To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1318
- compare with another revision
- download diff
- download tarball
- view history from revision 1318
- Committer: Teddy Hogeborn
- Date: 2025-06-14 15:37:45 UTC
- Revision ID: teddy@recompile.se-20250614153745-1labvcqq11fuijy4
debian/control: Require cryptsetup support in systemd
* debian/control (Package: mandos-client/Depends): Add dependency on
"systemd-cryptsetup" (for newer systemd), or "systemd (<< 256-2)"
for when cryptsetup support was included in the systemd package
itself, or "sysvinit-core" for installations without systemd.
* debian/control (Package: mandos-client/Depends): Add dependency on
"systemd-cryptsetup" (for newer systemd), or "systemd (<< 256-2)"
for when cryptsetup support was included in the systemd package
itself, or "sysvinit-core" for installations without systemd.
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
33
#
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
39
39
except ImportError:
40
40
pass
41
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
42
47
try:
43
48
import SocketServer as socketserver
44
49
except ImportError:
45
50
import socketserver
46
51
import socket
47
import argparse
48
52
import datetime
49
53
import errno
50
54
try:
51
55
import ConfigParser as configparser
52
56
except ImportError:
53
57
import configparser
54
import sys
55
58
import re
56
import os
57
59
import signal
58
60
import subprocess
59
61
import atexit
60
62
import stat
61
import logging
62
63
import logging.handlers
63
64
import pwd
64
65
import contextlib
76
77
import itertools
77
78
import collections
78
79
import codecs
80
import random
81
import shlex
79
82
80
83
import dbus
81
84
import dbus.service
85
import gi
82
86
from gi.repository import GLib
83
87
from dbus.mainloop.glib import DBusGMainLoop
84
88
import ctypes
86
90
import xml.dom.minidom
87
91
import inspect
88
92
89
try:
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Add os.set_inheritable if it does not exist
114
try:
115
os.set_inheritable
116
except AttributeError:
117
def set_inheritable(fd, inheritable):
118
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
119
if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):
120
fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)
121
elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):
122
fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)
123
os.set_inheritable = set_inheritable
124
del set_inheritable
125
126
# Show warnings by default
127
if not sys.warnoptions:
128
import warnings
129
warnings.simplefilter("default")
130
131
# Try to find the value of SO_BINDTODEVICE:
132
try:
133
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
134
# newer, and it is also the most natural place for it:
90
135
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
91
136
except AttributeError:
92
137
try:
138
# This is where SO_BINDTODEVICE was up to and including Python
139
# 2.6, and also 3.2:
93
140
from IN import SO_BINDTODEVICE
94
141
except ImportError:
95
SO_BINDTODEVICE = None
96
97
if sys.version_info.major == 2:
98
str = unicode
99
100
version = "1.7.7"
142
# In Python 2.7 it seems to have been removed entirely.
143
# Try running the C preprocessor:
144
try:
145
cc = subprocess.Popen(["cc", "--language=c", "-E",
146
"/dev/stdin"],
147
stdin=subprocess.PIPE,
148
stdout=subprocess.PIPE)
149
stdout = cc.communicate(
150
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
151
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
152
except (OSError, ValueError, IndexError):
153
# No value found
154
SO_BINDTODEVICE = None
155
156
if sys.version_info < (3, 2):
157
configparser.Configparser = configparser.SafeConfigParser
158
159
version = "1.8.18"
101
160
stored_state_file = "clients.pickle"
102
161
103
logger = logging.getLogger()
162
log = logging.getLogger(os.path.basename(sys.argv[0]))
163
logging.captureWarnings(True) # Show warnings via the logging system
104
164
syslogger = None
105
165
106
166
try:
107
167
if_nametoindex = ctypes.cdll.LoadLibrary(
108
168
ctypes.util.find_library("c")).if_nametoindex
109
169
except (OSError, AttributeError):
110
170
111
171
def if_nametoindex(interface):
112
172
"Get an interface index the hard way, i.e. using fcntl()"
113
173
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
136
196
137
197
def initlogger(debug, level=logging.WARNING):
138
198
"""init logger and add loglevel"""
139
199
140
200
global syslogger
141
201
syslogger = (logging.handlers.SysLogHandler(
142
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
143
address = "/dev/log"))
202
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
203
address="/dev/log"))
144
204
syslogger.setFormatter(logging.Formatter
145
('Mandos [%(process)d]: %(levelname)s:'
146
' %(message)s'))
147
logger.addHandler(syslogger)
148
205
("Mandos [%(process)d]: %(levelname)s:"
206
" %(message)s"))
207
log.addHandler(syslogger)
208
149
209
if debug:
150
210
console = logging.StreamHandler()
151
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
152
' [%(process)d]:'
153
' %(levelname)s:'
154
' %(message)s'))
155
logger.addHandler(console)
156
logger.setLevel(level)
211
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
212
" [%(process)d]:"
213
" %(levelname)s:"
214
" %(message)s"))
215
log.addHandler(console)
216
log.setLevel(level)
157
217
158
218
159
219
class PGPError(Exception):
161
221
pass
162
222
163
223
164
class PGPEngine(object):
224
class PGPEngine:
165
225
"""A simple class for OpenPGP symmetric encryption & decryption"""
166
226
167
227
def __init__(self):
168
228
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
169
229
self.gpg = "gpg"
171
231
output = subprocess.check_output(["gpgconf"])
172
232
for line in output.splitlines():
173
233
name, text, path = line.split(b":")
174
if name == "gpg":
234
if name == b"gpg":
175
235
self.gpg = path
176
236
break
177
237
except OSError as e:
178
238
if e.errno != errno.ENOENT:
179
239
raise
180
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
182
'--force-mdc',
183
'--quiet',
184
'--no-use-agent']
185
240
self.gnupgargs = ["--batch",
241
"--homedir", self.tempdir,
242
"--force-mdc",
243
"--quiet"]
244
# Only GPG version 1 has the --no-use-agent option.
245
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
246
self.gnupgargs.append("--no-use-agent")
247
186
248
def __enter__(self):
187
249
return self
188
250
189
251
def __exit__(self, exc_type, exc_value, traceback):
190
252
self._cleanup()
191
253
return False
192
254
193
255
def __del__(self):
194
256
self._cleanup()
195
257
196
258
def _cleanup(self):
197
259
if self.tempdir is not None:
198
260
# Delete contents of tempdir
199
261
for root, dirs, files in os.walk(self.tempdir,
200
topdown = False):
262
topdown=False):
201
263
for filename in files:
202
264
os.remove(os.path.join(root, filename))
203
265
for dirname in dirs:
205
267
# Remove tempdir
206
268
os.rmdir(self.tempdir)
207
269
self.tempdir = None
208
270
209
271
def password_encode(self, password):
210
272
# Passphrase can not be empty and can not contain newlines or
211
273
# NUL bytes. So we prefix it and hex encode it.
216
278
.replace(b"\n", b"\\n")
217
279
.replace(b"\0", b"\\x00"))
218
280
return encoded
219
281
220
282
def encrypt(self, data, password):
221
283
passphrase = self.password_encode(password)
222
284
with tempfile.NamedTemporaryFile(
223
285
dir=self.tempdir) as passfile:
224
286
passfile.write(passphrase)
225
287
passfile.flush()
226
proc = subprocess.Popen([self.gpg, '--symmetric',
227
'--passphrase-file',
288
proc = subprocess.Popen([self.gpg, "--symmetric",
289
"--passphrase-file",
228
290
passfile.name]
229
291
+ self.gnupgargs,
230
stdin = subprocess.PIPE,
231
stdout = subprocess.PIPE,
232
stderr = subprocess.PIPE)
233
ciphertext, err = proc.communicate(input = data)
292
stdin=subprocess.PIPE,
293
stdout=subprocess.PIPE,
294
stderr=subprocess.PIPE)
295
ciphertext, err = proc.communicate(input=data)
234
296
if proc.returncode != 0:
235
297
raise PGPError(err)
236
298
return ciphertext
237
299
238
300
def decrypt(self, data, password):
239
301
passphrase = self.password_encode(password)
240
302
with tempfile.NamedTemporaryFile(
241
dir = self.tempdir) as passfile:
303
dir=self.tempdir) as passfile:
242
304
passfile.write(passphrase)
243
305
passfile.flush()
244
proc = subprocess.Popen([self.gpg, '--decrypt',
245
'--passphrase-file',
306
proc = subprocess.Popen([self.gpg, "--decrypt",
307
"--passphrase-file",
246
308
passfile.name]
247
309
+ self.gnupgargs,
248
stdin = subprocess.PIPE,
249
stdout = subprocess.PIPE,
250
stderr = subprocess.PIPE)
251
decrypted_plaintext, err = proc.communicate(input = data)
310
stdin=subprocess.PIPE,
311
stdout=subprocess.PIPE,
312
stderr=subprocess.PIPE)
313
decrypted_plaintext, err = proc.communicate(input=data)
252
314
if proc.returncode != 0:
253
315
raise PGPError(err)
254
316
return decrypted_plaintext
255
317
318
256
319
# Pretend that we have an Avahi module
257
class Avahi(object):
258
"""This isn't so much a class as it is a module-like namespace.
259
It is instantiated once, and simulates having an Avahi module."""
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
320
class avahi:
321
"""This isn't so much a class as it is a module-like namespace."""
322
IF_UNSPEC = -1 # avahi-common/address.h
323
PROTO_UNSPEC = -1 # avahi-common/address.h
324
PROTO_INET = 0 # avahi-common/address.h
325
PROTO_INET6 = 1 # avahi-common/address.h
264
326
DBUS_NAME = "org.freedesktop.Avahi"
265
327
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
266
328
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
267
329
DBUS_PATH_SERVER = "/"
268
def string_array_to_txt_array(self, t):
330
331
@staticmethod
332
def string_array_to_txt_array(t):
269
333
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
270
334
for s in t), signature="ay")
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
279
avahi = Avahi()
335
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
336
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
337
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
338
SERVER_INVALID = 0 # avahi-common/defs.h
339
SERVER_REGISTERING = 1 # avahi-common/defs.h
340
SERVER_RUNNING = 2 # avahi-common/defs.h
341
SERVER_COLLISION = 3 # avahi-common/defs.h
342
SERVER_FAILURE = 4 # avahi-common/defs.h
343
280
344
281
345
class AvahiError(Exception):
282
346
def __init__(self, value, *args, **kwargs):
293
357
pass
294
358
295
359
296
class AvahiService(object):
360
class AvahiService:
297
361
"""An Avahi (Zeroconf) service.
298
362
299
363
Attributes:
300
364
interface: integer; avahi.IF_UNSPEC or an interface index.
301
365
Used to optionally bind to the specified interface.
302
name: string; Example: 'Mandos'
303
type: string; Example: '_mandos._tcp'.
366
name: string; Example: "Mandos"
367
type: string; Example: "_mandos._tcp".
304
368
See <https://www.iana.org/assignments/service-names-port-numbers>
305
369
port: integer; what port to announce
306
370
TXT: list of strings; TXT record for the service
313
377
server: D-Bus Server
314
378
bus: dbus.SystemBus()
315
379
"""
316
380
317
381
def __init__(self,
318
interface = avahi.IF_UNSPEC,
319
name = None,
320
servicetype = None,
321
port = None,
322
TXT = None,
323
domain = "",
324
host = "",
325
max_renames = 32768,
326
protocol = avahi.PROTO_UNSPEC,
327
bus = None):
382
interface=avahi.IF_UNSPEC,
383
name=None,
384
servicetype=None,
385
port=None,
386
TXT=None,
387
domain="",
388
host="",
389
max_renames=32768,
390
protocol=avahi.PROTO_UNSPEC,
391
bus=None):
328
392
self.interface = interface
329
393
self.name = name
330
394
self.type = servicetype
339
403
self.server = None
340
404
self.bus = bus
341
405
self.entry_group_state_changed_match = None
342
406
343
407
def rename(self, remove=True):
344
408
"""Derived from the Avahi example code"""
345
409
if self.rename_count >= self.max_renames:
346
logger.critical("No suitable Zeroconf service name found"
347
" after %i retries, exiting.",
348
self.rename_count)
410
log.critical("No suitable Zeroconf service name found"
411
" after %i retries, exiting.",
412
self.rename_count)
349
413
raise AvahiServiceError("Too many renames")
350
414
self.name = str(
351
415
self.server.GetAlternativeServiceName(self.name))
352
416
self.rename_count += 1
353
logger.info("Changing Zeroconf service name to %r ...",
354
self.name)
417
log.info("Changing Zeroconf service name to %r ...",
418
self.name)
355
419
if remove:
356
420
self.remove()
357
421
try:
359
423
except dbus.exceptions.DBusException as error:
360
424
if (error.get_dbus_name()
361
425
== "org.freedesktop.Avahi.CollisionError"):
362
logger.info("Local Zeroconf service name collision.")
426
log.info("Local Zeroconf service name collision.")
363
427
return self.rename(remove=False)
364
428
else:
365
logger.critical("D-Bus Exception", exc_info=error)
429
log.critical("D-Bus Exception", exc_info=error)
366
430
self.cleanup()
367
431
os._exit(1)
368
432
369
433
def remove(self):
370
434
"""Derived from the Avahi example code"""
371
435
if self.entry_group_state_changed_match is not None:
373
437
self.entry_group_state_changed_match = None
374
438
if self.group is not None:
375
439
self.group.Reset()
376
440
377
441
def add(self):
378
442
"""Derived from the Avahi example code"""
379
443
self.remove()
384
448
avahi.DBUS_INTERFACE_ENTRY_GROUP)
385
449
self.entry_group_state_changed_match = (
386
450
self.group.connect_to_signal(
387
'StateChanged', self.entry_group_state_changed))
388
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
389
self.name, self.type)
451
"StateChanged", self.entry_group_state_changed))
452
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
453
self.name, self.type)
390
454
self.group.AddService(
391
455
self.interface,
392
456
self.protocol,
396
460
dbus.UInt16(self.port),
397
461
avahi.string_array_to_txt_array(self.TXT))
398
462
self.group.Commit()
399
463
400
464
def entry_group_state_changed(self, state, error):
401
465
"""Derived from the Avahi example code"""
402
logger.debug("Avahi entry group state change: %i", state)
403
466
log.debug("Avahi entry group state change: %i", state)
467
404
468
if state == avahi.ENTRY_GROUP_ESTABLISHED:
405
logger.debug("Zeroconf service established.")
469
log.debug("Zeroconf service established.")
406
470
elif state == avahi.ENTRY_GROUP_COLLISION:
407
logger.info("Zeroconf service name collision.")
471
log.info("Zeroconf service name collision.")
408
472
self.rename()
409
473
elif state == avahi.ENTRY_GROUP_FAILURE:
410
logger.critical("Avahi: Error in group state changed %s",
411
str(error))
474
log.critical("Avahi: Error in group state changed %s",
475
str(error))
412
476
raise AvahiGroupError("State changed: {!s}".format(error))
413
477
414
478
def cleanup(self):
415
479
"""Derived from the Avahi example code"""
416
480
if self.group is not None:
421
485
pass
422
486
self.group = None
423
487
self.remove()
424
488
425
489
def server_state_changed(self, state, error=None):
426
490
"""Derived from the Avahi example code"""
427
logger.debug("Avahi server state change: %i", state)
491
log.debug("Avahi server state change: %i", state)
428
492
bad_states = {
429
493
avahi.SERVER_INVALID: "Zeroconf server invalid",
430
494
avahi.SERVER_REGISTERING: None,
434
498
if state in bad_states:
435
499
if bad_states[state] is not None:
436
500
if error is None:
437
logger.error(bad_states[state])
501
log.error(bad_states[state])
438
502
else:
439
logger.error(bad_states[state] + ": %r", error)
503
log.error(bad_states[state] + ": %r", error)
440
504
self.cleanup()
441
505
elif state == avahi.SERVER_RUNNING:
442
506
try:
444
508
except dbus.exceptions.DBusException as error:
445
509
if (error.get_dbus_name()
446
510
== "org.freedesktop.Avahi.CollisionError"):
447
logger.info("Local Zeroconf service name"
448
" collision.")
511
log.info("Local Zeroconf service name collision.")
449
512
return self.rename(remove=False)
450
513
else:
451
logger.critical("D-Bus Exception", exc_info=error)
514
log.critical("D-Bus Exception", exc_info=error)
452
515
self.cleanup()
453
516
os._exit(1)
454
517
else:
455
518
if error is None:
456
logger.debug("Unknown state: %r", state)
519
log.debug("Unknown state: %r", state)
457
520
else:
458
logger.debug("Unknown state: %r: %r", state, error)
459
521
log.debug("Unknown state: %r: %r", state, error)
522
460
523
def activate(self):
461
524
"""Derived from the Avahi example code"""
462
525
if self.server is None:
473
536
class AvahiServiceToSyslog(AvahiService):
474
537
def rename(self, *args, **kwargs):
475
538
"""Add the new name to the syslog messages"""
476
ret = AvahiService.rename(self, *args, **kwargs)
539
ret = super(AvahiServiceToSyslog, self).rename(*args,
540
**kwargs)
477
541
syslogger.setFormatter(logging.Formatter(
478
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
542
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
479
543
.format(self.name)))
480
544
return ret
481
545
546
482
547
# Pretend that we have a GnuTLS module
483
class GnuTLS(object):
484
"""This isn't so much a class as it is a module-like namespace.
485
It is instantiated once, and simulates having a GnuTLS module."""
486
487
_library = ctypes.cdll.LoadLibrary(
488
ctypes.util.find_library("gnutls"))
489
_need_version = b"3.3.0"
490
def __init__(self):
491
# Need to use class name "GnuTLS" here, since this method is
492
# called before the assignment to the "gnutls" global variable
493
# happens.
494
if GnuTLS.check_version(self._need_version) is None:
495
raise GnuTLS.Error("Needs GnuTLS {} or later"
496
.format(self._need_version))
497
548
class gnutls:
549
"""This isn't so much a class as it is a module-like namespace."""
550
551
library = ctypes.util.find_library("gnutls")
552
if library is None:
553
library = ctypes.util.find_library("gnutls-deb0")
554
_library = ctypes.cdll.LoadLibrary(library)
555
del library
556
498
557
# Unless otherwise indicated, the constants and types below are
499
558
# all from the gnutls/gnutls.h C header file.
500
559
501
560
# Constants
502
561
E_SUCCESS = 0
503
562
E_INTERRUPTED = -52
504
563
E_AGAIN = -28
505
564
CRT_OPENPGP = 2
565
CRT_RAWPK = 3
506
566
CLIENT = 2
507
567
SHUT_RDWR = 0
508
568
CRD_CERTIFICATE = 1
509
569
E_NO_CERTIFICATE_FOUND = -49
570
X509_FMT_DER = 0
571
NO_TICKETS = 1<<10
572
ENABLE_RAWPK = 1<<18
573
CTYPE_PEERS = 3
574
KEYID_USE_SHA256 = 1 # gnutls/x509.h
510
575
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
511
576
512
577
# Types
513
class session_int(ctypes.Structure):
578
class _session_int(ctypes.Structure):
514
579
_fields_ = []
515
session_t = ctypes.POINTER(session_int)
580
session_t = ctypes.POINTER(_session_int)
581
516
582
class certificate_credentials_st(ctypes.Structure):
517
583
_fields_ = []
518
584
certificate_credentials_t = ctypes.POINTER(
519
585
certificate_credentials_st)
520
586
certificate_type_t = ctypes.c_int
587
521
588
class datum_t(ctypes.Structure):
522
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
523
('size', ctypes.c_uint)]
524
class openpgp_crt_int(ctypes.Structure):
589
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
590
("size", ctypes.c_uint)]
591
592
class _openpgp_crt_int(ctypes.Structure):
525
593
_fields_ = []
526
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
594
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
595
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
528
596
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
529
597
credentials_type_t = ctypes.c_int
530
598
transport_ptr_t = ctypes.c_void_p
531
599
close_request_t = ctypes.c_int
532
600
533
601
# Exceptions
534
602
class Error(Exception):
535
# We need to use the class name "GnuTLS" here, since this
536
# exception might be raised from within GnuTLS.__init__,
537
# which is called before the assignment to the "gnutls"
538
# global variable has happened.
539
def __init__(self, message = None, code = None, args=()):
603
def __init__(self, message=None, code=None, args=()):
540
604
# Default usage is by a message string, but if a return
541
605
# code is passed, convert it to a string with
542
606
# gnutls.strerror()
543
607
self.code = code
544
608
if message is None and code is not None:
545
message = GnuTLS.strerror(code)
546
return super(GnuTLS.Error, self).__init__(
609
message = gnutls.strerror(code).decode(
610
"utf-8", errors="replace")
611
return super(gnutls.Error, self).__init__(
547
612
message, *args)
548
613
549
614
class CertificateSecurityError(Error):
550
615
pass
551
616
617
class PointerTo:
618
def __init__(self, cls):
619
self.cls = cls
620
621
def from_param(self, obj):
622
if not isinstance(obj, self.cls):
623
raise TypeError("Not of type {}: {!r}"
624
.format(self.cls.__name__, obj))
625
return ctypes.byref(obj.from_param(obj))
626
627
class CastToVoidPointer:
628
def __init__(self, cls):
629
self.cls = cls
630
631
def from_param(self, obj):
632
if not isinstance(obj, self.cls):
633
raise TypeError("Not of type {}: {!r}"
634
.format(self.cls.__name__, obj))
635
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
636
637
class With_from_param:
638
@classmethod
639
def from_param(cls, obj):
640
return obj._as_parameter_
641
552
642
# Classes
553
class Credentials(object):
643
class Credentials(With_from_param):
554
644
def __init__(self):
555
self._c_object = gnutls.certificate_credentials_t()
556
gnutls.certificate_allocate_credentials(
557
ctypes.byref(self._c_object))
645
self._as_parameter_ = gnutls.certificate_credentials_t()
646
gnutls.certificate_allocate_credentials(self)
558
647
self.type = gnutls.CRD_CERTIFICATE
559
648
560
649
def __del__(self):
561
gnutls.certificate_free_credentials(self._c_object)
562
563
class ClientSession(object):
564
def __init__(self, socket, credentials = None):
565
self._c_object = gnutls.session_t()
566
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
567
gnutls.set_default_priority(self._c_object)
568
gnutls.transport_set_ptr(self._c_object, socket.fileno())
569
gnutls.handshake_set_private_extensions(self._c_object,
570
True)
650
gnutls.certificate_free_credentials(self)
651
652
class ClientSession(With_from_param):
653
def __init__(self, socket, credentials=None):
654
self._as_parameter_ = gnutls.session_t()
655
gnutls_flags = gnutls.CLIENT
656
if gnutls.check_version(b"3.5.6"):
657
gnutls_flags |= gnutls.NO_TICKETS
658
if gnutls.has_rawpk:
659
gnutls_flags |= gnutls.ENABLE_RAWPK
660
gnutls.init(self, gnutls_flags)
661
del gnutls_flags
662
gnutls.set_default_priority(self)
663
gnutls.transport_set_ptr(self, socket.fileno())
664
gnutls.handshake_set_private_extensions(self, True)
571
665
self.socket = socket
572
666
if credentials is None:
573
667
credentials = gnutls.Credentials()
574
gnutls.credentials_set(self._c_object, credentials.type,
575
ctypes.cast(credentials._c_object,
576
ctypes.c_void_p))
668
gnutls.credentials_set(self, credentials.type,
669
credentials)
577
670
self.credentials = credentials
578
671
579
672
def __del__(self):
580
gnutls.deinit(self._c_object)
581
673
gnutls.deinit(self)
674
582
675
def handshake(self):
583
return gnutls.handshake(self._c_object)
584
676
return gnutls.handshake(self)
677
585
678
def send(self, data):
586
679
data = bytes(data)
587
680
data_len = len(data)
588
681
while data_len > 0:
589
data_len -= gnutls.record_send(self._c_object,
590
data[-data_len:],
682
data_len -= gnutls.record_send(self, data[-data_len:],
591
683
data_len)
592
684
593
685
def bye(self):
594
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
595
686
return gnutls.bye(self, gnutls.SHUT_RDWR)
687
596
688
# Error handling functions
597
689
def _error_code(result):
598
690
"""A function to raise exceptions on errors, suitable
599
for the 'restype' attribute on ctypes functions"""
600
if result >= 0:
691
for the "restype" attribute on ctypes functions"""
692
if result >= gnutls.E_SUCCESS:
601
693
return result
602
694
if result == gnutls.E_NO_CERTIFICATE_FOUND:
603
raise gnutls.CertificateSecurityError(code = result)
604
raise gnutls.Error(code = result)
605
606
def _retry_on_error(result, func, arguments):
695
raise gnutls.CertificateSecurityError(code=result)
696
raise gnutls.Error(code=result)
697
698
def _retry_on_error(result, func, arguments,
699
_error_code=_error_code):
607
700
"""A function to retry on some errors, suitable
608
for the 'errcheck' attribute on ctypes functions"""
609
while result < 0:
701
for the "errcheck" attribute on ctypes functions"""
702
while result < gnutls.E_SUCCESS:
610
703
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
611
704
return _error_code(result)
612
705
result = func(*arguments)
613
706
return result
614
707
615
708
# Unless otherwise indicated, the function declarations below are
616
709
# all from the gnutls/gnutls.h C header file.
617
710
618
711
# Functions
619
712
priority_set_direct = _library.gnutls_priority_set_direct
620
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
713
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
621
714
ctypes.POINTER(ctypes.c_char_p)]
622
715
priority_set_direct.restype = _error_code
623
716
624
717
init = _library.gnutls_init
625
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
718
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
626
719
init.restype = _error_code
627
720
628
721
set_default_priority = _library.gnutls_set_default_priority
629
set_default_priority.argtypes = [session_t]
722
set_default_priority.argtypes = [ClientSession]
630
723
set_default_priority.restype = _error_code
631
724
632
725
record_send = _library.gnutls_record_send
633
record_send.argtypes = [session_t, ctypes.c_void_p,
726
record_send.argtypes = [ClientSession, ctypes.c_void_p,
634
727
ctypes.c_size_t]
635
728
record_send.restype = ctypes.c_ssize_t
636
729
record_send.errcheck = _retry_on_error
637
730
638
731
certificate_allocate_credentials = (
639
732
_library.gnutls_certificate_allocate_credentials)
640
733
certificate_allocate_credentials.argtypes = [
641
ctypes.POINTER(certificate_credentials_t)]
734
PointerTo(Credentials)]
642
735
certificate_allocate_credentials.restype = _error_code
643
736
644
737
certificate_free_credentials = (
645
738
_library.gnutls_certificate_free_credentials)
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
739
certificate_free_credentials.argtypes = [Credentials]
647
740
certificate_free_credentials.restype = None
648
741
649
742
handshake_set_private_extensions = (
650
743
_library.gnutls_handshake_set_private_extensions)
651
handshake_set_private_extensions.argtypes = [session_t,
744
handshake_set_private_extensions.argtypes = [ClientSession,
652
745
ctypes.c_int]
653
746
handshake_set_private_extensions.restype = None
654
747
655
748
credentials_set = _library.gnutls_credentials_set
656
credentials_set.argtypes = [session_t, credentials_type_t,
657
ctypes.c_void_p]
749
credentials_set.argtypes = [ClientSession, credentials_type_t,
750
CastToVoidPointer(Credentials)]
658
751
credentials_set.restype = _error_code
659
752
660
753
strerror = _library.gnutls_strerror
661
754
strerror.argtypes = [ctypes.c_int]
662
755
strerror.restype = ctypes.c_char_p
663
756
664
757
certificate_type_get = _library.gnutls_certificate_type_get
665
certificate_type_get.argtypes = [session_t]
758
certificate_type_get.argtypes = [ClientSession]
666
759
certificate_type_get.restype = _error_code
667
760
668
761
certificate_get_peers = _library.gnutls_certificate_get_peers
669
certificate_get_peers.argtypes = [session_t,
762
certificate_get_peers.argtypes = [ClientSession,
670
763
ctypes.POINTER(ctypes.c_uint)]
671
764
certificate_get_peers.restype = ctypes.POINTER(datum_t)
672
765
673
766
global_set_log_level = _library.gnutls_global_set_log_level
674
767
global_set_log_level.argtypes = [ctypes.c_int]
675
768
global_set_log_level.restype = None
676
769
677
770
global_set_log_function = _library.gnutls_global_set_log_function
678
771
global_set_log_function.argtypes = [log_func]
679
772
global_set_log_function.restype = None
680
773
681
774
deinit = _library.gnutls_deinit
682
deinit.argtypes = [session_t]
775
deinit.argtypes = [ClientSession]
683
776
deinit.restype = None
684
777
685
778
handshake = _library.gnutls_handshake
686
handshake.argtypes = [session_t]
687
handshake.restype = _error_code
779
handshake.argtypes = [ClientSession]
780
handshake.restype = ctypes.c_int
688
781
handshake.errcheck = _retry_on_error
689
782
690
783
transport_set_ptr = _library.gnutls_transport_set_ptr
691
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
784
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
692
785
transport_set_ptr.restype = None
693
786
694
787
bye = _library.gnutls_bye
695
bye.argtypes = [session_t, close_request_t]
696
bye.restype = _error_code
788
bye.argtypes = [ClientSession, close_request_t]
789
bye.restype = ctypes.c_int
697
790
bye.errcheck = _retry_on_error
698
791
699
792
check_version = _library.gnutls_check_version
700
793
check_version.argtypes = [ctypes.c_char_p]
701
794
check_version.restype = ctypes.c_char_p
702
703
# All the function declarations below are from gnutls/openpgp.h
704
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
707
openpgp_crt_init.restype = _error_code
708
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
711
ctypes.POINTER(datum_t),
712
openpgp_crt_fmt_t]
713
openpgp_crt_import.restype = _error_code
714
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
717
ctypes.POINTER(ctypes.c_uint)]
718
openpgp_crt_verify_self.restype = _error_code
719
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
722
openpgp_crt_deinit.restype = None
723
724
openpgp_crt_get_fingerprint = (
725
_library.gnutls_openpgp_crt_get_fingerprint)
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
727
ctypes.c_void_p,
728
ctypes.POINTER(
729
ctypes.c_size_t)]
730
openpgp_crt_get_fingerprint.restype = _error_code
731
795
796
_need_version = b"3.3.0"
797
if check_version(_need_version) is None:
798
raise self.Error("Needs GnuTLS {} or later"
799
.format(_need_version))
800
801
_tls_rawpk_version = b"3.6.6"
802
has_rawpk = bool(check_version(_tls_rawpk_version))
803
804
if has_rawpk:
805
# Types
806
class pubkey_st(ctypes.Structure):
807
_fields = []
808
pubkey_t = ctypes.POINTER(pubkey_st)
809
810
x509_crt_fmt_t = ctypes.c_int
811
812
# All the function declarations below are from
813
# gnutls/abstract.h
814
pubkey_init = _library.gnutls_pubkey_init
815
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
816
pubkey_init.restype = _error_code
817
818
pubkey_import = _library.gnutls_pubkey_import
819
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
820
x509_crt_fmt_t]
821
pubkey_import.restype = _error_code
822
823
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
824
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
825
ctypes.POINTER(ctypes.c_ubyte),
826
ctypes.POINTER(ctypes.c_size_t)]
827
pubkey_get_key_id.restype = _error_code
828
829
pubkey_deinit = _library.gnutls_pubkey_deinit
830
pubkey_deinit.argtypes = [pubkey_t]
831
pubkey_deinit.restype = None
832
else:
833
# All the function declarations below are from
834
# gnutls/openpgp.h
835
836
openpgp_crt_init = _library.gnutls_openpgp_crt_init
837
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
838
openpgp_crt_init.restype = _error_code
839
840
openpgp_crt_import = _library.gnutls_openpgp_crt_import
841
openpgp_crt_import.argtypes = [openpgp_crt_t,
842
ctypes.POINTER(datum_t),
843
openpgp_crt_fmt_t]
844
openpgp_crt_import.restype = _error_code
845
846
openpgp_crt_verify_self = \
847
_library.gnutls_openpgp_crt_verify_self
848
openpgp_crt_verify_self.argtypes = [
849
openpgp_crt_t,
850
ctypes.c_uint,
851
ctypes.POINTER(ctypes.c_uint),
852
]
853
openpgp_crt_verify_self.restype = _error_code
854
855
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
856
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
857
openpgp_crt_deinit.restype = None
858
859
openpgp_crt_get_fingerprint = (
860
_library.gnutls_openpgp_crt_get_fingerprint)
861
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
862
ctypes.c_void_p,
863
ctypes.POINTER(
864
ctypes.c_size_t)]
865
openpgp_crt_get_fingerprint.restype = _error_code
866
867
if check_version(b"3.6.4"):
868
certificate_type_get2 = _library.gnutls_certificate_type_get2
869
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
870
certificate_type_get2.restype = _error_code
871
732
872
# Remove non-public functions
733
873
del _error_code, _retry_on_error
734
# Create the global "gnutls" object, simulating a module
735
gnutls = GnuTLS()
874
736
875
737
876
def call_pipe(connection, # : multiprocessing.Connection
738
877
func, *args, **kwargs):
739
878
"""This function is meant to be called by multiprocessing.Process
740
879
741
880
This function runs func(*args, **kwargs), and writes the resulting
742
881
return value on the provided multiprocessing.Connection.
743
882
"""
744
883
connection.send(func(*args, **kwargs))
745
884
connection.close()
746
885
747
class Client(object):
886
887
class Client:
748
888
"""A representation of a client host served by this server.
