
1768
1909
if hasattr(DBusObjectWithProperties, "__del__"):
1769
1910
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1770
1911
Client.__del__(self, *args, **kwargs)
1771
1912
1772
1913
def checker_callback(self, source, condition,
1773
1914
connection, command, *args, **kwargs):
1774
1915
ret = Client.checker_callback(self, source, condition,
1790
1931
| self.last_checker_signal),
1791
1932
dbus.String(command))
1792
1933
return ret
1793
1934
1794
1935
def start_checker(self, *args, **kwargs):
1795
1936
old_checker_pid = getattr(self.checker, "pid", None)
1796
1937
r = Client.start_checker(self, *args, **kwargs)
1800
1941
# Emit D-Bus signal
1801
1942
self.CheckerStarted(self.current_checker_command)
1802
1943
return r
1803
1944
1804
1945
def _reset_approved(self):
1805
1946
self.approved = None
1806
1947
return False
1807
1948
1808
1949
def approve(self, value=True):
1809
1950
self.approved = value
1810
gobject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1951
GLib.timeout_add(int(self.approval_duration.total_seconds()
1952
* 1000), self._reset_approved)
1812
1953
self.send_changedstate()
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1954
1955
# D-Bus methods, signals & properties
1956
1957
# Interfaces
1958
1959
# Signals
1960
1820
1961
# CheckerCompleted - signal
1821
1962
@dbus.service.signal(_interface, signature="nxs")
1822
1963
def CheckerCompleted(self, exitcode, waitstatus, command):
1823
1964
"D-Bus signal"
1824
1965
pass
1825
1966
1826
1967
# CheckerStarted - signal
1827
1968
@dbus.service.signal(_interface, signature="s")
1828
1969
def CheckerStarted(self, command):
1829
1970
"D-Bus signal"
1830
1971
pass
1831
1972
1832
1973
# PropertyChanged - signal
1833
1974
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1834
1975
@dbus.service.signal(_interface, signature="sv")
1835
1976
def PropertyChanged(self, property, value):
1836
1977
"D-Bus signal"
1837
1978
pass
1838
1979
1839
1980
# GotSecret - signal
1840
1981
@dbus.service.signal(_interface)
1841
1982
def GotSecret(self):
1844
1985
server to mandos-client
1845
1986
"""
1846
1987
pass
1847
1988
1848
1989
# Rejected - signal
1849
1990
@dbus.service.signal(_interface, signature="s")
1850
1991
def Rejected(self, reason):
1851
1992
"D-Bus signal"
1852
1993
pass
1853
1994
1854
1995
# NeedApproval - signal
1855
1996
@dbus.service.signal(_interface, signature="tb")
1856
1997
def NeedApproval(self, timeout, default):
1857
1998
"D-Bus signal"
1858
1999
return self.need_approval()
1859
1860
## Methods
1861
2000
2001
# Methods
2002
1862
2003
# Approve - method
1863
2004
@dbus.service.method(_interface, in_signature="b")
1864
2005
def Approve(self, value):
1865
2006
self.approve(value)
1866
2007
1867
2008
# CheckedOK - method
1868
2009
@dbus.service.method(_interface)
1869
2010
def CheckedOK(self):
1870
2011
self.checked_ok()
1871
2012
1872
2013
# Enable - method
1873
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
2015
@dbus.service.method(_interface)
1875
2016
def Enable(self):
1876
2017
"D-Bus method"
1877
2018
self.enable()
1878
2019
1879
2020
# StartChecker - method
1880
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
2022
@dbus.service.method(_interface)
1882
2023
def StartChecker(self):
1883
2024
"D-Bus method"
1884
2025
self.start_checker()
1885
2026
1886
2027
# Disable - method
1887
2028
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
2029
@dbus.service.method(_interface)
1889
2030
def Disable(self):
1890
2031
"D-Bus method"
1891
2032
self.disable()
1892
2033
1893
2034
# StopChecker - method
1894
2035
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
2036
@dbus.service.method(_interface)
1896
2037
def StopChecker(self):
1897
2038
self.stop_checker()
1898
1899
## Properties
1900
2039
2040
# Properties
2041
1901
2042
# ApprovalPending - property
1902
2043
@dbus_service_property(_interface, signature="b", access="read")
1903
2044
def ApprovalPending_dbus_property(self):
1904
2045
return dbus.Boolean(bool(self.approvals_pending))
1905
2046
1906
2047
# ApprovedByDefault - property
1907
2048
@dbus_service_property(_interface,
1908
2049
signature="b",
1911
2052
if value is None: # get
1912
2053
return dbus.Boolean(self.approved_by_default)
1913
2054
self.approved_by_default = bool(value)
1914
2055
1915
2056
# ApprovalDelay - property
1916
2057
@dbus_service_property(_interface,
1917
2058
signature="t",
1921
2062
return dbus.UInt64(self.approval_delay.total_seconds()
1922
2063
* 1000)
1923
2064
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1924
2065
1925
2066
# ApprovalDuration - property
1926
2067
@dbus_service_property(_interface,
1927
2068
signature="t",
1931
2072
return dbus.UInt64(self.approval_duration.total_seconds()
1932
2073
* 1000)
1933
2074
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
2075
1935
2076
# Name - property
1936
2077
@dbus_annotations(
1937
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
2079
@dbus_service_property(_interface, signature="s", access="read")
1939
2080
def Name_dbus_property(self):
1940
2081
return dbus.String(self.name)
1941
2082
2083
# KeyID - property
2084
@dbus_annotations(
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2086
@dbus_service_property(_interface, signature="s", access="read")
2087
def KeyID_dbus_property(self):
2088
return dbus.String(self.key_id)
2089
1942
2090
# Fingerprint - property
1943
2091
@dbus_annotations(
1944
2092
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
2093
@dbus_service_property(_interface, signature="s", access="read")
1946
2094
def Fingerprint_dbus_property(self):
1947
2095
return dbus.String(self.fingerprint)
1948
2096
1949
2097
# Host - property
1950
2098
@dbus_service_property(_interface,
1951
2099
signature="s",
1954
2102
if value is None: # get
1955
2103
return dbus.String(self.host)
1956
2104
self.host = str(value)
1957
2105
1958
2106
# Created - property
1959
2107
@dbus_annotations(
1960
2108
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
2109
@dbus_service_property(_interface, signature="s", access="read")
1962
2110
def Created_dbus_property(self):
1963
2111
return datetime_to_dbus(self.created)
1964
2112
1965
2113
