/mandos/trunk : revision 1318

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

19

21

# the Free Software Foundation, either version 3 of the License, or

20

22

# (at your option) any later version.

21

23

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

24

26

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

27

# GNU General Public License for more details.

26

#

28

#

27

29

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

31

32

# Contact the authors at <mandos@recompile.se>.

32

#

33

#

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

38

41

39

import SocketServer as socketserver

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

try:

48

import SocketServer as socketserver

49

except ImportError:

50

import socketserver

40

51

import socket

41

import argparse

42

52

import datetime

43

53

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

import sys

54

try:

55

import ConfigParser as configparser

56

except ImportError:

57

import configparser

52

58

import re

53

import os

54

59

import signal

55

60

import subprocess

56

61

import atexit

57

62

import stat

58

import logging

59

63

import logging.handlers

60

64

import pwd

61

65

import contextlib

62

66

import struct

63

67

import fcntl

64

68

import functools

65

import cPickle as pickle

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

66

73

import multiprocessing

67

74

import types

68

75

import binascii

69

76

import tempfile

70

77

import itertools

71

78

import collections

79

import codecs

80

import random

81

import shlex

72

82

73

83

import dbus

74

84

import dbus.service

75

import gobject

76

import avahi

85

import gi

86

from gi.repository import GLib

77

87

from dbus.mainloop.glib import DBusGMainLoop

78

88

import ctypes

79

89

import ctypes.util

80

90

import xml.dom.minidom

81

91

import inspect

82

92

83

try:

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

126

# Show warnings by default

127

if not sys.warnoptions:

128

import warnings

129

warnings.simplefilter("default")

130

131

# Try to find the value of SO_BINDTODEVICE:

132

try:

133

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

134

# newer, and it is also the most natural place for it:

84

135

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

136

except AttributeError:

86

137

try:

138

# This is where SO_BINDTODEVICE was up to and including Python

139

# 2.6, and also 3.2:

87

140

from IN import SO_BINDTODEVICE

88

141

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.0"

142

# In Python 2.7 it seems to have been removed entirely.

143

# Try running the C preprocessor:

144

try:

145

cc = subprocess.Popen(["cc", "--language=c", "-E",

146

"/dev/stdin"],

147

stdin=subprocess.PIPE,

148

stdout=subprocess.PIPE)

149

stdout = cc.communicate(

150

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

151

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

152

except (OSError, ValueError, IndexError):

153

# No value found

154

SO_BINDTODEVICE = None

155

156

if sys.version_info < (3, 2):

157

configparser.Configparser = configparser.SafeConfigParser

158

159

version = "1.8.18"

92

160

stored_state_file = "clients.pickle"

93

161

94

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

163

logging.captureWarnings(True) # Show warnings via the logging system

164

syslogger = None

98

165

99

166

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

167

if_nametoindex = ctypes.cdll.LoadLibrary(

168

ctypes.util.find_library("c")).if_nametoindex

103

169

except (OSError, AttributeError):

170

104

171

def if_nametoindex(interface):

105

172

"Get an interface index the hard way, i.e. using fcntl()"

106

173

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

174

with contextlib.closing(socket.socket()) as s:

108

175

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

176

struct.pack(b"16s16x", interface))

177

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

178

return interface_index

114

179

115

180

181

def copy_function(func):

182

"""Make a copy of a function"""

183

if sys.version_info.major == 2:

184

return types.FunctionType(func.func_code,

185

func.func_globals,

186

func.func_name,

187

func.func_defaults,

188

func.func_closure)

189

else:

190

return types.FunctionType(func.__code__,

191

func.__globals__,

192

func.__name__,

193

func.__defaults__,

194

func.__closure__)

195

196

116

197

def initlogger(debug, level=logging.WARNING):

117

198

"""init logger and add loglevel"""

118

199

200

global syslogger

201

syslogger = (logging.handlers.SysLogHandler(

202

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

address="/dev/log"))

119

204

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

208

124

209

if debug:

125

210

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

132

217

133

218

134

219

class PGPError(Exception):

136

221

pass

137

222

138

223

139

class PGPEngine(object):

224

class PGPEngine:

140

225

"""A simple class for OpenPGP symmetric encryption & decryption"""

226

141

227

def __init__(self):

142

228

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

143

self.gnupgargs = ['--batch',

144

'--home', self.tempdir,

145

'--force-mdc',

146

'--quiet',

147

'--no-use-agent']

148

229

self.gpg = "gpg"

230

try:

231

output = subprocess.check_output(["gpgconf"])

232

for line in output.splitlines():

233

name, text, path = line.split(b":")

234

if name == b"gpg":

235

self.gpg = path

236

break

237

except OSError as e:

238

if e.errno != errno.ENOENT:

239

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

244

# Only GPG version 1 has the --no-use-agent option.

245

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

246

self.gnupgargs.append("--no-use-agent")

247

149

248

def __enter__(self):

150

249

return self

151

250

152

251

def __exit__(self, exc_type, exc_value, traceback):

153

252

self._cleanup()

154

253

return False

155

254

156

255

def __del__(self):

157

256

self._cleanup()

158

257

159

258

def _cleanup(self):

160

259

if self.tempdir is not None:

161

260

# Delete contents of tempdir

162

261

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

262

topdown=False):

164

263

for filename in files:

165

264

os.remove(os.path.join(root, filename))

166

265

for dirname in dirs:

168

267

# Remove tempdir

169

268

os.rmdir(self.tempdir)

170

269

self.tempdir = None

171

270

172

271

def password_encode(self, password):

173

272

# Passphrase can not be empty and can not contain newlines or

174

273

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

176

274

encoded = b"mandos" + binascii.hexlify(password)

275

if len(encoded) > 2048:

276

# GnuPG can't handle long passwords, so encode differently

277

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

278

.replace(b"\n", b"\\n")

279

.replace(b"\0", b"\\x00"))

280

return encoded

281

177

282

def encrypt(self, data, password):

178

283

passphrase = self.password_encode(password)

179

with tempfile.NamedTemporaryFile(dir=self.tempdir

180

) as passfile:

284

with tempfile.NamedTemporaryFile(

285

dir=self.tempdir) as passfile:

181

286

passfile.write(passphrase)

182

287

passfile.flush()

183

proc = subprocess.Popen(['gpg', '--symmetric',

184

'--passphrase-file',

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

185

290

passfile.name]

186

291

+ self.gnupgargs,

187

stdin = subprocess.PIPE,

188

stdout = subprocess.PIPE,

189

stderr = subprocess.PIPE)

190

ciphertext, err = proc.communicate(input = data)

292

stdin=subprocess.PIPE,

293

stdout=subprocess.PIPE,

294

stderr=subprocess.PIPE)

295

ciphertext, err = proc.communicate(input=data)

191

296

if proc.returncode != 0:

192

297

raise PGPError(err)

193

298

return ciphertext

194

299

195

300

def decrypt(self, data, password):

196

301

passphrase = self.password_encode(password)

197

with tempfile.NamedTemporaryFile(dir = self.tempdir

198

) as passfile:

302

with tempfile.NamedTemporaryFile(

303

dir=self.tempdir) as passfile:

199

304

passfile.write(passphrase)

200

305

passfile.flush()

201

proc = subprocess.Popen(['gpg', '--decrypt',

202

'--passphrase-file',

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

203

308

passfile.name]

204

309

+ self.gnupgargs,

205

stdin = subprocess.PIPE,

206

stdout = subprocess.PIPE,

207

stderr = subprocess.PIPE)

208

decrypted_plaintext, err = proc.communicate(input

209

= data)

310

stdin=subprocess.PIPE,

311

stdout=subprocess.PIPE,

312

stderr=subprocess.PIPE)

313

decrypted_plaintext, err = proc.communicate(input=data)

210

314

if proc.returncode != 0:

211

315

raise PGPError(err)

212

316

return decrypted_plaintext

213

317

214

318

319

# Pretend that we have an Avahi module

320

class avahi:

321

"""This isn't so much a class as it is a module-like namespace."""

322

IF_UNSPEC = -1 # avahi-common/address.h

323

PROTO_UNSPEC = -1 # avahi-common/address.h

324

PROTO_INET = 0 # avahi-common/address.h

325

PROTO_INET6 = 1 # avahi-common/address.h

326

DBUS_NAME = "org.freedesktop.Avahi"

327

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

328

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

329

DBUS_PATH_SERVER = "/"

330

331

@staticmethod

332

def string_array_to_txt_array(t):

333

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

334

for s in t), signature="ay")

335

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

336

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

337

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

338

SERVER_INVALID = 0 # avahi-common/defs.h

339

SERVER_REGISTERING = 1 # avahi-common/defs.h

340

SERVER_RUNNING = 2 # avahi-common/defs.h

341

SERVER_COLLISION = 3 # avahi-common/defs.h

342

SERVER_FAILURE = 4 # avahi-common/defs.h

343

344

215

345

class AvahiError(Exception):

216

346

def __init__(self, value, *args, **kwargs):

217

347

self.value = value

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

348

return super(AvahiError, self).__init__(value, *args,

349

**kwargs)

350

221

351

222

352

class AvahiServiceError(AvahiError):

223

353

pass

224

354

355

225

356

class AvahiGroupError(AvahiError):

226

357

pass

227

358

228

359

229

class AvahiService(object):

360

class AvahiService:

230

361

"""An Avahi (Zeroconf) service.

231

362

232

363

Attributes:

233

364

interface: integer; avahi.IF_UNSPEC or an interface index.

234

365

Used to optionally bind to the specified interface.

235

236

type: string; Example: '_mandos._tcp'.

366

367

type: string; Example: "_mandos._tcp".

237

368

See <https://www.iana.org/assignments/service-names-port-numbers>

238

369

port: integer; what port to announce

239

370

TXT: list of strings; TXT record for the service

246

377

server: D-Bus Server

247

378

bus: dbus.SystemBus()

248

379

"""

249

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

380

381

def __init__(self,

382

interface=avahi.IF_UNSPEC,

383

name=None,

384

servicetype=None,

385

port=None,

386

TXT=None,

387

domain="",

388

host="",

389

max_renames=32768,

390

protocol=avahi.PROTO_UNSPEC,

391

bus=None):

254

392

self.interface = interface

255

393

self.name = name

256

394

self.type = servicetype

265

403

self.server = None

266

404

self.bus = bus

267

405

self.entry_group_state_changed_match = None

268

269

def rename(self):

406

407

def rename(self, remove=True):

270

408

"""Derived from the Avahi example code"""

271

409

if self.rename_count >= self.max_renames:

272

logger.critical("No suitable Zeroconf service name found"

273

" after %i retries, exiting.",

274

self.rename_count)

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

275

413

raise AvahiServiceError("Too many renames")

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

278

logger.info("Changing Zeroconf service name to %r ...",

279

self.name)

280

self.remove()

281

try:

282

self.add()

283

except dbus.exceptions.DBusException as error:

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

414

self.name = str(

415

self.server.GetAlternativeServiceName(self.name))

287

416

self.rename_count += 1

288

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

419

if remove:

420

self.remove()

421

try:

422

self.add()

423

except dbus.exceptions.DBusException as error:

424

if (error.get_dbus_name()

425

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

427

return self.rename(remove=False)

428

else:

429

log.critical("D-Bus Exception", exc_info=error)

430

self.cleanup()

431

os._exit(1)

432

289

433

def remove(self):

290

434

"""Derived from the Avahi example code"""

291

435

if self.entry_group_state_changed_match is not None:

293

437

self.entry_group_state_changed_match = None

294

438

if self.group is not None:

295

439

self.group.Reset()

296

440

297

441

def add(self):

298

442

"""Derived from the Avahi example code"""

299

443

self.remove()

304

448

avahi.DBUS_INTERFACE_ENTRY_GROUP)

305

449

self.entry_group_state_changed_match = (

306

450

self.group.connect_to_signal(

307

'StateChanged', self.entry_group_state_changed))

308

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

309

self.name, self.type)

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

310

454

self.group.AddService(

311

455

self.interface,

312

456

self.protocol,

316

460

dbus.UInt16(self.port),

317

461

avahi.string_array_to_txt_array(self.TXT))

318

462

self.group.Commit()

319

463

320

464

def entry_group_state_changed(self, state, error):

321

465

"""Derived from the Avahi example code"""

322

logger.debug("Avahi entry group state change: %i", state)

323

466

log.debug("Avahi entry group state change: %i", state)

467

324

468

if state == avahi.ENTRY_GROUP_ESTABLISHED:

325

logger.debug("Zeroconf service established.")

469

log.debug("Zeroconf service established.")

326

470

elif state == avahi.ENTRY_GROUP_COLLISION:

327

logger.info("Zeroconf service name collision.")

471

log.info("Zeroconf service name collision.")

328

472

self.rename()

329

473

elif state == avahi.ENTRY_GROUP_FAILURE:

330

logger.critical("Avahi: Error in group state changed %s",

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

334

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

476

raise AvahiGroupError("State changed: {!s}".format(error))

477

335

478

def cleanup(self):

336

479

"""Derived from the Avahi example code"""

337

480

if self.group is not None:

342

485

pass

343

486

self.group = None

344

487

self.remove()

345

488

346

489

def server_state_changed(self, state, error=None):

347

490

"""Derived from the Avahi example code"""

348

logger.debug("Avahi server state change: %i", state)

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

491

log.debug("Avahi server state change: %i", state)

492

bad_states = {

493

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

avahi.SERVER_REGISTERING: None,

495

avahi.SERVER_COLLISION: "Zeroconf server name collision",

496

avahi.SERVER_FAILURE: "Zeroconf server failure",

497

}

356

498

if state in bad_states:

357

499

if bad_states[state] is not None:

358

500

if error is None:

359

logger.error(bad_states[state])

501

log.error(bad_states[state])

360

502

else:

361

logger.error(bad_states[state] + ": %r", error)

503

log.error(bad_states[state] + ": %r", error)

362

504

self.cleanup()

363

505

elif state == avahi.SERVER_RUNNING:

364

self.add()

506

try:

507

self.add()

508

except dbus.exceptions.DBusException as error:

509

if (error.get_dbus_name()

510

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

512

return self.rename(remove=False)

513

else:

514

log.critical("D-Bus Exception", exc_info=error)

515

self.cleanup()

516

os._exit(1)

365

517

else:

366

518

if error is None:

367

logger.debug("Unknown state: %r", state)

519

log.debug("Unknown state: %r", state)

368

520

else:

369

logger.debug("Unknown state: %r: %r", state, error)

370

521

log.debug("Unknown state: %r: %r", state, error)

522

371

523

def activate(self):

372

524

"""Derived from the Avahi example code"""

373

525

if self.server is None:

377

529

follow_name_owner_changes=True),

378

530

avahi.DBUS_INTERFACE_SERVER)

379

531

self.server.connect_to_signal("StateChanged",

380

self.server_state_changed)

532

self.server_state_changed)

381

533

self.server_state_changed(self.server.GetState())

382

534

383

535

384

536

class AvahiServiceToSyslog(AvahiService):

385

def rename(self):

537

def rename(self, *args, **kwargs):

386

538

"""Add the new name to the syslog messages"""

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

541

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

543

.format(self.name)))

392

544

return ret

393

545

394

546

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

400

401

402

class Client(object):

547

# Pretend that we have a GnuTLS module

548

class gnutls:

549

"""This isn't so much a class as it is a module-like namespace."""

550

551

library = ctypes.util.find_library("gnutls")

552

if library is None:

553

library = ctypes.util.find_library("gnutls-deb0")

554

_library = ctypes.cdll.LoadLibrary(library)

555

del library

556

557

# Unless otherwise indicated, the constants and types below are

558

# all from the gnutls/gnutls.h C header file.

559

560

# Constants

561

E_SUCCESS = 0

562

E_INTERRUPTED = -52

563

E_AGAIN = -28

564

CRT_OPENPGP = 2

565

CRT_RAWPK = 3

566

CLIENT = 2

567

SHUT_RDWR = 0

568

CRD_CERTIFICATE = 1

569

E_NO_CERTIFICATE_FOUND = -49

570

X509_FMT_DER = 0

571

NO_TICKETS = 1<<10

572

ENABLE_RAWPK = 1<<18

573

CTYPE_PEERS = 3

574

KEYID_USE_SHA256 = 1 # gnutls/x509.h

575

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

577

# Types

578

class _session_int(ctypes.Structure):

579

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

581

582

class certificate_credentials_st(ctypes.Structure):

583

_fields_ = []

584

certificate_credentials_t = ctypes.POINTER(

585

certificate_credentials_st)

586

certificate_type_t = ctypes.c_int

587

588

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

591

592

class _openpgp_crt_int(ctypes.Structure):

593

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

595

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

credentials_type_t = ctypes.c_int

598

transport_ptr_t = ctypes.c_void_p

599

close_request_t = ctypes.c_int

600

601

# Exceptions

602

class Error(Exception):

603

def __init__(self, message=None, code=None, args=()):

604

# Default usage is by a message string, but if a return

605

# code is passed, convert it to a string with

606

# gnutls.strerror()

607

self.code = code

608

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

611

return super(gnutls.Error, self).__init__(

612

message, *args)

613

614

class CertificateSecurityError(Error):

615

pass

616

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

# Classes

643

class Credentials(With_from_param):

644

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

647

self.type = gnutls.CRD_CERTIFICATE

648

649

def __del__(self):

650

gnutls.certificate_free_credentials(self)

651

652

class ClientSession(With_from_param):

653

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

655

gnutls_flags = gnutls.CLIENT

656

if gnutls.check_version(b"3.5.6"):

657

gnutls_flags |= gnutls.NO_TICKETS

658

if gnutls.has_rawpk:

659

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

661

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

665

self.socket = socket

666

if credentials is None:

667

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

670

self.credentials = credentials

671

672

def __del__(self):

673

gnutls.deinit(self)

674

675

def handshake(self):

676

return gnutls.handshake(self)

677

678

def send(self, data):

679

data = bytes(data)

680

data_len = len(data)

681

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

683

data_len)

684

685

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

687

688

# Error handling functions

689

def _error_code(result):

690

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

693

return result

694

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

raise gnutls.CertificateSecurityError(code=result)

696

raise gnutls.Error(code=result)

697

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

700

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

703

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

return _error_code(result)

705

result = func(*arguments)

