/mandos/trunk : revision 237.4.55

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

import unittest

81

import random

82

72

83

73

import dbus

84

74

import dbus.service

85

import gi

86

from gi.repository import GLib

75

import gobject

76

import avahi

87

77

from dbus.mainloop.glib import DBusGMainLoop

88

78

import ctypes

89

79

import ctypes.util

90

80

import xml.dom.minidom

91

81

import inspect

92

82

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

97

# Show warnings by default

98

if not sys.warnoptions:

99

import warnings

100

warnings.simplefilter("default")

101

102

# Try to find the value of SO_BINDTODEVICE:

103

83

try:

104

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

105

# newer, and it is also the most natural place for it:

106

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

107

85

except AttributeError:

108

86

try:

109

# This is where SO_BINDTODEVICE was up to and including Python

110

# 2.6, and also 3.2:

111

87

from IN import SO_BINDTODEVICE

112

88

except ImportError:

113

# In Python 2.7 it seems to have been removed entirely.

114

# Try running the C preprocessor:

115

try:

116

cc = subprocess.Popen(["cc", "--language=c", "-E",

117

"/dev/stdin"],

118

stdin=subprocess.PIPE,

119

stdout=subprocess.PIPE)

120

stdout = cc.communicate(

121

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

122

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

123

except (OSError, ValueError, IndexError):

124

# No value found

125

SO_BINDTODEVICE = None

126

127

if sys.version_info < (3, 2):

128

configparser.Configparser = configparser.SafeConfigParser

129

130

version = "1.8.9"

89

SO_BINDTODEVICE = None

90

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

131

95

stored_state_file = "clients.pickle"

132

96

133

97

logger = logging.getLogger()

134

logging.captureWarnings(True) # Show warnings via the logging system

135

98

syslogger = None

136

99

137

100

try:

138

if_nametoindex = ctypes.cdll.LoadLibrary(

139

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

140

104

except (OSError, AttributeError):

141

142

105

def if_nametoindex(interface):

143

106

"Get an interface index the hard way, i.e. using fcntl()"

144

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

149

112

return interface_index

150

113

151

114

152

def copy_function(func):

153

"""Make a copy of a function"""

154

if sys.version_info.major == 2:

155

return types.FunctionType(func.func_code,

156

func.func_globals,

157

func.func_name,

158

func.func_defaults,

159

func.func_closure)

160

else:

161

return types.FunctionType(func.__code__,

162

func.__globals__,

163

func.__name__,

164

func.__defaults__,

165

func.__closure__)

166

167

168

115

def initlogger(debug, level=logging.WARNING):

169

116

"""init logger and add loglevel"""

170

117

171

118

global syslogger

172

syslogger = (logging.handlers.SysLogHandler(

173

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

174

address="/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

175

123

syslogger.setFormatter(logging.Formatter

176

124

('Mandos [%(process)d]: %(levelname)s:'

177

125

' %(message)s'))

178

126

logger.addHandler(syslogger)

179

127

180

128

if debug:

181

129

console = logging.StreamHandler()

182

130

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

192

140

pass

193

141

194

142

195

class PGPEngine:

143

class PGPEngine(object):

196

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

197

198

145

def __init__(self):

199

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

200

self.gpg = "gpg"

201

try:

202

output = subprocess.check_output(["gpgconf"])

203

for line in output.splitlines():

204

name, text, path = line.split(b":")

205

if name == b"gpg":

206

self.gpg = path

207

break

208

except OSError as e:

209

if e.errno != errno.ENOENT:

210

raise

211

147

self.gnupgargs = ['--batch',

212

'--homedir', self.tempdir,

148

'--home', self.tempdir,

213

149

'--force-mdc',

214

'--quiet']

215

# Only GPG version 1 has the --no-use-agent option.

216

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

217

self.gnupgargs.append("--no-use-agent")

218

150

'--quiet',

151

'--no-use-agent']

152

219

153

def __enter__(self):

220

154

return self

221

155

222

156

def __exit__(self, exc_type, exc_value, traceback):

223

157

self._cleanup()

224

158

return False

225

159

226

160

def __del__(self):

227

161

self._cleanup()

228

162

229

163

def _cleanup(self):

230

164

if self.tempdir is not None:

231

165

# Delete contents of tempdir

232

166

for root, dirs, files in os.walk(self.tempdir,

233

topdown=False):

167

topdown = False):

234

168

for filename in files:

235

169

os.remove(os.path.join(root, filename))

236

170

for dirname in dirs:

238

172

# Remove tempdir

239

173

os.rmdir(self.tempdir)

240

174

self.tempdir = None

241

175

242

176

def password_encode(self, password):

243

177

# Passphrase can not be empty and can not contain newlines or

244

178

# NUL bytes. So we prefix it and hex encode it.

249

183

.replace(b"\n", b"\\n")

250

184

.replace(b"\0", b"\\x00"))

251

185

return encoded

252

186

253

187

def encrypt(self, data, password):

254

188

passphrase = self.password_encode(password)

255

with tempfile.NamedTemporaryFile(

256

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

257

191

passfile.write(passphrase)

258

192

passfile.flush()

259

proc = subprocess.Popen([self.gpg, '--symmetric',

193

proc = subprocess.Popen(['gpg', '--symmetric',

260

194

'--passphrase-file',

261

195

passfile.name]

262

196

+ self.gnupgargs,

263

stdin=subprocess.PIPE,

264

stdout=subprocess.PIPE,

265

stderr=subprocess.PIPE)

266

ciphertext, err = proc.communicate(input=data)

197

stdin = subprocess.PIPE,

198

stdout = subprocess.PIPE,

199

stderr = subprocess.PIPE)

200

ciphertext, err = proc.communicate(input = data)

267

201

if proc.returncode != 0:

268

202

raise PGPError(err)

269

203

return ciphertext

270

204

271

205

def decrypt(self, data, password):

272

206

passphrase = self.password_encode(password)

273

with tempfile.NamedTemporaryFile(

274

dir=self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

275

209

passfile.write(passphrase)

276

210

passfile.flush()

277

proc = subprocess.Popen([self.gpg, '--decrypt',

211

proc = subprocess.Popen(['gpg', '--decrypt',

278

212

'--passphrase-file',

279

213

passfile.name]

280

214

+ self.gnupgargs,

281

stdin=subprocess.PIPE,

282

stdout=subprocess.PIPE,

283

stderr=subprocess.PIPE)

284

decrypted_plaintext, err = proc.communicate(input=data)

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

285

220

if proc.returncode != 0:

286

221

raise PGPError(err)

287

222

return decrypted_plaintext

288

223

289

224

290

# Pretend that we have an Avahi module

291

class avahi:

292

"""This isn't so much a class as it is a module-like namespace."""

293

IF_UNSPEC = -1 # avahi-common/address.h

294

PROTO_UNSPEC = -1 # avahi-common/address.h

295

PROTO_INET = 0 # avahi-common/address.h

296

PROTO_INET6 = 1 # avahi-common/address.h

297

DBUS_NAME = "org.freedesktop.Avahi"

298

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

299

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

300

DBUS_PATH_SERVER = "/"

301

302

@staticmethod

303

def string_array_to_txt_array(t):

304

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

305

for s in t), signature="ay")

306

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

307

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

308

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

309

SERVER_INVALID = 0 # avahi-common/defs.h

310

SERVER_REGISTERING = 1 # avahi-common/defs.h

311

SERVER_RUNNING = 2 # avahi-common/defs.h

312

SERVER_COLLISION = 3 # avahi-common/defs.h

313

SERVER_FAILURE = 4 # avahi-common/defs.h

314

315

316

225

class AvahiError(Exception):

317

226

def __init__(self, value, *args, **kwargs):

318

227

self.value = value

319

228

return super(AvahiError, self).__init__(value, *args,

320

229

**kwargs)

321

230

322

323

231

class AvahiServiceError(AvahiError):

324

232

pass

325

233

326

327

234

class AvahiGroupError(AvahiError):

328

235

pass

329

236

330

237

331

class AvahiService:

238

class AvahiService(object):

332

239

"""An Avahi (Zeroconf) service.

333

240

334

241

Attributes:

335

242

interface: integer; avahi.IF_UNSPEC or an interface index.

336

243

Used to optionally bind to the specified interface.

348

255

server: D-Bus Server

349

256

bus: dbus.SystemBus()

350

257

"""

351

352

def __init__(self,

353

interface=avahi.IF_UNSPEC,

354

name=None,

355

servicetype=None,

356

port=None,

357

TXT=None,

358

domain="",

359

host="",

360

max_renames=32768,

361

protocol=avahi.PROTO_UNSPEC,

362

bus=None):

258

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

363

263

self.interface = interface

364

264

self.name = name

365

265

self.type = servicetype

374

274

self.server = None

375

275

self.bus = bus

376

276

self.entry_group_state_changed_match = None

377

378

def rename(self, remove=True):

277

278

def rename(self):

379

279

"""Derived from the Avahi example code"""

380

280

if self.rename_count >= self.max_renames:

381

281

logger.critical("No suitable Zeroconf service name found"

382

282

" after %i retries, exiting.",

383

283

self.rename_count)

384

284

raise AvahiServiceError("Too many renames")

385

self.name = str(

386

self.server.GetAlternativeServiceName(self.name))

387

self.rename_count += 1

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

388

287

logger.info("Changing Zeroconf service name to %r ...",

389

288

self.name)

390

if remove:

391

self.remove()

289

self.remove()

392

290

try:

393

291

self.add()

394

292

except dbus.exceptions.DBusException as error:

395

if (error.get_dbus_name()

396

== "org.freedesktop.Avahi.CollisionError"):

397

logger.info("Local Zeroconf service name collision.")

398

return self.rename(remove=False)

399

else:

400

logger.critical("D-Bus Exception", exc_info=error)

401

self.cleanup()

402

os._exit(1)

403

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

297

404

298

def remove(self):

405

299

"""Derived from the Avahi example code"""

406

300

if self.entry_group_state_changed_match is not None:

408

302

self.entry_group_state_changed_match = None

409

303

if self.group is not None:

410

304

self.group.Reset()

411

305

412

306

def add(self):

413

307

"""Derived from the Avahi example code"""

414

308

self.remove()

431

325

dbus.UInt16(self.port),

432

326

avahi.string_array_to_txt_array(self.TXT))

433

327

self.group.Commit()

434

328

435

329

def entry_group_state_changed(self, state, error):

436

330

"""Derived from the Avahi example code"""

437

331

logger.debug("Avahi entry group state change: %i", state)

438

332

439

333

if state == avahi.ENTRY_GROUP_ESTABLISHED:

440

334

logger.debug("Zeroconf service established.")

441

335

elif state == avahi.ENTRY_GROUP_COLLISION:

444

338

elif state == avahi.ENTRY_GROUP_FAILURE:

445

339

logger.critical("Avahi: Error in group state changed %s",

446

340

str(error))

447

raise AvahiGroupError("State changed: {!s}".format(error))

448

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

343

449

344

def cleanup(self):

450

345

"""Derived from the Avahi example code"""

451

346

if self.group is not None:

456

351

pass

457

352

self.group = None

458

353

self.remove()

459

354

460

355

def server_state_changed(self, state, error=None):

461

356

"""Derived from the Avahi example code"""

462

357

logger.debug("Avahi server state change: %i", state)

463

bad_states = {

464

avahi.SERVER_INVALID: "Zeroconf server invalid",

465

avahi.SERVER_REGISTERING: None,

466

avahi.SERVER_COLLISION: "Zeroconf server name collision",

467

avahi.SERVER_FAILURE: "Zeroconf server failure",

468

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

469

365

if state in bad_states:

470

366

if bad_states[state] is not None:

471

367

if error is None:

474

370

logger.error(bad_states[state] + ": %r", error)

475

371

self.cleanup()

476

372

elif state == avahi.SERVER_RUNNING:

477

try:

478

self.add()

479

except dbus.exceptions.DBusException as error:

480

if (error.get_dbus_name()

481

== "org.freedesktop.Avahi.CollisionError"):

482

logger.info("Local Zeroconf service name"

483

" collision.")

484

return self.rename(remove=False)

485

else:

486

logger.critical("D-Bus Exception", exc_info=error)

487

self.cleanup()

488

os._exit(1)

373

self.add()

489

374

else:

490

375

if error is None:

491

376

logger.debug("Unknown state: %r", state)

492

377

else:

493

378

logger.debug("Unknown state: %r: %r", state, error)

494

379

495

380

def activate(self):

496

381

"""Derived from the Avahi example code"""

497

382

if self.server is None:

501

386

follow_name_owner_changes=True),

502

387

avahi.DBUS_INTERFACE_SERVER)

503

388

self.server.connect_to_signal("StateChanged",

504

self.server_state_changed)

389

self.server_state_changed)

505

390

self.server_state_changed(self.server.GetState())

506

391

507

392

508

393

class AvahiServiceToSyslog(AvahiService):

509

def rename(self, *args, **kwargs):

394

def rename(self):

510

395

"""Add the new name to the syslog messages"""

511

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

512

syslogger.setFormatter(logging.Formatter(

513

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

514

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

515

401

return ret

516

402

517

403

518

# Pretend that we have a GnuTLS module

519

class gnutls:

520

"""This isn't so much a class as it is a module-like namespace."""

521

522

library = ctypes.util.find_library("gnutls")

523

if library is None:

524

library = ctypes.util.find_library("gnutls-deb0")

525

_library = ctypes.cdll.LoadLibrary(library)

526

del library

527

528

# Unless otherwise indicated, the constants and types below are

529

# all from the gnutls/gnutls.h C header file.

530

531

# Constants

532

E_SUCCESS = 0

533

E_INTERRUPTED = -52

534

E_AGAIN = -28

535

CRT_OPENPGP = 2

536

CRT_RAWPK = 3

537

CLIENT = 2

538

SHUT_RDWR = 0

539

CRD_CERTIFICATE = 1

540

E_NO_CERTIFICATE_FOUND = -49

541

X509_FMT_DER = 0

542

NO_TICKETS = 1<<10

543

ENABLE_RAWPK = 1<<18

544

CTYPE_PEERS = 3

545

KEYID_USE_SHA256 = 1 # gnutls/x509.h

546

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

547

548

# Types

549

class session_int(ctypes.Structure):

550

_fields_ = []

551

session_t = ctypes.POINTER(session_int)

552

553

class certificate_credentials_st(ctypes.Structure):

554

_fields_ = []

555

certificate_credentials_t = ctypes.POINTER(

556

certificate_credentials_st)

557

certificate_type_t = ctypes.c_int

558

559

class datum_t(ctypes.Structure):

560

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

561

('size', ctypes.c_uint)]

562

563

class openpgp_crt_int(ctypes.Structure):

564

_fields_ = []

565

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

566

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

567

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

568

credentials_type_t = ctypes.c_int

569

transport_ptr_t = ctypes.c_void_p

570

close_request_t = ctypes.c_int

571

572

# Exceptions

573

class Error(Exception):

574

def __init__(self, message=None, code=None, args=()):

575

# Default usage is by a message string, but if a return

576

# code is passed, convert it to a string with

577

# gnutls.strerror()

578

self.code = code

579

if message is None and code is not None:

580

message = gnutls.strerror(code)

581

return super(gnutls.Error, self).__init__(

582

message, *args)

583

584

class CertificateSecurityError(Error):

585

pass

586

587

# Classes

588

class Credentials:

589

def __init__(self):

590

self._c_object = gnutls.certificate_credentials_t()

591

gnutls.certificate_allocate_credentials(

592

ctypes.byref(self._c_object))

593

self.type = gnutls.CRD_CERTIFICATE

594

595

def __del__(self):

596

gnutls.certificate_free_credentials(self._c_object)

597

598

class ClientSession:

599

def __init__(self, socket, credentials=None):

600

self._c_object = gnutls.session_t()

601

gnutls_flags = gnutls.CLIENT

602

if gnutls.check_version(b"3.5.6"):

603

gnutls_flags |= gnutls.NO_TICKETS

604

if gnutls.has_rawpk:

605

gnutls_flags |= gnutls.ENABLE_RAWPK

606

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

607

del gnutls_flags

608

gnutls.set_default_priority(self._c_object)

609

gnutls.transport_set_ptr(self._c_object, socket.fileno())

610

gnutls.handshake_set_private_extensions(self._c_object,

611

True)

612

self.socket = socket

613

if credentials is None:

614

credentials = gnutls.Credentials()

615

gnutls.credentials_set(self._c_object, credentials.type,

616

ctypes.cast(credentials._c_object,

617

ctypes.c_void_p))

618

self.credentials = credentials

619

620

def __del__(self):

621

gnutls.deinit(self._c_object)

622

623

def handshake(self):

624

return gnutls.handshake(self._c_object)

625

626

def send(self, data):

627

data = bytes(data)

628

data_len = len(data)

629

while data_len > 0:

630

data_len -= gnutls.record_send(self._c_object,

631

data[-data_len:],

632

data_len)

633

634

def bye(self):

635

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

636

637

# Error handling functions

638

def _error_code(result):

639

"""A function to raise exceptions on errors, suitable

640

for the 'restype' attribute on ctypes functions"""

641

if result >= 0:

642

return result

643

if result == gnutls.E_NO_CERTIFICATE_FOUND:

644

raise gnutls.CertificateSecurityError(code=result)

645

raise gnutls.Error(code=result)

646

647

def _retry_on_error(result, func, arguments):

648

"""A function to retry on some errors, suitable

649

for the 'errcheck' attribute on ctypes functions"""

650

while result < 0:

651

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

652

return _error_code(result)

653

result = func(*arguments)