# LastEnabled - property
1966
2114
@dbus_service_property(_interface, signature="s", access="read")
1967
2115
def LastEnabled_dbus_property(self):
1968
2116
return datetime_to_dbus(self.last_enabled)
1969
2117
1970
2118
# Enabled - property
1971
2119
@dbus_service_property(_interface,
1972
2120
signature="b",
1978
2126
self.enable()
1979
2127
else:
1980
2128
self.disable()
1981
2129
1982
2130
# LastCheckedOK - property
1983
2131
@dbus_service_property(_interface,
1984
2132
signature="s",
1988
2136
self.checked_ok()
1989
2137
return
1990
2138
return datetime_to_dbus(self.last_checked_ok)
1991
2139
1992
2140
# LastCheckerStatus - property
1993
2141
@dbus_service_property(_interface, signature="n", access="read")
1994
2142
def LastCheckerStatus_dbus_property(self):
1995
2143
return dbus.Int16(self.last_checker_status)
1996
2144
1997
2145
# Expires - property
1998
2146
@dbus_service_property(_interface, signature="s", access="read")
1999
2147
def Expires_dbus_property(self):
2000
2148
return datetime_to_dbus(self.expires)
2001
2149
2002
2150
# LastApprovalRequest - property
2003
2151
@dbus_service_property(_interface, signature="s", access="read")
2004
2152
def LastApprovalRequest_dbus_property(self):
2005
2153
return datetime_to_dbus(self.last_approval_request)
2006
2154
2007
2155
# Timeout - property
2008
2156
@dbus_service_property(_interface,
2009
2157
signature="t",
2024
2172
if (getattr(self, "disable_initiator_tag", None)
2025
2173
is None):
2026
2174
return
2027
gobject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = gobject.timeout_add(
2175
GLib.source_remove(self.disable_initiator_tag)
2176
self.disable_initiator_tag = GLib.timeout_add(
2029
2177
int((self.expires - now).total_seconds() * 1000),
2030
2178
self.disable)
2031
2179
2032
2180
# ExtendedTimeout - property
2033
2181
@dbus_service_property(_interface,
2034
2182
signature="t",
2038
2186
return dbus.UInt64(self.extended_timeout.total_seconds()
2039
2187
* 1000)
2040
2188
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2041
2189
2042
2190
# Interval - property
2043
2191
@dbus_service_property(_interface,
2044
2192
signature="t",
2051
2199
return
2052
2200
if self.enabled:
2053
2201
# Reschedule checker run
2054
gobject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = gobject.timeout_add(
2202
GLib.source_remove(self.checker_initiator_tag)
2203
self.checker_initiator_tag = GLib.timeout_add(
2056
2204
value, self.start_checker)
2057
self.start_checker() # Start one now, too
2058
2205
self.start_checker() # Start one now, too
2206
2059
2207
# Checker - property
2060
2208
@dbus_service_property(_interface,
2061
2209
signature="s",
2064
2212
if value is None: # get
2065
2213
return dbus.String(self.checker_command)
2066
2214
self.checker_command = str(value)
2067
2215
2068
2216
# CheckerRunning - property
2069
2217
@dbus_service_property(_interface,
2070
2218
signature="b",
2076
2224
self.start_checker()
2077
2225
else:
2078
2226
self.stop_checker()
2079
2227
2080
2228
# ObjectPath - property
2081
2229
@dbus_annotations(
2082
2230
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
2231
"org.freedesktop.DBus.Deprecated": "true"})
2084
2232
@dbus_service_property(_interface, signature="o", access="read")
2085
2233
def ObjectPath_dbus_property(self):
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2234
return self.dbus_object_path # is already a dbus.ObjectPath
2235
2088
2236
# Secret = property
2089
2237
@dbus_annotations(
2090
2238
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2095
2243
byte_arrays=True)
2096
2244
def Secret_dbus_property(self, value):
2097
2245
self.secret = bytes(value)
2098
2246
2099
2247
del _interface
2100
2248
2101
2249
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2250
class ProxyClient:
2251
def __init__(self, child_pipe, key_id, fpr, address):
2104
2252
self._pipe = child_pipe
2105
self._pipe.send(('init', fpr, address))
2253
self._pipe.send(('init', key_id, fpr, address))
2106
2254
if not self._pipe.recv():
2107
raise KeyError(fpr)
2108
2255
raise KeyError(key_id or fpr)
2256
2109
2257
def __getattribute__(self, name):
2110
2258
if name == '_pipe':
2111
2259
return super(ProxyClient, self).__getattribute__(name)
2114
2262
if data[0] == 'data':
2115
2263
return data[1]
2116
2264
if data[0] == 'function':
2117
2265
2118
2266
def func(*args, **kwargs):
2119
2267
self._pipe.send(('funcall', name, args, kwargs))
2120
2268
return self._pipe.recv()[1]
2121
2269
2122
2270
return func
2123
2271
2124
2272
def __setattr__(self, name, value):
2125
2273
if name == '_pipe':
2126
2274
return super(ProxyClient, self).__setattr__(name, value)
2129
2277
2130
2278
class ClientHandler(socketserver.BaseRequestHandler, object):
2131
2279
"""A class to handle client connections.
2132
2280
2133
2281
Instantiated once for each connection to handle it.
2134
2282
Note: This will run in its own forked process."""
2135
2283
2136
2284
def handle(self):
2137
2285
with contextlib.closing(self.server.child_pipe) as child_pipe:
2138
2286
logger.info("TCP connection from: %s",
2139
2287
str(self.client_address))
2140
2288
logger.debug("Pipe FD: %d",
2141
2289
self.server.child_pipe.fileno())
2142
2290
2143
2291
session = gnutls.ClientSession(self.request)
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2292
2293
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2294
# "+AES-256-CBC", "+SHA1",
2295
# "+COMP-NULL", "+CTYPE-OPENPGP",
2296
# "+DHE-DSS"))
2149
2297
# Use a fallback default, since this MUST be set.
2150
2298
priority = self.server.gnutls_priority
2151
2299
if priority is None:
2152
2300
priority = "NORMAL"
2153
gnutls.priority_set_direct(session._c_object, priority,
2301
gnutls.priority_set_direct(session._c_object,
2302
priority.encode("utf-8"),
2154
2303
None)
2155
2304
2156
2305
# Start communication using the Mandos protocol
2157
2306
# Get protocol number
2158
2307
line = self.request.makefile().readline()
2163
2312
except (ValueError, IndexError, RuntimeError) as error:
2164
2313
logger.error("Unknown protocol version: %s", error)
2165
2314
return
2166
2315
2167
2316
# Start GnuTLS connection
2168
2317
try:
2169
2318
session.handshake()
