To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1250
- compare with another revision
- download diff
- download tarball
- view history from revision 1250
- Committer: Teddy Hogeborn
- Date: 2022-04-23 23:58:39 UTC
- Revision ID: teddy@recompile.se-20220423235839-cnt9aq1kjveqaydc
Bug fix in mandos-ctl: handle backslashes in password
* mandos-ctl (mode=password): When sending the password to gpg, use
"printf" instead of "echo -n". This avoids the behavior of the
"echo" builtin in "dash", which always interprets backslash escape
codes.
Reported-By: Jesse Norell <jesse@kci.net>
* mandos-ctl (mode=password): When sending the password to gpg, use
"printf" instead of "echo -n". This avoids the behavior of the
"echo" builtin in "dash", which always interprets backslash escape
codes.
Reported-By: Jesse Norell <jesse@kci.net>
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
76
77
import itertools
77
78
import collections
78
79
import codecs
80
import unittest
81
import random
82
import shlex
79
83
80
84
import dbus
81
85
import dbus.service
82
try:
83
from gi.repository import GObject
84
except ImportError:
85
import gobject as GObject
86
import gi
87
from gi.repository import GLib
86
88
from dbus.mainloop.glib import DBusGMainLoop
87
89
import ctypes
88
90
import ctypes.util
89
91
import xml.dom.minidom
90
92
import inspect
91
93
92
try:
94
if sys.version_info.major == 2:
95
__metaclass__ = type
96
str = unicode
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
93
122
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
123
except AttributeError:
95
124
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
96
127
from IN import SO_BINDTODEVICE
97
128
except ImportError:
98
SO_BINDTODEVICE = None
99
100
if sys.version_info.major == 2:
101
str = unicode
102
103
version = "1.7.5"
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.14"
104
147
stored_state_file = "clients.pickle"
105
148
106
149
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
107
151
syslogger = None
108
152
109
153
try:
110
154
if_nametoindex = ctypes.cdll.LoadLibrary(
111
155
ctypes.util.find_library("c")).if_nametoindex
112
156
except (OSError, AttributeError):
113
157
114
158
def if_nametoindex(interface):
115
159
"Get an interface index the hard way, i.e. using fcntl()"
116
160
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
139
183
140
184
def initlogger(debug, level=logging.WARNING):
141
185
"""init logger and add loglevel"""
142
186
143
187
global syslogger
144
188
syslogger = (logging.handlers.SysLogHandler(
145
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
146
address = "/dev/log"))
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
147
191
syslogger.setFormatter(logging.Formatter
148
('Mandos [%(process)d]: %(levelname)s:'
149
' %(message)s'))
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
150
194
logger.addHandler(syslogger)
151
195
152
196
if debug:
153
197
console = logging.StreamHandler()
154
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
155
' [%(process)d]:'
156
' %(levelname)s:'
157
' %(message)s'))
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
158
202
logger.addHandler(console)
159
203
logger.setLevel(level)
160
204
164
208
pass
165
209
166
210
167
class PGPEngine(object):
211
class PGPEngine:
168
212
"""A simple class for OpenPGP symmetric encryption & decryption"""
169
213
170
214
def __init__(self):
171
215
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
172
216
self.gpg = "gpg"
174
218
output = subprocess.check_output(["gpgconf"])
175
219
for line in output.splitlines():
176
220
name, text, path = line.split(b":")
177
if name == "gpg":
221
if name == b"gpg":
178
222
self.gpg = path
179
223
break
180
224
except OSError as e:
181
225
if e.errno != errno.ENOENT:
182
226
raise
183
self.gnupgargs = ['--batch',
184
'--homedir', self.tempdir,
185
'--force-mdc',
186
'--quiet',
187
'--no-use-agent']
188
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
189
235
def __enter__(self):
190
236
return self
191
237
192
238
def __exit__(self, exc_type, exc_value, traceback):
193
239
self._cleanup()
194
240
return False
195
241
196
242
def __del__(self):
197
243
self._cleanup()
198
244
199
245
def _cleanup(self):
200
246
if self.tempdir is not None:
201
247
# Delete contents of tempdir
202
248
for root, dirs, files in os.walk(self.tempdir,
203
topdown = False):
249
topdown=False):
204
250
for filename in files:
205
251
os.remove(os.path.join(root, filename))
206
252
for dirname in dirs:
208
254
# Remove tempdir
209
255
os.rmdir(self.tempdir)
210
256
self.tempdir = None
211
257
212
258
def password_encode(self, password):
213
259
# Passphrase can not be empty and can not contain newlines or
214
260
# NUL bytes. So we prefix it and hex encode it.
219
265
.replace(b"\n", b"\\n")
220
266
.replace(b"\0", b"\\x00"))
221
267
return encoded
222
268
223
269
def encrypt(self, data, password):
224
270
passphrase = self.password_encode(password)
225
271
with tempfile.NamedTemporaryFile(
226
272
dir=self.tempdir) as passfile:
227
273
passfile.write(passphrase)
228
274
passfile.flush()
229
proc = subprocess.Popen([self.gpg, '--symmetric',
230
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
231
277
passfile.name]
232
278
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
237
283
if proc.returncode != 0:
238
284
raise PGPError(err)
239
285
return ciphertext
240
286
241
287
def decrypt(self, data, password):
242
288
passphrase = self.password_encode(password)
243
289
with tempfile.NamedTemporaryFile(
244
dir = self.tempdir) as passfile:
290
dir=self.tempdir) as passfile:
245
291
passfile.write(passphrase)
246
292
passfile.flush()
247
proc = subprocess.Popen([self.gpg, '--decrypt',
248
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
249
295
passfile.name]
250
296
+ self.gnupgargs,
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
255
301
if proc.returncode != 0:
256
302
raise PGPError(err)
257
303
return decrypted_plaintext
258
304
305
259
306
# Pretend that we have an Avahi module
260
class Avahi(object):
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
267
313
DBUS_NAME = "org.freedesktop.Avahi"
268
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
269
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
270
316
DBUS_PATH_SERVER = "/"
271
def string_array_to_txt_array(self, t):
317
318
@staticmethod
319
def string_array_to_txt_array(t):
272
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
273
321
for s in t), signature="ay")
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
282
avahi = Avahi()
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
283
331
284
332
class AvahiError(Exception):
285
333
def __init__(self, value, *args, **kwargs):
296
344
pass
297
345
298
346
299
class AvahiService(object):
347
class AvahiService:
300
348
"""An Avahi (Zeroconf) service.
301
349
302
350
Attributes:
303
351
interface: integer; avahi.IF_UNSPEC or an interface index.
304
352
Used to optionally bind to the specified interface.
305
name: string; Example: 'Mandos'
306
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
307
355
See <https://www.iana.org/assignments/service-names-port-numbers>
308
356
port: integer; what port to announce
309
357
TXT: list of strings; TXT record for the service
316
364
server: D-Bus Server
317
365
bus: dbus.SystemBus()
318
366
"""
319
367
320
368
def __init__(self,
321
interface = avahi.IF_UNSPEC,
322
name = None,
323
servicetype = None,
324
port = None,
325
TXT = None,
326
domain = "",
327
host = "",
328
max_renames = 32768,
329
protocol = avahi.PROTO_UNSPEC,
330
bus = None):
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
331
379
self.interface = interface
332
380
self.name = name
333
381
self.type = servicetype
342
390
self.server = None
343
391
self.bus = bus
344
392
self.entry_group_state_changed_match = None
345
393
346
394
def rename(self, remove=True):
347
395
"""Derived from the Avahi example code"""
348
396
if self.rename_count >= self.max_renames:
368
416
logger.critical("D-Bus Exception", exc_info=error)
369
417
self.cleanup()
370
418
os._exit(1)
371
419
372
420
def remove(self):
373
421
"""Derived from the Avahi example code"""
374
422
if self.entry_group_state_changed_match is not None:
376
424
self.entry_group_state_changed_match = None
377
425
if self.group is not None:
378
426
self.group.Reset()
379
427
380
428
def add(self):
381
429
"""Derived from the Avahi example code"""
382
430
self.remove()
387
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
388
436
self.entry_group_state_changed_match = (
389
437
self.group.connect_to_signal(
390
'StateChanged', self.entry_group_state_changed))
438
"StateChanged", self.entry_group_state_changed))
391
439
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
392
440
self.name, self.type)
393
441
self.group.AddService(
399
447
dbus.UInt16(self.port),
400
448
avahi.string_array_to_txt_array(self.TXT))
401
449
self.group.Commit()
402
450
403
451
def entry_group_state_changed(self, state, error):
404
452
"""Derived from the Avahi example code"""
405
453
logger.debug("Avahi entry group state change: %i", state)
406
454
407
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
408
456
logger.debug("Zeroconf service established.")
409
457
elif state == avahi.ENTRY_GROUP_COLLISION:
413
461
logger.critical("Avahi: Error in group state changed %s",
414
462
str(error))
415
463
raise AvahiGroupError("State changed: {!s}".format(error))
416
464
417
465
def cleanup(self):
418
466
"""Derived from the Avahi example code"""
419
467
if self.group is not None:
424
472
pass
425
473
self.group = None
426
474
self.remove()
427
475
428
476
def server_state_changed(self, state, error=None):
429
477
"""Derived from the Avahi example code"""
430
478
logger.debug("Avahi server state change: %i", state)
459
507
logger.debug("Unknown state: %r", state)
460
508
else:
461
509
logger.debug("Unknown state: %r: %r", state, error)
462
510
463
511
def activate(self):
464
512
"""Derived from the Avahi example code"""
465
513
if self.server is None:
476
524
class AvahiServiceToSyslog(AvahiService):
477
525
def rename(self, *args, **kwargs):
478
526
"""Add the new name to the syslog messages"""
479
ret = AvahiService.rename(self, *args, **kwargs)
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
**kwargs)
480
529
syslogger.setFormatter(logging.Formatter(
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
482
531
.format(self.name)))
483
532
return ret
484
533
534
485
535
# Pretend that we have a GnuTLS module
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
489
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
493
def __init__(self):
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
496
# happens.
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
500
536
class gnutls:
537
"""This isn't so much a class as it is a module-like namespace."""
538
539
library = ctypes.util.find_library("gnutls")
540
if library is None:
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
543
del library
544
501
545
# Unless otherwise indicated, the constants and types below are
502
546
# all from the gnutls/gnutls.h C header file.
503
547
504
548
# Constants
505
549
E_SUCCESS = 0
506
550
E_INTERRUPTED = -52
507
551
E_AGAIN = -28
508
552
CRT_OPENPGP = 2
553
CRT_RAWPK = 3
509
554
CLIENT = 2
510
555
SHUT_RDWR = 0
511
556
CRD_CERTIFICATE = 1
512
557
E_NO_CERTIFICATE_FOUND = -49
558
X509_FMT_DER = 0
559
NO_TICKETS = 1<<10
560
ENABLE_RAWPK = 1<<18
561
CTYPE_PEERS = 3
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
513
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
514
564
515
565
# Types
516
class session_int(ctypes.Structure):
566
class _session_int(ctypes.Structure):
517
567
_fields_ = []
518
session_t = ctypes.POINTER(session_int)
568
session_t = ctypes.POINTER(_session_int)
569
519
570
class certificate_credentials_st(ctypes.Structure):
520
571
_fields_ = []
521
572
certificate_credentials_t = ctypes.POINTER(
522
573
certificate_credentials_st)
523
574
certificate_type_t = ctypes.c_int
575
524
576
class datum_t(ctypes.Structure):
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
('size', ctypes.c_uint)]
527
class openpgp_crt_int(ctypes.Structure):
577
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
578
("size", ctypes.c_uint)]
579
580
class _openpgp_crt_int(ctypes.Structure):
528
581
_fields_ = []
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
582
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
531
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
532
585
credentials_type_t = ctypes.c_int
533
586
transport_ptr_t = ctypes.c_void_p
534
587
close_request_t = ctypes.c_int
535
588
536
589
# Exceptions
537
590
class Error(Exception):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
591
def __init__(self, message=None, code=None, args=()):
543
592
# Default usage is by a message string, but if a return
544
593
# code is passed, convert it to a string with
545
594
# gnutls.strerror()
546
595
self.code = code
547
596
if message is None and code is not None:
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
597
message = gnutls.strerror(code).decode(
598
"utf-8", errors="replace")
599
return super(gnutls.Error, self).__init__(
550
600
message, *args)
551
601
552
602
class CertificateSecurityError(Error):
553
603
pass
554
604
605
class PointerTo:
606
def __init__(self, cls):
607
self.cls = cls
608
609
def from_param(self, obj):
610
if not isinstance(obj, self.cls):
611
raise TypeError("Not of type {}: {!r}"
612
.format(self.cls.__name__, obj))
613
return ctypes.byref(obj.from_param(obj))
614
615
class CastToVoidPointer:
616
def __init__(self, cls):
617
self.cls = cls
618
619
def from_param(self, obj):
620
if not isinstance(obj, self.cls):
621
raise TypeError("Not of type {}: {!r}"
622
.format(self.cls.__name__, obj))
623
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
624
625
class With_from_param:
626
@classmethod
627
def from_param(cls, obj):
628
return obj._as_parameter_
629
555
630
# Classes
556
class Credentials(object):
631
class Credentials(With_from_param):
557
632
def __init__(self):
558
self._c_object = gnutls.certificate_credentials_t()
559
gnutls.certificate_allocate_credentials(
560
ctypes.byref(self._c_object))
633
self._as_parameter_ = gnutls.certificate_credentials_t()
634
gnutls.certificate_allocate_credentials(self)
561
635
self.type = gnutls.CRD_CERTIFICATE
562
636
563
637
def __del__(self):
564
gnutls.certificate_free_credentials(self._c_object)
565
566
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
568
self._c_object = gnutls.session_t()
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
570
gnutls.set_default_priority(self._c_object)
571
gnutls.transport_set_ptr(self._c_object, socket.fileno())
572
gnutls.handshake_set_private_extensions(self._c_object,
573
True)
638
gnutls.certificate_free_credentials(self)
639
640
class ClientSession(With_from_param):
641
def __init__(self, socket, credentials=None):
642
self._as_parameter_ = gnutls.session_t()
643
gnutls_flags = gnutls.CLIENT
644
if gnutls.check_version(b"3.5.6"):
645
gnutls_flags |= gnutls.NO_TICKETS
646
if gnutls.has_rawpk:
647
gnutls_flags |= gnutls.ENABLE_RAWPK
648
gnutls.init(self, gnutls_flags)
649
del gnutls_flags
650
gnutls.set_default_priority(self)
651
gnutls.transport_set_ptr(self, socket.fileno())
652
gnutls.handshake_set_private_extensions(self, True)
574
653
self.socket = socket
575
654
if credentials is None:
576
655
credentials = gnutls.Credentials()
577
gnutls.credentials_set(self._c_object, credentials.type,
578
ctypes.cast(credentials._c_object,
579
ctypes.c_void_p))
656
gnutls.credentials_set(self, credentials.type,
657
credentials)
580
658
self.credentials = credentials
581
659
582
660
def __del__(self):
583
gnutls.deinit(self._c_object)
584
661
gnutls.deinit(self)
662
585
663
def handshake(self):
586
return gnutls.handshake(self._c_object)
587
664
return gnutls.handshake(self)
665
588
666
def send(self, data):
589
667
data = bytes(data)
590
668
data_len = len(data)
591
669
while data_len > 0:
592
data_len -= gnutls.record_send(self._c_object,
593
data[-data_len:],
670
data_len -= gnutls.record_send(self, data[-data_len:],
594
671
data_len)
595
672
596
673
def bye(self):
597
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
598
674
return gnutls.bye(self, gnutls.SHUT_RDWR)
675
599
676
# Error handling functions
600
677
def _error_code(result):
601
678
"""A function to raise exceptions on errors, suitable
602
for the 'restype' attribute on ctypes functions"""
603
if result >= 0:
679
for the "restype" attribute on ctypes functions"""
680
if result >= gnutls.E_SUCCESS:
604
681
return result
605
682
if result == gnutls.E_NO_CERTIFICATE_FOUND:
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
608
609
def _retry_on_error(result, func, arguments):
683
raise gnutls.CertificateSecurityError(code=result)
684
raise gnutls.Error(code=result)
685
686
def _retry_on_error(result, func, arguments,
687
_error_code=_error_code):
610
688
"""A function to retry on some errors, suitable
611
for the 'errcheck' attribute on ctypes functions"""
612
while result < 0:
689
for the "errcheck" attribute on ctypes functions"""
690
while result < gnutls.E_SUCCESS:
613
691
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
614
692
return _error_code(result)
615
693
result = func(*arguments)