654

return result

655

656

# Unless otherwise indicated, the function declarations below are

657

# all from the gnutls/gnutls.h C header file.

658

659

# Functions

660

priority_set_direct = _library.gnutls_priority_set_direct

661

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

662

ctypes.POINTER(ctypes.c_char_p)]

663

priority_set_direct.restype = _error_code

664

665

init = _library.gnutls_init

666

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

667

init.restype = _error_code

668

669

set_default_priority = _library.gnutls_set_default_priority

670

set_default_priority.argtypes = [session_t]

671

set_default_priority.restype = _error_code

672

673

record_send = _library.gnutls_record_send

674

record_send.argtypes = [session_t, ctypes.c_void_p,

675

ctypes.c_size_t]

676

record_send.restype = ctypes.c_ssize_t

677

record_send.errcheck = _retry_on_error

678

679

certificate_allocate_credentials = (

680

_library.gnutls_certificate_allocate_credentials)

681

certificate_allocate_credentials.argtypes = [

682

ctypes.POINTER(certificate_credentials_t)]

683

certificate_allocate_credentials.restype = _error_code

684

685

certificate_free_credentials = (

686

_library.gnutls_certificate_free_credentials)

687

certificate_free_credentials.argtypes = [

688

certificate_credentials_t]

689

certificate_free_credentials.restype = None

690

691

handshake_set_private_extensions = (

692

_library.gnutls_handshake_set_private_extensions)

693

handshake_set_private_extensions.argtypes = [session_t,

694

ctypes.c_int]

695

handshake_set_private_extensions.restype = None

696

697

credentials_set = _library.gnutls_credentials_set

698

credentials_set.argtypes = [session_t, credentials_type_t,

699

ctypes.c_void_p]

700

credentials_set.restype = _error_code

701

702

strerror = _library.gnutls_strerror

703

strerror.argtypes = [ctypes.c_int]

704

strerror.restype = ctypes.c_char_p

705

706

certificate_type_get = _library.gnutls_certificate_type_get

707

certificate_type_get.argtypes = [session_t]

708

certificate_type_get.restype = _error_code

709

710

certificate_get_peers = _library.gnutls_certificate_get_peers

711

certificate_get_peers.argtypes = [session_t,

712

ctypes.POINTER(ctypes.c_uint)]

713

certificate_get_peers.restype = ctypes.POINTER(datum_t)

714

715

global_set_log_level = _library.gnutls_global_set_log_level

716

global_set_log_level.argtypes = [ctypes.c_int]

717

global_set_log_level.restype = None

718

719

global_set_log_function = _library.gnutls_global_set_log_function

720

global_set_log_function.argtypes = [log_func]

721

global_set_log_function.restype = None

722

723

deinit = _library.gnutls_deinit

724

deinit.argtypes = [session_t]

725

deinit.restype = None

726

727

handshake = _library.gnutls_handshake

728

handshake.argtypes = [session_t]

729

handshake.restype = _error_code

730

handshake.errcheck = _retry_on_error

731

732

transport_set_ptr = _library.gnutls_transport_set_ptr

733

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

734

transport_set_ptr.restype = None

735

736

bye = _library.gnutls_bye

737

bye.argtypes = [session_t, close_request_t]

738

bye.restype = _error_code

739

bye.errcheck = _retry_on_error

740

741

check_version = _library.gnutls_check_version

742

check_version.argtypes = [ctypes.c_char_p]

743

check_version.restype = ctypes.c_char_p

744

745

_need_version = b"3.3.0"

746

if check_version(_need_version) is None:

747

raise self.Error("Needs GnuTLS {} or later"

748

.format(_need_version))

749

750

_tls_rawpk_version = b"3.6.6"

751

has_rawpk = bool(check_version(_tls_rawpk_version))

752

753

if has_rawpk:

754

# Types

755

class pubkey_st(ctypes.Structure):

756

_fields = []

757

pubkey_t = ctypes.POINTER(pubkey_st)

758

759

x509_crt_fmt_t = ctypes.c_int

760

761

# All the function declarations below are from gnutls/abstract.h

762

pubkey_init = _library.gnutls_pubkey_init

763

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

764

pubkey_init.restype = _error_code

765

766

pubkey_import = _library.gnutls_pubkey_import

767

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

768

x509_crt_fmt_t]

769

pubkey_import.restype = _error_code

770

771

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

772

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

773

ctypes.POINTER(ctypes.c_ubyte),

774

ctypes.POINTER(ctypes.c_size_t)]

775

pubkey_get_key_id.restype = _error_code

776

777

pubkey_deinit = _library.gnutls_pubkey_deinit

778

pubkey_deinit.argtypes = [pubkey_t]

779

pubkey_deinit.restype = None

780

else:

781

# All the function declarations below are from gnutls/openpgp.h

782

783

openpgp_crt_init = _library.gnutls_openpgp_crt_init

784

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

785

openpgp_crt_init.restype = _error_code

786

787

openpgp_crt_import = _library.gnutls_openpgp_crt_import

788

openpgp_crt_import.argtypes = [openpgp_crt_t,

789

ctypes.POINTER(datum_t),

790

openpgp_crt_fmt_t]

791

openpgp_crt_import.restype = _error_code

792

793

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

794

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

795

ctypes.POINTER(ctypes.c_uint)]

796

openpgp_crt_verify_self.restype = _error_code

797

798

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

799

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

800

openpgp_crt_deinit.restype = None

801

802

openpgp_crt_get_fingerprint = (

803

_library.gnutls_openpgp_crt_get_fingerprint)

804

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

805

ctypes.c_void_p,

806

ctypes.POINTER(

807

ctypes.c_size_t)]

808

openpgp_crt_get_fingerprint.restype = _error_code

809

810

if check_version(b"3.6.4"):

811

certificate_type_get2 = _library.gnutls_certificate_type_get2

812

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

813

certificate_type_get2.restype = _error_code

814

815

# Remove non-public functions

816

del _error_code, _retry_on_error

817

818

819

def call_pipe(connection, # : multiprocessing.Connection

820

func, *args, **kwargs):

821

"""This function is meant to be called by multiprocessing.Process

822

823

This function runs func(*args, **kwargs), and writes the resulting

824

return value on the provided multiprocessing.Connection.

825

"""

826

connection.send(func(*args, **kwargs))

827

connection.close()

828

829

830

class Client:

404

class Client(object):

831

405

"""A representation of a client host served by this server.

832

406

833

407

Attributes:

834

408

approved: bool(); 'None' if not yet approved/disapproved

835

409

approval_delay: datetime.timedelta(); Time to wait for approval

836

410

approval_duration: datetime.timedelta(); Duration of one approval

837

checker: multiprocessing.Process(); a running checker process used

838

to see if the client lives. 'None' if no process is

839

running.

840

checker_callback_tag: a GLib event source tag, or None

411

checker: subprocess.Popen(); a running checker process used

412

to see if the client lives.

413

'None' if no process is running.

414

checker_callback_tag: a gobject event source tag, or None

841

415

checker_command: string; External command which is run to check

842

416

if client lives. %() expansions are done at

843

417

runtime with vars(self) as dict, so that for

844

418

instance %(name)s can be used in the command.

845

checker_initiator_tag: a GLib event source tag, or None

419

checker_initiator_tag: a gobject event source tag, or None

846

420

created: datetime.datetime(); (UTC) object creation

847

421

client_structure: Object describing what attributes a client has

848

422

and is used for storing the client at exit

849

423

current_checker_command: string; current running checker_command

850

disable_initiator_tag: a GLib event source tag, or None

424

disable_initiator_tag: a gobject event source tag, or None

851

425

enabled: bool()

852

426

fingerprint: string (40 or 32 hexadecimal digits); used to

853

uniquely identify an OpenPGP client

854

key_id: string (64 hexadecimal digits); used to uniquely identify

855

a client using raw public keys

427

uniquely identify the client

856

428

host: string; available for use by the checker command

857

429

interval: datetime.timedelta(); How often to start a new checker

858

430

last_approval_request: datetime.datetime(); (UTC) or None

860

432

last_checker_status: integer between 0 and 255 reflecting exit

861

433

status of last checker. -1 reflects crashed

862

434

checker, -2 means no checker completed yet.

863

last_checker_signal: The signal which killed the last checker, if

864

last_checker_status is -1

865

435

last_enabled: datetime.datetime(); (UTC) or None

866

436

name: string; from the config file, used in log messages and

867

437

D-Bus identifiers

874

444

disabled, or None

875

445

server_settings: The server_settings dict from main()

876

446

"""

877

447

878

448

runtime_expansions = ("approval_delay", "approval_duration",

879

"created", "enabled", "expires", "key_id",

449

"created", "enabled", "expires",

880

450

"fingerprint", "host", "interval",

881

451

"last_approval_request", "last_checked_ok",

882

452

"last_enabled", "name", "timeout")

883

client_defaults = {

884

"timeout": "PT5M",

885

"extended_timeout": "PT15M",

886

"interval": "PT2M",

887

"checker": "fping -q -- %%(host)s",

888

"host": "",

889

"approval_delay": "PT0S",

890

"approval_duration": "PT1S",

891

"approved_by_default": "True",

892

"enabled": "True",

893

}

894

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

463

895

464

@staticmethod

896

465

def config_parser(config):

897

466

"""Construct a new dict of client settings of this form:

904

473

for client_name in config.sections():

905

474

section = dict(config.items(client_name))

906

475

client = settings[client_name] = {}

907

476

908

477

client["host"] = section["host"]

909

478

# Reformat values from string types to Python types

910

479

client["approved_by_default"] = config.getboolean(

911

480

client_name, "approved_by_default")

912

481

client["enabled"] = config.getboolean(client_name,

913

482

"enabled")

914

915

# Uppercase and remove spaces from key_id and fingerprint

916

# for later comparison purposes with return value from the

917

# key_id() and fingerprint() functions

918

client["key_id"] = (section.get("key_id", "").upper()

919

.replace(" ", ""))

483

920

484

client["fingerprint"] = (section["fingerprint"].upper()

921

485

.replace(" ", ""))

922

486

if "secret" in section:

923

client["secret"] = codecs.decode(section["secret"]

924

.encode("utf-8"),

925

"base64")

487

client["secret"] = section["secret"].decode("base64")

926

488

elif "secfile" in section:

927

489

with open(os.path.expanduser(os.path.expandvars

928

490

(section["secfile"])),

943

505

client["last_approval_request"] = None

944

506

client["last_checked_ok"] = None

945

507

client["last_checker_status"] = -2

946

508

947

509

return settings

948

949

def __init__(self, settings, name=None, server_settings=None):

510

511

def __init__(self, settings, name = None, server_settings=None):

950

512

self.name = name

951

513

if server_settings is None:

952

514

server_settings = {}

954

516

# adding all client settings

955

517

for setting, value in settings.items():

956

518

setattr(self, setting, value)

957

519

958

520

if self.enabled:

959

521

if not hasattr(self, "last_enabled"):

960

522

self.last_enabled = datetime.datetime.utcnow()

964

526

else:

965

527

self.last_enabled = None

966

528

self.expires = None

967

529

968

530

logger.debug("Creating client %r", self.name)

969

logger.debug(" Key ID: %s", self.key_id)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

970

534

logger.debug(" Fingerprint: %s", self.fingerprint)

971

535

self.created = settings.get("created",

972

536

datetime.datetime.utcnow())

973

537

974

538

# attributes specific for this server instance

975

539

self.checker = None

976

540

self.checker_initiator_tag = None

979

543

self.current_checker_command = None

980

544

self.approved = None

981

545

self.approvals_pending = 0

982

self.changedstate = multiprocessing_manager.Condition(

983

multiprocessing_manager.Lock())

984

self.client_structure = [attr

985

for attr in self.__dict__.keys()

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

986

551

if not attr.startswith("_")]

987

552

self.client_structure.append("client_structure")

988

989

for name, t in inspect.getmembers(

990

type(self), lambda obj: isinstance(obj, property)):

553

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

991

558

if not name.startswith("_"):

992

559

self.client_structure.append(name)

993

560

994

561

# Send notice to process children that client state has changed

995

562

def send_changedstate(self):

996

563

with self.changedstate:

997

564

self.changedstate.notify_all()

998

565

999

566

def enable(self):

1000

567

"""Start this client's checker and timeout hooks"""

1001

568

if getattr(self, "enabled", False):

1006

573

self.last_enabled = datetime.datetime.utcnow()

1007

574

self.init_checker()

1008

575

self.send_changedstate()

1009

576

1010

577

def disable(self, quiet=True):

1011

578

"""Disable this client."""

1012

579

if not getattr(self, "enabled", False):

1014

581

if not quiet:

1015

582

logger.info("Disabling client %s", self.name)

1016

583

if getattr(self, "disable_initiator_tag", None) is not None:

1017

GLib.source_remove(self.disable_initiator_tag)

584

gobject.source_remove(self.disable_initiator_tag)

1018

585

self.disable_initiator_tag = None

1019

586

self.expires = None

1020

587

if getattr(self, "checker_initiator_tag", None) is not None:

1021

GLib.source_remove(self.checker_initiator_tag)

588

gobject.source_remove(self.checker_initiator_tag)

1022

589

self.checker_initiator_tag = None

1023

590

self.stop_checker()

1024

591

self.enabled = False

1025

592

if not quiet:

1026

593

self.send_changedstate()

1027

# Do not run this again if called by a GLib.timeout_add

594

# Do not run this again if called by a gobject.timeout_add

1028

595

return False

1029

596

1030

597

def __del__(self):

1031

598

self.disable()

1032

599

1033

600

def init_checker(self):

1034

601

# Schedule a new checker to be started an 'interval' from now,

1035

602

# and every interval from then on.

1036

603

if self.checker_initiator_tag is not None:

1037

GLib.source_remove(self.checker_initiator_tag)

1038

self.checker_initiator_tag = GLib.timeout_add(

1039

random.randrange(int(self.interval.total_seconds() * 1000

1040

+ 1)),

1041

self.start_checker)

604

gobject.source_remove(self.checker_initiator_tag)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

1042

609

# Schedule a disable() when 'timeout' has passed

1043

610

if self.disable_initiator_tag is not None:

1044

GLib.source_remove(self.disable_initiator_tag)

1045

self.disable_initiator_tag = GLib.timeout_add(

1046

int(self.timeout.total_seconds() * 1000), self.disable)

611

gobject.source_remove(self.disable_initiator_tag)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

1047

616

# Also start a new checker *right now*.

1048

617

self.start_checker()

1049

1050

def checker_callback(self, source, condition, connection,

1051

command):

618

619

def checker_callback(self, pid, condition, command):

1052

620

"""The checker has completed, so take appropriate actions."""

1053

# Read return code from connection (see call_pipe)

1054

returncode = connection.recv()

1055

connection.close()

1056

if self.checker is not None:

1057

self.checker.join()

1058

621

self.checker_callback_tag = None

1059

622

self.checker = None

1060

1061

if returncode >= 0:

1062

self.last_checker_status = returncode

1063

self.last_checker_signal = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

1064

625

if self.last_checker_status == 0:

1065

626

logger.info("Checker for %(name)s succeeded",

1066

627

vars(self))

1067

628

self.checked_ok()

1068

629

else:

1069

logger.info("Checker for %(name)s failed", vars(self))

630

logger.info("Checker for %(name)s failed",

631

vars(self))

1070

632

else:

1071

633

self.last_checker_status = -1

1072

self.last_checker_signal = -returncode

1073

634

logger.warning("Checker for %(name)s crashed?",

1074

635

vars(self))

1075

return False

1076

636

1077

637

def checked_ok(self):

1078

638

"""Assert that the client has been seen, alive and well."""

1079

639

self.last_checked_ok = datetime.datetime.utcnow()

1080

640

self.last_checker_status = 0

1081

self.last_checker_signal = None

1082

641

self.bump_timeout()

1083

642

1084

643

def bump_timeout(self, timeout=None):

1085

644

"""Bump up the timeout for this client."""

1086

645

if timeout is None:

1087

646

timeout = self.timeout

1088

647

if self.disable_initiator_tag is not None:

1089

GLib.source_remove(self.disable_initiator_tag)

648

gobject.source_remove(self.disable_initiator_tag)

1090

649

self.disable_initiator_tag = None

1091

650

if getattr(self, "enabled", False):

1092

self.disable_initiator_tag = GLib.timeout_add(

1093

int(timeout.total_seconds() * 1000), self.disable)

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

1094

654

self.expires = datetime.datetime.utcnow() + timeout

1095

655

1096

656

def need_approval(self):

1097

657

self.last_approval_request = datetime.datetime.utcnow()

1098

658

1099

659

def start_checker(self):

1100

660

"""Start a new checker subprocess if one is not running.

1101

661

1102

662

If a checker already exists, leave it running and do

1103

663

nothing."""