2173
2322
# established. Just abandon the request.
2174
2323
return
2175
2324
logger.debug("Handshake succeeded")
2176
2325
2177
2326
approval_required = False
2178
2327
try:
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2328
if gnutls.has_rawpk:
2329
fpr = b""
2330
try:
2331
key_id = self.key_id(
2332
self.peer_certificate(session))
2333
except (TypeError, gnutls.Error) as error:
2334
logger.warning("Bad certificate: %s", error)
2335
return
2336
logger.debug("Key ID: %s", key_id)
2337
2338
else:
2339
key_id = b""
2340
try:
2341
fpr = self.fingerprint(
2342
self.peer_certificate(session))
2343
except (TypeError, gnutls.Error) as error:
2344
logger.warning("Bad certificate: %s", error)
2345
return
2346
logger.debug("Fingerprint: %s", fpr)
2347
2348
try:
2349
client = ProxyClient(child_pipe, key_id, fpr,
2189
2350
self.client_address)
2190
2351
except KeyError:
2191
2352
return
2192
2353
2193
2354
if client.approval_delay:
2194
2355
delay = client.approval_delay
2195
2356
client.approvals_pending += 1
2196
2357
approval_required = True
2197
2358
2198
2359
while True:
2199
2360
if not client.enabled:
2200
2361
logger.info("Client %s is disabled",
2203
2364
# Emit D-Bus signal
2204
2365
client.Rejected("Disabled")
2205
2366
return
2206
2367
2207
2368
if client.approved or not client.approval_delay:
2208
#We are approved or approval is disabled
2369
# We are approved or approval is disabled
2209
2370
break
2210
2371
elif client.approved is None:
2211
2372
logger.info("Client %s needs approval",
2222
2383
# Emit D-Bus signal
2223
2384
client.Rejected("Denied")
2224
2385
return
2225
2226
#wait until timeout or approved
2386
2387
# wait until timeout or approved
2227
2388
time = datetime.datetime.now()
2228
2389
client.changedstate.acquire()
2229
2390
client.changedstate.wait(delay.total_seconds())
2242
2403
break
2243
2404
else:
2244
2405
delay -= time2 - time
2245
2406
2246
2407
try:
2247
2408
session.send(client.secret)
2248
2409
except gnutls.Error as error:
2249
2410
logger.warning("gnutls send failed",
2250
exc_info = error)
2411
exc_info=error)
2251
2412
return
2252
2413
2253
2414
logger.info("Sending secret to %s", client.name)
2254
2415
# bump the timeout using extended_timeout
2255
2416
client.bump_timeout(client.extended_timeout)
2256
2417
if self.server.use_dbus:
2257
2418
# Emit D-Bus signal
2258
2419
client.GotSecret()
2259
2420
2260
2421
finally:
2261
2422
if approval_required:
2262
2423
client.approvals_pending -= 1
2265
2426
except gnutls.Error as error:
2266
2427
logger.warning("GnuTLS bye failed",
2267
2428
exc_info=error)
2268
2429
2269
2430
@staticmethod
2270
2431
def peer_certificate(session):
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2432
"Return the peer's certificate as a bytestring"
2433
try:
2434
cert_type = gnutls.certificate_type_get2(session._c_object,
2435
gnutls.CTYPE_PEERS)
2436
except AttributeError:
2437
cert_type = gnutls.certificate_type_get(session._c_object)
2438
if gnutls.has_rawpk:
2439
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
else:
2441
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2442
# If not a valid certificate type...
2443
if cert_type not in valid_cert_types:
2444
logger.info("Cert type %r not in %r", cert_type,
2445
valid_cert_types)
2275
2446
# ...return invalid data
2276
2447
return b""
2277
2448
list_size = ctypes.c_uint(1)
2283
2454
return None
2284
2455
cert = cert_list[0]
2285
2456
return ctypes.string_at(cert.data, cert.size)
2286
2457
2458
@staticmethod
2459
def key_id(certificate):
2460
"Convert a certificate bytestring to a hexdigit key ID"
2461
# New GnuTLS "datum" with the public key
2462
datum = gnutls.datum_t(
2463
ctypes.cast(ctypes.c_char_p(certificate),
2464
ctypes.POINTER(ctypes.c_ubyte)),
2465
ctypes.c_uint(len(certificate)))
2466
# XXX all these need to be created in the gnutls "module"
2467
# New empty GnuTLS certificate
2468
pubkey = gnutls.pubkey_t()
2469
gnutls.pubkey_init(ctypes.byref(pubkey))
2470
# Import the raw public key into the certificate
2471
gnutls.pubkey_import(pubkey,
2472
ctypes.byref(datum),
2473
gnutls.X509_FMT_DER)
2474
# New buffer for the key ID
2475
buf = ctypes.create_string_buffer(32)
2476
buf_len = ctypes.c_size_t(len(buf))
2477
# Get the key ID from the raw public key into the buffer
2478
gnutls.pubkey_get_key_id(
2479
pubkey,
2480
gnutls.KEYID_USE_SHA256,
2481
ctypes.cast(ctypes.byref(buf),
2482
ctypes.POINTER(ctypes.c_ubyte)),
2483
ctypes.byref(buf_len))
2484
# Deinit the certificate
2485
gnutls.pubkey_deinit(pubkey)
2486
2487
# Convert the buffer to a Python bytestring
2488
key_id = ctypes.string_at(buf, buf_len.value)
2489
# Convert the bytestring to hexadecimal notation
2490
hex_key_id = binascii.hexlify(key_id).upper()
2491
return hex_key_id
2492
2287
2493
@staticmethod
2288
2494
def fingerprint(openpgp):
2289
2495
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2304
2510
ctypes.byref(crtverify))
2305
2511
if crtverify.value != 0:
2306
2512
gnutls.openpgp_crt_deinit(crt)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2513
raise gnutls.CertificateSecurityError(code
2514
=crtverify.value)
2308
2515
# New buffer for the fingerprint
2309
2516
buf = ctypes.create_string_buffer(20)
2310
2517
buf_len = ctypes.c_size_t()
2320
2527
return hex_fpr
2321
2528
2322
2529
2323
class MultiprocessingMixIn(object):
2530
class MultiprocessingMixIn:
2324
2531
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2325
2532
2326
2533
def sub_process_main(self, request, address):
2327
2534
try:
2328
2535
self.finish_request(request, address)
2329
2536
except Exception:
2330
2537
self.handle_error(request, address)
2331
2538
self.close_request(request)
2332
2539
2333
2540
def process_request(self, request, address):
2334
2541
"""Start a new process to process the request."""
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2542
proc = multiprocessing.Process(target=self.sub_process_main,
2543
args=(request, address))
2337
2544
proc.start()
2338
2545
return proc
2339
2546
2340
2547
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2548
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2342
2549
""" adds a pipe to the MixIn """
2343
2550
2344
2551
def process_request(self, request, client_address):
2345
2552
"""Overrides and wraps the original process_request().