706

return result

707

708

# Unless otherwise indicated, the function declarations below are

709

# all from the gnutls/gnutls.h C header file.

710

711

# Functions

712

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

714

ctypes.POINTER(ctypes.c_char_p)]

715

priority_set_direct.restype = _error_code

716

717

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

719

init.restype = _error_code

720

721

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

723

set_default_priority.restype = _error_code

724

725

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

727

ctypes.c_size_t]

728

record_send.restype = ctypes.c_ssize_t

729

record_send.errcheck = _retry_on_error

730

731

certificate_allocate_credentials = (

732

_library.gnutls_certificate_allocate_credentials)

733

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

735

certificate_allocate_credentials.restype = _error_code

736

737

certificate_free_credentials = (

738

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

740

certificate_free_credentials.restype = None

741

742

handshake_set_private_extensions = (

743

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

745

ctypes.c_int]

746

handshake_set_private_extensions.restype = None

747

748

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

751

credentials_set.restype = _error_code

752

753

strerror = _library.gnutls_strerror

754

strerror.argtypes = [ctypes.c_int]

755

strerror.restype = ctypes.c_char_p

756

757

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

759

certificate_type_get.restype = _error_code

760

761

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

763

ctypes.POINTER(ctypes.c_uint)]

764

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

766

global_set_log_level = _library.gnutls_global_set_log_level

767

global_set_log_level.argtypes = [ctypes.c_int]

768

global_set_log_level.restype = None

769

770

global_set_log_function = _library.gnutls_global_set_log_function

771

global_set_log_function.argtypes = [log_func]

772

global_set_log_function.restype = None

773

774

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

776

deinit.restype = None

777

778

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

781

handshake.errcheck = _retry_on_error

782

783

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

785

transport_set_ptr.restype = None

786

787

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

790

bye.errcheck = _retry_on_error

791

792

check_version = _library.gnutls_check_version

793

check_version.argtypes = [ctypes.c_char_p]

794

check_version.restype = ctypes.c_char_p

795

796

_need_version = b"3.3.0"

797

if check_version(_need_version) is None:

798

raise self.Error("Needs GnuTLS {} or later"

799

.format(_need_version))

800

801

_tls_rawpk_version = b"3.6.6"

802

has_rawpk = bool(check_version(_tls_rawpk_version))

803

804

if has_rawpk:

805

# Types

806

class pubkey_st(ctypes.Structure):

807

_fields = []

808

pubkey_t = ctypes.POINTER(pubkey_st)

809

810

x509_crt_fmt_t = ctypes.c_int

811

812

# All the function declarations below are from

813

# gnutls/abstract.h

814

pubkey_init = _library.gnutls_pubkey_init

815

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

pubkey_init.restype = _error_code

817

818

pubkey_import = _library.gnutls_pubkey_import

819

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

820

x509_crt_fmt_t]

821

pubkey_import.restype = _error_code

822

823

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

824

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

825

ctypes.POINTER(ctypes.c_ubyte),

826

ctypes.POINTER(ctypes.c_size_t)]

827

pubkey_get_key_id.restype = _error_code

828

829

pubkey_deinit = _library.gnutls_pubkey_deinit

830

pubkey_deinit.argtypes = [pubkey_t]

831

pubkey_deinit.restype = None

832

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

835

836

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

838

openpgp_crt_init.restype = _error_code

839

840

openpgp_crt_import = _library.gnutls_openpgp_crt_import

841

openpgp_crt_import.argtypes = [openpgp_crt_t,

842

ctypes.POINTER(datum_t),

843

openpgp_crt_fmt_t]

844

openpgp_crt_import.restype = _error_code

845

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

853

openpgp_crt_verify_self.restype = _error_code

854

855

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

856

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

857

openpgp_crt_deinit.restype = None

858

859

openpgp_crt_get_fingerprint = (

860

_library.gnutls_openpgp_crt_get_fingerprint)

861

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

862

ctypes.c_void_p,

863

ctypes.POINTER(

864

ctypes.c_size_t)]

865

openpgp_crt_get_fingerprint.restype = _error_code

866

867

if check_version(b"3.6.4"):

868

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

870

certificate_type_get2.restype = _error_code

871

872

# Remove non-public functions

873

del _error_code, _retry_on_error

874

875

876

def call_pipe(connection, # : multiprocessing.Connection

877

func, *args, **kwargs):

878

"""This function is meant to be called by multiprocessing.Process

879

880

This function runs func(*args, **kwargs), and writes the resulting

881

return value on the provided multiprocessing.Connection.

882

"""

883

connection.send(func(*args, **kwargs))

884

connection.close()

885

886

887

class Client:

403

888

"""A representation of a client host served by this server.

404

889

405

890

Attributes:

406

approved: bool(); 'None' if not yet approved/disapproved

891

approved: bool(); None if not yet approved/disapproved

407

892

approval_delay: datetime.timedelta(); Time to wait for approval

408

893

approval_duration: datetime.timedelta(); Duration of one approval

409

checker: subprocess.Popen(); a running checker process used

410

to see if the client lives.

411

'None' if no process is running.

412

checker_callback_tag: a gobject event source tag, or None

894

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

896

running.

897

checker_callback_tag: a GLib event source tag, or None

413

898

checker_command: string; External command which is run to check

414

899

if client lives. %() expansions are done at

415

900

runtime with vars(self) as dict, so that for

416

901

instance %(name)s can be used in the command.

417

checker_initiator_tag: a gobject event source tag, or None

902

checker_initiator_tag: a GLib event source tag, or None

418

903

created: datetime.datetime(); (UTC) object creation

419

904

client_structure: Object describing what attributes a client has

420

905

and is used for storing the client at exit

421

906

current_checker_command: string; current running checker_command

422

disable_initiator_tag: a gobject event source tag, or None

907

disable_initiator_tag: a GLib event source tag, or None

423

908

enabled: bool()

424

909

fingerprint: string (40 or 32 hexadecimal digits); used to

425

uniquely identify the client

910

uniquely identify an OpenPGP client

911

key_id: string (64 hexadecimal digits); used to uniquely identify

912

a client using raw public keys

426

913

host: string; available for use by the checker command

427

914

interval: datetime.timedelta(); How often to start a new checker

428

915

last_approval_request: datetime.datetime(); (UTC) or None

430

917

last_checker_status: integer between 0 and 255 reflecting exit

431

918

status of last checker. -1 reflects crashed

432

919

checker, -2 means no checker completed yet.

920

last_checker_signal: The signal which killed the last checker, if

921

last_checker_status is -1

433

922

last_enabled: datetime.datetime(); (UTC) or None

434

923

435

924

D-Bus identifiers

442

931

disabled, or None

443

932

server_settings: The server_settings dict from main()

444

933

"""

445

934

446

935

runtime_expansions = ("approval_delay", "approval_duration",

447

"created", "enabled", "expires",

936

"created", "enabled", "expires", "key_id",

448

937

"fingerprint", "host", "interval",

449

938

"last_approval_request", "last_checked_ok",

450

939

"last_enabled", "name", "timeout")

451

client_defaults = { "timeout": "PT5M",

452

"extended_timeout": "PT15M",

453

"interval": "PT2M",

454

"checker": "fping -q -- %%(host)s",

455

"host": "",

456

"approval_delay": "PT0S",

457

"approval_duration": "PT1S",

458

"approved_by_default": "True",

459

"enabled": "True",

460

}

461

462

def timeout_milliseconds(self):

463

"Return the 'timeout' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.timeout)

465

466

def extended_timeout_milliseconds(self):

467

"Return the 'extended_timeout' attribute in milliseconds"

468

return timedelta_to_milliseconds(self.extended_timeout)

469

470

def interval_milliseconds(self):

471

"Return the 'interval' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.interval)

473

474

def approval_delay_milliseconds(self):

475

return timedelta_to_milliseconds(self.approval_delay)

476

940

client_defaults = {

941

"timeout": "PT5M",

942

"extended_timeout": "PT15M",

943

"interval": "PT2M",

944

"checker": "fping -q -- %%(host)s",

945

"host": "",

946

"approval_delay": "PT0S",

947

"approval_duration": "PT1S",

948

"approved_by_default": "True",

949

"enabled": "True",

950

}

951

477

952

@staticmethod

478

953

def config_parser(config):

479

954

"""Construct a new dict of client settings of this form:

486

961

for client_name in config.sections():

487

962

section = dict(config.items(client_name))

488

963

client = settings[client_name] = {}

489

964

490

965

client["host"] = section["host"]

491

966

# Reformat values from string types to Python types

492

967

client["approved_by_default"] = config.getboolean(

493

968

client_name, "approved_by_default")

494

969

client["enabled"] = config.getboolean(client_name,

495

970

"enabled")

496

497

client["fingerprint"] = (section["fingerprint"].upper()

971

972

# Uppercase and remove spaces from key_id and fingerprint

973

# for later comparison purposes with return value from the

974

# key_id() and fingerprint() functions

975

client["key_id"] = (section.get("key_id", "").upper()

976

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

498

979

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

499

985

if "secret" in section:

500

client["secret"] = section["secret"].decode("base64")

986

client["secret"] = codecs.decode(section["secret"]

987

.encode("utf-8"),

988

"base64")

501

989

elif "secfile" in section:

502

990

with open(os.path.expanduser(os.path.expandvars

503

991

(section["secfile"])),

504

992

"rb") as secfile:

505

993

client["secret"] = secfile.read()

506

994

else:

507

raise TypeError("No secret or secfile for section {0}"

995

raise TypeError("No secret or secfile for section {}"

508

996

.format(section))

509

997

client["timeout"] = string_to_delta(section["timeout"])

510

998

client["extended_timeout"] = string_to_delta(

518

1006

client["last_approval_request"] = None

519

1007

client["last_checked_ok"] = None

520

1008

client["last_checker_status"] = -2

521

1009

522

1010

return settings

523

524

def __init__(self, settings, name = None, server_settings=None):

1011

1012

def __init__(self, settings, name=None, server_settings=None):

525

1013

self.name = name

526

1014

if server_settings is None:

527

1015

server_settings = {}

528

1016

self.server_settings = server_settings

529

1017

# adding all client settings

530

for setting, value in settings.iteritems():

1018

for setting, value in settings.items():

531

1019

setattr(self, setting, value)

532

1020

533

1021

if self.enabled:

534

1022

if not hasattr(self, "last_enabled"):

535

1023

self.last_enabled = datetime.datetime.utcnow()

539

1027

else:

540

1028

self.last_enabled = None

541

1029

self.expires = None

542

543

logger.debug("Creating client %r", self.name)

544

# Uppercase and remove spaces from fingerprint for later

545

# comparison purposes with return value from the fingerprint()

546

# function

547

logger.debug(" Fingerprint: %s", self.fingerprint)

1030

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

548

1034

self.created = settings.get("created",

549

1035

datetime.datetime.utcnow())

550

1036

551

1037

# attributes specific for this server instance

552

1038

self.checker = None

553

1039

self.checker_initiator_tag = None

556

1042

self.current_checker_command = None

557

1043

self.approved = None

558

1044

self.approvals_pending = 0

559

self.changedstate = (multiprocessing_manager

560

.Condition(multiprocessing_manager

561

.Lock()))

562

self.client_structure = [attr for attr in

563

self.__dict__.iterkeys()

1045

self.changedstate = multiprocessing_manager.Condition(

1046

multiprocessing_manager.Lock())

1047

self.client_structure = [attr

1048

for attr in self.__dict__.keys()

564

1049

if not attr.startswith("_")]

565

1050

self.client_structure.append("client_structure")

566

567

for name, t in inspect.getmembers(type(self),

568

lambda obj:

569

isinstance(obj,

570

property)):

1051

1052

for name, t in inspect.getmembers(

1053

type(self), lambda obj: isinstance(obj, property)):

571

1054

if not name.startswith("_"):

572

1055

self.client_structure.append(name)

573

1056

574

1057

# Send notice to process children that client state has changed

575

1058

def send_changedstate(self):

576

1059

with self.changedstate:

577

1060

self.changedstate.notify_all()

578

1061

579

1062

def enable(self):

580

1063

"""Start this client's checker and timeout hooks"""

581

1064

if getattr(self, "enabled", False):

582

1065

# Already enabled

583

1066

return

584

self.expires = datetime.datetime.utcnow() + self.timeout

585

1067

self.enabled = True

586

1068

self.last_enabled = datetime.datetime.utcnow()

587

1069

self.init_checker()

588

1070

self.send_changedstate()

589

1071

590

1072

def disable(self, quiet=True):

591

1073

"""Disable this client."""

592

1074

if not getattr(self, "enabled", False):

593

1075

return False

594

1076

if not quiet:

595

logger.info("Disabling client %s", self.name)

1077

log.info("Disabling client %s", self.name)

596

1078

if getattr(self, "disable_initiator_tag", None) is not None:

597

gobject.source_remove(self.disable_initiator_tag)

1079

GLib.source_remove(self.disable_initiator_tag)

598

1080

self.disable_initiator_tag = None

599

1081

self.expires = None

600

1082

if getattr(self, "checker_initiator_tag", None) is not None:

601

gobject.source_remove(self.checker_initiator_tag)

1083

GLib.source_remove(self.checker_initiator_tag)

602

1084

self.checker_initiator_tag = None

603

1085

self.stop_checker()

604

1086

self.enabled = False

605

1087

if not quiet:

606

1088

self.send_changedstate()

607

# Do not run this again if called by a gobject.timeout_add

1089

# Do not run this again if called by a GLib.timeout_add

608

1090

return False

609

1091

610

1092

def __del__(self):

611

1093

self.disable()

612

613

def init_checker(self):

614

# Schedule a new checker to be started an 'interval' from now,

615

# and every interval from then on.

1094

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

616

1100

if self.checker_initiator_tag is not None:

617

gobject.source_remove(self.checker_initiator_tag)

618

self.checker_initiator_tag = (gobject.timeout_add

619

(self.interval_milliseconds(),

620

self.start_checker))

621

# Schedule a disable() when 'timeout' has passed

1101

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

622

1119

if self.disable_initiator_tag is not None:

623

gobject.source_remove(self.disable_initiator_tag)

624

self.disable_initiator_tag = (gobject.timeout_add

625

(self.timeout_milliseconds(),

626

self.disable))

627

# Also start a new checker *right now*.

628

self.start_checker()

629

630

def checker_callback(self, pid, condition, command):

1120

GLib.source_remove(self.disable_initiator_tag)

1121

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1124

1125

def checker_callback(self, source, condition, connection,

1126

command):

631

1127

"""The checker has completed, so take appropriate actions."""

1128

# Read return code from connection (see call_pipe)

1129

returncode = connection.recv()

1130

connection.close()

1131

if self.checker is not None:

1132

self.checker.join()

632

1133

self.checker_callback_tag = None

633

1134

self.checker = None

634

if os.WIFEXITED(condition):

635

self.last_checker_status = os.WEXITSTATUS(condition)

1135

1136

if returncode >= 0:

1137

self.last_checker_status = returncode

1138

self.last_checker_signal = None

636

1139

if self.last_checker_status == 0:

637

logger.info("Checker for %(name)s succeeded",

638

vars(self))

1140

log.info("Checker for %(name)s succeeded", vars(self))

639

1141

self.checked_ok()

640

1142

else:

641

logger.info("Checker for %(name)s failed",

642

vars(self))

1143

log.info("Checker for %(name)s failed", vars(self))

643

1144

else:

644

1145

self.last_checker_status = -1

645

logger.warning("Checker for %(name)s crashed?",

646

vars(self))

647

1146

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1148

return False

1149

648

1150

def checked_ok(self):

649

1151

"""Assert that the client has been seen, alive and well."""

650

1152

self.last_checked_ok = datetime.datetime.utcnow()

651

1153

self.last_checker_status = 0

1154

self.last_checker_signal = None

652

1155

self.bump_timeout()

653

1156

654

1157

def bump_timeout(self, timeout=None):

655

1158

"""Bump up the timeout for this client."""

656

1159

if timeout is None:

657

1160

timeout = self.timeout

658

1161

if self.disable_initiator_tag is not None:

659

gobject.source_remove(self.disable_initiator_tag)

1162

GLib.source_remove(self.disable_initiator_tag)

660

1163

self.disable_initiator_tag = None

661

1164

if getattr(self, "enabled", False):

662

self.disable_initiator_tag = (gobject.timeout_add

663

(timedelta_to_milliseconds

664

(timeout), self.disable))

1165

self.disable_initiator_tag = GLib.timeout_add(

1166

int(timeout.total_seconds() * 1000), self.disable)

665

1167

self.expires = datetime.datetime.utcnow() + timeout

666

1168

667

1169

def need_approval(self):

668

1170

self.last_approval_request = datetime.datetime.utcnow()

669

670

def start_checker(self):

1171

1172

def start_checker(self, start_was_randomized=False):

671

1173

"""Start a new checker subprocess if one is not running.

672

1174

673

1175

If a checker already exists, leave it running and do

674

1176

nothing."""