1104

664

# The reason for not killing a running checker is that if we

1109

669

# checkers alone, the checker would have to take more time

1110

670

# than 'timeout' for the client to be disabled, which is as it

1111

671

# should be.

1112

1113

if self.checker is not None and not self.checker.is_alive():

1114

logger.warning("Checker was not alive; joining")

1115

self.checker.join()

1116

self.checker = None

672

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

1117

687

# Start a new checker if needed

1118

688

if self.checker is None:

1119

689

# Escape attributes for the shell

1120

escaped_attrs = {

1121

attr: re.escape(str(getattr(self, attr)))

1122

for attr in self.runtime_expansions}

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

1123

693

try:

1124

694

command = self.checker_command % escaped_attrs

1125

695

except TypeError as error:

1126

696

logger.error('Could not format string "%s"',

1127

self.checker_command,

697

self.checker_command, exc_info=error)

698

return True # Try again later

699

self.current_checker_command = command

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

# The exception is when not debugging but nevertheless

708

# running in the foreground; use the previously

709

# created wnull.

710

popen_args = {}

711

if (not self.server_settings["debug"]

712

and self.server_settings["foreground"]):

713

popen_args.update({"stdout": wnull,

714

"stderr": wnull })

715

self.checker = subprocess.Popen(command,

716

close_fds=True,

717

shell=True, cwd="/",

718

**popen_args)

719

except OSError as error:

720

logger.error("Failed to start subprocess",

1128

721

exc_info=error)

1129

return True # Try again later

1130

self.current_checker_command = command

1131

logger.info("Starting checker %r for %s", command,

1132

self.name)

1133

# We don't need to redirect stdout and stderr, since

1134

# in normal mode, that is already done by daemon(),

1135

# and in debug mode we don't want to. (Stdin is

1136

# always replaced by /dev/null.)

1137

# The exception is when not debugging but nevertheless

1138

# running in the foreground; use the previously

1139

# created wnull.

1140

popen_args = {"close_fds": True,

1141

"shell": True,

1142

"cwd": "/"}

1143

if (not self.server_settings["debug"]

1144

and self.server_settings["foreground"]):

1145

popen_args.update({"stdout": wnull,

1146

"stderr": wnull})

1147

pipe = multiprocessing.Pipe(duplex=False)

1148

self.checker = multiprocessing.Process(

1149

target=call_pipe,

1150

args=(pipe[1], subprocess.call, command),

1151

kwargs=popen_args)

1152

self.checker.start()

1153

self.checker_callback_tag = GLib.io_add_watch(

1154

GLib.IOChannel.unix_new(pipe[0].fileno()),

1155

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1156

self.checker_callback, pipe[0], command)

1157

# Re-run this periodically if run by GLib.timeout_add

722

return True

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

727

# The checker may have completed before the gobject

728

# watch was added. Check for this.

729

try:

730

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

731

except OSError as error:

732

if error.errno == errno.ECHILD:

733

# This should never happen

734

logger.error("Child process vanished",

735

exc_info=error)

736

return True

737

raise

738

if pid:

739

gobject.source_remove(self.checker_callback_tag)

740

self.checker_callback(pid, status, command)

741

# Re-run this periodically if run by gobject.timeout_add

1158

742

return True

1159

743

1160

744

def stop_checker(self):

1161

745

"""Force the checker process, if any, to stop."""

1162

746

if self.checker_callback_tag:

1163

GLib.source_remove(self.checker_callback_tag)

747

gobject.source_remove(self.checker_callback_tag)

1164

748

self.checker_callback_tag = None

1165

749

if getattr(self, "checker", None) is None:

1166

750

return

1167

751

logger.debug("Stopping checker for %(name)s", vars(self))

1168

self.checker.terminate()

752

try:

753

self.checker.terminate()

754

#time.sleep(0.5)

755

#if self.checker.poll() is None:

756

# self.checker.kill()

757

except OSError as error:

758

if error.errno != errno.ESRCH: # No such process

759

raise

1169

760

self.checker = None

1170

761

1171

762

1172

def dbus_service_property(dbus_interface,

1173

signature="v",

1174

access="readwrite",

1175

byte_arrays=False):

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

1176

765

"""Decorators for marking methods of a DBusObjectWithProperties to

1177

766

become properties on the D-Bus.

1178

767

1179

768

The decorated method will be called with no arguments by "Get"

1180

769

and with one argument by "Set".

1181

770

1182

771

The parameters, where they are supported, are the same as

1183

772

dbus.service.method, except there is only "signature", since the

1184

773

type from Get() and the type sent to Set() is the same.

1188

777

if byte_arrays and signature != "ay":

1189

778

raise ValueError("Byte arrays not supported for non-'ay'"

1190

779

" signature {!r}".format(signature))

1191

1192

780

def decorator(func):

1193

781

func._dbus_is_property = True

1194

782

func._dbus_interface = dbus_interface

1197

785

func._dbus_name = func.__name__

1198

786

if func._dbus_name.endswith("_dbus_property"):

1199

787

func._dbus_name = func._dbus_name[:-14]

1200

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

788

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1201

789

return func

1202

1203

790

return decorator

1204

791

1205

792

1206

793

def dbus_interface_annotations(dbus_interface):

1207

794

"""Decorator for marking functions returning interface annotations

1208

795

1209

796

Usage:

1210

797

1211

798

@dbus_interface_annotations("org.example.Interface")

1212

799

def _foo(self): # Function name does not matter

1213

800

return {"org.freedesktop.DBus.Deprecated": "true",

1214

801

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1215

802

"false"}

1216

803

"""

1217

1218

804

def decorator(func):

1219

805

func._dbus_is_interface = True

1220

806

func._dbus_interface = dbus_interface

1221

807

func._dbus_name = dbus_interface

1222

808

return func

1223

1224

809

return decorator

1225

810

1226

811

1227

812

def dbus_annotations(annotations):

1228

813

"""Decorator to annotate D-Bus methods, signals or properties

1229

814

Usage:

1230

815

1231

816

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1232

817

"org.freedesktop.DBus.Property."

1233

818

"EmitsChangedSignal": "false"})

1235

820

access="r")

1236

821

def Property_dbus_property(self):

1237

822

return dbus.Boolean(False)

1238

1239

See also the DBusObjectWithAnnotations class.

1240

823

"""

1241

1242

824

def decorator(func):

1243

825

func._dbus_annotations = annotations

1244

826

return func

1245

1246

827

return decorator

1247

828

1248

829

1251

832

"""

1252

833

pass

1253

834

1254

1255

835

class DBusPropertyAccessException(DBusPropertyException):

1256

836

"""A property's access permissions disallows an operation.

1257

837

"""

1264

844

pass

1265

845

1266

846

1267

class DBusObjectWithAnnotations(dbus.service.Object):

1268

"""A D-Bus object with annotations.

1269

1270

Classes inheriting from this can use the dbus_annotations

1271

decorator to add annotations to methods or signals.

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

849

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

1272

853

"""

1273

854

1274

855

@staticmethod

1275

856

def _is_dbus_thing(thing):

1276

857

"""Returns a function testing if an attribute is a D-Bus thing

1277

858

1278

859

If called like _is_dbus_thing("method") it returns a function

1279

860

suitable for use as predicate to inspect.getmembers().

1280

861

"""

1281

862

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1282

863

False)

1283

864

1284

865

def _get_all_dbus_things(self, thing):

1285

866

"""Returns a generator of (name, attribute) pairs

1286

867

"""

1287

return ((getattr(athing.__get__(self), "_dbus_name", name),

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

1288

870

athing.__get__(self))

1289

871

for cls in self.__class__.__mro__

1290

872

for name, athing in

1291

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1292

1293

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1294

out_signature="s",

1295

path_keyword='object_path',

1296

connection_keyword='connection')

1297

def Introspect(self, object_path, connection):

1298

"""Overloading of standard D-Bus method.

1299

1300

Inserts annotation tags on methods and signals.

1301

"""

1302

xmlstring = dbus.service.Object.Introspect(self, object_path,

1303

connection)

1304

try:

1305

document = xml.dom.minidom.parseString(xmlstring)

1306

1307

for if_tag in document.getElementsByTagName("interface"):

1308

# Add annotation tags

1309

for typ in ("method", "signal"):

1310

for tag in if_tag.getElementsByTagName(typ):

1311

annots = dict()

1312

for name, prop in (self.

1313

_get_all_dbus_things(typ)):

1314

if (name == tag.getAttribute("name")

1315

and prop._dbus_interface

1316

== if_tag.getAttribute("name")):

1317

annots.update(getattr(

1318

prop, "_dbus_annotations", {}))

1319

for name, value in annots.items():

1320

ann_tag = document.createElement(

1321

"annotation")

1322

ann_tag.setAttribute("name", name)

1323

ann_tag.setAttribute("value", value)

1324

tag.appendChild(ann_tag)

1325

# Add interface annotation tags

1326

for annotation, value in dict(

1327

itertools.chain.from_iterable(

1328

annotations().items()

1329

for name, annotations

1330

in self._get_all_dbus_things("interface")

1331

if name == if_tag.getAttribute("name")

1332

)).items():

1333

ann_tag = document.createElement("annotation")

1334

ann_tag.setAttribute("name", annotation)

1335

ann_tag.setAttribute("value", value)

1336

if_tag.appendChild(ann_tag)

1337

# Fix argument name for the Introspect method itself

1338

if (if_tag.getAttribute("name")

1339

== dbus.INTROSPECTABLE_IFACE):

1340

for cn in if_tag.getElementsByTagName("method"):

1341

if cn.getAttribute("name") == "Introspect":

1342

for arg in cn.getElementsByTagName("arg"):

1343

if (arg.getAttribute("direction")

1344

== "out"):

1345

arg.setAttribute("name",

1346

"xml_data")

1347

xmlstring = document.toxml("utf-8")

1348

document.unlink()

1349

except (AttributeError, xml.dom.DOMException,

1350

xml.parsers.expat.ExpatError) as error:

1351

logger.error("Failed to override Introspection method",

1352

exc_info=error)

1353

return xmlstring

1354

1355

1356

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1357

"""A D-Bus object with properties.

1358

1359

Classes inheriting from this can use the dbus_service_property

1360

decorator to expose methods as D-Bus properties. It exposes the

1361

standard Get(), Set(), and GetAll() methods on the D-Bus.

1362

"""

1363

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

875

1364

876

def _get_dbus_property(self, interface_name, property_name):

1365

877

"""Returns a bound method if one exists which is a D-Bus

1366

878

property with the specified name and interface.

1367

879

"""

1368

for cls in self.__class__.__mro__:

1369

for name, value in inspect.getmembers(

1370

cls, self._is_dbus_thing("property")):

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

1371

884

if (value._dbus_name == property_name

1372

885

and value._dbus_interface == interface_name):

1373

886

return value.__get__(self)

1374

887

1375

888

# No such property

1376

raise DBusPropertyNotFound("{}:{}.{}".format(

1377

self.dbus_object_path, interface_name, property_name))

1378

1379

@classmethod

1380

def _get_all_interface_names(cls):

1381

"""Get a sequence of all interfaces supported by an object"""

1382

return (name for name in set(getattr(getattr(x, attr),

1383

"_dbus_interface", None)

1384

for x in (inspect.getmro(cls))

1385

for attr in dir(x))

1386

if name is not None)

1387

1388

@dbus.service.method(dbus.PROPERTIES_IFACE,

1389

in_signature="ss",

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

892

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1390

894

out_signature="v")

1391

895

def Get(self, interface_name, property_name):

1392

896

"""Standard D-Bus property Get() method, see D-Bus standard.

1398

902

if not hasattr(value, "variant_level"):

1399

903

return value

1400

904

return type(value)(value, variant_level=value.variant_level+1)

1401

905

1402

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1403

907

def Set(self, interface_name, property_name, value):

1404

908

"""Standard D-Bus property Set() method, see D-Bus standard.

1413

917

raise ValueError("Byte arrays not supported for non-"

1414

918

"'ay' signature {!r}"

1415

919

.format(prop._dbus_signature))

1416

value = dbus.ByteArray(bytes(value))

920

value = dbus.ByteArray(b''.join(chr(byte)

921

for byte in value))

1417

922

prop(value)

1418

1419

@dbus.service.method(dbus.PROPERTIES_IFACE,

1420

in_signature="s",

923

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1421

925

out_signature="a{sv}")

1422

926

def GetAll(self, interface_name):

1423

927

"""Standard D-Bus property GetAll() method, see D-Bus

1424

928

standard.

1425

929

1426

930

Note: Will not include properties with access="write".

1427

931

"""

1428

932

properties = {}

1438

942

if not hasattr(value, "variant_level"):

1439

943

properties[name] = value

1440

944

continue

1441

properties[name] = type(value)(

1442

value, variant_level=value.variant_level + 1)

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

1443

947

return dbus.Dictionary(properties, signature="sv")

1444

948

1445

949

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1446

950

def PropertiesChanged(self, interface_name, changed_properties,

1447

951

invalidated_properties):

1449

953

standard.

1450

954

"""

1451

955

pass

1452

956

1453

957

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1454

958

out_signature="s",

1455

959

path_keyword='object_path',

1456

960

connection_keyword='connection')

1457

961

def Introspect(self, object_path, connection):

1458

962

"""Overloading of standard D-Bus method.

1459

963

1460

964

Inserts property tags and interface annotation tags.

1461

965

"""

1462

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1463

object_path,

1464

connection)

966

xmlstring = dbus.service.Object.Introspect(self, object_path,

967

connection)

1465

968

try:

1466

969

document = xml.dom.minidom.parseString(xmlstring)

1467

1468

970

def make_tag(document, name, prop):

1469

971

e = document.createElement("property")

1470

972

e.setAttribute("name", name)

1471

973

e.setAttribute("type", prop._dbus_signature)

1472

974

e.setAttribute("access", prop._dbus_access)

1473

975

return e

1474

1475

976

for if_tag in document.getElementsByTagName("interface"):

1476

977

# Add property tags

1477

978

for tag in (make_tag(document, name, prop)

1480

981

if prop._dbus_interface

1481

982

== if_tag.getAttribute("name")):

1482

983

if_tag.appendChild(tag)

1483

# Add annotation tags for properties

1484

for tag in if_tag.getElementsByTagName("property"):

1485

annots = dict()

1486

for name, prop in self._get_all_dbus_things(

1487

"property"):

1488

if (name == tag.getAttribute("name")

1489

and prop._dbus_interface

1490

== if_tag.getAttribute("name")):

1491

annots.update(getattr(

1492

prop, "_dbus_annotations", {}))

1493

for name, value in annots.items():

1494

ann_tag = document.createElement(

1495

"annotation")

1496

ann_tag.setAttribute("name", name)

1497

ann_tag.setAttribute("value", value)

1498

tag.appendChild(ann_tag)

984

# Add annotation tags

985

for typ in ("method", "signal", "property"):

986

for tag in if_tag.getElementsByTagName(typ):

987

annots = dict()

988

for name, prop in (self.

989

_get_all_dbus_things(typ)):

990

if (name == tag.getAttribute("name")

991

and prop._dbus_interface

992

== if_tag.getAttribute("name")):

993

annots.update(getattr

994

(prop,

995

"_dbus_annotations",

996

{}))

997

for name, value in annots.items():

998

ann_tag = document.createElement(

999

"annotation")

1000

ann_tag.setAttribute("name", name)

1001

ann_tag.setAttribute("value", value)

1002

tag.appendChild(ann_tag)

1003

# Add interface annotation tags

1004

for annotation, value in dict(

1005

itertools.chain.from_iterable(

1006

annotations().items()

1007

for name, annotations in

1008

self._get_all_dbus_things("interface")

1009

if name == if_tag.getAttribute("name")

1010

)).items():

1011

ann_tag = document.createElement("annotation")

1012

ann_tag.setAttribute("name", annotation)

1013

ann_tag.setAttribute("value", value)

1014

if_tag.appendChild(ann_tag)

1499

1015

# Add the names to the return values for the

1500

1016

# "org.freedesktop.DBus.Properties" methods

1501

1017

if (if_tag.getAttribute("name")

1520

1036

return xmlstring

1521

1037

1522

1038

1523

try:

1524

dbus.OBJECT_MANAGER_IFACE

1525

except AttributeError:

1526

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1527

1528

1529

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1530

"""A D-Bus object with an ObjectManager.

1531

1532

Classes inheriting from this exposes the standard

1533

GetManagedObjects call and the InterfacesAdded and

1534

InterfacesRemoved signals on the standard

1535

"org.freedesktop.DBus.ObjectManager" interface.

1536

1537

Note: No signals are sent automatically; they must be sent

1538

manually.

1539

"""

1540

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1541

out_signature="a{oa{sa{sv}}}")

1542

def GetManagedObjects(self):

1543

"""This function must be overridden"""

1544

raise NotImplementedError()

1545

1546

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1547

signature="oa{sa{sv}}")

1548

def InterfacesAdded(self, object_path, interfaces_and_properties):

1549

pass

1550

1551

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1552

def InterfacesRemoved(self, object_path, interfaces):

1553

pass

1554

1555

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1556

out_signature="s",

1557

path_keyword='object_path',

1558

connection_keyword='connection')

1559

def Introspect(self, object_path, connection):

1560

"""Overloading of standard D-Bus method.

1561

1562

Override return argument name of GetManagedObjects to be

1563

"objpath_interfaces_and_properties"

1564

"""

1565

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1566

object_path,

1567

connection)

1568

try:

1569

document = xml.dom.minidom.parseString(xmlstring)

1570

1571

for if_tag in document.getElementsByTagName("interface"):

1572

# Fix argument name for the GetManagedObjects method

1573

if (if_tag.getAttribute("name")

1574

== dbus.OBJECT_MANAGER_IFACE):

1575

for cn in if_tag.getElementsByTagName("method"):

1576

if (cn.getAttribute("name")

1577

== "GetManagedObjects"):

1578

for arg in cn.getElementsByTagName("arg"):

1579

if (arg.getAttribute("direction")

1580

== "out"):

1581

arg.setAttribute(

1582

"name",

1583

"objpath_interfaces"

1584

"_and_properties")

1585

xmlstring = document.toxml("utf-8")

1586

document.unlink()

1587

except (AttributeError, xml.dom.DOMException,

1588

xml.parsers.expat.ExpatError) as error:

1589

logger.error("Failed to override Introspection method",

1590

exc_info=error)

1591

return xmlstring

1592

1593

1594

1039

def datetime_to_dbus(dt, variant_level=0):

1595

1040

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1596

1041

if dt is None:

1597

return dbus.String("", variant_level=variant_level)

1598

return dbus.String(dt.isoformat(), variant_level=variant_level)

1042

return dbus.String("", variant_level = variant_level)

1043

return dbus.String(dt.isoformat(),

1044

variant_level=variant_level)

1599

1045

1600

1046

1601

1047

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1603

1049

dbus.service.Object, it will add alternate D-Bus attributes with

1604

1050

interface names according to the "alt_interface_names" mapping.