2346
2553
2347
2554
This function creates a new pipe in self.pipe
2348
2555
"""
2349
2556
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2350
2557
2351
2558
proc = MultiprocessingMixIn.process_request(self, request,
2352
2559
client_address)
2353
2560
self.child_pipe.close()
2354
2561
self.add_pipe(parent_pipe, proc)
2355
2562
2356
2563
def add_pipe(self, parent_pipe, proc):
2357
2564
"""Dummy function; override as necessary"""
2358
2565
raise NotImplementedError()
2359
2566
2360
2567
2361
2568
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2362
socketserver.TCPServer, object):
2569
socketserver.TCPServer):
2363
2570
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2364
2571
2365
2572
Attributes:
2366
2573
enabled: Boolean; whether this server is activated yet
2367
2574
interface: None or a network interface name (string)
2368
2575
use_ipv6: Boolean; to use IPv6 or not
2369
2576
"""
2370
2577
2371
2578
def __init__(self, server_address, RequestHandlerClass,
2372
2579
interface=None,
2373
2580
use_ipv6=True,
2383
2590
self.socketfd = socketfd
2384
2591
# Save the original socket.socket() function
2385
2592
self.socket_socket = socket.socket
2593
2386
2594
# To implement --socket, we monkey patch socket.socket.
2387
#
2595
#
2388
2596
# (When socketserver.TCPServer is a new-style class, we
2389
2597
# could make self.socket into a property instead of monkey
2390
2598
# patching socket.socket.)
2391
#
2599
#
2392
2600
# Create a one-time-only replacement for socket.socket()
2393
2601
@functools.wraps(socket.socket)
2394
2602
def socket_wrapper(*args, **kwargs):
2406
2614
# socket_wrapper(), if socketfd was set.
2407
2615
socketserver.TCPServer.__init__(self, server_address,
2408
2616
RequestHandlerClass)
2409
2617
2410
2618
def server_bind(self):
2411
2619
"""This overrides the normal server_bind() function
2412
2620
to bind to an interface if one was specified, and also NOT to
2413
2621
bind to an address or port if they were not specified."""
2622
global SO_BINDTODEVICE
2414
2623
if self.interface is not None:
2415
2624
if SO_BINDTODEVICE is None:
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2625
# Fall back to a hard-coded value which seems to be
2626
# common enough.
2627
logger.warning("SO_BINDTODEVICE not found, trying 25")
2628
SO_BINDTODEVICE = 25
2629
try:
2630
self.socket.setsockopt(
2631
socket.SOL_SOCKET, SO_BINDTODEVICE,
2632
(self.interface + "\0").encode("utf-8"))
2633
except socket.error as error:
2634
if error.errno == errno.EPERM:
2635
logger.error("No permission to bind to"
2636
" interface %s", self.interface)
2637
elif error.errno == errno.ENOPROTOOPT:
2638
logger.error("SO_BINDTODEVICE not available;"
2639
" cannot bind to interface %s",
2640
self.interface)
2641
elif error.errno == errno.ENODEV:
2642
logger.error("Interface %s does not exist,"
2643
" cannot bind", self.interface)
2644
else:
2645
raise
2437
2646
# Only bind(2) the socket if we really need to.
2438
2647
if self.server_address[0] or self.server_address[1]:
2648
if self.server_address[1]:
2649
self.allow_reuse_address = True
2439
2650
if not self.server_address[0]:
2440
2651
if self.address_family == socket.AF_INET6:
2441
any_address = "::" # in6addr_any
2652
any_address = "::" # in6addr_any
2442
2653
else:
2443
any_address = "0.0.0.0" # INADDR_ANY
2654
any_address = "0.0.0.0" # INADDR_ANY
2444
2655
self.server_address = (any_address,
2445
2656
self.server_address[1])
2446
2657
elif not self.server_address[1]:
2456
2667
2457
2668
class MandosServer(IPv6_TCPServer):
2458
2669
"""Mandos server.
2459
2670
2460
2671
Attributes:
2461
2672
clients: set of Client objects
2462
2673
gnutls_priority GnuTLS priority string
2463
2674
use_dbus: Boolean; to emit D-Bus signals or not
2464
2465
Assumes a gobject.MainLoop event loop.
2675
2676
Assumes a GLib.MainLoop event loop.
2466
2677
"""
2467
2678
2468
2679
def __init__(self, server_address, RequestHandlerClass,
2469
2680
interface=None,
2470
2681
use_ipv6=True,
2480
2691
self.gnutls_priority = gnutls_priority
2481
2692
IPv6_TCPServer.__init__(self, server_address,
2482
2693
RequestHandlerClass,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2694
interface=interface,
2695
use_ipv6=use_ipv6,
2696
socketfd=socketfd)
2697
2487
2698
def server_activate(self):
2488
2699
if self.enabled:
2489
2700
return socketserver.TCPServer.server_activate(self)
2490
2701
2491
2702
def enable(self):
2492
2703
self.enabled = True
2493
2704
2494
2705
def add_pipe(self, parent_pipe, proc):
2495
2706
# Call "handle_ipc" for both data and EOF events
2496
gobject.io_add_watch(
2497
parent_pipe.fileno(),
2498
gobject.IO_IN | gobject.IO_HUP,
2707
GLib.io_add_watch(
2708
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2709
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2499
2710
functools.partial(self.handle_ipc,
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2711
parent_pipe=parent_pipe,
2712
proc=proc))
2713
2503
2714
def handle_ipc(self, source, condition,
2504
2715
parent_pipe=None,
2505
proc = None,
2716
proc=None,
2506
2717
client_object=None):
2507
2718
# error, or the other end of multiprocessing.Pipe has closed
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2719
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2509
2720
# Wait for other process to exit
2510
2721
proc.join()
2511
2722
return False
2512
2723
2513
2724
# Read a request from the child
2514
2725
request = parent_pipe.recv()
2515
2726
command = request[0]
2516
2727
2517
2728
if command == 'init':
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2729
key_id = request[1].decode("ascii")
2730
fpr = request[2].decode("ascii")
2731
address = request[3]
2732
2733
for c in self.clients.values():
2734
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2735
"27AE41E4649B934CA495991B7852B855"):
2736
continue
2737
if key_id and c.key_id == key_id:
2738
client = c
2739
break
2740
if fpr and c.fingerprint == fpr:
2523
2741
client = c
2524
2742
break
2525
2743
else:
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2744
logger.info("Client not found for key ID: %s, address"
2745
": %s", key_id or fpr, address)
2528
2746
if self.use_dbus:
2529
2747
# Emit D-Bus signal
2530
mandos_dbus_service.ClientNotFound(fpr,
2748
mandos_dbus_service.ClientNotFound(key_id or fpr,
2531
2749
address[0])
2532
2750
parent_pipe.send(False)
2533
2751
return False
2534
2535
gobject.io_add_watch(
2536
parent_pipe.fileno(),
2537
gobject.IO_IN | gobject.IO_HUP,
2752
2753
GLib.io_add_watch(
2754
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2755
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2538
2756
functools.partial(self.handle_ipc,
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2757
parent_pipe=parent_pipe,
2758
proc=proc,
2759
client_object=client))
2542
2760
parent_pipe.send(True)
2543
2761
# remove the old hook in favor of the new above hook on
2544
2762
# same fileno
2547
2765
funcname = request[1]
2548
2766
args = request[2]
2549
2767
kwargs = request[3]
2550
2768
2551