675

1177

# The reason for not killing a running checker is that if we

680

1182

# checkers alone, the checker would have to take more time

681

1183

# than 'timeout' for the client to be disabled, which is as it

682

1184

# should be.

683

684

# If a checker exists, make sure it is not a zombie

685

try:

686

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

687

except (AttributeError, OSError) as error:

688

if (isinstance(error, OSError)

689

and error.errno != errno.ECHILD):

690

raise error

691

else:

692

if pid:

693

logger.warning("Checker was a zombie")

694

gobject.source_remove(self.checker_callback_tag)

695

self.checker_callback(pid, status,

696

self.current_checker_command)

1185

1186

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1188

self.checker.join()

1189

self.checker = None

697

1190

# Start a new checker if needed

698

1191

if self.checker is None:

699

1192

# Escape attributes for the shell

700

escaped_attrs = dict(

701

(attr, re.escape(unicode(getattr(self, attr))))

702

for attr in

703

self.runtime_expansions)

1193

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1195

for attr in self.runtime_expansions}

704

1196

try:

705

1197

command = self.checker_command % escaped_attrs

706

1198

except TypeError as error:

707

logger.error('Could not format string "%s"',

708

self.checker_command, exc_info=error)

709

return True # Try again later

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1201

return True # Try again later

710

1202

self.current_checker_command = command

711

try:

712

logger.info("Starting checker %r for %s",

713

command, self.name)

714

# We don't need to redirect stdout and stderr, since

715

# in normal mode, that is already done by daemon(),

716

# and in debug mode we don't want to. (Stdin is

717

# always replaced by /dev/null.)

718

# The exception is when not debugging but nevertheless

719

# running in the foreground; use the previously

720

# created wnull.

721

popen_args = {}

722

if (not self.server_settings["debug"]

723

and self.server_settings["foreground"]):

724

popen_args.update({"stdout": wnull,

725

"stderr": wnull })

726

self.checker = subprocess.Popen(command,

727

close_fds=True,

728

shell=True, cwd="/",

729

**popen_args)

730

except OSError as error:

731

logger.error("Failed to start subprocess",

732

exc_info=error)

733

return True

734

self.checker_callback_tag = (gobject.child_watch_add

735

(self.checker.pid,

736

self.checker_callback,

737

data=command))

738

# The checker may have completed before the gobject

739

# watch was added. Check for this.

740

try:

741

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

742

except OSError as error:

743

if error.errno == errno.ECHILD:

744

# This should never happen

745

logger.error("Child process vanished",

746

exc_info=error)

747

return True

748

raise

749

if pid:

750

gobject.source_remove(self.checker_callback_tag)

751

self.checker_callback(pid, status, command)

752

# Re-run this periodically if run by gobject.timeout_add

1203

log.info("Starting checker %r for %s", command, self.name)

1204

# We don't need to redirect stdout and stderr, since

1205

# in normal mode, that is already done by daemon(),

1206

# and in debug mode we don't want to. (Stdin is

1207

# always replaced by /dev/null.)

1208

# The exception is when not debugging but nevertheless

1209

# running in the foreground; use the previously

1210

# created wnull.

1211

popen_args = {"close_fds": True,

1212

"shell": True,

1213

"cwd": "/"}

1214

if (not self.server_settings["debug"]

1215

and self.server_settings["foreground"]):

1216

popen_args.update({"stdout": wnull,

1217

"stderr": wnull})

1218

pipe = multiprocessing.Pipe(duplex=False)

1219

self.checker = multiprocessing.Process(

1220

target=call_pipe,

1221

args=(pipe[1], subprocess.call, command),

1222

kwargs=popen_args)

1223

self.checker.start()

1224

self.checker_callback_tag = GLib.io_add_watch(

1225

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1227

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

# Re-run this periodically if run by GLib.timeout_add

753

1240

return True

754

1241

755

1242

def stop_checker(self):

756

1243

"""Force the checker process, if any, to stop."""

757

1244

if self.checker_callback_tag:

758

gobject.source_remove(self.checker_callback_tag)

1245

GLib.source_remove(self.checker_callback_tag)

759

1246

self.checker_callback_tag = None

760

1247

if getattr(self, "checker", None) is None:

761

1248

return

762

logger.debug("Stopping checker for %(name)s", vars(self))

763

try:

764

self.checker.terminate()

765

#time.sleep(0.5)

766

#if self.checker.poll() is None:

767

# self.checker.kill()

768

except OSError as error:

769

if error.errno != errno.ESRCH: # No such process

770

raise

1249

log.debug("Stopping checker for %(name)s", vars(self))

1250

self.checker.terminate()

771

1251

self.checker = None

772

1252

773

1253

774

def dbus_service_property(dbus_interface, signature="v",

775

access="readwrite", byte_arrays=False):

1254

def dbus_service_property(dbus_interface,

1255

signature="v",

1256

access="readwrite",

1257

byte_arrays=False):

776

1258

"""Decorators for marking methods of a DBusObjectWithProperties to

777

1259

become properties on the D-Bus.

778

1260

779

1261

The decorated method will be called with no arguments by "Get"

780

1262

and with one argument by "Set".

781

1263

782

1264

The parameters, where they are supported, are the same as

783

1265

dbus.service.method, except there is only "signature", since the

784

1266

type from Get() and the type sent to Set() is the same.

787

1269

# "Set" method, so we fail early here:

788

1270

if byte_arrays and signature != "ay":

789

1271

raise ValueError("Byte arrays not supported for non-'ay'"

790

" signature {0!r}".format(signature))

1272

" signature {!r}".format(signature))

1273

791

1274

def decorator(func):

792

1275

func._dbus_is_property = True

793

1276

func._dbus_interface = dbus_interface

796

1279

func._dbus_name = func.__name__

797

1280

if func._dbus_name.endswith("_dbus_property"):

798

1281

func._dbus_name = func._dbus_name[:-14]

799

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

800

1283

return func

1284

801

1285

return decorator

802

1286

803

1287

804

1288

def dbus_interface_annotations(dbus_interface):

805

1289

"""Decorator for marking functions returning interface annotations

806

1290

807

1291

Usage:

808

1292

809

1293

@dbus_interface_annotations("org.example.Interface")

810

1294

def _foo(self): # Function name does not matter

811

1295

return {"org.freedesktop.DBus.Deprecated": "true",

812

1296

"org.freedesktop.DBus.Property.EmitsChangedSignal":

813

1297

"false"}

814

1298

"""

1299

815

1300

def decorator(func):

816

1301

func._dbus_is_interface = True

817

1302

func._dbus_interface = dbus_interface

818

1303

func._dbus_name = dbus_interface

819

1304

return func

1305

820

1306

return decorator

821

1307

822

1308

823

1309

def dbus_annotations(annotations):

824

1310

"""Decorator to annotate D-Bus methods, signals or properties

825

1311

Usage:

826

1312

1313

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1314

"org.freedesktop.DBus.Property."

1315

"EmitsChangedSignal": "false"})

827

1316

@dbus_service_property("org.example.Interface", signature="b",

828

1317

access="r")

829

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

830

"org.freedesktop.DBus.Property."

831

"EmitsChangedSignal": "false"})

832

1318

def Property_dbus_property(self):

833

1319

return dbus.Boolean(False)

1320

1321

See also the DBusObjectWithAnnotations class.

834

1322

"""

1323

835

1324

def decorator(func):

836

1325

func._dbus_annotations = annotations

837

1326

return func

1327

838

1328

return decorator

839

1329

840

1330

841

1331

class DBusPropertyException(dbus.exceptions.DBusException):

842

1332

"""A base class for D-Bus property-related exceptions

843

1333

"""

844

def __unicode__(self):

845

return unicode(str(self))

1334

pass

846

1335

847

1336

848

1337

class DBusPropertyAccessException(DBusPropertyException):

857

1346

pass

858

1347

859

1348

860

class DBusObjectWithProperties(dbus.service.Object):

861

"""A D-Bus object with properties.

862

863

Classes inheriting from this can use the dbus_service_property

864

decorator to expose methods as D-Bus properties. It exposes the

865

standard Get(), Set(), and GetAll() methods on the D-Bus.

1349

class DBusObjectWithAnnotations(dbus.service.Object):

1350

"""A D-Bus object with annotations.

1351

1352

Classes inheriting from this can use the dbus_annotations

1353

decorator to add annotations to methods or signals.

866

1354

"""

867

1355

868

1356

@staticmethod

869

1357

def _is_dbus_thing(thing):

870

1358

"""Returns a function testing if an attribute is a D-Bus thing

871

1359

872

1360

If called like _is_dbus_thing("method") it returns a function

873

1361

suitable for use as predicate to inspect.getmembers().

874

1362

"""

875

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1363

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

876

1364

False)

877

1365

878

1366

def _get_all_dbus_things(self, thing):

879

1367

"""Returns a generator of (name, attribute) pairs

880

1368

"""

881

return ((getattr(athing.__get__(self), "_dbus_name",

882

name),

1369

return ((getattr(athing.__get__(self), "_dbus_name", name),

883

1370

athing.__get__(self))

884

1371

for cls in self.__class__.__mro__

885

1372

for name, athing in

886

inspect.getmembers(cls,

887

self._is_dbus_thing(thing)))

888

1373

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1374

1375

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1379

def Introspect(self, object_path, connection):

1380

"""Overloading of standard D-Bus method.

1381

1382

Inserts annotation tags on methods and signals.

1383

"""

1384

xmlstring = dbus.service.Object.Introspect(self, object_path,

1385

connection)

1386

try:

1387

document = xml.dom.minidom.parseString(xmlstring)

1388

1389

for if_tag in document.getElementsByTagName("interface"):

1390

# Add annotation tags

1391

for typ in ("method", "signal"):

1392

for tag in if_tag.getElementsByTagName(typ):

1393

annots = dict()

1394

for name, prop in (self.

1395

_get_all_dbus_things(typ)):

1396

if (name == tag.getAttribute("name")

1397

and prop._dbus_interface

1398

== if_tag.getAttribute("name")):

1399

annots.update(getattr(

1400

prop, "_dbus_annotations", {}))

1401

for name, value in annots.items():

1402

ann_tag = document.createElement(

1403

"annotation")

1404

ann_tag.setAttribute("name", name)

1405

ann_tag.setAttribute("value", value)

1406

tag.appendChild(ann_tag)

1407

# Add interface annotation tags

1408

for annotation, value in dict(

1409

itertools.chain.from_iterable(

1410

annotations().items()

1411

for name, annotations

1412

in self._get_all_dbus_things("interface")

1413

if name == if_tag.getAttribute("name")

1414

)).items():

1415

ann_tag = document.createElement("annotation")

1416

ann_tag.setAttribute("name", annotation)

1417

ann_tag.setAttribute("value", value)

1418

if_tag.appendChild(ann_tag)

1419

# Fix argument name for the Introspect method itself

1420

if (if_tag.getAttribute("name")

1421

== dbus.INTROSPECTABLE_IFACE):

1422

for cn in if_tag.getElementsByTagName("method"):

1423

if cn.getAttribute("name") == "Introspect":

1424

for arg in cn.getElementsByTagName("arg"):

1425

if (arg.getAttribute("direction")

1426

== "out"):

1427

arg.setAttribute("name",

1428

"xml_data")

1429

xmlstring = document.toxml("utf-8")

1430

document.unlink()

1431

except (AttributeError, xml.dom.DOMException,

1432

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1435

return xmlstring

1436

1437

1438

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1439

"""A D-Bus object with properties.

1440

1441

Classes inheriting from this can use the dbus_service_property

1442

decorator to expose methods as D-Bus properties. It exposes the

1443

standard Get(), Set(), and GetAll() methods on the D-Bus.

1444

"""

1445

889

1446

def _get_dbus_property(self, interface_name, property_name):

890

1447

"""Returns a bound method if one exists which is a D-Bus

891

1448

property with the specified name and interface.

892

1449

"""

893

for cls in self.__class__.__mro__:

894

for name, value in (inspect.getmembers

895

(cls,

896

self._is_dbus_thing("property"))):

1450

for cls in self.__class__.__mro__:

1451

for name, value in inspect.getmembers(

1452

cls, self._is_dbus_thing("property")):

897

1453

if (value._dbus_name == property_name

898

1454

and value._dbus_interface == interface_name):

899

1455

return value.__get__(self)

900

1456

901

1457

# No such property

902

raise DBusPropertyNotFound(self.dbus_object_path + ":"

903

+ interface_name + "."

904

+ property_name)

905

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1458

raise DBusPropertyNotFound("{}:{}.{}".format(

1459

self.dbus_object_path, interface_name, property_name))

1460

1461

@classmethod

1462

def _get_all_interface_names(cls):

1463

"""Get a sequence of all interfaces supported by an object"""

1464

return (name for name in set(getattr(getattr(x, attr),

1465

"_dbus_interface", None)

1466

for x in (inspect.getmro(cls))

1467

for attr in dir(x))

1468

if name is not None)

1469

1470

@dbus.service.method(dbus.PROPERTIES_IFACE,

1471

in_signature="ss",

907

1472

out_signature="v")

908

1473

def Get(self, interface_name, property_name):

909

1474

"""Standard D-Bus property Get() method, see D-Bus standard.

915

1480

if not hasattr(value, "variant_level"):

916

1481

return value

917

1482

return type(value)(value, variant_level=value.variant_level+1)

918

1483

919

1484

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

920

1485

def Set(self, interface_name, property_name, value):

921

1486

"""Standard D-Bus property Set() method, see D-Bus standard.

927

1492

# The byte_arrays option is not supported yet on

928

1493

# signatures other than "ay".

929

1494

if prop._dbus_signature != "ay":

930

raise ValueError

931

value = dbus.ByteArray(b''.join(chr(byte)

932

for byte in value))

1495

raise ValueError("Byte arrays not supported for non-"

1496

"'ay' signature {!r}"

1497

.format(prop._dbus_signature))

1498

value = dbus.ByteArray(bytes(value))

933

1499

prop(value)

934

935

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1500

1501

@dbus.service.method(dbus.PROPERTIES_IFACE,

1502

in_signature="s",

936

1503

out_signature="a{sv}")

937

1504

def GetAll(self, interface_name):

938

1505

"""Standard D-Bus property GetAll() method, see D-Bus

939

1506

standard.

940

1507

941

1508

Note: Will not include properties with access="write".

942

1509

"""

943

1510

properties = {}

953

1520

if not hasattr(value, "variant_level"):

954

1521

properties[name] = value

955

1522

continue

956

properties[name] = type(value)(value, variant_level=

957

value.variant_level+1)

1523

properties[name] = type(value)(

1524

value, variant_level=value.variant_level + 1)

958

1525

return dbus.Dictionary(properties, signature="sv")

959

1526

1527

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1528

def PropertiesChanged(self, interface_name, changed_properties,

1529

invalidated_properties):

1530

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1531

standard.

1532

"""

1533

pass

1534

960

1535

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

961

1536

out_signature="s",

962

path_keyword='object_path',

963

connection_keyword='connection')

1537

path_keyword="object_path",

1538

connection_keyword="connection")

964

1539

def Introspect(self, object_path, connection):

965

1540

"""Overloading of standard D-Bus method.

966

1541

967

1542

Inserts property tags and interface annotation tags.

968

1543

"""

969

xmlstring = dbus.service.Object.Introspect(self, object_path,

970

connection)

1544

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1545

object_path,

1546

connection)

971

1547

try:

972

1548

document = xml.dom.minidom.parseString(xmlstring)

1549

973

1550

def make_tag(document, name, prop):

974

1551

e = document.createElement("property")

975

1552

e.setAttribute("name", name)

976

1553

e.setAttribute("type", prop._dbus_signature)

977

1554

e.setAttribute("access", prop._dbus_access)

978

1555

return e

1556

979

1557

for if_tag in document.getElementsByTagName("interface"):

980

1558

# Add property tags

981

1559

for tag in (make_tag(document, name, prop)

984

1562

if prop._dbus_interface

985

1563

== if_tag.getAttribute("name")):

986

1564

if_tag.appendChild(tag)

987

# Add annotation tags

988

for typ in ("method", "signal", "property"):

989

for tag in if_tag.getElementsByTagName(typ):

990

annots = dict()

991

for name, prop in (self.

992

_get_all_dbus_things(typ)):

993

if (name == tag.getAttribute("name")

994

and prop._dbus_interface

995

== if_tag.getAttribute("name")):

996

annots.update(getattr

997

(prop,

998

"_dbus_annotations",

999

{}))

1000

for name, value in annots.iteritems():

1001

ann_tag = document.createElement(

1002

"annotation")

1003

ann_tag.setAttribute("name", name)

1004

ann_tag.setAttribute("value", value)

1005

tag.appendChild(ann_tag)

1006

# Add interface annotation tags

1007

for annotation, value in dict(

1008

itertools.chain.from_iterable(

1009

annotations().iteritems()

1010

for name, annotations in

1011

self._get_all_dbus_things("interface")

1012

if name == if_tag.getAttribute("name")

1013

)).iteritems():

1014

ann_tag = document.createElement("annotation")

1015

ann_tag.setAttribute("name", annotation)

1016

ann_tag.setAttribute("value", value)

1017

if_tag.appendChild(ann_tag)

1565

# Add annotation tags for properties

1566

for tag in if_tag.getElementsByTagName("property"):

1567

annots = dict()

1568

for name, prop in self._get_all_dbus_things(

1569

"property"):

1570

if (name == tag.getAttribute("name")

1571

and prop._dbus_interface

1572

== if_tag.getAttribute("name")):

1573

annots.update(getattr(

1574

prop, "_dbus_annotations", {}))

1575

for name, value in annots.items():

1576

ann_tag = document.createElement(

1577

"annotation")

1578

ann_tag.setAttribute("name", name)

1579

ann_tag.setAttribute("value", value)

1580

tag.appendChild(ann_tag)

1018

1581

# Add the names to the return values for the

1019

1582

# "org.freedesktop.DBus.Properties" methods

1020

1583

if (if_tag.getAttribute("name")

1034

1597

document.unlink()

1035

1598

except (AttributeError, xml.dom.DOMException,

1036

1599

xml.parsers.expat.ExpatError) as error:

1037

logger.error("Failed to override Introspection method",

1038

exc_info=error)

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1602

return xmlstring

1603

1604

1605

try:

1606

dbus.OBJECT_MANAGER_IFACE

1607

except AttributeError:

1608

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1609

1610

1611

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1612

"""A D-Bus object with an ObjectManager.

1613

1614

Classes inheriting from this exposes the standard

1615

GetManagedObjects call and the InterfacesAdded and

1616

InterfacesRemoved signals on the standard

1617

"org.freedesktop.DBus.ObjectManager" interface.

1618

1619

Note: No signals are sent automatically; they must be sent

1620

manually.

1621

"""

1622

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1623

out_signature="a{oa{sa{sv}}}")

1624

def GetManagedObjects(self):

1625

"""This function must be overridden"""

1626

raise NotImplementedError()

1627

1628

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1629

signature="oa{sa{sv}}")

1630

def InterfacesAdded(self, object_path, interfaces_and_properties):

1631

pass

1632

1633

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1634

def InterfacesRemoved(self, object_path, interfaces):

1635

pass

1636

1637

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1641

def Introspect(self, object_path, connection):

1642

"""Overloading of standard D-Bus method.