1605

1051

Usage:

1606

1052

1607

1053

@alternate_dbus_interfaces({"org.example.Interface":

1608

1054

"net.example.AlternateInterface"})

1609

1055

class SampleDBusObject(dbus.service.Object):

1610

1056

@dbus.service.method("org.example.Interface")

1611

1057

def SampleDBusMethod():

1612

1058

pass

1613

1059

1614

1060

The above "SampleDBusMethod" on "SampleDBusObject" will be

1615

1061

reachable via two interfaces: "org.example.Interface" and

1616

1062

"net.example.AlternateInterface", the latter of which will have

1617

1063

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1618

1064

"true", unless "deprecate" is passed with a False value.

1619

1065

1620

1066

This works for methods and signals, and also for D-Bus properties

1621

1067

(from DBusObjectWithProperties) and interfaces (from the

1622

1068

dbus_interface_annotations decorator).

1623

1069

"""

1624

1625

1070

def wrapper(cls):

1626

1071

for orig_interface_name, alt_interface_name in (

1627

alt_interface_names.items()):

1072

alt_interface_names.items()):

1628

1073

attr = {}

1629

1074

interface_names = set()

1630

1075

# Go though all attributes of the class

1632

1077

# Ignore non-D-Bus attributes, and D-Bus attributes

1633

1078

# with the wrong interface name

1634

1079

if (not hasattr(attribute, "_dbus_interface")

1635

or not attribute._dbus_interface.startswith(

1636

orig_interface_name)):

1080

or not attribute._dbus_interface

1081

.startswith(orig_interface_name)):

1637

1082

continue

1638

1083

# Create an alternate D-Bus interface name based on

1639

1084

# the current name

1640

alt_interface = attribute._dbus_interface.replace(

1641

orig_interface_name, alt_interface_name)

1085

alt_interface = (attribute._dbus_interface

1086

.replace(orig_interface_name,

1087

alt_interface_name))

1642

1088

interface_names.add(alt_interface)

1643

1089

# Is this a D-Bus signal?

1644

1090

if getattr(attribute, "_dbus_is_signal", False):

1645

1091

# Extract the original non-method undecorated

1646

1092

# function by black magic

1647

if sys.version_info.major == 2:

1648

nonmethod_func = (dict(

1093

nonmethod_func = (dict(

1649

1094

zip(attribute.func_code.co_freevars,

1650

attribute.__closure__))

1651

["func"].cell_contents)

1652

else:

1653

nonmethod_func = (dict(

1654

zip(attribute.__code__.co_freevars,

1655

attribute.__closure__))

1656

["func"].cell_contents)

1095

attribute.__closure__))["func"]

1096

.cell_contents)

1657

1097

# Create a new, but exactly alike, function

1658

1098

# object, and decorate it to be a new D-Bus signal

1659

1099

# with the alternate D-Bus interface name

1660

new_function = copy_function(nonmethod_func)

1661

new_function = (dbus.service.signal(

1662

alt_interface,

1663

attribute._dbus_signature)(new_function))

1100

new_function = (dbus.service.signal

1101

(alt_interface,

1102

attribute._dbus_signature)

1103

(types.FunctionType(

1104

nonmethod_func.func_code,

1105

nonmethod_func.func_globals,

1106

nonmethod_func.func_name,

1107

nonmethod_func.func_defaults,

1108

nonmethod_func.func_closure)))

1664

1109

# Copy annotations, if any

1665

1110

try:

1666

new_function._dbus_annotations = dict(

1667

attribute._dbus_annotations)

1111

new_function._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1668

1113

except AttributeError:

1669

1114

pass

1670

1671

1115

# Define a creator of a function to call both the

1672

1116

# original and alternate functions, so both the

1673

1117

# original and alternate signals gets sent when

1676

1120

"""This function is a scope container to pass

1677

1121

func1 and func2 to the "call_both" function

1678

1122

outside of its arguments"""

1679

1680

@functools.wraps(func2)

1681

1123

def call_both(*args, **kwargs):

1682

1124

"""This function will emit two D-Bus

1683

1125

signals by calling func1 and func2"""

1684

1126

func1(*args, **kwargs)

1685

1127

func2(*args, **kwargs)

1686

# Make wrapper function look like a D-Bus

1687

# signal

1688

for name, attr in inspect.getmembers(func2):

1689

if name.startswith("_dbus_"):

1690

setattr(call_both, name, attr)

1691

1692

1128

return call_both

1693

1129

# Create the "call_both" function and add it to

1694

1130

# the class

1699

1135

# object. Decorate it to be a new D-Bus method

1700

1136

# with the alternate D-Bus interface name. Add it

1701

1137

# to the class.

1702

attr[attrname] = (

1703

dbus.service.method(

1704

alt_interface,

1705

attribute._dbus_in_signature,

1706

attribute._dbus_out_signature)

1707

(copy_function(attribute)))

1138

attr[attrname] = (dbus.service.method

1139

(alt_interface,

1140

attribute._dbus_in_signature,

1141

attribute._dbus_out_signature)

1142

(types.FunctionType

1143

(attribute.func_code,

1144

attribute.func_globals,

1145

attribute.func_name,

1146

attribute.func_defaults,

1147

attribute.func_closure)))

1708

1148

# Copy annotations, if any

1709

1149

try:

1710

attr[attrname]._dbus_annotations = dict(

1711

attribute._dbus_annotations)

1150

attr[attrname]._dbus_annotations = (

1151

dict(attribute._dbus_annotations))

1712

1152

except AttributeError:

1713

1153

pass

1714

1154

# Is this a D-Bus property?

1717

1157

# object, and decorate it to be a new D-Bus

1718

1158

# property with the alternate D-Bus interface

1719

1159

# name. Add it to the class.

1720

attr[attrname] = (dbus_service_property(

1721

alt_interface, attribute._dbus_signature,

1722

attribute._dbus_access,

1723

attribute._dbus_get_args_options

1724

["byte_arrays"])

1725

(copy_function(attribute)))

1160

attr[attrname] = (dbus_service_property

1161

(alt_interface,

1162

attribute._dbus_signature,

1163

attribute._dbus_access,

1164

attribute

1165

._dbus_get_args_options

1166

["byte_arrays"])

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1726

1173

# Copy annotations, if any

1727

1174

try:

1728

attr[attrname]._dbus_annotations = dict(

1729

attribute._dbus_annotations)

1175

attr[attrname]._dbus_annotations = (

1176

dict(attribute._dbus_annotations))

1730

1177

except AttributeError:

1731

1178

pass

1732

1179

# Is this a D-Bus interface?

1735

1182

# object. Decorate it to be a new D-Bus interface

1736

1183

# with the alternate D-Bus interface name. Add it

1737

1184

# to the class.

1738

attr[attrname] = (

1739

dbus_interface_annotations(alt_interface)

1740

(copy_function(attribute)))

1185

attr[attrname] = (dbus_interface_annotations

1186

(alt_interface)

1187

(types.FunctionType

1188

(attribute.func_code,

1189

attribute.func_globals,

1190

attribute.func_name,

1191

attribute.func_defaults,

1192

attribute.func_closure)))

1741

1193

if deprecate:

1742

1194

# Deprecate all alternate interfaces

1743

iname = "_AlternateDBusNames_interface_annotation{}"

1195

iname="_AlternateDBusNames_interface_annotation{}"

1744

1196

for interface_name in interface_names:

1745

1746

1197

@dbus_interface_annotations(interface_name)

1747

1198

def func(self):

1748

return {"org.freedesktop.DBus.Deprecated":

1749

"true"}

1199

return { "org.freedesktop.DBus.Deprecated":

1200

"true" }

1750

1201

# Find an unused name

1751

1202

for aname in (iname.format(i)

1752

1203

for i in itertools.count()):

1756

1207

if interface_names:

1757

1208

# Replace the class with a new subclass of it with

1758

1209

# methods, signals, etc. as created above.

1759

if sys.version_info.major == 2:

1760

cls = type(b"{}Alternate".format(cls.__name__),

1761

(cls, ), attr)

1762

else:

1763

cls = type("{}Alternate".format(cls.__name__),

1764

(cls, ), attr)

1210

cls = type(b"{}Alternate".format(cls.__name__),

1211

(cls,), attr)

1765

1212

return cls

1766

1767

1213

return wrapper

1768

1214

1769

1215

1770

1216

@alternate_dbus_interfaces({"se.recompile.Mandos":

1771

"se.bsnet.fukt.Mandos"})

1217

"se.bsnet.fukt.Mandos"})

1772

1218

class ClientDBus(Client, DBusObjectWithProperties):

1773

1219

"""A Client class using D-Bus

1774

1220

1775

1221

Attributes:

1776

1222

dbus_object_path: dbus.ObjectPath

1777

1223

bus: dbus.SystemBus()

1778

1224

"""

1779

1225

1780

1226

runtime_expansions = (Client.runtime_expansions

1781

+ ("dbus_object_path", ))

1782

1227

+ ("dbus_object_path",))

1228

1783

1229

_interface = "se.recompile.Mandos.Client"

1784

1230

1785

1231

# dbus.service.Object doesn't use super(), so we can't either.

1786

1787

def __init__(self, bus=None, *args, **kwargs):

1232

1233

def __init__(self, bus = None, *args, **kwargs):

1788

1234

self.bus = bus

1789

1235

Client.__init__(self, *args, **kwargs)

1790

1236

# Only now, when this client is initialized, can it show up on

1792

1238

client_object_name = str(self.name).translate(

1793

1239

{ord("."): ord("_"),

1794

1240

ord("-"): ord("_")})

1795

self.dbus_object_path = dbus.ObjectPath(

1796

"/clients/" + client_object_name)

1241

self.dbus_object_path = (dbus.ObjectPath

1242

("/clients/" + client_object_name))

1797

1243

DBusObjectWithProperties.__init__(self, self.bus,

1798

1244

self.dbus_object_path)

1799

1800

def notifychangeproperty(transform_func, dbus_name,

1801

type_func=lambda x: x,

1802

variant_level=1,

1803

invalidate_only=False,

1245

1246

def notifychangeproperty(transform_func,

1247

dbus_name, type_func=lambda x: x,

1248

variant_level=1, invalidate_only=False,

1804

1249

_interface=_interface):

1805

1250

""" Modify a variable so that it's a property which announces

1806

1251

its changes to DBus.

1807

1252

1808

1253

transform_fun: Function that takes a value and a variant_level

1809

1254

and transforms it to a D-Bus type.

1810

1255

dbus_name: D-Bus name of the variable

1813

1258

variant_level: D-Bus variant level. Default: 1

1814

1259

"""

1815

1260

attrname = "_{}".format(dbus_name)

1816

1817

1261

def setter(self, value):

1818

1262

if hasattr(self, "dbus_object_path"):

1819

1263

if (not hasattr(self, attrname) or

1820

1264

type_func(getattr(self, attrname, None))

1821

1265

!= type_func(value)):

1822

1266

if invalidate_only:

1823

self.PropertiesChanged(

1824

_interface, dbus.Dictionary(),

1825

dbus.Array((dbus_name, )))

1267

self.PropertiesChanged(_interface,

1268

dbus.Dictionary(),

1269

dbus.Array

1270

((dbus_name,)))

1826

1271

else:

1827

dbus_value = transform_func(

1828

type_func(value),

1829

variant_level=variant_level)

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1830

1275

self.PropertyChanged(dbus.String(dbus_name),

1831

1276

dbus_value)

1832

self.PropertiesChanged(

1833

_interface,

1834

dbus.Dictionary({dbus.String(dbus_name):

1835

dbus_value}),

1836

dbus.Array())

1277

self.PropertiesChanged(_interface,

1278

dbus.Dictionary({

1279

dbus.String(dbus_name):

1280

dbus_value }), dbus.Array())

1837

1281

setattr(self, attrname, value)

1838

1282

1839

1283

return property(lambda self: getattr(self, attrname), setter)

1840

1284

1841

1285

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1842

1286

approvals_pending = notifychangeproperty(dbus.Boolean,

1843

1287

"ApprovalPending",

1844

type_func=bool)

1288

type_func = bool)

1845

1289

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1846

1290

last_enabled = notifychangeproperty(datetime_to_dbus,

1847

1291

"LastEnabled")

1848

checker = notifychangeproperty(

1849

dbus.Boolean, "CheckerRunning",

1850

type_func=lambda checker: checker is not None)

1292

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1293

type_func = lambda checker:

1294

checker is not None)

1851

1295

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1852

1296

"LastCheckedOK")

1853

1297

last_checker_status = notifychangeproperty(dbus.Int16,

1856

1300

datetime_to_dbus, "LastApprovalRequest")

1857

1301

approved_by_default = notifychangeproperty(dbus.Boolean,

1858

1302

"ApprovedByDefault")

1859

approval_delay = notifychangeproperty(

1860

dbus.UInt64, "ApprovalDelay",

1861

type_func=lambda td: td.total_seconds() * 1000)

1303

approval_delay = notifychangeproperty(dbus.UInt64,

1304

"ApprovalDelay",

1305

type_func =

1306

lambda td: td.total_seconds()

1307

* 1000)

1862

1308

approval_duration = notifychangeproperty(

1863

1309

dbus.UInt64, "ApprovalDuration",

1864

type_func=lambda td: td.total_seconds() * 1000)

1310

type_func = lambda td: td.total_seconds() * 1000)

1865

1311

host = notifychangeproperty(dbus.String, "Host")

1866

timeout = notifychangeproperty(

1867

dbus.UInt64, "Timeout",

1868

type_func=lambda td: td.total_seconds() * 1000)

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func = lambda td:

1314

td.total_seconds() * 1000)

1869

1315

extended_timeout = notifychangeproperty(

1870

1316

dbus.UInt64, "ExtendedTimeout",

1871

type_func=lambda td: td.total_seconds() * 1000)

1872

interval = notifychangeproperty(

1873

dbus.UInt64, "Interval",

1874

type_func=lambda td: td.total_seconds() * 1000)

1317

type_func = lambda td: td.total_seconds() * 1000)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

lambda td: td.total_seconds()

1322

* 1000)

1875

1323

checker_command = notifychangeproperty(dbus.String, "Checker")

1876

1324

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1877

1325

invalidate_only=True)

1878

1326

1879

1327

del notifychangeproperty

1880

1328

1881

1329

def __del__(self, *args, **kwargs):

1882

1330

try:

1883

1331

self.remove_from_connection()

1886

1334

if hasattr(DBusObjectWithProperties, "__del__"):

1887

1335

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1888

1336

Client.__del__(self, *args, **kwargs)

1889

1890

def checker_callback(self, source, condition,

1891

connection, command, *args, **kwargs):

1892

ret = Client.checker_callback(self, source, condition,

1893

connection, command, *args,

1894

**kwargs)

1895

exitstatus = self.last_checker_status

1896

if exitstatus >= 0:

1337

1338

def checker_callback(self, pid, condition, command,

1339

*args, **kwargs):

1340

self.checker_callback_tag = None

1341

self.checker = None

1342

if os.WIFEXITED(condition):

1343

exitstatus = os.WEXITSTATUS(condition)

1897

1344

# Emit D-Bus signal

1898

1345

self.CheckerCompleted(dbus.Int16(exitstatus),

1899

# This is specific to GNU libC

1900

dbus.Int64(exitstatus << 8),

1346

dbus.Int64(condition),

1901

1347

dbus.String(command))

1902

1348

else:

1903

1349

# Emit D-Bus signal

1904

1350

self.CheckerCompleted(dbus.Int16(-1),

1905

dbus.Int64(

1906

# This is specific to GNU libC

1907

(exitstatus << 8)

1908

| self.last_checker_signal),

1351

dbus.Int64(condition),

1909

1352

dbus.String(command))

1910

return ret

1911

1353

1354

return Client.checker_callback(self, pid, condition, command,

1355

*args, **kwargs)

1356

1912

1357

def start_checker(self, *args, **kwargs):

1913

1358

old_checker_pid = getattr(self.checker, "pid", None)

1914

1359

r = Client.start_checker(self, *args, **kwargs)

1918

1363

# Emit D-Bus signal

1919

1364

self.CheckerStarted(self.current_checker_command)

1920

1365

return r

1921

1366

1922

1367

def _reset_approved(self):

1923

1368

self.approved = None

1924

1369

return False

1925

1370

1926

1371

def approve(self, value=True):

1927

1372

self.approved = value

1928

GLib.timeout_add(int(self.approval_duration.total_seconds()

1929

* 1000), self._reset_approved)

1373

gobject.timeout_add(int(self.approval_duration.total_seconds()

1374

* 1000), self._reset_approved)

1930

1375

self.send_changedstate()

1931

1932

# D-Bus methods, signals & properties

1933

1934

# Interfaces

1935

1936

# Signals

1937

1376

1377

## D-Bus methods, signals & properties

1378

1379

## Interfaces

1380

1381

## Signals

1382

1938

1383

# CheckerCompleted - signal

1939

1384

@dbus.service.signal(_interface, signature="nxs")

1940

1385

def CheckerCompleted(self, exitcode, waitstatus, command):

1941

1386

"D-Bus signal"

1942

1387

pass

1943

1388

1944

1389

# CheckerStarted - signal

1945

1390

@dbus.service.signal(_interface, signature="s")

1946

1391

def CheckerStarted(self, command):

1947

1392

"D-Bus signal"