2769
parent_pipe.send(('data', getattr(client_object,
2552
2770
funcname)(*args,
2553
2771
**kwargs)))
2554
2772
2555
2773
if command == 'getattr':
2556
2774
attrname = request[1]
2557
2775
if isinstance(client_object.__getattribute__(attrname),
2558
collections.Callable):
2776
collections.abc.Callable):
2559
2777
parent_pipe.send(('function', ))
2560
2778
else:
2561
2779
parent_pipe.send((
2562
2780
'data', client_object.__getattribute__(attrname)))
2563
2781
2564
2782
if command == 'setattr':
2565
2783
attrname = request[1]
2566
2784
value = request[2]
2567
2785
setattr(client_object, attrname, value)
2568
2786
2569
2787
return True
2570
2788
2571
2789
2572
2790
def rfc3339_duration_to_delta(duration):
2573
2791
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2574
2575
>>> rfc3339_duration_to_delta("P7D")
2576
datetime.timedelta(7)
2577
>>> rfc3339_duration_to_delta("PT60S")
2578
datetime.timedelta(0, 60)
2579
>>> rfc3339_duration_to_delta("PT60M")
2580
datetime.timedelta(0, 3600)
2581
>>> rfc3339_duration_to_delta("PT24H")
2582
datetime.timedelta(1)
2583
>>> rfc3339_duration_to_delta("P1W")
2584
datetime.timedelta(7)
2585
>>> rfc3339_duration_to_delta("PT5M30S")
2586
datetime.timedelta(0, 330)
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
datetime.timedelta(1, 200)
2792
2793
>>> timedelta = datetime.timedelta
2794
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2795
True
2796
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2797
True
2798
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2799
True
2800
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2801
True
2802
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2803
True
2804
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2805
True
2806
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2807
True
2808
>>> del timedelta
2589
2809
"""
2590
2810
2591
2811
# Parsing an RFC 3339 duration with regular expressions is not
2592
2812
# possible - there would have to be multiple places for the same
2593
2813
# values, like seconds. The current code, while more esoteric, is
2594
2814
# cleaner without depending on a parsing library. If Python had a
2595
2815
# built-in library for parsing we would use it, but we'd like to
2596
2816
# avoid excessive use of external libraries.
2597
2817
2598
2818
# New type for defining tokens, syntax, and semantics all-in-one
2599
2819
Token = collections.namedtuple("Token", (
2600
2820
"regexp", # To match token; if "value" is not None, must have
2633
2853
frozenset((token_year, token_month,
2634
2854
token_day, token_time,
2635
2855
token_week)))
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2856
# Define starting values:
2857
# Value so far
2858
value = datetime.timedelta()
2638
2859
found_token = None
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2860
# Following valid tokens
2861
followers = frozenset((token_duration, ))
2862
# String left to parse
2863
s = duration
2641
2864
# Loop until end token is found
2642
2865
while found_token is not token_end:
2643
2866
# Search for any currently valid tokens
2667
2890
2668
2891
def string_to_delta(interval):
2669
2892
"""Parse a string and return a datetime.timedelta
2670
2671
>>> string_to_delta('7d')
2672
datetime.timedelta(7)
2673
>>> string_to_delta('60s')
2674
datetime.timedelta(0, 60)
2675
>>> string_to_delta('60m')
2676
datetime.timedelta(0, 3600)
2677
>>> string_to_delta('24h')
2678
datetime.timedelta(1)
2679
>>> string_to_delta('1w')
2680
datetime.timedelta(7)
2681
>>> string_to_delta('5m 30s')
2682
datetime.timedelta(0, 330)
2893
2894
>>> string_to_delta('7d') == datetime.timedelta(7)
2895
True
2896
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
True
2898
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
True
2900
>>> string_to_delta('24h') == datetime.timedelta(1)
2901
True
2902
>>> string_to_delta('1w') == datetime.timedelta(7)
2903
True
2904
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2905
True
2683
2906
"""
2684
2907
2685
2908
try:
2686
2909
return rfc3339_duration_to_delta(interval)
2687
2910
except ValueError:
2688
2911
pass
2689
2912
2690
2913
timevalue = datetime.timedelta(0)
2691
2914
for s in interval.split():
2692
2915
try:
2710
2933
return timevalue
2711
2934
2712
2935
2713
def daemon(nochdir = False, noclose = False):
2936
def daemon(nochdir=False, noclose=False):
2714
2937
"""See daemon(3). Standard BSD Unix function.
2715
2938
2716
2939
This should really exist as os.daemon, but it doesn't (yet)."""
2717
2940
if os.fork():
2718
2941
sys.exit()
2736
2959
2737
2960
2738
2961
def main():
2739
2962
2740
2963
##################################################################
2741
2964
# Parsing of options, both command line and config file
2742
2965
2743
2966
parser = argparse.ArgumentParser()
2744
2967
parser.add_argument("-v", "--version", action="version",
2745
version = "%(prog)s {}".format(version),
2968
version="%(prog)s {}".format(version),
2746
2969
help="show version number and exit")
2747
2970
parser.add_argument("-i", "--interface", metavar="IF",
2748
2971
help="Bind to interface IF")
2784
3007
parser.add_argument("--no-zeroconf", action="store_false",
2785
3008
dest="zeroconf", help="Do not use Zeroconf",
2786
3009
default=None)
2787
3010
2788
3011
options = parser.parse_args()
2789
2790
if options.check:
2791
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
3012
2795
3013
# Default values for config file for server-global settings
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
3014
if gnutls.has_rawpk:
3015
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3016
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3017
else:
3018
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3019
":+SIGN-DSA-SHA256")
3020
server_defaults = {"interface": "",
3021
"address": "",
3022
"port": "",
3023
"debug": "False",
3024
"priority": priority,
3025
"servicename": "Mandos",
3026
"use_dbus": "True",
3027
"use_ipv6": "True",
3028
"debuglevel": "",
3029
"restore": "True",
3030
"socket": "",
3031
"statedir": "/var/lib/mandos",
3032
"foreground": "False",
3033
"zeroconf": "True",
3034
}
3035
del priority
3036
2814
3037
# Parse config file for server-global settings
2815
server_config = configparser.SafeConfigParser(server_defaults)
3038
server_config = configparser.ConfigParser(server_defaults)
2816
3039
del server_defaults
2817
3040
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2818
# Convert the SafeConfigParser object to a dict
3041
# Convert the ConfigParser object to a dict
2819
3042
server_settings = server_config.defaults()
2820
3043
# Use the appropriate methods on the non-string config options
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3044
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3045
"foreground", "zeroconf"):
2822
3046
server_settings[option] = server_config.getboolean("DEFAULT",
2823
3047
option)
2824
3048
if server_settings["port"]:
2834
3058
server_settings["socket"] = os.dup(server_settings
2835
3059
["socket"])