749
889
750
890
Attributes:
751
approved: bool(); 'None' if not yet approved/disapproved
891
approved: bool(); None if not yet approved/disapproved
752
892
approval_delay: datetime.timedelta(); Time to wait for approval
753
893
approval_duration: datetime.timedelta(); Duration of one approval
754
checker: subprocess.Popen(); a running checker process used
755
to see if the client lives.
756
'None' if no process is running.
894
checker: multiprocessing.Process(); a running checker process used
895
to see if the client lives. None if no process is
896
running.
757
897
checker_callback_tag: a GLib event source tag, or None
758
898
checker_command: string; External command which is run to check
759
899
if client lives. %() expansions are done at
767
907
disable_initiator_tag: a GLib event source tag, or None
768
908
enabled: bool()
769
909
fingerprint: string (40 or 32 hexadecimal digits); used to
770
uniquely identify the client
910
uniquely identify an OpenPGP client
911
key_id: string (64 hexadecimal digits); used to uniquely identify
912
a client using raw public keys
771
913
host: string; available for use by the checker command
772
914
interval: datetime.timedelta(); How often to start a new checker
773
915
last_approval_request: datetime.datetime(); (UTC) or None
789
931
disabled, or None
790
932
server_settings: The server_settings dict from main()
791
933
"""
792
934
793
935
runtime_expansions = ("approval_delay", "approval_duration",
794
"created", "enabled", "expires",
936
"created", "enabled", "expires", "key_id",
795
937
"fingerprint", "host", "interval",
796
938
"last_approval_request", "last_checked_ok",
797
939
"last_enabled", "name", "timeout")
806
948
"approved_by_default": "True",
807
949
"enabled": "True",
808
950
}
809
951
810
952
@staticmethod
811
953
def config_parser(config):
812
954
"""Construct a new dict of client settings of this form:
819
961
for client_name in config.sections():
820
962
section = dict(config.items(client_name))
821
963
client = settings[client_name] = {}
822
964
823
965
client["host"] = section["host"]
824
966
# Reformat values from string types to Python types
825
967
client["approved_by_default"] = config.getboolean(
826
968
client_name, "approved_by_default")
827
969
client["enabled"] = config.getboolean(client_name,
828
970
"enabled")
829
830
# Uppercase and remove spaces from fingerprint for later
831
# comparison purposes with return value from the
832
# fingerprint() function
833
client["fingerprint"] = (section["fingerprint"].upper()
971
972
# Uppercase and remove spaces from key_id and fingerprint
973
# for later comparison purposes with return value from the
974
# key_id() and fingerprint() functions
975
client["key_id"] = (section.get("key_id", "").upper()
976
.replace(" ", ""))
977
client["fingerprint"] = (section.get("fingerprint",
978
"").upper()
834
979
.replace(" ", ""))
980
if not (client["key_id"] or client["fingerprint"]):
981
log.error("Skipping client %s without key_id or"
982
" fingerprint", client_name)
983
del settings[client_name]
984
continue
835
985
if "secret" in section:
836
986
client["secret"] = codecs.decode(section["secret"]
837
987
.encode("utf-8"),
856
1006
client["last_approval_request"] = None
857
1007
client["last_checked_ok"] = None
858
1008
client["last_checker_status"] = -2
859
1009
860
1010
return settings
861
862
def __init__(self, settings, name = None, server_settings=None):
1011
1012
def __init__(self, settings, name=None, server_settings=None):
863
1013
self.name = name
864
1014
if server_settings is None:
865
1015
server_settings = {}
867
1017
# adding all client settings
868
1018
for setting, value in settings.items():
869
1019
setattr(self, setting, value)
870
1020
871
1021
if self.enabled:
872
1022
if not hasattr(self, "last_enabled"):
873
1023
self.last_enabled = datetime.datetime.utcnow()
877
1027
else:
878
1028
self.last_enabled = None
879
1029
self.expires = None
880
881
logger.debug("Creating client %r", self.name)
882
logger.debug(" Fingerprint: %s", self.fingerprint)
1030
1031
log.debug("Creating client %r", self.name)
1032
log.debug(" Key ID: %s", self.key_id)
1033
log.debug(" Fingerprint: %s", self.fingerprint)
883
1034
self.created = settings.get("created",
884
1035
datetime.datetime.utcnow())
885
1036
886
1037
# attributes specific for this server instance
887
1038
self.checker = None
888
1039
self.checker_initiator_tag = None
897
1048
for attr in self.__dict__.keys()
898
1049
if not attr.startswith("_")]
899
1050
self.client_structure.append("client_structure")
900
1051
901
1052
for name, t in inspect.getmembers(
902
1053
type(self), lambda obj: isinstance(obj, property)):
903
1054
if not name.startswith("_"):
904
1055
self.client_structure.append(name)
905
1056
906
1057
# Send notice to process children that client state has changed
907
1058
def send_changedstate(self):
908
1059
with self.changedstate:
909
1060
self.changedstate.notify_all()
910
1061
911
1062
def enable(self):
912
1063
"""Start this client's checker and timeout hooks"""
913
1064
if getattr(self, "enabled", False):
914
1065
# Already enabled
915
1066
return
916
self.expires = datetime.datetime.utcnow() + self.timeout
917
1067
self.enabled = True
918
1068
self.last_enabled = datetime.datetime.utcnow()
919
1069
self.init_checker()
920
1070
self.send_changedstate()
921
1071
922
1072
def disable(self, quiet=True):
923
1073
"""Disable this client."""
924
1074
if not getattr(self, "enabled", False):
925
1075
return False
926
1076
if not quiet:
927
logger.info("Disabling client %s", self.name)
1077
log.info("Disabling client %s", self.name)
928
1078
if getattr(self, "disable_initiator_tag", None) is not None:
929
1079
GLib.source_remove(self.disable_initiator_tag)
930
1080
self.disable_initiator_tag = None
938
1088
self.send_changedstate()
939
1089
# Do not run this again if called by a GLib.timeout_add
940
1090
return False
941
1091
942
1092
def __del__(self):
943
1093
self.disable()
944
945
def init_checker(self):
946
# Schedule a new checker to be started an 'interval' from now,
947
# and every interval from then on.
1094
1095
def init_checker(self, randomize_start=False):
1096
# Schedule a new checker to be started a randomly selected
1097
# time (a fraction of 'interval') from now. This spreads out
1098
# the startup of checkers over time when the server is
1099
# started.
948
1100
if self.checker_initiator_tag is not None:
949
1101
GLib.source_remove(self.checker_initiator_tag)
1102
interval_milliseconds = int(self.interval.total_seconds()
1103
* 1000)
1104
if randomize_start:
1105
delay_milliseconds = random.randrange(
1106
interval_milliseconds + 1)
1107
else:
1108
delay_milliseconds = interval_milliseconds
950
1109
self.checker_initiator_tag = GLib.timeout_add(
951
int(self.interval.total_seconds() * 1000),
952
self.start_checker)
953
# Schedule a disable() when 'timeout' has passed
1110
delay_milliseconds, self.start_checker, randomize_start)
1111
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1112
# A checker might take up to an 'interval' of time, so we can
1113
# expire at the soonest one interval after a checker was
1114
# started. Since the initial checker is delayed, the expire
1115
# time might have to be extended.
1116
now = datetime.datetime.utcnow()
1117
self.expires = now + delay + self.interval
1118
# Schedule a disable() at expire time
954
1119
if self.disable_initiator_tag is not None:
955
1120
GLib.source_remove(self.disable_initiator_tag)
956
1121
self.disable_initiator_tag = GLib.timeout_add(
957
int(self.timeout.total_seconds() * 1000), self.disable)
958
# Also start a new checker *right now*.
959
self.start_checker()
960
1122
int((self.expires - now).total_seconds() * 1000),
1123
self.disable)
1124
961
1125
def checker_callback(self, source, condition, connection,
962
1126
command):
963
1127
"""The checker has completed, so take appropriate actions."""
964
self.checker_callback_tag = None
965
self.checker = None
966
1128
# Read return code from connection (see call_pipe)
967
1129
returncode = connection.recv()
968
1130
connection.close()
969
1131
if self.checker is not None:
1132
self.checker.join()
1133
self.checker_callback_tag = None
1134
self.checker = None
1135
970
1136
if returncode >= 0:
971
1137
self.last_checker_status = returncode
972
1138
self.last_checker_signal = None
973
1139
if self.last_checker_status == 0:
974
logger.info("Checker for %(name)s succeeded",
975
vars(self))
1140
log.info("Checker for %(name)s succeeded", vars(self))
976
1141
self.checked_ok()
977
1142
else:
978
logger.info("Checker for %(name)s failed", vars(self))
1143
log.info("Checker for %(name)s failed", vars(self))
979
1144
else:
980
1145
self.last_checker_status = -1
981
1146
self.last_checker_signal = -returncode
982
logger.warning("Checker for %(name)s crashed?",
983
vars(self))
1147
log.warning("Checker for %(name)s crashed?", vars(self))
984
1148
return False
985
1149
986
1150
def checked_ok(self):
987
1151
"""Assert that the client has been seen, alive and well."""
988
1152
self.last_checked_ok = datetime.datetime.utcnow()
989
1153
self.last_checker_status = 0
990
1154
self.last_checker_signal = None
991
1155
self.bump_timeout()
992
1156
993
1157
def bump_timeout(self, timeout=None):
994
1158
"""Bump up the timeout for this client."""
995
1159
if timeout is None:
1001
1165
self.disable_initiator_tag = GLib.timeout_add(
1002
1166
int(timeout.total_seconds() * 1000), self.disable)
1003
1167
self.expires = datetime.datetime.utcnow() + timeout
1004
1168
1005
1169
def need_approval(self):
1006
1170
self.last_approval_request = datetime.datetime.utcnow()
1007
1008
def start_checker(self):
1171
1172
def start_checker(self, start_was_randomized=False):
1009
1173
"""Start a new checker subprocess if one is not running.
1010
1174
1011
1175
If a checker already exists, leave it running and do
1012
1176
nothing."""
1013
1177
# The reason for not killing a running checker is that if we
1018
1182
# checkers alone, the checker would have to take more time
1019
1183
# than 'timeout' for the client to be disabled, which is as it
1020
1184
# should be.
1021
1185
1022
1186
if self.checker is not None and not self.checker.is_alive():
1023
logger.warning("Checker was not alive; joining")
1187
log.warning("Checker was not alive; joining")
1024
1188
self.checker.join()
1025
1189
self.checker = None
1026
1190
# Start a new checker if needed
1027
1191
if self.checker is None:
1028
1192
# Escape attributes for the shell
1029
1193
escaped_attrs = {
1030
attr: re.escape(str(getattr(self, attr)))
1031
for attr in self.runtime_expansions }
1194
attr: shlex.quote(str(getattr(self, attr)))
1195
for attr in self.runtime_expansions}
1032
1196
try:
1033
1197
command = self.checker_command % escaped_attrs
1034
1198
except TypeError as error:
1035
logger.error('Could not format string "%s"',
1036
self.checker_command,
1037
exc_info=error)
1199
log.error('Could not format string "%s"',
1200
self.checker_command, exc_info=error)
1038
1201
return True # Try again later
1039
1202
self.current_checker_command = command
1040
logger.info("Starting checker %r for %s", command,
1041
self.name)
1203
log.info("Starting checker %r for %s", command, self.name)
1042
1204
# We don't need to redirect stdout and stderr, since
1043
1205
# in normal mode, that is already done by daemon(),
1044
1206
# and in debug mode we don't want to. (Stdin is
1046
1208
# The exception is when not debugging but nevertheless
1047
1209
# running in the foreground; use the previously
1048
1210
# created wnull.
1049
popen_args = { "close_fds": True,
1050
"shell": True,
1051
"cwd": "/" }
1211
popen_args = {"close_fds": True,
1212
"shell": True,
1213
"cwd": "/"}
1052
1214
if (not self.server_settings["debug"]
1053
1215
and self.server_settings["foreground"]):
1054
1216
popen_args.update({"stdout": wnull,
1055
"stderr": wnull })
1056
pipe = multiprocessing.Pipe(duplex = False)
1217
"stderr": wnull})
1218
pipe = multiprocessing.Pipe(duplex=False)
1057
1219
self.checker = multiprocessing.Process(
1058
target = call_pipe,
1059
args = (pipe[1], subprocess.call, command),
1060
kwargs = popen_args)
1220
target=call_pipe,
1221
args=(pipe[1], subprocess.call, command),
1222
kwargs=popen_args)
1061
1223
self.checker.start()
1062
1224
self.checker_callback_tag = GLib.io_add_watch(
1063
pipe[0].fileno(), GLib.IO_IN,
1225
GLib.IOChannel.unix_new(pipe[0].fileno()),
1226
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1064
1227
self.checker_callback, pipe[0], command)
1228
if start_was_randomized:
1229
# We were started after a random delay; Schedule a new
1230
# checker to be started an 'interval' from now, and every
1231
# interval from then on.
1232
now = datetime.datetime.utcnow()
1233
self.checker_initiator_tag = GLib.timeout_add(
1234
int(self.interval.total_seconds() * 1000),
1235
self.start_checker)
1236
self.expires = max(self.expires, now + self.interval)
1237
# Don't start a new checker again after same random delay
1238
return False
1065
1239
# Re-run this periodically if run by GLib.timeout_add
1066
1240
return True
1067
1241
1068
1242
def stop_checker(self):
1069
1243
"""Force the checker process, if any, to stop."""
1070
1244
if self.checker_callback_tag:
1072
1246
self.checker_callback_tag = None
1073
1247
if getattr(self, "checker", None) is None:
1074
1248
return
1075
logger.debug("Stopping checker for %(name)s", vars(self))
1249
log.debug("Stopping checker for %(name)s", vars(self))
1076
1250
self.checker.terminate()
1077
1251
self.checker = None
1078
1252
1083
1257
byte_arrays=False):
1084
1258
"""Decorators for marking methods of a DBusObjectWithProperties to
1085
1259
become properties on the D-Bus.
1086
1260
1087
1261
The decorated method will be called with no arguments by "Get"
1088
1262
and with one argument by "Set".
1089
1263
1090
1264
The parameters, where they are supported, are the same as
1091
1265
dbus.service.method, except there is only "signature", since the
1092
1266
type from Get() and the type sent to Set() is the same.
1096
1270
if byte_arrays and signature != "ay":
1097
1271
raise ValueError("Byte arrays not supported for non-'ay'"
1098
1272
" signature {!r}".format(signature))
1099
1273
1100
1274
def decorator(func):
1101
1275
func._dbus_is_property = True
1102
1276
func._dbus_interface = dbus_interface
1105
1279
func._dbus_name = func.__name__
1106
1280
if func._dbus_name.endswith("_dbus_property"):
1107
1281
func._dbus_name = func._dbus_name[:-14]
1108
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1282
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1109
1283
return func
1110
1284
1111
1285
return decorator
1112
1286
1113
1287
1114
1288
def dbus_interface_annotations(dbus_interface):
1115
1289
"""Decorator for marking functions returning interface annotations
1116
1290
1117
1291
Usage:
1118
1292
1119
1293
@dbus_interface_annotations("org.example.Interface")
1120
1294
def _foo(self): # Function name does not matter
1121
1295
return {"org.freedesktop.DBus.Deprecated": "true",
1122
1296
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1123
1297
"false"}
1124
1298
"""
1125
1299
1126
1300
def decorator(func):
1127
1301
func._dbus_is_interface = True
1128
1302
func._dbus_interface = dbus_interface
1129
1303
func._dbus_name = dbus_interface
1130
1304
return func
1131
1305
1132
1306
return decorator
1133
1307
1134
1308
1135
1309
def dbus_annotations(annotations):
1136
1310
"""Decorator to annotate D-Bus methods, signals or properties
1137
1311
Usage:
1138
1312
1139
1313
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1140
1314
"org.freedesktop.DBus.Property."
1141
1315
"EmitsChangedSignal": "false"})
1143
1317
access="r")
1144
1318
def Property_dbus_property(self):
1145
1319
return dbus.Boolean(False)
1146
1320
1147
1321
See also the DBusObjectWithAnnotations class.
1148
1322
"""
1149
1323
1150
1324
def decorator(func):
1151
1325
func._dbus_annotations = annotations
1152
1326
return func
1153
1327
1154
1328
return decorator
1155
1329
1156
1330
1174
1348
1175
1349
class DBusObjectWithAnnotations(dbus.service.Object):
1176
1350
"""A D-Bus object with annotations.
1177
1351
1178
1352
Classes inheriting from this can use the dbus_annotations
1179
1353
decorator to add annotations to methods or signals.
1180
1354
"""
1181
1355
1182
1356
@staticmethod
1183
1357
def _is_dbus_thing(thing):
1184
1358
"""Returns a function testing if an attribute is a D-Bus thing
1185
1359
1186
1360
If called like _is_dbus_thing("method") it returns a function
1187
1361
suitable for use as predicate to inspect.getmembers().
1188
1362
"""
1189
1363
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1190
1364
False)
1191
1365
1192
1366
def _get_all_dbus_things(self, thing):
1193
1367
"""Returns a generator of (name, attribute) pairs
1194
1368
"""
1197
1371
for cls in self.__class__.__mro__
1198
1372
for name, athing in
1199
1373
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1200
1374
1201
1375
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1202
out_signature = "s",
1203
path_keyword = 'object_path',
1204
connection_keyword = 'connection')
1376
out_signature="s",
1377
path_keyword="object_path",
1378
connection_keyword="connection")
1205
1379
def Introspect(self, object_path, connection):
1206
1380
"""Overloading of standard D-Bus method.
1207
1381
1208
1382
Inserts annotation tags on methods and signals.
1209
1383
"""
1210
1384
xmlstring = dbus.service.Object.Introspect(self, object_path,
1211
1385
connection)
1212
1386
try:
1213
1387
document = xml.dom.minidom.parseString(xmlstring)
1214
1388
1215
1389
for if_tag in document.getElementsByTagName("interface"):
1216
1390
# Add annotation tags
1217
1391
for typ in ("method", "signal"):
1244
1418
if_tag.appendChild(ann_tag)
1245
1419
# Fix argument name for the Introspect method itself
1246
1420
if (if_tag.getAttribute("name")
1247
== dbus.INTROSPECTABLE_IFACE):
1421
== dbus.INTROSPECTABLE_IFACE):
1248
1422
for cn in if_tag.getElementsByTagName("method"):
1249
1423
if cn.getAttribute("name") == "Introspect":
1250
1424
for arg in cn.getElementsByTagName("arg"):
1256
1430
document.unlink()
1257
1431
except (AttributeError, xml.dom.DOMException,
1258
1432
xml.parsers.expat.ExpatError) as error:
1259
logger.error("Failed to override Introspection method",
1260
exc_info=error)
1433
log.error("Failed to override Introspection method",
1434
exc_info=error)
1261
1435
return xmlstring
1262
1436
1263
1437
1264
1438
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1265
1439
"""A D-Bus object with properties.
1266
1440
1267
1441
Classes inheriting from this can use the dbus_service_property
1268
1442
decorator to expose methods as D-Bus properties. It exposes the
1269
1443
standard Get(), Set(), and GetAll() methods on the D-Bus.
1270
1444
"""
1271
1445
1272
1446
def _get_dbus_property(self, interface_name, property_name):
1273
1447
"""Returns a bound method if one exists which is a D-Bus
1274
1448
property with the specified name and interface.
1279
1453
if (value._dbus_name == property_name
1280
1454
and value._dbus_interface == interface_name):
1281
1455
return value.__get__(self)
1282
1456
1283
1457
# No such property
1284
1458
raise DBusPropertyNotFound("{}:{}.{}".format(
1285
1459
self.dbus_object_path, interface_name, property_name))
1286
1460
1287
1461
@classmethod
1288
1462
def _get_all_interface_names(cls):
1289
1463
"""Get a sequence of all interfaces supported by an object"""
1292
1466
for x in (inspect.getmro(cls))
1293
1467
for attr in dir(x))
1294
1468
if name is not None)
1295
1469
1296
1470
@dbus.service.method(dbus.PROPERTIES_IFACE,
1297
1471
in_signature="ss",
1298
1472
out_signature="v")
1306
1480
if not hasattr(value, "variant_level"):
1307
1481
return value
1308
1482
return type(value)(value, variant_level=value.variant_level+1)
1309
1483
1310
1484
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1311
1485
def Set(self, interface_name, property_name, value):
1312
1486
"""Standard D-Bus property Set() method, see D-Bus standard.
1321
1495
raise ValueError("Byte arrays not supported for non-"
1322
1496
"'ay' signature {!r}"
1323
1497
.format(prop._dbus_signature))
1324
value = dbus.ByteArray(b''.join(chr(byte)
1325
for byte in value))
1498
value = dbus.ByteArray(bytes(value))
1326
1499
prop(value)
1327
1500
1328
1501
@dbus.service.method(dbus.PROPERTIES_IFACE,
1329
1502
in_signature="s",
1330
1503
out_signature="a{sv}")
1331
1504
def GetAll(self, interface_name):
1332
1505
"""Standard D-Bus property GetAll() method, see D-Bus
1333
1506
standard.
1334
1507
1335
1508
Note: Will not include properties with access="write".
1336
1509
"""
1337
1510
properties = {}
1348
1521
properties[name] = value
1349
1522
continue
1350
1523
properties[name] = type(value)(
1351
value, variant_level = value.variant_level + 1)
1524
value, variant_level=value.variant_level + 1)
1352
1525
return dbus.Dictionary(properties, signature="sv")
1353
1526
1354
1527
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1355
1528
def PropertiesChanged(self, interface_name, changed_properties,
1356
1529
invalidated_properties):
1358
1531
standard.
1359
1532
"""
1360
1533
pass
1361
1534
1362
1535
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1363
1536
out_signature="s",
1364
path_keyword='object_path',
1365
connection_keyword='connection')
1537
path_keyword="object_path",
1538
connection_keyword="connection")
1366
1539
def Introspect(self, object_path, connection):
1367
1540
"""Overloading of standard D-Bus method.
1368
1541
1369
1542
Inserts property tags and interface annotation tags.
1370
1543
"""
1371
1544
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1373
1546
connection)
1374
1547
try:
1375
1548
document = xml.dom.minidom.parseString(xmlstring)
1376
1549
1377
1550
def make_tag(document, name, prop):
1378
1551
e = document.createElement("property")
1379
1552
e.setAttribute("name", name)
1380
1553
e.setAttribute("type", prop._dbus_signature)
1381
1554
e.setAttribute("access", prop._dbus_access)
1382
1555
return e
1383
1556
1384
1557
for if_tag in document.getElementsByTagName("interface"):
1385
1558
# Add property tags
1386
1559
for tag in (make_tag(document, name, prop)
1424
1597
document.unlink()
1425
1598
except (AttributeError, xml.dom.DOMException,
1426
1599
xml.parsers.expat.ExpatError) as error:
1427
logger.error("Failed to override Introspection method",
1428
exc_info=error)
1600
log.error("Failed to override Introspection method",
1601
exc_info=error)
1429
1602
return xmlstring
1430
1603
1604
1431
1605
try:
1432
1606
dbus.OBJECT_MANAGER_IFACE
1433
1607
except AttributeError:
1434
1608
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1435
1609
1610
1436
1611
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1437
1612
"""A D-Bus object with an ObjectManager.
1438
1613
1439
1614
Classes inheriting from this exposes the standard
1440
1615
GetManagedObjects call and the InterfacesAdded and
1441
1616
InterfacesRemoved signals on the standard
1442
1617
"org.freedesktop.DBus.ObjectManager" interface.
1443
1618
1444
1619
Note: No signals are sent automatically; they must be sent
1445
1620
manually.
1446
1621
"""
1447
1622
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1448
out_signature = "a{oa{sa{sv}}}")
1623
out_signature="a{oa{sa{sv}}}")
1449
1624
def GetManagedObjects(self):
1450
1625
"""This function must be overridden"""
1451
1626
raise NotImplementedError()
1452
1627
1453
1628
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1454
signature = "oa{sa{sv}}")
1629
signature="oa{sa{sv}}")
1455
1630
def InterfacesAdded(self, object_path, interfaces_and_properties):
1456
1631
pass
1457
1458
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1632
1633
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1459
1634
def InterfacesRemoved(self, object_path, interfaces):
1460
1635
pass
1461
1636
1462
1637
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1463
out_signature = "s",
1464
path_keyword = 'object_path',
1465
connection_keyword = 'connection')
1638
out_signature="s",
1639
path_keyword="object_path",
1640
connection_keyword="connection")
1466
1641
def Introspect(self, object_path, connection):
1467
1642
"""Overloading of standard D-Bus method.
1468
1643
1469
1644
Override return argument name of GetManagedObjects to be
1470
1645
"objpath_interfaces_and_properties"
1471
1646
"""
1474
1649
connection)
1475
1650
try:
1476
1651
document = xml.dom.minidom.parseString(xmlstring)
1477
1652
1478
1653
for if_tag in document.getElementsByTagName("interface"):
1479
1654
# Fix argument name for the GetManagedObjects method
1480
1655
if (if_tag.getAttribute("name")
1481
== dbus.OBJECT_MANAGER_IFACE):
1656
== dbus.OBJECT_MANAGER_IFACE):
1482
1657
for cn in if_tag.getElementsByTagName("method"):
1483
1658
if (cn.getAttribute("name")
1484
1659
== "GetManagedObjects"):
1493
1668
document.unlink()
1494
1669
except (AttributeError, xml.dom.DOMException,
1495
1670
xml.parsers.expat.ExpatError) as error:
1496
logger.error("Failed to override Introspection method",
1497
exc_info = error)
1671
log.error("Failed to override Introspection method",
1672
exc_info=error)
1498
1673
return xmlstring
1499
1674
1675
1500
1676
def datetime_to_dbus(dt, variant_level=0):
1501
1677
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1502
1678
if dt is None:
1503
return dbus.String("", variant_level = variant_level)
1679
return dbus.String("", variant_level=variant_level)
1504
1680
return dbus.String(dt.isoformat(), variant_level=variant_level)
1505
1681
1506
1682
1509
1685
dbus.service.Object, it will add alternate D-Bus attributes with
1510
1686
interface names according to the "alt_interface_names" mapping.
1511
1687
Usage:
1512
1688
1513
1689
@alternate_dbus_interfaces({"org.example.Interface":
1514
1690
"net.example.AlternateInterface"})
1515
1691
class SampleDBusObject(dbus.service.Object):
1516
1692
@dbus.service.method("org.example.Interface")
1517
1693
def SampleDBusMethod():
1518
1694
pass
1519
1695
1520
1696
The above "SampleDBusMethod" on "SampleDBusObject" will be
1521
1697
reachable via two interfaces: "org.example.Interface" and
1522
1698
"net.example.AlternateInterface", the latter of which will have
1523
1699
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1524
1700
"true", unless "deprecate" is passed with a False value.
1525
1701
1526
1702
This works for methods and signals, and also for D-Bus properties
1527
1703
(from DBusObjectWithProperties) and interfaces (from the
1528
1704
dbus_interface_annotations decorator).
1529
1705
"""
1530
1706
1531
1707
def wrapper(cls):
1532
1708
for orig_interface_name, alt_interface_name in (
1533
1709
alt_interface_names.items()):
1573
1749
attribute._dbus_annotations)
1574
1750
except AttributeError:
1575
1751
pass
1752
1576
1753
# Define a creator of a function to call both the
1577
1754
# original and alternate functions, so both the
1578
1755
# original and alternate signals gets sent when
1581
1758
"""This function is a scope container to pass
1582
1759
func1 and func2 to the "call_both" function
1583
1760
outside of its arguments"""
1584
1761
1585
1762
@functools.wraps(func2)
1586
1763
def call_both(*args, **kwargs):
1587
1764
"""This function will emit two D-Bus
1588
1765
signals by calling func1 and func2"""
1589
1766
func1(*args, **kwargs)
1590
1767
func2(*args, **kwargs)
1591
# Make wrapper function look like a D-Bus signal
1768
# Make wrapper function look like a D-Bus
1769
# signal
1592
1770
for name, attr in inspect.getmembers(func2):
1593
1771
if name.startswith("_dbus_"):
1594
1772
setattr(call_both, name, attr)
1595
1773
1596
1774
return call_both
1597
1775
# Create the "call_both" function and add it to
1598
1776
# the class
1644
1822
(copy_function(attribute)))
1645
1823
if deprecate:
1646
1824
# Deprecate all alternate interfaces
1647
iname="_AlternateDBusNames_interface_annotation{}"
1825
iname = "_AlternateDBusNames_interface_annotation{}"
1648
1826
for interface_name in interface_names:
1649
1827
1650
1828
@dbus_interface_annotations(interface_name)
1651
1829
def func(self):
1652
return { "org.freedesktop.DBus.Deprecated":
1653
"true" }
1830
return {"org.freedesktop.DBus.Deprecated":
1831
"true"}
1654
1832
# Find an unused name
1655
1833
for aname in (iname.format(i)
1656
1834
for i in itertools.count()):
1667
1845
cls = type("{}Alternate".format(cls.__name__),
1668
1846
(cls, ), attr)
1669
1847
return cls
1670
1848
1671
1849
return wrapper
1672
1850
1673
1851
1675
1853
"se.bsnet.fukt.Mandos"})
1676
1854
class ClientDBus(Client, DBusObjectWithProperties):
1677
1855
"""A Client class using D-Bus
1678
1856
1679
1857
Attributes:
1680
1858
dbus_object_path: dbus.ObjectPath
1681
1859
bus: dbus.SystemBus()
1682
1860
"""
1683
1861
1684
1862
runtime_expansions = (Client.runtime_expansions
1685
1863
+ ("dbus_object_path", ))
1686
1864
1687
1865
_interface = "se.recompile.Mandos.Client"
1688
1866
1689
1867
# dbus.service.Object doesn't use super(), so we can't either.
1690
1691
def __init__(self, bus = None, *args, **kwargs):
1868
1869
def __init__(self, bus=None, *args, **kwargs):
1692
1870
self.bus = bus
1693
1871
Client.__init__(self, *args, **kwargs)
1694
1872
# Only now, when this client is initialized, can it show up on
1700
1878
"/clients/" + client_object_name)
1701
1879
DBusObjectWithProperties.__init__(self, self.bus,
1702
1880
self.dbus_object_path)
1703
1881
1704
1882
def notifychangeproperty(transform_func, dbus_name,
1705
1883
type_func=lambda x: x,
1706
1884
variant_level=1,
1708
1886
_interface=_interface):
1709
1887
""" Modify a variable so that it's a property which announces
1710
1888
its changes to DBus.
1711
1889
1712
1890
transform_fun: Function that takes a value and a variant_level
1713
1891
and transforms it to a D-Bus type.
1714
1892
dbus_name: D-Bus name of the variable
1717
1895
variant_level: D-Bus variant level. Default: 1
1718
1896
"""
1719
1897
attrname = "_{}".format(dbus_name)
1720
1898
1721
1899
def setter(self, value):
1722
1900
if hasattr(self, "dbus_object_path"):
1723
1901
if (not hasattr(self, attrname) or
1730
1908
else:
1731
1909
dbus_value = transform_func(
1732
1910
type_func(value),
1733
variant_level = variant_level)
1911
variant_level=variant_level)
1734
1912
self.PropertyChanged(dbus.String(dbus_name),
1735
1913
dbus_value)
1736
1914
self.PropertiesChanged(
1737
1915
_interface,
1738
dbus.Dictionary({ dbus.String(dbus_name):
1739
dbus_value }),
1916
dbus.Dictionary({dbus.String(dbus_name):
1917
dbus_value}),
1740
1918
dbus.Array())
1741
1919
setattr(self, attrname, value)
1742
1920
1743
1921
return property(lambda self: getattr(self, attrname), setter)
1744
1922
1745
1923
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1746
1924
approvals_pending = notifychangeproperty(dbus.Boolean,
1747
1925
"ApprovalPending",
1748
type_func = bool)
1926
type_func=bool)
1749
1927
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1750
1928
last_enabled = notifychangeproperty(datetime_to_dbus,
1751
1929
"LastEnabled")
1752
1930
checker = notifychangeproperty(
1753
1931
dbus.Boolean, "CheckerRunning",
1754
type_func = lambda checker: checker is not None)
1932
type_func=lambda checker: checker is not None)
1755
1933
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1756
1934
"LastCheckedOK")
1757
1935
last_checker_status = notifychangeproperty(dbus.Int16,
1762
1940
"ApprovedByDefault")
1763
1941
approval_delay = notifychangeproperty(
1764
1942
dbus.UInt64, "ApprovalDelay",
1765
type_func = lambda td: td.total_seconds() * 1000)
1943
type_func=lambda td: td.total_seconds() * 1000)
1766
1944
approval_duration = notifychangeproperty(
1767
1945
dbus.UInt64, "ApprovalDuration",
1768
type_func = lambda td: td.total_seconds() * 1000)
1946
type_func=lambda td: td.total_seconds() * 1000)
1769
1947
host = notifychangeproperty(dbus.String, "Host")
1770
1948
timeout = notifychangeproperty(
1771
1949
dbus.UInt64, "Timeout",
1772
type_func = lambda td: td.total_seconds() * 1000)
1950
type_func=lambda td: td.total_seconds() * 1000)
1773
1951
extended_timeout = notifychangeproperty(
1774
1952
dbus.UInt64, "ExtendedTimeout",
1775
type_func = lambda td: td.total_seconds() * 1000)
1953
type_func=lambda td: td.total_seconds() * 1000)
1776
1954
interval = notifychangeproperty(
1777
1955
dbus.UInt64, "Interval",
1778
type_func = lambda td: td.total_seconds() * 1000)
1956
type_func=lambda td: td.total_seconds() * 1000)
1779
1957
checker_command = notifychangeproperty(dbus.String, "Checker")
1780
1958
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1781
1959
invalidate_only=True)
1782
1960
1783
1961
del notifychangeproperty
1784
1962
1785
1963
def __del__(self, *args, **kwargs):
1786
1964
try:
1787
1965
self.remove_from_connection()
1790
1968
if hasattr(DBusObjectWithProperties, "__del__"):
1791
1969
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1792
1970
Client.__del__(self, *args, **kwargs)
1793
1971
1794
1972
def checker_callback(self, source, condition,
1795
1973
connection, command, *args, **kwargs):
1796
1974
ret = Client.checker_callback(self, source, condition,
1812
1990
| self.last_checker_signal),
1813
1991
dbus.String(command))
1814
1992
return ret
1815
1993
1816
1994
def start_checker(self, *args, **kwargs):
1817
1995
old_checker_pid = getattr(self.checker, "pid", None)
1818
1996
r = Client.start_checker(self, *args, **kwargs)
1822
2000
# Emit D-Bus signal
1823
2001
self.CheckerStarted(self.current_checker_command)
1824
2002
return r
1825
2003
1826
2004
def _reset_approved(self):
1827
2005
self.approved = None
1828
2006
return False
1829
2007
1830
2008
def approve(self, value=True):
1831
2009
self.approved = value
1832
2010
GLib.timeout_add(int(self.approval_duration.total_seconds()
1833
2011
* 1000), self._reset_approved)
1834
2012
self.send_changedstate()
1835
1836
## D-Bus methods, signals & properties
1837
1838
## Interfaces
1839
1840
## Signals
1841
2013
2014
# D-Bus methods, signals & properties
2015
2016
# Interfaces
2017
2018
# Signals
2019
1842
2020
# CheckerCompleted - signal
1843
2021
@dbus.service.signal(_interface, signature="nxs")
1844
2022
def CheckerCompleted(self, exitcode, waitstatus, command):
1845
2023
"D-Bus signal"
1846
2024
pass
1847
2025
1848
2026
# CheckerStarted - signal
1849
2027
@dbus.service.signal(_interface, signature="s")
1850
2028
def CheckerStarted(self, command):
1851
2029
"D-Bus signal"
1852
2030
pass
1853
2031
1854
2032
# PropertyChanged - signal
1855
2033
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1856
2034
@dbus.service.signal(_interface, signature="sv")
1857
2035
def PropertyChanged(self, property, value):
1858
2036
"D-Bus signal"
1859
2037
pass
1860
2038
1861
2039
# GotSecret - signal
1862
2040
@dbus.service.signal(_interface)
1863
2041
def GotSecret(self):
1866
2044
server to mandos-client
1867
2045
"""
1868
2046
pass
1869
2047
1870
2048
# Rejected - signal
1871
2049
@dbus.service.signal(_interface, signature="s")
1872
2050
def Rejected(self, reason):
1873
2051
"D-Bus signal"
1874
2052
pass
1875
2053
1876
2054
# NeedApproval - signal
1877
2055
@dbus.service.signal(_interface, signature="tb")
1878
2056
def NeedApproval(self, timeout, default):
1879
2057
"D-Bus signal"
1880
2058
return self.need_approval()
1881
1882
## Methods
1883
2059
2060
# Methods
2061
1884
2062
# Approve - method
1885
2063
@dbus.service.method(_interface, in_signature="b")
1886
2064
def Approve(self, value):
1887
2065
self.approve(value)
1888
2066
1889
2067
# CheckedOK - method
1890
2068
@dbus.service.method(_interface)
1891
2069
def CheckedOK(self):
1892
2070
self.checked_ok()
1893
2071
1894
2072
# Enable - method
1895
2073
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1896
2074
@dbus.service.method(_interface)
1897
2075
def Enable(self):
1898
2076
"D-Bus method"
1899
2077
self.enable()
1900
2078
1901
2079
# StartChecker - method
1902
2080
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1903
2081
@dbus.service.method(_interface)
1904
2082
def StartChecker(self):
1905
2083
"D-Bus method"
1906
2084
self.start_checker()
1907
2085
1908
2086
# Disable - method
1909
2087
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1910
2088
@dbus.service.method(_interface)
1911
2089
def Disable(self):
1912
2090
"D-Bus method"
1913
2091
self.disable()
1914
2092
1915
2093
# StopChecker - method
1916
2094
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1917
2095
@dbus.service.method(_interface)
1918
2096
def StopChecker(self):
1919
2097
self.stop_checker()
1920
1921
## Properties
1922
2098
2099
# Properties
2100
1923
2101
# ApprovalPending - property
1924
2102
@dbus_service_property(_interface, signature="b", access="read")
1925
2103
def ApprovalPending_dbus_property(self):
1926
2104
return dbus.Boolean(bool(self.approvals_pending))
1927
2105
1928
2106
# ApprovedByDefault - property
1929
2107
@dbus_service_property(_interface,
1930
2108
signature="b",
1933
2111
if value is None: # get
1934
2112
return dbus.Boolean(self.approved_by_default)
1935
2113
self.approved_by_default = bool(value)
1936
2114
1937
2115
# ApprovalDelay - property
1938
2116
@dbus_service_property(_interface,
1939
2117
signature="t",
1943
2121
return dbus.UInt64(self.approval_delay.total_seconds()
1944
2122
* 1000)
1945
2123
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1946
2124
1947
2125
# ApprovalDuration - property
1948
2126
@dbus_service_property(_interface,
1949
2127
signature="t",
1953
2131
return dbus.UInt64(self.approval_duration.total_seconds()
1954
2132
* 1000)
1955
2133
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1956
2134
1957
2135
# Name - property
1958
2136
@dbus_annotations(
1959
2137
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1960
2138
@dbus_service_property(_interface, signature="s", access="read")
1961
2139
def Name_dbus_property(self):
1962
2140
return dbus.String(self.name)
1963
2141
2142
# KeyID - property
2143
@dbus_annotations(
2144
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2145
@dbus_service_property(_interface, signature="s", access="read")
2146
def KeyID_dbus_property(self):
2147
return dbus.String(self.key_id)
2148
1964
2149
# Fingerprint - property
1965
2150
@dbus_annotations(
1966
2151
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1967
2152
@dbus_service_property(_interface, signature="s", access="read")
1968
2153
def Fingerprint_dbus_property(self):
1969
2154
return dbus.String(self.fingerprint)
1970
2155
1971
2156
# Host - property
1972
2157
@dbus_service_property(_interface,
1973
2158
signature="s",
1976
2161
if value is None: # get
1977
2162
return dbus.String(self.host)
1978
2163
self.host = str(value)
1979
2164
1980
2165
# Created - property
1981
2166
@dbus_annotations(
1982
2167
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1983
2168
@dbus_service_property(_interface, signature="s", access="read")
1984
2169
def Created_dbus_property(self):
1985
2170
return datetime_to_dbus(self.created)
1986
2171
1987
2172
# LastEnabled - property
1988
2173
@dbus_service_property(_interface, signature="s", access="read")
1989
2174
def LastEnabled_dbus_property(self):
1990
2175
return datetime_to_dbus(self.last_enabled)
1991
2176
1992
2177
# Enabled - property
1993
2178
@dbus_service_property(_interface,
1994
2179
signature="b",
2000
2185
self.enable()
2001
2186
else:
2002
2187
self.disable()
2003
2188
2004
2189
# LastCheckedOK - property
2005
2190
@dbus_service_property(_interface,
2006
2191
signature="s",
2010
2195
self.checked_ok()
2011
2196
return
2012
2197
return datetime_to_dbus(self.last_checked_ok)
2013
2198
2014
2199
# LastCheckerStatus - property
2015
2200
@dbus_service_property(_interface, signature="n", access="read")
2016
2201
def LastCheckerStatus_dbus_property(self):
2017
2202
return dbus.Int16(self.last_checker_status)
2018
2203
2019
2204
# Expires - property
2020
2205
@dbus_service_property(_interface, signature="s", access="read")
2021
2206
def Expires_dbus_property(self):
2022
2207
return datetime_to_dbus(self.expires)
2023
2208
2024
2209
# LastApprovalRequest - property
2025
2210
@dbus_service_property(_interface, signature="s", access="read")
2026
2211
def LastApprovalRequest_dbus_property(self):
2027
2212
return datetime_to_dbus(self.last_approval_request)
2028
2213
2029
2214
# Timeout - property
2030
2215
@dbus_service_property(_interface,
2031
2216
signature="t",
2050
2235
self.disable_initiator_tag = GLib.timeout_add(
2051
2236
int((self.expires - now).total_seconds() * 1000),
2052
2237
self.disable)
2053
2238
2054
2239
# ExtendedTimeout - property
2055
2240
@dbus_service_property(_interface,
2056
2241
signature="t",
2060
2245
return dbus.UInt64(self.extended_timeout.total_seconds()
2061
2246
* 1000)
2062
2247
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2063
2248
2064
2249
# Interval - property
2065
2250
@dbus_service_property(_interface,
2066
2251
signature="t",
2076
2261
GLib.source_remove(self.checker_initiator_tag)
2077
2262
self.checker_initiator_tag = GLib.timeout_add(
2078
2263
value, self.start_checker)
2079
self.start_checker() # Start one now, too
2080
2264
self.start_checker() # Start one now, too
2265
2081
2266
# Checker - property
2082
2267
@dbus_service_property(_interface,
2083
2268
signature="s",
2086
2271
if value is None: # get
2087
2272
return dbus.String(self.checker_command)
2088
2273
self.checker_command = str(value)
2089
2274
2090
2275
# CheckerRunning - property
2091
2276
@dbus_service_property(_interface,
2092
2277
signature="b",
2098
2283
self.start_checker()
2099
2284
else:
2100
2285
self.stop_checker()
2101
2286
2102
2287
# ObjectPath - property
2103
2288
@dbus_annotations(
2104
2289
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2105
2290
"org.freedesktop.DBus.Deprecated": "true"})
2106
2291
@dbus_service_property(_interface, signature="o", access="read")
2107
2292
def ObjectPath_dbus_property(self):
2108
return self.dbus_object_path # is already a dbus.ObjectPath
2109
2293
return self.dbus_object_path # is already a dbus.ObjectPath
2294
2110
2295
# Secret = property
2111
2296
@dbus_annotations(
2112
2297
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2117
2302
byte_arrays=True)
2118
2303
def Secret_dbus_property(self, value):
2119
2304
self.secret = bytes(value)
2120
2305
2121
2306
del _interface
2122
2307
2123
2308
2124
class ProxyClient(object):
2125
def __init__(self, child_pipe, fpr, address):
2309
class ProxyClient:
2310
def __init__(self, child_pipe, key_id, fpr, address):
2126
2311
self._pipe = child_pipe
2127
self._pipe.send(('init', fpr, address))
2312
self._pipe.send(("init", key_id, fpr, address))
2128
2313
if not self._pipe.recv():
2129
raise KeyError(fpr)
2130
2314
raise KeyError(key_id or fpr)
2315
2131
2316
def __getattribute__(self, name):
2132
if name == '_pipe':
2317
if name == "_pipe":
2133
2318
return super(ProxyClient, self).__getattribute__(name)
2134
self._pipe.send(('getattr', name))
2319
self._pipe.send(("getattr", name))
2135
2320
data = self._pipe.recv()
2136
if data[0] == 'data':
2321
if data[0] == "data":
2137
2322
return data[1]
2138
if data[0] == 'function':
2139
2323
if data[0] == "function":
2324
2140
2325
def func(*args, **kwargs):
2141
self._pipe.send(('funcall', name, args, kwargs))
2326
self._pipe.send(("funcall", name, args, kwargs))
2142
2327
return self._pipe.recv()[1]
2143
2328
2144
2329
return func
2145
2330
2146
2331
def __setattr__(self, name, value):
2147
if name == '_pipe':
2332
if name == "_pipe":
2148
2333
return super(ProxyClient, self).__setattr__(name, value)
2149
self._pipe.send(('setattr', name, value))
2334
self._pipe.send(("setattr", name, value))
2150
2335
2151
2336
2152
2337
class ClientHandler(socketserver.BaseRequestHandler, object):
2153
2338
"""A class to handle client connections.
2154
2339
2155
2340
Instantiated once for each connection to handle it.
2156
2341
Note: This will run in its own forked process."""
2157
2342
2158
2343
def handle(self):
2159
2344
with contextlib.closing(self.server.child_pipe) as child_pipe:
2160
logger.info("TCP connection from: %s",
2161
str(self.client_address))
2162
logger.debug("Pipe FD: %d",
2163
self.server.child_pipe.fileno())
2164
2345
log.info("TCP connection from: %s",
2346
str(self.client_address))
2347
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2348
2165
2349
session = gnutls.ClientSession(self.request)
2166
2167
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
# "+AES-256-CBC", "+SHA1",
2169
# "+COMP-NULL", "+CTYPE-OPENPGP",
2170
# "+DHE-DSS"))
2350
2351
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2352
# "+AES-256-CBC", "+SHA1",
2353
# "+COMP-NULL", "+CTYPE-OPENPGP",
2354
# "+DHE-DSS"))
2171
2355
# Use a fallback default, since this MUST be set.
2172
2356
priority = self.server.gnutls_priority
2173
2357
if priority is None:
2174
2358
priority = "NORMAL"
2175
gnutls.priority_set_direct(session._c_object, priority,
2176
None)
2177
2359
gnutls.priority_set_direct(session,
2360
priority.encode("utf-8"), None)
2361
2178
2362
# Start communication using the Mandos protocol
2179
2363
# Get protocol number
2180
2364
line = self.request.makefile().readline()
2181
logger.debug("Protocol version: %r", line)
2365
log.debug("Protocol version: %r", line)
2182
2366
try:
2183
2367
if int(line.strip().split()[0]) > 1:
2184
2368
raise RuntimeError(line)
2185
2369
except (ValueError, IndexError, RuntimeError) as error:
2186
logger.error("Unknown protocol version: %s", error)
2370
log.error("Unknown protocol version: %s", error)
2187
2371
return
2188
2372
2189
2373
# Start GnuTLS connection
2190
2374
try:
2191
2375
session.handshake()
2192
2376
except gnutls.Error as error:
2193
logger.warning("Handshake failed: %s", error)
2377
log.warning("Handshake failed: %s", error)
2194
2378
# Do not run session.bye() here: the session is not
2195
2379
# established. Just abandon the request.
2196
2380
return
2197
logger.debug("Handshake succeeded")
2198
2381
log.debug("Handshake succeeded")
2382
2199
2383
approval_required = False
2200
2384
try:
2201
try:
2202
fpr = self.fingerprint(
2203
self.peer_certificate(session))
2204
except (TypeError, gnutls.Error) as error:
2205
logger.warning("Bad certificate: %s", error)
2206
return
2207
logger.debug("Fingerprint: %s", fpr)
2208
2209
try:
2210
client = ProxyClient(child_pipe, fpr,
2385
if gnutls.has_rawpk:
2386
fpr = b""
2387
try:
2388
key_id = self.key_id(
2389
self.peer_certificate(session))
2390
except (TypeError, gnutls.Error) as error:
2391
log.warning("Bad certificate: %s", error)
2392
return
2393
log.debug("Key ID: %s",
2394
key_id.decode("utf-8",
2395
errors="replace"))
2396
2397
else:
2398
key_id = b""
2399
try:
2400
fpr = self.fingerprint(
2401
self.peer_certificate(session))
2402
except (TypeError, gnutls.Error) as error:
2403
log.warning("Bad certificate: %s", error)
2404
return
2405
log.debug("Fingerprint: %s", fpr)
2406
2407
try:
2408
client = ProxyClient(child_pipe, key_id, fpr,
2211
2409
self.client_address)
2212
2410
except KeyError:
2213
2411
return
2214
2412
2215
2413
if client.approval_delay:
2216
2414
delay = client.approval_delay
2217
2415
client.approvals_pending += 1
2218
2416
approval_required = True
2219
2417
2220
2418
while True:
2221
2419
if not client.enabled:
2222
logger.info("Client %s is disabled",
2223
client.name)
2420
log.info("Client %s is disabled", client.name)
2224
2421
if self.server.use_dbus:
2225
2422
# Emit D-Bus signal
2226
2423
client.Rejected("Disabled")
2227
2424
return
2228
2425
2229
2426
if client.approved or not client.approval_delay:
2230
#We are approved or approval is disabled
2427
# We are approved or approval is disabled
2231
2428
break
2232
2429
elif client.approved is None:
2233
logger.info("Client %s needs approval",
2234
client.name)
2430
log.info("Client %s needs approval",
2431
client.name)
2235
2432
if self.server.use_dbus:
2236
2433
# Emit D-Bus signal
2237
2434
client.NeedApproval(
2238
2435
client.approval_delay.total_seconds()
2239
2436
* 1000, client.approved_by_default)
2240
2437
else:
2241
logger.warning("Client %s was not approved",
2242
client.name)
2438
log.warning("Client %s was not approved",
2439
client.name)
2243
2440
if self.server.use_dbus:
2244
2441
# Emit D-Bus signal
2245
2442
client.Rejected("Denied")
2246
2443
return
2247
2248
#wait until timeout or approved
2444
2445
# wait until timeout or approved
2249
2446
time = datetime.datetime.now()
2250
2447
client.changedstate.acquire()
2251
2448
client.changedstate.wait(delay.total_seconds())
2253
2450
time2 = datetime.datetime.now()
2254
2451
if (time2 - time) >= delay:
2255
2452
if not client.approved_by_default:
2256
logger.warning("Client %s timed out while"
2257
" waiting for approval",
2258
client.name)
2453
log.warning("Client %s timed out while"
2454
" waiting for approval",
2455
client.name)
2259
2456
if self.server.use_dbus:
2260
2457
# Emit D-Bus signal
2261
2458
client.Rejected("Approval timed out")
2264
2461
break
2265
2462
else:
2266
2463
delay -= time2 - time
2267
2464
2268
2465
try:
2269
2466
session.send(client.secret)
2270
2467
except gnutls.Error as error:
2271
logger.warning("gnutls send failed",
2272
exc_info = error)
2468
log.warning("gnutls send failed", exc_info=error)
2273
2469
return
2274
2275
logger.info("Sending secret to %s", client.name)
2470
2471
log.info("Sending secret to %s", client.name)
2276
2472
# bump the timeout using extended_timeout
2277
2473
client.bump_timeout(client.extended_timeout)
2278
2474
if self.server.use_dbus:
2279
2475
# Emit D-Bus signal
2280
2476
client.GotSecret()
2281
2477
2282
2478
finally:
2283
2479
if approval_required:
2284
2480
client.approvals_pending -= 1
2285
2481
try:
2286
2482
session.bye()
2287
2483
except gnutls.Error as error:
2288
logger.warning("GnuTLS bye failed",
2289
exc_info=error)
2290
2484
log.warning("GnuTLS bye failed", exc_info=error)
2485
2291
2486
@staticmethod
2292
2487
def peer_certificate(session):
2293
"Return the peer's OpenPGP certificate as a bytestring"
2294
# If not an OpenPGP certificate...
2295
if (gnutls.certificate_type_get(session._c_object)
2296
!= gnutls.CRT_OPENPGP):
2488
"Return the peer's certificate as a bytestring"
2489
try:
2490
cert_type = gnutls.certificate_type_get2(
2491
session, gnutls.CTYPE_PEERS)
2492
except AttributeError:
2493
cert_type = gnutls.certificate_type_get(session)
2494
if gnutls.has_rawpk:
2495
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2496
else:
2497
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2498
# If not a valid certificate type...
2499
if cert_type not in valid_cert_types:
2500
log.info("Cert type %r not in %r", cert_type,
2501
valid_cert_types)
2297
2502
# ...return invalid data
2298
2503
return b""
2299
2504
list_size = ctypes.c_uint(1)
2300
2505
cert_list = (gnutls.certificate_get_peers
2301
(session._c_object, ctypes.byref(list_size)))
2506
(session, ctypes.byref(list_size)))
2302
2507
if not bool(cert_list) and list_size.value != 0:
2303
2508
raise gnutls.Error("error getting peer certificate")
2304
2509
if list_size.value == 0:
2305
2510
return None
2306
2511
cert = cert_list[0]
2307
2512
return ctypes.string_at(cert.data, cert.size)
2308
2513
2514
@staticmethod
2515
def key_id(certificate):
2516
"Convert a certificate bytestring to a hexdigit key ID"
2517
# New GnuTLS "datum" with the public key
2518
datum = gnutls.datum_t(
2519
ctypes.cast(ctypes.c_char_p(certificate),
2520
ctypes.POINTER(ctypes.c_ubyte)),
2521
ctypes.c_uint(len(certificate)))
2522
# XXX all these need to be created in the gnutls "module"
2523
# New empty GnuTLS certificate
2524
pubkey = gnutls.pubkey_t()
2525
gnutls.pubkey_init(ctypes.byref(pubkey))
2526
# Import the raw public key into the certificate
2527
gnutls.pubkey_import(pubkey,
2528
ctypes.byref(datum),
2529
gnutls.X509_FMT_DER)
2530
# New buffer for the key ID
2531
buf = ctypes.create_string_buffer(32)
2532
buf_len = ctypes.c_size_t(len(buf))
2533
# Get the key ID from the raw public key into the buffer
2534
gnutls.pubkey_get_key_id(
2535
pubkey,
2536
gnutls.KEYID_USE_SHA256,
2537
ctypes.cast(ctypes.byref(buf),
2538
ctypes.POINTER(ctypes.c_ubyte)),
2539
ctypes.byref(buf_len))
2540
# Deinit the certificate
2541
gnutls.pubkey_deinit(pubkey)
2542
2543
# Convert the buffer to a Python bytestring
2544
key_id = ctypes.string_at(buf, buf_len.value)
2545
# Convert the bytestring to hexadecimal notation
2546
hex_key_id = binascii.hexlify(key_id).upper()
2547
return hex_key_id
2548
2309
2549
@staticmethod
2310
2550
def fingerprint(openpgp):
2311
2551
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2326
2566
ctypes.byref(crtverify))
2327
2567
if crtverify.value != 0:
2328
2568
gnutls.openpgp_crt_deinit(crt)
2329
raise gnutls.CertificateSecurityError("Verify failed")
2569
raise gnutls.CertificateSecurityError(code
2570
=crtverify.value)
2330
2571
# New buffer for the fingerprint
2331
2572
buf = ctypes.create_string_buffer(20)
2332
2573
buf_len = ctypes.c_size_t()
2342
2583
return hex_fpr
2343
2584
2344
2585
2345
class MultiprocessingMixIn(object):
2586
class MultiprocessingMixIn:
2346
2587
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2347
2588
2348
2589
def sub_process_main(self, request, address):
2349
2590
try:
2350
2591
self.finish_request(request, address)
2351
2592
except Exception:
2352
2593
self.handle_error(request, address)
2353
2594
self.close_request(request)
2354
2595
2355
2596
def process_request(self, request, address):
2356
2597
"""Start a new process to process the request."""
2357
proc = multiprocessing.Process(target = self.sub_process_main,
2358
args = (request, address))
2598
proc = multiprocessing.Process(target=self.sub_process_main,
2599
args=(request, address))
2359
2600
proc.start()
2360
2601
return proc
2361
2602
2362
2603
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2604
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2364
2605
""" adds a pipe to the MixIn """
2365
2606
2366
2607
def process_request(self, request, client_address):
2367
2608
"""Overrides and wraps the original process_request().
2368
2609
2369
2610
This function creates a new pipe in self.pipe
2370
2611
"""
2371
2612
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2372
2613
2373
2614
proc = MultiprocessingMixIn.process_request(self, request,
2374
2615
client_address)
2375
2616
self.child_pipe.close()
2376
2617
self.add_pipe(parent_pipe, proc)
2377
2618
2378
2619
def add_pipe(self, parent_pipe, proc):
2379
2620
"""Dummy function; override as necessary"""
2380
2621
raise NotImplementedError()
2381
2622
2382
2623
2383
2624
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2384
socketserver.TCPServer, object):
2385
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2386
2625
socketserver.TCPServer):
2626
"""IPv6-capable TCP server. Accepts None as address and/or port
2627
2387
2628
Attributes:
2388
2629
enabled: Boolean; whether this server is activated yet
2389
2630
interface: None or a network interface name (string)
2390
2631
use_ipv6: Boolean; to use IPv6 or not
2391
2632
"""
2392
2633
2393
2634
def __init__(self, server_address, RequestHandlerClass,
2394
2635
interface=None,
2395
2636
use_ipv6=True,
2405
2646
self.socketfd = socketfd
2406
2647
# Save the original socket.socket() function
2407
2648
self.socket_socket = socket.socket
2649
2408
2650
# To implement --socket, we monkey patch socket.socket.
2409
#
2651
#
2410
2652
# (When socketserver.TCPServer is a new-style class, we
2411
2653
# could make self.socket into a property instead of monkey
2412
2654
# patching socket.socket.)
2413
#
2655
#
2414
2656
# Create a one-time-only replacement for socket.socket()
2415
2657
@functools.wraps(socket.socket)
2416
2658
def socket_wrapper(*args, **kwargs):
2428
2670
# socket_wrapper(), if socketfd was set.
2429
2671
socketserver.TCPServer.__init__(self, server_address,
2430
2672
RequestHandlerClass)
2431
2673
2432
2674
def server_bind(self):
2433
2675
"""This overrides the normal server_bind() function
2434
2676
to bind to an interface if one was specified, and also NOT to
2435
2677
bind to an address or port if they were not specified."""
2678
global SO_BINDTODEVICE
2436
2679
if self.interface is not None:
2437
2680
if SO_BINDTODEVICE is None:
2438
logger.error("SO_BINDTODEVICE does not exist;"
2439
" cannot bind to interface %s",
2440
self.interface)
2441
else:
2442
try:
2443
self.socket.setsockopt(
2444
socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
(self.interface + "\0").encode("utf-8"))
2446
except socket.error as error:
2447
if error.errno == errno.EPERM:
2448
logger.error("No permission to bind to"
2449
" interface %s", self.interface)
2450
elif error.errno == errno.ENOPROTOOPT:
2451
logger.error("SO_BINDTODEVICE not available;"
2452
" cannot bind to interface %s",
2453
self.interface)
2454
elif error.errno == errno.ENODEV:
2455
logger.error("Interface %s does not exist,"
2456
" cannot bind", self.interface)
2457
else:
2458
raise
2681
# Fall back to a hard-coded value which seems to be
2682
# common enough.
2683
log.warning("SO_BINDTODEVICE not found, trying 25")
2684
SO_BINDTODEVICE = 25
2685
try:
2686
self.socket.setsockopt(
2687
socket.SOL_SOCKET, SO_BINDTODEVICE,
2688
(self.interface + "\0").encode("utf-8"))
2689
except socket.error as error:
2690
if error.errno == errno.EPERM:
2691
log.error("No permission to bind to interface %s",
2692
self.interface)
2693
elif error.errno == errno.ENOPROTOOPT:
2694
log.error("SO_BINDTODEVICE not available; cannot"
2695
" bind to interface %s", self.interface)
2696
elif error.errno == errno.ENODEV:
2697
log.error("Interface %s does not exist, cannot"
2698
" bind", self.interface)
2699
else:
2700
raise
2459
2701
# Only bind(2) the socket if we really need to.
2460
2702
if self.server_address[0] or self.server_address[1]:
2703
if self.server_address[1]:
2704
self.allow_reuse_address = True
2461
2705
if not self.server_address[0]:
2462
2706
if self.address_family == socket.AF_INET6:
2463
any_address = "::" # in6addr_any
2707
any_address = "::" # in6addr_any
2464
2708
else:
2465
any_address = "0.0.0.0" # INADDR_ANY
2709
any_address = "0.0.0.0" # INADDR_ANY
2466
2710
self.server_address = (any_address,
2467
2711
self.server_address[1])
2468
2712
elif not self.server_address[1]:
2478
2722
2479
2723
class MandosServer(IPv6_TCPServer):
2480
2724
"""Mandos server.
2481
2725
2482
2726
Attributes:
2483
2727
clients: set of Client objects
2484
2728
gnutls_priority GnuTLS priority string
2485
2729
use_dbus: Boolean; to emit D-Bus signals or not
2486
2730
2487
2731
Assumes a GLib.MainLoop event loop.
2488
2732
"""
2489
2733
2490
2734
def __init__(self, server_address, RequestHandlerClass,
2491
2735
interface=None,
2492
2736
use_ipv6=True,
2502
2746
self.gnutls_priority = gnutls_priority
2503
2747
IPv6_TCPServer.__init__(self, server_address,
2504
2748
RequestHandlerClass,
2505
interface = interface,
2506
use_ipv6 = use_ipv6,
2507
socketfd = socketfd)
2508
2749
interface=interface,
2750
use_ipv6=use_ipv6,
2751
socketfd=socketfd)
2752
2509
2753
def server_activate(self):
2510
2754
if self.enabled:
2511
2755
return socketserver.TCPServer.server_activate(self)
2512
2756
2513
2757
def enable(self):
2514
2758
self.enabled = True
2515
2759
2516
2760
def add_pipe(self, parent_pipe, proc):
2517
2761
# Call "handle_ipc" for both data and EOF events
2518
2762
GLib.io_add_watch(
2519
parent_pipe.fileno(),
2520
GLib.IO_IN | GLib.IO_HUP,
2763
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2764
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2521
2765
functools.partial(self.handle_ipc,
2522
parent_pipe = parent_pipe,
2523
proc = proc))
2524
2766
parent_pipe=parent_pipe,
2767
proc=proc))
2768
2525
2769
def handle_ipc(self, source, condition,
2526
2770
parent_pipe=None,
2527
proc = None,
2771
proc=None,
2528
2772
client_object=None):
2529
2773
# error, or the other end of multiprocessing.Pipe has closed
2530
2774
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2531
2775
# Wait for other process to exit
2532
2776
proc.join()
2533
2777
return False
2534
2778
2535
2779
# Read a request from the child
2536
2780
request = parent_pipe.recv()
2537
2781
command = request[0]
2538
2539
if command == 'init':
2540
fpr = request[1]
2541
address = request[2]
2542
2782
2783
if command == "init":
2784
key_id = request[1].decode("ascii")
2785
fpr = request[2].decode("ascii")
2786
address = request[3]
2787
2543
2788
for c in self.clients.values():
2544
if c.fingerprint == fpr:
2789
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2790
"27AE41E4649B934CA495991B7852B855"):
2791
continue
2792
if key_id and c.key_id == key_id:
2793
client = c
2794
break
2795
if fpr and c.fingerprint == fpr:
2545
2796
client = c
2546
2797
break
2547
2798
else:
2548
logger.info("Client not found for fingerprint: %s, ad"
2549
"dress: %s", fpr, address)
2799
log.info("Client not found for key ID: %s, address:"
2800
" %s", key_id or fpr, address)
2550
2801
if self.use_dbus:
2551
2802
# Emit D-Bus signal
2552
mandos_dbus_service.ClientNotFound(fpr,
2803
mandos_dbus_service.ClientNotFound(key_id or fpr,
2553
2804
address[0])
2554
2805
parent_pipe.send(False)
2555
2806
return False
2556
2807
2557
2808
GLib.io_add_watch(
2558
parent_pipe.fileno(),
2559
GLib.IO_IN | GLib.IO_HUP,
2809
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2810
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2560
2811
functools.partial(self.handle_ipc,
2561
parent_pipe = parent_pipe,
2562
proc = proc,
2563
client_object = client))
2812
parent_pipe=parent_pipe,
2813
proc=proc,
2814
client_object=client))
2564
2815
parent_pipe.send(True)
2565
2816
# remove the old hook in favor of the new above hook on
2566
2817
# same fileno
2567
2818
return False
2568
if command == 'funcall':
2819
if command == "funcall":
2569
2820
funcname = request[1]
2570
2821
args = request[2]
2571
2822
kwargs = request[3]
2572
2573
parent_pipe.send(('data', getattr(client_object,
2823
2824
parent_pipe.send(("data", getattr(client_object,
2574
2825
funcname)(*args,
2575
2826
**kwargs)))
2576
2577
if command == 'getattr':
2827
2828
if command == "getattr":
2578
2829
attrname = request[1]
2579
2830
if isinstance(client_object.__getattribute__(attrname),
2580
collections.Callable):
2581
parent_pipe.send(('function', ))
2831
collections.abc.Callable):
2832
parent_pipe.send(("function", ))
2582
2833
else:
2583
2834
parent_pipe.send((
2584
'data', client_object.__getattribute__(attrname)))
2585
2586
if command == 'setattr':
2835
"data", client_object.__getattribute__(attrname)))
2836
2837
if command == "setattr":
2587
2838
attrname = request[1]
2588
2839
value = request[2]
2589
2840
setattr(client_object, attrname, value)
2590
2841
2591
2842
return True
2592
2843
2593
2844
2594
2845
def rfc3339_duration_to_delta(duration):
2595
2846
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2596
2597
>>> rfc3339_duration_to_delta("P7D")
2598
datetime.timedelta(7)
2599
>>> rfc3339_duration_to_delta("PT60S")
2600
datetime.timedelta(0, 60)
2601
>>> rfc3339_duration_to_delta("PT60M")
2602
datetime.timedelta(0, 3600)
2603
>>> rfc3339_duration_to_delta("PT24H")
2604
datetime.timedelta(1)
2605
>>> rfc3339_duration_to_delta("P1W")
2606
datetime.timedelta(7)
2607
>>> rfc3339_duration_to_delta("PT5M30S")
2608
datetime.timedelta(0, 330)
2609
>>> rfc3339_duration_to_delta("P1DT3M20S")
2610
datetime.timedelta(1, 200)
2847
2848
>>> timedelta = datetime.timedelta
2849
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2850
True
2851
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2852
True
2853
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2854
True
2855
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2856
True
2857
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2858
True
2859
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2860
True
2861
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2862
True
2863
>>> del timedelta
2611
2864
"""
2612
2865
2613
2866
# Parsing an RFC 3339 duration with regular expressions is not
2614
2867
# possible - there would have to be multiple places for the same
2615
2868
# values, like seconds. The current code, while more esoteric, is
2616
2869
# cleaner without depending on a parsing library. If Python had a
2617
2870
# built-in library for parsing we would use it, but we'd like to
2618
2871
# avoid excessive use of external libraries.
2619
2872
2620
2873
# New type for defining tokens, syntax, and semantics all-in-one
2621
2874
Token = collections.namedtuple("Token", (
2622
2875
"regexp", # To match token; if "value" is not None, must have
2655
2908
frozenset((token_year, token_month,
2656
2909
token_day, token_time,
2657
2910
token_week)))
2658
# Define starting values
2659
value = datetime.timedelta() # Value so far
2911
# Define starting values:
2912
# Value so far
2913
value = datetime.timedelta()
2660
2914
found_token = None
2661
followers = frozenset((token_duration, )) # Following valid tokens
2662
s = duration # String left to parse
2915
# Following valid tokens
2916
followers = frozenset((token_duration, ))
2917
# String left to parse
2918
s = duration
2663
2919
# Loop until end token is found
2664
2920
while found_token is not token_end:
2665
2921
# Search for any currently valid tokens
2689
2945
2690
2946
def string_to_delta(interval):
2691
2947
"""Parse a string and return a datetime.timedelta
2692
2693
>>> string_to_delta('7d')
2694
datetime.timedelta(7)
2695
>>> string_to_delta('60s')
2696
datetime.timedelta(0, 60)
2697
>>> string_to_delta('60m')
2698
datetime.timedelta(0, 3600)
2699
>>> string_to_delta('24h')
2700
datetime.timedelta(1)
2701
>>> string_to_delta('1w')
2702
datetime.timedelta(7)
2703
>>> string_to_delta('5m 30s')
2704
datetime.timedelta(0, 330)
2948
2949
>>> string_to_delta("7d") == datetime.timedelta(7)
2950
True
2951
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2952
True
2953
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2954
True
2955
>>> string_to_delta("24h") == datetime.timedelta(1)
2956
True
2957
>>> string_to_delta("1w") == datetime.timedelta(7)
2958
True
2959
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2960
True
2705
2961
"""
2706
2962
2707
2963
try:
2708
2964
return rfc3339_duration_to_delta(interval)
2709
2965
except ValueError:
2710
2966
pass
2711
2967
2712
2968
timevalue = datetime.timedelta(0)
2713
2969
for s in interval.split():
2714
2970
try:
2732
2988
return timevalue
2733
2989
2734
2990
2735
def daemon(nochdir = False, noclose = False):
2991
def daemon(nochdir=False, noclose=False):
2736
2992
"""See daemon(3). Standard BSD Unix function.
2737
2993
2738
2994
This should really exist as os.daemon, but it doesn't (yet)."""
2739
2995
if os.fork():
2740
2996
sys.exit()
2758
3014
2759
3015
2760
3016
def main():
2761
3017
2762
3018
##################################################################
2763
3019
# Parsing of options, both command line and config file
2764
3020
2765
3021
parser = argparse.ArgumentParser()
2766
3022
parser.add_argument("-v", "--version", action="version",
2767
version = "%(prog)s {}".format(version),
3023
version="%(prog)s {}".format(version),
2768
3024
help="show version number and exit")
2769
3025
parser.add_argument("-i", "--interface", metavar="IF",
2770
3026
help="Bind to interface IF")
2806
3062
parser.add_argument("--no-zeroconf", action="store_false",
2807
3063
dest="zeroconf", help="Do not use Zeroconf",
2808
3064
default=None)
2809
3065
2810
3066
options = parser.parse_args()
2811
2812
if options.check:
2813
import doctest
2814
fail_count, test_count = doctest.testmod()
2815
sys.exit(os.EX_OK if fail_count == 0 else 1)
2816
3067
2817
3068
# Default values for config file for server-global settings
2818
server_defaults = { "interface": "",
2819
"address": "",
2820
"port": "",
2821
"debug": "False",
2822
"priority":
2823
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2824
":+SIGN-DSA-SHA256",
2825
"servicename": "Mandos",
2826
"use_dbus": "True",
2827
"use_ipv6": "True",
2828
"debuglevel": "",
2829
"restore": "True",
2830
"socket": "",
2831
"statedir": "/var/lib/mandos",
2832
"foreground": "False",
2833
"zeroconf": "True",
2834
}
2835
3069
if gnutls.has_rawpk:
3070
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3072
else:
3073
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3074
":+SIGN-DSA-SHA256")
3075
server_defaults = {"interface": "",
3076
"address": "",
3077
"port": "",
3078
"debug": "False",
3079
"priority": priority,
3080
"servicename": "Mandos",
3081
"use_dbus": "True",
3082
"use_ipv6": "True",
3083
"debuglevel": "",
3084
"restore": "True",
3085
"socket": "",
3086
"statedir": "/var/lib/mandos",
3087
"foreground": "False",
3088
"zeroconf": "True",
3089
}
3090
del priority
3091
2836
3092
# Parse config file for server-global settings
2837
server_config = configparser.SafeConfigParser(server_defaults)
3093
server_config = configparser.ConfigParser(server_defaults)
2838
3094
del server_defaults
2839
3095
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2840
# Convert the SafeConfigParser object to a dict
3096
# Convert the ConfigParser object to a dict
2841
3097
server_settings = server_config.defaults()
2842
3098
# Use the appropriate methods on the non-string config options
2843
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3099
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3100
"foreground", "zeroconf"):
2844
3101
server_settings[option] = server_config.getboolean("DEFAULT",
2845
3102
option)
2846
3103
if server_settings["port"]:
2852
3109
# Later, stdin will, and stdout and stderr might, be dup'ed
2853
3110
# over with an opened os.devnull. But we don't want this to
2854
3111
# happen with a supplied network socket.
2855
if 0 <= server_settings["socket"] <= 2:
3112
while 0 <= server_settings["socket"] <= 2:
2856
3113
server_settings["socket"] = os.dup(server_settings
2857
3114
["socket"])
3115
os.set_inheritable(server_settings["socket"], False)
2858
3116
del server_config
2859
3117
2860
3118
# Override the settings from the config file with command line
2861
3119
# options, if set.
2862
3120
for option in ("interface", "address", "port", "debug",
2880
3138
if server_settings["debug"]:
2881
3139
server_settings["foreground"] = True
2882
3140
# Now we have our good server settings in "server_settings"
2883
3141
2884
3142
##################################################################
2885
3143
2886
3144
if (not server_settings["zeroconf"]
2887
3145
and not (server_settings["port"]
2888
3146
or server_settings["socket"] != "")):
2889
3147
parser.error("Needs port or socket to work without Zeroconf")
2890
3148
2891
3149
# For convenience
2892
3150
debug = server_settings["debug"]
2893
3151
debuglevel = server_settings["debuglevel"]
2897
3155
stored_state_file)
2898
3156
foreground = server_settings["foreground"]
2899
3157
zeroconf = server_settings["zeroconf"]
2900
3158
2901
3159
if debug:
2902
3160
initlogger(debug, logging.DEBUG)
2903
3161
else:
2906
3164
else:
2907
3165
level = getattr(logging, debuglevel.upper())
2908
3166
initlogger(debug, level)
2909
3167
2910
3168
if server_settings["servicename"] != "Mandos":
2911
3169
syslogger.setFormatter(
2912
logging.Formatter('Mandos ({}) [%(process)d]:'
2913
' %(levelname)s: %(message)s'.format(
3170
logging.Formatter("Mandos ({}) [%(process)d]:"
3171
" %(levelname)s: %(message)s".format(
2914
3172
server_settings["servicename"])))
2915
3173
2916
3174
# Parse config file with clients
2917
client_config = configparser.SafeConfigParser(Client
2918
.client_defaults)
3175
client_config = configparser.ConfigParser(Client.client_defaults)
2919
3176
client_config.read(os.path.join(server_settings["configdir"],
2920
3177
"clients.conf"))
2921
3178
2922
3179
global mandos_dbus_service
2923
3180
mandos_dbus_service = None
2924
3181
2925
3182
socketfd = None
2926
3183
if server_settings["socket"] != "":
2927
3184
socketfd = server_settings["socket"]
2941
3198
try:
2942
3199
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2943
3200
except IOError as e:
2944
logger.error("Could not open file %r", pidfilename,
2945
exc_info=e)
2946
3201
log.error("Could not open file %r", pidfilename,
3202
exc_info=e)
3203
2947
3204
for name, group in (("_mandos", "_mandos"),
2948
3205
("mandos", "mandos"),
2949
3206
("nobody", "nogroup")):
2959
3216
try:
2960
3217
os.setgid(gid)
2961
3218
os.setuid(uid)
2962
if debug:
2963
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2964
gid))
3219
log.debug("Did setuid/setgid to %s:%s", uid, gid)
2965
3220
except OSError as error:
2966
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2967
.format(uid, gid, os.strerror(error.errno)))
3221
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3222
os.strerror(error.errno))
2968
3223
if error.errno != errno.EPERM:
2969
3224
raise
2970
3225
2971
3226
if debug:
2972
3227
# Enable all possible GnuTLS debugging
2973
3228
2974
3229
# "Use a log level over 10 to enable all debugging options."
2975
3230
# - GnuTLS manual
2976
3231
gnutls.global_set_log_level(11)
2977
3232
2978
3233
@gnutls.log_func
2979
3234
def debug_gnutls(level, string):
2980
logger.debug("GnuTLS: %s", string[:-1])
2981
3235
log.debug("GnuTLS: %s",
3236
string[:-1].decode("utf-8", errors="replace"))
3237
2982
3238
gnutls.global_set_log_function(debug_gnutls)
2983
3239
2984
3240
# Redirect stdin so all checkers get /dev/null
2985
3241
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2986
3242
os.dup2(null, sys.stdin.fileno())
2987
3243
if null > 2:
2988
3244
os.close(null)
2989
3245
2990
3246
# Need to fork before connecting to D-Bus
2991
3247
if not foreground:
2992
3248
# Close all input and output, do double fork, etc.
2993
3249
daemon()
2994
2995
# multiprocessing will use threads, so before we use GLib we need
2996
# to inform GLib that threads will be used.
2997
GLib.threads_init()
2998
3250
3251
if gi.version_info < (3, 10, 2):
3252
# multiprocessing will use threads, so before we use GLib we
3253
# need to inform GLib that threads will be used.
3254
GLib.threads_init()
3255
2999
3256
global main_loop
3000
3257
# From the Avahi example code
3001
3258
DBusGMainLoop(set_as_default=True)
3002
3259
main_loop = GLib.MainLoop()
3003
bus = dbus.SystemBus()
3260
if use_dbus or zeroconf:
3261
bus = dbus.SystemBus()
3004
3262
# End of Avahi example code
3005
3263
if use_dbus:
3006
3264
try:
3011
3269
"se.bsnet.fukt.Mandos", bus,
3012
3270
do_not_queue=True)
3013
3271
except dbus.exceptions.DBusException as e:
3014
logger.error("Disabling D-Bus:", exc_info=e)
3272
log.error("Disabling D-Bus:", exc_info=e)
3015
3273
use_dbus = False
3016
3274
server_settings["use_dbus"] = False
3017
3275
tcp_server.use_dbus = False
3018
3276
if zeroconf:
3019
3277
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3020
3278
service = AvahiServiceToSyslog(
3021
name = server_settings["servicename"],
3022
servicetype = "_mandos._tcp",
3023
protocol = protocol,
3024
bus = bus)
3279
name=server_settings["servicename"],
3280
servicetype="_mandos._tcp",
3281
protocol=protocol,
3282
bus=bus)
3025
3283
if server_settings["interface"]:
3026
3284
service.interface = if_nametoindex(
3027
3285
server_settings["interface"].encode("utf-8"))
3028
3286
3029
3287
global multiprocessing_manager
3030
3288
multiprocessing_manager = multiprocessing.Manager()
3031
3289
3032
3290
client_class = Client
3033
3291
if use_dbus:
3034
client_class = functools.partial(ClientDBus, bus = bus)
3035
3292
client_class = functools.partial(ClientDBus, bus=bus)
3293
3036
3294
client_settings = Client.config_parser(client_config)
3037
3295
old_client_settings = {}
3038
3296
clients_data = {}
3039
3297
3040
3298
# This is used to redirect stdout and stderr for checker processes
3041
3299
global wnull
3042
wnull = open(os.devnull, "w") # A writable /dev/null
3300
wnull = open(os.devnull, "w") # A writable /dev/null
3043
3301
# Only used if server is running in foreground but not in debug
3044
3302
# mode
3045
3303
if debug or not foreground:
3046
3304
wnull.close()
3047
3305
3048
3306
# Get client data and settings from last running state.
3049
3307
if server_settings["restore"]:
3050
3308
try:
3051
3309
with open(stored_state_path, "rb") as stored_state:
3052
if sys.version_info.major == 2:
3310
if sys.version_info.major == 2:
3053
3311
clients_data, old_client_settings = pickle.load(
3054
3312
stored_state)
3055
3313
else:
3056
3314
bytes_clients_data, bytes_old_client_settings = (
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3059
## clients_data
3315
pickle.load(stored_state, encoding="bytes"))
3316
# Fix bytes to strings
3317
# clients_data
3060
3318
# .keys()
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3063
else key): value
3064
for key, value in
3065
bytes_clients_data.items() }
3319
clients_data = {(key.decode("utf-8")
3320
if isinstance(key, bytes)
3321
else key): value
3322
for key, value in
3323
bytes_clients_data.items()}
3066
3324
del bytes_clients_data
3067
3325
for key in clients_data:
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3070
for k, v in
3071
clients_data[key].items() }
3326
value = {(k.decode("utf-8")
3327
if isinstance(k, bytes) else k): v
3328
for k, v in
3329
clients_data[key].items()}
3072
3330
clients_data[key] = value
3073
3331
# .client_structure
3074
3332
value["client_structure"] = [
3075
3333
(s.decode("utf-8")
3076
3334
if isinstance(s, bytes)
3077
3335
else s) for s in
3078
value["client_structure"] ]
3079
# .name & .host
3080
for k in ("name", "host"):
3336
value["client_structure"]]
3337
# .name, .host, and .checker_command
3338
for k in ("name", "host", "checker_command"):
3081
3339
if isinstance(value[k], bytes):
3082
3340
value[k] = value[k].decode("utf-8")
3083
## old_client_settings
3341
if "key_id" not in value:
3342
value["key_id"] = ""
3343
elif "fingerprint" not in value:
3344
value["fingerprint"] = ""
3345
# old_client_settings
3084
3346
# .keys()
3085
3347
old_client_settings = {
3086
3348
(key.decode("utf-8")
3087
3349
if isinstance(key, bytes)
3088
3350
else key): value
3089
3351
for key, value in
3090
bytes_old_client_settings.items() }
3352
bytes_old_client_settings.items()}
3091
3353
del bytes_old_client_settings
3092
# .host
3354
# .host and .checker_command
3093
3355
for value in old_client_settings.values():
3094
if isinstance(value["host"], bytes):
3095
value["host"] = (value["host"]
3096
.decode("utf-8"))
3356
for attribute in ("host", "checker_command"):
3357
if isinstance(value[attribute], bytes):
3358
value[attribute] = (value[attribute]
3359
.decode("utf-8"))
3097
3360
os.remove(stored_state_path)
3098
3361
except IOError as e:
3099
3362
if e.errno == errno.ENOENT:
3100
logger.warning("Could not load persistent state:"
3101
" {}".format(os.strerror(e.errno)))
3363
log.warning("Could not load persistent state:"
3364
" %s", os.strerror(e.errno))
3102
3365
else:
3103
logger.critical("Could not load persistent state:",
3104
exc_info=e)
3366
log.critical("Could not load persistent state:",
3367
exc_info=e)
3105
3368
raise
3106
3369
except EOFError as e:
3107
logger.warning("Could not load persistent state: "
3108
"EOFError:",
3109
exc_info=e)
3110
3370
log.warning("Could not load persistent state: EOFError:",
3371
exc_info=e)
3372
3111
3373
with PGPEngine() as pgp:
3112
3374
for client_name, client in clients_data.items():
3113
3375
# Skip removed clients
3114
3376
if client_name not in client_settings:
3115
3377
continue
3116
3378
3117
3379
# Decide which value to use after restoring saved state.
3118
3380
# We have three different values: Old config file,
3119
3381
# new config file, and saved state.
3130
3392
client[name] = value
3131
3393
except KeyError:
3132
3394
pass
3133
3395
3134
3396
# Clients who has passed its expire date can still be
3135
3397
# enabled if its last checker was successful. A Client
3136
3398
# whose checker succeeded before we stored its state is
3139
3401
if client["enabled"]:
3140
3402
if datetime.datetime.utcnow() >= client["expires"]:
3141
3403
if not client["last_checked_ok"]:
3142
logger.warning(
3143
"disabling client {} - Client never "
3144
"performed a successful checker".format(
3145
client_name))
3404
log.warning("disabling client %s - Client"
3405
" never performed a successful"
3406
" checker", client_name)
3146
3407
client["enabled"] = False
3147
3408
elif client["last_checker_status"] != 0:
3148
logger.warning(
3149
"disabling client {} - Client last"
3150
" checker failed with error code"
3151
" {}".format(
3152
client_name,
3153
client["last_checker_status"]))
3409
log.warning("disabling client %s - Client"
3410
" last checker failed with error"
3411
" code %s", client_name,
3412
client["last_checker_status"])
3154
3413
client["enabled"] = False
3155
3414
else:
3156
3415
client["expires"] = (
3157
3416
datetime.datetime.utcnow()
3158
3417
+ client["timeout"])
3159
logger.debug("Last checker succeeded,"
3160
" keeping {} enabled".format(
3161
client_name))
3418
log.debug("Last checker succeeded, keeping %s"
3419
" enabled", client_name)
3162
3420
try:
3163
3421
client["secret"] = pgp.decrypt(
3164
3422
client["encrypted_secret"],
3165
3423
client_settings[client_name]["secret"])
3166
3424
except PGPError:
3167
3425
# If decryption fails, we use secret from new settings
3168
logger.debug("Failed to decrypt {} old secret".format(
3169
client_name))
3426
log.debug("Failed to decrypt %s old secret",
3427
client_name)
3170
3428
client["secret"] = (client_settings[client_name]
3171
3429
["secret"])
3172
3430
3173
3431
# Add/remove clients based on new changes made to config
3174
3432
for client_name in (set(old_client_settings)
3175
3433
- set(client_settings)):
3177
3435
for client_name in (set(client_settings)
3178
3436
- set(old_client_settings)):
3179
3437
clients_data[client_name] = client_settings[client_name]
3180
3438
3181
3439
# Create all client objects
3182
3440
for client_name, client in clients_data.items():
3183
3441
tcp_server.clients[client_name] = client_class(
3184
name = client_name,
3185
settings = client,
3186
server_settings = server_settings)
3187
3442
name=client_name,
3443
settings=client,
3444
server_settings=server_settings)
3445
3188
3446
if not tcp_server.clients:
3189
logger.warning("No clients defined")
3190
3447
log.warning("No clients defined")
3448
3191
3449
if not foreground:
3192
3450
if pidfile is not None:
3193
3451
pid = os.getpid()
3195
3453
with pidfile:
3196
3454
print(pid, file=pidfile)
3197
3455
except IOError:
3198
logger.error("Could not write to file %r with PID %d",
3199
pidfilename, pid)
3456
log.error("Could not write to file %r with PID %d",
3457
pidfilename, pid)
3200
3458
del pidfile
3201
3459
del pidfilename
3202
3460
3203
3461
for termsig in (signal.SIGHUP, signal.SIGTERM):
3204
3462
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3205
3463
lambda: main_loop.quit() and False)
3206
3464
3207
3465
if use_dbus:
3208
3466
3209
3467
@alternate_dbus_interfaces(
3210
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3468
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3211
3469
class MandosDBusService(DBusObjectWithObjectManager):
3212
3470
"""A D-Bus proxy object"""
3213
3471
3214
3472
def __init__(self):
3215
3473
dbus.service.Object.__init__(self, bus, "/")
3216
3474
3217
3475
_interface = "se.recompile.Mandos"
3218
3476
3219
3477
@dbus.service.signal(_interface, signature="o")
3220
3478
def ClientAdded(self, objpath):
3221
3479
"D-Bus signal"
3222
3480
pass
3223
3481
3224
3482
@dbus.service.signal(_interface, signature="ss")
3225
def ClientNotFound(self, fingerprint, address):
3483
def ClientNotFound(self, key_id, address):
3226
3484
"D-Bus signal"
3227
3485
pass
3228
3486
3229
3487
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3230
3488
"true"})
3231
3489
@dbus.service.signal(_interface, signature="os")
3232
3490
def ClientRemoved(self, objpath, name):
3233
3491
"D-Bus signal"
3234
3492
pass
3235
3493
3236
3494
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3237
3495
"true"})
3238
3496
@dbus.service.method(_interface, out_signature="ao")
3240
3498
"D-Bus method"
3241
3499
return dbus.Array(c.dbus_object_path for c in
3242
3500
tcp_server.clients.values())
3243
3501
3244
3502
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3245
3503
"true"})
3246
3504
@dbus.service.method(_interface,
3248
3506
def GetAllClientsWithProperties(self):
3249
3507
"D-Bus method"
3250
3508
return dbus.Dictionary(
3251
{ c.dbus_object_path: c.GetAll(
3509
{c.dbus_object_path: c.GetAll(
3252
3510
"se.recompile.Mandos.Client")
3253
for c in tcp_server.clients.values() },
3511
for c in tcp_server.clients.values()},
3254
3512
signature="oa{sv}")
3255
3513
3256
3514
@dbus.service.method(_interface, in_signature="o")
3257
3515
def RemoveClient(self, object_path):
3258
3516
"D-Bus method"
3266
3524
self.client_removed_signal(c)
3267
3525
return
3268
3526
raise KeyError(object_path)
3269
3527
3270
3528
del _interface
3271
3529
3272
3530
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3273
out_signature = "a{oa{sa{sv}}}")
3531
out_signature="a{oa{sa{sv}}}")
3274
3532
def GetManagedObjects(self):
3275
3533
"""D-Bus method"""
3276
3534
return dbus.Dictionary(
3277
{ client.dbus_object_path:
3278
dbus.Dictionary(
3279
{ interface: client.GetAll(interface)
3280
for interface in
3281
client._get_all_interface_names()})
3282
for client in tcp_server.clients.values()})
3283
3535
{client.dbus_object_path:
3536
dbus.Dictionary(
3537
{interface: client.GetAll(interface)
3538
for interface in
3539
client._get_all_interface_names()})
3540
for client in tcp_server.clients.values()})
3541
3284
3542
def client_added_signal(self, client):
3285
3543
"""Send the new standard signal and the old signal"""
3286
3544
if use_dbus:
3288
3546
self.InterfacesAdded(
3289
3547
client.dbus_object_path,
3290
3548
dbus.Dictionary(
3291
{ interface: client.GetAll(interface)
3292
for interface in
3293
client._get_all_interface_names()}))
3549
{interface: client.GetAll(interface)
3550
for interface in
3551
client._get_all_interface_names()}))
3294
3552
# Old signal
3295
3553
self.ClientAdded(client.dbus_object_path)
3296
3554
3297
3555
def client_removed_signal(self, client):
3298
3556
"""Send the new standard signal and the old signal"""
3299
3557
if use_dbus:
3304
3562
# Old signal
3305
3563
self.ClientRemoved(client.dbus_object_path,
3306
3564
client.name)
3307
3565
3308
3566
mandos_dbus_service = MandosDBusService()
3309
3567
3568
# Save modules to variables to exempt the modules from being
3569
# unloaded before the function registered with atexit() is run.
3570
mp = multiprocessing
3571
wn = wnull
3572
3310
3573
def cleanup():
3311
3574
"Cleanup function; run on exit"
3312
3575
if zeroconf:
3313
3576
service.cleanup()
3314
3315
multiprocessing.active_children()
3316
wnull.close()
3577
3578
mp.active_children()
3579
wn.close()
3317
3580
if not (tcp_server.clients or client_settings):
3318
3581
return
3319
3582
3320
3583
# Store client before exiting. Secrets are encrypted with key
3321
3584
# based on what config file has. If config file is
3322
3585
# removed/edited, old secret will thus be unrecovable.
3327
3590
client.encrypted_secret = pgp.encrypt(client.secret,
3328
3591
key)
3329
3592
client_dict = {}
3330
3593
3331
3594
# A list of attributes that can not be pickled
3332
3595
# + secret.
3333
exclude = { "bus", "changedstate", "secret",
3334
"checker", "server_settings" }
3596
exclude = {"bus", "changedstate", "secret",
3597
"checker", "server_settings"}
3335
3598
for name, typ in inspect.getmembers(dbus.service
3336
3599
.Object):
3337
3600
exclude.add(name)
3338
3601
3339
3602
client_dict["encrypted_secret"] = (client
3340
3603
.encrypted_secret)
3341
3604
for attr in client.client_structure:
3342
3605
if attr not in exclude:
3343
3606
client_dict[attr] = getattr(client, attr)
3344
3607
3345
3608
clients[client.name] = client_dict
3346
3609
del client_settings[client.name]["secret"]
3347
3610
3348
3611
try:
3349
3612
with tempfile.NamedTemporaryFile(
3350
mode='wb',
3613
mode="wb",
3351
3614
suffix=".pickle",
3352
prefix='clients-',
3615
prefix="clients-",
3353
3616
dir=os.path.dirname(stored_state_path),
3354
3617
delete=False) as stored_state:
3355
3618
pickle.dump((clients, client_settings), stored_state,
3356
protocol = 2)
3619
protocol=2)
3357
3620
tempname = stored_state.name
3358
3621
os.rename(tempname, stored_state_path)
3359
3622
except (IOError, OSError) as e:
3363
3626
except NameError:
3364
3627
pass
3365
3628
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3366
logger.warning("Could not save persistent state: {}"
3367
.format(os.strerror(e.errno)))
3629
log.warning("Could not save persistent state: %s",
3630
os.strerror(e.errno))
3368
3631
else:
3369
logger.warning("Could not save persistent state:",
3370
exc_info=e)
3632
log.warning("Could not save persistent state:",
3633
exc_info=e)
3371
3634
raise
3372
3635
3373
3636
# Delete all clients, and settings from config
3374
3637
while tcp_server.clients:
3375
3638
name, client = tcp_server.clients.popitem()
3381
3644
if use_dbus:
3382
3645
mandos_dbus_service.client_removed_signal(client)
3383
3646
client_settings.clear()
3384
3647
3385
3648
atexit.register(cleanup)
3386
3649
3387
3650
for client in tcp_server.clients.values():
3388
3651
if use_dbus:
3389
3652
# Emit D-Bus signal for adding
3390
3653
mandos_dbus_service.client_added_signal(client)
3391
3654
# Need to initiate checking of clients
3392
3655
if client.enabled:
3393
client.init_checker()
3394
3656
client.init_checker(randomize_start=True)
3657
3395
3658
tcp_server.enable()
3396
3659
tcp_server.server_activate()
3397
3660
3398
3661
# Find out what port we got
3399
3662
if zeroconf:
3400
3663
service.port = tcp_server.socket.getsockname()[1]
3401
3664
if use_ipv6:
3402
logger.info("Now listening on address %r, port %d,"
3403
" flowinfo %d, scope_id %d",
3404
*tcp_server.socket.getsockname())
3665
log.info("Now listening on address %r, port %d, flowinfo %d,"
3666
" scope_id %d", *tcp_server.socket.getsockname())
3405
3667
else: # IPv4
3406
logger.info("Now listening on address %r, port %d",
3407
*tcp_server.socket.getsockname())
3408
3409
#service.interface = tcp_server.socket.getsockname()[3]
3410
3668
log.info("Now listening on address %r, port %d",
3669
*tcp_server.socket.getsockname())
3670
3671
# service.interface = tcp_server.socket.getsockname()[3]
3672
3411
3673
try:
3412
3674
if zeroconf:
3413
3675
# From the Avahi example code
3414
3676
try:
3415
3677
service.activate()
3416
3678
except dbus.exceptions.DBusException as error:
3417
logger.critical("D-Bus Exception", exc_info=error)
3679
log.critical("D-Bus Exception", exc_info=error)
3418
3680
cleanup()
3419
3681
sys.exit(1)
3420
3682
# End of Avahi example code
3421
3422
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3423
lambda *args, **kwargs:
3424
(tcp_server.handle_request
3425
(*args[2:], **kwargs) or True))
3426
3427
logger.debug("Starting main loop")
3683
3684
GLib.io_add_watch(
3685
GLib.IOChannel.unix_new(tcp_server.fileno()),
3686
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3687
lambda *args, **kwargs: (tcp_server.handle_request
3688
(*args[2:], **kwargs) or True))
3689
3690
log.debug("Starting main loop")
3428
3691
main_loop.run()
3429
3692
except AvahiError as error:
3430
logger.critical("Avahi Error", exc_info=error)
3693
log.critical("Avahi Error", exc_info=error)
3431
3694
cleanup()
3432
3695
sys.exit(1)
3433
3696
except KeyboardInterrupt:
3434
3697
if debug:
3435
3698
print("", file=sys.stderr)
3436
logger.debug("Server received KeyboardInterrupt")
3437
logger.debug("Server exiting")
3699
log.debug("Server received KeyboardInterrupt")
3700
log.debug("Server exiting")
3438
3701
# Must run before the D-Bus bus name gets deregistered
3439
3702
cleanup()
3440
3703
3441
3442
if __name__ == '__main__':
3443
main()
3704
3705
def parse_test_args():
3706
# type: () -> argparse.Namespace
3707
parser = argparse.ArgumentParser(add_help=False)
3708
parser.add_argument("--check", action="store_true")
3709
parser.add_argument("--prefix", )
3710
args, unknown_args = parser.parse_known_args()
3711
if args.check:
3712
# Remove test options from sys.argv
3713
sys.argv[1:] = unknown_args
3714
return args
3715
3716
# Add all tests from doctest strings
3717
def load_tests(loader, tests, none):
3718
import doctest
3719
tests.addTests(doctest.DocTestSuite())
3720
return tests
3721
3722
if __name__ == "__main__":
3723
options = parse_test_args()
3724
try:
3725
if options.check:
3726
extra_test_prefix = options.prefix
3727
if extra_test_prefix is not None:
3728
if not (unittest.main(argv=[""], exit=False)
3729
.result.wasSuccessful()):
3730
sys.exit(1)
3731
class ExtraTestLoader(unittest.TestLoader):
3732
testMethodPrefix = extra_test_prefix
3733
# Call using ./scriptname --test [--verbose]
3734
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3735
else:
3736
unittest.main(argv=[""])
3737
else:
3738
main()
3739
finally:
3740
logging.shutdown()
3741
3742
# Local Variables:
3743
# run-tests:
3744
# (lambda (&optional extra)
3745
# (if (not (funcall run-tests-in-test-buffer default-directory
3746
# extra))
3747
# (funcall show-test-buffer-in-test-window)
3748
# (funcall remove-test-window)
3749
# (if extra (message "Extra tests run successfully!"))))
3750
# run-tests-in-test-buffer:
3751
# (lambda (dir &optional extra)
3752
# (with-current-buffer (get-buffer-create "*Test*")
3753
# (setq buffer-read-only nil
3754
# default-directory dir)
3755
# (erase-buffer)
3756
# (compilation-mode))
3757
# (let ((process-result
3758
# (let ((inhibit-read-only t))
3759
# (process-file-shell-command
3760
# (funcall get-command-line extra) nil "*Test*"))))
3761
# (and (numberp process-result)
3762
# (= process-result 0))))
3763
# get-command-line:
3764
# (lambda (&optional extra)
3765
# (let ((quoted-script
3766
# (shell-quote-argument (funcall get-script-name))))
3767
# (format
3768
# (concat "%s --check" (if extra " --prefix=atest" ""))
3769
# quoted-script)))
3770
# get-script-name:
3771
# (lambda ()
3772
# (if (fboundp 'file-local-name)
3773
# (file-local-name (buffer-file-name))
3774
# (or (file-remote-p (buffer-file-name) 'localname)
3775
# (buffer-file-name))))
3776
# remove-test-window:
3777
# (lambda ()
3778
# (let ((test-window (get-buffer-window "*Test*")))
3779
# (if test-window (delete-window test-window))))
3780
# show-test-buffer-in-test-window:
3781
# (lambda ()
3782
# (when (not (get-buffer-window-list "*Test*"))
3783
# (setq next-error-last-buffer (get-buffer "*Test*"))
3784
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3785
# (display-buffer-overriding-action
3786
# `((display-buffer-in-side-window) (side . ,side)
3787
# (window-height . fit-window-to-buffer)
3788
# (window-width . fit-window-to-buffer))))
3789
# (display-buffer "*Test*"))))
3790
# eval:
3791
# (progn
3792
# (let* ((run-extra-tests (lambda () (interactive)
3793
# (funcall run-tests t)))
3794
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3795
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3796
# (setq minor-mode-overriding-map-alist
3797
# (cons `(run-tests . ,outer-keymap)
3798
# minor-mode-overriding-map-alist)))
3799
# (add-hook 'after-save-hook run-tests 90 t))
3800
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0