1643

1644

Override return argument name of GetManagedObjects to be

1645

"objpath_interfaces_and_properties"

1646

"""

1647

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1648

object_path,

1649

connection)

1650

try:

1651

document = xml.dom.minidom.parseString(xmlstring)

1652

1653

for if_tag in document.getElementsByTagName("interface"):

1654

# Fix argument name for the GetManagedObjects method

1655

if (if_tag.getAttribute("name")

1656

== dbus.OBJECT_MANAGER_IFACE):

1657

for cn in if_tag.getElementsByTagName("method"):

1658

if (cn.getAttribute("name")

1659

== "GetManagedObjects"):

1660

for arg in cn.getElementsByTagName("arg"):

1661

if (arg.getAttribute("direction")

1662

== "out"):

1663

arg.setAttribute(

1664

"name",

1665

"objpath_interfaces"

1666

"_and_properties")

1667

xmlstring = document.toxml("utf-8")

1668

document.unlink()

1669

except (AttributeError, xml.dom.DOMException,

1670

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1039

1673

return xmlstring

1040

1674

1041

1675

1042

1676

def datetime_to_dbus(dt, variant_level=0):

1043

1677

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1044

1678

if dt is None:

1045

return dbus.String("", variant_level = variant_level)

1046

return dbus.String(dt.isoformat(),

1047

variant_level=variant_level)

1679

return dbus.String("", variant_level=variant_level)

1680

return dbus.String(dt.isoformat(), variant_level=variant_level)

1048

1681

1049

1682

1050

1683

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1052

1685

dbus.service.Object, it will add alternate D-Bus attributes with

1053

1686

interface names according to the "alt_interface_names" mapping.

1054

1687

Usage:

1055

1688

1056

1689

@alternate_dbus_interfaces({"org.example.Interface":

1057

1690

"net.example.AlternateInterface"})

1058

1691

class SampleDBusObject(dbus.service.Object):

1059

1692

@dbus.service.method("org.example.Interface")

1060

1693

def SampleDBusMethod():

1061

1694

pass

1062

1695

1063

1696

The above "SampleDBusMethod" on "SampleDBusObject" will be

1064

1697

reachable via two interfaces: "org.example.Interface" and

1065

1698

"net.example.AlternateInterface", the latter of which will have

1066

1699

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1067

1700

"true", unless "deprecate" is passed with a False value.

1068

1701

1069

1702

This works for methods and signals, and also for D-Bus properties

1070

1703

(from DBusObjectWithProperties) and interfaces (from the

1071

1704

dbus_interface_annotations decorator).

1072

1705

"""

1706

1073

1707

def wrapper(cls):

1074

1708

for orig_interface_name, alt_interface_name in (

1075

alt_interface_names.iteritems()):

1709

alt_interface_names.items()):

1076

1710

attr = {}

1077

1711

interface_names = set()

1078

1712

# Go though all attributes of the class

1080

1714

# Ignore non-D-Bus attributes, and D-Bus attributes

1081

1715

# with the wrong interface name

1082

1716

if (not hasattr(attribute, "_dbus_interface")

1083

or not attribute._dbus_interface

1084

.startswith(orig_interface_name)):

1717

or not attribute._dbus_interface.startswith(

1718

orig_interface_name)):

1085

1719

continue

1086

1720

# Create an alternate D-Bus interface name based on

1087

1721

# the current name

1088

alt_interface = (attribute._dbus_interface

1089

.replace(orig_interface_name,

1090

alt_interface_name))

1722

alt_interface = attribute._dbus_interface.replace(

1723

orig_interface_name, alt_interface_name)

1091

1724

interface_names.add(alt_interface)

1092

1725

# Is this a D-Bus signal?

1093

1726

if getattr(attribute, "_dbus_is_signal", False):

1094

1727

# Extract the original non-method undecorated

1095

1728

# function by black magic

1096

nonmethod_func = (dict(

1729

if sys.version_info.major == 2:

1730

nonmethod_func = (dict(

1097

1731

zip(attribute.func_code.co_freevars,

1098

attribute.__closure__))["func"]

1099

.cell_contents)

1732

attribute.__closure__))

1733

["func"].cell_contents)

1734

else:

1735

nonmethod_func = (dict(

1736

zip(attribute.__code__.co_freevars,

1737

attribute.__closure__))

1738

["func"].cell_contents)

1100

1739

# Create a new, but exactly alike, function

1101

1740

# object, and decorate it to be a new D-Bus signal

1102

1741

# with the alternate D-Bus interface name

1103

new_function = (dbus.service.signal

1104

(alt_interface,

1105

attribute._dbus_signature)

1106

(types.FunctionType(

1107

nonmethod_func.func_code,

1108

nonmethod_func.func_globals,

1109

nonmethod_func.func_name,

1110

nonmethod_func.func_defaults,

1111

nonmethod_func.func_closure)))

1742

new_function = copy_function(nonmethod_func)

1743

new_function = (dbus.service.signal(

1744

alt_interface,

1745

attribute._dbus_signature)(new_function))

1112

1746

# Copy annotations, if any

1113

1747

try:

1114

new_function._dbus_annotations = (

1115

dict(attribute._dbus_annotations))

1748

new_function._dbus_annotations = dict(

1749

attribute._dbus_annotations)

1116

1750

except AttributeError:

1117

1751

pass

1752

1118

1753

# Define a creator of a function to call both the

1119

1754

# original and alternate functions, so both the

1120

1755

# original and alternate signals gets sent when

1123

1758

"""This function is a scope container to pass

1124

1759

func1 and func2 to the "call_both" function

1125

1760

outside of its arguments"""

1761

1762

@functools.wraps(func2)

1126

1763

def call_both(*args, **kwargs):

1127

1764

"""This function will emit two D-Bus

1128

1765

signals by calling func1 and func2"""

1129

1766

func1(*args, **kwargs)

1130

1767

func2(*args, **kwargs)

1768

# Make wrapper function look like a D-Bus

1769

# signal

1770

for name, attr in inspect.getmembers(func2):

1771

if name.startswith("_dbus_"):

1772

setattr(call_both, name, attr)

1773

1131

1774

return call_both

1132

1775

# Create the "call_both" function and add it to

1133

1776

# the class

1138

1781

# object. Decorate it to be a new D-Bus method

1139

1782

# with the alternate D-Bus interface name. Add it

1140

1783

# to the class.

1141

attr[attrname] = (dbus.service.method

1142

(alt_interface,

1143

attribute._dbus_in_signature,

1144

attribute._dbus_out_signature)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1784

attr[attrname] = (

1785

dbus.service.method(

1786

alt_interface,

1787

attribute._dbus_in_signature,

1788

attribute._dbus_out_signature)

1789

(copy_function(attribute)))

1151

1790

# Copy annotations, if any

1152

1791

try:

1153

attr[attrname]._dbus_annotations = (

1154

dict(attribute._dbus_annotations))

1792

attr[attrname]._dbus_annotations = dict(

1793

attribute._dbus_annotations)

1155

1794

except AttributeError:

1156

1795

pass

1157

1796

# Is this a D-Bus property?

1160

1799

# object, and decorate it to be a new D-Bus

1161

1800

# property with the alternate D-Bus interface

1162

1801

# name. Add it to the class.

1163

attr[attrname] = (dbus_service_property

1164

(alt_interface,

1165

attribute._dbus_signature,

1166

attribute._dbus_access,

1167

attribute

1168

._dbus_get_args_options

1169

["byte_arrays"])

1170

(types.FunctionType

1171

(attribute.func_code,

1172

attribute.func_globals,

1173

attribute.func_name,

1174

attribute.func_defaults,

1175

attribute.func_closure)))

1802

attr[attrname] = (dbus_service_property(

1803

alt_interface, attribute._dbus_signature,

1804

attribute._dbus_access,

1805

attribute._dbus_get_args_options

1806

["byte_arrays"])

1807

(copy_function(attribute)))

1176

1808

# Copy annotations, if any

1177

1809

try:

1178

attr[attrname]._dbus_annotations = (

1179

dict(attribute._dbus_annotations))

1810

attr[attrname]._dbus_annotations = dict(

1811

attribute._dbus_annotations)

1180

1812

except AttributeError:

1181

1813

pass

1182

1814

# Is this a D-Bus interface?

1185

1817

# object. Decorate it to be a new D-Bus interface

1186

1818

# with the alternate D-Bus interface name. Add it

1187

1819

# to the class.

1188

attr[attrname] = (dbus_interface_annotations

1189

(alt_interface)

1190

(types.FunctionType

1191

(attribute.func_code,

1192

attribute.func_globals,

1193

attribute.func_name,

1194

attribute.func_defaults,

1195

attribute.func_closure)))

1820

attr[attrname] = (

1821

dbus_interface_annotations(alt_interface)

1822

(copy_function(attribute)))

1196

1823

if deprecate:

1197

1824

# Deprecate all alternate interfaces

1198

iname="_AlternateDBusNames_interface_annotation{0}"

1825

iname = "_AlternateDBusNames_interface_annotation{}"

1199

1826

for interface_name in interface_names:

1827

1200

1828

@dbus_interface_annotations(interface_name)

1201

1829

def func(self):

1202

return { "org.freedesktop.DBus.Deprecated":

1203

"true" }

1830

return {"org.freedesktop.DBus.Deprecated":

1831

"true"}

1204

1832

# Find an unused name

1205

1833

for aname in (iname.format(i)

1206

1834

for i in itertools.count()):

1210

1838

if interface_names:

1211

1839

# Replace the class with a new subclass of it with

1212

1840

# methods, signals, etc. as created above.

1213

cls = type(b"{0}Alternate".format(cls.__name__),

1214

(cls,), attr)

1841

if sys.version_info.major == 2:

1842

cls = type(b"{}Alternate".format(cls.__name__),

1843

(cls, ), attr)

1844

else:

1845

cls = type("{}Alternate".format(cls.__name__),

1846

(cls, ), attr)

1215

1847

return cls

1848

1216

1849

return wrapper

1217

1850

1218

1851

1219

1852

@alternate_dbus_interfaces({"se.recompile.Mandos":

1220

"se.bsnet.fukt.Mandos"})

1853

"se.bsnet.fukt.Mandos"})

1221

1854

class ClientDBus(Client, DBusObjectWithProperties):

1222

1855

"""A Client class using D-Bus

1223

1856

1224

1857

Attributes:

1225

1858

dbus_object_path: dbus.ObjectPath

1226

1859

bus: dbus.SystemBus()

1227

1860

"""

1228

1861

1229

1862

runtime_expansions = (Client.runtime_expansions

1230

+ ("dbus_object_path",))

1231

1863

+ ("dbus_object_path", ))

1864

1865

_interface = "se.recompile.Mandos.Client"

1866

1232

1867

# dbus.service.Object doesn't use super(), so we can't either.

1233

1234

def __init__(self, bus = None, *args, **kwargs):

1868

1869

def __init__(self, bus=None, *args, **kwargs):

1235

1870

self.bus = bus

1236

1871

Client.__init__(self, *args, **kwargs)

1237

1872

# Only now, when this client is initialized, can it show up on

1238

1873

# the D-Bus

1239

client_object_name = unicode(self.name).translate(

1874

client_object_name = str(self.name).translate(

1240

1875

{ord("."): ord("_"),

1241

1876

ord("-"): ord("_")})

1242

self.dbus_object_path = (dbus.ObjectPath

1243

("/clients/" + client_object_name))

1877

self.dbus_object_path = dbus.ObjectPath(

1878

"/clients/" + client_object_name)

1244

1879

DBusObjectWithProperties.__init__(self, self.bus,

1245

1880

self.dbus_object_path)

1246

1247

def notifychangeproperty(transform_func,

1248

dbus_name, type_func=lambda x: x,

1249

variant_level=1):

1881

1882

def notifychangeproperty(transform_func, dbus_name,

1883

type_func=lambda x: x,

1884

variant_level=1,

1885

invalidate_only=False,

1886

_interface=_interface):

1250

1887

""" Modify a variable so that it's a property which announces

1251

1888

its changes to DBus.

1252

1889

1253

1890

transform_fun: Function that takes a value and a variant_level

1254

1891

and transforms it to a D-Bus type.

1255

1892

dbus_name: D-Bus name of the variable

1257

1894

to the D-Bus. Default: no transform

1258

1895

variant_level: D-Bus variant level. Default: 1

1259

1896

"""

1260

attrname = "_{0}".format(dbus_name)

1897

attrname = "_{}".format(dbus_name)

1898

1261

1899

def setter(self, value):

1262

1900

if hasattr(self, "dbus_object_path"):

1263

1901

if (not hasattr(self, attrname) or

1264

1902

type_func(getattr(self, attrname, None))

1265

1903

!= type_func(value)):

1266

dbus_value = transform_func(type_func(value),

1267

variant_level

1268

=variant_level)

1269

self.PropertyChanged(dbus.String(dbus_name),

1270

dbus_value)

1904

if invalidate_only:

1905

self.PropertiesChanged(

1906

_interface, dbus.Dictionary(),

1907

dbus.Array((dbus_name, )))

1908

else:

1909

dbus_value = transform_func(

1910

type_func(value),

1911

variant_level=variant_level)

1912

self.PropertyChanged(dbus.String(dbus_name),

1913

dbus_value)

1914

self.PropertiesChanged(

1915

_interface,

1916

dbus.Dictionary({dbus.String(dbus_name):

1917

dbus_value}),

1918

dbus.Array())

1271

1919

setattr(self, attrname, value)

1272

1920

1273

1921

return property(lambda self: getattr(self, attrname), setter)

1274

1922

1275

1923

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1276

1924

approvals_pending = notifychangeproperty(dbus.Boolean,

1277

1925

"ApprovalPending",

1278

type_func = bool)

1926

type_func=bool)

1279

1927

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1280

1928

last_enabled = notifychangeproperty(datetime_to_dbus,

1281

1929

"LastEnabled")

1282

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1283

type_func = lambda checker:

1284

checker is not None)

1930

checker = notifychangeproperty(

1931

dbus.Boolean, "CheckerRunning",

1932

type_func=lambda checker: checker is not None)

1285

1933

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1286

1934

"LastCheckedOK")

1287

1935

last_checker_status = notifychangeproperty(dbus.Int16,

1290

1938

datetime_to_dbus, "LastApprovalRequest")

1291

1939

approved_by_default = notifychangeproperty(dbus.Boolean,

1292

1940

"ApprovedByDefault")

1293

approval_delay = notifychangeproperty(dbus.UInt64,

1294

"ApprovalDelay",

1295

type_func =

1296

timedelta_to_milliseconds)

1941

approval_delay = notifychangeproperty(

1942

dbus.UInt64, "ApprovalDelay",

1943

type_func=lambda td: td.total_seconds() * 1000)

1297

1944

approval_duration = notifychangeproperty(

1298

1945

dbus.UInt64, "ApprovalDuration",

1299

type_func = timedelta_to_milliseconds)

1946

type_func=lambda td: td.total_seconds() * 1000)

1300

1947

host = notifychangeproperty(dbus.String, "Host")

1301

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1302

type_func =

1303

timedelta_to_milliseconds)

1948

timeout = notifychangeproperty(

1949

dbus.UInt64, "Timeout",

1950

type_func=lambda td: td.total_seconds() * 1000)

1304

1951

extended_timeout = notifychangeproperty(

1305

1952

dbus.UInt64, "ExtendedTimeout",

1306

type_func = timedelta_to_milliseconds)

1307

interval = notifychangeproperty(dbus.UInt64,

1308

"Interval",

1309

type_func =

1310

timedelta_to_milliseconds)

1953

type_func=lambda td: td.total_seconds() * 1000)

1954

interval = notifychangeproperty(

1955

dbus.UInt64, "Interval",

1956

type_func=lambda td: td.total_seconds() * 1000)

1311

1957

checker_command = notifychangeproperty(dbus.String, "Checker")

1312

1958

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1959

invalidate_only=True)

1960

1313

1961

del notifychangeproperty

1314

1962

1315

1963

def __del__(self, *args, **kwargs):

1316

1964

try:

1317

1965

self.remove_from_connection()

1320

1968

if hasattr(DBusObjectWithProperties, "__del__"):

1321

1969

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1322

1970

Client.__del__(self, *args, **kwargs)

1323

1324

def checker_callback(self, pid, condition, command,

1325

*args, **kwargs):

1326

self.checker_callback_tag = None

1327

self.checker = None

1328

if os.WIFEXITED(condition):

1329

exitstatus = os.WEXITSTATUS(condition)

1971

1972

def checker_callback(self, source, condition,

1973

connection, command, *args, **kwargs):

1974

ret = Client.checker_callback(self, source, condition,

1975

connection, command, *args,

1976

**kwargs)

1977

exitstatus = self.last_checker_status

1978

if exitstatus >= 0:

1330

1979

# Emit D-Bus signal

1331

1980

self.CheckerCompleted(dbus.Int16(exitstatus),

1332

dbus.Int64(condition),

1981

# This is specific to GNU libC

1982

dbus.Int64(exitstatus << 8),

1333

1983

dbus.String(command))

1334

1984

else:

1335

1985

# Emit D-Bus signal

1336

1986

self.CheckerCompleted(dbus.Int16(-1),

1337

dbus.Int64(condition),

1987

dbus.Int64(

1988

# This is specific to GNU libC

1989

(exitstatus << 8)

1990

| self.last_checker_signal),

1338

1991

dbus.String(command))

1339

1340

return Client.checker_callback(self, pid, condition, command,

1341

*args, **kwargs)

1342

1992

return ret

1993

1343

1994

def start_checker(self, *args, **kwargs):

1344

old_checker = self.checker

1345

if self.checker is not None:

1346

old_checker_pid = self.checker.pid

1347

else:

1348

old_checker_pid = None

1995

old_checker_pid = getattr(self.checker, "pid", None)

1349

1996

r = Client.start_checker(self, *args, **kwargs)

1350

1997

# Only if new checker process was started

1351

1998

if (self.checker is not None

1353

2000

# Emit D-Bus signal

1354

2001

self.CheckerStarted(self.current_checker_command)

1355

2002

return r

1356

2003

1357

2004

def _reset_approved(self):

1358

2005

self.approved = None

1359

2006

return False

1360

2007

1361

2008

def approve(self, value=True):

1362

2009

self.approved = value

1363

gobject.timeout_add(timedelta_to_milliseconds

1364

(self.approval_duration),

1365

self._reset_approved)

2010

GLib.timeout_add(int(self.approval_duration.total_seconds()