2836
3060
del server_config
2837
3061
2838
3062
# Override the settings from the config file with command line
2839
3063
# options, if set.
2840
3064
for option in ("interface", "address", "port", "debug",
2858
3082
if server_settings["debug"]:
2859
3083
server_settings["foreground"] = True
2860
3084
# Now we have our good server settings in "server_settings"
2861
3085
2862
3086
##################################################################
2863
3087
2864
3088
if (not server_settings["zeroconf"]
2865
3089
and not (server_settings["port"]
2866
3090
or server_settings["socket"] != "")):
2867
3091
parser.error("Needs port or socket to work without Zeroconf")
2868
3092
2869
3093
# For convenience
2870
3094
debug = server_settings["debug"]
2871
3095
debuglevel = server_settings["debuglevel"]
2875
3099
stored_state_file)
2876
3100
foreground = server_settings["foreground"]
2877
3101
zeroconf = server_settings["zeroconf"]
2878
3102
2879
3103
if debug:
2880
3104
initlogger(debug, logging.DEBUG)
2881
3105
else:
2884
3108
else:
2885
3109
level = getattr(logging, debuglevel.upper())
2886
3110
initlogger(debug, level)
2887
3111
2888
3112
if server_settings["servicename"] != "Mandos":
2889
3113
syslogger.setFormatter(
2890
3114
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
3115
' %(levelname)s: %(message)s'.format(
2892
3116
server_settings["servicename"])))
2893
3117
2894
3118
# Parse config file with clients
2895
client_config = configparser.SafeConfigParser(Client
2896
.client_defaults)
3119
client_config = configparser.ConfigParser(Client.client_defaults)
2897
3120
client_config.read(os.path.join(server_settings["configdir"],
2898
3121
"clients.conf"))
2899
3122
2900
3123
global mandos_dbus_service
2901
3124
mandos_dbus_service = None
2902
3125
2903
3126
socketfd = None
2904
3127
if server_settings["socket"] != "":
2905
3128
socketfd = server_settings["socket"]
2921
3144
except IOError as e:
2922
3145
logger.error("Could not open file %r", pidfilename,
2923
3146
exc_info=e)
2924
2925
for name in ("_mandos", "mandos", "nobody"):
3147
3148
for name, group in (("_mandos", "_mandos"),
3149
("mandos", "mandos"),
3150
("nobody", "nogroup")):
2926
3151
try:
2927
3152
uid = pwd.getpwnam(name).pw_uid
2928
gid = pwd.getpwnam(name).pw_gid
3153
gid = pwd.getpwnam(group).pw_gid
2929
3154
break
2930
3155
except KeyError:
2931
3156
continue
2935
3160
try:
2936
3161
os.setgid(gid)
2937
3162
os.setuid(uid)
3163
if debug:
3164
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3165
gid))
2938
3166
except OSError as error:
3167
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3168
.format(uid, gid, os.strerror(error.errno)))
2939
3169
if error.errno != errno.EPERM:
2940
3170
raise
2941
3171
2942
3172
if debug:
2943
3173
# Enable all possible GnuTLS debugging
2944
3174
2945
3175
# "Use a log level over 10 to enable all debugging options."
2946
3176
# - GnuTLS manual
2947
3177
gnutls.global_set_log_level(11)
2948
3178
2949
3179
@gnutls.log_func
2950
3180
def debug_gnutls(level, string):
2951
3181
logger.debug("GnuTLS: %s", string[:-1])
2952
3182
2953
3183
gnutls.global_set_log_function(debug_gnutls)
2954
3184
2955
3185
# Redirect stdin so all checkers get /dev/null
2956
3186
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2957
3187
os.dup2(null, sys.stdin.fileno())
2958
3188
if null > 2:
2959
3189
os.close(null)
2960
3190
2961
3191
# Need to fork before connecting to D-Bus
2962
3192
if not foreground:
2963
3193
# Close all input and output, do double fork, etc.
2964
3194
daemon()
2965
2966
# multiprocessing will use threads, so before we use gobject we
2967
# need to inform gobject that threads will be used.
2968
gobject.threads_init()
2969
3195
3196
if gi.version_info < (3, 10, 2):
3197
# multiprocessing will use threads, so before we use GLib we
3198
# need to inform GLib that threads will be used.
3199
GLib.threads_init()
3200
2970
3201
global main_loop
2971
3202
# From the Avahi example code
2972
3203
DBusGMainLoop(set_as_default=True)
2973
main_loop = gobject.MainLoop()
3204
main_loop = GLib.MainLoop()
2974
3205
bus = dbus.SystemBus()
2975
3206
# End of Avahi example code
2976
3207
if use_dbus:
2989
3220
if zeroconf:
2990
3221
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2991
3222
service = AvahiServiceToSyslog(
2992
name = server_settings["servicename"],
2993
servicetype = "_mandos._tcp",
2994
protocol = protocol,
2995
bus = bus)
3223
name=server_settings["servicename"],
3224
servicetype="_mandos._tcp",
3225
protocol=protocol,
3226
bus=bus)
2996
3227
if server_settings["interface"]:
2997
3228
service.interface = if_nametoindex(
2998
3229
server_settings["interface"].encode("utf-8"))
2999
3230
3000
3231
global multiprocessing_manager
3001
3232
multiprocessing_manager = multiprocessing.Manager()
3002
3233
3003
3234
client_class = Client
3004
3235
if use_dbus:
3005
client_class = functools.partial(ClientDBus, bus = bus)
3006
3236
client_class = functools.partial(ClientDBus, bus=bus)
3237
3007
3238
client_settings = Client.config_parser(client_config)
3008
3239
old_client_settings = {}
3009
3240
clients_data = {}
3010
3241
3011
3242
# This is used to redirect stdout and stderr for checker processes
3012
3243
global wnull
3013
wnull = open(os.devnull, "w") # A writable /dev/null
3244
wnull = open(os.devnull, "w") # A writable /dev/null
3014
3245
# Only used if server is running in foreground but not in debug
3015
3246
# mode
3016
3247
if debug or not foreground:
3017
3248
wnull.close()
3018
3249
3019
3250
# Get client data and settings from last running state.
3020
3251
if server_settings["restore"]:
3021
3252
try:
3022
3253
with open(stored_state_path, "rb") as stored_state:
3023
clients_data, old_client_settings = pickle.load(
3024
stored_state)
3254
if sys.version_info.major == 2:
3255
clients_data, old_client_settings = pickle.load(
3256
stored_state)
3257
else:
3258
bytes_clients_data, bytes_old_client_settings = (
3259
pickle.load(stored_state, encoding="bytes"))
3260
# Fix bytes to strings
3261
# clients_data
3262
# .keys()
3263
clients_data = {(key.decode("utf-8")
3264
if isinstance(key, bytes)
3265
else key): value
3266
for key, value in
3267
bytes_clients_data.items()}
3268
del bytes_clients_data
3269
for key in clients_data:
3270
value = {(k.decode("utf-8")
3271
if isinstance(k, bytes) else k): v
3272
for k, v in
3273
clients_data[key].items()}
3274
clients_data[key] = value
3275
# .client_structure
3276
value["client_structure"] = [
3277
(s.decode("utf-8")
3278
if isinstance(s, bytes)
3279
else s) for s in
3280
value["client_structure"]]
3281
# .name, .host, and .checker_command
3282
for k in ("name", "host", "checker_command"):
3283
if isinstance(value[k], bytes):
3284
value[k] = value[k].decode("utf-8")
3285
if "key_id" not in value:
3286
value["key_id"] = ""
3287
elif "fingerprint" not in value:
3288
value["fingerprint"] = ""
3289
# old_client_settings
3290
# .keys()
3291
old_client_settings = {
3292
(key.decode("utf-8")
3293
if isinstance(key, bytes)
3294
else key): value
3295
for key, value in
3296
bytes_old_client_settings.items()}
3297
del bytes_old_client_settings
3298
# .host and .checker_command
3299
for value in old_client_settings.values():
3300
for attribute in ("host", "checker_command"):
3301
if isinstance(value[attribute], bytes):
3302
value[attribute] = (value[attribute]
3303
.decode("utf-8"))
3025
3304
os.remove(stored_state_path)
3026
3305
except IOError as e:
3027
3306
if e.errno == errno.ENOENT:
3035
3314
logger.warning("Could not load persistent state: "
3036
3315
"EOFError:",
3037
3316
exc_info=e)
3038
3317
3039
3318
with PGPEngine() as pgp:
3040
3319
for client_name, client in clients_data.items():
3041
3320
# Skip removed clients
3042
3321
if client_name not in client_settings:
3043
3322
continue
3044
3323
3045
3324
# Decide which value to use after restoring saved state.
3046
3325
# We have three different values: Old config file,
3047
3326
# new config file, and saved state.
3058
3337
client[name] = value
3059
3338
except KeyError:
3060
3339
pass
3061
3340
3062
3341
# Clients who has passed its expire date can still be
3063
3342
# enabled if its last checker was successful. A Client
3064
3343
# whose checker succeeded before we stored its state is
3097
3376
client_name))
3098
3377
client["secret"] = (client_settings[client_name]
3099
3378
["secret"])
3100
3379
3101
3380
# Add/remove clients based on new changes made to config
3102
3381
for client_name in (set(old_client_settings)
3103
3382
- set(client_settings)):
3105
3384
for client_name in (set(client_settings)
3106
3385
- set(old_client_settings)):
3107
3386
clients_data[client_name] = client_settings[client_name]
3108
3387
3109
3388
# Create all client objects
3110
3389
for client_name, client in clients_data.items():
3111
3390
tcp_server.clients[client_name] = client_class(
3112
name = client_name,
3113
settings = client,
3114
server_settings = server_settings)
3115
3391
name=client_name,
3392
settings=client,
3393
server_settings=server_settings)
3394
3116
3395
if not tcp_server.clients:
3117
3396
logger.warning("No clients defined")
3118
3397
3119
3398
if not foreground:
3120
3399
if pidfile is not None:
3121
3400
pid = os.getpid()
3127
3406
pidfilename, pid)
3128
3407
del pidfile
3129
3408
del pidfilename
3130
3131
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3132
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3133
3409
3410
for termsig in (signal.SIGHUP, signal.SIGTERM):
3411
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3412
lambda: main_loop.quit() and False)
3413
3134
3414
if use_dbus:
3135
3415
3136
3416
@alternate_dbus_interfaces(
3137
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3417
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3138
3418
class MandosDBusService(DBusObjectWithObjectManager):
3139
3419
"""A D-Bus proxy object"""
3140
3420
3141
3421
def __init__(self):
3142
3422
dbus.service.Object.__init__(self, bus, "/")
3143
3423
3144
3424
_interface = "se.recompile.Mandos"
3145
3425
3146
3426
@dbus.service.signal(_interface, signature="o")
3147
3427
def ClientAdded(self, objpath):
3148
3428
"D-Bus signal"
3149
3429
pass
3150
3430
3151
3431
@dbus.service.signal(_interface, signature="ss")
3152
def ClientNotFound(self, fingerprint, address):
3432
def ClientNotFound(self, key_id, address):
3153
3433
"D-Bus signal"
3154
3434
pass
3155
3435
3156
3436
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3157
3437
"true"})
3158
3438
@dbus.service.signal(_interface, signature="os")
3159
3439
def ClientRemoved(self, objpath, name):
3160
3440
"D-Bus signal"
3161
3441
pass
3162
3442
3163
3443
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3164
3444
"true"})
3165
3445
@dbus.service.method(_interface, out_signature="ao")
3166
3446
def GetAllClients(self):
3167
3447
"D-Bus method"
3168
3448
return dbus.Array(c.dbus_object_path for c in
3169
tcp_server.clients.itervalues())
3170
3449
tcp_server.clients.values())
3450
3171
3451
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3172
3452
"true"})
3173
3453
@dbus.service.method(_interface,
3175
3455
def GetAllClientsWithProperties(self):
3176
3456
"D-Bus method"
3177
3457
return dbus.Dictionary(
3178
{ c.dbus_object_path: c.GetAll(
3458
{c.dbus_object_path: c.GetAll(
3179
3459
"se.recompile.Mandos.Client")
3180
for c in tcp_server.clients.itervalues() },
3460
for c in tcp_server.clients.values()},
3181
3461
signature="oa{sv}")
3182
3462
3183
3463
@dbus.service.method(_interface, in_signature="o")
3184
3464
def RemoveClient(self, object_path):
3185
3465
"D-Bus method"
3186
for c in tcp_server.clients.itervalues():
3466
for c in tcp_server.clients.values():
3187
3467
if c.dbus_object_path == object_path:
3188
3468
del tcp_server.clients[c.name]
3189
3469
c.remove_from_connection()
3193
3473
self.client_removed_signal(c)
3194
3474
return
3195
3475
raise KeyError(object_path)
3196
3476
3197
3477
del _interface
3198
3478
3199
3479
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3200
out_signature = "a{oa{sa{sv}}}")
3480
out_signature="a{oa{sa{sv}}}")
3201
3481
def GetManagedObjects(self):
3202
3482
"""D-Bus method"""
3203
3483
return dbus.Dictionary(
3204
{ client.dbus_object_path:
3205
dbus.Dictionary(
3206
{ interface: client.GetAll(interface)
3207
for interface in
3208
client._get_all_interface_names()})
3209
for client in tcp_server.clients.values()})
3210
3484
{client.dbus_object_path:
3485
dbus.Dictionary(
3486
{interface: client.GetAll(interface)
3487
for interface in
3488
client._get_all_interface_names()})
3489
for client in tcp_server.clients.values()})
3490
3211
3491
def client_added_signal(self, client):
3212
3492
"""Send the new standard signal and the old signal"""
3213
3493
if use_dbus:
3215
3495
self.InterfacesAdded(
3216
3496
client.dbus_object_path,
3217
3497
dbus.Dictionary(
3218
{ interface: client.GetAll(interface)
3219
for interface in
3220
client._get_all_interface_names()}))
3498
{interface: client.GetAll(interface)
3499
for interface in
3500
client._get_all_interface_names()}))
3221
3501
# Old signal
3222
3502
self.ClientAdded(client.dbus_object_path)
3223
3503
3224
3504
def client_removed_signal(self, client):
3225
3505
"""Send the new standard signal and the old signal"""
3226
3506
if use_dbus:
3231
3511
# Old signal
3232
3512
self.ClientRemoved(client.dbus_object_path,
3233
3513
client.name)
3234
3514
3235
3515
mandos_dbus_service = MandosDBusService()
3236
3516
3517
# Save modules to variables to exempt the modules from being
3518
# unloaded before the function registered with atexit() is run.
3519
mp = multiprocessing
3520
wn = wnull
3521
3237
3522
def cleanup():
3238
3523
"Cleanup function; run on exit"
3239
3524
if zeroconf:
3240
3525
service.cleanup()
3241
3242
multiprocessing.active_children()
3243
wnull.close()
3526
3527
mp.active_children()
3528
wn.close()
3244
3529
if not (tcp_server.clients or client_settings):
3245
3530
return
3246
3531
3247
3532
# Store client before exiting. Secrets are encrypted with key
3248
3533
# based on what config file has. If config file is
3249
3534
# removed/edited, old secret will thus be unrecovable.
3250
3535
clients = {}
3251
3536
with PGPEngine() as pgp:
3252
for client in tcp_server.clients.itervalues():
3537
for client in tcp_server.clients.values():
3253
3538
key = client_settings[client.name]["secret"]
3254
3539
client.encrypted_secret = pgp.encrypt(client.secret,
3255
3540
key)
3256
3541
client_dict = {}
3257
3542
3258
3543
# A list of attributes that can not be pickled
3259
3544
# + secret.
3260
exclude = { "bus", "changedstate", "secret",
3261
"checker", "server_settings" }
3545
exclude = {"bus", "changedstate", "secret",
3546
"checker", "server_settings"}
3262
3547
for name, typ in inspect.getmembers(dbus.service
3263
3548
.Object):
3264
3549
exclude.add(name)
3265
3550
3266
3551
client_dict["encrypted_secret"] = (client
3267
3552
.encrypted_secret)
3268
3553
for attr in client.client_structure:
3269
3554
if attr not in exclude:
3270
3555
client_dict[attr] = getattr(client, attr)
3271
3556
3272
3557
clients[client.name] = client_dict
3273
3558
del client_settings[client.name]["secret"]
3274
3559
3275
3560
try:
3276
3561
with tempfile.NamedTemporaryFile(
3277
3562
mode='wb',
3279
3564
prefix='clients-',
3280
3565
dir=os.path.dirname(stored_state_path),
3281
3566
delete=False) as stored_state:
3282
pickle.dump((clients, client_settings), stored_state)
3567
pickle.dump((clients, client_settings), stored_state,
3568
protocol=2)
3283
3569
tempname = stored_state.name
3284
3570
os.rename(tempname, stored_state_path)
3285
3571
except (IOError, OSError) as e:
3295
3581
logger.warning("Could not save persistent state:",
3296
3582
exc_info=e)
3297
3583
raise
3298
3584
3299
3585
# Delete all clients, and settings from config
3300
3586
while tcp_server.clients:
3301
3587
name, client = tcp_server.clients.popitem()
3307
3593
if use_dbus:
3308
3594
mandos_dbus_service.client_removed_signal(client)
3309
3595
client_settings.clear()
3310
3596
3311
3597
atexit.register(cleanup)
3312
3313
for client in tcp_server.clients.itervalues():
3598
3599
for client in tcp_server.clients.values():
3314
3600
if use_dbus:
3315
3601
# Emit D-Bus signal for adding
3316
3602
mandos_dbus_service.client_added_signal(client)
3317
3603
# Need to initiate checking of clients
3318
3604
if client.enabled:
3319
3605
client.init_checker()
3320
3606
3321
3607
tcp_server.enable()
3322
3608
tcp_server.server_activate()
3323
3609
3324
3610
# Find out what port we got
3325
3611
if zeroconf:
3326
3612
service.port = tcp_server.socket.getsockname()[1]
3331
3617
else: # IPv4
3332
3618
logger.info("Now listening on address %r, port %d",
3333
3619
*tcp_server.socket.getsockname())
3334
3335
#service.interface = tcp_server.socket.getsockname()[3]
3336
3620
3621
# service.interface = tcp_server.socket.getsockname()[3]
3622
3337
3623
try:
3338
3624
if zeroconf:
3339
3625
# From the Avahi example code
3344
3630
cleanup()
3345
3631
sys.exit(1)
3346
3632
# End of Avahi example code
3347
3348
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3349
lambda *args, **kwargs:
3350
(tcp_server.handle_request
3351
(*args[2:], **kwargs) or True))
3352
3633
3634
GLib.io_add_watch(
3635
GLib.IOChannel.unix_new(tcp_server.fileno()),
3636
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3637
lambda *args, **kwargs: (tcp_server.handle_request
3638
(*args[2:], **kwargs) or True))
3639
3353
3640
logger.debug("Starting main loop")
3354
3641
main_loop.run()
3355
3642
except AvahiError as error:
3364
3651
# Must run before the D-Bus bus name gets deregistered
3365
3652
cleanup()
3366
3653
3654
3655
def should_only_run_tests():
3656
parser = argparse.ArgumentParser(add_help=False)
3657
parser.add_argument("--check", action='store_true')
3658
args, unknown_args = parser.parse_known_args()
3659
run_tests = args.check
3660
if run_tests:
3661
# Remove --check argument from sys.argv
3662
sys.argv[1:] = unknown_args
3663
return run_tests
3664
3665
# Add all tests from doctest strings
3666
def load_tests(loader, tests, none):
3667
import doctest
3668
tests.addTests(doctest.DocTestSuite())
3669
return tests
3367
3670
3368
3671
if __name__ == '__main__':
3369
main()
3672
try:
3673
if should_only_run_tests():
3674
# Call using ./mandos --check [--verbose]
3675
unittest.main()
3676
else:
3677
main()
3678
finally:
3679
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0