1948

1393

pass

1949

1394

1950

1395

# PropertyChanged - signal

1951

1396

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1952

1397

@dbus.service.signal(_interface, signature="sv")

1953

1398

def PropertyChanged(self, property, value):

1954

1399

"D-Bus signal"

1955

1400

pass

1956

1401

1957

1402

# GotSecret - signal

1958

1403

@dbus.service.signal(_interface)

1959

1404

def GotSecret(self):

1962

1407

server to mandos-client

1963

1408

"""

1964

1409

pass

1965

1410

1966

1411

# Rejected - signal

1967

1412

@dbus.service.signal(_interface, signature="s")

1968

1413

def Rejected(self, reason):

1969

1414

"D-Bus signal"

1970

1415

pass

1971

1416

1972

1417

# NeedApproval - signal

1973

1418

@dbus.service.signal(_interface, signature="tb")

1974

1419

def NeedApproval(self, timeout, default):

1975

1420

"D-Bus signal"

1976

1421

return self.need_approval()

1977

1978

# Methods

1979

1422

1423

## Methods

1424

1980

1425

# Approve - method

1981

1426

@dbus.service.method(_interface, in_signature="b")

1982

1427

def Approve(self, value):

1983

1428

self.approve(value)

1984

1429

1985

1430

# CheckedOK - method

1986

1431

@dbus.service.method(_interface)

1987

1432

def CheckedOK(self):

1988

1433

self.checked_ok()

1989

1434

1990

1435

# Enable - method

1991

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1992

1436

@dbus.service.method(_interface)

1993

1437

def Enable(self):

1994

1438

"D-Bus method"

1995

1439

self.enable()

1996

1440

1997

1441

# StartChecker - method

1998

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1999

1442

@dbus.service.method(_interface)

2000

1443

def StartChecker(self):

2001

1444

"D-Bus method"

2002

1445

self.start_checker()

2003

1446

2004

1447

# Disable - method

2005

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2006

1448

@dbus.service.method(_interface)

2007

1449

def Disable(self):

2008

1450

"D-Bus method"

2009

1451

self.disable()

2010

1452

2011

1453

# StopChecker - method

2012

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2013

1454

@dbus.service.method(_interface)

2014

1455

def StopChecker(self):

2015

1456

self.stop_checker()

2016

2017

# Properties

2018

1457

1458

## Properties

1459

2019

1460

# ApprovalPending - property

2020

1461

@dbus_service_property(_interface, signature="b", access="read")

2021

1462

def ApprovalPending_dbus_property(self):

2022

1463

return dbus.Boolean(bool(self.approvals_pending))

2023

1464

2024

1465

# ApprovedByDefault - property

2025

@dbus_service_property(_interface,

2026

signature="b",

1466

@dbus_service_property(_interface, signature="b",

2027

1467

access="readwrite")

2028

1468

def ApprovedByDefault_dbus_property(self, value=None):

2029

1469

if value is None: # get

2030

1470

return dbus.Boolean(self.approved_by_default)

2031

1471

self.approved_by_default = bool(value)

2032

1472

2033

1473

# ApprovalDelay - property

2034

@dbus_service_property(_interface,

2035

signature="t",

1474

@dbus_service_property(_interface, signature="t",

2036

1475

access="readwrite")

2037

1476

def ApprovalDelay_dbus_property(self, value=None):

2038

1477

if value is None: # get

2039

1478

return dbus.UInt64(self.approval_delay.total_seconds()

2040

1479

* 1000)

2041

1480

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2042

1481

2043

1482

# ApprovalDuration - property

2044

@dbus_service_property(_interface,

2045

signature="t",

1483

@dbus_service_property(_interface, signature="t",

2046

1484

access="readwrite")

2047

1485

def ApprovalDuration_dbus_property(self, value=None):

2048

1486

if value is None: # get

2049

1487

return dbus.UInt64(self.approval_duration.total_seconds()

2050

1488

* 1000)

2051

1489

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2052

1490

2053

1491

# Name - property

2054

@dbus_annotations(

2055

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2056

1492

@dbus_service_property(_interface, signature="s", access="read")

2057

1493

def Name_dbus_property(self):

2058

1494

return dbus.String(self.name)

2059

2060

# KeyID - property

2061

@dbus_annotations(

2062

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2063

@dbus_service_property(_interface, signature="s", access="read")

2064

def KeyID_dbus_property(self):

2065

return dbus.String(self.key_id)

2066

1495

2067

1496

# Fingerprint - property

2068

@dbus_annotations(

2069

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2070

1497

@dbus_service_property(_interface, signature="s", access="read")

2071

1498

def Fingerprint_dbus_property(self):

2072

1499

return dbus.String(self.fingerprint)

2073

1500

2074

1501

# Host - property

2075

@dbus_service_property(_interface,

2076

signature="s",

1502

@dbus_service_property(_interface, signature="s",

2077

1503

access="readwrite")

2078

1504

def Host_dbus_property(self, value=None):

2079

1505

if value is None: # get

2080

1506

return dbus.String(self.host)

2081

1507

self.host = str(value)

2082

1508

2083

1509

# Created - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

1510

@dbus_service_property(_interface, signature="s", access="read")

2087

1511

def Created_dbus_property(self):

2088

1512

return datetime_to_dbus(self.created)

2089

1513

2090

1514

# LastEnabled - property

2091

1515

@dbus_service_property(_interface, signature="s", access="read")

2092

1516

def LastEnabled_dbus_property(self):

2093

1517

return datetime_to_dbus(self.last_enabled)

2094

1518

2095

1519

# Enabled - property

2096

@dbus_service_property(_interface,

2097

signature="b",

1520

@dbus_service_property(_interface, signature="b",

2098

1521

access="readwrite")

2099

1522

def Enabled_dbus_property(self, value=None):

2100

1523

if value is None: # get

2103

1526

self.enable()

2104

1527

else:

2105

1528

self.disable()

2106

1529

2107

1530

# LastCheckedOK - property

2108

@dbus_service_property(_interface,

2109

signature="s",

1531

@dbus_service_property(_interface, signature="s",

2110

1532

access="readwrite")

2111

1533

def LastCheckedOK_dbus_property(self, value=None):

2112

1534

if value is not None:

2113

1535

self.checked_ok()

2114

1536

return

2115

1537

return datetime_to_dbus(self.last_checked_ok)

2116

1538

2117

1539

# LastCheckerStatus - property

2118

@dbus_service_property(_interface, signature="n", access="read")

1540

@dbus_service_property(_interface, signature="n",

1541

access="read")

2119

1542

def LastCheckerStatus_dbus_property(self):

2120

1543

return dbus.Int16(self.last_checker_status)

2121

1544

2122

1545

# Expires - property

2123

1546

@dbus_service_property(_interface, signature="s", access="read")

2124

1547

def Expires_dbus_property(self):

2125

1548

return datetime_to_dbus(self.expires)

2126

1549

2127

1550

# LastApprovalRequest - property

2128

1551

@dbus_service_property(_interface, signature="s", access="read")

2129

1552

def LastApprovalRequest_dbus_property(self):

2130

1553

return datetime_to_dbus(self.last_approval_request)

2131

1554

2132

1555

# Timeout - property

2133

@dbus_service_property(_interface,

2134

signature="t",

1556

@dbus_service_property(_interface, signature="t",

2135

1557

access="readwrite")

2136

1558

def Timeout_dbus_property(self, value=None):

2137

1559

if value is None: # get

2149

1571

if (getattr(self, "disable_initiator_tag", None)

2150

1572

is None):

2151

1573

return

2152

GLib.source_remove(self.disable_initiator_tag)

2153

self.disable_initiator_tag = GLib.timeout_add(

2154

int((self.expires - now).total_seconds() * 1000),

2155

self.disable)

2156

1574

gobject.source_remove(self.disable_initiator_tag)

1575

self.disable_initiator_tag = (

1576

gobject.timeout_add(

1577

int((self.expires - now).total_seconds()

1578

* 1000), self.disable))

1579

2157

1580

# ExtendedTimeout - property

2158

@dbus_service_property(_interface,

2159

signature="t",

1581

@dbus_service_property(_interface, signature="t",

2160

1582

access="readwrite")

2161

1583

def ExtendedTimeout_dbus_property(self, value=None):

2162

1584

if value is None: # get

2163

1585

return dbus.UInt64(self.extended_timeout.total_seconds()

2164

1586

* 1000)

2165

1587

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2166

1588

2167

1589

# Interval - property

2168

@dbus_service_property(_interface,

2169

signature="t",

1590

@dbus_service_property(_interface, signature="t",

2170

1591

access="readwrite")

2171

1592

def Interval_dbus_property(self, value=None):

2172

1593

if value is None: # get

2176

1597

return

2177

1598

if self.enabled:

2178

1599

# Reschedule checker run

2179

GLib.source_remove(self.checker_initiator_tag)

2180

self.checker_initiator_tag = GLib.timeout_add(

2181

value, self.start_checker)

2182

self.start_checker() # Start one now, too

2183

1600

gobject.source_remove(self.checker_initiator_tag)

1601

self.checker_initiator_tag = (gobject.timeout_add

1602

(value, self.start_checker))

1603

self.start_checker() # Start one now, too

1604

2184

1605

# Checker - property

2185

@dbus_service_property(_interface,

2186

signature="s",

1606

@dbus_service_property(_interface, signature="s",

2187

1607

access="readwrite")

2188

1608

def Checker_dbus_property(self, value=None):

2189

1609

if value is None: # get

2190

1610

return dbus.String(self.checker_command)

2191

1611

self.checker_command = str(value)

2192

1612

2193

1613

# CheckerRunning - property

2194

@dbus_service_property(_interface,

2195

signature="b",

1614

@dbus_service_property(_interface, signature="b",

2196

1615

access="readwrite")

2197

1616

def CheckerRunning_dbus_property(self, value=None):

2198

1617

if value is None: # get

2201

1620

self.start_checker()

2202

1621

else:

2203

1622

self.stop_checker()

2204

1623

2205

1624

# ObjectPath - property

2206

@dbus_annotations(

2207

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2208

"org.freedesktop.DBus.Deprecated": "true"})

2209

1625

@dbus_service_property(_interface, signature="o", access="read")

2210

1626

def ObjectPath_dbus_property(self):

2211

return self.dbus_object_path # is already a dbus.ObjectPath

2212

1627

return self.dbus_object_path # is already a dbus.ObjectPath

1628

2213

1629

# Secret = property

2214

@dbus_annotations(

2215

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2216

"invalidates"})

2217

@dbus_service_property(_interface,

2218

signature="ay",

2219

access="write",

2220

byte_arrays=True)

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

2221

1632

def Secret_dbus_property(self, value):

2222

1633

self.secret = bytes(value)

2223

1634

2224

1635

del _interface

2225

1636

2226

1637

2227

class ProxyClient:

2228

def __init__(self, child_pipe, key_id, fpr, address):

1638

class ProxyClient(object):

1639

def __init__(self, child_pipe, fpr, address):

2229

1640

self._pipe = child_pipe

2230

self._pipe.send(('init', key_id, fpr, address))

1641

self._pipe.send(('init', fpr, address))

2231

1642

if not self._pipe.recv():

2232

raise KeyError(key_id or fpr)

2233

1643

raise KeyError()

1644

2234

1645

def __getattribute__(self, name):

2235

1646

if name == '_pipe':

2236

1647

return super(ProxyClient, self).__getattribute__(name)

2239

1650

if data[0] == 'data':

2240

1651

return data[1]

2241

1652

if data[0] == 'function':

2242

2243

1653

def func(*args, **kwargs):

2244

1654

self._pipe.send(('funcall', name, args, kwargs))

2245

1655

return self._pipe.recv()[1]

2246

2247

1656

return func

2248

1657

2249

1658

def __setattr__(self, name, value):

2250

1659

if name == '_pipe':

2251

1660

return super(ProxyClient, self).__setattr__(name, value)

2254

1663

2255

1664

class ClientHandler(socketserver.BaseRequestHandler, object):

2256

1665

"""A class to handle client connections.

2257

1666

2258

1667

Instantiated once for each connection to handle it.

2259

1668

Note: This will run in its own forked process."""

2260

1669

2261

1670

def handle(self):

2262

1671

with contextlib.closing(self.server.child_pipe) as child_pipe:

2263

1672

logger.info("TCP connection from: %s",

2264

1673

str(self.client_address))

2265

1674

logger.debug("Pipe FD: %d",

2266

1675

self.server.child_pipe.fileno())

2267

2268

session = gnutls.ClientSession(self.request)

2269

2270

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2271

# "+AES-256-CBC", "+SHA1",

2272

# "+COMP-NULL", "+CTYPE-OPENPGP",

2273

# "+DHE-DSS"))

1676

1677

session = (gnutls.connection

1678

.ClientSession(self.request,

1679

gnutls.connection

1680

.X509Credentials()))

1681

1682

# Note: gnutls.connection.X509Credentials is really a

1683

# generic GnuTLS certificate credentials object so long as

1684

# no X.509 keys are added to it. Therefore, we can use it

1685

# here despite using OpenPGP certificates.

1686

1687

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1688

# "+AES-256-CBC", "+SHA1",

1689

# "+COMP-NULL", "+CTYPE-OPENPGP",

1690

# "+DHE-DSS"))

2274

1691

# Use a fallback default, since this MUST be set.

2275

1692

priority = self.server.gnutls_priority

2276

1693

if priority is None:

2277

1694

priority = "NORMAL"

2278

gnutls.priority_set_direct(session._c_object,

2279

priority.encode("utf-8"),

2280

None)

2281

1695

(gnutls.library.functions

1696

.gnutls_priority_set_direct(session._c_object,

1697

priority, None))

1698

2282

1699

# Start communication using the Mandos protocol

2283

1700

# Get protocol number

2284

1701

line = self.request.makefile().readline()

2289

1706

except (ValueError, IndexError, RuntimeError) as error:

2290

1707

logger.error("Unknown protocol version: %s", error)

2291

1708

return

2292

1709

2293

1710

# Start GnuTLS connection

2294

1711

try:

2295

1712

session.handshake()

2296

except gnutls.Error as error:

1713

except gnutls.errors.GNUTLSError as error:

2297

1714

logger.warning("Handshake failed: %s", error)

2298

1715

# Do not run session.bye() here: the session is not

2299

1716

# established. Just abandon the request.

2300

1717

return

2301

1718

logger.debug("Handshake succeeded")

2302

1719

2303

1720

approval_required = False

2304

1721

try:

2305

if gnutls.has_rawpk:

2306

fpr = b""

2307

try:

2308

key_id = self.key_id(

2309

self.peer_certificate(session))

2310

except (TypeError, gnutls.Error) as error:

2311

logger.warning("Bad certificate: %s", error)

2312

return

2313

logger.debug("Key ID: %s", key_id)

2314

2315

else:

2316

key_id = b""

2317

try:

2318

fpr = self.fingerprint(

2319

self.peer_certificate(session))

2320

except (TypeError, gnutls.Error) as error:

2321

logger.warning("Bad certificate: %s", error)

2322

return

2323

logger.debug("Fingerprint: %s", fpr)

2324

2325

try:

2326

client = ProxyClient(child_pipe, key_id, fpr,

1722

try:

1723

fpr = self.fingerprint(self.peer_certificate

1724

(session))

1725

except (TypeError,

1726

gnutls.errors.GNUTLSError) as error:

1727

logger.warning("Bad certificate: %s", error)

1728

return

1729

logger.debug("Fingerprint: %s", fpr)

1730

1731

try:

1732

client = ProxyClient(child_pipe, fpr,

2327

1733

self.client_address)

2328

1734

except KeyError:

2329

1735

return

2330

1736

2331

1737

if client.approval_delay:

2332

1738

delay = client.approval_delay

2333

1739

client.approvals_pending += 1

2334

1740

approval_required = True

2335

1741

2336

1742

while True:

2337

1743

if not client.enabled:

2338

1744

logger.info("Client %s is disabled",

2339

client.name)

1745

client.name)

2340

1746

if self.server.use_dbus:

2341

1747

# Emit D-Bus signal

2342

1748

client.Rejected("Disabled")

2343

1749

return

2344

1750

2345

1751

if client.approved or not client.approval_delay:

2346

# We are approved or approval is disabled

1752

#We are approved or approval is disabled

2347

1753

break

2348

1754

elif client.approved is None:

2349

1755

logger.info("Client %s needs approval",

2360

1766

# Emit D-Bus signal

2361

1767

client.Rejected("Denied")

2362

1768

return

2363

2364

# wait until timeout or approved

1769

1770

#wait until timeout or approved

2365

1771

time = datetime.datetime.now()

2366

1772

client.changedstate.acquire()

2367

1773

client.changedstate.wait(delay.total_seconds())

2380

1786

break

2381

1787

else:

2382

1788

delay -= time2 - time

2383

2384

try:

2385

session.send(client.secret)

2386

except gnutls.Error as error:

2387

logger.warning("gnutls send failed",

2388

exc_info=error)

2389

return

2390

1789

1790

sent_size = 0

1791

while sent_size < len(client.secret):

1792

try:

1793

sent = session.send(client.secret[sent_size:])

1794

except gnutls.errors.GNUTLSError as error:

1795

logger.warning("gnutls send failed",

1796

exc_info=error)

1797

return

1798

logger.debug("Sent: %d, remaining: %d",

1799

sent, len(client.secret)

1800

- (sent_size + sent))

1801

sent_size += sent

1802

2391

1803

logger.info("Sending secret to %s", client.name)

2392

1804

# bump the timeout using extended_timeout

2393

1805

client.bump_timeout(client.extended_timeout)

2394

1806

if self.server.use_dbus:

2395

1807

# Emit D-Bus signal

2396

1808

client.GotSecret()

2397

1809

2398

1810

finally:

2399

1811

if approval_required:

2400

1812

client.approvals_pending -= 1

2401

1813

try:

2402

1814

session.bye()

2403

except gnutls.Error as error:

1815

except gnutls.errors.GNUTLSError as error:

2404

1816

logger.warning("GnuTLS bye failed",

2405

1817

exc_info=error)

2406

1818

2407

1819

@staticmethod

2408

1820

def peer_certificate(session):

2409

"Return the peer's certificate as a bytestring"

2410

try:

2411

cert_type = gnutls.certificate_type_get2(session._c_object,

2412

gnutls.CTYPE_PEERS)

2413

except AttributeError:

2414

cert_type = gnutls.certificate_type_get(session._c_object)

2415

if gnutls.has_rawpk:

2416

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2417

else:

2418

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2419

# If not a valid certificate type...

2420

if cert_type not in valid_cert_types:

2421

logger.info("Cert type %r not in %r", cert_type,

2422

valid_cert_types)

2423

# ...return invalid data

2424

return b""

1821

"Return the peer's OpenPGP certificate as a bytestring"

1822

# If not an OpenPGP certificate...

1823

if (gnutls.library.functions

1824

.gnutls_certificate_type_get(session._c_object)

1825

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1826

# ...do the normal thing

1827

return session.peer_certificate

2425

1828

list_size = ctypes.c_uint(1)

2426

cert_list = (gnutls.certificate_get_peers

1829

cert_list = (gnutls.library.functions

1830

.gnutls_certificate_get_peers

2427

1831

(session._c_object, ctypes.byref(list_size)))

2428

1832

if not bool(cert_list) and list_size.value != 0:

2429

raise gnutls.Error("error getting peer certificate")

1833

raise gnutls.errors.GNUTLSError("error getting peer"

1834

" certificate")

2430

1835

if list_size.value == 0:

2431

1836

return None

2432

1837

cert = cert_list[0]

2433

1838

return ctypes.string_at(cert.data, cert.size)

2434

2435

@staticmethod

2436

def key_id(certificate):

2437

"Convert a certificate bytestring to a hexdigit key ID"

2438

# New GnuTLS "datum" with the public key

2439

datum = gnutls.datum_t(

2440

ctypes.cast(ctypes.c_char_p(certificate),

2441

ctypes.POINTER(ctypes.c_ubyte)),

2442

ctypes.c_uint(len(certificate)))

2443

# XXX all these need to be created in the gnutls "module"

2444

# New empty GnuTLS certificate

2445

pubkey = gnutls.pubkey_t()

2446

gnutls.pubkey_init(ctypes.byref(pubkey))

2447

# Import the raw public key into the certificate

2448

gnutls.pubkey_import(pubkey,

2449

ctypes.byref(datum),

2450

gnutls.X509_FMT_DER)

2451

# New buffer for the key ID

2452

buf = ctypes.create_string_buffer(32)

2453

buf_len = ctypes.c_size_t(len(buf))

2454

# Get the key ID from the raw public key into the buffer

2455

gnutls.pubkey_get_key_id(pubkey,

2456

gnutls.KEYID_USE_SHA256,

2457

ctypes.cast(ctypes.byref(buf),

2458

ctypes.POINTER(ctypes.c_ubyte)),

2459

ctypes.byref(buf_len))

2460

# Deinit the certificate

2461

gnutls.pubkey_deinit(pubkey)

2462

2463

# Convert the buffer to a Python bytestring

2464

key_id = ctypes.string_at(buf, buf_len.value)

2465

# Convert the bytestring to hexadecimal notation

2466

hex_key_id = binascii.hexlify(key_id).upper()

2467

return hex_key_id

2468

1839

2469

1840

@staticmethod

2470

1841

def fingerprint(openpgp):

2471

1842

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2472

1843

# New GnuTLS "datum" with the OpenPGP public key

2473

datum = gnutls.datum_t(

2474

ctypes.cast(ctypes.c_char_p(openpgp),

2475

ctypes.POINTER(ctypes.c_ubyte)),

2476

ctypes.c_uint(len(openpgp)))

1844

datum = (gnutls.library.types

1845

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1846

ctypes.POINTER

1847

(ctypes.c_ubyte)),

1848

ctypes.c_uint(len(openpgp))))

2477

1849

# New empty GnuTLS certificate

2478

crt = gnutls.openpgp_crt_t()

2479

gnutls.openpgp_crt_init(ctypes.byref(crt))

1850

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2480

1853

# Import the OpenPGP public key into the certificate

2481

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2482

gnutls.OPENPGP_FMT_RAW)

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1856

gnutls.library.constants

1857

.GNUTLS_OPENPGP_FMT_RAW))

2483

1858

# Verify the self signature in the key

2484

1859

crtverify = ctypes.c_uint()

2485

gnutls.openpgp_crt_verify_self(crt, 0,

2486

ctypes.byref(crtverify))

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_verify_self(crt, 0,

1862

ctypes.byref(crtverify)))

2487

1863

if crtverify.value != 0:

2488

gnutls.openpgp_crt_deinit(crt)

2489

raise gnutls.CertificateSecurityError(code

2490

=crtverify.value)

1864

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1865

raise (gnutls.errors.CertificateSecurityError

1866

("Verify failed"))

2491

1867

# New buffer for the fingerprint

2492

1868

buf = ctypes.create_string_buffer(20)

2493

1869

buf_len = ctypes.c_size_t()

2494

1870

# Get the fingerprint from the certificate into the buffer

2495

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2496

ctypes.byref(buf_len))

1871

(gnutls.library.functions

1872

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1873

ctypes.byref(buf_len)))

2497

1874

# Deinit the certificate

2498

gnutls.openpgp_crt_deinit(crt)

1875

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2499

1876

# Convert the buffer to a Python bytestring

2500

1877

fpr = ctypes.string_at(buf, buf_len.value)

2501

1878

# Convert the bytestring to hexadecimal notation

2503

1880

return hex_fpr

2504

1881

2505

1882

2506

class MultiprocessingMixIn:

1883

class MultiprocessingMixIn(object):

2507

1884

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2508

2509

1885

def sub_process_main(self, request, address):

2510

1886

try:

2511

1887

self.finish_request(request, address)

2512

1888

except Exception:

2513

1889

self.handle_error(request, address)

2514

1890

self.close_request(request)

2515

1891

2516

1892

def process_request(self, request, address):

2517

1893

"""Start a new process to process the request."""

2518

proc = multiprocessing.Process(target=self.sub_process_main,

2519

args=(request, address))

1894

proc = multiprocessing.Process(target = self.sub_process_main,

1895

args = (request, address))

2520

1896

proc.start()

2521

1897

return proc

2522

1898

2523

1899

2524

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1900

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2525

1901

""" adds a pipe to the MixIn """

2526

2527

1902

def process_request(self, request, client_address):

2528

1903

"""Overrides and wraps the original process_request().

2529

1904

2530

1905

This function creates a new pipe in self.pipe

2531

1906

"""

2532

1907

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2533

1908

2534

1909

proc = MultiprocessingMixIn.process_request(self, request,

2535

1910

client_address)

2536

1911

self.child_pipe.close()

2537

1912

self.add_pipe(parent_pipe, proc)

2538

1913

2539

1914

def add_pipe(self, parent_pipe, proc):

2540

1915

"""Dummy function; override as necessary"""

2541

1916

raise NotImplementedError()

2542

1917

2543

1918

2544

1919

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2545

socketserver.TCPServer):

1920

socketserver.TCPServer, object):

2546

1921

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2547

1922

2548

1923

Attributes:

2549

1924

enabled: Boolean; whether this server is activated yet

2550

1925

interface: None or a network interface name (string)

2551

1926

use_ipv6: Boolean; to use IPv6 or not

2552

1927

"""

2553

2554

1928

def __init__(self, server_address, RequestHandlerClass,

2555

interface=None,

2556

use_ipv6=True,

2557

socketfd=None):

1929

interface=None, use_ipv6=True, socketfd=None):

2558

1930

"""If socketfd is set, use that file descriptor instead of

2559

1931

creating a new one with socket.socket().

2560

1932

"""

2566

1938

self.socketfd = socketfd

2567

1939

# Save the original socket.socket() function

2568

1940

self.socket_socket = socket.socket

2569

2570

1941

# To implement --socket, we monkey patch socket.socket.

2571

#

1942

#

2572

1943

# (When socketserver.TCPServer is a new-style class, we

2573

1944

# could make self.socket into a property instead of monkey

2574

1945

# patching socket.socket.)

2575

#

1946

#

2576

1947

# Create a one-time-only replacement for socket.socket()

2577

1948

@functools.wraps(socket.socket)

2578

1949

def socket_wrapper(*args, **kwargs):

2590

1961

# socket_wrapper(), if socketfd was set.

2591

1962

socketserver.TCPServer.__init__(self, server_address,

2592

1963

RequestHandlerClass)

2593

1964

2594

1965

def server_bind(self):

2595

1966

"""This overrides the normal server_bind() function

2596

1967

to bind to an interface if one was specified, and also NOT to

2597

1968

bind to an address or port if they were not specified."""

2598

global SO_BINDTODEVICE

2599

1969

if self.interface is not None:

2600

1970

if SO_BINDTODEVICE is None:

2601

# Fall back to a hard-coded value which seems to be

2602

# common enough.

2603

logger.warning("SO_BINDTODEVICE not found, trying 25")

2604

SO_BINDTODEVICE = 25

2605

try:

2606

self.socket.setsockopt(

2607

socket.SOL_SOCKET, SO_BINDTODEVICE,

2608

(self.interface + "\0").encode("utf-8"))

2609

except socket.error as error:

2610

if error.errno == errno.EPERM:

2611

logger.error("No permission to bind to"

2612

" interface %s", self.interface)

2613

elif error.errno == errno.ENOPROTOOPT:

2614

logger.error("SO_BINDTODEVICE not available;"

2615

" cannot bind to interface %s",

2616

self.interface)

2617

elif error.errno == errno.ENODEV:

2618

logger.error("Interface %s does not exist,"

2619

" cannot bind", self.interface)

2620

else:

2621

raise

1971

logger.error("SO_BINDTODEVICE does not exist;"

1972

" cannot bind to interface %s",

1973

self.interface)

1974

else:

1975

try:

1976

self.socket.setsockopt(socket.SOL_SOCKET,

1977

SO_BINDTODEVICE,

1978

(self.interface + "\0")

1979

.encode("utf-8"))

1980

except socket.error as error:

1981

if error.errno == errno.EPERM:

1982

logger.error("No permission to bind to"

1983

" interface %s", self.interface)

1984

elif error.errno == errno.ENOPROTOOPT:

1985

logger.error("SO_BINDTODEVICE not available;"

1986

" cannot bind to interface %s",

1987

self.interface)

1988

elif error.errno == errno.ENODEV:

1989

logger.error("Interface %s does not exist,"

1990

" cannot bind", self.interface)

1991

else:

1992

raise

2622

1993

# Only bind(2) the socket if we really need to.

2623

1994

if self.server_address[0] or self.server_address[1]:

2624

if self.server_address[1]:

2625

self.allow_reuse_address = True

2626

1995

if not self.server_address[0]:

2627

1996

if self.address_family == socket.AF_INET6:

2628

any_address = "::" # in6addr_any

1997

any_address = "::" # in6addr_any

2629

1998

else:

2630

any_address = "0.0.0.0" # INADDR_ANY

1999

any_address = "0.0.0.0" # INADDR_ANY

2631

2000

self.server_address = (any_address,

2632

2001

self.server_address[1])

2633

2002

elif not self.server_address[1]:

2634

self.server_address = (self.server_address[0], 0)

2003

self.server_address = (self.server_address[0],

2004

0)

2635

2005

# if self.interface:

2636

2006

# self.server_address = (self.server_address[0],

2637

2007

# 0, # port

2643

2013

2644

2014

class MandosServer(IPv6_TCPServer):

2645

2015

"""Mandos server.

2646

2016

2647

2017

Attributes:

2648

2018

clients: set of Client objects

2649

2019

gnutls_priority GnuTLS priority string

2650

2020

use_dbus: Boolean; to emit D-Bus signals or not

2651

2652

Assumes a GLib.MainLoop event loop.

2021

2022

Assumes a gobject.MainLoop event loop.

2653

2023

"""

2654

2655

2024

def __init__(self, server_address, RequestHandlerClass,

2656

interface=None,

2657

use_ipv6=True,

2658

clients=None,

2659

gnutls_priority=None,

2660

use_dbus=True,

2661

socketfd=None):

2025

interface=None, use_ipv6=True, clients=None,

2026

gnutls_priority=None, use_dbus=True, socketfd=None):

2662

2027

self.enabled = False

2663

2028

self.clients = clients

2664

2029

if self.clients is None:

2667

2032

self.gnutls_priority = gnutls_priority

2668

2033

IPv6_TCPServer.__init__(self, server_address,

2669

2034

RequestHandlerClass,

2670

interface=interface,

2671

use_ipv6=use_ipv6,

2672

socketfd=socketfd)

2673

2035

interface = interface,

2036

use_ipv6 = use_ipv6,

2037

socketfd = socketfd)

2674

2038

def server_activate(self):

2675

2039

if self.enabled:

2676

2040

return socketserver.TCPServer.server_activate(self)

2677

2041

2678

2042

def enable(self):

2679

2043

self.enabled = True

2680

2044

2681

2045

def add_pipe(self, parent_pipe, proc):

2682

2046

# Call "handle_ipc" for both data and EOF events

2683

GLib.io_add_watch(

2684

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2685

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2686

functools.partial(self.handle_ipc,

2687

parent_pipe=parent_pipe,

2688

proc=proc))

2689

2690

def handle_ipc(self, source, condition,

2691

parent_pipe=None,

2692

proc=None,

2693

client_object=None):

2047

gobject.io_add_watch(parent_pipe.fileno(),

2048

gobject.IO_IN | gobject.IO_HUP,

2049

functools.partial(self.handle_ipc,

2050

parent_pipe =

2051

parent_pipe,

2052

proc = proc))

2053

2054

def handle_ipc(self, source, condition, parent_pipe=None,

2055

proc = None, client_object=None):

2694

2056

# error, or the other end of multiprocessing.Pipe has closed

2695

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2057

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2696

2058

# Wait for other process to exit

2697

2059

proc.join()

2698

2060

return False

2699

2061

2700

2062

# Read a request from the child

2701

2063

request = parent_pipe.recv()

2702

2064

command = request[0]

2703

2065

2704

2066

if command == 'init':

2705

key_id = request[1].decode("ascii")

2706

fpr = request[2].decode("ascii")

2707

address = request[3]

2708

2709

for c in self.clients.values():

2710

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2711

continue

2712

if key_id and c.key_id == key_id:

2713

client = c

2714

break

2715

if fpr and c.fingerprint == fpr:

2067

fpr = request[1]

2068

address = request[2]

2069

2070

for c in self.clients.itervalues():

2071

if c.fingerprint == fpr:

2716

2072

client = c

2717

2073

break

2718

2074

else:

2719

logger.info("Client not found for key ID: %s, address"

2720

": %s", key_id or fpr, address)

2075

logger.info("Client not found for fingerprint: %s, ad"

2076

"dress: %s", fpr, address)

2721

2077

if self.use_dbus:

2722

2078

# Emit D-Bus signal

2723

mandos_dbus_service.ClientNotFound(key_id or fpr,

2079

mandos_dbus_service.ClientNotFound(fpr,

2724

2080

address[0])

2725

2081

parent_pipe.send(False)

2726

2082

return False

2727

2728

GLib.io_add_watch(

2729

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2730

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2731

functools.partial(self.handle_ipc,

2732

parent_pipe=parent_pipe,

2733

proc=proc,

2734

client_object=client))

2083

2084

gobject.io_add_watch(parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe =

2088

parent_pipe,

2089

proc = proc,

2090

client_object =

2091

client))

2735

2092

parent_pipe.send(True)

2736

2093

# remove the old hook in favor of the new above hook on

2737

2094

# same fileno

2740

2097

funcname = request[1]

2741

2098

args = request[2]

2742

2099

kwargs = request[3]

2743

2100

2744

2101

parent_pipe.send(('data', getattr(client_object,

2745

2102

funcname)(*args,

2746

**kwargs)))

2747

2103

**kwargs)))

2104

2748

2105

if command == 'getattr':

2749

2106

attrname = request[1]

2750

if isinstance(client_object.__getattribute__(attrname),

2751

collections.Callable):

2752

parent_pipe.send(('function', ))

2107

if callable(client_object.__getattribute__(attrname)):

2108

parent_pipe.send(('function',))

2753

2109

else:

2754

parent_pipe.send((

2755

'data', client_object.__getattribute__(attrname)))

2756

2110

parent_pipe.send(('data', client_object

2111

.__getattribute__(attrname)))

2112

2757

2113

if command == 'setattr':

2758

2114

attrname = request[1]

2759

2115

value = request[2]

2760

2116

setattr(client_object, attrname, value)

2761

2117

2762

2118

return True

2763

2119

2764

2120

2765

2121

def rfc3339_duration_to_delta(duration):

2766

2122

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2767

2768

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2771

True

2772

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2773

True

2774

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2775

True

2776

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2777

True

2778

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2779

True

2780

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2781

True

2123

2124

>>> rfc3339_duration_to_delta("P7D")

2125

datetime.timedelta(7)

2126

>>> rfc3339_duration_to_delta("PT60S")

2127

datetime.timedelta(0, 60)

2128

>>> rfc3339_duration_to_delta("PT60M")

2129

datetime.timedelta(0, 3600)