616
694
return result
617
695
618
696
# Unless otherwise indicated, the function declarations below are
619
697
# all from the gnutls/gnutls.h C header file.
620
698
621
699
# Functions
622
700
priority_set_direct = _library.gnutls_priority_set_direct
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
624
702
ctypes.POINTER(ctypes.c_char_p)]
625
703
priority_set_direct.restype = _error_code
626
704
627
705
init = _library.gnutls_init
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
629
707
init.restype = _error_code
630
708
631
709
set_default_priority = _library.gnutls_set_default_priority
632
set_default_priority.argtypes = [session_t]
710
set_default_priority.argtypes = [ClientSession]
633
711
set_default_priority.restype = _error_code
634
712
635
713
record_send = _library.gnutls_record_send
636
record_send.argtypes = [session_t, ctypes.c_void_p,
714
record_send.argtypes = [ClientSession, ctypes.c_void_p,
637
715
ctypes.c_size_t]
638
716
record_send.restype = ctypes.c_ssize_t
639
717
record_send.errcheck = _retry_on_error
640
718
641
719
certificate_allocate_credentials = (
642
720
_library.gnutls_certificate_allocate_credentials)
643
721
certificate_allocate_credentials.argtypes = [
644
ctypes.POINTER(certificate_credentials_t)]
722
PointerTo(Credentials)]
645
723
certificate_allocate_credentials.restype = _error_code
646
724
647
725
certificate_free_credentials = (
648
726
_library.gnutls_certificate_free_credentials)
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
727
certificate_free_credentials.argtypes = [Credentials]
650
728
certificate_free_credentials.restype = None
651
729
652
730
handshake_set_private_extensions = (
653
731
_library.gnutls_handshake_set_private_extensions)
654
handshake_set_private_extensions.argtypes = [session_t,
732
handshake_set_private_extensions.argtypes = [ClientSession,
655
733
ctypes.c_int]
656
734
handshake_set_private_extensions.restype = None
657
735
658
736
credentials_set = _library.gnutls_credentials_set
659
credentials_set.argtypes = [session_t, credentials_type_t,
660
ctypes.c_void_p]
737
credentials_set.argtypes = [ClientSession, credentials_type_t,
738
CastToVoidPointer(Credentials)]
661
739
credentials_set.restype = _error_code
662
740
663
741
strerror = _library.gnutls_strerror
664
742
strerror.argtypes = [ctypes.c_int]
665
743
strerror.restype = ctypes.c_char_p
666
744
667
745
certificate_type_get = _library.gnutls_certificate_type_get
668
certificate_type_get.argtypes = [session_t]
746
certificate_type_get.argtypes = [ClientSession]
669
747
certificate_type_get.restype = _error_code
670
748
671
749
certificate_get_peers = _library.gnutls_certificate_get_peers
672
certificate_get_peers.argtypes = [session_t,
750
certificate_get_peers.argtypes = [ClientSession,
673
751
ctypes.POINTER(ctypes.c_uint)]
674
752
certificate_get_peers.restype = ctypes.POINTER(datum_t)
675
753
676
754
global_set_log_level = _library.gnutls_global_set_log_level
677
755
global_set_log_level.argtypes = [ctypes.c_int]
678
756
global_set_log_level.restype = None
679
757
680
758
global_set_log_function = _library.gnutls_global_set_log_function
681
759
global_set_log_function.argtypes = [log_func]
682
760
global_set_log_function.restype = None
683
761
684
762
deinit = _library.gnutls_deinit
685
deinit.argtypes = [session_t]
763
deinit.argtypes = [ClientSession]
686
764
deinit.restype = None
687
765
688
766
handshake = _library.gnutls_handshake
689
handshake.argtypes = [session_t]
690
handshake.restype = _error_code
767
handshake.argtypes = [ClientSession]
768
handshake.restype = ctypes.c_int
691
769
handshake.errcheck = _retry_on_error
692
770
693
771
transport_set_ptr = _library.gnutls_transport_set_ptr
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
695
773
transport_set_ptr.restype = None
696
774
697
775
bye = _library.gnutls_bye
698
bye.argtypes = [session_t, close_request_t]
699
bye.restype = _error_code
776
bye.argtypes = [ClientSession, close_request_t]
777
bye.restype = ctypes.c_int
700
778
bye.errcheck = _retry_on_error
701
779
702
780
check_version = _library.gnutls_check_version
703
781
check_version.argtypes = [ctypes.c_char_p]
704
782
check_version.restype = ctypes.c_char_p
705
706
# All the function declarations below are from gnutls/openpgp.h
707
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
711
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
715
openpgp_crt_fmt_t]
716
openpgp_crt_import.restype = _error_code
717
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
722
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
726
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
ctypes.c_void_p,
731
ctypes.POINTER(
732
ctypes.c_size_t)]
733
openpgp_crt_get_fingerprint.restype = _error_code
734
783
784
_need_version = b"3.3.0"
785
if check_version(_need_version) is None:
786
raise self.Error("Needs GnuTLS {} or later"
787
.format(_need_version))
788
789
_tls_rawpk_version = b"3.6.6"
790
has_rawpk = bool(check_version(_tls_rawpk_version))
791
792
if has_rawpk:
793
# Types
794
class pubkey_st(ctypes.Structure):
795
_fields = []
796
pubkey_t = ctypes.POINTER(pubkey_st)
797
798
x509_crt_fmt_t = ctypes.c_int
799
800
# All the function declarations below are from
801
# gnutls/abstract.h
802
pubkey_init = _library.gnutls_pubkey_init
803
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
804
pubkey_init.restype = _error_code
805
806
pubkey_import = _library.gnutls_pubkey_import
807
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
808
x509_crt_fmt_t]
809
pubkey_import.restype = _error_code
810
811
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
812
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
813
ctypes.POINTER(ctypes.c_ubyte),
814
ctypes.POINTER(ctypes.c_size_t)]
815
pubkey_get_key_id.restype = _error_code
816
817
pubkey_deinit = _library.gnutls_pubkey_deinit
818
pubkey_deinit.argtypes = [pubkey_t]
819
pubkey_deinit.restype = None
820
else:
821
# All the function declarations below are from
822
# gnutls/openpgp.h
823
824
openpgp_crt_init = _library.gnutls_openpgp_crt_init
825
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
826
openpgp_crt_init.restype = _error_code
827
828
openpgp_crt_import = _library.gnutls_openpgp_crt_import
829
openpgp_crt_import.argtypes = [openpgp_crt_t,
830
ctypes.POINTER(datum_t),
831
openpgp_crt_fmt_t]
832
openpgp_crt_import.restype = _error_code
833
834
openpgp_crt_verify_self = \
835
_library.gnutls_openpgp_crt_verify_self
836
openpgp_crt_verify_self.argtypes = [
837
openpgp_crt_t,
838
ctypes.c_uint,
839
ctypes.POINTER(ctypes.c_uint),
840
]
841
openpgp_crt_verify_self.restype = _error_code
842
843
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
844
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
845
openpgp_crt_deinit.restype = None
846
847
openpgp_crt_get_fingerprint = (
848
_library.gnutls_openpgp_crt_get_fingerprint)
849
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
850
ctypes.c_void_p,
851
ctypes.POINTER(
852
ctypes.c_size_t)]
853
openpgp_crt_get_fingerprint.restype = _error_code
854
855
if check_version(b"3.6.4"):
856
certificate_type_get2 = _library.gnutls_certificate_type_get2
857
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
858
certificate_type_get2.restype = _error_code
859
735
860
# Remove non-public functions
736
861
del _error_code, _retry_on_error
737
# Create the global "gnutls" object, simulating a module
738
gnutls = GnuTLS()
862
739
863
740
864
def call_pipe(connection, # : multiprocessing.Connection
741
865
func, *args, **kwargs):
742
866
"""This function is meant to be called by multiprocessing.Process
743
867
744
868
This function runs func(*args, **kwargs), and writes the resulting
745
869
return value on the provided multiprocessing.Connection.
746
870
"""
747
871
connection.send(func(*args, **kwargs))
748
872
connection.close()
749
873
750
class Client(object):
874
875
class Client:
751
876
"""A representation of a client host served by this server.
752
877
753
878
Attributes:
754
approved: bool(); 'None' if not yet approved/disapproved
879
approved: bool(); None if not yet approved/disapproved
755
880
approval_delay: datetime.timedelta(); Time to wait for approval
756
881
approval_duration: datetime.timedelta(); Duration of one approval
757
checker: subprocess.Popen(); a running checker process used
758
to see if the client lives.
759
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
882
checker: multiprocessing.Process(); a running checker process used
883
to see if the client lives. None if no process is
884
running.
885
checker_callback_tag: a GLib event source tag, or None
761
886
checker_command: string; External command which is run to check
762
887
if client lives. %() expansions are done at
763
888
runtime with vars(self) as dict, so that for
764
889
instance %(name)s can be used in the command.
765
checker_initiator_tag: a GObject event source tag, or None
890
checker_initiator_tag: a GLib event source tag, or None
766
891
created: datetime.datetime(); (UTC) object creation
767
892
client_structure: Object describing what attributes a client has
768
893
and is used for storing the client at exit
769
894
current_checker_command: string; current running checker_command
770
disable_initiator_tag: a GObject event source tag, or None
895
disable_initiator_tag: a GLib event source tag, or None
771
896
enabled: bool()
772
897
fingerprint: string (40 or 32 hexadecimal digits); used to
773
uniquely identify the client
898
uniquely identify an OpenPGP client
899
key_id: string (64 hexadecimal digits); used to uniquely identify
900
a client using raw public keys
774
901
host: string; available for use by the checker command
775
902
interval: datetime.timedelta(); How often to start a new checker
776
903
last_approval_request: datetime.datetime(); (UTC) or None
792
919
disabled, or None
793
920
server_settings: The server_settings dict from main()
794
921
"""
795
922
796
923
runtime_expansions = ("approval_delay", "approval_duration",
797
"created", "enabled", "expires",
924
"created", "enabled", "expires", "key_id",
798
925
"fingerprint", "host", "interval",
799
926
"last_approval_request", "last_checked_ok",
800
927
"last_enabled", "name", "timeout")
809
936
"approved_by_default": "True",
810
937
"enabled": "True",
811
938
}
812
939
813
940
@staticmethod
814
941
def config_parser(config):
815
942
"""Construct a new dict of client settings of this form:
822
949
for client_name in config.sections():
823
950
section = dict(config.items(client_name))
824
951
client = settings[client_name] = {}
825
952
826
953
client["host"] = section["host"]
827
954
# Reformat values from string types to Python types
828
955
client["approved_by_default"] = config.getboolean(
829
956
client_name, "approved_by_default")
830
957
client["enabled"] = config.getboolean(client_name,
831
958
"enabled")
832
833
# Uppercase and remove spaces from fingerprint for later
834
# comparison purposes with return value from the
835
# fingerprint() function
959
960
# Uppercase and remove spaces from key_id and fingerprint
961
# for later comparison purposes with return value from the
962
# key_id() and fingerprint() functions
963
client["key_id"] = (section.get("key_id", "").upper()
964
.replace(" ", ""))
836
965
client["fingerprint"] = (section["fingerprint"].upper()
837
966
.replace(" ", ""))
838
967
if "secret" in section:
859
988
client["last_approval_request"] = None
860
989
client["last_checked_ok"] = None
861
990
client["last_checker_status"] = -2
862
991
863
992
return settings
864
865
def __init__(self, settings, name = None, server_settings=None):
993
994
def __init__(self, settings, name=None, server_settings=None):
866
995
self.name = name
867
996
if server_settings is None:
868
997
server_settings = {}
870
999
# adding all client settings
871
1000
for setting, value in settings.items():
872
1001
setattr(self, setting, value)
873
1002
874
1003
if self.enabled:
875
1004
if not hasattr(self, "last_enabled"):
876
1005
self.last_enabled = datetime.datetime.utcnow()
880
1009
else:
881
1010
self.last_enabled = None
882
1011
self.expires = None
883
1012
884
1013
logger.debug("Creating client %r", self.name)
1014
logger.debug(" Key ID: %s", self.key_id)
885
1015
logger.debug(" Fingerprint: %s", self.fingerprint)
886
1016
self.created = settings.get("created",
887
1017
datetime.datetime.utcnow())
888
1018
889
1019
# attributes specific for this server instance
890
1020
self.checker = None
891
1021
self.checker_initiator_tag = None
900
1030
for attr in self.__dict__.keys()
901
1031
if not attr.startswith("_")]
902
1032
self.client_structure.append("client_structure")
903
1033
904
1034
for name, t in inspect.getmembers(
905
1035
type(self), lambda obj: isinstance(obj, property)):
906
1036
if not name.startswith("_"):
907
1037
self.client_structure.append(name)
908
1038
909
1039
# Send notice to process children that client state has changed
910
1040
def send_changedstate(self):
911
1041
with self.changedstate:
912
1042
self.changedstate.notify_all()
913
1043
914
1044
def enable(self):
915
1045
"""Start this client's checker and timeout hooks"""
916
1046
if getattr(self, "enabled", False):
921
1051
self.last_enabled = datetime.datetime.utcnow()
922
1052
self.init_checker()
923
1053
self.send_changedstate()
924
1054
925
1055
def disable(self, quiet=True):
926
1056
"""Disable this client."""