2011

* 1000), self._reset_approved)

1366

2012

self.send_changedstate()

1367

1368

## D-Bus methods, signals & properties

1369

_interface = "se.recompile.Mandos.Client"

1370

1371

## Interfaces

1372

1373

@dbus_interface_annotations(_interface)

1374

def _foo(self):

1375

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1376

"false"}

1377

1378

## Signals

1379

2013

2014

# D-Bus methods, signals & properties

2015

2016

# Interfaces

2017

2018

# Signals

2019

1380

2020

# CheckerCompleted - signal

1381

2021

@dbus.service.signal(_interface, signature="nxs")

1382

2022

def CheckerCompleted(self, exitcode, waitstatus, command):

1383

2023

"D-Bus signal"

1384

2024

pass

1385

2025

1386

2026

# CheckerStarted - signal

1387

2027

@dbus.service.signal(_interface, signature="s")

1388

2028

def CheckerStarted(self, command):

1389

2029

"D-Bus signal"

1390

2030

pass

1391

2031

1392

2032

# PropertyChanged - signal

2033

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1393

2034

@dbus.service.signal(_interface, signature="sv")

1394

2035

def PropertyChanged(self, property, value):

1395

2036

"D-Bus signal"

1396

2037

pass

1397

2038

1398

2039

# GotSecret - signal

1399

2040

@dbus.service.signal(_interface)

1400

2041

def GotSecret(self):

1403

2044

server to mandos-client

1404

2045

"""

1405

2046

pass

1406

2047

1407

2048

# Rejected - signal

1408

2049

@dbus.service.signal(_interface, signature="s")

1409

2050

def Rejected(self, reason):

1410

2051

"D-Bus signal"

1411

2052

pass

1412

2053

1413

2054

# NeedApproval - signal

1414

2055

@dbus.service.signal(_interface, signature="tb")

1415

2056

def NeedApproval(self, timeout, default):

1416

2057

"D-Bus signal"

1417

2058

return self.need_approval()

1418

1419

## Methods

1420

2059

2060

# Methods

2061

1421

2062

# Approve - method

1422

2063

@dbus.service.method(_interface, in_signature="b")

1423

2064

def Approve(self, value):

1424

2065

self.approve(value)

1425

2066

1426

2067

# CheckedOK - method

1427

2068

@dbus.service.method(_interface)

1428

2069

def CheckedOK(self):

1429

2070

self.checked_ok()

1430

2071

1431

2072

# Enable - method

2073

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1432

2074

@dbus.service.method(_interface)

1433

2075

def Enable(self):

1434

2076

"D-Bus method"

1435

2077

self.enable()

1436

2078

1437

2079

# StartChecker - method

2080

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1438

2081

@dbus.service.method(_interface)

1439

2082

def StartChecker(self):

1440

2083

"D-Bus method"

1441

2084

self.start_checker()

1442

2085

1443

2086

# Disable - method

2087

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1444

2088

@dbus.service.method(_interface)

1445

2089

def Disable(self):

1446

2090

"D-Bus method"

1447

2091

self.disable()

1448

2092

1449

2093

# StopChecker - method

2094

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1450

2095

@dbus.service.method(_interface)

1451

2096

def StopChecker(self):

1452

2097

self.stop_checker()

1453

1454

## Properties

1455

2098

2099

# Properties

2100

1456

2101

# ApprovalPending - property

1457

2102

@dbus_service_property(_interface, signature="b", access="read")

1458

2103

def ApprovalPending_dbus_property(self):

1459

2104

return dbus.Boolean(bool(self.approvals_pending))

1460

2105

1461

2106

# ApprovedByDefault - property

1462

@dbus_service_property(_interface, signature="b",

2107

@dbus_service_property(_interface,

2108

signature="b",

1463

2109

access="readwrite")

1464

2110

def ApprovedByDefault_dbus_property(self, value=None):

1465

2111

if value is None: # get

1466

2112

return dbus.Boolean(self.approved_by_default)

1467

2113

self.approved_by_default = bool(value)

1468

2114

1469

2115

# ApprovalDelay - property

1470

@dbus_service_property(_interface, signature="t",

2116

@dbus_service_property(_interface,

2117

signature="t",

1471

2118

access="readwrite")

1472

2119

def ApprovalDelay_dbus_property(self, value=None):

1473

2120

if value is None: # get

1474

return dbus.UInt64(self.approval_delay_milliseconds())

2121

return dbus.UInt64(self.approval_delay.total_seconds()

2122

* 1000)

1475

2123

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1476

2124

1477

2125

# ApprovalDuration - property

1478

@dbus_service_property(_interface, signature="t",

2126

@dbus_service_property(_interface,

2127

signature="t",

1479

2128

access="readwrite")

1480

2129

def ApprovalDuration_dbus_property(self, value=None):

1481

2130

if value is None: # get

1482

return dbus.UInt64(timedelta_to_milliseconds(

1483

self.approval_duration))

2131

return dbus.UInt64(self.approval_duration.total_seconds()

2132

* 1000)

1484

2133

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1485

2134

1486

2135

# Name - property

2136

@dbus_annotations(

2137

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1487

2138

@dbus_service_property(_interface, signature="s", access="read")

1488

2139

def Name_dbus_property(self):

1489

2140

return dbus.String(self.name)

1490

2141

2142

# KeyID - property

2143

@dbus_annotations(

2144

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2145

@dbus_service_property(_interface, signature="s", access="read")

2146

def KeyID_dbus_property(self):

2147

return dbus.String(self.key_id)

2148

1491

2149

# Fingerprint - property

2150

@dbus_annotations(

2151

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1492

2152

@dbus_service_property(_interface, signature="s", access="read")

1493

2153

def Fingerprint_dbus_property(self):

1494

2154

return dbus.String(self.fingerprint)

1495

2155

1496

2156

# Host - property

1497

@dbus_service_property(_interface, signature="s",

2157

@dbus_service_property(_interface,

2158

signature="s",

1498

2159

access="readwrite")

1499

2160

def Host_dbus_property(self, value=None):

1500

2161

if value is None: # get

1501

2162

return dbus.String(self.host)

1502

self.host = unicode(value)

1503

2163

self.host = str(value)

2164

1504

2165

# Created - property

2166

@dbus_annotations(

2167

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1505

2168

@dbus_service_property(_interface, signature="s", access="read")

1506

2169

def Created_dbus_property(self):

1507

2170

return datetime_to_dbus(self.created)

1508

2171

1509

2172

# LastEnabled - property

1510

2173

@dbus_service_property(_interface, signature="s", access="read")

1511

2174

def LastEnabled_dbus_property(self):

1512

2175

return datetime_to_dbus(self.last_enabled)

1513

2176

1514

2177

# Enabled - property

1515

@dbus_service_property(_interface, signature="b",

2178

@dbus_service_property(_interface,

2179

signature="b",

1516

2180

access="readwrite")

1517

2181

def Enabled_dbus_property(self, value=None):

1518

2182

if value is None: # get

1521

2185

self.enable()

1522

2186

else:

1523

2187

self.disable()

1524

2188

1525

2189

# LastCheckedOK - property

1526

@dbus_service_property(_interface, signature="s",

2190

@dbus_service_property(_interface,

2191

signature="s",

1527

2192

access="readwrite")

1528

2193

def LastCheckedOK_dbus_property(self, value=None):

1529

2194

if value is not None:

1530

2195

self.checked_ok()

1531

2196

return

1532

2197

return datetime_to_dbus(self.last_checked_ok)

1533

2198

1534

2199

# LastCheckerStatus - property

1535

@dbus_service_property(_interface, signature="n",

1536

access="read")

2200

@dbus_service_property(_interface, signature="n", access="read")

1537

2201

def LastCheckerStatus_dbus_property(self):

1538

2202

return dbus.Int16(self.last_checker_status)

1539

2203

1540

2204

# Expires - property

1541

2205

@dbus_service_property(_interface, signature="s", access="read")

1542

2206

def Expires_dbus_property(self):

1543

2207

return datetime_to_dbus(self.expires)

1544

2208

1545

2209

# LastApprovalRequest - property

1546

2210

@dbus_service_property(_interface, signature="s", access="read")

1547

2211

def LastApprovalRequest_dbus_property(self):

1548

2212

return datetime_to_dbus(self.last_approval_request)

1549

2213

1550

2214

# Timeout - property

1551

@dbus_service_property(_interface, signature="t",

2215

@dbus_service_property(_interface,

2216

signature="t",

1552

2217

access="readwrite")

1553

2218

def Timeout_dbus_property(self, value=None):

1554

2219

if value is None: # get

1555

return dbus.UInt64(self.timeout_milliseconds())

2220

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1556

2221

old_timeout = self.timeout

1557

2222

self.timeout = datetime.timedelta(0, 0, 0, value)

1558

2223

# Reschedule disabling

1566

2231

if (getattr(self, "disable_initiator_tag", None)

1567

2232

is None):

1568

2233

return

1569

gobject.source_remove(self.disable_initiator_tag)

1570

self.disable_initiator_tag = (

1571

gobject.timeout_add(

1572

timedelta_to_milliseconds(self.expires - now),

1573

self.disable))

1574

2234

GLib.source_remove(self.disable_initiator_tag)

2235

self.disable_initiator_tag = GLib.timeout_add(

2236

int((self.expires - now).total_seconds() * 1000),

2237

self.disable)

2238

1575

2239

# ExtendedTimeout - property

1576

@dbus_service_property(_interface, signature="t",

2240

@dbus_service_property(_interface,

2241

signature="t",

1577

2242

access="readwrite")

1578

2243

def ExtendedTimeout_dbus_property(self, value=None):

1579

2244

if value is None: # get

1580

return dbus.UInt64(self.extended_timeout_milliseconds())

2245

return dbus.UInt64(self.extended_timeout.total_seconds()

2246

* 1000)

1581

2247

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1582

2248

1583

2249

# Interval - property

1584

@dbus_service_property(_interface, signature="t",

2250

@dbus_service_property(_interface,

2251

signature="t",

1585

2252

access="readwrite")

1586

2253

def Interval_dbus_property(self, value=None):

1587

2254

if value is None: # get

1588

return dbus.UInt64(self.interval_milliseconds())

2255

return dbus.UInt64(self.interval.total_seconds() * 1000)

1589

2256

self.interval = datetime.timedelta(0, 0, 0, value)

1590

2257

if getattr(self, "checker_initiator_tag", None) is None:

1591

2258

return

1592

2259

if self.enabled:

1593

2260

# Reschedule checker run

1594

gobject.source_remove(self.checker_initiator_tag)

1595

self.checker_initiator_tag = (gobject.timeout_add

1596

(value, self.start_checker))

1597

self.start_checker() # Start one now, too

1598

2261

GLib.source_remove(self.checker_initiator_tag)

2262

self.checker_initiator_tag = GLib.timeout_add(

2263

value, self.start_checker)

2264

self.start_checker() # Start one now, too

2265

1599

2266

# Checker - property

1600

@dbus_service_property(_interface, signature="s",

2267

@dbus_service_property(_interface,

2268

signature="s",

1601

2269

access="readwrite")

1602

2270

def Checker_dbus_property(self, value=None):

1603

2271

if value is None: # get

1604

2272

return dbus.String(self.checker_command)

1605

self.checker_command = unicode(value)

1606

2273

self.checker_command = str(value)

2274

1607

2275

# CheckerRunning - property

1608

@dbus_service_property(_interface, signature="b",

2276

@dbus_service_property(_interface,

2277

signature="b",

1609

2278

access="readwrite")

1610

2279

def CheckerRunning_dbus_property(self, value=None):

1611

2280

if value is None: # get

1614

2283

self.start_checker()

1615

2284

else:

1616

2285

self.stop_checker()

1617

2286

1618

2287

# ObjectPath - property

2288

@dbus_annotations(

2289

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2290

"org.freedesktop.DBus.Deprecated": "true"})

1619

2291

@dbus_service_property(_interface, signature="o", access="read")

1620

2292

def ObjectPath_dbus_property(self):

1621

return self.dbus_object_path # is already a dbus.ObjectPath

1622

2293

return self.dbus_object_path # is already a dbus.ObjectPath

2294

1623

2295

# Secret = property

1624

@dbus_service_property(_interface, signature="ay",

1625

access="write", byte_arrays=True)

2296

@dbus_annotations(

2297

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2298

"invalidates"})

2299

@dbus_service_property(_interface,

2300

signature="ay",

2301

access="write",

2302

byte_arrays=True)

1626

2303

def Secret_dbus_property(self, value):

1627

self.secret = str(value)

1628

2304

self.secret = bytes(value)

2305

1629

2306

del _interface

1630

2307

1631

2308

1632

class ProxyClient(object):

1633

def __init__(self, child_pipe, fpr, address):

2309

class ProxyClient:

2310

def __init__(self, child_pipe, key_id, fpr, address):

1634

2311

self._pipe = child_pipe

1635

self._pipe.send(('init', fpr, address))

2312

self._pipe.send(("init", key_id, fpr, address))

1636

2313

if not self._pipe.recv():

1637

raise KeyError()

1638

2314

raise KeyError(key_id or fpr)

2315

1639

2316

def __getattribute__(self, name):

1640

if name == '_pipe':

2317

if name == "_pipe":

1641

2318

return super(ProxyClient, self).__getattribute__(name)

1642

self._pipe.send(('getattr', name))

2319

self._pipe.send(("getattr", name))

1643

2320

data = self._pipe.recv()

1644

if data[0] == 'data':

2321

if data[0] == "data":

1645

2322

return data[1]

1646

if data[0] == 'function':

2323

if data[0] == "function":

2324

1647

2325

def func(*args, **kwargs):

1648

self._pipe.send(('funcall', name, args, kwargs))

2326

self._pipe.send(("funcall", name, args, kwargs))

1649

2327

return self._pipe.recv()[1]

2328

1650

2329

return func

1651

2330

1652

2331

def __setattr__(self, name, value):

1653

if name == '_pipe':

2332

if name == "_pipe":

1654

2333

return super(ProxyClient, self).__setattr__(name, value)

1655

self._pipe.send(('setattr', name, value))

2334

self._pipe.send(("setattr", name, value))

1656

2335

1657

2336

1658

2337

class ClientHandler(socketserver.BaseRequestHandler, object):

1659

2338

"""A class to handle client connections.

1660

2339

1661

2340

Instantiated once for each connection to handle it.

1662

2341

Note: This will run in its own forked process."""

1663

2342

1664

2343

def handle(self):

1665

2344

with contextlib.closing(self.server.child_pipe) as child_pipe:

1666

logger.info("TCP connection from: %s",

1667

unicode(self.client_address))

1668

logger.debug("Pipe FD: %d",

1669

self.server.child_pipe.fileno())

1670

1671

session = (gnutls.connection

1672

.ClientSession(self.request,

1673

gnutls.connection

1674

.X509Credentials()))

1675

1676

# Note: gnutls.connection.X509Credentials is really a

1677

# generic GnuTLS certificate credentials object so long as

1678

# no X.509 keys are added to it. Therefore, we can use it

1679

# here despite using OpenPGP certificates.

1680

1681

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1682

# "+AES-256-CBC", "+SHA1",

1683

# "+COMP-NULL", "+CTYPE-OPENPGP",

1684

# "+DHE-DSS"))

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2348

2349

session = gnutls.ClientSession(self.request)

2350

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2352

# "+AES-256-CBC", "+SHA1",

2353

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

# "+DHE-DSS"))

1685

2355

# Use a fallback default, since this MUST be set.

1686

2356

priority = self.server.gnutls_priority

1687

2357

if priority is None:

1688

2358

priority = "NORMAL"

1689

(gnutls.library.functions

1690

.gnutls_priority_set_direct(session._c_object,

1691

priority, None))

1692

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2361

1693

2362

# Start communication using the Mandos protocol

1694

2363

# Get protocol number

1695

2364

line = self.request.makefile().readline()

1696

logger.debug("Protocol version: %r", line)

2365

log.debug("Protocol version: %r", line)

1697

2366

try:

1698

2367

if int(line.strip().split()[0]) > 1:

1699

raise RuntimeError

2368

raise RuntimeError(line)

1700

2369

except (ValueError, IndexError, RuntimeError) as error:

1701

logger.error("Unknown protocol version: %s", error)

2370

log.error("Unknown protocol version: %s", error)

1702

2371

return

1703

2372

1704

2373

# Start GnuTLS connection

1705

2374

try:

1706

2375

session.handshake()

1707

except gnutls.errors.GNUTLSError as error:

1708

logger.warning("Handshake failed: %s", error)

2376

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

1709

2378

# Do not run session.bye() here: the session is not

1710

2379

# established. Just abandon the request.

1711

2380

return

1712

logger.debug("Handshake succeeded")

1713

2381

log.debug("Handshake succeeded")

2382

1714

2383

approval_required = False

1715

2384

try:

1716

try:

1717

fpr = self.fingerprint(self.peer_certificate

1718

(session))

1719

except (TypeError,

1720

gnutls.errors.GNUTLSError) as error:

1721

logger.warning("Bad certificate: %s", error)

1722

return

1723

logger.debug("Fingerprint: %s", fpr)

1724

1725

try:

1726

client = ProxyClient(child_pipe, fpr,

2385

if gnutls.has_rawpk:

2386

fpr = b""

2387

try:

2388

key_id = self.key_id(

2389

self.peer_certificate(session))

2390

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2392

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2396

2397

else:

2398

key_id = b""

2399

try:

2400

fpr = self.fingerprint(

2401

self.peer_certificate(session))

2402

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2404

return

2405

log.debug("Fingerprint: %s", fpr)

2406

2407

try:

2408

client = ProxyClient(child_pipe, key_id, fpr,

1727

2409

self.client_address)

1728

2410

except KeyError:

1729

2411

return

1730

2412

1731

2413

if client.approval_delay:

1732

2414

delay = client.approval_delay

1733

2415

client.approvals_pending += 1

1734

2416

approval_required = True

1735

2417

1736

2418

while True:

1737

2419

if not client.enabled:

1738

logger.info("Client %s is disabled",

1739

client.name)

2420

log.info("Client %s is disabled", client.name)

1740

2421

if self.server.use_dbus:

1741

2422

# Emit D-Bus signal

1742

2423

client.Rejected("Disabled")