2130

>>> rfc3339_duration_to_delta("PT24H")

2131

datetime.timedelta(1)

2132

>>> rfc3339_duration_to_delta("P1W")

2133

datetime.timedelta(7)

2134

>>> rfc3339_duration_to_delta("PT5M30S")

2135

datetime.timedelta(0, 330)

2136

>>> rfc3339_duration_to_delta("P1DT3M20S")

2137

datetime.timedelta(1, 200)

2782

2138

"""

2783

2139

2784

2140

# Parsing an RFC 3339 duration with regular expressions is not

2785

2141

# possible - there would have to be multiple places for the same

2786

2142

# values, like seconds. The current code, while more esoteric, is

2787

2143

# cleaner without depending on a parsing library. If Python had a

2788

2144

# built-in library for parsing we would use it, but we'd like to

2789

2145

# avoid excessive use of external libraries.

2790

2146

2791

2147

# New type for defining tokens, syntax, and semantics all-in-one

2792

Token = collections.namedtuple("Token", (

2793

"regexp", # To match token; if "value" is not None, must have

2794

# a "group" containing digits

2795

"value", # datetime.timedelta or None

2796

"followers")) # Tokens valid after this token

2148

Token = collections.namedtuple("Token",

2149

("regexp", # To match token; if

2150

# "value" is not None,

2151

# must have a "group"

2152

# containing digits

2153

"value", # datetime.timedelta or

2154

# None

2155

"followers")) # Tokens valid after

2156

# this token

2797

2157

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2798

2158

# the "duration" ABNF definition in RFC 3339, Appendix A.

2799

2159

token_end = Token(re.compile(r"$"), None, frozenset())

2800

2160

token_second = Token(re.compile(r"(\d+)S"),

2801

2161

datetime.timedelta(seconds=1),

2802

frozenset((token_end, )))

2162

frozenset((token_end,)))

2803

2163

token_minute = Token(re.compile(r"(\d+)M"),

2804

2164

datetime.timedelta(minutes=1),

2805

2165

frozenset((token_second, token_end)))

2821

2181

frozenset((token_month, token_end)))

2822

2182

token_week = Token(re.compile(r"(\d+)W"),

2823

2183

datetime.timedelta(weeks=1),

2824

frozenset((token_end, )))

2184

frozenset((token_end,)))

2825

2185

token_duration = Token(re.compile(r"P"), None,

2826

2186

frozenset((token_year, token_month,

2827

2187

token_day, token_time,

2828

2188

token_week)))

2829

# Define starting values:

2830

# Value so far

2831

value = datetime.timedelta()

2189

# Define starting values

2190

value = datetime.timedelta() # Value so far

2832

2191

found_token = None

2833

# Following valid tokens

2834

followers = frozenset((token_duration, ))

2835

# String left to parse

2836

s = duration

2192

followers = frozenset((token_duration,)) # Following valid tokens

2193

s = duration # String left to parse

2837

2194

# Loop until end token is found

2838

2195

while found_token is not token_end:

2839

2196

# Search for any currently valid tokens

2855

2212

break

2856

2213

else:

2857

2214

# No currently valid tokens were found

2858

raise ValueError("Invalid RFC 3339 duration: {!r}"

2859

.format(duration))

2215

raise ValueError("Invalid RFC 3339 duration")

2860

2216

# End token found

2861

2217

return value

2862

2218

2863

2219

2864

2220

def string_to_delta(interval):

2865

2221

"""Parse a string and return a datetime.timedelta

2866

2867

>>> string_to_delta('7d') == datetime.timedelta(7)

2868

True

2869

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2870

True

2871

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2872

True

2873

>>> string_to_delta('24h') == datetime.timedelta(1)

2874

True

2875

>>> string_to_delta('1w') == datetime.timedelta(7)

2876

True

2877

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2878

True

2222

2223

>>> string_to_delta('7d')

2224

datetime.timedelta(7)

2225

>>> string_to_delta('60s')

2226

datetime.timedelta(0, 60)

2227

>>> string_to_delta('60m')

2228

datetime.timedelta(0, 3600)

2229

>>> string_to_delta('24h')

2230

datetime.timedelta(1)

2231

>>> string_to_delta('1w')

2232

datetime.timedelta(7)

2233

>>> string_to_delta('5m 30s')

2234

datetime.timedelta(0, 330)

2879

2235

"""

2880

2236

2881

2237

try:

2882

2238

return rfc3339_duration_to_delta(interval)

2883

2239

except ValueError:

2884

2240

pass

2885

2241

2886

2242

timevalue = datetime.timedelta(0)

2887

2243

for s in interval.split():

2888

2244

try:

2899

2255

elif suffix == "w":

2900

2256

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2901

2257

else:

2902

raise ValueError("Unknown suffix {!r}".format(suffix))

2258

raise ValueError("Unknown suffix {!r}"

2259

.format(suffix))

2903

2260

except IndexError as e:

2904

2261

raise ValueError(*(e.args))

2905

2262

timevalue += delta

2906

2263

return timevalue

2907

2264

2908

2265

2909

def daemon(nochdir=False, noclose=False):

2266

def daemon(nochdir = False, noclose = False):

2910

2267

"""See daemon(3). Standard BSD Unix function.

2911

2268

2912

2269

This should really exist as os.daemon, but it doesn't (yet)."""

2913

2270

if os.fork():

2914

2271

sys.exit()

2921

2278

# Close all standard open file descriptors

2922

2279

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2923

2280

if not stat.S_ISCHR(os.fstat(null).st_mode):

2924

raise OSError(errno.ENODEV,

2925

"{} not a character device"

2281

raise OSError(errno.ENODEV, "{} not a character device"

2926

2282

.format(os.devnull))

2927

2283

os.dup2(null, sys.stdin.fileno())

2928

2284

os.dup2(null, sys.stdout.fileno())

2932

2288

2933

2289

2934

2290

def main():

2935

2291

2936

2292

##################################################################

2937

2293

# Parsing of options, both command line and config file

2938

2294

2939

2295

parser = argparse.ArgumentParser()

2940

2296

parser.add_argument("-v", "--version", action="version",

2941

version="%(prog)s {}".format(version),

2297

version = "%(prog)s {}".format(version),

2942

2298

help="show version number and exit")

2943

2299

parser.add_argument("-i", "--interface", metavar="IF",

2944

2300

help="Bind to interface IF")

2980

2336

parser.add_argument("--no-zeroconf", action="store_false",

2981

2337

dest="zeroconf", help="Do not use Zeroconf",

2982

2338

default=None)

2983

2339

2984

2340

options = parser.parse_args()

2985

2341

2342

if options.check:

2343

import doctest

2344

fail_count, test_count = doctest.testmod()

2345

sys.exit(os.EX_OK if fail_count == 0 else 1)

2346

2986

2347

# Default values for config file for server-global settings

2987

if gnutls.has_rawpk:

2988

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2989

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2990

else:

2991

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2992

":+SIGN-DSA-SHA256")

2993

server_defaults = {"interface": "",

2994

"address": "",

2995

"port": "",

2996

"debug": "False",

2997

"priority": priority,

2998

"servicename": "Mandos",

2999

"use_dbus": "True",

3000

"use_ipv6": "True",

3001

"debuglevel": "",

3002

"restore": "True",

3003

"socket": "",

3004

"statedir": "/var/lib/mandos",

3005

"foreground": "False",

3006

"zeroconf": "True",

3007

}

3008

del priority

3009

2348

server_defaults = { "interface": "",

2349

"address": "",

2350

"port": "",

2351

"debug": "False",

2352

"priority":

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2354

"servicename": "Mandos",

2355

"use_dbus": "True",

2356

"use_ipv6": "True",

2357

"debuglevel": "",

2358

"restore": "True",

2359

"socket": "",

2360

"statedir": "/var/lib/mandos",

2361

"foreground": "False",

2362

"zeroconf": "True",

2363

}

2364

3010

2365

# Parse config file for server-global settings

3011

server_config = configparser.ConfigParser(server_defaults)

2366

server_config = configparser.SafeConfigParser(server_defaults)

3012

2367

del server_defaults

3013

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3014

# Convert the ConfigParser object to a dict

2368

server_config.read(os.path.join(options.configdir,

2369

"mandos.conf"))

2370

# Convert the SafeConfigParser object to a dict

3015

2371

server_settings = server_config.defaults()

3016

2372

# Use the appropriate methods on the non-string config options

3017

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3018

"foreground", "zeroconf"):

2373

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3019

2374

server_settings[option] = server_config.getboolean("DEFAULT",

3020

2375

option)

3021

2376

if server_settings["port"]:

3031

2386

server_settings["socket"] = os.dup(server_settings

3032

2387

["socket"])

3033

2388

del server_config

3034

2389

3035

2390

# Override the settings from the config file with command line

3036

2391

# options, if set.

3037

2392

for option in ("interface", "address", "port", "debug",

3038

"priority", "servicename", "configdir", "use_dbus",

3039

"use_ipv6", "debuglevel", "restore", "statedir",

3040

"socket", "foreground", "zeroconf"):

2393

"priority", "servicename", "configdir",

2394

"use_dbus", "use_ipv6", "debuglevel", "restore",

2395

"statedir", "socket", "foreground", "zeroconf"):

3041

2396

value = getattr(options, option)

3042

2397

if value is not None:

3043

2398

server_settings[option] = value

3055

2410

if server_settings["debug"]:

3056

2411

server_settings["foreground"] = True

3057

2412

# Now we have our good server settings in "server_settings"

3058

2413

3059

2414

##################################################################

3060

3061

if (not server_settings["zeroconf"]

3062

and not (server_settings["port"]

3063

or server_settings["socket"] != "")):

3064

parser.error("Needs port or socket to work without Zeroconf")

3065

2415

2416

if (not server_settings["zeroconf"] and

2417

not (server_settings["port"]

2418

or server_settings["socket"] != "")):

2419

parser.error("Needs port or socket to work without"

2420

" Zeroconf")

2421

3066

2422

# For convenience

3067

2423

debug = server_settings["debug"]

3068

2424

debuglevel = server_settings["debuglevel"]

3072

2428

stored_state_file)

3073

2429

foreground = server_settings["foreground"]

3074

2430

zeroconf = server_settings["zeroconf"]

3075

2431

3076

2432

if debug:

3077

2433

initlogger(debug, logging.DEBUG)

3078

2434

else:

3081

2437

else:

3082

2438

level = getattr(logging, debuglevel.upper())

3083

2439

initlogger(debug, level)

3084

2440

3085

2441

if server_settings["servicename"] != "Mandos":

3086

syslogger.setFormatter(

3087

logging.Formatter('Mandos ({}) [%(process)d]:'

3088

' %(levelname)s: %(message)s'.format(

3089

server_settings["servicename"])))

3090

2442

syslogger.setFormatter(logging.Formatter

2443

('Mandos ({}) [%(process)d]:'

2444

' %(levelname)s: %(message)s'

2445

.format(server_settings

2446

["servicename"])))

2447

3091

2448

# Parse config file with clients

3092

client_config = configparser.ConfigParser(Client.client_defaults)

2449

client_config = configparser.SafeConfigParser(Client

2450

.client_defaults)

3093

2451

client_config.read(os.path.join(server_settings["configdir"],

3094

2452

"clients.conf"))

3095

2453

3096

2454

global mandos_dbus_service

3097

2455

mandos_dbus_service = None

3098

2456

3099

2457

socketfd = None

3100

2458

if server_settings["socket"] != "":

3101

2459

socketfd = server_settings["socket"]

3102

tcp_server = MandosServer(

3103

(server_settings["address"], server_settings["port"]),

3104

ClientHandler,

3105

interface=(server_settings["interface"] or None),

3106

use_ipv6=use_ipv6,

3107

gnutls_priority=server_settings["priority"],

3108

use_dbus=use_dbus,

3109

socketfd=socketfd)

2460

tcp_server = MandosServer((server_settings["address"],

2461

server_settings["port"]),

2462

ClientHandler,

2463

interface=(server_settings["interface"]

2464

or None),

2465

use_ipv6=use_ipv6,

2466

gnutls_priority=

2467

server_settings["priority"],

2468

use_dbus=use_dbus,

2469

socketfd=socketfd)

3110

2470

if not foreground:

3111

2471

pidfilename = "/run/mandos.pid"

3112

2472

if not os.path.isdir("/run/."):

3113

2473

pidfilename = "/var/run/mandos.pid"

3114

2474

pidfile = None

3115

2475

try:

3116

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2476

pidfile = open(pidfilename, "w")

3117

2477

except IOError as e:

3118

2478

logger.error("Could not open file %r", pidfilename,

3119

2479

exc_info=e)

3120

3121

for name, group in (("_mandos", "_mandos"),

3122

("mandos", "mandos"),

3123

("nobody", "nogroup")):

2480

2481

for name in ("_mandos", "mandos", "nobody"):

3124

2482

try:

3125

2483

uid = pwd.getpwnam(name).pw_uid

3126

gid = pwd.getpwnam(group).pw_gid

2484

gid = pwd.getpwnam(name).pw_gid

3127

2485

break

3128

2486

except KeyError:

3129

2487

continue

3133

2491

try:

3134

2492

os.setgid(gid)

3135

2493

os.setuid(uid)

3136

if debug:

3137

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3138

gid))

3139

2494

except OSError as error:

3140

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3141

.format(uid, gid, os.strerror(error.errno)))

3142

2495

if error.errno != errno.EPERM:

3143

2496

raise

3144

2497

3145

2498

if debug:

3146

2499

# Enable all possible GnuTLS debugging

3147

2500

3148

2501

# "Use a log level over 10 to enable all debugging options."

3149

2502

# - GnuTLS manual

3150

gnutls.global_set_log_level(11)

3151

3152

@gnutls.log_func

2503

gnutls.library.functions.gnutls_global_set_log_level(11)

2504

2505

@gnutls.library.types.gnutls_log_func

3153

2506

def debug_gnutls(level, string):

3154

2507

logger.debug("GnuTLS: %s", string[:-1])

3155

3156

gnutls.global_set_log_function(debug_gnutls)

3157

2508

2509

(gnutls.library.functions

2510

.gnutls_global_set_log_function(debug_gnutls))

2511

3158

2512

# Redirect stdin so all checkers get /dev/null

3159

2513

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3160

2514

os.dup2(null, sys.stdin.fileno())

3161

2515

if null > 2:

3162

2516

os.close(null)

3163

2517

3164

2518

# Need to fork before connecting to D-Bus

3165

2519

if not foreground:

3166

2520

# Close all input and output, do double fork, etc.

3167

2521

daemon()

3168

3169

if gi.version_info < (3, 10, 2):

3170

# multiprocessing will use threads, so before we use GLib we

3171

# need to inform GLib that threads will be used.

3172

GLib.threads_init()

3173

2522

2523

# multiprocessing will use threads, so before we use gobject we

2524

# need to inform gobject that threads will be used.

2525

gobject.threads_init()

2526

3174

2527

global main_loop

3175

2528

# From the Avahi example code

3176

2529

DBusGMainLoop(set_as_default=True)

3177

main_loop = GLib.MainLoop()

2530

main_loop = gobject.MainLoop()

3178

2531

bus = dbus.SystemBus()

3179

2532

# End of Avahi example code

3180

2533

if use_dbus:

3181

2534

try:

3182

2535

bus_name = dbus.service.BusName("se.recompile.Mandos",

3183

bus,

3184

do_not_queue=True)

3185

old_bus_name = dbus.service.BusName(

3186

"se.bsnet.fukt.Mandos", bus,

3187

do_not_queue=True)

3188

except dbus.exceptions.DBusException as e:

2536

bus, do_not_queue=True)

2537

old_bus_name = (dbus.service.BusName

2538

("se.bsnet.fukt.Mandos", bus,

2539

do_not_queue=True))

2540

except dbus.exceptions.NameExistsException as e:

3189

2541

logger.error("Disabling D-Bus:", exc_info=e)

3190

2542

use_dbus = False

3191

2543

server_settings["use_dbus"] = False

3192

2544

tcp_server.use_dbus = False

3193

2545

if zeroconf:

3194

2546

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3195

service = AvahiServiceToSyslog(

3196

name=server_settings["servicename"],

3197

servicetype="_mandos._tcp",

3198

protocol=protocol,

3199

bus=bus)

2547

service = AvahiServiceToSyslog(name =

2548

server_settings["servicename"],

2549

servicetype = "_mandos._tcp",

2550

protocol = protocol, bus = bus)

3200

2551

if server_settings["interface"]:

3201

service.interface = if_nametoindex(

3202

server_settings["interface"].encode("utf-8"))

3203

2552

service.interface = (if_nametoindex

2553

(server_settings["interface"]

2554

.encode("utf-8")))

2555

3204

2556

global multiprocessing_manager

3205

2557

multiprocessing_manager = multiprocessing.Manager()

3206

2558

3207

2559

client_class = Client

3208

2560

if use_dbus:

3209

client_class = functools.partial(ClientDBus, bus=bus)

3210

2561

client_class = functools.partial(ClientDBus, bus = bus)

2562

3211

2563

client_settings = Client.config_parser(client_config)

3212

2564

old_client_settings = {}

3213

2565

clients_data = {}

3214

2566

3215

2567

# This is used to redirect stdout and stderr for checker processes

3216

2568

global wnull

3217

wnull = open(os.devnull, "w") # A writable /dev/null

2569

wnull = open(os.devnull, "w") # A writable /dev/null

3218

2570

# Only used if server is running in foreground but not in debug

3219

2571

# mode

3220

2572

if debug or not foreground:

3221

2573

wnull.close()

3222

2574

3223

2575

# Get client data and settings from last running state.

3224

2576

if server_settings["restore"]:

3225

2577

try:

3226

2578

with open(stored_state_path, "rb") as stored_state:

3227

if sys.version_info.major == 2:

3228

clients_data, old_client_settings = pickle.load(

3229

stored_state)

3230

else:

3231

bytes_clients_data, bytes_old_client_settings = (

3232

pickle.load(stored_state, encoding="bytes"))

3233

# Fix bytes to strings

3234

# clients_data

3235

# .keys()

3236

clients_data = {(key.decode("utf-8")

3237

if isinstance(key, bytes)

3238

else key): value

3239

for key, value in

3240

bytes_clients_data.items()}

3241

del bytes_clients_data

3242

for key in clients_data:

3243

value = {(k.decode("utf-8")

3244

if isinstance(k, bytes) else k): v

3245

for k, v in

3246

clients_data[key].items()}

3247

clients_data[key] = value

3248

# .client_structure

3249

value["client_structure"] = [

3250

(s.decode("utf-8")

3251

if isinstance(s, bytes)

3252

else s) for s in

3253

value["client_structure"]]

3254

# .name, .host, and .checker_command

3255

for k in ("name", "host", "checker_command"):

3256

if isinstance(value[k], bytes):

3257

value[k] = value[k].decode("utf-8")

3258

if "key_id" not in value:

3259

value["key_id"] = ""

3260

elif "fingerprint" not in value:

3261

value["fingerprint"] = ""

3262

# old_client_settings

3263

# .keys()

3264

old_client_settings = {

3265

(key.decode("utf-8")

3266

if isinstance(key, bytes)

3267

else key): value

3268

for key, value in

3269

bytes_old_client_settings.items()}

3270

del bytes_old_client_settings

3271

# .host and .checker_command

3272

for value in old_client_settings.values():

3273

for attribute in ("host", "checker_command"):

3274

if isinstance(value[attribute], bytes):

3275

value[attribute] = (value[attribute]

3276

.decode("utf-8"))

2579

clients_data, old_client_settings = (pickle.load

2580

(stored_state))

3277

2581

os.remove(stored_state_path)

3278

2582

except IOError as e:

3279

2583

if e.errno == errno.ENOENT:

3280

logger.warning("Could not load persistent state:"

3281

" {}".format(os.strerror(e.errno)))

2584

logger.warning("Could not load persistent state: {}"

2585

.format(os.strerror(e.errno)))

3282

2586

else:

3283

2587

logger.critical("Could not load persistent state:",

3284

2588

exc_info=e)

3285

2589

raise

3286

2590

except EOFError as e:

3287

2591

logger.warning("Could not load persistent state: "

3288

"EOFError:",

3289

exc_info=e)

3290

2592

"EOFError:", exc_info=e)

2593

3291

2594

with PGPEngine() as pgp:

3292

2595

for client_name, client in clients_data.items():

3293

2596

# Skip removed clients

3294

2597

if client_name not in client_settings:

3295

2598

continue

3296

2599

3297

2600

# Decide which value to use after restoring saved state.

3298

2601

# We have three different values: Old config file,

3299

2602

# new config file, and saved state.

3304

2607

# For each value in new config, check if it

3305

2608

# differs from the old config value (Except for

3306

2609

# the "secret" attribute)

3307

if (name != "secret"

3308

and (value !=

3309

old_client_settings[client_name][name])):

2610

if (name != "secret" and

2611

value != old_client_settings[client_name]

2612

[name]):

3310

2613

client[name] = value

3311

2614

except KeyError:

3312

2615

pass

3313

2616

3314

2617

# Clients who has passed its expire date can still be

3315

# enabled if its last checker was successful. A Client

2618

# enabled if its last checker was successful. Clients

3316

2619

# whose checker succeeded before we stored its state is

3317

2620

# assumed to have successfully run all checkers during

3318

2621

# downtime.

3321

2624

if not client["last_checked_ok"]:

3322

2625

logger.warning(

3323

2626

"disabling client {} - Client never "

3324

"performed a successful checker".format(

3325

client_name))

2627

"performed a successful checker"

2628

.format(client_name))

3326

2629

client["enabled"] = False

3327

2630

elif client["last_checker_status"] != 0:

3328

2631

logger.warning(

3329

2632

"disabling client {} - Client last"

3330

" checker failed with error code"

3331

" {}".format(

3332

client_name,

3333

client["last_checker_status"]))

2633

" checker failed with error code {}"

2634

.format(client_name,

2635

client["last_checker_status"]))

3334

2636

client["enabled"] = False

3335

2637

else:

3336

client["expires"] = (

3337

datetime.datetime.utcnow()

3338

+ client["timeout"])

2638

client["expires"] = (datetime.datetime

2639

.utcnow()

2640

+ client["timeout"])

3339

2641

logger.debug("Last checker succeeded,"

3340

" keeping {} enabled".format(

3341

client_name))

2642

" keeping {} enabled"

2643

.format(client_name))

3342

2644

try:

3343

client["secret"] = pgp.decrypt(

3344

client["encrypted_secret"],

3345

client_settings[client_name]["secret"])

2645

client["secret"] = (

2646

pgp.decrypt(client["encrypted_secret"],

2647

client_settings[client_name]

2648

["secret"]))

3346

2649

except PGPError:

3347

2650

# If decryption fails, we use secret from new settings

3348

logger.debug("Failed to decrypt {} old secret".format(

3349

client_name))

3350

client["secret"] = (client_settings[client_name]

3351

["secret"])

3352

2651

logger.debug("Failed to decrypt {} old secret"

2652

.format(client_name))

2653

client["secret"] = (

2654

client_settings[client_name]["secret"])

2655

3353

2656

# Add/remove clients based on new changes made to config

3354

2657

for client_name in (set(old_client_settings)

3355

2658

- set(client_settings)):

3357

2660

for client_name in (set(client_settings)

3358

2661

- set(old_client_settings)):

3359

2662

clients_data[client_name] = client_settings[client_name]

3360

2663

3361

2664

# Create all client objects

3362

2665

for client_name, client in clients_data.items():

3363

2666

tcp_server.clients[client_name] = client_class(

3364

name=client_name,

3365

settings=client,

3366

server_settings=server_settings)

3367

2667

name = client_name, settings = client,

2668

server_settings = server_settings)

2669

3368

2670

if not tcp_server.clients:

3369

2671

logger.warning("No clients defined")

3370

2672

3371

2673

if not foreground:

3372

2674

if pidfile is not None:

3373

pid = os.getpid()

3374

2675

try:

3375

2676

with pidfile:

3376

print(pid, file=pidfile)

2677

pid = os.getpid()

2678

pidfile.write("{}\n".format(pid).encode("utf-8"))

3377

2679

except IOError:

3378

2680

logger.error("Could not write to file %r with PID %d",

3379

2681

pidfilename, pid)

3380

2682

del pidfile

3381

2683

del pidfilename

3382

3383

for termsig in (signal.SIGHUP, signal.SIGTERM):

3384

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3385

lambda: main_loop.quit() and False)

3386

2684

2685

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2686

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2687

3387

2688

if use_dbus:

3388

3389

@alternate_dbus_interfaces(

3390

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3391

class MandosDBusService(DBusObjectWithObjectManager):

2689

@alternate_dbus_interfaces({"se.recompile.Mandos":

2690

"se.bsnet.fukt.Mandos"})

2691

class MandosDBusService(DBusObjectWithProperties):

3392

2692

"""A D-Bus proxy object"""

3393

3394

2693

def __init__(self):

3395

2694

dbus.service.Object.__init__(self, bus, "/")

3396

3397

2695

_interface = "se.recompile.Mandos"

3398

2696

2697

@dbus_interface_annotations(_interface)

2698

def _foo(self):

2699

return { "org.freedesktop.DBus.Property"

2700

".EmitsChangedSignal":

2701

"false"}

2702

3399

2703

@dbus.service.signal(_interface, signature="o")

3400

2704

def ClientAdded(self, objpath):

3401

2705

"D-Bus signal"

3402

2706

pass

3403

2707

3404

2708

@dbus.service.signal(_interface, signature="ss")

3405

def ClientNotFound(self, key_id, address):

2709

def ClientNotFound(self, fingerprint, address):

3406

2710

"D-Bus signal"

3407

2711

pass

3408

3409

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3410

"true"})

2712

3411

2713

@dbus.service.signal(_interface, signature="os")

3412

2714

def ClientRemoved(self, objpath, name):

3413

2715

"D-Bus signal"

3414

2716

pass

3415

3416

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3417

"true"})

2717

3418

2718

@dbus.service.method(_interface, out_signature="ao")

3419

2719

def GetAllClients(self):

3420

2720

"D-Bus method"

3421

return dbus.Array(c.dbus_object_path for c in

3422

tcp_server.clients.values())

3423

3424

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3425

"true"})

2721

return dbus.Array(c.dbus_object_path

2722

for c in

2723

tcp_server.clients.itervalues())

2724

3426

2725

@dbus.service.method(_interface,

3427

2726

out_signature="a{oa{sv}}")

3428

2727

def GetAllClientsWithProperties(self):

3429

2728

"D-Bus method"

3430

2729

return dbus.Dictionary(

3431

{c.dbus_object_path: c.GetAll(

3432

"se.recompile.Mandos.Client")

3433

for c in tcp_server.clients.values()},

2730

{ c.dbus_object_path: c.GetAll("")

2731

for c in tcp_server.clients.itervalues() },

3434

2732

signature="oa{sv}")

3435

2733

3436

2734

@dbus.service.method(_interface, in_signature="o")

3437

2735

def RemoveClient(self, object_path):

3438

2736

"D-Bus method"

3439

for c in tcp_server.clients.values():

2737

for c in tcp_server.clients.itervalues():

3440

2738

if c.dbus_object_path == object_path:

3441

2739

del tcp_server.clients[c.name]

3442

2740

c.remove_from_connection()

3443

# Don't signal the disabling

2741

# Don't signal anything except ClientRemoved

3444

2742

c.disable(quiet=True)

3445

# Emit D-Bus signal for removal

3446

self.client_removed_signal(c)

2743

# Emit D-Bus signal

2744

self.ClientRemoved(object_path, c.name)

3447

2745

return

3448

2746

raise KeyError(object_path)

3449

2747

3450

2748

del _interface

3451

3452

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3453

out_signature="a{oa{sa{sv}}}")

3454

def GetManagedObjects(self):

3455

"""D-Bus method"""

3456

return dbus.Dictionary(

3457

{client.dbus_object_path:

3458

dbus.Dictionary(

3459

{interface: client.GetAll(interface)

3460

for interface in

3461

client._get_all_interface_names()})

3462

for client in tcp_server.clients.values()})

3463

3464

def client_added_signal(self, client):

3465

"""Send the new standard signal and the old signal"""

3466

if use_dbus:

3467

# New standard signal

3468

self.InterfacesAdded(

3469

client.dbus_object_path,

3470

dbus.Dictionary(

3471

{interface: client.GetAll(interface)

3472

for interface in

3473

client._get_all_interface_names()}))

3474

# Old signal

3475

self.ClientAdded(client.dbus_object_path)

3476

3477

def client_removed_signal(self, client):

3478

"""Send the new standard signal and the old signal"""

3479

if use_dbus:

3480

# New standard signal

3481

self.InterfacesRemoved(

3482

client.dbus_object_path,

3483

client._get_all_interface_names())

3484

# Old signal

3485

self.ClientRemoved(client.dbus_object_path,

3486

client.name)

3487

2749

3488

2750

mandos_dbus_service = MandosDBusService()

3489

3490

# Save modules to variables to exempt the modules from being

3491

# unloaded before the function registered with atexit() is run.

3492

mp = multiprocessing

3493

wn = wnull

3494

2751

3495

2752

def cleanup():

3496

2753

"Cleanup function; run on exit"

3497

2754

if zeroconf:

3498

2755

service.cleanup()

3499

3500

mp.active_children()

3501

wn.close()

2756

2757

multiprocessing.active_children()

2758

wnull.close()

3502

2759

if not (tcp_server.clients or client_settings):

3503

2760

return

3504

2761

3505

2762

# Store client before exiting. Secrets are encrypted with key

3506

2763

# based on what config file has. If config file is

3507

2764

# removed/edited, old secret will thus be unrecovable.

3508

2765

clients = {}

3509

2766

with PGPEngine() as pgp:

3510

for client in tcp_server.clients.values():

2767

for client in tcp_server.clients.itervalues():

3511

2768

key = client_settings[client.name]["secret"]

3512

2769

client.encrypted_secret = pgp.encrypt(client.secret,

3513

2770

key)

3514

2771

client_dict = {}

3515

2772

3516

2773

# A list of attributes that can not be pickled

3517

2774

# + secret.

3518

exclude = {"bus", "changedstate", "secret",

3519

"checker", "server_settings"}

3520

for name, typ in inspect.getmembers(dbus.service

3521

.Object):

2775

exclude = { "bus", "changedstate", "secret",

2776

"checker", "server_settings" }

2777

for name, typ in (inspect.getmembers

2778

(dbus.service.Object)):

3522

2779

exclude.add(name)

3523

2780

3524

2781

client_dict["encrypted_secret"] = (client

3525

2782

.encrypted_secret)

3526

2783

for attr in client.client_structure:

3527

2784

if attr not in exclude:

3528

2785

client_dict[attr] = getattr(client, attr)

3529

2786

3530

2787

clients[client.name] = client_dict

3531

2788

del client_settings[client.name]["secret"]

3532

2789

3533

2790

try:

3534

with tempfile.NamedTemporaryFile(

3535

mode='wb',

3536

suffix=".pickle",

3537

prefix='clients-',

3538

dir=os.path.dirname(stored_state_path),

3539

delete=False) as stored_state:

3540

pickle.dump((clients, client_settings), stored_state,

3541

protocol=2)

3542

tempname = stored_state.name

2791

with (tempfile.NamedTemporaryFile

2792

(mode='wb', suffix=".pickle", prefix='clients-',

2793

dir=os.path.dirname(stored_state_path),

2794

delete=False)) as stored_state:

2795

pickle.dump((clients, client_settings), stored_state)

2796

tempname=stored_state.name

3543

2797

os.rename(tempname, stored_state_path)

3544

2798

except (IOError, OSError) as e:

3545

2799

if not debug:

3554

2808

logger.warning("Could not save persistent state:",

3555

2809

exc_info=e)

3556

2810

raise

3557

2811

3558

2812

# Delete all clients, and settings from config

3559

2813

while tcp_server.clients:

3560

2814

name, client = tcp_server.clients.popitem()

3561

2815

if use_dbus:

3562

2816

client.remove_from_connection()

3563

# Don't signal the disabling

2817

# Don't signal anything except ClientRemoved

3564

2818

client.disable(quiet=True)

3565

# Emit D-Bus signal for removal

3566

2819

if use_dbus:

3567

mandos_dbus_service.client_removed_signal(client)

2820

# Emit D-Bus signal

2821

mandos_dbus_service.ClientRemoved(client

2822

.dbus_object_path,

2823

client.name)

3568

2824

client_settings.clear()

3569

2825

3570

2826

atexit.register(cleanup)

3571

3572

for client in tcp_server.clients.values():

2827

2828

for client in tcp_server.clients.itervalues():

3573

2829

if use_dbus:

3574

# Emit D-Bus signal for adding

3575

mandos_dbus_service.client_added_signal(client)

2830

# Emit D-Bus signal

2831

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3576

2832

# Need to initiate checking of clients

3577

2833

if client.enabled:

3578

2834

client.init_checker()

3579

2835

3580

2836

tcp_server.enable()

3581

2837

tcp_server.server_activate()

3582

2838

3583

2839

# Find out what port we got

3584

2840

if zeroconf:

3585

2841

service.port = tcp_server.socket.getsockname()[1]

3590

2846

else: # IPv4

3591

2847

logger.info("Now listening on address %r, port %d",

3592

2848

*tcp_server.socket.getsockname())

3593

3594

# service.interface = tcp_server.socket.getsockname()[3]

3595

2849

2850

#service.interface = tcp_server.socket.getsockname()[3]

2851

3596

2852

try:

3597

2853

if zeroconf:

3598

2854

# From the Avahi example code

3603

2859

cleanup()

3604

2860

sys.exit(1)

3605

2861

# End of Avahi example code

3606

3607

GLib.io_add_watch(

3608

GLib.IOChannel.unix_new(tcp_server.fileno()),

3609

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3610

lambda *args, **kwargs: (tcp_server.handle_request

3611

(*args[2:], **kwargs) or True))

3612

2862

2863

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2864

lambda *args, **kwargs:

2865

(tcp_server.handle_request

2866

(*args[2:], **kwargs) or True))

2867

3613

2868

logger.debug("Starting main loop")

3614

2869

main_loop.run()

3615

2870

except AvahiError as error:

3624

2879

# Must run before the D-Bus bus name gets deregistered

3625

2880

cleanup()

3626

2881

3627

3628

def should_only_run_tests():

3629

parser = argparse.ArgumentParser(add_help=False)

3630

parser.add_argument("--check", action='store_true')

3631

args, unknown_args = parser.parse_known_args()

3632

run_tests = args.check

3633

if run_tests:

3634

# Remove --check argument from sys.argv

3635

sys.argv[1:] = unknown_args

3636

return run_tests

3637

3638

# Add all tests from doctest strings

3639

def load_tests(loader, tests, none):

3640

import doctest

3641

tests.addTests(doctest.DocTestSuite())

3642

return tests

3643

3644

2882

if __name__ == '__main__':

3645

try:

3646

if should_only_run_tests():

3647

# Call using ./mandos --check [--verbose]

3648

unittest.main()

3649

else:

3650

main()

3651

finally:

3652

logging.shutdown()

2883

main()