927
1057
if not getattr(self, "enabled", False):
929
1059
if not quiet:
930
1060
logger.info("Disabling client %s", self.name)
931
1061
if getattr(self, "disable_initiator_tag", None) is not None:
932
GObject.source_remove(self.disable_initiator_tag)
1062
GLib.source_remove(self.disable_initiator_tag)
933
1063
self.disable_initiator_tag = None
934
1064
self.expires = None
935
1065
if getattr(self, "checker_initiator_tag", None) is not None:
936
GObject.source_remove(self.checker_initiator_tag)
1066
GLib.source_remove(self.checker_initiator_tag)
937
1067
self.checker_initiator_tag = None
938
1068
self.stop_checker()
939
1069
self.enabled = False
940
1070
if not quiet:
941
1071
self.send_changedstate()
942
# Do not run this again if called by a GObject.timeout_add
1072
# Do not run this again if called by a GLib.timeout_add
943
1073
return False
944
1074
945
1075
def __del__(self):
946
1076
self.disable()
947
1077
948
1078
def init_checker(self):
949
1079
# Schedule a new checker to be started an 'interval' from now,
950
1080
# and every interval from then on.
951
1081
if self.checker_initiator_tag is not None:
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
954
int(self.interval.total_seconds() * 1000),
1082
GLib.source_remove(self.checker_initiator_tag)
1083
self.checker_initiator_tag = GLib.timeout_add(
1084
random.randrange(int(self.interval.total_seconds() * 1000
1085
+ 1)),
955
1086
self.start_checker)
956
1087
# Schedule a disable() when 'timeout' has passed
957
1088
if self.disable_initiator_tag is not None:
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1089
GLib.source_remove(self.disable_initiator_tag)
1090
self.disable_initiator_tag = GLib.timeout_add(
960
1091
int(self.timeout.total_seconds() * 1000), self.disable)
961
1092
# Also start a new checker *right now*.
962
1093
self.start_checker()
963
1094
964
1095
def checker_callback(self, source, condition, connection,
965
1096
command):
966
1097
"""The checker has completed, so take appropriate actions."""
967
self.checker_callback_tag = None
968
self.checker = None
969
1098
# Read return code from connection (see call_pipe)
970
1099
returncode = connection.recv()
971
1100
connection.close()
972
1101
if self.checker is not None:
1102
self.checker.join()
1103
self.checker_callback_tag = None
1104
self.checker = None
1105
973
1106
if returncode >= 0:
974
1107
self.last_checker_status = returncode
975
1108
self.last_checker_signal = None
985
1118
logger.warning("Checker for %(name)s crashed?",
986
1119
vars(self))
987
1120
return False
988
1121
989
1122
def checked_ok(self):
990
1123
"""Assert that the client has been seen, alive and well."""
991
1124
self.last_checked_ok = datetime.datetime.utcnow()
992
1125
self.last_checker_status = 0
993
1126
self.last_checker_signal = None
994
1127
self.bump_timeout()
995
1128
996
1129
def bump_timeout(self, timeout=None):
997
1130
"""Bump up the timeout for this client."""
998
1131
if timeout is None:
999
1132
timeout = self.timeout
1000
1133
if self.disable_initiator_tag is not None:
1001
GObject.source_remove(self.disable_initiator_tag)
1134
GLib.source_remove(self.disable_initiator_tag)
1002
1135
self.disable_initiator_tag = None
1003
1136
if getattr(self, "enabled", False):
1004
self.disable_initiator_tag = GObject.timeout_add(
1137
self.disable_initiator_tag = GLib.timeout_add(
1005
1138
int(timeout.total_seconds() * 1000), self.disable)
1006
1139
self.expires = datetime.datetime.utcnow() + timeout
1007
1140
1008
1141
def need_approval(self):
1009
1142
self.last_approval_request = datetime.datetime.utcnow()
1010
1143
1011
1144
def start_checker(self):
1012
1145
"""Start a new checker subprocess if one is not running.
1013
1146
1014
1147
If a checker already exists, leave it running and do
1015
1148
nothing."""
1016
1149
# The reason for not killing a running checker is that if we
1021
1154
# checkers alone, the checker would have to take more time
1022
1155
# than 'timeout' for the client to be disabled, which is as it
1023
1156
# should be.
1024
1157
1025
1158
if self.checker is not None and not self.checker.is_alive():
1026
1159
logger.warning("Checker was not alive; joining")
1027
1160
self.checker.join()
1030
1163
if self.checker is None:
1031
1164
# Escape attributes for the shell
1032
1165
escaped_attrs = {
1033
attr: re.escape(str(getattr(self, attr)))
1034
for attr in self.runtime_expansions }
1166
attr: shlex.quote(str(getattr(self, attr)))
1167
for attr in self.runtime_expansions}
1035
1168
try:
1036
1169
command = self.checker_command % escaped_attrs
1037
1170
except TypeError as error:
1049
1182
# The exception is when not debugging but nevertheless
1050
1183
# running in the foreground; use the previously
1051
1184
# created wnull.
1052
popen_args = { "close_fds": True,
1053
"shell": True,
1054
"cwd": "/" }
1185
popen_args = {"close_fds": True,
1186
"shell": True,
1187
"cwd": "/"}
1055
1188
if (not self.server_settings["debug"]
1056
1189
and self.server_settings["foreground"]):
1057
1190
popen_args.update({"stdout": wnull,
1058
"stderr": wnull })
1059
pipe = multiprocessing.Pipe(duplex = False)
1191
"stderr": wnull})
1192
pipe = multiprocessing.Pipe(duplex=False)
1060
1193
self.checker = multiprocessing.Process(
1061
target = call_pipe,
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1194
target=call_pipe,
1195
args=(pipe[1], subprocess.call, command),
1196
kwargs=popen_args)
1064
1197
self.checker.start()
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1198
self.checker_callback_tag = GLib.io_add_watch(
1199
GLib.IOChannel.unix_new(pipe[0].fileno()),
1200
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1067
1201
self.checker_callback, pipe[0], command)
1068
# Re-run this periodically if run by GObject.timeout_add
1202
# Re-run this periodically if run by GLib.timeout_add
1069
1203
return True
1070
1204
1071
1205
def stop_checker(self):
1072
1206
"""Force the checker process, if any, to stop."""
1073
1207
if self.checker_callback_tag:
1074
GObject.source_remove(self.checker_callback_tag)
1208
GLib.source_remove(self.checker_callback_tag)
1075
1209
self.checker_callback_tag = None
1076
1210
if getattr(self, "checker", None) is None:
1077
1211
return
1086
1220
byte_arrays=False):
1087
1221
"""Decorators for marking methods of a DBusObjectWithProperties to
1088
1222
become properties on the D-Bus.
1089
1223
1090
1224
The decorated method will be called with no arguments by "Get"
1091
1225
and with one argument by "Set".
1092
1226
1093
1227
The parameters, where they are supported, are the same as
1094
1228
dbus.service.method, except there is only "signature", since the
1095
1229
type from Get() and the type sent to Set() is the same.
1099
1233
if byte_arrays and signature != "ay":
1100
1234
raise ValueError("Byte arrays not supported for non-'ay'"
1101
1235
" signature {!r}".format(signature))
1102
1236
1103
1237
def decorator(func):
1104
1238
func._dbus_is_property = True
1105
1239
func._dbus_interface = dbus_interface
1108
1242
func._dbus_name = func.__name__
1109
1243
if func._dbus_name.endswith("_dbus_property"):
1110
1244
func._dbus_name = func._dbus_name[:-14]
1111
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1245
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1112
1246
return func
1113
1247
1114
1248
return decorator
1115
1249
1116
1250
1117
1251
def dbus_interface_annotations(dbus_interface):
1118
1252
"""Decorator for marking functions returning interface annotations
1119
1253
1120
1254
Usage:
1121
1255
1122
1256
@dbus_interface_annotations("org.example.Interface")
1123
1257
def _foo(self): # Function name does not matter
1124
1258
return {"org.freedesktop.DBus.Deprecated": "true",
1125
1259
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1126
1260
"false"}
1127
1261
"""
1128
1262
1129
1263
def decorator(func):
1130
1264
func._dbus_is_interface = True
1131
1265
func._dbus_interface = dbus_interface
1132
1266
func._dbus_name = dbus_interface
1133
1267
return func
1134
1268
1135
1269
return decorator
1136
1270
1137
1271
1138
1272
def dbus_annotations(annotations):
1139
1273
"""Decorator to annotate D-Bus methods, signals or properties
1140
1274
Usage:
1141
1275
1142
1276
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1143
1277
"org.freedesktop.DBus.Property."
1144
1278
"EmitsChangedSignal": "false"})
1146
1280
access="r")
1147
1281
def Property_dbus_property(self):
1148
1282
return dbus.Boolean(False)
1149
1283
1150
1284
See also the DBusObjectWithAnnotations class.
1151
1285
"""
1152
1286
1153
1287
def decorator(func):
1154
1288
func._dbus_annotations = annotations
1155
1289
return func
1156
1290
1157
1291
return decorator
1158
1292
1159
1293
1177
1311
1178
1312
class DBusObjectWithAnnotations(dbus.service.Object):
1179
1313
"""A D-Bus object with annotations.
1180
1314
1181
1315
Classes inheriting from this can use the dbus_annotations
1182
1316
decorator to add annotations to methods or signals.
1183
1317
"""
1184
1318
1185
1319
@staticmethod
1186
1320
def _is_dbus_thing(thing):
1187
1321
"""Returns a function testing if an attribute is a D-Bus thing
1188
1322
1189
1323
If called like _is_dbus_thing("method") it returns a function
1190
1324
suitable for use as predicate to inspect.getmembers().
1191
1325
"""
1192
1326
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1193
1327
False)
1194
1328
1195
1329
def _get_all_dbus_things(self, thing):
1196
1330
"""Returns a generator of (name, attribute) pairs
1197
1331
"""
1200
1334
for cls in self.__class__.__mro__
1201
1335
for name, athing in
1202
1336
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1203
1337
1204
1338
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1339
out_signature="s",
1340
path_keyword="object_path",
1341
connection_keyword="connection")
1208
1342
def Introspect(self, object_path, connection):
1209
1343
"""Overloading of standard D-Bus method.
1210
1344
1211
1345
Inserts annotation tags on methods and signals.
1212
1346
"""
1213
1347
xmlstring = dbus.service.Object.Introspect(self, object_path,
1214
1348
connection)
1215
1349
try:
1216
1350
document = xml.dom.minidom.parseString(xmlstring)
1217
1351
1218
1352
for if_tag in document.getElementsByTagName("interface"):
1219
1353
# Add annotation tags
1220
1354
for typ in ("method", "signal"):
1247
1381
if_tag.appendChild(ann_tag)
1248
1382
# Fix argument name for the Introspect method itself
1249
1383
if (if_tag.getAttribute("name")
1250
== dbus.INTROSPECTABLE_IFACE):
1384
== dbus.INTROSPECTABLE_IFACE):
1251
1385
for cn in if_tag.getElementsByTagName("method"):
1252
1386
if cn.getAttribute("name") == "Introspect":
1253
1387
for arg in cn.getElementsByTagName("arg"):
1266
1400
1267
1401
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1268
1402
"""A D-Bus object with properties.
1269
1403
1270
1404
Classes inheriting from this can use the dbus_service_property
1271
1405
decorator to expose methods as D-Bus properties. It exposes the
1272
1406
standard Get(), Set(), and GetAll() methods on the D-Bus.
1273
1407
"""
1274
1408
1275
1409
def _get_dbus_property(self, interface_name, property_name):
1276
1410
"""Returns a bound method if one exists which is a D-Bus
1277
1411
property with the specified name and interface.
1282
1416
if (value._dbus_name == property_name
1283
1417
and value._dbus_interface == interface_name):
1284
1418
return value.__get__(self)
1285
1419
1286
1420
# No such property
1287
1421
raise DBusPropertyNotFound("{}:{}.{}".format(
1288
1422
self.dbus_object_path, interface_name, property_name))
1289
1423
1290
1424
@classmethod
1291
1425
def _get_all_interface_names(cls):
1292
1426
"""Get a sequence of all interfaces supported by an object"""
1295
1429
for x in (inspect.getmro(cls))
1296
1430
for attr in dir(x))
1297
1431
if name is not None)
1298
1432
1299
1433
@dbus.service.method(dbus.PROPERTIES_IFACE,
1300
1434
in_signature="ss",
1301
1435
out_signature="v")
1309
1443
if not hasattr(value, "variant_level"):
1310
1444
return value
1311
1445
return type(value)(value, variant_level=value.variant_level+1)
1312
1446
1313
1447
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1314
1448
def Set(self, interface_name, property_name, value):
1315
1449
"""Standard D-Bus property Set() method, see D-Bus standard.
1324
1458
raise ValueError("Byte arrays not supported for non-"
1325
1459
"'ay' signature {!r}"
1326
1460
.format(prop._dbus_signature))
1327
value = dbus.ByteArray(b''.join(chr(byte)
1328
for byte in value))
1461
value = dbus.ByteArray(bytes(value))
1329
1462
prop(value)
1330
1463
1331
1464
@dbus.service.method(dbus.PROPERTIES_IFACE,
1332
1465
in_signature="s",
1333
1466
out_signature="a{sv}")
1334
1467
def GetAll(self, interface_name):
1335
1468
"""Standard D-Bus property GetAll() method, see D-Bus
1336
1469
standard.
1337
1470
1338
1471
Note: Will not include properties with access="write".
1339
1472
"""
1340
1473
properties = {}
1351
1484
properties[name] = value
1352
1485
continue
1353
1486
properties[name] = type(value)(
1354
value, variant_level = value.variant_level + 1)
1487
value, variant_level=value.variant_level + 1)
1355
1488
return dbus.Dictionary(properties, signature="sv")
1356
1489
1357
1490
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1358
1491
def PropertiesChanged(self, interface_name, changed_properties,
1359
1492
invalidated_properties):
1361
1494
standard.
1362
1495
"""
1363
1496
pass
1364
1497
1365
1498
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1366
1499
out_signature="s",
1367
path_keyword='object_path',
1368
connection_keyword='connection')
1500
path_keyword="object_path",
1501
connection_keyword="connection")
1369
1502
def Introspect(self, object_path, connection):
1370
1503
"""Overloading of standard D-Bus method.
1371
1504
1372
1505
Inserts property tags and interface annotation tags.
1373
1506
"""
1374
1507
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1376
1509
connection)
1377
1510
try:
1378
1511
document = xml.dom.minidom.parseString(xmlstring)
1379
1512
1380
1513
def make_tag(document, name, prop):
1381
1514
e = document.createElement("property")
1382
1515
e.setAttribute("name", name)
1383
1516
e.setAttribute("type", prop._dbus_signature)
1384
1517
e.setAttribute("access", prop._dbus_access)
1385
1518
return e
1386
1519
1387
1520
for if_tag in document.getElementsByTagName("interface"):
1388
1521
# Add property tags
1389
1522
for tag in (make_tag(document, name, prop)
1431
1564
exc_info=error)
1432
1565
return xmlstring
1433
1566
1567
1434
1568
try:
1435
1569
dbus.OBJECT_MANAGER_IFACE
1436
1570
except AttributeError:
1437
1571
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1438
1572
1573
1439
1574
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1440
1575
"""A D-Bus object with an ObjectManager.
1441
1576
1442
1577
Classes inheriting from this exposes the standard
1443
1578
GetManagedObjects call and the InterfacesAdded and
1444
1579
InterfacesRemoved signals on the standard
1445
1580
"org.freedesktop.DBus.ObjectManager" interface.
1446
1581
1447
1582
Note: No signals are sent automatically; they must be sent
1448
1583
manually.
1449
1584
"""
1450
1585
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1451
out_signature = "a{oa{sa{sv}}}")
1586
out_signature="a{oa{sa{sv}}}")
1452
1587
def GetManagedObjects(self):
1453
1588
"""This function must be overridden"""
1454
1589
raise NotImplementedError()
1455
1590
1456
1591
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1457
signature = "oa{sa{sv}}")
1592
signature="oa{sa{sv}}")
1458
1593
def InterfacesAdded(self, object_path, interfaces_and_properties):
1459
1594
pass
1460
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1595
1596
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1462
1597
def InterfacesRemoved(self, object_path, interfaces):
1463
1598
pass
1464
1599
1465
1600
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1601
out_signature="s",
1602
path_keyword="object_path",
1603
connection_keyword="connection")
1469
1604
def Introspect(self, object_path, connection):
1470
1605
"""Overloading of standard D-Bus method.
1471
1606
1472
1607
Override return argument name of GetManagedObjects to be
1473
1608
"objpath_interfaces_and_properties"
1474
1609
"""
1477
1612
connection)
1478
1613
try:
1479
1614
document = xml.dom.minidom.parseString(xmlstring)
1480
1615
1481
1616
for if_tag in document.getElementsByTagName("interface"):
1482
1617
# Fix argument name for the GetManagedObjects method
1483
1618
if (if_tag.getAttribute("name")
1484
== dbus.OBJECT_MANAGER_IFACE):
1619
== dbus.OBJECT_MANAGER_IFACE):
1485
1620
for cn in if_tag.getElementsByTagName("method"):
1486
1621
if (cn.getAttribute("name")
1487
1622
== "GetManagedObjects"):
1497
1632
except (AttributeError, xml.dom.DOMException,
1498
1633
xml.parsers.expat.ExpatError) as error:
1499
1634
logger.error("Failed to override Introspection method",
1500
exc_info = error)
1635
exc_info=error)
1501
1636
return xmlstring
1502
1637
1638
1503
1639
def datetime_to_dbus(dt, variant_level=0):
1504
1640
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1505
1641
if dt is None:
1506
return dbus.String("", variant_level = variant_level)
1642
return dbus.String("", variant_level=variant_level)
1507
1643
return dbus.String(dt.isoformat(), variant_level=variant_level)
1508
1644
1509
1645
1512
1648
dbus.service.Object, it will add alternate D-Bus attributes with
1513
1649
interface names according to the "alt_interface_names" mapping.
1514
1650
Usage:
1515
1651
1516
1652
@alternate_dbus_interfaces({"org.example.Interface":
1517
1653
"net.example.AlternateInterface"})
1518
1654
class SampleDBusObject(dbus.service.Object):
1519
1655
@dbus.service.method("org.example.Interface")
1520
1656
def SampleDBusMethod():
1521
1657
pass
1522
1658
1523
1659
The above "SampleDBusMethod" on "SampleDBusObject" will be
1524
1660
reachable via two interfaces: "org.example.Interface" and
1525
1661
"net.example.AlternateInterface", the latter of which will have
1526
1662
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1527
1663
"true", unless "deprecate" is passed with a False value.
1528
1664
1529
1665
This works for methods and signals, and also for D-Bus properties
1530
1666
(from DBusObjectWithProperties) and interfaces (from the
1531
1667
dbus_interface_annotations decorator).
1532
1668
"""
1533
1669
1534
1670
def wrapper(cls):
1535
1671
for orig_interface_name, alt_interface_name in (
1536
1672
alt_interface_names.items()):
1576
1712
attribute._dbus_annotations)
1577
1713
except AttributeError:
1578
1714
pass
1715
1579
1716
# Define a creator of a function to call both the
1580
1717
# original and alternate functions, so both the
1581
1718
# original and alternate signals gets sent when
1584
1721
"""This function is a scope container to pass
1585
1722
func1 and func2 to the "call_both" function
1586
1723
outside of its arguments"""
1587
1724
1588
1725
@functools.wraps(func2)
1589
1726
def call_both(*args, **kwargs):
1590
1727
"""This function will emit two D-Bus
1591
1728
signals by calling func1 and func2"""
1592
1729
func1(*args, **kwargs)
1593
1730
func2(*args, **kwargs)
1594
# Make wrapper function look like a D-Bus signal
1731
# Make wrapper function look like a D-Bus
1732
# signal
1595
1733
for name, attr in inspect.getmembers(func2):
1596
1734
if name.startswith("_dbus_"):
1597
1735
setattr(call_both, name, attr)
1598
1736
1599
1737
return call_both
1600
1738
# Create the "call_both" function and add it to
1601
1739
# the class
1647
1785
(copy_function(attribute)))
1648
1786
if deprecate:
1649
1787
# Deprecate all alternate interfaces
1650
iname="_AlternateDBusNames_interface_annotation{}"
1788
iname = "_AlternateDBusNames_interface_annotation{}"
1651
1789
for interface_name in interface_names:
1652
1790
1653
1791
@dbus_interface_annotations(interface_name)
1654
1792
def func(self):
1655
return { "org.freedesktop.DBus.Deprecated":
1656
"true" }
1793
return {"org.freedesktop.DBus.Deprecated":
1794
"true"}
1657
1795
# Find an unused name
1658
1796
for aname in (iname.format(i)
1659
1797
for i in itertools.count()):
1670
1808
cls = type("{}Alternate".format(cls.__name__),
1671
1809
(cls, ), attr)
1672
1810
return cls
1673
1811
1674
1812
return wrapper
1675
1813
1676
1814
1678
1816
"se.bsnet.fukt.Mandos"})
1679
1817
class ClientDBus(Client, DBusObjectWithProperties):
1680
1818
"""A Client class using D-Bus
1681
1819
1682
1820
Attributes:
1683
1821
dbus_object_path: dbus.ObjectPath
1684
1822
bus: dbus.SystemBus()
1685
1823
"""
1686
1824
1687
1825
runtime_expansions = (Client.runtime_expansions
1688
1826
+ ("dbus_object_path", ))
1689
1827
1690
1828
_interface = "se.recompile.Mandos.Client"
1691
1829
1692
1830
# dbus.service.Object doesn't use super(), so we can't either.
1693
1694
def __init__(self, bus = None, *args, **kwargs):
1831
1832
def __init__(self, bus=None, *args, **kwargs):
1695
1833
self.bus = bus
1696
1834
Client.__init__(self, *args, **kwargs)
1697
1835
# Only now, when this client is initialized, can it show up on
1703
1841
"/clients/" + client_object_name)
1704
1842
DBusObjectWithProperties.__init__(self, self.bus,
1705
1843
self.dbus_object_path)
1706
1844
1707
1845
def notifychangeproperty(transform_func, dbus_name,
1708
1846
type_func=lambda x: x,
1709
1847
variant_level=1,
1711
1849
_interface=_interface):
1712
1850
""" Modify a variable so that it's a property which announces
1713
1851
its changes to DBus.
1714
1852
1715
1853
transform_fun: Function that takes a value and a variant_level
1716
1854
and transforms it to a D-Bus type.
1717
1855
dbus_name: D-Bus name of the variable
1720
1858
variant_level: D-Bus variant level. Default: 1
1721
1859
"""
1722
1860
attrname = "_{}".format(dbus_name)
1723
1861
1724
1862
def setter(self, value):
1725
1863
if hasattr(self, "dbus_object_path"):
1726
1864
if (not hasattr(self, attrname) or
1733
1871
else:
1734
1872
dbus_value = transform_func(
1735
1873
type_func(value),
1736
variant_level = variant_level)
1874
variant_level=variant_level)
1737
1875
self.PropertyChanged(dbus.String(dbus_name),
1738
1876
dbus_value)
1739
1877
self.PropertiesChanged(
1740
1878
_interface,
1741
dbus.Dictionary({ dbus.String(dbus_name):
1742
dbus_value }),
1879
dbus.Dictionary({dbus.String(dbus_name):
1880
dbus_value}),
1743
1881
dbus.Array())
1744
1882
setattr(self, attrname, value)
1745
1883
1746
1884
return property(lambda self: getattr(self, attrname), setter)
1747
1885
1748
1886
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1749
1887
approvals_pending = notifychangeproperty(dbus.Boolean,
1750
1888
"ApprovalPending",
1751
type_func = bool)
1889
type_func=bool)
1752
1890
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1753
1891
last_enabled = notifychangeproperty(datetime_to_dbus,
1754
1892
"LastEnabled")
1755
1893
checker = notifychangeproperty(
1756
1894
dbus.Boolean, "CheckerRunning",
1757
type_func = lambda checker: checker is not None)
1895
type_func=lambda checker: checker is not None)
1758
1896
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1759
1897
"LastCheckedOK")
1760
1898
last_checker_status = notifychangeproperty(dbus.Int16,
1765
1903
"ApprovedByDefault")
1766
1904
approval_delay = notifychangeproperty(
1767
1905
dbus.UInt64, "ApprovalDelay",
1768
type_func = lambda td: td.total_seconds() * 1000)
1906
type_func=lambda td: td.total_seconds() * 1000)
1769
1907
approval_duration = notifychangeproperty(
1770
1908
dbus.UInt64, "ApprovalDuration",
1771
type_func = lambda td: td.total_seconds() * 1000)
1909
type_func=lambda td: td.total_seconds() * 1000)
1772
1910
host = notifychangeproperty(dbus.String, "Host")
1773
1911
timeout = notifychangeproperty(
1774
1912
dbus.UInt64, "Timeout",
1775
type_func = lambda td: td.total_seconds() * 1000)
1913
type_func=lambda td: td.total_seconds() * 1000)
1776
1914
extended_timeout = notifychangeproperty(
1777
1915
dbus.UInt64, "ExtendedTimeout",
1778
type_func = lambda td: td.total_seconds() * 1000)
1916
type_func=lambda td: td.total_seconds() * 1000)
1779
1917
interval = notifychangeproperty(
1780
1918
dbus.UInt64, "Interval",
1781
type_func = lambda td: td.total_seconds() * 1000)
1919
type_func=lambda td: td.total_seconds() * 1000)
1782
1920
checker_command = notifychangeproperty(dbus.String, "Checker")
1783
1921
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1784
1922
invalidate_only=True)
1785
1923
1786
1924
del notifychangeproperty
1787
1925
1788
1926
def __del__(self, *args, **kwargs):
1789
1927
try:
1790
1928
self.remove_from_connection()
1793
1931
if hasattr(DBusObjectWithProperties, "__del__"):
1794
1932
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1795
1933
Client.__del__(self, *args, **kwargs)
1796
1934
1797
1935
def checker_callback(self, source, condition,
1798
1936
connection, command, *args, **kwargs):
1799
1937
ret = Client.checker_callback(self, source, condition,
1815
1953
| self.last_checker_signal),
1816
1954
dbus.String(command))
1817
1955
return ret
1818
1956
1819
1957
def start_checker(self, *args, **kwargs):
1820
1958
old_checker_pid = getattr(self.checker, "pid", None)
1821
1959
r = Client.start_checker(self, *args, **kwargs)
1825
1963
# Emit D-Bus signal
1826
1964
self.CheckerStarted(self.current_checker_command)
1827
1965
return r
1828
1966
1829
1967
def _reset_approved(self):
1830
1968
self.approved = None
1831
1969
return False
1832
1970
1833
1971
def approve(self, value=True):
1834
1972
self.approved = value
1835
GObject.timeout_add(int(self.approval_duration.total_seconds()
1836
* 1000), self._reset_approved)
1973
GLib.timeout_add(int(self.approval_duration.total_seconds()
1974
* 1000), self._reset_approved)
1837
1975
self.send_changedstate()
1838
1839
## D-Bus methods, signals & properties
1840
1841
## Interfaces
1842
1843
## Signals
1844
1976
1977
# D-Bus methods, signals & properties
1978
1979
# Interfaces
1980
1981
# Signals
1982
1845
1983
# CheckerCompleted - signal
1846
1984
@dbus.service.signal(_interface, signature="nxs")
1847
1985
def CheckerCompleted(self, exitcode, waitstatus, command):
1848
1986
"D-Bus signal"
1849
1987
pass
1850
1988
1851
1989
# CheckerStarted - signal
1852
1990
@dbus.service.signal(_interface, signature="s")
1853
1991
def CheckerStarted(self, command):
1854
1992
"D-Bus signal"
1855
1993
pass
1856
1994
1857
1995
# PropertyChanged - signal
1858
1996
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1859
1997
@dbus.service.signal(_interface, signature="sv")
1860
1998
def PropertyChanged(self, property, value):
1861
1999
"D-Bus signal"
1862
2000
pass
1863
2001
1864
2002
# GotSecret - signal
1865
2003
@dbus.service.signal(_interface)
1866
2004
def GotSecret(self):
1869
2007
server to mandos-client
1870
2008
"""
1871
2009
pass
1872
2010
1873
2011
# Rejected - signal
1874
2012
@dbus.service.signal(_interface, signature="s")
1875
2013
def Rejected(self, reason):
1876
2014
"D-Bus signal"
1877
2015
pass
1878
2016
1879
2017
# NeedApproval - signal
1880
2018
@dbus.service.signal(_interface, signature="tb")
1881
2019
def NeedApproval(self, timeout, default):
1882
2020
"D-Bus signal"
1883
2021
return self.need_approval()
1884
1885
## Methods
1886
2022
2023
# Methods
2024
1887
2025
# Approve - method
1888
2026
@dbus.service.method(_interface, in_signature="b")
1889
2027
def Approve(self, value):
1890
2028
self.approve(value)
1891
2029
1892
2030
# CheckedOK - method
1893
2031
@dbus.service.method(_interface)
1894
2032
def CheckedOK(self):
1895
2033
self.checked_ok()
1896
2034
1897
2035
# Enable - method
1898
2036
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1899
2037
@dbus.service.method(_interface)
1900
2038
def Enable(self):
1901
2039
"D-Bus method"
1902
2040
self.enable()
1903
2041
1904
2042
# StartChecker - method
1905
2043
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1906
2044
@dbus.service.method(_interface)
1907
2045
def StartChecker(self):
1908
2046
"D-Bus method"
1909
2047
self.start_checker()
1910
2048
1911
2049
# Disable - method
1912
2050
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1913
2051
@dbus.service.method(_interface)
1914
2052
def Disable(self):
1915
2053
"D-Bus method"
1916
2054
self.disable()
1917
2055
1918
2056
# StopChecker - method
1919
2057
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1920
2058
@dbus.service.method(_interface)
1921
2059
def StopChecker(self):
1922
2060
self.stop_checker()
1923
1924
## Properties
1925
2061
2062
# Properties
2063
1926
2064
# ApprovalPending - property
1927
2065
@dbus_service_property(_interface, signature="b", access="read")
1928
2066
def ApprovalPending_dbus_property(self):
1929
2067
return dbus.Boolean(bool(self.approvals_pending))
1930
2068
1931
2069
# ApprovedByDefault - property
1932
2070
@dbus_service_property(_interface,
1933
2071
signature="b",
1936
2074
if value is None: # get
1937
2075
return dbus.Boolean(self.approved_by_default)
1938
2076
self.approved_by_default = bool(value)
1939
2077
1940
2078
# ApprovalDelay - property
1941
2079
@dbus_service_property(_interface,
1942
2080
signature="t",
1946
2084
return dbus.UInt64(self.approval_delay.total_seconds()
1947
2085
* 1000)
1948
2086
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1949
2087
1950
2088
# ApprovalDuration - property
1951
2089
@dbus_service_property(_interface,
1952
2090
signature="t",
1956
2094
return dbus.UInt64(self.approval_duration.total_seconds()
1957
2095
* 1000)
1958
2096
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1959
2097
1960
2098
# Name - property
1961
2099
@dbus_annotations(
1962
2100
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1963
2101
@dbus_service_property(_interface, signature="s", access="read")
1964
2102
def Name_dbus_property(self):
1965
2103
return dbus.String(self.name)
1966
2104
2105
# KeyID - property
2106
@dbus_annotations(
2107
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2108
@dbus_service_property(_interface, signature="s", access="read")
2109
def KeyID_dbus_property(self):
2110
return dbus.String(self.key_id)
2111
1967
2112
# Fingerprint - property
1968
2113
@dbus_annotations(
1969
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1970
2115
@dbus_service_property(_interface, signature="s", access="read")
1971
2116
def Fingerprint_dbus_property(self):
1972
2117
return dbus.String(self.fingerprint)
1973
2118
1974
2119
# Host - property
1975
2120
@dbus_service_property(_interface,
1976
2121
signature="s",
1979
2124
if value is None: # get
1980
2125
return dbus.String(self.host)
1981
2126
self.host = str(value)
1982
2127
1983
2128
# Created - property
1984
2129
@dbus_annotations(
1985
2130
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
2131
@dbus_service_property(_interface, signature="s", access="read")
1987
2132
def Created_dbus_property(self):
1988
2133
return datetime_to_dbus(self.created)
1989
2134
1990
2135
# LastEnabled - property
1991
2136
@dbus_service_property(_interface, signature="s", access="read")
1992
2137
def LastEnabled_dbus_property(self):
1993
2138
return datetime_to_dbus(self.last_enabled)
1994
2139
1995
2140
# Enabled - property
1996
2141
@dbus_service_property(_interface,
1997
2142
signature="b",
2003
2148
self.enable()
2004
2149
else:
2005
2150
self.disable()
2006
2151
2007
2152
# LastCheckedOK - property
2008
2153
@dbus_service_property(_interface,
2009
2154
signature="s",
2013
2158
self.checked_ok()
2014
2159
return
2015
2160
return datetime_to_dbus(self.last_checked_ok)
2016
2161
2017
2162
# LastCheckerStatus - property
2018
2163
@dbus_service_property(_interface, signature="n", access="read")
2019
2164
def LastCheckerStatus_dbus_property(self):
2020
2165
return dbus.Int16(self.last_checker_status)
2021
2166
2022
2167
# Expires - property
2023
2168
@dbus_service_property(_interface, signature="s", access="read")
2024
2169
def Expires_dbus_property(self):
2025
2170
return datetime_to_dbus(self.expires)
2026
2171
2027
2172
# LastApprovalRequest - property
2028
2173
@dbus_service_property(_interface, signature="s", access="read")
2029
2174
def LastApprovalRequest_dbus_property(self):
2030
2175
return datetime_to_dbus(self.last_approval_request)
2031
2176
2032
2177
# Timeout - property
2033
2178
@dbus_service_property(_interface,
2034
2179
signature="t",
2049
2194
if (getattr(self, "disable_initiator_tag", None)
2050
2195
is None):
2051
2196
return
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2197
GLib.source_remove(self.disable_initiator_tag)
2198
self.disable_initiator_tag = GLib.timeout_add(
2054
2199
int((self.expires - now).total_seconds() * 1000),
2055
2200
self.disable)
2056
2201
2057
2202
# ExtendedTimeout - property
2058
2203
@dbus_service_property(_interface,
2059
2204
signature="t",
2063
2208
return dbus.UInt64(self.extended_timeout.total_seconds()
2064
2209
* 1000)
2065
2210
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2066
2211
2067
2212
# Interval - property
2068
2213
@dbus_service_property(_interface,
2069
2214
signature="t",
2076
2221
return
2077
2222
if self.enabled:
2078
2223
# Reschedule checker run
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2224
GLib.source_remove(self.checker_initiator_tag)
2225
self.checker_initiator_tag = GLib.timeout_add(
2081
2226
value, self.start_checker)
2082
self.start_checker() # Start one now, too
2083
2227
self.start_checker() # Start one now, too
2228
2084
2229
# Checker - property
2085
2230
@dbus_service_property(_interface,
2086
2231
signature="s",
2089
2234
if value is None: # get
2090
2235
return dbus.String(self.checker_command)
2091
2236
self.checker_command = str(value)
2092
2237
2093
2238
# CheckerRunning - property
2094
2239
@dbus_service_property(_interface,
2095
2240
signature="b",
2101
2246
self.start_checker()
2102
2247
else:
2103
2248
self.stop_checker()
2104
2249
2105
2250
# ObjectPath - property
2106
2251
@dbus_annotations(
2107
2252
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2108
2253
"org.freedesktop.DBus.Deprecated": "true"})
2109
2254
@dbus_service_property(_interface, signature="o", access="read")
2110
2255
def ObjectPath_dbus_property(self):
2111
return self.dbus_object_path # is already a dbus.ObjectPath
2112
2256
return self.dbus_object_path # is already a dbus.ObjectPath
2257
2113
2258
# Secret = property
2114
2259
@dbus_annotations(
2115
2260
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2120
2265
byte_arrays=True)
2121
2266
def Secret_dbus_property(self, value):
2122
2267
self.secret = bytes(value)
2123
2268
2124
2269
del _interface
2125
2270
2126
2271
2127
class ProxyClient(object):
2128
def __init__(self, child_pipe, fpr, address):
2272
class ProxyClient:
2273
def __init__(self, child_pipe, key_id, fpr, address):
2129
2274
self._pipe = child_pipe
2130
self._pipe.send(('init', fpr, address))
2275
self._pipe.send(("init", key_id, fpr, address))
2131
2276
if not self._pipe.recv():
2132
raise KeyError(fpr)
2133
2277
raise KeyError(key_id or fpr)
2278
2134
2279
def __getattribute__(self, name):
2135
if name == '_pipe':
2280
if name == "_pipe":
2136
2281
return super(ProxyClient, self).__getattribute__(name)
2137
self._pipe.send(('getattr', name))
2282
self._pipe.send(("getattr", name))
2138
2283
data = self._pipe.recv()
2139
if data[0] == 'data':
2284
if data[0] == "data":
2140
2285
return data[1]
2141
if data[0] == 'function':
2142
2286
if data[0] == "function":
2287
2143
2288
def func(*args, **kwargs):
2144
self._pipe.send(('funcall', name, args, kwargs))
2289
self._pipe.send(("funcall", name, args, kwargs))
2145
2290
return self._pipe.recv()[1]
2146
2291
2147
2292
return func
2148
2293
2149
2294
def __setattr__(self, name, value):
2150
if name == '_pipe':
2295
if name == "_pipe":
2151
2296
return super(ProxyClient, self).__setattr__(name, value)
2152
self._pipe.send(('setattr', name, value))
2297
self._pipe.send(("setattr", name, value))
2153
2298
2154
2299
2155
2300
class ClientHandler(socketserver.BaseRequestHandler, object):
2156
2301
"""A class to handle client connections.
2157
2302
2158
2303
Instantiated once for each connection to handle it.
2159
2304
Note: This will run in its own forked process."""
2160
2305
2161
2306
def handle(self):
2162
2307
with contextlib.closing(self.server.child_pipe) as child_pipe:
2163
2308
logger.info("TCP connection from: %s",
2164
2309
str(self.client_address))
2165
2310
logger.debug("Pipe FD: %d",
2166
2311
self.server.child_pipe.fileno())
2167
2312
2168
2313
session = gnutls.ClientSession(self.request)
2169
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2173
# "+DHE-DSS"))
2314
2315
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2316
# "+AES-256-CBC", "+SHA1",
2317
# "+COMP-NULL", "+CTYPE-OPENPGP",
2318
# "+DHE-DSS"))
2174
2319
# Use a fallback default, since this MUST be set.
2175
2320
priority = self.server.gnutls_priority
2176
2321
if priority is None:
2177
2322
priority = "NORMAL"
2178
gnutls.priority_set_direct(session._c_object, priority,
2179
None)
2180
2323
gnutls.priority_set_direct(session,
2324
priority.encode("utf-8"), None)
2325
2181
2326
# Start communication using the Mandos protocol
2182
2327
# Get protocol number
2183
2328
line = self.request.makefile().readline()
2188
2333
except (ValueError, IndexError, RuntimeError) as error:
2189
2334
logger.error("Unknown protocol version: %s", error)
2190
2335
return
2191
2336
2192
2337
# Start GnuTLS connection
2193
2338
try:
2194
2339
session.handshake()
2198
2343
# established. Just abandon the request.
2199
2344
return
2200
2345
logger.debug("Handshake succeeded")
2201
2346
2202
2347
approval_required = False
2203
2348
try:
2204
try:
2205
fpr = self.fingerprint(
2206
self.peer_certificate(session))
2207
except (TypeError, gnutls.Error) as error:
2208
logger.warning("Bad certificate: %s", error)
2209
return
2210
logger.debug("Fingerprint: %s", fpr)
2211
2212
try:
2213
client = ProxyClient(child_pipe, fpr,
2349
if gnutls.has_rawpk:
2350
fpr = b""
2351
try:
2352
key_id = self.key_id(
2353
self.peer_certificate(session))
2354
except (TypeError, gnutls.Error) as error:
2355
logger.warning("Bad certificate: %s", error)
2356
return
2357
logger.debug("Key ID: %s",
2358
key_id.decode("utf-8",
2359
errors="replace"))
2360
2361
else:
2362
key_id = b""
2363
try:
2364
fpr = self.fingerprint(
2365
self.peer_certificate(session))
2366
except (TypeError, gnutls.Error) as error:
2367
logger.warning("Bad certificate: %s", error)
2368
return
2369
logger.debug("Fingerprint: %s", fpr)
2370
2371
try:
2372
client = ProxyClient(child_pipe, key_id, fpr,
2214
2373
self.client_address)
2215
2374
except KeyError:
2216
2375
return
2217
2376
2218
2377
if client.approval_delay:
2219
2378
delay = client.approval_delay
2220
2379
client.approvals_pending += 1
2221
2380
approval_required = True
2222
2381
2223
2382
while True:
2224
2383
if not client.enabled:
2225
2384
logger.info("Client %s is disabled",
2228
2387
# Emit D-Bus signal
2229
2388
client.Rejected("Disabled")
2230
2389
return
2231
2390
2232
2391
if client.approved or not client.approval_delay:
2233
#We are approved or approval is disabled
2392
# We are approved or approval is disabled
2234
2393
break
2235
2394
elif client.approved is None:
2236
2395
logger.info("Client %s needs approval",
2247
2406
# Emit D-Bus signal
2248
2407
client.Rejected("Denied")
2249
2408
return
2250
2251
#wait until timeout or approved
2409
2410
# wait until timeout or approved
2252
2411
time = datetime.datetime.now()
2253
2412
client.changedstate.acquire()
2254
2413
client.changedstate.wait(delay.total_seconds())
2267
2426
break
2268
2427
else:
2269
2428
delay -= time2 - time
2270
2429
2271
2430
try:
2272
2431
session.send(client.secret)
2273
2432
except gnutls.Error as error:
2274
2433
logger.warning("gnutls send failed",
2275
exc_info = error)
2434
exc_info=error)
2276
2435
return
2277
2436
2278
2437
logger.info("Sending secret to %s", client.name)
2279
2438
# bump the timeout using extended_timeout
2280
2439
client.bump_timeout(client.extended_timeout)
2281
2440
if self.server.use_dbus:
2282
2441
# Emit D-Bus signal
2283
2442
client.GotSecret()
2284
2443
2285
2444
finally:
2286
2445
if approval_required:
2287
2446
client.approvals_pending -= 1
2290
2449
except gnutls.Error as error:
2291
2450
logger.warning("GnuTLS bye failed",
2292
2451
exc_info=error)
2293
2452
2294
2453
@staticmethod
2295
2454
def peer_certificate(session):
2296
"Return the peer's OpenPGP certificate as a bytestring"
2297
# If not an OpenPGP certificate...
2298
if (gnutls.certificate_type_get(session._c_object)
2299
!= gnutls.CRT_OPENPGP):
2455
"Return the peer's certificate as a bytestring"
2456
try:
2457
cert_type = gnutls.certificate_type_get2(
2458
session, gnutls.CTYPE_PEERS)
2459
except AttributeError:
2460
cert_type = gnutls.certificate_type_get(session)
2461
if gnutls.has_rawpk:
2462
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2463
else:
2464
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2465
# If not a valid certificate type...
2466
if cert_type not in valid_cert_types:
2467
logger.info("Cert type %r not in %r", cert_type,
2468
valid_cert_types)
2300
2469
# ...return invalid data
2301
2470
return b""
2302
2471
list_size = ctypes.c_uint(1)
2303
2472
cert_list = (gnutls.certificate_get_peers
2304
(session._c_object, ctypes.byref(list_size)))
2473
(session, ctypes.byref(list_size)))
2305
2474
if not bool(cert_list) and list_size.value != 0:
2306
2475
raise gnutls.Error("error getting peer certificate")
2307
2476
if list_size.value == 0:
2308
2477
return None
2309
2478
cert = cert_list[0]
2310
2479
return ctypes.string_at(cert.data, cert.size)
2311
2480
2481
@staticmethod
2482
def key_id(certificate):
2483
"Convert a certificate bytestring to a hexdigit key ID"
2484
# New GnuTLS "datum" with the public key
2485
datum = gnutls.datum_t(
2486
ctypes.cast(ctypes.c_char_p(certificate),
2487
ctypes.POINTER(ctypes.c_ubyte)),
2488
ctypes.c_uint(len(certificate)))
2489
# XXX all these need to be created in the gnutls "module"
2490
# New empty GnuTLS certificate
2491
pubkey = gnutls.pubkey_t()
2492
gnutls.pubkey_init(ctypes.byref(pubkey))
2493
# Import the raw public key into the certificate
2494
gnutls.pubkey_import(pubkey,
2495
ctypes.byref(datum),
2496
gnutls.X509_FMT_DER)
2497
# New buffer for the key ID
2498
buf = ctypes.create_string_buffer(32)
2499
buf_len = ctypes.c_size_t(len(buf))
2500
# Get the key ID from the raw public key into the buffer
2501
gnutls.pubkey_get_key_id(
2502
pubkey,
2503
gnutls.KEYID_USE_SHA256,
2504
ctypes.cast(ctypes.byref(buf),
2505
ctypes.POINTER(ctypes.c_ubyte)),
2506
ctypes.byref(buf_len))
2507
# Deinit the certificate
2508
gnutls.pubkey_deinit(pubkey)
2509
2510
# Convert the buffer to a Python bytestring
2511
key_id = ctypes.string_at(buf, buf_len.value)
2512
# Convert the bytestring to hexadecimal notation
2513
hex_key_id = binascii.hexlify(key_id).upper()
2514
return hex_key_id
2515
2312
2516
@staticmethod
2313
2517
def fingerprint(openpgp):
2314
2518
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2329
2533
ctypes.byref(crtverify))
2330
2534
if crtverify.value != 0:
2331
2535
gnutls.openpgp_crt_deinit(crt)
2332
raise gnutls.CertificateSecurityError("Verify failed")
2536
raise gnutls.CertificateSecurityError(code
2537
=crtverify.value)
2333
2538
# New buffer for the fingerprint
2334
2539
buf = ctypes.create_string_buffer(20)
2335
2540
buf_len = ctypes.c_size_t()
2345
2550
return hex_fpr
2346
2551
2347
2552
2348
class MultiprocessingMixIn(object):
2553
class MultiprocessingMixIn:
2349
2554
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2350
2555
2351
2556
def sub_process_main(self, request, address):
2352
2557
try:
2353
2558
self.finish_request(request, address)
2354
2559
except Exception:
2355
2560
self.handle_error(request, address)
2356
2561
self.close_request(request)
2357
2562
2358
2563
def process_request(self, request, address):
2359
2564
"""Start a new process to process the request."""
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2565
proc = multiprocessing.Process(target=self.sub_process_main,
2566
args=(request, address))
2362
2567
proc.start()
2363
2568
return proc
2364
2569
2365
2570
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2571
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2367
2572
""" adds a pipe to the MixIn """
2368
2573
2369
2574
def process_request(self, request, client_address):
2370
2575
"""Overrides and wraps the original process_request().
2371
2576
2372
2577
This function creates a new pipe in self.pipe
2373
2578
"""
2374
2579
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2375
2580
2376
2581
proc = MultiprocessingMixIn.process_request(self, request,
2377
2582
client_address)
2378
2583
self.child_pipe.close()
2379
2584
self.add_pipe(parent_pipe, proc)
2380
2585
2381
2586
def add_pipe(self, parent_pipe, proc):
2382
2587
"""Dummy function; override as necessary"""
2383
2588
raise NotImplementedError()
2384
2589
2385
2590
2386
2591
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2387
socketserver.TCPServer, object):
2388
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2389
2592
socketserver.TCPServer):
2593
"""IPv6-capable TCP server. Accepts None as address and/or port
2594
2390
2595
Attributes:
2391
2596
enabled: Boolean; whether this server is activated yet
2392
2597
interface: None or a network interface name (string)
2393
2598
use_ipv6: Boolean; to use IPv6 or not
2394
2599
"""
2395
2600
2396
2601
def __init__(self, server_address, RequestHandlerClass,
2397
2602
interface=None,
2398
2603
use_ipv6=True,
2408
2613
self.socketfd = socketfd
2409
2614
# Save the original socket.socket() function
2410
2615
self.socket_socket = socket.socket
2616
2411
2617
# To implement --socket, we monkey patch socket.socket.
2412
#
2618
#
2413
2619
# (When socketserver.TCPServer is a new-style class, we
2414
2620
# could make self.socket into a property instead of monkey
2415
2621
# patching socket.socket.)
2416
#
2622
#
2417
2623
# Create a one-time-only replacement for socket.socket()
2418
2624
@functools.wraps(socket.socket)
2419
2625
def socket_wrapper(*args, **kwargs):
2431
2637
# socket_wrapper(), if socketfd was set.
2432
2638
socketserver.TCPServer.__init__(self, server_address,
2433
2639
RequestHandlerClass)
2434
2640
2435
2641
def server_bind(self):
2436
2642
"""This overrides the normal server_bind() function
2437
2643
to bind to an interface if one was specified, and also NOT to
2438
2644
bind to an address or port if they were not specified."""
2645
global SO_BINDTODEVICE
2439
2646
if self.interface is not None:
2440
2647
if SO_BINDTODEVICE is None:
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2443
self.interface)
2444
else:
2445
try:
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2456
self.interface)
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2460
else:
2461
raise
2648
# Fall back to a hard-coded value which seems to be
2649
# common enough.
2650
logger.warning("SO_BINDTODEVICE not found, trying 25")
2651
SO_BINDTODEVICE = 25
2652
try:
2653
self.socket.setsockopt(
2654
socket.SOL_SOCKET, SO_BINDTODEVICE,
2655
(self.interface + "\0").encode("utf-8"))
2656
except socket.error as error:
2657
if error.errno == errno.EPERM:
2658
logger.error("No permission to bind to"
2659
" interface %s", self.interface)
2660
elif error.errno == errno.ENOPROTOOPT:
2661
logger.error("SO_BINDTODEVICE not available;"
2662
" cannot bind to interface %s",
2663
self.interface)
2664
elif error.errno == errno.ENODEV:
2665
logger.error("Interface %s does not exist,"
2666
" cannot bind", self.interface)
2667
else:
2668
raise
2462
2669
# Only bind(2) the socket if we really need to.
2463
2670
if self.server_address[0] or self.server_address[1]:
2671
if self.server_address[1]:
2672
self.allow_reuse_address = True
2464
2673
if not self.server_address[0]:
2465
2674
if self.address_family == socket.AF_INET6:
2466
any_address = "::" # in6addr_any
2675
any_address = "::" # in6addr_any
2467
2676
else:
2468
any_address = "0.0.0.0" # INADDR_ANY
2677
any_address = "0.0.0.0" # INADDR_ANY
2469
2678
self.server_address = (any_address,
2470
2679
self.server_address[1])
2471
2680
elif not self.server_address[1]:
2481
2690
2482
2691
class MandosServer(IPv6_TCPServer):
2483
2692
"""Mandos server.
2484
2693
2485
2694
Attributes:
2486
2695
clients: set of Client objects
2487
2696
gnutls_priority GnuTLS priority string
2488
2697
use_dbus: Boolean; to emit D-Bus signals or not
2489
2490
Assumes a GObject.MainLoop event loop.
2698
2699
Assumes a GLib.MainLoop event loop.
2491
2700
"""
2492
2701
2493
2702
def __init__(self, server_address, RequestHandlerClass,
2494
2703
interface=None,
2495
2704
use_ipv6=True,
2505
2714
self.gnutls_priority = gnutls_priority
2506
2715
IPv6_TCPServer.__init__(self, server_address,
2507
2716
RequestHandlerClass,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2511
2717
interface=interface,
2718
use_ipv6=use_ipv6,
2719
socketfd=socketfd)
2720
2512
2721
def server_activate(self):
2513
2722
if self.enabled:
2514
2723
return socketserver.TCPServer.server_activate(self)
2515
2724
2516
2725
def enable(self):
2517
2726
self.enabled = True
2518
2727
2519
2728
def add_pipe(self, parent_pipe, proc):
2520
2729
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2522
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2730
GLib.io_add_watch(
2731
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2732
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2524
2733
functools.partial(self.handle_ipc,
2525
parent_pipe = parent_pipe,
2526
proc = proc))
2527
2734
parent_pipe=parent_pipe,
2735
proc=proc))
2736
2528
2737
def handle_ipc(self, source, condition,
2529
2738
parent_pipe=None,
2530
proc = None,
2739
proc=None,
2531
2740
client_object=None):
2532
2741
# error, or the other end of multiprocessing.Pipe has closed
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2742
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2534
2743
# Wait for other process to exit
2535
2744
proc.join()
2536
2745
return False
2537
2746
2538
2747
# Read a request from the child
2539
2748
request = parent_pipe.recv()
2540
2749
command = request[0]
2541
2542
if command == 'init':
2543
fpr = request[1]
2544
address = request[2]
2545
2750
2751
if command == "init":
2752
key_id = request[1].decode("ascii")
2753
fpr = request[2].decode("ascii")
2754
address = request[3]
2755
2546
2756
for c in self.clients.values():
2547
if c.fingerprint == fpr:
2757
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2758
"27AE41E4649B934CA495991B7852B855"):
2759
continue
2760
if key_id and c.key_id == key_id:
2761
client = c
2762
break
2763
if fpr and c.fingerprint == fpr:
2548
2764
client = c
2549
2765
break
2550
2766
else:
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2767
logger.info("Client not found for key ID: %s, address"
2768
": %s", key_id or fpr, address)
2553
2769
if self.use_dbus:
2554
2770
# Emit D-Bus signal
2555
mandos_dbus_service.ClientNotFound(fpr,
2771
mandos_dbus_service.ClientNotFound(key_id or fpr,
2556
2772
address[0])
2557
2773
parent_pipe.send(False)
2558
2774
return False
2559
2560
GObject.io_add_watch(
2561
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2775
2776
GLib.io_add_watch(
2777
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2778
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2563
2779
functools.partial(self.handle_ipc,
2564
parent_pipe = parent_pipe,
2565
proc = proc,
2566
client_object = client))
2780
parent_pipe=parent_pipe,
2781
proc=proc,
2782
client_object=client))
2567
2783
parent_pipe.send(True)
2568
2784
# remove the old hook in favor of the new above hook on
2569
2785
# same fileno
2570
2786
return False
2571
if command == 'funcall':
2787
if command == "funcall":
2572
2788
funcname = request[1]
2573
2789
args = request[2]
2574
2790
kwargs = request[3]
2575
2576
parent_pipe.send(('data', getattr(client_object,
2791
2792
parent_pipe.send(("data", getattr(client_object,
2577
2793
funcname)(*args,
2578
2794
**kwargs)))
2579
2580
if command == 'getattr':
2795
2796
if command == "getattr":
2581
2797
attrname = request[1]
2582
2798
if isinstance(client_object.__getattribute__(attrname),
2583
collections.Callable):
2584
parent_pipe.send(('function', ))
2799
collections.abc.Callable):
2800
parent_pipe.send(("function", ))
2585
2801
else:
2586
2802
parent_pipe.send((
2587
'data', client_object.__getattribute__(attrname)))
2588
2589
if command == 'setattr':
2803
"data", client_object.__getattribute__(attrname)))
2804
2805
if command == "setattr":
2590
2806
attrname = request[1]
2591
2807
value = request[2]
2592
2808
setattr(client_object, attrname, value)
2593
2809
2594
2810
return True
2595
2811
2596
2812
2597
2813
def rfc3339_duration_to_delta(duration):
2598
2814
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2599
2600
>>> rfc3339_duration_to_delta("P7D")
2601
datetime.timedelta(7)
2602
>>> rfc3339_duration_to_delta("PT60S")
2603
datetime.timedelta(0, 60)
2604
>>> rfc3339_duration_to_delta("PT60M")
2605
datetime.timedelta(0, 3600)
2606
>>> rfc3339_duration_to_delta("PT24H")
2607
datetime.timedelta(1)
2608
>>> rfc3339_duration_to_delta("P1W")
2609
datetime.timedelta(7)
2610
>>> rfc3339_duration_to_delta("PT5M30S")
2611
datetime.timedelta(0, 330)
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
datetime.timedelta(1, 200)
2815
2816
>>> timedelta = datetime.timedelta
2817
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2818
True
2819
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2820
True
2821
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2822
True
2823
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2824
True
2825
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2826
True
2827
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2828
True
2829
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2830
True
2831
>>> del timedelta
2614
2832
"""
2615
2833
2616
2834
# Parsing an RFC 3339 duration with regular expressions is not
2617
2835
# possible - there would have to be multiple places for the same
2618
2836
# values, like seconds. The current code, while more esoteric, is
2619
2837
# cleaner without depending on a parsing library. If Python had a
2620
2838
# built-in library for parsing we would use it, but we'd like to
2621
2839
# avoid excessive use of external libraries.
2622
2840
2623
2841
# New type for defining tokens, syntax, and semantics all-in-one
2624
2842
Token = collections.namedtuple("Token", (
2625
2843
"regexp", # To match token; if "value" is not None, must have
2658
2876
frozenset((token_year, token_month,
2659
2877
token_day, token_time,
2660
2878
token_week)))
2661
# Define starting values
2662
value = datetime.timedelta() # Value so far
2879
# Define starting values:
2880
# Value so far
2881
value = datetime.timedelta()
2663
2882
found_token = None
2664
followers = frozenset((token_duration, )) # Following valid tokens
2665
s = duration # String left to parse
2883
# Following valid tokens
2884
followers = frozenset((token_duration, ))
2885
# String left to parse
2886
s = duration
2666
2887
# Loop until end token is found
2667
2888
while found_token is not token_end:
2668
2889
# Search for any currently valid tokens
2692
2913
2693
2914
def string_to_delta(interval):
2694
2915
"""Parse a string and return a datetime.timedelta
2695
2696
>>> string_to_delta('7d')
2697
datetime.timedelta(7)
2698
>>> string_to_delta('60s')
2699
datetime.timedelta(0, 60)
2700
>>> string_to_delta('60m')
2701
datetime.timedelta(0, 3600)
2702
>>> string_to_delta('24h')
2703
datetime.timedelta(1)
2704
>>> string_to_delta('1w')
2705
datetime.timedelta(7)
2706
>>> string_to_delta('5m 30s')
2707
datetime.timedelta(0, 330)
2916
2917
>>> string_to_delta("7d") == datetime.timedelta(7)
2918
True
2919
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2920
True
2921
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2922
True
2923
>>> string_to_delta("24h") == datetime.timedelta(1)
2924
True
2925
>>> string_to_delta("1w") == datetime.timedelta(7)
2926
True
2927
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2928
True
2708
2929
"""
2709
2930
2710
2931
try:
2711
2932
return rfc3339_duration_to_delta(interval)
2712
2933
except ValueError:
2713
2934
pass
2714
2935
2715
2936
timevalue = datetime.timedelta(0)
2716
2937
for s in interval.split():
2717
2938
try:
2735
2956
return timevalue
2736
2957
2737
2958
2738
def daemon(nochdir = False, noclose = False):
2959
def daemon(nochdir=False, noclose=False):
2739
2960
"""See daemon(3). Standard BSD Unix function.
2740
2961
2741
2962
This should really exist as os.daemon, but it doesn't (yet)."""
2742
2963
if os.fork():
2743
2964
sys.exit()
2761
2982
2762
2983
2763
2984
def main():
2764
2985
2765
2986
##################################################################
2766
2987
# Parsing of options, both command line and config file
2767
2988
2768
2989
parser = argparse.ArgumentParser()
2769
2990
parser.add_argument("-v", "--version", action="version",
2770
version = "%(prog)s {}".format(version),
2991
version="%(prog)s {}".format(version),
2771
2992
help="show version number and exit")
2772
2993
parser.add_argument("-i", "--interface", metavar="IF",
2773
2994
help="Bind to interface IF")
2809
3030
parser.add_argument("--no-zeroconf", action="store_false",
2810
3031
dest="zeroconf", help="Do not use Zeroconf",
2811
3032
default=None)
2812
3033
2813
3034
options = parser.parse_args()
2814
2815
if options.check:
2816
import doctest
2817
fail_count, test_count = doctest.testmod()
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2819
3035
2820
3036
# Default values for config file for server-global settings
2821
server_defaults = { "interface": "",
2822
"address": "",
2823
"port": "",
2824
"debug": "False",
2825
"priority":
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2829
"use_dbus": "True",
2830
"use_ipv6": "True",
2831
"debuglevel": "",
2832
"restore": "True",
2833
"socket": "",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2836
"zeroconf": "True",
2837
}
2838
3037
if gnutls.has_rawpk:
3038
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3039
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3040
else:
3041
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3042
":+SIGN-DSA-SHA256")
3043
server_defaults = {"interface": "",
3044
"address": "",
3045
"port": "",
3046
"debug": "False",
3047
"priority": priority,
3048
"servicename": "Mandos",
3049
"use_dbus": "True",
3050
"use_ipv6": "True",
3051
"debuglevel": "",
3052
"restore": "True",
3053
"socket": "",
3054
"statedir": "/var/lib/mandos",
3055
"foreground": "False",
3056
"zeroconf": "True",
3057
}
3058
del priority
3059
2839
3060
# Parse config file for server-global settings
2840
server_config = configparser.SafeConfigParser(server_defaults)
3061
server_config = configparser.ConfigParser(server_defaults)
2841
3062
del server_defaults
2842
3063
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2843
# Convert the SafeConfigParser object to a dict
3064
# Convert the ConfigParser object to a dict
2844
3065
server_settings = server_config.defaults()
2845
3066
# Use the appropriate methods on the non-string config options
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3067
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3068
"foreground", "zeroconf"):
2847
3069
server_settings[option] = server_config.getboolean("DEFAULT",
2848
3070
option)
2849
3071
if server_settings["port"]:
2859
3081
server_settings["socket"] = os.dup(server_settings
2860
3082
["socket"])
2861
3083
del server_config
2862
3084
2863
3085
# Override the settings from the config file with command line
2864
3086
# options, if set.
2865
3087
for option in ("interface", "address", "port", "debug",
2883
3105
if server_settings["debug"]:
2884
3106
server_settings["foreground"] = True
2885
3107
# Now we have our good server settings in "server_settings"
2886
3108
2887
3109
##################################################################
2888
3110
2889
3111
if (not server_settings["zeroconf"]
2890
3112
and not (server_settings["port"]
2891
3113
or server_settings["socket"] != "")):
2892
3114
parser.error("Needs port or socket to work without Zeroconf")
2893
3115
2894
3116
# For convenience
2895
3117
debug = server_settings["debug"]
2896
3118
debuglevel = server_settings["debuglevel"]
2900
3122
stored_state_file)
2901
3123
foreground = server_settings["foreground"]
2902
3124
zeroconf = server_settings["zeroconf"]
2903
3125
2904
3126
if debug:
2905
3127
initlogger(debug, logging.DEBUG)
2906
3128
else:
2909
3131
else:
2910
3132
level = getattr(logging, debuglevel.upper())
2911
3133
initlogger(debug, level)
2912
3134
2913
3135
if server_settings["servicename"] != "Mandos":
2914
3136
syslogger.setFormatter(
2915
logging.Formatter('Mandos ({}) [%(process)d]:'
2916
' %(levelname)s: %(message)s'.format(
3137
logging.Formatter("Mandos ({}) [%(process)d]:"
3138
" %(levelname)s: %(message)s".format(
2917
3139
server_settings["servicename"])))
2918
3140
2919
3141
# Parse config file with clients
2920
client_config = configparser.SafeConfigParser(Client
2921
.client_defaults)
3142
client_config = configparser.ConfigParser(Client.client_defaults)
2922
3143
client_config.read(os.path.join(server_settings["configdir"],
2923
3144
"clients.conf"))
2924
3145
2925
3146
global mandos_dbus_service
2926
3147
mandos_dbus_service = None
2927
3148
2928
3149
socketfd = None
2929
3150
if server_settings["socket"] != "":
2930
3151
socketfd = server_settings["socket"]
2946
3167
except IOError as e:
2947
3168
logger.error("Could not open file %r", pidfilename,
2948
3169
exc_info=e)
2949
3170
2950
3171
for name, group in (("_mandos", "_mandos"),
2951
3172
("mandos", "mandos"),
2952
3173
("nobody", "nogroup")):
2970
3191
.format(uid, gid, os.strerror(error.errno)))
2971
3192
if error.errno != errno.EPERM:
2972
3193
raise
2973
3194
2974
3195
if debug:
2975
3196
# Enable all possible GnuTLS debugging
2976
3197
2977
3198
# "Use a log level over 10 to enable all debugging options."
2978
3199
# - GnuTLS manual
2979
3200
gnutls.global_set_log_level(11)
2980
3201
2981
3202
@gnutls.log_func
2982
3203
def debug_gnutls(level, string):
2983
logger.debug("GnuTLS: %s", string[:-1])
2984
3204
logger.debug("GnuTLS: %s",
3205
string[:-1].decode("utf-8",
3206
errors="replace"))
3207
2985
3208
gnutls.global_set_log_function(debug_gnutls)
2986
3209
2987
3210
# Redirect stdin so all checkers get /dev/null
2988
3211
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2989
3212
os.dup2(null, sys.stdin.fileno())
2990
3213
if null > 2:
2991
3214
os.close(null)
2992
3215
2993
3216
# Need to fork before connecting to D-Bus
2994
3217
if not foreground:
2995
3218
# Close all input and output, do double fork, etc.
2996
3219
daemon()
2997
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
3001
3220
3221
if gi.version_info < (3, 10, 2):
3222
# multiprocessing will use threads, so before we use GLib we
3223
# need to inform GLib that threads will be used.
3224
GLib.threads_init()
3225
3002
3226
global main_loop
3003
3227
# From the Avahi example code
3004
3228
DBusGMainLoop(set_as_default=True)
3005
main_loop = GObject.MainLoop()
3229
main_loop = GLib.MainLoop()
3006
3230
bus = dbus.SystemBus()
3007
3231
# End of Avahi example code
3008
3232
if use_dbus:
3021
3245
if zeroconf:
3022
3246
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3023
3247
service = AvahiServiceToSyslog(
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3027
bus = bus)
3248
name=server_settings["servicename"],
3249
servicetype="_mandos._tcp",
3250
protocol=protocol,
3251
bus=bus)
3028
3252
if server_settings["interface"]:
3029
3253
service.interface = if_nametoindex(
3030
3254
server_settings["interface"].encode("utf-8"))
3031
3255
3032
3256
global multiprocessing_manager
3033
3257
multiprocessing_manager = multiprocessing.Manager()
3034
3258
3035
3259
client_class = Client
3036
3260
if use_dbus:
3037
client_class = functools.partial(ClientDBus, bus = bus)
3038
3261
client_class = functools.partial(ClientDBus, bus=bus)
3262
3039
3263
client_settings = Client.config_parser(client_config)
3040
3264
old_client_settings = {}
3041
3265
clients_data = {}
3042
3266
3043
3267
# This is used to redirect stdout and stderr for checker processes
3044
3268
global wnull
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3269
wnull = open(os.devnull, "w") # A writable /dev/null
3046
3270
# Only used if server is running in foreground but not in debug
3047
3271
# mode
3048
3272
if debug or not foreground:
3049
3273
wnull.close()
3050
3274
3051
3275
# Get client data and settings from last running state.
3052
3276
if server_settings["restore"]:
3053
3277
try:
3054
3278
with open(stored_state_path, "rb") as stored_state:
3055
if sys.version_info.major == 2:
3279
if sys.version_info.major == 2:
3056
3280
clients_data, old_client_settings = pickle.load(
3057
3281
stored_state)
3058
3282
else:
3059
3283
bytes_clients_data, bytes_old_client_settings = (
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3062
## clients_data
3284
pickle.load(stored_state, encoding="bytes"))
3285
# Fix bytes to strings
3286
# clients_data
3063
3287
# .keys()
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3066
else key): value
3067
for key, value in
3068
bytes_clients_data.items() }
3288
clients_data = {(key.decode("utf-8")
3289
if isinstance(key, bytes)
3290
else key): value
3291
for key, value in
3292
bytes_clients_data.items()}
3293
del bytes_clients_data
3069
3294
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3295
value = {(k.decode("utf-8")
3296
if isinstance(k, bytes) else k): v
3297
for k, v in
3298
clients_data[key].items()}
3074
3299
clients_data[key] = value
3075
3300
# .client_structure
3076
3301
value["client_structure"] = [
3077
3302
(s.decode("utf-8")
3078
3303
if isinstance(s, bytes)
3079
3304
else s) for s in
3080
value["client_structure"] ]
3081
# .name & .host
3082
for k in ("name", "host"):
3305
value["client_structure"]]
3306
# .name, .host, and .checker_command
3307
for k in ("name", "host", "checker_command"):
3083
3308
if isinstance(value[k], bytes):
3084
3309
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys
3310
if "key_id" not in value:
3311
value["key_id"] = ""
3312
elif "fingerprint" not in value:
3313
value["fingerprint"] = ""
3314
# old_client_settings
3315
# .keys()
3087
3316
old_client_settings = {
3088
3317
(key.decode("utf-8")
3089
3318
if isinstance(key, bytes)
3090
3319
else key): value
3091
3320
for key, value in
3092
bytes_old_client_settings.items() }
3093
# .host
3321
bytes_old_client_settings.items()}
3322
del bytes_old_client_settings
3323
# .host and .checker_command
3094
3324
for value in old_client_settings.values():
3095
value["host"] = value["host"].decode("utf-8")
3325
for attribute in ("host", "checker_command"):
3326
if isinstance(value[attribute], bytes):
3327
value[attribute] = (value[attribute]
3328
.decode("utf-8"))
3096
3329
os.remove(stored_state_path)
3097
3330
except IOError as e:
3098
3331
if e.errno == errno.ENOENT:
3106
3339
logger.warning("Could not load persistent state: "
3107
3340
"EOFError:",
3108
3341
exc_info=e)
3109
3342
3110
3343
with PGPEngine() as pgp:
3111
3344
for client_name, client in clients_data.items():
3112
3345
# Skip removed clients
3113
3346
if client_name not in client_settings:
3114
3347
continue
3115
3348
3116
3349
# Decide which value to use after restoring saved state.
3117
3350
# We have three different values: Old config file,
3118
3351
# new config file, and saved state.
3129
3362
client[name] = value
3130
3363
except KeyError:
3131
3364
pass
3132
3365
3133
3366
# Clients who has passed its expire date can still be
3134
3367
# enabled if its last checker was successful. A Client
3135
3368
# whose checker succeeded before we stored its state is
3168
3401
client_name))
3169
3402
client["secret"] = (client_settings[client_name]
3170
3403
["secret"])
3171
3404
3172
3405
# Add/remove clients based on new changes made to config
3173
3406
for client_name in (set(old_client_settings)
3174
3407
- set(client_settings)):
3176
3409
for client_name in (set(client_settings)
3177
3410
- set(old_client_settings)):
3178
3411
clients_data[client_name] = client_settings[client_name]
3179
3412
3180
3413
# Create all client objects
3181
3414
for client_name, client in clients_data.items():
3182
3415
tcp_server.clients[client_name] = client_class(
3183
name = client_name,
3184
settings = client,
3185
server_settings = server_settings)
3186
3416
name=client_name,
3417
settings=client,
3418
server_settings=server_settings)
3419
3187
3420
if not tcp_server.clients:
3188
3421
logger.warning("No clients defined")
3189
3422
3190
3423
if not foreground:
3191
3424
if pidfile is not None:
3192
3425
pid = os.getpid()
3198
3431
pidfilename, pid)
3199
3432
del pidfile
3200
3433
del pidfilename
3201
3202
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3203
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3204
3434
3435
for termsig in (signal.SIGHUP, signal.SIGTERM):
3436
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3437
lambda: main_loop.quit() and False)
3438
3205
3439
if use_dbus:
3206
3440
3207
3441
@alternate_dbus_interfaces(
3208
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3442
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3209
3443
class MandosDBusService(DBusObjectWithObjectManager):
3210
3444
"""A D-Bus proxy object"""
3211
3445
3212
3446
def __init__(self):
3213
3447
dbus.service.Object.__init__(self, bus, "/")
3214
3448
3215
3449
_interface = "se.recompile.Mandos"
3216
3450
3217
3451
@dbus.service.signal(_interface, signature="o")
3218
3452
def ClientAdded(self, objpath):
3219
3453
"D-Bus signal"
3220
3454
pass
3221
3455
3222
3456
@dbus.service.signal(_interface, signature="ss")
3223
def ClientNotFound(self, fingerprint, address):
3457
def ClientNotFound(self, key_id, address):
3224
3458
"D-Bus signal"
3225
3459
pass
3226
3460
3227
3461
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3228
3462
"true"})
3229
3463
@dbus.service.signal(_interface, signature="os")
3230
3464
def ClientRemoved(self, objpath, name):
3231
3465
"D-Bus signal"
3232
3466
pass
3233
3467
3234
3468
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3235
3469
"true"})
3236
3470
@dbus.service.method(_interface, out_signature="ao")
3238
3472
"D-Bus method"
3239
3473
return dbus.Array(c.dbus_object_path for c in
3240
3474
tcp_server.clients.values())
3241
3475
3242
3476
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3243
3477
"true"})
3244
3478
@dbus.service.method(_interface,
3246
3480
def GetAllClientsWithProperties(self):
3247
3481
"D-Bus method"
3248
3482
return dbus.Dictionary(
3249
{ c.dbus_object_path: c.GetAll(
3483
{c.dbus_object_path: c.GetAll(
3250
3484
"se.recompile.Mandos.Client")
3251
for c in tcp_server.clients.values() },
3485
for c in tcp_server.clients.values()},
3252
3486
signature="oa{sv}")
3253
3487
3254
3488
@dbus.service.method(_interface, in_signature="o")
3255
3489
def RemoveClient(self, object_path):
3256
3490
"D-Bus method"
3264
3498
self.client_removed_signal(c)
3265
3499
return
3266
3500
raise KeyError(object_path)
3267
3501
3268
3502
del _interface
3269
3503
3270
3504
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3271
out_signature = "a{oa{sa{sv}}}")
3505
out_signature="a{oa{sa{sv}}}")
3272
3506
def GetManagedObjects(self):
3273
3507
"""D-Bus method"""
3274
3508
return dbus.Dictionary(
3275
{ client.dbus_object_path:
3276
dbus.Dictionary(
3277
{ interface: client.GetAll(interface)
3278
for interface in
3279
client._get_all_interface_names()})
3280
for client in tcp_server.clients.values()})
3281
3509
{client.dbus_object_path:
3510
dbus.Dictionary(
3511
{interface: client.GetAll(interface)
3512
for interface in
3513
client._get_all_interface_names()})
3514
for client in tcp_server.clients.values()})
3515
3282
3516
def client_added_signal(self, client):
3283
3517
"""Send the new standard signal and the old signal"""
3284
3518
if use_dbus:
3286
3520
self.InterfacesAdded(
3287
3521
client.dbus_object_path,
3288
3522
dbus.Dictionary(
3289
{ interface: client.GetAll(interface)
3290
for interface in
3291
client._get_all_interface_names()}))
3523
{interface: client.GetAll(interface)
3524
for interface in
3525
client._get_all_interface_names()}))
3292
3526
# Old signal
3293
3527
self.ClientAdded(client.dbus_object_path)
3294
3528
3295
3529
def client_removed_signal(self, client):
3296
3530
"""Send the new standard signal and the old signal"""
3297
3531
if use_dbus:
3302
3536
# Old signal
3303
3537
self.ClientRemoved(client.dbus_object_path,
3304
3538
client.name)
3305
3539
3306
3540
mandos_dbus_service = MandosDBusService()
3307
3541
3542
# Save modules to variables to exempt the modules from being
3543
# unloaded before the function registered with atexit() is run.
3544
mp = multiprocessing
3545
wn = wnull
3546
3308
3547
def cleanup():
3309
3548
"Cleanup function; run on exit"
3310
3549
if zeroconf:
3311
3550
service.cleanup()
3312
3313
multiprocessing.active_children()
3314
wnull.close()
3551
3552
mp.active_children()
3553
wn.close()
3315
3554
if not (tcp_server.clients or client_settings):
3316
3555
return
3317
3556
3318
3557
# Store client before exiting. Secrets are encrypted with key
3319
3558
# based on what config file has. If config file is
3320
3559
# removed/edited, old secret will thus be unrecovable.
3325
3564
client.encrypted_secret = pgp.encrypt(client.secret,
3326
3565
key)
3327
3566
client_dict = {}
3328
3567
3329
3568
# A list of attributes that can not be pickled
3330
3569
# + secret.
3331
exclude = { "bus", "changedstate", "secret",
3332
"checker", "server_settings" }
3570
exclude = {"bus", "changedstate", "secret",
3571
"checker", "server_settings"}
3333
3572
for name, typ in inspect.getmembers(dbus.service
3334
3573
.Object):
3335
3574
exclude.add(name)
3336
3575
3337
3576
client_dict["encrypted_secret"] = (client
3338
3577
.encrypted_secret)
3339
3578
for attr in client.client_structure:
3340
3579
if attr not in exclude:
3341
3580
client_dict[attr] = getattr(client, attr)
3342
3581
3343
3582
clients[client.name] = client_dict
3344
3583
del client_settings[client.name]["secret"]
3345
3584
3346
3585
try:
3347
3586
with tempfile.NamedTemporaryFile(
3348
mode='wb',
3587
mode="wb",
3349
3588
suffix=".pickle",
3350
prefix='clients-',
3589
prefix="clients-",
3351
3590
dir=os.path.dirname(stored_state_path),
3352
3591
delete=False) as stored_state:
3353
3592
pickle.dump((clients, client_settings), stored_state,
3354
protocol = 2)
3593
protocol=2)
3355
3594
tempname = stored_state.name
3356
3595
os.rename(tempname, stored_state_path)
3357
3596
except (IOError, OSError) as e:
3367
3606
logger.warning("Could not save persistent state:",
3368
3607
exc_info=e)
3369
3608
raise
3370
3609
3371
3610
# Delete all clients, and settings from config
3372
3611
while tcp_server.clients:
3373
3612
name, client = tcp_server.clients.popitem()
3379
3618
if use_dbus:
3380
3619
mandos_dbus_service.client_removed_signal(client)
3381
3620
client_settings.clear()
3382
3621
3383
3622
atexit.register(cleanup)
3384
3623
3385
3624
for client in tcp_server.clients.values():
3386
3625
if use_dbus:
3387
3626
# Emit D-Bus signal for adding
3389
3628
# Need to initiate checking of clients
3390
3629
if client.enabled:
3391
3630
client.init_checker()
3392
3631
3393
3632
tcp_server.enable()
3394
3633
tcp_server.server_activate()
3395
3634
3396
3635
# Find out what port we got
3397
3636
if zeroconf:
3398
3637
service.port = tcp_server.socket.getsockname()[1]
3403
3642
else: # IPv4
3404
3643
logger.info("Now listening on address %r, port %d",
3405
3644
*tcp_server.socket.getsockname())
3406
3407
#service.interface = tcp_server.socket.getsockname()[3]
3408
3645
3646
# service.interface = tcp_server.socket.getsockname()[3]
3647
3409
3648
try:
3410
3649
if zeroconf:
3411
3650
# From the Avahi example code
3416
3655
cleanup()
3417
3656
sys.exit(1)
3418
3657
# End of Avahi example code
3419
3420
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3421
lambda *args, **kwargs:
3422
(tcp_server.handle_request
3423
(*args[2:], **kwargs) or True))
3424
3658
3659
GLib.io_add_watch(
3660
GLib.IOChannel.unix_new(tcp_server.fileno()),
3661
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3662
lambda *args, **kwargs: (tcp_server.handle_request
3663
(*args[2:], **kwargs) or True))
3664
3425
3665
logger.debug("Starting main loop")
3426
3666
main_loop.run()
3427
3667
except AvahiError as error:
3436
3676
# Must run before the D-Bus bus name gets deregistered
3437
3677
cleanup()
3438
3678
3439
3440
if __name__ == '__main__':
3441
main()
3679
3680
def should_only_run_tests():
3681
parser = argparse.ArgumentParser(add_help=False)
3682
parser.add_argument("--check", action="store_true")
3683
args, unknown_args = parser.parse_known_args()
3684
run_tests = args.check
3685
if run_tests:
3686
# Remove --check argument from sys.argv
3687
sys.argv[1:] = unknown_args
3688
return run_tests
3689
3690
# Add all tests from doctest strings
3691
def load_tests(loader, tests, none):
3692
import doctest
3693
tests.addTests(doctest.DocTestSuite())
3694
return tests
3695
3696
if __name__ == "__main__":
3697
try:
3698
if should_only_run_tests():
3699
# Call using ./mandos --check [--verbose]
3700
unittest.main()
3701
else:
3702
main()
3703
finally:
3704
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0