1743

2424

return

1744

2425

1745

2426

if client.approved or not client.approval_delay:

1746

#We are approved or approval is disabled

2427

# We are approved or approval is disabled

1747

2428

break

1748

2429

elif client.approved is None:

1749

logger.info("Client %s needs approval",

2430

log.info("Client %s needs approval",

2431

client.name)

2432

if self.server.use_dbus:

2433

# Emit D-Bus signal

2434

client.NeedApproval(

2435

client.approval_delay.total_seconds()

2436

* 1000, client.approved_by_default)

2437

else:

2438

log.warning("Client %s was not approved",

1750

2439

client.name)

1751

2440

if self.server.use_dbus:

1752

2441

# Emit D-Bus signal

1753

client.NeedApproval(

1754

client.approval_delay_milliseconds(),

1755

client.approved_by_default)

1756

else:

1757

logger.warning("Client %s was not approved",

1758

client.name)

1759

if self.server.use_dbus:

1760

# Emit D-Bus signal

1761

2442

client.Rejected("Denied")

1762

2443

return

1763

1764

#wait until timeout or approved

2444

2445

# wait until timeout or approved

1765

2446

time = datetime.datetime.now()

1766

2447

client.changedstate.acquire()

1767

client.changedstate.wait(

1768

float(timedelta_to_milliseconds(delay)

1769

/ 1000))

2448

client.changedstate.wait(delay.total_seconds())

1770

2449

client.changedstate.release()

1771

2450

time2 = datetime.datetime.now()

1772

2451

if (time2 - time) >= delay:

1773

2452

if not client.approved_by_default:

1774

logger.warning("Client %s timed out while"

1775

" waiting for approval",

1776

client.name)

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

1777

2456

if self.server.use_dbus:

1778

2457

# Emit D-Bus signal

1779

2458

client.Rejected("Approval timed out")

1782

2461

break

1783

2462

else:

1784

2463

delay -= time2 - time

1785

1786

sent_size = 0

1787

while sent_size < len(client.secret):

1788

try:

1789

sent = session.send(client.secret[sent_size:])

1790

except gnutls.errors.GNUTLSError as error:

1791

logger.warning("gnutls send failed",

1792

exc_info=error)

1793

return

1794

logger.debug("Sent: %d, remaining: %d",

1795

sent, len(client.secret)

1796

- (sent_size + sent))

1797

sent_size += sent

1798

1799

logger.info("Sending secret to %s", client.name)

2464

2465

try:

2466

session.send(client.secret)

2467

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2469

return

2470

2471

log.info("Sending secret to %s", client.name)

1800

2472

# bump the timeout using extended_timeout

1801

2473

client.bump_timeout(client.extended_timeout)

1802

2474

if self.server.use_dbus:

1803

2475

# Emit D-Bus signal

1804

2476

client.GotSecret()

1805

2477

1806

2478

finally:

1807

2479

if approval_required:

1808

2480

client.approvals_pending -= 1

1809

2481

try:

1810

2482

session.bye()

1811

except gnutls.errors.GNUTLSError as error:

1812

logger.warning("GnuTLS bye failed",

1813

exc_info=error)

1814

2483

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2485

1815

2486

@staticmethod

1816

2487

def peer_certificate(session):

1817

"Return the peer's OpenPGP certificate as a bytestring"

1818

# If not an OpenPGP certificate...

1819

if (gnutls.library.functions

1820

.gnutls_certificate_type_get(session._c_object)

1821

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1822

# ...do the normal thing

1823

return session.peer_certificate

2488

"Return the peer's certificate as a bytestring"

2489

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2492

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2494

if gnutls.has_rawpk:

2495

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

else:

2497

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

# If not a valid certificate type...

2499

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2502

# ...return invalid data

2503

return b""

1824

2504

list_size = ctypes.c_uint(1)

1825

cert_list = (gnutls.library.functions

1826

.gnutls_certificate_get_peers

1827

(session._c_object, ctypes.byref(list_size)))

2505

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

1828

2507

if not bool(cert_list) and list_size.value != 0:

1829

raise gnutls.errors.GNUTLSError("error getting peer"

1830

" certificate")

2508

raise gnutls.Error("error getting peer certificate")

1831

2509

if list_size.value == 0:

1832

2510

return None

1833

2511

cert = cert_list[0]

1834

2512

return ctypes.string_at(cert.data, cert.size)

1835

2513

2514

@staticmethod

2515

def key_id(certificate):

2516

"Convert a certificate bytestring to a hexdigit key ID"

2517

# New GnuTLS "datum" with the public key

2518

datum = gnutls.datum_t(

2519

ctypes.cast(ctypes.c_char_p(certificate),

2520

ctypes.POINTER(ctypes.c_ubyte)),

2521

ctypes.c_uint(len(certificate)))

2522

# XXX all these need to be created in the gnutls "module"

2523

# New empty GnuTLS certificate

2524

pubkey = gnutls.pubkey_t()

2525

gnutls.pubkey_init(ctypes.byref(pubkey))

2526

# Import the raw public key into the certificate

2527

gnutls.pubkey_import(pubkey,

2528

ctypes.byref(datum),

2529

gnutls.X509_FMT_DER)

2530

# New buffer for the key ID

2531

buf = ctypes.create_string_buffer(32)

2532

buf_len = ctypes.c_size_t(len(buf))

2533

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2540

# Deinit the certificate

2541

gnutls.pubkey_deinit(pubkey)

2542

2543

# Convert the buffer to a Python bytestring

2544

key_id = ctypes.string_at(buf, buf_len.value)

2545

# Convert the bytestring to hexadecimal notation

2546

hex_key_id = binascii.hexlify(key_id).upper()

2547

return hex_key_id

2548

1836

2549

@staticmethod

1837

2550

def fingerprint(openpgp):

1838

2551

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1839

2552

# New GnuTLS "datum" with the OpenPGP public key

1840

datum = (gnutls.library.types

1841

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1842

ctypes.POINTER

1843

(ctypes.c_ubyte)),

1844

ctypes.c_uint(len(openpgp))))

2553

datum = gnutls.datum_t(

2554

ctypes.cast(ctypes.c_char_p(openpgp),

2555

ctypes.POINTER(ctypes.c_ubyte)),

2556

ctypes.c_uint(len(openpgp)))

1845

2557

# New empty GnuTLS certificate

1846

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1847

(gnutls.library.functions

1848

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2558

crt = gnutls.openpgp_crt_t()

2559

gnutls.openpgp_crt_init(ctypes.byref(crt))

1849

2560

# Import the OpenPGP public key into the certificate

1850

(gnutls.library.functions

1851

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1852

gnutls.library.constants

1853

.GNUTLS_OPENPGP_FMT_RAW))

2561

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2562

gnutls.OPENPGP_FMT_RAW)

1854

2563

# Verify the self signature in the key

1855

2564

crtverify = ctypes.c_uint()

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_verify_self(crt, 0,

1858

ctypes.byref(crtverify)))

2565

gnutls.openpgp_crt_verify_self(crt, 0,

2566

ctypes.byref(crtverify))

1859

2567

if crtverify.value != 0:

1860

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1861

raise (gnutls.errors.CertificateSecurityError

1862

("Verify failed"))

2568

gnutls.openpgp_crt_deinit(crt)

2569

raise gnutls.CertificateSecurityError(code

2570

=crtverify.value)

1863

2571

# New buffer for the fingerprint

1864

2572

buf = ctypes.create_string_buffer(20)

1865

2573

buf_len = ctypes.c_size_t()

1866

2574

# Get the fingerprint from the certificate into the buffer

1867

(gnutls.library.functions

1868

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1869

ctypes.byref(buf_len)))

2575

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2576

ctypes.byref(buf_len))

1870

2577

# Deinit the certificate

1871

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2578

gnutls.openpgp_crt_deinit(crt)

1872

2579

# Convert the buffer to a Python bytestring

1873

2580

fpr = ctypes.string_at(buf, buf_len.value)

1874

2581

# Convert the bytestring to hexadecimal notation

1876

2583

return hex_fpr

1877

2584

1878

2585

1879

class MultiprocessingMixIn(object):

2586

class MultiprocessingMixIn:

1880

2587

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2588

1881

2589

def sub_process_main(self, request, address):

1882

2590

try:

1883

2591

self.finish_request(request, address)

1884

2592

except Exception:

1885

2593

self.handle_error(request, address)

1886

2594

self.close_request(request)

1887

2595

1888

2596

def process_request(self, request, address):

1889

2597

"""Start a new process to process the request."""

1890

proc = multiprocessing.Process(target = self.sub_process_main,

1891

args = (request, address))

2598

proc = multiprocessing.Process(target=self.sub_process_main,

2599

args=(request, address))

1892

2600

proc.start()

1893

2601

return proc

1894

2602

1895

2603

1896

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2604

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1897

2605

""" adds a pipe to the MixIn """

2606

1898

2607

def process_request(self, request, client_address):

1899

2608

"""Overrides and wraps the original process_request().

1900

2609

1901

2610

This function creates a new pipe in self.pipe

1902

2611

"""

1903

2612

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1904

2613

1905

2614

proc = MultiprocessingMixIn.process_request(self, request,

1906

2615

client_address)

1907

2616

self.child_pipe.close()

1908

2617

self.add_pipe(parent_pipe, proc)

1909

2618

1910

2619

def add_pipe(self, parent_pipe, proc):

1911

2620

"""Dummy function; override as necessary"""

1912

raise NotImplementedError

2621

raise NotImplementedError()

1913

2622

1914

2623

1915

2624

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1916

socketserver.TCPServer, object):

1917

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1918

2625

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2627

1919

2628

Attributes:

1920

2629

enabled: Boolean; whether this server is activated yet

1921

2630

interface: None or a network interface name (string)

1922

2631

use_ipv6: Boolean; to use IPv6 or not

1923

2632

"""

2633

1924

2634

def __init__(self, server_address, RequestHandlerClass,

1925

interface=None, use_ipv6=True, socketfd=None):

2635

interface=None,

2636

use_ipv6=True,

2637

socketfd=None):

1926

2638

"""If socketfd is set, use that file descriptor instead of

1927

2639

creating a new one with socket.socket().

1928

2640

"""

1934

2646

self.socketfd = socketfd

1935

2647

# Save the original socket.socket() function

1936

2648

self.socket_socket = socket.socket

2649

1937

2650

# To implement --socket, we monkey patch socket.socket.

1938

#

2651

#

1939

2652

# (When socketserver.TCPServer is a new-style class, we

1940

2653

# could make self.socket into a property instead of monkey

1941

2654

# patching socket.socket.)

1942

#

2655

#

1943

2656

# Create a one-time-only replacement for socket.socket()

1944

2657

@functools.wraps(socket.socket)

1945

2658

def socket_wrapper(*args, **kwargs):

1957

2670

# socket_wrapper(), if socketfd was set.

1958

2671

socketserver.TCPServer.__init__(self, server_address,

1959

2672

RequestHandlerClass)

1960

2673

1961

2674

def server_bind(self):

1962

2675

"""This overrides the normal server_bind() function

1963

2676

to bind to an interface if one was specified, and also NOT to

1964

2677

bind to an address or port if they were not specified."""

2678

global SO_BINDTODEVICE

1965

2679

if self.interface is not None:

1966

2680

if SO_BINDTODEVICE is None:

1967

logger.error("SO_BINDTODEVICE does not exist;"

1968

" cannot bind to interface %s",

1969

self.interface)

1970

else:

1971

try:

1972

self.socket.setsockopt(socket.SOL_SOCKET,

1973

SO_BINDTODEVICE,

1974

str(self.interface + '\0'))

1975

except socket.error as error:

1976

if error.errno == errno.EPERM:

1977

logger.error("No permission to bind to"

1978

" interface %s", self.interface)

1979

elif error.errno == errno.ENOPROTOOPT:

1980

logger.error("SO_BINDTODEVICE not available;"

1981

" cannot bind to interface %s",

1982

self.interface)

1983

elif error.errno == errno.ENODEV:

1984

logger.error("Interface %s does not exist,"

1985

" cannot bind", self.interface)

1986

else:

1987

raise

2681

# Fall back to a hard-coded value which seems to be

2682

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2684

SO_BINDTODEVICE = 25

2685

try:

2686

self.socket.setsockopt(

2687

socket.SOL_SOCKET, SO_BINDTODEVICE,

2688

(self.interface + "\0").encode("utf-8"))

2689

except socket.error as error:

2690

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2693

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2696

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2699

else:

2700

raise

1988

2701

# Only bind(2) the socket if we really need to.

1989

2702

if self.server_address[0] or self.server_address[1]:

2703

if self.server_address[1]:

2704

self.allow_reuse_address = True

1990

2705

if not self.server_address[0]:

1991

2706

if self.address_family == socket.AF_INET6:

1992

any_address = "::" # in6addr_any

2707

any_address = "::" # in6addr_any

1993

2708

else:

1994

any_address = "0.0.0.0" # INADDR_ANY

2709

any_address = "0.0.0.0" # INADDR_ANY

1995

2710

self.server_address = (any_address,

1996

2711

self.server_address[1])

1997

2712

elif not self.server_address[1]:

1998

self.server_address = (self.server_address[0],

1999

0)

2713

self.server_address = (self.server_address[0], 0)

2000

2714

# if self.interface:

2001

2715

# self.server_address = (self.server_address[0],

2002

2716

# 0, # port

2008

2722

2009

2723

class MandosServer(IPv6_TCPServer):

2010

2724

"""Mandos server.

2011

2725

2012

2726

Attributes:

2013

2727

clients: set of Client objects

2014

2728

gnutls_priority GnuTLS priority string

2015

2729

use_dbus: Boolean; to emit D-Bus signals or not

2016

2017

Assumes a gobject.MainLoop event loop.

2730

2731

Assumes a GLib.MainLoop event loop.

2018

2732

"""

2733

2019

2734

def __init__(self, server_address, RequestHandlerClass,

2020

interface=None, use_ipv6=True, clients=None,

2021

gnutls_priority=None, use_dbus=True, socketfd=None):

2735

interface=None,

2736

use_ipv6=True,

2737

clients=None,

2738

gnutls_priority=None,

2739

use_dbus=True,

2740

socketfd=None):

2022

2741

self.enabled = False

2023

2742

self.clients = clients

2024

2743

if self.clients is None:

2027

2746

self.gnutls_priority = gnutls_priority

2028

2747

IPv6_TCPServer.__init__(self, server_address,

2029

2748

RequestHandlerClass,

2030

interface = interface,

2031

use_ipv6 = use_ipv6,

2032

socketfd = socketfd)

2749

interface=interface,

2750

use_ipv6=use_ipv6,

2751

socketfd=socketfd)

2752

2033

2753

def server_activate(self):

2034

2754

if self.enabled:

2035

2755

return socketserver.TCPServer.server_activate(self)

2036

2756

2037

2757

def enable(self):

2038

2758

self.enabled = True

2039

2759

2040

2760

def add_pipe(self, parent_pipe, proc):

2041

2761

# Call "handle_ipc" for both data and EOF events

2042

gobject.io_add_watch(parent_pipe.fileno(),

2043

gobject.IO_IN | gobject.IO_HUP,

2044

functools.partial(self.handle_ipc,

2045

parent_pipe =

2046

parent_pipe,

2047

proc = proc))

2048

2049

def handle_ipc(self, source, condition, parent_pipe=None,

2050

proc = None, client_object=None):

2762

GLib.io_add_watch(

2763

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2764

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2765

functools.partial(self.handle_ipc,

2766

parent_pipe=parent_pipe,

2767

proc=proc))

2768

2769

def handle_ipc(self, source, condition,

2770

parent_pipe=None,

2771

proc=None,

2772

client_object=None):

2051

2773

# error, or the other end of multiprocessing.Pipe has closed

2052

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2774

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2053

2775

# Wait for other process to exit

2054

2776

proc.join()

2055

2777

return False

2056

2778

2057

2779

# Read a request from the child

2058

2780

request = parent_pipe.recv()

2059

2781

command = request[0]

2060

2061

if command == 'init':

2062

fpr = request[1]

2063

address = request[2]

2064

2065

for c in self.clients.itervalues():

2066

if c.fingerprint == fpr:

2782

2783

if command == "init":

2784

key_id = request[1].decode("ascii")

2785

fpr = request[2].decode("ascii")

2786

address = request[3]

2787

2788

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2791

continue

2792

if key_id and c.key_id == key_id:

2793

client = c

2794

break

2795

if fpr and c.fingerprint == fpr:

2067

2796

client = c

2068

2797

break

2069

2798

else:

2070

logger.info("Client not found for fingerprint: %s, ad"

2071

"dress: %s", fpr, address)

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2072

2801

if self.use_dbus:

2073

2802

# Emit D-Bus signal

2074

mandos_dbus_service.ClientNotFound(fpr,

2803

mandos_dbus_service.ClientNotFound(key_id or fpr,

2075

2804

address[0])

2076

2805

parent_pipe.send(False)

2077

2806

return False

2078

2079

gobject.io_add_watch(parent_pipe.fileno(),

2080

gobject.IO_IN | gobject.IO_HUP,

2081

functools.partial(self.handle_ipc,

2082

parent_pipe =

2083

parent_pipe,

2084

proc = proc,

2085

client_object =

2086

client))

2807

2808

GLib.io_add_watch(

2809

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2810

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2811

functools.partial(self.handle_ipc,

2812

parent_pipe=parent_pipe,

2813

proc=proc,

2814

client_object=client))

2087

2815

parent_pipe.send(True)

2088

2816

# remove the old hook in favor of the new above hook on

2089

2817

# same fileno

2090

2818

return False

2091

if command == 'funcall':

2819

if command == "funcall":

2092

2820

funcname = request[1]

2093

2821

args = request[2]

2094

2822

kwargs = request[3]

2095

2096

parent_pipe.send(('data', getattr(client_object,

2823

2824

parent_pipe.send(("data", getattr(client_object,

2097

2825

funcname)(*args,

2098

**kwargs)))

2099

2100

if command == 'getattr':

2826

**kwargs)))

2827

2828

if command == "getattr":

2101

2829

attrname = request[1]

2102

if callable(client_object.__getattribute__(attrname)):

2103

parent_pipe.send(('function',))

2830

if isinstance(client_object.__getattribute__(attrname),

2831

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2104

2833

else:

2105

parent_pipe.send(('data', client_object

2106

.__getattribute__(attrname)))

2107

2108

if command == 'setattr':

2834

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2836

2837

if command == "setattr":

2109

2838

attrname = request[1]

2110

2839

value = request[2]

2111

2840

setattr(client_object, attrname, value)

2112

2841

2113

2842

return True

2114

2843

2115

2844

2116

2845

def rfc3339_duration_to_delta(duration):

2117

2846

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2118

2119

>>> rfc3339_duration_to_delta("P7D")

2120

datetime.timedelta(7)

2121

>>> rfc3339_duration_to_delta("PT60S")

2122

datetime.timedelta(0, 60)

2123

>>> rfc3339_duration_to_delta("PT60M")

2124

datetime.timedelta(0, 3600)

2125

>>> rfc3339_duration_to_delta("PT24H")

2126

datetime.timedelta(1)

2127

>>> rfc3339_duration_to_delta("P1W")

2128

datetime.timedelta(7)

2129

>>> rfc3339_duration_to_delta("PT5M30S")

2130

datetime.timedelta(0, 330)

2131

>>> rfc3339_duration_to_delta("P1DT3M20S")

2132

datetime.timedelta(1, 200)

2847

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2133

2864

"""

2134

2865

2135

2866

# Parsing an RFC 3339 duration with regular expressions is not

2136

2867

# possible - there would have to be multiple places for the same

2137

2868

# values, like seconds. The current code, while more esoteric, is

2138

2869

# cleaner without depending on a parsing library. If Python had a

2139

2870

# built-in library for parsing we would use it, but we'd like to

2140

2871

# avoid excessive use of external libraries.

2141

2872

2142

2873

# New type for defining tokens, syntax, and semantics all-in-one

2143

Token = collections.namedtuple("Token",

2144

("regexp", # To match token; if

2145

# "value" is not None,

2146

# must have a "group"

2147

# containing digits

2148

"value", # datetime.timedelta or

2149

# None

2150

"followers")) # Tokens valid after

2151

# this token

2874

Token = collections.namedtuple("Token", (

2875

"regexp", # To match token; if "value" is not None, must have

2876

# a "group" containing digits

2877

"value", # datetime.timedelta or None

2878

"followers")) # Tokens valid after this token

2152

2879

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2153

2880

# the "duration" ABNF definition in RFC 3339, Appendix A.

2154

2881

token_end = Token(re.compile(r"$"), None, frozenset())

2155

2882

token_second = Token(re.compile(r"(\d+)S"),

2156

2883

datetime.timedelta(seconds=1),

2157

frozenset((token_end,)))

2884

frozenset((token_end, )))

2158

2885

token_minute = Token(re.compile(r"(\d+)M"),

2159

2886

datetime.timedelta(minutes=1),

2160

2887

frozenset((token_second, token_end)))

2176

2903

frozenset((token_month, token_end)))

2177

2904

token_week = Token(re.compile(r"(\d+)W"),

2178

2905

datetime.timedelta(weeks=1),

2179

frozenset((token_end,)))

2906

frozenset((token_end, )))

2180

2907

token_duration = Token(re.compile(r"P"), None,

2181

2908

frozenset((token_year, token_month,

2182

2909

token_day, token_time,

2183

token_week))),

2184

# Define starting values

2185

value = datetime.timedelta() # Value so far

2910

token_week)))

2911

# Define starting values:

2912

# Value so far

2913

value = datetime.timedelta()

2186

2914

found_token = None

2187

followers = frozenset(token_duration,) # Following valid tokens

2188

s = duration # String left to parse

2915

# Following valid tokens

2916

followers = frozenset((token_duration, ))

2917

# String left to parse

2918

s = duration

2189

2919

# Loop until end token is found

2190

2920

while found_token is not token_end:

2191

2921

# Search for any currently valid tokens

2207

2937

break

2208

2938

else:

2209

2939

# No currently valid tokens were found

2210

raise ValueError("Invalid RFC 3339 duration")

2940

raise ValueError("Invalid RFC 3339 duration: {!r}"

2941

.format(duration))

2211

2942

# End token found

2212

2943

return value

2213

2944

2214

2945

2215

2946

def string_to_delta(interval):

2216

2947

"""Parse a string and return a datetime.timedelta

2217

2218

>>> string_to_delta('7d')

2219

datetime.timedelta(7)

2220

>>> string_to_delta('60s')

2221

datetime.timedelta(0, 60)

2222

>>> string_to_delta('60m')

2223

datetime.timedelta(0, 3600)

2224

>>> string_to_delta('24h')

2225

datetime.timedelta(1)

2226

>>> string_to_delta('1w')

2227

datetime.timedelta(7)

2228

>>> string_to_delta('5m 30s')

2229

datetime.timedelta(0, 330)

2948

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2960

True

2230

2961

"""

2231

2962

2232

2963

try:

2233

2964

return rfc3339_duration_to_delta(interval)

2234

2965

except ValueError:

2235

2966

pass

2236

2967

2237

2968

timevalue = datetime.timedelta(0)

2238

2969

for s in interval.split():

2239

2970

try:

2240

suffix = unicode(s[-1])

2971

suffix = s[-1]

2241

2972

value = int(s[:-1])

2242

2973

if suffix == "d":

2243

2974

delta = datetime.timedelta(value)

2250

2981

elif suffix == "w":

2251

2982

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2252

2983

else:

2253

raise ValueError("Unknown suffix {0!r}"

2254

.format(suffix))

2255

except (ValueError, IndexError) as e:

2984

raise ValueError("Unknown suffix {!r}".format(suffix))

2985

except IndexError as e:

2256

2986

raise ValueError(*(e.args))

2257

2987

timevalue += delta

2258

2988

return timevalue

2259

2989

2260

2990

2261

def daemon(nochdir = False, noclose = False):

2991

def daemon(nochdir=False, noclose=False):

2262

2992

"""See daemon(3). Standard BSD Unix function.

2263

2993

2264

2994

This should really exist as os.daemon, but it doesn't (yet)."""

2265

2995

if os.fork():

2266

2996

sys.exit()

2274

3004

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2275

3005

if not stat.S_ISCHR(os.fstat(null).st_mode):

2276

3006

raise OSError(errno.ENODEV,

2277

"{0} not a character device"

3007

"{} not a character device"

2278

3008

.format(os.devnull))

2279

3009

os.dup2(null, sys.stdin.fileno())

2280

3010

os.dup2(null, sys.stdout.fileno())

2284

3014

2285

3015

2286

3016

def main():

2287

3017

2288

3018

##################################################################

2289

3019

# Parsing of options, both command line and config file

2290

3020

2291

3021

parser = argparse.ArgumentParser()

2292

3022

parser.add_argument("-v", "--version", action="version",

2293

version = "%(prog)s {0}".format(version),

3023

version="%(prog)s {}".format(version),

2294

3024

help="show version number and exit")

2295

3025

parser.add_argument("-i", "--interface", metavar="IF",

2296

3026

help="Bind to interface IF")

2329

3059

help="Directory to save/restore state in")

2330

3060

parser.add_argument("--foreground", action="store_true",

2331

3061

help="Run in foreground", default=None)

2332

3062

parser.add_argument("--no-zeroconf", action="store_false",

3063

dest="zeroconf", help="Do not use Zeroconf",

3064

default=None)

3065

2333

3066

options = parser.parse_args()

2334

2335

if options.check:

2336

import doctest

2337

doctest.testmod()

2338

sys.exit()

2339

3067

2340

3068

# Default values for config file for server-global settings

2341

server_defaults = { "interface": "",

2342

"address": "",

2343

"port": "",

2344

"debug": "False",

2345

"priority":

2346

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",

2347

"servicename": "Mandos",

2348

"use_dbus": "True",

2349

"use_ipv6": "True",

2350

"debuglevel": "",

2351

"restore": "True",

2352

"socket": "",

2353

"statedir": "/var/lib/mandos",

2354

"foreground": "False",

2355

}

2356

3069

if gnutls.has_rawpk:

3070

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3071

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3072

else:

3073

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3074

":+SIGN-DSA-SHA256")

3075

server_defaults = {"interface": "",

3076

"address": "",

3077

"port": "",

3078

"debug": "False",

3079

"priority": priority,

3080

"servicename": "Mandos",

3081

"use_dbus": "True",

3082

"use_ipv6": "True",

3083

"debuglevel": "",

3084

"restore": "True",

3085

"socket": "",

3086

"statedir": "/var/lib/mandos",

3087

"foreground": "False",

3088

"zeroconf": "True",

3089

}

3090

del priority

3091

2357

3092

# Parse config file for server-global settings

2358

server_config = configparser.SafeConfigParser(server_defaults)

3093

server_config = configparser.ConfigParser(server_defaults)

2359

3094

del server_defaults

2360

server_config.read(os.path.join(options.configdir,

2361

"mandos.conf"))

2362

# Convert the SafeConfigParser object to a dict

3095

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3096

# Convert the ConfigParser object to a dict

2363

3097

server_settings = server_config.defaults()

2364

3098

# Use the appropriate methods on the non-string config options

2365

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3099

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3100

"foreground", "zeroconf"):

2366

3101

server_settings[option] = server_config.getboolean("DEFAULT",

2367

3102

option)

2368

3103

if server_settings["port"]:

2374

3109

# Later, stdin will, and stdout and stderr might, be dup'ed

2375

3110

# over with an opened os.devnull. But we don't want this to

2376

3111

# happen with a supplied network socket.

2377

if 0 <= server_settings["socket"] <= 2:

3112

while 0 <= server_settings["socket"] <= 2:

2378

3113

server_settings["socket"] = os.dup(server_settings

2379

3114

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

2380

3116

del server_config

2381

3117

2382

3118

# Override the settings from the config file with command line

2383

3119

# options, if set.

2384

3120

for option in ("interface", "address", "port", "debug",

2385

"priority", "servicename", "configdir",

2386

"use_dbus", "use_ipv6", "debuglevel", "restore",

2387

"statedir", "socket", "foreground"):

3121

"priority", "servicename", "configdir", "use_dbus",

3122

"use_ipv6", "debuglevel", "restore", "statedir",

3123

"socket", "foreground", "zeroconf"):

2388

3124

value = getattr(options, option)

2389

3125

if value is not None:

2390

3126

server_settings[option] = value

2391

3127

del options

2392

3128

# Force all strings to be unicode

2393

3129

for option in server_settings.keys():

2394

if type(server_settings[option]) is str:

2395

server_settings[option] = unicode(server_settings[option])

3130

if isinstance(server_settings[option], bytes):

3131

server_settings[option] = (server_settings[option]

3132

.decode("utf-8"))

2396

3133

# Force all boolean options to be boolean

2397

3134

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2398

"foreground"):

3135

"foreground", "zeroconf"):

2399

3136

server_settings[option] = bool(server_settings[option])

2400

3137

# Debug implies foreground

2401

3138

if server_settings["debug"]:

2402

3139

server_settings["foreground"] = True

2403

3140

# Now we have our good server settings in "server_settings"

2404

3141

2405

3142

##################################################################

2406

3143

3144

if (not server_settings["zeroconf"]

3145

and not (server_settings["port"]

3146

or server_settings["socket"] != "")):

3147

parser.error("Needs port or socket to work without Zeroconf")

3148

2407

3149

# For convenience

2408

3150

debug = server_settings["debug"]

2409

3151

debuglevel = server_settings["debuglevel"]

2412

3154

stored_state_path = os.path.join(server_settings["statedir"],

2413

3155

stored_state_file)

2414

3156

foreground = server_settings["foreground"]

2415

3157

zeroconf = server_settings["zeroconf"]

3158

2416

3159

if debug:

2417

3160

initlogger(debug, logging.DEBUG)

2418

3161

else:

2421

3164

else:

2422

3165

level = getattr(logging, debuglevel.upper())

2423

3166

initlogger(debug, level)

2424

3167

2425

3168

if server_settings["servicename"] != "Mandos":

2426

syslogger.setFormatter(logging.Formatter

2427

('Mandos ({0}) [%(process)d]:'

2428

' %(levelname)s: %(message)s'

2429

.format(server_settings

2430

["servicename"])))

2431

3169

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

3172

server_settings["servicename"])))

3173

2432

3174

# Parse config file with clients

2433

client_config = configparser.SafeConfigParser(Client

2434

.client_defaults)

3175

client_config = configparser.ConfigParser(Client.client_defaults)

2435

3176

client_config.read(os.path.join(server_settings["configdir"],

2436

3177

"clients.conf"))

2437

3178

2438

3179

global mandos_dbus_service

2439

3180

mandos_dbus_service = None

2440

2441

tcp_server = MandosServer((server_settings["address"],

2442

server_settings["port"]),

2443

ClientHandler,

2444

interface=(server_settings["interface"]

2445

or None),

2446

use_ipv6=use_ipv6,

2447

gnutls_priority=

2448

server_settings["priority"],

2449

use_dbus=use_dbus,

2450

socketfd=(server_settings["socket"]

2451

or None))

3181

3182

socketfd = None

3183

if server_settings["socket"] != "":

3184

socketfd = server_settings["socket"]

3185

tcp_server = MandosServer(

3186

(server_settings["address"], server_settings["port"]),

3187

ClientHandler,

3188

interface=(server_settings["interface"] or None),

3189

use_ipv6=use_ipv6,

3190

gnutls_priority=server_settings["priority"],

3191

use_dbus=use_dbus,

3192

socketfd=socketfd)

2452

3193

if not foreground:

2453

pidfilename = "/var/run/mandos.pid"

3194

pidfilename = "/run/mandos.pid"

3195

if not os.path.isdir("/run/."):

3196

pidfilename = "/var/run/mandos.pid"

2454

3197

pidfile = None

2455

3198

try:

2456

pidfile = open(pidfilename, "w")

3199

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2457

3200

except IOError as e:

2458

logger.error("Could not open file %r", pidfilename,

2459

exc_info=e)

2460

2461

for name in ("_mandos", "mandos", "nobody"):

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3203

3204

for name, group in (("_mandos", "_mandos"),

3205

("mandos", "mandos"),

3206

("nobody", "nogroup")):

2462

3207

try:

2463

3208

uid = pwd.getpwnam(name).pw_uid

2464

gid = pwd.getpwnam(name).pw_gid

3209

gid = pwd.getpwnam(group).pw_gid

2465

3210

break

2466

3211

except KeyError:

2467

3212

continue

2471

3216

try:

2472

3217

os.setgid(gid)

2473

3218

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

2474

3220

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

2475

3223

if error.errno != errno.EPERM:

2476

raise error

2477

3224

raise

3225

2478

3226

if debug:

2479

3227

# Enable all possible GnuTLS debugging

2480

3228

2481

3229

# "Use a log level over 10 to enable all debugging options."

2482

3230

# - GnuTLS manual

2483

gnutls.library.functions.gnutls_global_set_log_level(11)

2484

2485

@gnutls.library.types.gnutls_log_func

3231

gnutls.global_set_log_level(11)

3232

3233

@gnutls.log_func

2486

3234

def debug_gnutls(level, string):

2487

logger.debug("GnuTLS: %s", string[:-1])

2488

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2491

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3237

3238

gnutls.global_set_log_function(debug_gnutls)

3239

2492

3240

# Redirect stdin so all checkers get /dev/null

2493

3241

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2494

3242

os.dup2(null, sys.stdin.fileno())

2495

3243

if null > 2:

2496

3244

os.close(null)

2497

3245

2498

3246

# Need to fork before connecting to D-Bus

2499

3247

if not foreground:

2500

3248

# Close all input and output, do double fork, etc.

2501

3249

daemon()

2502

2503

# multiprocessing will use threads, so before we use gobject we

2504

# need to inform gobject that threads will be used.

2505

gobject.threads_init()

2506

3250

3251

if gi.version_info < (3, 10, 2):

3252

# multiprocessing will use threads, so before we use GLib we

3253

# need to inform GLib that threads will be used.

3254

GLib.threads_init()

3255

2507

3256

global main_loop

2508

3257

# From the Avahi example code

2509

3258

DBusGMainLoop(set_as_default=True)

2510

main_loop = gobject.MainLoop()

2511

bus = dbus.SystemBus()

3259

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

2512

3262

# End of Avahi example code

2513

3263

if use_dbus:

2514

3264

try:

2515

3265

bus_name = dbus.service.BusName("se.recompile.Mandos",

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

2521

logger.error("Disabling D-Bus:", exc_info=e)

3266

bus,

3267

do_not_queue=True)

3268

old_bus_name = dbus.service.BusName(

3269

"se.bsnet.fukt.Mandos", bus,

3270

do_not_queue=True)

3271

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

2522

3273

use_dbus = False

2523

3274

server_settings["use_dbus"] = False

2524

3275

tcp_server.use_dbus = False

2525

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2526

service = AvahiServiceToSyslog(name =

2527

server_settings["servicename"],

2528

servicetype = "_mandos._tcp",

2529

protocol = protocol, bus = bus)

2530

if server_settings["interface"]:

2531

service.interface = (if_nametoindex

2532

(str(server_settings["interface"])))

2533

3276

if zeroconf:

3277

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3278

service = AvahiServiceToSyslog(

3279

name=server_settings["servicename"],

3280

servicetype="_mandos._tcp",

3281

protocol=protocol,

3282

bus=bus)

3283

if server_settings["interface"]:

3284

service.interface = if_nametoindex(

3285

server_settings["interface"].encode("utf-8"))

3286

2534

3287

global multiprocessing_manager

2535

3288

multiprocessing_manager = multiprocessing.Manager()

2536

3289

2537

3290

client_class = Client

2538

3291

if use_dbus:

2539

client_class = functools.partial(ClientDBus, bus = bus)

2540

3292

client_class = functools.partial(ClientDBus, bus=bus)

3293

2541

3294

client_settings = Client.config_parser(client_config)

2542

3295

old_client_settings = {}

2543

3296

clients_data = {}

2544

3297

2545

3298

# This is used to redirect stdout and stderr for checker processes

2546

3299

global wnull

2547

wnull = open(os.devnull, "w") # A writable /dev/null

3300

wnull = open(os.devnull, "w") # A writable /dev/null

2548

3301

# Only used if server is running in foreground but not in debug

2549

3302

# mode

2550

3303

if debug or not foreground:

2551

3304

wnull.close()

2552

3305

2553

3306

# Get client data and settings from last running state.

2554

3307

if server_settings["restore"]:

2555

3308

try:

2556

3309

with open(stored_state_path, "rb") as stored_state:

2557

clients_data, old_client_settings = (pickle.load

2558

(stored_state))

3310

if sys.version_info.major == 2:

3311

clients_data, old_client_settings = pickle.load(

3312

stored_state)

3313

else:

3314

bytes_clients_data, bytes_old_client_settings = (

3315

pickle.load(stored_state, encoding="bytes"))

3316

# Fix bytes to strings

3317

# clients_data

3318

# .keys()

3319

clients_data = {(key.decode("utf-8")

3320

if isinstance(key, bytes)

3321

else key): value

3322

for key, value in

3323

bytes_clients_data.items()}

3324

del bytes_clients_data

3325

for key in clients_data:

3326

value = {(k.decode("utf-8")

3327

if isinstance(k, bytes) else k): v

3328

for k, v in

3329

clients_data[key].items()}

3330

clients_data[key] = value

3331

# .client_structure

3332

value["client_structure"] = [

3333

(s.decode("utf-8")

3334

if isinstance(s, bytes)

3335

else s) for s in

3336

value["client_structure"]]

3337

# .name, .host, and .checker_command

3338

for k in ("name", "host", "checker_command"):

3339

if isinstance(value[k], bytes):

3340

value[k] = value[k].decode("utf-8")

3341

if "key_id" not in value:

3342

value["key_id"] = ""

3343

elif "fingerprint" not in value:

3344

value["fingerprint"] = ""

3345

# old_client_settings

3346

# .keys()

3347

old_client_settings = {

3348

(key.decode("utf-8")

3349

if isinstance(key, bytes)

3350

else key): value

3351

for key, value in

3352

bytes_old_client_settings.items()}

3353

del bytes_old_client_settings

3354

# .host and .checker_command

3355

for value in old_client_settings.values():

3356

for attribute in ("host", "checker_command"):

3357

if isinstance(value[attribute], bytes):

3358

value[attribute] = (value[attribute]

3359

.decode("utf-8"))

2559

3360

os.remove(stored_state_path)

2560

3361

except IOError as e:

2561

3362

if e.errno == errno.ENOENT:

2562

logger.warning("Could not load persistent state: {0}"

2563

.format(os.strerror(e.errno)))

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

2564

3365

else:

2565

logger.critical("Could not load persistent state:",

2566

exc_info=e)

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

2567

3368

raise

2568

3369

except EOFError as e:

2569

logger.warning("Could not load persistent state: "

2570

"EOFError:", exc_info=e)

2571

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3372

2572

3373

with PGPEngine() as pgp:

2573

for client_name, client in clients_data.iteritems():

3374

for client_name, client in clients_data.items():

2574

3375

# Skip removed clients

2575

3376

if client_name not in client_settings:

2576

3377

continue

2577

3378

2578

3379

# Decide which value to use after restoring saved state.

2579

3380

# We have three different values: Old config file,

2580

3381

# new config file, and saved state.

2585

3386

# For each value in new config, check if it

2586

3387

# differs from the old config value (Except for

2587

3388

# the "secret" attribute)

2588

if (name != "secret" and

2589

value != old_client_settings[client_name]

2590

[name]):

3389

if (name != "secret"

3390

and (value !=

3391

old_client_settings[client_name][name])):

2591

3392

client[name] = value

2592

3393

except KeyError:

2593

3394

pass

2594

3395

2595

3396

# Clients who has passed its expire date can still be

2596

# enabled if its last checker was successful. Clients

3397

# enabled if its last checker was successful. A Client

2597

3398

# whose checker succeeded before we stored its state is

2598

3399

# assumed to have successfully run all checkers during

2599

3400

# downtime.

2600

3401

if client["enabled"]:

2601

3402

if datetime.datetime.utcnow() >= client["expires"]:

2602

3403

if not client["last_checked_ok"]:

2603

logger.warning(

2604

"disabling client {0} - Client never "

2605

"performed a successful checker"

2606

.format(client_name))

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

2607

3407

client["enabled"] = False

2608

3408

elif client["last_checker_status"] != 0:

2609

logger.warning(

2610

"disabling client {0} - Client "

2611

"last checker failed with error code {1}"

2612

.format(client_name,

2613

client["last_checker_status"]))

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

2614

3413

client["enabled"] = False

2615

3414

else:

2616

client["expires"] = (datetime.datetime

2617

.utcnow()

2618

+ client["timeout"])

2619

logger.debug("Last checker succeeded,"

2620

" keeping {0} enabled"

2621

.format(client_name))

3415

client["expires"] = (

3416

datetime.datetime.utcnow()

3417

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

2622

3420

try:

2623

client["secret"] = (

2624

pgp.decrypt(client["encrypted_secret"],

2625

client_settings[client_name]

2626

["secret"]))

3421

client["secret"] = pgp.decrypt(

3422

client["encrypted_secret"],

3423

client_settings[client_name]["secret"])

2627

3424

except PGPError:

2628

3425

# If decryption fails, we use secret from new settings

2629

logger.debug("Failed to decrypt {0} old secret"

2630

.format(client_name))

2631

client["secret"] = (

2632

client_settings[client_name]["secret"])

2633

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3428

client["secret"] = (client_settings[client_name]

3429

["secret"])

3430

2634

3431

# Add/remove clients based on new changes made to config

2635

3432

for client_name in (set(old_client_settings)

2636

3433

- set(client_settings)):

2638

3435

for client_name in (set(client_settings)

2639

3436

- set(old_client_settings)):

2640

3437

clients_data[client_name] = client_settings[client_name]

2641

3438

2642

3439

# Create all client objects

2643

for client_name, client in clients_data.iteritems():

3440

for client_name, client in clients_data.items():

2644

3441

tcp_server.clients[client_name] = client_class(

2645

name = client_name, settings = client,

2646

server_settings = server_settings)

2647

3442

name=client_name,

3443

settings=client,

3444

server_settings=server_settings)

3445

2648

3446

if not tcp_server.clients:

2649

logger.warning("No clients defined")

2650

3447

log.warning("No clients defined")

3448

2651

3449

if not foreground:

2652

3450

if pidfile is not None:

3451

pid = os.getpid()

2653

3452

try:

2654

3453

with pidfile:

2655

pid = os.getpid()

2656

pidfile.write(str(pid) + "\n".encode("utf-8"))

3454

print(pid, file=pidfile)

2657

3455

except IOError:

2658

logger.error("Could not write to file %r with PID %d",

2659

pidfilename, pid)

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

2660

3458

del pidfile

2661

3459

del pidfilename

2662

2663

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2664

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2665

3460

3461

for termsig in (signal.SIGHUP, signal.SIGTERM):

3462

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3463

lambda: main_loop.quit() and False)

3464

2666

3465

if use_dbus:

2667

@alternate_dbus_interfaces({"se.recompile.Mandos":

2668

"se.bsnet.fukt.Mandos"})

2669

class MandosDBusService(DBusObjectWithProperties):

3466

3467

@alternate_dbus_interfaces(

3468

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3469

class MandosDBusService(DBusObjectWithObjectManager):

2670

3470

"""A D-Bus proxy object"""

3471

2671

3472

def __init__(self):

2672

3473

dbus.service.Object.__init__(self, bus, "/")

3474

2673

3475

_interface = "se.recompile.Mandos"

2674

2675

@dbus_interface_annotations(_interface)

2676

def _foo(self):

2677

return { "org.freedesktop.DBus.Property"

2678

".EmitsChangedSignal":

2679

"false"}

2680

3476

2681

3477

@dbus.service.signal(_interface, signature="o")

2682

3478

def ClientAdded(self, objpath):

2683

3479

"D-Bus signal"

2684

3480

pass

2685

3481

2686

3482

@dbus.service.signal(_interface, signature="ss")

2687

def ClientNotFound(self, fingerprint, address):

3483

def ClientNotFound(self, key_id, address):

2688

3484

"D-Bus signal"

2689

3485

pass

2690

3486

3487

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3488

"true"})

2691

3489

@dbus.service.signal(_interface, signature="os")

2692

3490

def ClientRemoved(self, objpath, name):

2693

3491

"D-Bus signal"

2694

3492

pass

2695

3493

3494

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3495

"true"})

2696

3496

@dbus.service.method(_interface, out_signature="ao")

2697

3497

def GetAllClients(self):

2698

3498

"D-Bus method"

2699

return dbus.Array(c.dbus_object_path

2700

for c in

2701

tcp_server.clients.itervalues())

2702

3499

return dbus.Array(c.dbus_object_path for c in

3500

tcp_server.clients.values())

3501

3502

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3503

"true"})

2703

3504

@dbus.service.method(_interface,

2704

3505

out_signature="a{oa{sv}}")

2705

3506

def GetAllClientsWithProperties(self):

2706

3507

"D-Bus method"

2707

3508

return dbus.Dictionary(

2708

((c.dbus_object_path, c.GetAll(""))

2709

for c in tcp_server.clients.itervalues()),

3509

{c.dbus_object_path: c.GetAll(

3510

"se.recompile.Mandos.Client")

3511

for c in tcp_server.clients.values()},

2710

3512

signature="oa{sv}")

2711

3513

2712

3514

@dbus.service.method(_interface, in_signature="o")

2713

3515

def RemoveClient(self, object_path):

2714

3516

"D-Bus method"

2715

for c in tcp_server.clients.itervalues():

3517

for c in tcp_server.clients.values():

2716

3518

if c.dbus_object_path == object_path:

2717

3519

del tcp_server.clients[c.name]

2718

3520

c.remove_from_connection()

2719

# Don't signal anything except ClientRemoved

3521

# Don't signal the disabling

2720

3522

c.disable(quiet=True)

2721

# Emit D-Bus signal

2722

self.ClientRemoved(object_path, c.name)

3523

# Emit D-Bus signal for removal

3524

self.client_removed_signal(c)

2723

3525

return

2724

3526

raise KeyError(object_path)

2725

3527

2726

3528

del _interface

2727

3529

3530

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3531

out_signature="a{oa{sa{sv}}}")

3532

def GetManagedObjects(self):

3533

"""D-Bus method"""

3534

return dbus.Dictionary(

3535

{client.dbus_object_path:

3536

dbus.Dictionary(

3537

{interface: client.GetAll(interface)

3538

for interface in

3539

client._get_all_interface_names()})

3540

for client in tcp_server.clients.values()})

3541

3542

def client_added_signal(self, client):

3543

"""Send the new standard signal and the old signal"""

3544

if use_dbus:

3545

# New standard signal

3546

self.InterfacesAdded(

3547

client.dbus_object_path,

3548

dbus.Dictionary(

3549

{interface: client.GetAll(interface)

3550

for interface in

3551

client._get_all_interface_names()}))

3552

# Old signal

3553

self.ClientAdded(client.dbus_object_path)

3554

3555

def client_removed_signal(self, client):

3556

"""Send the new standard signal and the old signal"""

3557

if use_dbus:

3558

# New standard signal

3559

self.InterfacesRemoved(

3560

client.dbus_object_path,

3561

client._get_all_interface_names())

3562

# Old signal

3563

self.ClientRemoved(client.dbus_object_path,

3564

client.name)

3565

2728

3566

mandos_dbus_service = MandosDBusService()

2729

3567

3568

# Save modules to variables to exempt the modules from being

3569

# unloaded before the function registered with atexit() is run.

3570

mp = multiprocessing

3571

wn = wnull

3572

2730

3573

def cleanup():

2731

3574

"Cleanup function; run on exit"

2732

service.cleanup()

2733

2734

multiprocessing.active_children()

2735

wnull.close()

3575

if zeroconf:

3576

service.cleanup()

3577

3578

mp.active_children()

3579

wn.close()

2736

3580

if not (tcp_server.clients or client_settings):

2737

3581

return

2738

3582

2739

3583

# Store client before exiting. Secrets are encrypted with key

2740

3584

# based on what config file has. If config file is

2741

3585

# removed/edited, old secret will thus be unrecovable.

2742

3586

clients = {}

2743

3587

with PGPEngine() as pgp:

2744

for client in tcp_server.clients.itervalues():

3588

for client in tcp_server.clients.values():

2745

3589

key = client_settings[client.name]["secret"]

2746

3590

client.encrypted_secret = pgp.encrypt(client.secret,

2747

3591

key)

2748

3592

client_dict = {}

2749

3593

2750

3594

# A list of attributes that can not be pickled

2751

3595

# + secret.

2752

exclude = set(("bus", "changedstate", "secret",

2753

"checker", "server_settings"))

2754

for name, typ in (inspect.getmembers

2755

(dbus.service.Object)):

3596

exclude = {"bus", "changedstate", "secret",

3597

"checker", "server_settings"}

3598

for name, typ in inspect.getmembers(dbus.service

3599

.Object):

2756

3600

exclude.add(name)

2757

3601

2758

3602

client_dict["encrypted_secret"] = (client

2759

3603

.encrypted_secret)

2760

3604

for attr in client.client_structure:

2761

3605

if attr not in exclude:

2762

3606

client_dict[attr] = getattr(client, attr)

2763

3607

2764

3608

clients[client.name] = client_dict

2765

3609

del client_settings[client.name]["secret"]

2766

3610

2767

3611

try:

2768

with (tempfile.NamedTemporaryFile

2769

(mode='wb', suffix=".pickle", prefix='clients-',

2770

dir=os.path.dirname(stored_state_path),

2771

delete=False)) as stored_state:

2772

pickle.dump((clients, client_settings), stored_state)

2773

tempname=stored_state.name

3612

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3614

suffix=".pickle",

3615

prefix="clients-",

3616

dir=os.path.dirname(stored_state_path),

3617

delete=False) as stored_state:

3618

pickle.dump((clients, client_settings), stored_state,

3619

protocol=2)

3620

tempname = stored_state.name

2774

3621

os.rename(tempname, stored_state_path)

2775

3622

except (IOError, OSError) as e:

2776

3623

if not debug:

2779

3626

except NameError:

2780

3627

pass

2781

3628

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2782

logger.warning("Could not save persistent state: {0}"

2783

.format(os.strerror(e.errno)))

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

2784

3631

else:

2785

logger.warning("Could not save persistent state:",

2786

exc_info=e)

2787

raise e

2788

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3634

raise

3635

2789

3636

# Delete all clients, and settings from config

2790

3637

while tcp_server.clients:

2791

3638

name, client = tcp_server.clients.popitem()

2792

3639

if use_dbus:

2793

3640

client.remove_from_connection()

2794

# Don't signal anything except ClientRemoved

3641

# Don't signal the disabling

2795

3642

client.disable(quiet=True)

3643

# Emit D-Bus signal for removal

2796

3644

if use_dbus:

2797

# Emit D-Bus signal

2798

mandos_dbus_service.ClientRemoved(client

2799

.dbus_object_path,

2800

client.name)

3645

mandos_dbus_service.client_removed_signal(client)

2801

3646

client_settings.clear()

2802

3647

2803

3648

atexit.register(cleanup)

2804

2805

for client in tcp_server.clients.itervalues():

3649

3650

for client in tcp_server.clients.values():

2806

3651

if use_dbus:

2807

# Emit D-Bus signal

2808

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3652

# Emit D-Bus signal for adding

3653

mandos_dbus_service.client_added_signal(client)

2809

3654

# Need to initiate checking of clients

2810

3655

if client.enabled:

2811

client.init_checker()

2812

3656

client.init_checker(randomize_start=True)

3657

2813

3658

tcp_server.enable()

2814

3659

tcp_server.server_activate()

2815

3660

2816

3661

# Find out what port we got

2817

service.port = tcp_server.socket.getsockname()[1]

3662

if zeroconf:

3663

service.port = tcp_server.socket.getsockname()[1]

2818

3664

if use_ipv6:

2819

logger.info("Now listening on address %r, port %d,"

2820

" flowinfo %d, scope_id %d",

2821

*tcp_server.socket.getsockname())

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

2822

3667

else: # IPv4

2823

logger.info("Now listening on address %r, port %d",

2824

*tcp_server.socket.getsockname())

2825

2826

#service.interface = tcp_server.socket.getsockname()[3]

2827

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3670

3671

# service.interface = tcp_server.socket.getsockname()[3]

3672

2828

3673

try:

2829

# From the Avahi example code

2830

try:

2831

service.activate()

2832

except dbus.exceptions.DBusException as error:

2833

logger.critical("D-Bus Exception", exc_info=error)

2834

cleanup()

2835

sys.exit(1)

2836

# End of Avahi example code

2837

2838

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2839

lambda *args, **kwargs:

2840

(tcp_server.handle_request

2841

(*args[2:], **kwargs) or True))

2842

2843

logger.debug("Starting main loop")

3674

if zeroconf:

3675

# From the Avahi example code

3676

try:

3677

service.activate()

3678

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3680

cleanup()

3681

sys.exit(1)

3682

# End of Avahi example code

3683

3684

GLib.io_add_watch(

3685

GLib.IOChannel.unix_new(tcp_server.fileno()),

3686

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3687

lambda *args, **kwargs: (tcp_server.handle_request

3688

(*args[2:], **kwargs) or True))

3689

3690

log.debug("Starting main loop")

2844

3691

main_loop.run()

2845

3692

except AvahiError as error:

2846

logger.critical("Avahi Error", exc_info=error)

3693

log.critical("Avahi Error", exc_info=error)

2847

3694

cleanup()

2848

3695

sys.exit(1)

2849

3696

except KeyboardInterrupt:

2850

3697

if debug:

2851

3698

print("", file=sys.stderr)

2852

logger.debug("Server received KeyboardInterrupt")

2853

logger.debug("Server exiting")

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

2854

3701

# Must run before the D-Bus bus name gets deregistered

2855

3702

cleanup()

2856

3703

2857

if __name__ == '__main__':

2858

main()

3704

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3707

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3710

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3713

sys.argv[1:] = unknown_args

3714

return args

3715

3716

# Add all tests from doctest strings

3717

def load_tests(loader, tests, none):

3718

import doctest

3719

tests.addTests(doctest.DocTestSuite())

3720

return tests

3721

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3724

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3737

else:

3738

main()

3739

finally:

3740

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End: