To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1274
- compare with another revision
- download diff
- download tarball
- view history from revision 1274
- Committer: Teddy Hogeborn
- Date: 2023-02-11 06:58:15 UTC
- Revision ID: teddy@recompile.se-20230211065815-jtffi61tbdrgr875
Suppress warnings
Suppress warnings about mlock()ing uninitialized memory and reading an
ievent struct.
* dracut-module/password-agent.c (send_password_to_socket): Suppress
"-Wmaybe-uninitialized" when mlock()ing password send buffer.
(test_read_inotify_event_IN_DELETE_badname): When reading from
a struct ievent, suppress "-Wstringop-overread".
Suppress warnings about mlock()ing uninitialized memory and reading an
ievent struct.
* dracut-module/password-agent.c (send_password_to_socket): Suppress
"-Wmaybe-uninitialized" when mlock()ing password send buffer.
(test_read_inotify_event_IN_DELETE_badname): When reading from
a struct ievent, suppress "-Wstringop-overread".
- files added:
- bugs.xml
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
33
#
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
38
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
39
47
try:
40
48
import SocketServer as socketserver
41
49
except ImportError:
42
50
import socketserver
43
51
import socket
44
import argparse
45
52
import datetime
46
53
import errno
47
54
try:
48
55
import ConfigParser as configparser
49
56
except ImportError:
50
57
import configparser
51
import sys
52
58
import re
53
import os
54
59
import signal
55
60
import subprocess
56
61
import atexit
57
62
import stat
58
import logging
59
63
import logging.handlers
60
64
import pwd
61
65
import contextlib
73
77
import itertools
74
78
import collections
75
79
import codecs
80
import random
81
import shlex
76
82
77
83
import dbus
78
84
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
85
import gi
86
from gi.repository import GLib
84
87
from dbus.mainloop.glib import DBusGMainLoop
85
88
import ctypes
86
89
import ctypes.util
87
90
import xml.dom.minidom
88
91
import inspect
89
92
90
try:
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
91
122
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
123
except AttributeError:
93
124
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
94
127
from IN import SO_BINDTODEVICE
95
128
except ImportError:
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.16"
102
147
stored_state_file = "clients.pickle"
103
148
104
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
105
151
syslogger = None
106
152
107
153
try:
108
154
if_nametoindex = ctypes.cdll.LoadLibrary(
109
155
ctypes.util.find_library("c")).if_nametoindex
110
156
except (OSError, AttributeError):
111
157
112
158
def if_nametoindex(interface):
113
159
"Get an interface index the hard way, i.e. using fcntl()"
114
160
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
165
return interface_index
120
166
121
167
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
122
184
def initlogger(debug, level=logging.WARNING):
123
185
"""init logger and add loglevel"""
124
186
125
187
global syslogger
126
188
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
129
191
syslogger.setFormatter(logging.Formatter
130
('Mandos [%(process)d]: %(levelname)s:'
131
' %(message)s'))
132
logger.addHandler(syslogger)
133
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
195
134
196
if debug:
135
197
console = logging.StreamHandler()
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
137
' [%(process)d]:'
138
' %(levelname)s:'
139
' %(message)s'))
140
logger.addHandler(console)
141
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
142
204
143
205
144
206
class PGPError(Exception):
146
208
pass
147
209
148
210
149
class PGPEngine(object):
211
class PGPEngine:
150
212
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
213
152
214
def __init__(self):
153
215
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
156
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
216
self.gpg = "gpg"
217
try:
218
output = subprocess.check_output(["gpgconf"])
219
for line in output.splitlines():
220
name, text, path = line.split(b":")
221
if name == b"gpg":
222
self.gpg = path
223
break
224
except OSError as e:
225
if e.errno != errno.ENOENT:
226
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
160
235
def __enter__(self):
161
236
return self
162
237
163
238
def __exit__(self, exc_type, exc_value, traceback):
164
239
self._cleanup()
165
240
return False
166
241
167
242
def __del__(self):
168
243
self._cleanup()
169
244
170
245
def _cleanup(self):
171
246
if self.tempdir is not None:
172
247
# Delete contents of tempdir
173
248
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
249
topdown=False):
175
250
for filename in files:
176
251
os.remove(os.path.join(root, filename))
177
252
for dirname in dirs:
179
254
# Remove tempdir
180
255
os.rmdir(self.tempdir)
181
256
self.tempdir = None
182
257
183
258
def password_encode(self, password):
184
259
# Passphrase can not be empty and can not contain newlines or
185
260
# NUL bytes. So we prefix it and hex encode it.
190
265
.replace(b"\n", b"\\n")
191
266
.replace(b"\0", b"\\x00"))
192
267
return encoded
193
268
194
269
def encrypt(self, data, password):
195
270
passphrase = self.password_encode(password)
196
271
with tempfile.NamedTemporaryFile(
197
272
dir=self.tempdir) as passfile:
198
273
passfile.write(passphrase)
199
274
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
201
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
202
277
passfile.name]
203
278
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
208
283
if proc.returncode != 0:
209
284
raise PGPError(err)
210
285
return ciphertext
211
286
212
287
def decrypt(self, data, password):
213
288
passphrase = self.password_encode(password)
214
289
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
290
dir=self.tempdir) as passfile:
216
291
passfile.write(passphrase)
217
292
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
219
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
220
295
passfile.name]
221
296
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
226
301
if proc.returncode != 0:
227
302
raise PGPError(err)
228
303
return decrypted_plaintext
229
304
230
305
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
231
332
class AvahiError(Exception):
232
333
def __init__(self, value, *args, **kwargs):
233
334
self.value = value
243
344
pass
244
345
245
346
246
class AvahiService(object):
347
class AvahiService:
247
348
"""An Avahi (Zeroconf) service.
248
349
249
350
Attributes:
250
351
interface: integer; avahi.IF_UNSPEC or an interface index.
251
352
Used to optionally bind to the specified interface.
252
name: string; Example: 'Mandos'
253
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
254
355
See <https://www.iana.org/assignments/service-names-port-numbers>
255
356
port: integer; what port to announce
256
357
TXT: list of strings; TXT record for the service
263
364
server: D-Bus Server
264
365
bus: dbus.SystemBus()
265
366
"""
266
367
267
368
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
278
379
self.interface = interface
279
380
self.name = name
280
381
self.type = servicetype
289
390
self.server = None
290
391
self.bus = bus
291
392
self.entry_group_state_changed_match = None
292
393
293
394
def rename(self, remove=True):
294
395
"""Derived from the Avahi example code"""
295
396
if self.rename_count >= self.max_renames:
296
logger.critical("No suitable Zeroconf service name found"
297
" after %i retries, exiting.",
298
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
299
400
raise AvahiServiceError("Too many renames")
300
401
self.name = str(
301
402
self.server.GetAlternativeServiceName(self.name))
302
403
self.rename_count += 1
303
logger.info("Changing Zeroconf service name to %r ...",
304
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
305
406
if remove:
306
407
self.remove()
307
408
try:
309
410
except dbus.exceptions.DBusException as error:
310
411
if (error.get_dbus_name()
311
412
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
313
414
return self.rename(remove=False)
314
415
else:
315
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
316
417
self.cleanup()
317
418
os._exit(1)
318
419
319
420
def remove(self):
320
421
"""Derived from the Avahi example code"""
321
422
if self.entry_group_state_changed_match is not None:
323
424
self.entry_group_state_changed_match = None
324
425
if self.group is not None:
325
426
self.group.Reset()
326
427
327
428
def add(self):
328
429
"""Derived from the Avahi example code"""
329
430
self.remove()
334
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
335
436
self.entry_group_state_changed_match = (
336
437
self.group.connect_to_signal(
337
'StateChanged', self.entry_group_state_changed))
338
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
339
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
340
441
self.group.AddService(
341
442
self.interface,
342
443
self.protocol,
346
447
dbus.UInt16(self.port),
347
448
avahi.string_array_to_txt_array(self.TXT))
348
449
self.group.Commit()
349
450
350
451
def entry_group_state_changed(self, state, error):
351
452
"""Derived from the Avahi example code"""
352
logger.debug("Avahi entry group state change: %i", state)
353
453
log.debug("Avahi entry group state change: %i", state)
454
354
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
356
457
elif state == avahi.ENTRY_GROUP_COLLISION:
357
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
358
459
self.rename()
359
460
elif state == avahi.ENTRY_GROUP_FAILURE:
360
logger.critical("Avahi: Error in group state changed %s",
361
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
362
463
raise AvahiGroupError("State changed: {!s}".format(error))
363
464
364
465
def cleanup(self):
365
466
"""Derived from the Avahi example code"""
366
467
if self.group is not None:
371
472
pass
372
473
self.group = None
373
474
self.remove()
374
475
375
476
def server_state_changed(self, state, error=None):
376
477
"""Derived from the Avahi example code"""
377
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
378
479
bad_states = {
379
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
481
avahi.SERVER_REGISTERING: None,
384
485
if state in bad_states:
385
486
if bad_states[state] is not None:
386
487
if error is None:
387
logger.error(bad_states[state])
488
log.error(bad_states[state])
388
489
else:
389
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
390
491
self.cleanup()
391
492
elif state == avahi.SERVER_RUNNING:
392
493
try:
394
495
except dbus.exceptions.DBusException as error:
395
496
if (error.get_dbus_name()
396
497
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
398
" collision.")
498
log.info("Local Zeroconf service name collision.")
399
499
return self.rename(remove=False)
400
500
else:
401
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
402
502
self.cleanup()
403
503
os._exit(1)
404
504
else:
405
505
if error is None:
406
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
407
507
else:
408
logger.debug("Unknown state: %r: %r", state, error)
409
508
log.debug("Unknown state: %r: %r", state, error)
509
410
510
def activate(self):
411
511
"""Derived from the Avahi example code"""
412
512
if self.server is None:
423
523
class AvahiServiceToSyslog(AvahiService):
424
524
def rename(self, *args, **kwargs):
425
525
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
427
528
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
429
530
.format(self.name)))
430
531
return ret
431
532
533
432
534
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
537
538
library = ctypes.util.find_library("gnutls")
539
if library is None:
540
library = ctypes.util.find_library("gnutls-deb0")
541
_library = ctypes.cdll.LoadLibrary(library)
542
del library
543
448
544
# Unless otherwise indicated, the constants and types below are
449
545
# all from the gnutls/gnutls.h C header file.
450
546
451
547
# Constants
452
548
E_SUCCESS = 0
453
549
E_INTERRUPTED = -52
454
550
E_AGAIN = -28
455
551
CRT_OPENPGP = 2
552
CRT_RAWPK = 3
456
553
CLIENT = 2
457
554
SHUT_RDWR = 0
458
555
CRD_CERTIFICATE = 1
459
556
E_NO_CERTIFICATE_FOUND = -49
557
X509_FMT_DER = 0
558
NO_TICKETS = 1<<10
559
ENABLE_RAWPK = 1<<18
560
CTYPE_PEERS = 3
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
460
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
563
462
564
# Types
463
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
464
566
_fields_ = []
465
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
568
466
569
class certificate_credentials_st(ctypes.Structure):
467
570
_fields_ = []
468
571
certificate_credentials_t = ctypes.POINTER(
469
572
certificate_credentials_st)
470
573
certificate_type_t = ctypes.c_int
574
471
575
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
578
579
class _openpgp_crt_int(ctypes.Structure):
475
580
_fields_ = []
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
584
credentials_type_t = ctypes.c_int
480
585
transport_ptr_t = ctypes.c_void_p
481
586
close_request_t = ctypes.c_int
482
587
483
588
# Exceptions
484
589
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
590
def __init__(self, message=None, code=None, args=()):
490
591
# Default usage is by a message string, but if a return
491
592
# code is passed, convert it to a string with
492
593
# gnutls.strerror()
493
594
self.code = code
494
595
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
497
599
message, *args)
498
600
499
601
class CertificateSecurityError(Error):
500
602
pass
501
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
502
629
# Classes
503
class Credentials(object):
630
class Credentials(With_from_param):
504
631
def __init__(self):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
508
634
self.type = gnutls.CRD_CERTIFICATE
509
635
510
636
def __del__(self):
511
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
520
True)
637
gnutls.certificate_free_credentials(self)
638
639
class ClientSession(With_from_param):
640
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
645
if gnutls.has_rawpk:
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
648
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
521
652
self.socket = socket
522
653
if credentials is None:
523
654
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
526
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
527
657
self.credentials = credentials
528
658
529
659
def __del__(self):
530
gnutls.deinit(self._c_object)
531
660
gnutls.deinit(self)
661
532
662
def handshake(self):
533
return gnutls.handshake(self._c_object)
534
663
return gnutls.handshake(self)
664
535
665
def send(self, data):
536
666
data = bytes(data)
537
667
data_len = len(data)
538
668
while data_len > 0:
539
data_len -= gnutls.record_send(self._c_object,
540
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
541
670
data_len)
542
671
543
672
def bye(self):
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
674
546
675
# Error handling functions
547
676
def _error_code(result):
548
677
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
550
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
551
680
return result
552
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
556
def _retry_on_error(result, func, arguments):
682
raise gnutls.CertificateSecurityError(code=result)
683
raise gnutls.Error(code=result)
684
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
557
687
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
559
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
560
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
691
return _error_code(result)
562
692
result = func(*arguments)
563
693
return result
564
694
565
695
# Unless otherwise indicated, the function declarations below are
566
696
# all from the gnutls/gnutls.h C header file.
567
697
568
698
# Functions
569
699
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
571
701
ctypes.POINTER(ctypes.c_char_p)]
572
702
priority_set_direct.restype = _error_code
573
703
574
704
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
576
706
init.restype = _error_code
577
707
578
708
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
580
710
set_default_priority.restype = _error_code
581
711
582
712
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
584
714
ctypes.c_size_t]
585
715
record_send.restype = ctypes.c_ssize_t
586
716
record_send.errcheck = _retry_on_error
587
717
588
718
certificate_allocate_credentials = (
589
719
_library.gnutls_certificate_allocate_credentials)
590
720
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
592
722
certificate_allocate_credentials.restype = _error_code
593
723
594
724
certificate_free_credentials = (
595
725
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
597
727
certificate_free_credentials.restype = None
598
728
599
729
handshake_set_private_extensions = (
600
730
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
602
732
ctypes.c_int]
603
733
handshake_set_private_extensions.restype = None
604
734
605
735
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
607
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
608
738
credentials_set.restype = _error_code
609
739
610
740
strerror = _library.gnutls_strerror
611
741
strerror.argtypes = [ctypes.c_int]
612
742
strerror.restype = ctypes.c_char_p
613
743
614
744
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
616
746
certificate_type_get.restype = _error_code
617
747
618
748
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
620
750
ctypes.POINTER(ctypes.c_uint)]
621
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
752
623
753
global_set_log_level = _library.gnutls_global_set_log_level
624
754
global_set_log_level.argtypes = [ctypes.c_int]
625
755
global_set_log_level.restype = None
626
756
627
757
global_set_log_function = _library.gnutls_global_set_log_function
628
758
global_set_log_function.argtypes = [log_func]
629
759
global_set_log_function.restype = None
630
760
631
761
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
633
763
deinit.restype = None
634
764
635
765
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
638
768
handshake.errcheck = _retry_on_error
639
769
640
770
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
642
772
transport_set_ptr.restype = None
643
773
644
774
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
647
777
bye.errcheck = _retry_on_error
648
778
649
779
check_version = _library.gnutls_check_version
650
780
check_version.argtypes = [ctypes.c_char_p]
651
781
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
782
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
787
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
790
791
if has_rawpk:
792
# Types
793
class pubkey_st(ctypes.Structure):
794
_fields = []
795
pubkey_t = ctypes.POINTER(pubkey_st)
796
797
x509_crt_fmt_t = ctypes.c_int
798
799
# All the function declarations below are from
800
# gnutls/abstract.h
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
804
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
807
x509_crt_fmt_t]
808
pubkey_import.restype = _error_code
809
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
815
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
819
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
822
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
826
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
830
openpgp_crt_fmt_t]
831
openpgp_crt_import.restype = _error_code
832
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
840
openpgp_crt_verify_self.restype = _error_code
841
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
845
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
849
ctypes.c_void_p,
850
ctypes.POINTER(
851
ctypes.c_size_t)]
852
openpgp_crt_get_fingerprint.restype = _error_code
853
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
858
682
859
# Remove non-public functions
683
860
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
861
686
862
687
863
def call_pipe(connection, # : multiprocessing.Connection
688
864
func, *args, **kwargs):
689
865
"""This function is meant to be called by multiprocessing.Process
690
866
691
867
This function runs func(*args, **kwargs), and writes the resulting
692
868
return value on the provided multiprocessing.Connection.
693
869
"""
694
870
connection.send(func(*args, **kwargs))
695
871
connection.close()
696
872
697
class Client(object):
873
874
class Client:
698
875
"""A representation of a client host served by this server.
699
876
700
877
Attributes:
701
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
702
879
approval_delay: datetime.timedelta(); Time to wait for approval
703
880
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
884
checker_callback_tag: a GLib event source tag, or None
708
885
checker_command: string; External command which is run to check
709
886
if client lives. %() expansions are done at
710
887
runtime with vars(self) as dict, so that for
711
888
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
889
checker_initiator_tag: a GLib event source tag, or None
713
890
created: datetime.datetime(); (UTC) object creation
714
891
client_structure: Object describing what attributes a client has
715
892
and is used for storing the client at exit
716
893
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
894
disable_initiator_tag: a GLib event source tag, or None
718
895
enabled: bool()
719
896
fingerprint: string (40 or 32 hexadecimal digits); used to
720
uniquely identify the client
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
721
900
host: string; available for use by the checker command
722
901
interval: datetime.timedelta(); How often to start a new checker
723
902
last_approval_request: datetime.datetime(); (UTC) or None
739
918
disabled, or None
740
919
server_settings: The server_settings dict from main()
741
920
"""
742
921
743
922
runtime_expansions = ("approval_delay", "approval_duration",
744
"created", "enabled", "expires",
923
"created", "enabled", "expires", "key_id",
745
924
"fingerprint", "host", "interval",
746
925
"last_approval_request", "last_checked_ok",
747
926
"last_enabled", "name", "timeout")
756
935
"approved_by_default": "True",
757
936
"enabled": "True",
758
937
}
759
938
760
939
@staticmethod
761
940
def config_parser(config):
762
941
"""Construct a new dict of client settings of this form:
769
948
for client_name in config.sections():
770
949
section = dict(config.items(client_name))
771
950
client = settings[client_name] = {}
772
951
773
952
client["host"] = section["host"]
774
953
# Reformat values from string types to Python types
775
954
client["approved_by_default"] = config.getboolean(
776
955
client_name, "approved_by_default")
777
956
client["enabled"] = config.getboolean(client_name,
778
957
"enabled")
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
958
959
# Uppercase and remove spaces from key_id and fingerprint
960
# for later comparison purposes with return value from the
961
# key_id() and fingerprint() functions
962
client["key_id"] = (section.get("key_id", "").upper()
963
.replace(" ", ""))
783
964
client["fingerprint"] = (section["fingerprint"].upper()
784
965
.replace(" ", ""))
785
966
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
967
client["secret"] = codecs.decode(section["secret"]
968
.encode("utf-8"),
969
"base64")
787
970
elif "secfile" in section:
788
971
with open(os.path.expanduser(os.path.expandvars
789
972
(section["secfile"])),
804
987
client["last_approval_request"] = None
805
988
client["last_checked_ok"] = None
806
989
client["last_checker_status"] = -2
807
990
808
991
return settings
809
810
def __init__(self, settings, name = None, server_settings=None):
992
993
def __init__(self, settings, name=None, server_settings=None):
811
994
self.name = name
812
995
if server_settings is None:
813
996
server_settings = {}
815
998
# adding all client settings
816
999
for setting, value in settings.items():
817
1000
setattr(self, setting, value)
818
1001
819
1002
if self.enabled:
820
1003
if not hasattr(self, "last_enabled"):
821
1004
self.last_enabled = datetime.datetime.utcnow()
825
1008
else:
826
1009
self.last_enabled = None
827
1010
self.expires = None
828
829
logger.debug("Creating client %r", self.name)
830
logger.debug(" Fingerprint: %s", self.fingerprint)
1011
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
831
1015
self.created = settings.get("created",
832
1016
datetime.datetime.utcnow())
833
1017
834
1018
# attributes specific for this server instance
835
1019
self.checker = None
836
1020
self.checker_initiator_tag = None
842
1026
self.changedstate = multiprocessing_manager.Condition(
843
1027
multiprocessing_manager.Lock())
844
1028
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
1029
for attr in self.__dict__.keys()
846
1030
if not attr.startswith("_")]
847
1031
self.client_structure.append("client_structure")
848
1032
849
1033
for name, t in inspect.getmembers(
850
1034
type(self), lambda obj: isinstance(obj, property)):
851
1035
if not name.startswith("_"):
852
1036
self.client_structure.append(name)
853
1037
854
1038
# Send notice to process children that client state has changed
855
1039
def send_changedstate(self):
856
1040
with self.changedstate:
857
1041
self.changedstate.notify_all()
858
1042
859
1043
def enable(self):
860
1044
"""Start this client's checker and timeout hooks"""
861
1045
if getattr(self, "enabled", False):
862
1046
# Already enabled
863
1047
return
864
self.expires = datetime.datetime.utcnow() + self.timeout
865
1048
self.enabled = True
866
1049
self.last_enabled = datetime.datetime.utcnow()
867
1050
self.init_checker()
868
1051
self.send_changedstate()
869
1052
870
1053
def disable(self, quiet=True):
871
1054
"""Disable this client."""
872
1055
if not getattr(self, "enabled", False):
873
1056
return False
874
1057
if not quiet:
875
logger.info("Disabling client %s", self.name)
1058
log.info("Disabling client %s", self.name)
876
1059
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
1060
GLib.source_remove(self.disable_initiator_tag)
878
1061
self.disable_initiator_tag = None
879
1062
self.expires = None
880
1063
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
1064
GLib.source_remove(self.checker_initiator_tag)
882
1065
self.checker_initiator_tag = None
883
1066
self.stop_checker()
884
1067
self.enabled = False
885
1068
if not quiet:
886
1069
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
1070
# Do not run this again if called by a GLib.timeout_add
888
1071
return False
889
1072
890
1073
def __del__(self):
891
1074
self.disable()
892
893
def init_checker(self):
894
# Schedule a new checker to be started an 'interval' from now,
895
# and every interval from then on.
1075
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
896
1081
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
900
self.start_checker)
901
# Schedule a disable() when 'timeout' has passed
1082
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
902
1100
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
906
# Also start a new checker *right now*.
907
self.start_checker()
908
1101
GLib.source_remove(self.disable_initiator_tag)
1102
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1105
909
1106
def checker_callback(self, source, condition, connection,
910
1107
command):
911
1108
"""The checker has completed, so take appropriate actions."""
912
self.checker_callback_tag = None
913
self.checker = None
914
1109
# Read return code from connection (see call_pipe)
915
1110
returncode = connection.recv()
916
1111
connection.close()
917
1112
if self.checker is not None:
1113
self.checker.join()
1114
self.checker_callback_tag = None
1115
self.checker = None
1116
918
1117
if returncode >= 0:
919
1118
self.last_checker_status = returncode
920
1119
self.last_checker_signal = None
921
1120
if self.last_checker_status == 0:
922
logger.info("Checker for %(name)s succeeded",
923
vars(self))
1121
log.info("Checker for %(name)s succeeded", vars(self))
924
1122
self.checked_ok()
925
1123
else:
926
logger.info("Checker for %(name)s failed", vars(self))
1124
log.info("Checker for %(name)s failed", vars(self))
927
1125
else:
928
1126
self.last_checker_status = -1
929
1127
self.last_checker_signal = -returncode
930
logger.warning("Checker for %(name)s crashed?",
931
vars(self))
1128
log.warning("Checker for %(name)s crashed?", vars(self))
932
1129
return False
933
1130
934
1131
def checked_ok(self):
935
1132
"""Assert that the client has been seen, alive and well."""
936
1133
self.last_checked_ok = datetime.datetime.utcnow()
937
1134
self.last_checker_status = 0
938
1135
self.last_checker_signal = None
939
1136
self.bump_timeout()
940
1137
941
1138
def bump_timeout(self, timeout=None):
942
1139
"""Bump up the timeout for this client."""
943
1140
if timeout is None:
944
1141
timeout = self.timeout
945
1142
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1143
GLib.source_remove(self.disable_initiator_tag)
947
1144
self.disable_initiator_tag = None
948
1145
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1146
self.disable_initiator_tag = GLib.timeout_add(
950
1147
int(timeout.total_seconds() * 1000), self.disable)
951
1148
self.expires = datetime.datetime.utcnow() + timeout
952
1149
953
1150
def need_approval(self):
954
1151
self.last_approval_request = datetime.datetime.utcnow()
955
956
def start_checker(self):
1152
1153
def start_checker(self, start_was_randomized=False):
957
1154
"""Start a new checker subprocess if one is not running.
958
1155
959
1156
If a checker already exists, leave it running and do
960
1157
nothing."""
961
1158
# The reason for not killing a running checker is that if we
966
1163
# checkers alone, the checker would have to take more time
967
1164
# than 'timeout' for the client to be disabled, which is as it
968
1165
# should be.
969
1166
970
1167
if self.checker is not None and not self.checker.is_alive():
971
logger.warning("Checker was not alive; joining")
1168
log.warning("Checker was not alive; joining")
972
1169
self.checker.join()
973
1170
self.checker = None
974
1171
# Start a new checker if needed
975
1172
if self.checker is None:
976
1173
# Escape attributes for the shell
977
1174
escaped_attrs = {
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
1175
attr: shlex.quote(str(getattr(self, attr)))
1176
for attr in self.runtime_expansions}
980
1177
try:
981
1178
command = self.checker_command % escaped_attrs
982
1179
except TypeError as error:
983
logger.error('Could not format string "%s"',
984
self.checker_command,
985
exc_info=error)
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
986
1182
return True # Try again later
987
1183
self.current_checker_command = command
988
logger.info("Starting checker %r for %s", command,
989
self.name)
1184
log.info("Starting checker %r for %s", command, self.name)
990
1185
# We don't need to redirect stdout and stderr, since
991
1186
# in normal mode, that is already done by daemon(),
992
1187
# and in debug mode we don't want to. (Stdin is
994
1189
# The exception is when not debugging but nevertheless
995
1190
# running in the foreground; use the previously
996
1191
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1192
popen_args = {"close_fds": True,
1193
"shell": True,
1194
"cwd": "/"}
1000
1195
if (not self.server_settings["debug"]
1001
1196
and self.server_settings["foreground"]):
1002
1197
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1198
"stderr": wnull})
1199
pipe = multiprocessing.Pipe(duplex=False)
1005
1200
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1201
target=call_pipe,
1202
args=(pipe[1], subprocess.call, command),
1203
kwargs=popen_args)
1009
1204
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1205
self.checker_callback_tag = GLib.io_add_watch(
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1012
1208
self.checker_callback, pipe[0], command)
1013
# Re-run this periodically if run by gobject.timeout_add
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
# Re-run this periodically if run by GLib.timeout_add
1014
1221
return True
1015
1222
1016
1223
def stop_checker(self):
1017
1224
"""Force the checker process, if any, to stop."""
1018
1225
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1226
GLib.source_remove(self.checker_callback_tag)
1020
1227
self.checker_callback_tag = None
1021
1228
if getattr(self, "checker", None) is None:
1022
1229
return
1023
logger.debug("Stopping checker for %(name)s", vars(self))
1230
log.debug("Stopping checker for %(name)s", vars(self))
1024
1231
self.checker.terminate()
1025
1232
self.checker = None
1026
1233
1031
1238
byte_arrays=False):
1032
1239
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
1240
become properties on the D-Bus.
1034
1241
1035
1242
The decorated method will be called with no arguments by "Get"
1036
1243
and with one argument by "Set".
1037
1244
1038
1245
The parameters, where they are supported, are the same as
1039
1246
dbus.service.method, except there is only "signature", since the
1040
1247
type from Get() and the type sent to Set() is the same.
1044
1251
if byte_arrays and signature != "ay":
1045
1252
raise ValueError("Byte arrays not supported for non-'ay'"
1046
1253
" signature {!r}".format(signature))
1047
1254
1048
1255
def decorator(func):
1049
1256
func._dbus_is_property = True
1050
1257
func._dbus_interface = dbus_interface
1053
1260
func._dbus_name = func.__name__
1054
1261
if func._dbus_name.endswith("_dbus_property"):
1055
1262
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1057
1264
return func
1058
1265
1059
1266
return decorator
1060
1267
1061
1268
1062
1269
def dbus_interface_annotations(dbus_interface):
1063
1270
"""Decorator for marking functions returning interface annotations
1064
1271
1065
1272
Usage:
1066
1273
1067
1274
@dbus_interface_annotations("org.example.Interface")
1068
1275
def _foo(self): # Function name does not matter
1069
1276
return {"org.freedesktop.DBus.Deprecated": "true",
1070
1277
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
1278
"false"}
1072
1279
"""
1073
1280
1074
1281
def decorator(func):
1075
1282
func._dbus_is_interface = True
1076
1283
func._dbus_interface = dbus_interface
1077
1284
func._dbus_name = dbus_interface
1078
1285
return func
1079
1286
1080
1287
return decorator
1081
1288
1082
1289
1083
1290
def dbus_annotations(annotations):
1084
1291
"""Decorator to annotate D-Bus methods, signals or properties
1085
1292
Usage:
1086
1293
1087
1294
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
1295
"org.freedesktop.DBus.Property."
1089
1296
"EmitsChangedSignal": "false"})
1091
1298
access="r")
1092
1299
def Property_dbus_property(self):
1093
1300
return dbus.Boolean(False)
1094
1301
1095
1302
See also the DBusObjectWithAnnotations class.
1096
1303
"""
1097
1304
1098
1305
def decorator(func):
1099
1306
func._dbus_annotations = annotations
1100
1307
return func
1101
1308
1102
1309
return decorator
1103
1310
1104
1311
1122
1329
1123
1330
class DBusObjectWithAnnotations(dbus.service.Object):
1124
1331
"""A D-Bus object with annotations.
1125
1332
1126
1333
Classes inheriting from this can use the dbus_annotations
1127
1334
decorator to add annotations to methods or signals.
1128
1335
"""
1129
1336
1130
1337
@staticmethod
1131
1338
def _is_dbus_thing(thing):
1132
1339
"""Returns a function testing if an attribute is a D-Bus thing
1133
1340
1134
1341
If called like _is_dbus_thing("method") it returns a function
1135
1342
suitable for use as predicate to inspect.getmembers().
1136
1343
"""
1137
1344
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1138
1345
False)
1139
1346
1140
1347
def _get_all_dbus_things(self, thing):
1141
1348
"""Returns a generator of (name, attribute) pairs
1142
1349
"""
1145
1352
for cls in self.__class__.__mro__
1146
1353
for name, athing in
1147
1354
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1355
1149
1356
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1357
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1153
1360
def Introspect(self, object_path, connection):
1154
1361
"""Overloading of standard D-Bus method.
1155
1362
1156
1363
Inserts annotation tags on methods and signals.
1157
1364
"""
1158
1365
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
1366
connection)
1160
1367
try:
1161
1368
document = xml.dom.minidom.parseString(xmlstring)
1162
1369
1163
1370
for if_tag in document.getElementsByTagName("interface"):
1164
1371
# Add annotation tags
1165
1372
for typ in ("method", "signal"):
1192
1399
if_tag.appendChild(ann_tag)
1193
1400
# Fix argument name for the Introspect method itself
1194
1401
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1402
== dbus.INTROSPECTABLE_IFACE):
1196
1403
for cn in if_tag.getElementsByTagName("method"):
1197
1404
if cn.getAttribute("name") == "Introspect":
1198
1405
for arg in cn.getElementsByTagName("arg"):
1204
1411
document.unlink()
1205
1412
except (AttributeError, xml.dom.DOMException,
1206
1413
xml.parsers.expat.ExpatError) as error:
1207
logger.error("Failed to override Introspection method",
1208
exc_info=error)
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1209
1416
return xmlstring
1210
1417
1211
1418
1212
1419
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
1420
"""A D-Bus object with properties.
1214
1421
1215
1422
Classes inheriting from this can use the dbus_service_property
1216
1423
decorator to expose methods as D-Bus properties. It exposes the
1217
1424
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
1425
"""
1219
1426
1220
1427
def _get_dbus_property(self, interface_name, property_name):
1221
1428
"""Returns a bound method if one exists which is a D-Bus
1222
1429
property with the specified name and interface.
1227
1434
if (value._dbus_name == property_name
1228
1435
and value._dbus_interface == interface_name):
1229
1436
return value.__get__(self)
1230
1437
1231
1438
# No such property
1232
1439
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
1440
self.dbus_object_path, interface_name, property_name))
1234
1441
1235
1442
@classmethod
1236
1443
def _get_all_interface_names(cls):
1237
1444
"""Get a sequence of all interfaces supported by an object"""
1240
1447
for x in (inspect.getmro(cls))
1241
1448
for attr in dir(x))
1242
1449
if name is not None)
1243
1450
1244
1451
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
1452
in_signature="ss",
1246
1453
out_signature="v")
1254
1461
if not hasattr(value, "variant_level"):
1255
1462
return value
1256
1463
return type(value)(value, variant_level=value.variant_level+1)
1257
1464
1258
1465
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
1466
def Set(self, interface_name, property_name, value):
1260
1467
"""Standard D-Bus property Set() method, see D-Bus standard.
1269
1476
raise ValueError("Byte arrays not supported for non-"
1270
1477
"'ay' signature {!r}"
1271
1478
.format(prop._dbus_signature))
1272
value = dbus.ByteArray(b''.join(chr(byte)
1273
for byte in value))
1479
value = dbus.ByteArray(bytes(value))
1274
1480
prop(value)
1275
1481
1276
1482
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
1483
in_signature="s",
1278
1484
out_signature="a{sv}")
1279
1485
def GetAll(self, interface_name):
1280
1486
"""Standard D-Bus property GetAll() method, see D-Bus
1281
1487
standard.
1282
1488
1283
1489
Note: Will not include properties with access="write".
1284
1490
"""
1285
1491
properties = {}
1296
1502
properties[name] = value
1297
1503
continue
1298
1504
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1505
value, variant_level=value.variant_level + 1)
1300
1506
return dbus.Dictionary(properties, signature="sv")
1301
1507
1302
1508
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
1509
def PropertiesChanged(self, interface_name, changed_properties,
1304
1510
invalidated_properties):
1306
1512
standard.
1307
1513
"""
1308
1514
pass
1309
1515
1310
1516
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
1517
out_signature="s",
1312
path_keyword='object_path',
1313
connection_keyword='connection')
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1314
1520
def Introspect(self, object_path, connection):
1315
1521
"""Overloading of standard D-Bus method.
1316
1522
1317
1523
Inserts property tags and interface annotation tags.
1318
1524
"""
1319
1525
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1321
1527
connection)
1322
1528
try:
1323
1529
document = xml.dom.minidom.parseString(xmlstring)
1324
1530
1325
1531
def make_tag(document, name, prop):
1326
1532
e = document.createElement("property")
1327
1533
e.setAttribute("name", name)
1328
1534
e.setAttribute("type", prop._dbus_signature)
1329
1535
e.setAttribute("access", prop._dbus_access)
1330
1536
return e
1331
1537
1332
1538
for if_tag in document.getElementsByTagName("interface"):
1333
1539
# Add property tags
1334
1540
for tag in (make_tag(document, name, prop)
1372
1578
document.unlink()
1373
1579
except (AttributeError, xml.dom.DOMException,
1374
1580
xml.parsers.expat.ExpatError) as error:
1375
logger.error("Failed to override Introspection method",
1376
exc_info=error)
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1377
1583
return xmlstring
1378
1584
1585
1379
1586
try:
1380
1587
dbus.OBJECT_MANAGER_IFACE
1381
1588
except AttributeError:
1382
1589
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1590
1591
1384
1592
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1593
"""A D-Bus object with an ObjectManager.
1386
1594
1387
1595
Classes inheriting from this exposes the standard
1388
1596
GetManagedObjects call and the InterfacesAdded and
1389
1597
InterfacesRemoved signals on the standard
1390
1598
"org.freedesktop.DBus.ObjectManager" interface.
1391
1599
1392
1600
Note: No signals are sent automatically; they must be sent
1393
1601
manually.
1394
1602
"""
1395
1603
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1604
out_signature="a{oa{sa{sv}}}")
1397
1605
def GetManagedObjects(self):
1398
1606
"""This function must be overridden"""
1399
1607
raise NotImplementedError()
1400
1608
1401
1609
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1610
signature="oa{sa{sv}}")
1403
1611
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
1612
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1613
1614
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1615
def InterfacesRemoved(self, object_path, interfaces):
1408
1616
pass
1409
1617
1410
1618
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1619
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1414
1622
def Introspect(self, object_path, connection):
1415
1623
"""Overloading of standard D-Bus method.
1416
1624
1417
1625
Override return argument name of GetManagedObjects to be
1418
1626
"objpath_interfaces_and_properties"
1419
1627
"""
1422
1630
connection)
1423
1631
try:
1424
1632
document = xml.dom.minidom.parseString(xmlstring)
1425
1633
1426
1634
for if_tag in document.getElementsByTagName("interface"):
1427
1635
# Fix argument name for the GetManagedObjects method
1428
1636
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1637
== dbus.OBJECT_MANAGER_IFACE):
1430
1638
for cn in if_tag.getElementsByTagName("method"):
1431
1639
if (cn.getAttribute("name")
1432
1640
== "GetManagedObjects"):
1441
1649
document.unlink()
1442
1650
except (AttributeError, xml.dom.DOMException,
1443
1651
xml.parsers.expat.ExpatError) as error:
1444
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1446
1654
return xmlstring
1447
1655
1656
1448
1657
def datetime_to_dbus(dt, variant_level=0):
1449
1658
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1659
if dt is None:
1451
return dbus.String("", variant_level = variant_level)
1660
return dbus.String("", variant_level=variant_level)
1452
1661
return dbus.String(dt.isoformat(), variant_level=variant_level)
1453
1662
1454
1663
1457
1666
dbus.service.Object, it will add alternate D-Bus attributes with
1458
1667
interface names according to the "alt_interface_names" mapping.
1459
1668
Usage:
1460
1669
1461
1670
@alternate_dbus_interfaces({"org.example.Interface":
1462
1671
"net.example.AlternateInterface"})
1463
1672
class SampleDBusObject(dbus.service.Object):
1464
1673
@dbus.service.method("org.example.Interface")
1465
1674
def SampleDBusMethod():
1466
1675
pass
1467
1676
1468
1677
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
1678
reachable via two interfaces: "org.example.Interface" and
1470
1679
"net.example.AlternateInterface", the latter of which will have
1471
1680
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
1681
"true", unless "deprecate" is passed with a False value.
1473
1682
1474
1683
This works for methods and signals, and also for D-Bus properties
1475
1684
(from DBusObjectWithProperties) and interfaces (from the
1476
1685
dbus_interface_annotations decorator).
1477
1686
"""
1478
1687
1479
1688
def wrapper(cls):
1480
1689
for orig_interface_name, alt_interface_name in (
1481
1690
alt_interface_names.items()):
1496
1705
interface_names.add(alt_interface)
1497
1706
# Is this a D-Bus signal?
1498
1707
if getattr(attribute, "_dbus_is_signal", False):
1708
# Extract the original non-method undecorated
1709
# function by black magic
1499
1710
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
1711
nonmethod_func = (dict(
1503
1712
zip(attribute.func_code.co_freevars,
1504
1713
attribute.__closure__))
1505
1714
["func"].cell_contents)
1506
1715
else:
1507
nonmethod_func = attribute
1716
nonmethod_func = (dict(
1717
zip(attribute.__code__.co_freevars,
1718
attribute.__closure__))
1719
["func"].cell_contents)
1508
1720
# Create a new, but exactly alike, function
1509
1721
# object, and decorate it to be a new D-Bus signal
1510
1722
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1723
new_function = copy_function(nonmethod_func)
1525
1724
new_function = (dbus.service.signal(
1526
1725
alt_interface,
1527
1726
attribute._dbus_signature)(new_function))
1531
1730
attribute._dbus_annotations)
1532
1731
except AttributeError:
1533
1732
pass
1733
1534
1734
# Define a creator of a function to call both the
1535
1735
# original and alternate functions, so both the
1536
1736
# original and alternate signals gets sent when
1539
1739
"""This function is a scope container to pass
1540
1740
func1 and func2 to the "call_both" function
1541
1741
outside of its arguments"""
1542
1742
1543
1743
@functools.wraps(func2)
1544
1744
def call_both(*args, **kwargs):
1545
1745
"""This function will emit two D-Bus
1546
1746
signals by calling func1 and func2"""
1547
1747
func1(*args, **kwargs)
1548
1748
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1749
# Make wrapper function look like a D-Bus
1750
# signal
1550
1751
for name, attr in inspect.getmembers(func2):
1551
1752
if name.startswith("_dbus_"):
1552
1753
setattr(call_both, name, attr)
1553
1754
1554
1755
return call_both
1555
1756
# Create the "call_both" function and add it to
1556
1757
# the class
1566
1767
alt_interface,
1567
1768
attribute._dbus_in_signature,
1568
1769
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1770
(copy_function(attribute)))
1574
1771
# Copy annotations, if any
1575
1772
try:
1576
1773
attr[attrname]._dbus_annotations = dict(
1588
1785
attribute._dbus_access,
1589
1786
attribute._dbus_get_args_options
1590
1787
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1788
(copy_function(attribute)))
1597
1789
# Copy annotations, if any
1598
1790
try:
1599
1791
attr[attrname]._dbus_annotations = dict(
1608
1800
# to the class.
1609
1801
attr[attrname] = (
1610
1802
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1803
(copy_function(attribute)))
1616
1804
if deprecate:
1617
1805
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1806
iname = "_AlternateDBusNames_interface_annotation{}"
1619
1807
for interface_name in interface_names:
1620
1808
1621
1809
@dbus_interface_annotations(interface_name)
1622
1810
def func(self):
1623
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1811
return {"org.freedesktop.DBus.Deprecated":
1812
"true"}
1625
1813
# Find an unused name
1626
1814
for aname in (iname.format(i)
1627
1815
for i in itertools.count()):
1631
1819
if interface_names:
1632
1820
# Replace the class with a new subclass of it with
1633
1821
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1822
if sys.version_info.major == 2:
1823
cls = type(b"{}Alternate".format(cls.__name__),
1824
(cls, ), attr)
1825
else:
1826
cls = type("{}Alternate".format(cls.__name__),
1827
(cls, ), attr)
1636
1828
return cls
1637
1829
1638
1830
return wrapper
1639
1831
1640
1832
1642
1834
"se.bsnet.fukt.Mandos"})
1643
1835
class ClientDBus(Client, DBusObjectWithProperties):
1644
1836
"""A Client class using D-Bus
1645
1837
1646
1838
Attributes:
1647
1839
dbus_object_path: dbus.ObjectPath
1648
1840
bus: dbus.SystemBus()
1649
1841
"""
1650
1842
1651
1843
runtime_expansions = (Client.runtime_expansions
1652
1844
+ ("dbus_object_path", ))
1653
1845
1654
1846
_interface = "se.recompile.Mandos.Client"
1655
1847
1656
1848
# dbus.service.Object doesn't use super(), so we can't either.
1657
1658
def __init__(self, bus = None, *args, **kwargs):
1849
1850
def __init__(self, bus=None, *args, **kwargs):
1659
1851
self.bus = bus
1660
1852
Client.__init__(self, *args, **kwargs)
1661
1853
# Only now, when this client is initialized, can it show up on
1667
1859
"/clients/" + client_object_name)
1668
1860
DBusObjectWithProperties.__init__(self, self.bus,
1669
1861
self.dbus_object_path)
1670
1862
1671
1863
def notifychangeproperty(transform_func, dbus_name,
1672
1864
type_func=lambda x: x,
1673
1865
variant_level=1,
1675
1867
_interface=_interface):
1676
1868
""" Modify a variable so that it's a property which announces
1677
1869
its changes to DBus.
1678
1870
1679
1871
transform_fun: Function that takes a value and a variant_level
1680
1872
and transforms it to a D-Bus type.
1681
1873
dbus_name: D-Bus name of the variable
1684
1876
variant_level: D-Bus variant level. Default: 1
1685
1877
"""
1686
1878
attrname = "_{}".format(dbus_name)
1687
1879
1688
1880
def setter(self, value):
1689
1881
if hasattr(self, "dbus_object_path"):
1690
1882
if (not hasattr(self, attrname) or
1697
1889
else:
1698
1890
dbus_value = transform_func(
1699
1891
type_func(value),
1700
variant_level = variant_level)
1892
variant_level=variant_level)
1701
1893
self.PropertyChanged(dbus.String(dbus_name),
1702
1894
dbus_value)
1703
1895
self.PropertiesChanged(
1704
1896
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1897
dbus.Dictionary({dbus.String(dbus_name):
1898
dbus_value}),
1707
1899
dbus.Array())
1708
1900
setattr(self, attrname, value)
1709
1901
1710
1902
return property(lambda self: getattr(self, attrname), setter)
1711
1903
1712
1904
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
1905
approvals_pending = notifychangeproperty(dbus.Boolean,
1714
1906
"ApprovalPending",
1715
type_func = bool)
1907
type_func=bool)
1716
1908
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1909
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1910
"LastEnabled")
1719
1911
checker = notifychangeproperty(
1720
1912
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1913
type_func=lambda checker: checker is not None)
1722
1914
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1915
"LastCheckedOK")
1724
1916
last_checker_status = notifychangeproperty(dbus.Int16,
1729
1921
"ApprovedByDefault")
1730
1922
approval_delay = notifychangeproperty(
1731
1923
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1924
type_func=lambda td: td.total_seconds() * 1000)
1733
1925
approval_duration = notifychangeproperty(
1734
1926
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1927
type_func=lambda td: td.total_seconds() * 1000)
1736
1928
host = notifychangeproperty(dbus.String, "Host")
1737
1929
timeout = notifychangeproperty(
1738
1930
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1931
type_func=lambda td: td.total_seconds() * 1000)
1740
1932
extended_timeout = notifychangeproperty(
1741
1933
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1934
type_func=lambda td: td.total_seconds() * 1000)
1743
1935
interval = notifychangeproperty(
1744
1936
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1937
type_func=lambda td: td.total_seconds() * 1000)
1746
1938
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
1939
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
1940
invalidate_only=True)
1749
1941
1750
1942
del notifychangeproperty
1751
1943
1752
1944
def __del__(self, *args, **kwargs):
1753
1945
try:
1754
1946
self.remove_from_connection()
1757
1949
if hasattr(DBusObjectWithProperties, "__del__"):
1758
1950
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1951
Client.__del__(self, *args, **kwargs)
1760
1952
1761
1953
def checker_callback(self, source, condition,
1762
1954
connection, command, *args, **kwargs):
1763
1955
ret = Client.checker_callback(self, source, condition,
1779
1971
| self.last_checker_signal),
1780
1972
dbus.String(command))
1781
1973
return ret
1782
1974
1783
1975
def start_checker(self, *args, **kwargs):
1784
1976
old_checker_pid = getattr(self.checker, "pid", None)
1785
1977
r = Client.start_checker(self, *args, **kwargs)
1789
1981
# Emit D-Bus signal
1790
1982
self.CheckerStarted(self.current_checker_command)
1791
1983
return r
1792
1984
1793
1985
def _reset_approved(self):
1794
1986
self.approved = None
1795
1987
return False
1796
1988
1797
1989
def approve(self, value=True):
1798
1990
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1991
GLib.timeout_add(int(self.approval_duration.total_seconds()
1992
* 1000), self._reset_approved)
1801
1993
self.send_changedstate()
1802
1803
## D-Bus methods, signals & properties
1804
1805
## Interfaces
1806
1807
## Signals
1808
1994
1995
# D-Bus methods, signals & properties
1996
1997
# Interfaces
1998
1999
# Signals
2000
1809
2001
# CheckerCompleted - signal
1810
2002
@dbus.service.signal(_interface, signature="nxs")
1811
2003
def CheckerCompleted(self, exitcode, waitstatus, command):
1812
2004
"D-Bus signal"
1813
2005
pass
1814
2006
1815
2007
# CheckerStarted - signal
1816
2008
@dbus.service.signal(_interface, signature="s")
1817
2009
def CheckerStarted(self, command):
1818
2010
"D-Bus signal"
1819
2011
pass
1820
2012
1821
2013
# PropertyChanged - signal
1822
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
2015
@dbus.service.signal(_interface, signature="sv")
1824
2016
def PropertyChanged(self, property, value):
1825
2017
"D-Bus signal"
1826
2018
pass
1827
2019
1828
2020
# GotSecret - signal
1829
2021
@dbus.service.signal(_interface)
1830
2022
def GotSecret(self):
1833
2025
server to mandos-client
1834
2026
"""
1835
2027
pass
1836
2028
1837
2029
# Rejected - signal
1838
2030
@dbus.service.signal(_interface, signature="s")
1839
2031
def Rejected(self, reason):
1840
2032
"D-Bus signal"
1841
2033
pass
1842
2034
1843
2035
# NeedApproval - signal
1844
2036
@dbus.service.signal(_interface, signature="tb")
1845
2037
def NeedApproval(self, timeout, default):
1846
2038
"D-Bus signal"
1847
2039
return self.need_approval()
1848
1849
## Methods
1850
2040
2041
# Methods
2042
1851
2043
# Approve - method
1852
2044
@dbus.service.method(_interface, in_signature="b")
1853
2045
def Approve(self, value):
1854
2046
self.approve(value)
1855
2047
1856
2048
# CheckedOK - method
1857
2049
@dbus.service.method(_interface)
1858
2050
def CheckedOK(self):
1859
2051
self.checked_ok()
1860
2052
1861
2053
# Enable - method
1862
2054
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
2055
@dbus.service.method(_interface)
1864
2056
def Enable(self):
1865
2057
"D-Bus method"
1866
2058
self.enable()
1867
2059
1868
2060
# StartChecker - method
1869
2061
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
2062
@dbus.service.method(_interface)
1871
2063
def StartChecker(self):
1872
2064
"D-Bus method"
1873
2065
self.start_checker()
1874
2066
1875
2067
# Disable - method
1876
2068
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
2069
@dbus.service.method(_interface)
1878
2070
def Disable(self):
1879
2071
"D-Bus method"
1880
2072
self.disable()
1881
2073
1882
2074
# StopChecker - method
1883
2075
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
2076
@dbus.service.method(_interface)
1885
2077
def StopChecker(self):
1886
2078
self.stop_checker()
1887
1888
## Properties
1889
2079
2080
# Properties
2081
1890
2082
# ApprovalPending - property
1891
2083
@dbus_service_property(_interface, signature="b", access="read")
1892
2084
def ApprovalPending_dbus_property(self):
1893
2085
return dbus.Boolean(bool(self.approvals_pending))
1894
2086
1895
2087
# ApprovedByDefault - property
1896
2088
@dbus_service_property(_interface,
1897
2089
signature="b",
1900
2092
if value is None: # get
1901
2093
return dbus.Boolean(self.approved_by_default)
1902
2094
self.approved_by_default = bool(value)
1903
2095
1904
2096
# ApprovalDelay - property
1905
2097
@dbus_service_property(_interface,
1906
2098
signature="t",
1910
2102
return dbus.UInt64(self.approval_delay.total_seconds()
1911
2103
* 1000)
1912
2104
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
2105
1914
2106
# ApprovalDuration - property
1915
2107
@dbus_service_property(_interface,
1916
2108
signature="t",
1920
2112
return dbus.UInt64(self.approval_duration.total_seconds()
1921
2113
* 1000)
1922
2114
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
2115
1924
2116
# Name - property
1925
2117
@dbus_annotations(
1926
2118
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
2119
@dbus_service_property(_interface, signature="s", access="read")
1928
2120
def Name_dbus_property(self):
1929
2121
return dbus.String(self.name)
1930
2122
2123
# KeyID - property
2124
@dbus_annotations(
2125
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2126
@dbus_service_property(_interface, signature="s", access="read")
2127
def KeyID_dbus_property(self):
2128
return dbus.String(self.key_id)
2129
1931
2130
# Fingerprint - property
1932
2131
@dbus_annotations(
1933
2132
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
2133
@dbus_service_property(_interface, signature="s", access="read")
1935
2134
def Fingerprint_dbus_property(self):
1936
2135
return dbus.String(self.fingerprint)
1937
2136
1938
2137
# Host - property
1939
2138
@dbus_service_property(_interface,
1940
2139
signature="s",
1943
2142
if value is None: # get
1944
2143
return dbus.String(self.host)
1945
2144
self.host = str(value)
1946
2145
1947
2146
# Created - property
1948
2147
@dbus_annotations(
1949
2148
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
2149
@dbus_service_property(_interface, signature="s", access="read")
1951
2150
def Created_dbus_property(self):
1952
2151
return datetime_to_dbus(self.created)
1953
2152
1954
2153
# LastEnabled - property
1955
2154
@dbus_service_property(_interface, signature="s", access="read")
1956
2155
def LastEnabled_dbus_property(self):
1957
2156
return datetime_to_dbus(self.last_enabled)
1958
2157
1959
2158
# Enabled - property
1960
2159
@dbus_service_property(_interface,
1961
2160
signature="b",
1967
2166
self.enable()
1968
2167
else:
1969
2168
self.disable()
1970
2169
1971
2170
# LastCheckedOK - property
1972
2171
@dbus_service_property(_interface,
1973
2172
signature="s",
1977
2176
self.checked_ok()
1978
2177
return
1979
2178
return datetime_to_dbus(self.last_checked_ok)
1980
2179
1981
2180
# LastCheckerStatus - property
1982
2181
@dbus_service_property(_interface, signature="n", access="read")
1983
2182
def LastCheckerStatus_dbus_property(self):
1984
2183
return dbus.Int16(self.last_checker_status)
1985
2184
1986
2185
# Expires - property
1987
2186
@dbus_service_property(_interface, signature="s", access="read")
1988
2187
def Expires_dbus_property(self):
1989
2188
return datetime_to_dbus(self.expires)
1990
2189
1991
2190
# LastApprovalRequest - property
1992
2191
@dbus_service_property(_interface, signature="s", access="read")
1993
2192
def LastApprovalRequest_dbus_property(self):
1994
2193
return datetime_to_dbus(self.last_approval_request)
1995
2194
1996
2195
# Timeout - property
1997
2196
@dbus_service_property(_interface,
1998
2197
signature="t",
2013
2212
if (getattr(self, "disable_initiator_tag", None)
2014
2213
is None):
2015
2214
return
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2215
GLib.source_remove(self.disable_initiator_tag)
2216
self.disable_initiator_tag = GLib.timeout_add(
2018
2217
int((self.expires - now).total_seconds() * 1000),
2019
2218
self.disable)
2020
2219
2021
2220
# ExtendedTimeout - property
2022
2221
@dbus_service_property(_interface,
2023
2222
signature="t",
2027
2226
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
2227
* 1000)
2029
2228
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
2229
2031
2230
# Interval - property
2032
2231
@dbus_service_property(_interface,
2033
2232
signature="t",
2040
2239
return
2041
2240
if self.enabled:
2042
2241
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2242
GLib.source_remove(self.checker_initiator_tag)
2243
self.checker_initiator_tag = GLib.timeout_add(
2045
2244
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2047
2245
self.start_checker() # Start one now, too
2246
2048
2247
# Checker - property
2049
2248
@dbus_service_property(_interface,
2050
2249
signature="s",
2053
2252
if value is None: # get
2054
2253
return dbus.String(self.checker_command)
2055
2254
self.checker_command = str(value)
2056
2255
2057
2256
# CheckerRunning - property
2058
2257
@dbus_service_property(_interface,
2059
2258
signature="b",
2065
2264
self.start_checker()
2066
2265
else:
2067
2266
self.stop_checker()
2068
2267
2069
2268
# ObjectPath - property
2070
2269
@dbus_annotations(
2071
2270
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
2271
"org.freedesktop.DBus.Deprecated": "true"})
2073
2272
@dbus_service_property(_interface, signature="o", access="read")
2074
2273
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2076
2274
return self.dbus_object_path # is already a dbus.ObjectPath
2275
2077
2276
# Secret = property
2078
2277
@dbus_annotations(
2079
2278
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2084
2283
byte_arrays=True)
2085
2284
def Secret_dbus_property(self, value):
2086
2285
self.secret = bytes(value)
2087
2286
2088
2287
del _interface
2089
2288
2090
2289
2091
class ProxyClient(object):
2092
def __init__(self, child_pipe, fpr, address):
2290
class ProxyClient:
2291
def __init__(self, child_pipe, key_id, fpr, address):
2093
2292
self._pipe = child_pipe
2094
self._pipe.send(('init', fpr, address))
2293
self._pipe.send(("init", key_id, fpr, address))
2095
2294
if not self._pipe.recv():
2096
raise KeyError(fpr)
2097
2295
raise KeyError(key_id or fpr)
2296
2098
2297
def __getattribute__(self, name):
2099
if name == '_pipe':
2298
if name == "_pipe":
2100
2299
return super(ProxyClient, self).__getattribute__(name)
2101
self._pipe.send(('getattr', name))
2300
self._pipe.send(("getattr", name))
2102
2301
data = self._pipe.recv()
2103
if data[0] == 'data':
2302
if data[0] == "data":
2104
2303
return data[1]
2105
if data[0] == 'function':
2106
2304
if data[0] == "function":
2305
2107
2306
def func(*args, **kwargs):
2108
self._pipe.send(('funcall', name, args, kwargs))
2307
self._pipe.send(("funcall", name, args, kwargs))
2109
2308
return self._pipe.recv()[1]
2110
2309
2111
2310
return func
2112
2311
2113
2312
def __setattr__(self, name, value):
2114
if name == '_pipe':
2313
if name == "_pipe":
2115
2314
return super(ProxyClient, self).__setattr__(name, value)
2116
self._pipe.send(('setattr', name, value))
2315
self._pipe.send(("setattr", name, value))
2117
2316
2118
2317
2119
2318
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2319
"""A class to handle client connections.
2121
2320
2122
2321
Instantiated once for each connection to handle it.
2123
2322
Note: This will run in its own forked process."""
2124
2323
2125
2324
def handle(self):
2126
2325
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
logger.info("TCP connection from: %s",
2128
str(self.client_address))
2129
logger.debug("Pipe FD: %d",
2130
self.server.child_pipe.fileno())
2131
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2329
2132
2330
session = gnutls.ClientSession(self.request)
2133
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2137
# "+DHE-DSS"))
2331
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2333
# "+AES-256-CBC", "+SHA1",
2334
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
# "+DHE-DSS"))
2138
2336
# Use a fallback default, since this MUST be set.
2139
2337
priority = self.server.gnutls_priority
2140
2338
if priority is None:
2141
2339
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2143
None)
2144
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2342
2145
2343
# Start communication using the Mandos protocol
2146
2344
# Get protocol number
2147
2345
line = self.request.makefile().readline()
2148
logger.debug("Protocol version: %r", line)
2346
log.debug("Protocol version: %r", line)
2149
2347
try:
2150
2348
if int(line.strip().split()[0]) > 1:
2151
2349
raise RuntimeError(line)
2152
2350
except (ValueError, IndexError, RuntimeError) as error:
2153
logger.error("Unknown protocol version: %s", error)
2351
log.error("Unknown protocol version: %s", error)
2154
2352
return
2155
2353
2156
2354
# Start GnuTLS connection
2157
2355
try:
2158
2356
session.handshake()
2159
2357
except gnutls.Error as error:
2160
logger.warning("Handshake failed: %s", error)
2358
log.warning("Handshake failed: %s", error)
2161
2359
# Do not run session.bye() here: the session is not
2162
2360
# established. Just abandon the request.
2163
2361
return
2164
logger.debug("Handshake succeeded")
2165
2362
log.debug("Handshake succeeded")
2363
2166
2364
approval_required = False
2167
2365
try:
2168
try:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
2172
logger.warning("Bad certificate: %s", error)
2173
return
2174
logger.debug("Fingerprint: %s", fpr)
2175
2176
try:
2177
client = ProxyClient(child_pipe, fpr,
2366
if gnutls.has_rawpk:
2367
fpr = b""
2368
try:
2369
key_id = self.key_id(
2370
self.peer_certificate(session))
2371
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2373
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2377
2378
else:
2379
key_id = b""
2380
try:
2381
fpr = self.fingerprint(
2382
self.peer_certificate(session))
2383
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2385
return
2386
log.debug("Fingerprint: %s", fpr)
2387
2388
try:
2389
client = ProxyClient(child_pipe, key_id, fpr,
2178
2390
self.client_address)
2179
2391
except KeyError:
2180
2392
return
2181
2393
2182
2394
if client.approval_delay:
2183
2395
delay = client.approval_delay
2184
2396
client.approvals_pending += 1
2185
2397
approval_required = True
2186
2398
2187
2399
while True:
2188
2400
if not client.enabled:
2189
logger.info("Client %s is disabled",
2190
client.name)
2401
log.info("Client %s is disabled", client.name)
2191
2402
if self.server.use_dbus:
2192
2403
# Emit D-Bus signal
2193
2404
client.Rejected("Disabled")
2194
2405
return
2195
2406
2196
2407
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2408
# We are approved or approval is disabled
2198
2409
break
2199
2410
elif client.approved is None:
2200
logger.info("Client %s needs approval",
2201
client.name)
2411
log.info("Client %s needs approval",
2412
client.name)
2202
2413
if self.server.use_dbus:
2203
2414
# Emit D-Bus signal
2204
2415
client.NeedApproval(
2205
2416
client.approval_delay.total_seconds()
2206
2417
* 1000, client.approved_by_default)
2207
2418
else:
2208
logger.warning("Client %s was not approved",
2209
client.name)
2419
log.warning("Client %s was not approved",
2420
client.name)
2210
2421
if self.server.use_dbus:
2211
2422
# Emit D-Bus signal
2212
2423
client.Rejected("Denied")
2213
2424
return
2214
2215
#wait until timeout or approved
2425
2426
# wait until timeout or approved
2216
2427
time = datetime.datetime.now()
2217
2428
client.changedstate.acquire()
2218
2429
client.changedstate.wait(delay.total_seconds())
2220
2431
time2 = datetime.datetime.now()
2221
2432
if (time2 - time) >= delay:
2222
2433
if not client.approved_by_default:
2223
logger.warning("Client %s timed out while"
2224
" waiting for approval",
2225
client.name)
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2226
2437
if self.server.use_dbus:
2227
2438
# Emit D-Bus signal
2228
2439
client.Rejected("Approval timed out")
2231
2442
break
2232
2443
else:
2233
2444
delay -= time2 - time
2234
2445
2235
2446
try:
2236
2447
session.send(client.secret)
2237
2448
except gnutls.Error as error:
2238
logger.warning("gnutls send failed",
2239
exc_info = error)
2449
log.warning("gnutls send failed", exc_info=error)
2240
2450
return
2241
2242
logger.info("Sending secret to %s", client.name)
2451
2452
log.info("Sending secret to %s", client.name)
2243
2453
# bump the timeout using extended_timeout
2244
2454
client.bump_timeout(client.extended_timeout)
2245
2455
if self.server.use_dbus:
2246
2456
# Emit D-Bus signal
2247
2457
client.GotSecret()
2248
2458
2249
2459
finally:
2250
2460
if approval_required:
2251
2461
client.approvals_pending -= 1
2252
2462
try:
2253
2463
session.bye()
2254
2464
except gnutls.Error as error:
2255
logger.warning("GnuTLS bye failed",
2256
exc_info=error)
2257
2465
log.warning("GnuTLS bye failed", exc_info=error)
2466
2258
2467
@staticmethod
2259
2468
def peer_certificate(session):
2260
"Return the peer's OpenPGP certificate as a bytestring"
2261
# If not an OpenPGP certificate...
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2469
"Return the peer's certificate as a bytestring"
2470
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2473
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2475
if gnutls.has_rawpk:
2476
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
else:
2478
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
# If not a valid certificate type...
2480
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2264
2483
# ...return invalid data
2265
2484
return b""
2266
2485
list_size = ctypes.c_uint(1)
2267
2486
cert_list = (gnutls.certificate_get_peers
2268
(session._c_object, ctypes.byref(list_size)))
2487
(session, ctypes.byref(list_size)))
2269
2488
if not bool(cert_list) and list_size.value != 0:
2270
2489
raise gnutls.Error("error getting peer certificate")
2271
2490
if list_size.value == 0:
2272
2491
return None
2273
2492
cert = cert_list[0]
2274
2493
return ctypes.string_at(cert.data, cert.size)
2275
2494
2495
@staticmethod
2496
def key_id(certificate):
2497
"Convert a certificate bytestring to a hexdigit key ID"
2498
# New GnuTLS "datum" with the public key
2499
datum = gnutls.datum_t(
2500
ctypes.cast(ctypes.c_char_p(certificate),
2501
ctypes.POINTER(ctypes.c_ubyte)),
2502
ctypes.c_uint(len(certificate)))
2503
# XXX all these need to be created in the gnutls "module"
2504
# New empty GnuTLS certificate
2505
pubkey = gnutls.pubkey_t()
2506
gnutls.pubkey_init(ctypes.byref(pubkey))
2507
# Import the raw public key into the certificate
2508
gnutls.pubkey_import(pubkey,
2509
ctypes.byref(datum),
2510
gnutls.X509_FMT_DER)
2511
# New buffer for the key ID
2512
buf = ctypes.create_string_buffer(32)
2513
buf_len = ctypes.c_size_t(len(buf))
2514
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2521
# Deinit the certificate
2522
gnutls.pubkey_deinit(pubkey)
2523
2524
# Convert the buffer to a Python bytestring
2525
key_id = ctypes.string_at(buf, buf_len.value)
2526
# Convert the bytestring to hexadecimal notation
2527
hex_key_id = binascii.hexlify(key_id).upper()
2528
return hex_key_id
2529
2276
2530
@staticmethod
2277
2531
def fingerprint(openpgp):
2278
2532
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2293
2547
ctypes.byref(crtverify))
2294
2548
if crtverify.value != 0:
2295
2549
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
2550
raise gnutls.CertificateSecurityError(code
2551
=crtverify.value)
2297
2552
# New buffer for the fingerprint
2298
2553
buf = ctypes.create_string_buffer(20)
2299
2554
buf_len = ctypes.c_size_t()
2309
2564
return hex_fpr
2310
2565
2311
2566
2312
class MultiprocessingMixIn(object):
2567
class MultiprocessingMixIn:
2313
2568
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2569
2315
2570
def sub_process_main(self, request, address):
2316
2571
try:
2317
2572
self.finish_request(request, address)
2318
2573
except Exception:
2319
2574
self.handle_error(request, address)
2320
2575
self.close_request(request)
2321
2576
2322
2577
def process_request(self, request, address):
2323
2578
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2579
proc = multiprocessing.Process(target=self.sub_process_main,
2580
args=(request, address))
2326
2581
proc.start()
2327
2582
return proc
2328
2583
2329
2584
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2585
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2331
2586
""" adds a pipe to the MixIn """
2332
2587
2333
2588
def process_request(self, request, client_address):
2334
2589
"""Overrides and wraps the original process_request().
2335
2590
2336
2591
This function creates a new pipe in self.pipe
2337
2592
"""
2338
2593
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2339
2594
2340
2595
proc = MultiprocessingMixIn.process_request(self, request,
2341
2596
client_address)
2342
2597
self.child_pipe.close()
2343
2598
self.add_pipe(parent_pipe, proc)
2344
2599
2345
2600
def add_pipe(self, parent_pipe, proc):
2346
2601
"""Dummy function; override as necessary"""
2347
2602
raise NotImplementedError()
2348
2603
2349
2604
2350
2605
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
socketserver.TCPServer, object):
2352
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2353
2606
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2608
2354
2609
Attributes:
2355
2610
enabled: Boolean; whether this server is activated yet
2356
2611
interface: None or a network interface name (string)
2357
2612
use_ipv6: Boolean; to use IPv6 or not
2358
2613
"""
2359
2614
2360
2615
def __init__(self, server_address, RequestHandlerClass,
2361
2616
interface=None,
2362
2617
use_ipv6=True,
2372
2627
self.socketfd = socketfd
2373
2628
# Save the original socket.socket() function
2374
2629
self.socket_socket = socket.socket
2630
2375
2631
# To implement --socket, we monkey patch socket.socket.
2376
#
2632
#
2377
2633
# (When socketserver.TCPServer is a new-style class, we
2378
2634
# could make self.socket into a property instead of monkey
2379
2635
# patching socket.socket.)
2380
#
2636
#
2381
2637
# Create a one-time-only replacement for socket.socket()
2382
2638
@functools.wraps(socket.socket)
2383
2639
def socket_wrapper(*args, **kwargs):
2395
2651
# socket_wrapper(), if socketfd was set.
2396
2652
socketserver.TCPServer.__init__(self, server_address,
2397
2653
RequestHandlerClass)
2398
2654
2399
2655
def server_bind(self):
2400
2656
"""This overrides the normal server_bind() function
2401
2657
to bind to an interface if one was specified, and also NOT to
2402
2658
bind to an address or port if they were not specified."""
2659
global SO_BINDTODEVICE
2403
2660
if self.interface is not None:
2404
2661
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2407
self.interface)
2408
else:
2409
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2420
self.interface)
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2424
else:
2425
raise
2662
# Fall back to a hard-coded value which seems to be
2663
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2665
SO_BINDTODEVICE = 25
2666
try:
2667
self.socket.setsockopt(
2668
socket.SOL_SOCKET, SO_BINDTODEVICE,
2669
(self.interface + "\0").encode("utf-8"))
2670
except socket.error as error:
2671
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2674
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2677
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2680
else:
2681
raise
2426
2682
# Only bind(2) the socket if we really need to.
2427
2683
if self.server_address[0] or self.server_address[1]:
2684
if self.server_address[1]:
2685
self.allow_reuse_address = True
2428
2686
if not self.server_address[0]:
2429
2687
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2688
any_address = "::" # in6addr_any
2431
2689
else:
2432
any_address = "0.0.0.0" # INADDR_ANY
2690
any_address = "0.0.0.0" # INADDR_ANY
2433
2691
self.server_address = (any_address,
2434
2692
self.server_address[1])
2435
2693
elif not self.server_address[1]:
2445
2703
2446
2704
class MandosServer(IPv6_TCPServer):
2447
2705
"""Mandos server.
2448
2706
2449
2707
Attributes:
2450
2708
clients: set of Client objects
2451
2709
gnutls_priority GnuTLS priority string
2452
2710
use_dbus: Boolean; to emit D-Bus signals or not
2453
2454
Assumes a gobject.MainLoop event loop.
2711
2712
Assumes a GLib.MainLoop event loop.
2455
2713
"""
2456
2714
2457
2715
def __init__(self, server_address, RequestHandlerClass,
2458
2716
interface=None,
2459
2717
use_ipv6=True,
2469
2727
self.gnutls_priority = gnutls_priority
2470
2728
IPv6_TCPServer.__init__(self, server_address,
2471
2729
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2475
2730
interface=interface,
2731
use_ipv6=use_ipv6,
2732
socketfd=socketfd)
2733
2476
2734
def server_activate(self):
2477
2735
if self.enabled:
2478
2736
return socketserver.TCPServer.server_activate(self)
2479
2737
2480
2738
def enable(self):
2481
2739
self.enabled = True
2482
2740
2483
2741
def add_pipe(self, parent_pipe, proc):
2484
2742
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2743
GLib.io_add_watch(
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2488
2746
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2491
2747
parent_pipe=parent_pipe,
2748
proc=proc))
2749
2492
2750
def handle_ipc(self, source, condition,
2493
2751
parent_pipe=None,
2494
proc = None,
2752
proc=None,
2495
2753
client_object=None):
2496
2754
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2755
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2756
# Wait for other process to exit
2499
2757
proc.join()
2500
2758
return False
2501
2759
2502
2760
# Read a request from the child
2503
2761
request = parent_pipe.recv()
2504
2762
command = request[0]
2505
2506
if command == 'init':
2507
fpr = request[1]
2508
address = request[2]
2509
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2763
2764
if command == "init":
2765
key_id = request[1].decode("ascii")
2766
fpr = request[2].decode("ascii")
2767
address = request[3]
2768
2769
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2772
continue
2773
if key_id and c.key_id == key_id:
2774
client = c
2775
break
2776
if fpr and c.fingerprint == fpr:
2512
2777
client = c
2513
2778
break
2514
2779
else:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2517
2782
if self.use_dbus:
2518
2783
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
2784
mandos_dbus_service.ClientNotFound(key_id or fpr,
2520
2785
address[0])
2521
2786
parent_pipe.send(False)
2522
2787
return False
2523
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2788
2789
GLib.io_add_watch(
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2527
2792
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2793
parent_pipe=parent_pipe,
2794
proc=proc,
2795
client_object=client))
2531
2796
parent_pipe.send(True)
2532
2797
# remove the old hook in favor of the new above hook on
2533
2798
# same fileno
2534
2799
return False
2535
if command == 'funcall':
2800
if command == "funcall":
2536
2801
funcname = request[1]
2537
2802
args = request[2]
2538
2803
kwargs = request[3]
2539
2540
parent_pipe.send(('data', getattr(client_object,
2804
2805
parent_pipe.send(("data", getattr(client_object,
2541
2806
funcname)(*args,
2542
2807
**kwargs)))
2543
2544
if command == 'getattr':
2808
2809
if command == "getattr":
2545
2810
attrname = request[1]
2546
2811
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2549
2814
else:
2550
2815
parent_pipe.send((
2551
'data', client_object.__getattribute__(attrname)))
2552
2553
if command == 'setattr':
2816
"data", client_object.__getattribute__(attrname)))
2817
2818
if command == "setattr":
2554
2819
attrname = request[1]
2555
2820
value = request[2]
2556
2821
setattr(client_object, attrname, value)
2557
2822
2558
2823
return True
2559
2824
2560
2825
2561
2826
def rfc3339_duration_to_delta(duration):
2562
2827
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2563
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2828
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2578
2845
"""
2579
2846
2580
2847
# Parsing an RFC 3339 duration with regular expressions is not
2581
2848
# possible - there would have to be multiple places for the same
2582
2849
# values, like seconds. The current code, while more esoteric, is
2583
2850
# cleaner without depending on a parsing library. If Python had a
2584
2851
# built-in library for parsing we would use it, but we'd like to
2585
2852
# avoid excessive use of external libraries.
2586
2853
2587
2854
# New type for defining tokens, syntax, and semantics all-in-one
2588
2855
Token = collections.namedtuple("Token", (
2589
2856
"regexp", # To match token; if "value" is not None, must have
2622
2889
frozenset((token_year, token_month,
2623
2890
token_day, token_time,
2624
2891
token_week)))
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2892
# Define starting values:
2893
# Value so far
2894
value = datetime.timedelta()
2627
2895
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2896
# Following valid tokens
2897
followers = frozenset((token_duration, ))
2898
# String left to parse
2899
s = duration
2630
2900
# Loop until end token is found
2631
2901
while found_token is not token_end:
2632
2902
# Search for any currently valid tokens
2656
2926
2657
2927
def string_to_delta(interval):
2658
2928
"""Parse a string and return a datetime.timedelta
2659
2660
>>> string_to_delta('7d')
2661
datetime.timedelta(7)
2662
>>> string_to_delta('60s')
2663
datetime.timedelta(0, 60)
2664
>>> string_to_delta('60m')
2665
datetime.timedelta(0, 3600)
2666
>>> string_to_delta('24h')
2667
datetime.timedelta(1)
2668
>>> string_to_delta('1w')
2669
datetime.timedelta(7)
2670
>>> string_to_delta('5m 30s')
2671
datetime.timedelta(0, 330)
2929
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2941
True
2672
2942
"""
2673
2943
2674
2944
try:
2675
2945
return rfc3339_duration_to_delta(interval)
2676
2946
except ValueError:
2677
2947
pass
2678
2948
2679
2949
timevalue = datetime.timedelta(0)
2680
2950
for s in interval.split():
2681
2951
try:
2699
2969
return timevalue
2700
2970
2701
2971
2702
def daemon(nochdir = False, noclose = False):
2972
def daemon(nochdir=False, noclose=False):
2703
2973
"""See daemon(3). Standard BSD Unix function.
2704
2974
2705
2975
This should really exist as os.daemon, but it doesn't (yet)."""
2706
2976
if os.fork():
2707
2977
sys.exit()
2725
2995
2726
2996
2727
2997
def main():
2728
2998
2729
2999
##################################################################
2730
3000
# Parsing of options, both command line and config file
2731
3001
2732
3002
parser = argparse.ArgumentParser()
2733
3003
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
3004
version="%(prog)s {}".format(version),
2735
3005
help="show version number and exit")
2736
3006
parser.add_argument("-i", "--interface", metavar="IF",
2737
3007
help="Bind to interface IF")
2773
3043
parser.add_argument("--no-zeroconf", action="store_false",
2774
3044
dest="zeroconf", help="Do not use Zeroconf",
2775
3045
default=None)
2776
3046
2777
3047
options = parser.parse_args()
2778
2779
if options.check:
2780
import doctest
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2783
3048
2784
3049
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2786
"address": "",
2787
"port": "",
2788
"debug": "False",
2789
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2793
"use_dbus": "True",
2794
"use_ipv6": "True",
2795
"debuglevel": "",
2796
"restore": "True",
2797
"socket": "",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2802
3050
if gnutls.has_rawpk:
3051
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3052
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3053
else:
3054
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3055
":+SIGN-DSA-SHA256")
3056
server_defaults = {"interface": "",
3057
"address": "",
3058
"port": "",
3059
"debug": "False",
3060
"priority": priority,
3061
"servicename": "Mandos",
3062
"use_dbus": "True",
3063
"use_ipv6": "True",
3064
"debuglevel": "",
3065
"restore": "True",
3066
"socket": "",
3067
"statedir": "/var/lib/mandos",
3068
"foreground": "False",
3069
"zeroconf": "True",
3070
}
3071
del priority
3072
2803
3073
# Parse config file for server-global settings
2804
server_config = configparser.SafeConfigParser(server_defaults)
3074
server_config = configparser.ConfigParser(server_defaults)
2805
3075
del server_defaults
2806
3076
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2807
# Convert the SafeConfigParser object to a dict
3077
# Convert the ConfigParser object to a dict
2808
3078
server_settings = server_config.defaults()
2809
3079
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3080
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3081
"foreground", "zeroconf"):
2811
3082
server_settings[option] = server_config.getboolean("DEFAULT",
2812
3083
option)
2813
3084
if server_settings["port"]:
2823
3094
server_settings["socket"] = os.dup(server_settings
2824
3095
["socket"])
2825
3096
del server_config
2826
3097
2827
3098
# Override the settings from the config file with command line
2828
3099
# options, if set.
2829
3100
for option in ("interface", "address", "port", "debug",
2847
3118
if server_settings["debug"]:
2848
3119
server_settings["foreground"] = True
2849
3120
# Now we have our good server settings in "server_settings"
2850
3121
2851
3122
##################################################################
2852
3123
2853
3124
if (not server_settings["zeroconf"]
2854
3125
and not (server_settings["port"]
2855
3126
or server_settings["socket"] != "")):
2856
3127
parser.error("Needs port or socket to work without Zeroconf")
2857
3128
2858
3129
# For convenience
2859
3130
debug = server_settings["debug"]
2860
3131
debuglevel = server_settings["debuglevel"]
2864
3135
stored_state_file)
2865
3136
foreground = server_settings["foreground"]
2866
3137
zeroconf = server_settings["zeroconf"]
2867
3138
2868
3139
if debug:
2869
3140
initlogger(debug, logging.DEBUG)
2870
3141
else:
2873
3144
else:
2874
3145
level = getattr(logging, debuglevel.upper())
2875
3146
initlogger(debug, level)
2876
3147
2877
3148
if server_settings["servicename"] != "Mandos":
2878
3149
syslogger.setFormatter(
2879
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
' %(levelname)s: %(message)s'.format(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
2881
3152
server_settings["servicename"])))
2882
3153
2883
3154
# Parse config file with clients
2884
client_config = configparser.SafeConfigParser(Client
2885
.client_defaults)
3155
client_config = configparser.ConfigParser(Client.client_defaults)
2886
3156
client_config.read(os.path.join(server_settings["configdir"],
2887
3157
"clients.conf"))
2888
3158
2889
3159
global mandos_dbus_service
2890
3160
mandos_dbus_service = None
2891
3161
2892
3162
socketfd = None
2893
3163
if server_settings["socket"] != "":
2894
3164
socketfd = server_settings["socket"]
2908
3178
try:
2909
3179
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2910
3180
except IOError as e:
2911
logger.error("Could not open file %r", pidfilename,
2912
exc_info=e)
2913
2914
for name in ("_mandos", "mandos", "nobody"):
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3183
3184
for name, group in (("_mandos", "_mandos"),
3185
("mandos", "mandos"),
3186
("nobody", "nogroup")):
2915
3187
try:
2916
3188
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
3189
gid = pwd.getpwnam(group).pw_gid
2918
3190
break
2919
3191
except KeyError:
2920
3192
continue
2924
3196
try:
2925
3197
os.setgid(gid)
2926
3198
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
2927
3200
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
2928
3203
if error.errno != errno.EPERM:
2929
3204
raise
2930
3205
2931
3206
if debug:
2932
3207
# Enable all possible GnuTLS debugging
2933
3208
2934
3209
# "Use a log level over 10 to enable all debugging options."
2935
3210
# - GnuTLS manual
2936
3211
gnutls.global_set_log_level(11)
2937
3212
2938
3213
@gnutls.log_func
2939
3214
def debug_gnutls(level, string):
2940
logger.debug("GnuTLS: %s", string[:-1])
2941
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3217
2942
3218
gnutls.global_set_log_function(debug_gnutls)
2943
3219
2944
3220
# Redirect stdin so all checkers get /dev/null
2945
3221
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
3222
os.dup2(null, sys.stdin.fileno())
2947
3223
if null > 2:
2948
3224
os.close(null)
2949
3225
2950
3226
# Need to fork before connecting to D-Bus
2951
3227
if not foreground:
2952
3228
# Close all input and output, do double fork, etc.
2953
3229
daemon()
2954
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2958
3230
3231
if gi.version_info < (3, 10, 2):
3232
# multiprocessing will use threads, so before we use GLib we
3233
# need to inform GLib that threads will be used.
3234
GLib.threads_init()
3235
2959
3236
global main_loop
2960
3237
# From the Avahi example code
2961
3238
DBusGMainLoop(set_as_default=True)
2962
main_loop = gobject.MainLoop()
3239
main_loop = GLib.MainLoop()
2963
3240
bus = dbus.SystemBus()
2964
3241
# End of Avahi example code
2965
3242
if use_dbus:
2971
3248
"se.bsnet.fukt.Mandos", bus,
2972
3249
do_not_queue=True)
2973
3250
except dbus.exceptions.DBusException as e:
2974
logger.error("Disabling D-Bus:", exc_info=e)
3251
log.error("Disabling D-Bus:", exc_info=e)
2975
3252
use_dbus = False
2976
3253
server_settings["use_dbus"] = False
2977
3254
tcp_server.use_dbus = False
2978
3255
if zeroconf:
2979
3256
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3257
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
3258
name=server_settings["servicename"],
3259
servicetype="_mandos._tcp",
3260
protocol=protocol,
3261
bus=bus)
2985
3262
if server_settings["interface"]:
2986
3263
service.interface = if_nametoindex(
2987
3264
server_settings["interface"].encode("utf-8"))
2988
3265
2989
3266
global multiprocessing_manager
2990
3267
multiprocessing_manager = multiprocessing.Manager()
2991
3268
2992
3269
client_class = Client
2993
3270
if use_dbus:
2994
client_class = functools.partial(ClientDBus, bus = bus)
2995
3271
client_class = functools.partial(ClientDBus, bus=bus)
3272
2996
3273
client_settings = Client.config_parser(client_config)
2997
3274
old_client_settings = {}
2998
3275
clients_data = {}
2999
3276
3000
3277
# This is used to redirect stdout and stderr for checker processes
3001
3278
global wnull
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3279
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3280
# Only used if server is running in foreground but not in debug
3004
3281
# mode
3005
3282
if debug or not foreground:
3006
3283
wnull.close()
3007
3284
3008
3285
# Get client data and settings from last running state.
3009
3286
if server_settings["restore"]:
3010
3287
try:
3011
3288
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
3289
if sys.version_info.major == 2:
3290
clients_data, old_client_settings = pickle.load(
3291
stored_state)
3292
else:
3293
bytes_clients_data, bytes_old_client_settings = (
3294
pickle.load(stored_state, encoding="bytes"))
3295
# Fix bytes to strings
3296
# clients_data
3297
# .keys()
3298
clients_data = {(key.decode("utf-8")
3299
if isinstance(key, bytes)
3300
else key): value
3301
for key, value in
3302
bytes_clients_data.items()}
3303
del bytes_clients_data
3304
for key in clients_data:
3305
value = {(k.decode("utf-8")
3306
if isinstance(k, bytes) else k): v
3307
for k, v in
3308
clients_data[key].items()}
3309
clients_data[key] = value
3310
# .client_structure
3311
value["client_structure"] = [
3312
(s.decode("utf-8")
3313
if isinstance(s, bytes)
3314
else s) for s in
3315
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3318
if isinstance(value[k], bytes):
3319
value[k] = value[k].decode("utf-8")
3320
if "key_id" not in value:
3321
value["key_id"] = ""
3322
elif "fingerprint" not in value:
3323
value["fingerprint"] = ""
3324
# old_client_settings
3325
# .keys()
3326
old_client_settings = {
3327
(key.decode("utf-8")
3328
if isinstance(key, bytes)
3329
else key): value
3330
for key, value in
3331
bytes_old_client_settings.items()}
3332
del bytes_old_client_settings
3333
# .host and .checker_command
3334
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3338
.decode("utf-8"))
3014
3339
os.remove(stored_state_path)
3015
3340
except IOError as e:
3016
3341
if e.errno == errno.ENOENT:
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3019
3344
else:
3020
logger.critical("Could not load persistent state:",
3021
exc_info=e)
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3022
3347
raise
3023
3348
except EOFError as e:
3024
logger.warning("Could not load persistent state: "
3025
"EOFError:",
3026
exc_info=e)
3027
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3351
3028
3352
with PGPEngine() as pgp:
3029
3353
for client_name, client in clients_data.items():
3030
3354
# Skip removed clients
3031
3355
if client_name not in client_settings:
3032
3356
continue
3033
3357
3034
3358
# Decide which value to use after restoring saved state.
3035
3359
# We have three different values: Old config file,
3036
3360
# new config file, and saved state.
3047
3371
client[name] = value
3048
3372
except KeyError:
3049
3373
pass
3050
3374
3051
3375
# Clients who has passed its expire date can still be
3052
3376
# enabled if its last checker was successful. A Client
3053
3377
# whose checker succeeded before we stored its state is
3056
3380
if client["enabled"]:
3057
3381
if datetime.datetime.utcnow() >= client["expires"]:
3058
3382
if not client["last_checked_ok"]:
3059
logger.warning(
3060
"disabling client {} - Client never "
3061
"performed a successful checker".format(
3062
client_name))
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3063
3386
client["enabled"] = False
3064
3387
elif client["last_checker_status"] != 0:
3065
logger.warning(
3066
"disabling client {} - Client last"
3067
" checker failed with error code"
3068
" {}".format(
3069
client_name,
3070
client["last_checker_status"]))
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3071
3392
client["enabled"] = False
3072
3393
else:
3073
3394
client["expires"] = (
3074
3395
datetime.datetime.utcnow()
3075
3396
+ client["timeout"])
3076
logger.debug("Last checker succeeded,"
3077
" keeping {} enabled".format(
3078
client_name))
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3079
3399
try:
3080
3400
client["secret"] = pgp.decrypt(
3081
3401
client["encrypted_secret"],
3082
3402
client_settings[client_name]["secret"])
3083
3403
except PGPError:
3084
3404
# If decryption fails, we use secret from new settings
3085
logger.debug("Failed to decrypt {} old secret".format(
3086
client_name))
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3087
3407
client["secret"] = (client_settings[client_name]
3088
3408
["secret"])
3089
3409
3090
3410
# Add/remove clients based on new changes made to config
3091
3411
for client_name in (set(old_client_settings)
3092
3412
- set(client_settings)):
3094
3414
for client_name in (set(client_settings)
3095
3415
- set(old_client_settings)):
3096
3416
clients_data[client_name] = client_settings[client_name]
3097
3417
3098
3418
# Create all client objects
3099
3419
for client_name, client in clients_data.items():
3100
3420
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
3103
server_settings = server_settings)
3104
3421
name=client_name,
3422
settings=client,
3423
server_settings=server_settings)
3424
3105
3425
if not tcp_server.clients:
3106
logger.warning("No clients defined")
3107
3426
log.warning("No clients defined")
3427
3108
3428
if not foreground:
3109
3429
if pidfile is not None:
3110
3430
pid = os.getpid()
3112
3432
with pidfile:
3113
3433
print(pid, file=pidfile)
3114
3434
except IOError:
3115
logger.error("Could not write to file %r with PID %d",
3116
pidfilename, pid)
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3117
3437
del pidfile
3118
3438
del pidfilename
3119
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
3439
3440
for termsig in (signal.SIGHUP, signal.SIGTERM):
3441
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3442
lambda: main_loop.quit() and False)
3443
3123
3444
if use_dbus:
3124
3445
3125
3446
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3447
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3448
class MandosDBusService(DBusObjectWithObjectManager):
3128
3449
"""A D-Bus proxy object"""
3129
3450
3130
3451
def __init__(self):
3131
3452
dbus.service.Object.__init__(self, bus, "/")
3132
3453
3133
3454
_interface = "se.recompile.Mandos"
3134
3455
3135
3456
@dbus.service.signal(_interface, signature="o")
3136
3457
def ClientAdded(self, objpath):
3137
3458
"D-Bus signal"
3138
3459
pass
3139
3460
3140
3461
@dbus.service.signal(_interface, signature="ss")
3141
def ClientNotFound(self, fingerprint, address):
3462
def ClientNotFound(self, key_id, address):
3142
3463
"D-Bus signal"
3143
3464
pass
3144
3465
3145
3466
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
3467
"true"})
3147
3468
@dbus.service.signal(_interface, signature="os")
3148
3469
def ClientRemoved(self, objpath, name):
3149
3470
"D-Bus signal"
3150
3471
pass
3151
3472
3152
3473
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
3474
"true"})
3154
3475
@dbus.service.method(_interface, out_signature="ao")
3155
3476
def GetAllClients(self):
3156
3477
"D-Bus method"
3157
3478
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3159
3479
tcp_server.clients.values())
3480
3160
3481
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
3482
"true"})
3162
3483
@dbus.service.method(_interface,
3164
3485
def GetAllClientsWithProperties(self):
3165
3486
"D-Bus method"
3166
3487
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3488
{c.dbus_object_path: c.GetAll(
3168
3489
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3490
for c in tcp_server.clients.values()},
3170
3491
signature="oa{sv}")
3171
3492
3172
3493
@dbus.service.method(_interface, in_signature="o")
3173
3494
def RemoveClient(self, object_path):
3174
3495
"D-Bus method"
3175
for c in tcp_server.clients.itervalues():
3496
for c in tcp_server.clients.values():
3176
3497
if c.dbus_object_path == object_path:
3177
3498
del tcp_server.clients[c.name]
3178
3499
c.remove_from_connection()
3182
3503
self.client_removed_signal(c)
3183
3504
return
3184
3505
raise KeyError(object_path)
3185
3506
3186
3507
del _interface
3187
3508
3188
3509
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3510
out_signature="a{oa{sa{sv}}}")
3190
3511
def GetManagedObjects(self):
3191
3512
"""D-Bus method"""
3192
3513
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3514
{client.dbus_object_path:
3515
dbus.Dictionary(
3516
{interface: client.GetAll(interface)
3517
for interface in
3518
client._get_all_interface_names()})
3519
for client in tcp_server.clients.values()})
3520
3200
3521
def client_added_signal(self, client):
3201
3522
"""Send the new standard signal and the old signal"""
3202
3523
if use_dbus:
3204
3525
self.InterfacesAdded(
3205
3526
client.dbus_object_path,
3206
3527
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3528
{interface: client.GetAll(interface)
3529
for interface in
3530
client._get_all_interface_names()}))
3210
3531
# Old signal
3211
3532
self.ClientAdded(client.dbus_object_path)
3212
3533
3213
3534
def client_removed_signal(self, client):
3214
3535
"""Send the new standard signal and the old signal"""
3215
3536
if use_dbus:
3220
3541
# Old signal
3221
3542
self.ClientRemoved(client.dbus_object_path,
3222
3543
client.name)
3223
3544
3224
3545
mandos_dbus_service = MandosDBusService()
3225
3546
3547
# Save modules to variables to exempt the modules from being
3548
# unloaded before the function registered with atexit() is run.
3549
mp = multiprocessing
3550
wn = wnull
3551
3226
3552
def cleanup():
3227
3553
"Cleanup function; run on exit"
3228
3554
if zeroconf:
3229
3555
service.cleanup()
3230
3231
multiprocessing.active_children()
3232
wnull.close()
3556
3557
mp.active_children()
3558
wn.close()
3233
3559
if not (tcp_server.clients or client_settings):
3234
3560
return
3235
3561
3236
3562
# Store client before exiting. Secrets are encrypted with key
3237
3563
# based on what config file has. If config file is
3238
3564
# removed/edited, old secret will thus be unrecovable.
3239
3565
clients = {}
3240
3566
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3567
for client in tcp_server.clients.values():
3242
3568
key = client_settings[client.name]["secret"]
3243
3569
client.encrypted_secret = pgp.encrypt(client.secret,
3244
3570
key)
3245
3571
client_dict = {}
3246
3572
3247
3573
# A list of attributes that can not be pickled
3248
3574
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3575
exclude = {"bus", "changedstate", "secret",
3576
"checker", "server_settings"}
3251
3577
for name, typ in inspect.getmembers(dbus.service
3252
3578
.Object):
3253
3579
exclude.add(name)
3254
3580
3255
3581
client_dict["encrypted_secret"] = (client
3256
3582
.encrypted_secret)
3257
3583
for attr in client.client_structure:
3258
3584
if attr not in exclude:
3259
3585
client_dict[attr] = getattr(client, attr)
3260
3586
3261
3587
clients[client.name] = client_dict
3262
3588
del client_settings[client.name]["secret"]
3263
3589
3264
3590
try:
3265
3591
with tempfile.NamedTemporaryFile(
3266
mode='wb',
3592
mode="wb",
3267
3593
suffix=".pickle",
3268
prefix='clients-',
3594
prefix="clients-",
3269
3595
dir=os.path.dirname(stored_state_path),
3270
3596
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3597
pickle.dump((clients, client_settings), stored_state,
3598
protocol=2)
3272
3599
tempname = stored_state.name
3273
3600
os.rename(tempname, stored_state_path)
3274
3601
except (IOError, OSError) as e:
3278
3605
except NameError:
3279
3606
pass
3280
3607
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3281
logger.warning("Could not save persistent state: {}"
3282
.format(os.strerror(e.errno)))
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3283
3610
else:
3284
logger.warning("Could not save persistent state:",
3285
exc_info=e)
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3286
3613
raise
3287
3614
3288
3615
# Delete all clients, and settings from config
3289
3616
while tcp_server.clients:
3290
3617
name, client = tcp_server.clients.popitem()
3296
3623
if use_dbus:
3297
3624
mandos_dbus_service.client_removed_signal(client)
3298
3625
client_settings.clear()
3299
3626
3300
3627
atexit.register(cleanup)
3301
3302
for client in tcp_server.clients.itervalues():
3628
3629
for client in tcp_server.clients.values():
3303
3630
if use_dbus:
3304
3631
# Emit D-Bus signal for adding
3305
3632
mandos_dbus_service.client_added_signal(client)
3306
3633
# Need to initiate checking of clients
3307
3634
if client.enabled:
3308
client.init_checker()
3309
3635
client.init_checker(randomize_start=True)
3636
3310
3637
tcp_server.enable()
3311
3638
tcp_server.server_activate()
3312
3639
3313
3640
# Find out what port we got
3314
3641
if zeroconf:
3315
3642
service.port = tcp_server.socket.getsockname()[1]
3316
3643
if use_ipv6:
3317
logger.info("Now listening on address %r, port %d,"
3318
" flowinfo %d, scope_id %d",
3319
*tcp_server.socket.getsockname())
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3320
3646
else: # IPv4
3321
logger.info("Now listening on address %r, port %d",
3322
*tcp_server.socket.getsockname())
3323
3324
#service.interface = tcp_server.socket.getsockname()[3]
3325
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3649
3650
# service.interface = tcp_server.socket.getsockname()[3]
3651
3326
3652
try:
3327
3653
if zeroconf:
3328
3654
# From the Avahi example code
3329
3655
try:
3330
3656
service.activate()
3331
3657
except dbus.exceptions.DBusException as error:
3332
logger.critical("D-Bus Exception", exc_info=error)
3658
log.critical("D-Bus Exception", exc_info=error)
3333
3659
cleanup()
3334
3660
sys.exit(1)
3335
3661
# End of Avahi example code
3336
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3341
3342
logger.debug("Starting main loop")
3662
3663
GLib.io_add_watch(
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3668
3669
log.debug("Starting main loop")
3343
3670
main_loop.run()
3344
3671
except AvahiError as error:
3345
logger.critical("Avahi Error", exc_info=error)
3672
log.critical("Avahi Error", exc_info=error)
3346
3673
cleanup()
3347
3674
sys.exit(1)
3348
3675
except KeyboardInterrupt:
3349
3676
if debug:
3350
3677
print("", file=sys.stderr)
3351
logger.debug("Server received KeyboardInterrupt")
3352
logger.debug("Server exiting")
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3353
3680
# Must run before the D-Bus bus name gets deregistered
3354
3681
cleanup()
3355
3682
3356
3357
if __name__ == '__main__':
3358
main()
3683
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3693
return args
3694
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3697
import doctest
3698
tests.addTests(doctest.DocTestSuite())
3699
return tests
3700
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3703
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3716
else:
3717
main()
3718
finally:
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0