/mandos/trunk : revision 237.4.55

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

72

84

73

import dbus

85

74

import dbus.service

86

import gi

87

from gi.repository import GLib

75

import gobject

76

import avahi

88

77

from dbus.mainloop.glib import DBusGMainLoop

89

78

import ctypes

90

79

import ctypes.util

91

80

import xml.dom.minidom

92

81

import inspect

93

82

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

83

try:

122

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

85

except AttributeError:

124

86

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

87

from IN import SO_BINDTODEVICE

128

88

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.14"

89

SO_BINDTODEVICE = None

90

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

147

95

stored_state_file = "clients.pickle"

148

96

149

97

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

98

syslogger = None

152

99

153

100

try:

154

if_nametoindex = ctypes.cdll.LoadLibrary(

155

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

156

104

except (OSError, AttributeError):

157

158

105

def if_nametoindex(interface):

159

106

"Get an interface index the hard way, i.e. using fcntl()"

160

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

165

112

return interface_index

166

113

167

114

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

115

def initlogger(debug, level=logging.WARNING):

185

116

"""init logger and add loglevel"""

186

117

187

118

global syslogger

188

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

191

123

syslogger.setFormatter(logging.Formatter

192

124

('Mandos [%(process)d]: %(levelname)s:'

193

125

' %(message)s'))

194

126

logger.addHandler(syslogger)

195

127

196

128

if debug:

197

129

console = logging.StreamHandler()

198

130

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

208

140

pass

209

141

210

142

211

class PGPEngine:

143

class PGPEngine(object):

212

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

214

145

def __init__(self):

215

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

147

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

148

'--home', self.tempdir,

229

149

'--force-mdc',

230

'--quiet']

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

150

'--quiet',

151

'--no-use-agent']

152

235

153

def __enter__(self):

236

154

return self

237

155

238

156

def __exit__(self, exc_type, exc_value, traceback):

239

157

self._cleanup()

240

158

return False

241

159

242

160

def __del__(self):

243

161

self._cleanup()

244

162

245

163

def _cleanup(self):

246

164

if self.tempdir is not None:

247

165

# Delete contents of tempdir

248

166

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

167

topdown = False):

250

168

for filename in files:

251

169

os.remove(os.path.join(root, filename))

252

170

for dirname in dirs:

254

172

# Remove tempdir

255

173

os.rmdir(self.tempdir)

256

174

self.tempdir = None

257

175

258

176

def password_encode(self, password):

259

177

# Passphrase can not be empty and can not contain newlines or

260

178

# NUL bytes. So we prefix it and hex encode it.

265

183

.replace(b"\n", b"\\n")

266

184

.replace(b"\0", b"\\x00"))

267

185

return encoded

268

186

269

187

def encrypt(self, data, password):

270

188

passphrase = self.password_encode(password)

271

with tempfile.NamedTemporaryFile(

272

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

273

191

passfile.write(passphrase)

274

192

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

193

proc = subprocess.Popen(['gpg', '--symmetric',

276

194

'--passphrase-file',

277

195

passfile.name]

278

196

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

197

stdin = subprocess.PIPE,

198

stdout = subprocess.PIPE,

199

stderr = subprocess.PIPE)

200

ciphertext, err = proc.communicate(input = data)

283

201

if proc.returncode != 0:

284

202

raise PGPError(err)

285

203

return ciphertext

286

204

287

205

def decrypt(self, data, password):

288

206

passphrase = self.password_encode(password)

289

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

291

209

passfile.write(passphrase)

292

210

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

211

proc = subprocess.Popen(['gpg', '--decrypt',

294

212

'--passphrase-file',

295

213

passfile.name]

296

214

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

301

220

if proc.returncode != 0:

302

221

raise PGPError(err)

303

222

return decrypted_plaintext

304

223

305

224

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

225

class AvahiError(Exception):

333

226

def __init__(self, value, *args, **kwargs):

334

227

self.value = value

335

228

return super(AvahiError, self).__init__(value, *args,

336

229

**kwargs)

337

230

338

339

231

class AvahiServiceError(AvahiError):

340

232

pass

341

233

342

343

234

class AvahiGroupError(AvahiError):

344

235

pass

345

236

346

237

347

class AvahiService:

238

class AvahiService(object):

348

239

"""An Avahi (Zeroconf) service.

349

240

350

241

Attributes:

351

242

interface: integer; avahi.IF_UNSPEC or an interface index.

352

243

Used to optionally bind to the specified interface.

364

255

server: D-Bus Server

365

256

bus: dbus.SystemBus()

366

257

"""

367

368

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

258

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

379

263

self.interface = interface

380

264

self.name = name

381

265

self.type = servicetype

390

274

self.server = None

391

275

self.bus = bus

392

276

self.entry_group_state_changed_match = None

393

394

def rename(self, remove=True):

277

278

def rename(self):

395

279

"""Derived from the Avahi example code"""

396

280

if self.rename_count >= self.max_renames:

397

281

logger.critical("No suitable Zeroconf service name found"

398

282

" after %i retries, exiting.",

399

283

self.rename_count)

400

284

raise AvahiServiceError("Too many renames")

401

self.name = str(

402

self.server.GetAlternativeServiceName(self.name))

403

self.rename_count += 1

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

404

287

logger.info("Changing Zeroconf service name to %r ...",

405

288

self.name)

406

if remove:

407

self.remove()

289

self.remove()

408

290

try:

409

291

self.add()

410

292

except dbus.exceptions.DBusException as error:

411

if (error.get_dbus_name()

412

== "org.freedesktop.Avahi.CollisionError"):

413

logger.info("Local Zeroconf service name collision.")

414

return self.rename(remove=False)

415

else:

416

logger.critical("D-Bus Exception", exc_info=error)

417

self.cleanup()

418

os._exit(1)

419

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

297

420

298

def remove(self):

421

299

"""Derived from the Avahi example code"""

422

300

if self.entry_group_state_changed_match is not None:

424

302

self.entry_group_state_changed_match = None

425

303

if self.group is not None:

426

304

self.group.Reset()

427

305

428

306

def add(self):

429

307

"""Derived from the Avahi example code"""

430

308

self.remove()

447

325

dbus.UInt16(self.port),

448

326

avahi.string_array_to_txt_array(self.TXT))

449

327

self.group.Commit()

450

328

451

329

def entry_group_state_changed(self, state, error):

452

330

"""Derived from the Avahi example code"""

453

331

logger.debug("Avahi entry group state change: %i", state)

454

332

455

333

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

334

logger.debug("Zeroconf service established.")

457

335

elif state == avahi.ENTRY_GROUP_COLLISION:

460

338

elif state == avahi.ENTRY_GROUP_FAILURE:

461

339

logger.critical("Avahi: Error in group state changed %s",

462

340

str(error))

463

raise AvahiGroupError("State changed: {!s}".format(error))

464

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

343

465

344

def cleanup(self):

466

345

"""Derived from the Avahi example code"""

467

346

if self.group is not None:

472

351

pass

473

352

self.group = None

474

353

self.remove()

475

354

476

355

def server_state_changed(self, state, error=None):

477

356

"""Derived from the Avahi example code"""

478

357

logger.debug("Avahi server state change: %i", state)

479

bad_states = {

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

avahi.SERVER_REGISTERING: None,

482

avahi.SERVER_COLLISION: "Zeroconf server name collision",

483

avahi.SERVER_FAILURE: "Zeroconf server failure",

484

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

485

365

if state in bad_states:

486

366

if bad_states[state] is not None:

487

367

if error is None:

490

370

logger.error(bad_states[state] + ": %r", error)

491

371

self.cleanup()

492

372

elif state == avahi.SERVER_RUNNING:

493

try:

494

self.add()

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

logger.info("Local Zeroconf service name"

499

" collision.")

500

return self.rename(remove=False)

501

else:

502

logger.critical("D-Bus Exception", exc_info=error)

503

self.cleanup()

504

os._exit(1)

373

self.add()

505

374

else:

506

375

if error is None:

507

376

logger.debug("Unknown state: %r", state)

508

377

else:

509

378

logger.debug("Unknown state: %r: %r", state, error)

510

379

511

380

def activate(self):

512

381

"""Derived from the Avahi example code"""

513

382

if self.server is None:

517

386

follow_name_owner_changes=True),

518

387

avahi.DBUS_INTERFACE_SERVER)

519

388

self.server.connect_to_signal("StateChanged",

520

self.server_state_changed)

389

self.server_state_changed)

521

390

self.server_state_changed(self.server.GetState())

522

391

523

392

524

393

class AvahiServiceToSyslog(AvahiService):

525

def rename(self, *args, **kwargs):

394

def rename(self):

526

395

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

529

syslogger.setFormatter(logging.Formatter(

530

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

532

401

return ret

533

402

534

403

535

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

538

539

library = ctypes.util.find_library("gnutls")

540

if library is None:

541

library = ctypes.util.find_library("gnutls-deb0")

542

_library = ctypes.cdll.LoadLibrary(library)

543

del library

544

545

# Unless otherwise indicated, the constants and types below are

546

# all from the gnutls/gnutls.h C header file.

547

548

# Constants

549

E_SUCCESS = 0

550

E_INTERRUPTED = -52

551

E_AGAIN = -28

552

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

CLIENT = 2

555

SHUT_RDWR = 0

556

CRD_CERTIFICATE = 1

557

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

565

# Types

566

class session_int(ctypes.Structure):

567

_fields_ = []

568

session_t = ctypes.POINTER(session_int)

569

570

class certificate_credentials_st(ctypes.Structure):

571

_fields_ = []

572

certificate_credentials_t = ctypes.POINTER(

573

certificate_credentials_st)

574

certificate_type_t = ctypes.c_int

575

576

class datum_t(ctypes.Structure):

577

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

578

('size', ctypes.c_uint)]

579

580

class openpgp_crt_int(ctypes.Structure):

581

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

credentials_type_t = ctypes.c_int

586

transport_ptr_t = ctypes.c_void_p

587

close_request_t = ctypes.c_int

588

589

# Exceptions

590

class Error(Exception):

591

def __init__(self, message=None, code=None, args=()):

592

# Default usage is by a message string, but if a return

593

# code is passed, convert it to a string with

594

# gnutls.strerror()

595

self.code = code

596

if message is None and code is not None:

597

message = gnutls.strerror(code)

598

return super(gnutls.Error, self).__init__(

599

message, *args)

600

601

class CertificateSecurityError(Error):

602

pass

603

604

# Classes

605

class Credentials:

606

def __init__(self):

607

self._c_object = gnutls.certificate_credentials_t()

608

gnutls.certificate_allocate_credentials(

609

ctypes.byref(self._c_object))

610

self.type = gnutls.CRD_CERTIFICATE

611

612

def __del__(self):

613

gnutls.certificate_free_credentials(self._c_object)

614

615

class ClientSession:

616

def __init__(self, socket, credentials=None):

617

self._c_object = gnutls.session_t()

618

gnutls_flags = gnutls.CLIENT

619

if gnutls.check_version(b"3.5.6"):

620

gnutls_flags |= gnutls.NO_TICKETS

621

if gnutls.has_rawpk:

622

gnutls_flags |= gnutls.ENABLE_RAWPK

623

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

624

del gnutls_flags

625

gnutls.set_default_priority(self._c_object)

626

gnutls.transport_set_ptr(self._c_object, socket.fileno())

627

gnutls.handshake_set_private_extensions(self._c_object,

628

True)

629

self.socket = socket

630

if credentials is None:

631

credentials = gnutls.Credentials()

632

gnutls.credentials_set(self._c_object, credentials.type,

633

ctypes.cast(credentials._c_object,

634

ctypes.c_void_p))

635

self.credentials = credentials

636

637

def __del__(self):

638

gnutls.deinit(self._c_object)

639

640

def handshake(self):

641

return gnutls.handshake(self._c_object)

642

643

def send(self, data):

644

data = bytes(data)

645

data_len = len(data)

646

while data_len > 0:

647

data_len -= gnutls.record_send(self._c_object,

648

data[-data_len:],

649

data_len)

650

651

def bye(self):

652

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

653

654

# Error handling functions

655

def _error_code(result):

656

"""A function to raise exceptions on errors, suitable

657

for the 'restype' attribute on ctypes functions"""

658

if result >= 0:

659

return result

660

if result == gnutls.E_NO_CERTIFICATE_FOUND:

661

raise gnutls.CertificateSecurityError(code=result)

662

raise gnutls.Error(code=result)

663

664

def _retry_on_error(result, func, arguments):

665

"""A function to retry on some errors, suitable

666

for the 'errcheck' attribute on ctypes functions"""

667

while result < 0:

668

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

669

return _error_code(result)

670

result = func(*arguments)

671

return result

672

673

# Unless otherwise indicated, the function declarations below are

674

# all from the gnutls/gnutls.h C header file.

675

676

# Functions

677

priority_set_direct = _library.gnutls_priority_set_direct

678

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

679

ctypes.POINTER(ctypes.c_char_p)]

680

priority_set_direct.restype = _error_code

681

682

init = _library.gnutls_init

683

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

684

init.restype = _error_code

685

686

set_default_priority = _library.gnutls_set_default_priority

687

set_default_priority.argtypes = [session_t]

688

set_default_priority.restype = _error_code

689

690

record_send = _library.gnutls_record_send

691

record_send.argtypes = [session_t, ctypes.c_void_p,

692

ctypes.c_size_t]

693

record_send.restype = ctypes.c_ssize_t

694

record_send.errcheck = _retry_on_error

695

696

certificate_allocate_credentials = (

697

_library.gnutls_certificate_allocate_credentials)

698

certificate_allocate_credentials.argtypes = [

699

ctypes.POINTER(certificate_credentials_t)]

700

certificate_allocate_credentials.restype = _error_code

701

702

certificate_free_credentials = (

703

_library.gnutls_certificate_free_credentials)

704

certificate_free_credentials.argtypes = [

705

certificate_credentials_t]

706

certificate_free_credentials.restype = None

707

708

handshake_set_private_extensions = (

709

_library.gnutls_handshake_set_private_extensions)

710

handshake_set_private_extensions.argtypes = [session_t,

711

ctypes.c_int]

712

handshake_set_private_extensions.restype = None

713

714

credentials_set = _library.gnutls_credentials_set

715

credentials_set.argtypes = [session_t, credentials_type_t,

716

ctypes.c_void_p]

717

credentials_set.restype = _error_code

718

719

strerror = _library.gnutls_strerror

720

strerror.argtypes = [ctypes.c_int]

721

strerror.restype = ctypes.c_char_p

722

723

certificate_type_get = _library.gnutls_certificate_type_get

724

certificate_type_get.argtypes = [session_t]

725

certificate_type_get.restype = _error_code

726

727

certificate_get_peers = _library.gnutls_certificate_get_peers

728

certificate_get_peers.argtypes = [session_t,

729

ctypes.POINTER(ctypes.c_uint)]

730

certificate_get_peers.restype = ctypes.POINTER(datum_t)

731

732

global_set_log_level = _library.gnutls_global_set_log_level

733

global_set_log_level.argtypes = [ctypes.c_int]

734

global_set_log_level.restype = None

735

736

global_set_log_function = _library.gnutls_global_set_log_function

737

global_set_log_function.argtypes = [log_func]

738

global_set_log_function.restype = None

739

740

deinit = _library.gnutls_deinit

741

deinit.argtypes = [session_t]

742

deinit.restype = None

743

744

handshake = _library.gnutls_handshake

745

handshake.argtypes = [session_t]

746

handshake.restype = _error_code

747

handshake.errcheck = _retry_on_error

748

749

transport_set_ptr = _library.gnutls_transport_set_ptr

750

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

751

transport_set_ptr.restype = None

752

753

bye = _library.gnutls_bye

754

bye.argtypes = [session_t, close_request_t]

755

bye.restype = _error_code

756

bye.errcheck = _retry_on_error

757

758

check_version = _library.gnutls_check_version

759

check_version.argtypes = [ctypes.c_char_p]

760

check_version.restype = ctypes.c_char_p

761

762

_need_version = b"3.3.0"

763

if check_version(_need_version) is None:

764

raise self.Error("Needs GnuTLS {} or later"

765

.format(_need_version))

766

767

_tls_rawpk_version = b"3.6.6"

768

has_rawpk = bool(check_version(_tls_rawpk_version))

769

770

if has_rawpk:

771

# Types

772

class pubkey_st(ctypes.Structure):

773

_fields = []

774

pubkey_t = ctypes.POINTER(pubkey_st)

775

776

x509_crt_fmt_t = ctypes.c_int

777

778

# All the function declarations below are from

779

# gnutls/abstract.h

780

pubkey_init = _library.gnutls_pubkey_init

781

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

782

pubkey_init.restype = _error_code

783

784

pubkey_import = _library.gnutls_pubkey_import

785

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

786

x509_crt_fmt_t]

787

pubkey_import.restype = _error_code

788

789

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

790

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

791

ctypes.POINTER(ctypes.c_ubyte),

792

ctypes.POINTER(ctypes.c_size_t)]

793

pubkey_get_key_id.restype = _error_code

794

795

pubkey_deinit = _library.gnutls_pubkey_deinit

796

pubkey_deinit.argtypes = [pubkey_t]

797

pubkey_deinit.restype = None

798

else:

799

# All the function declarations below are from

800

# gnutls/openpgp.h

801

802

openpgp_crt_init = _library.gnutls_openpgp_crt_init

803

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

804

openpgp_crt_init.restype = _error_code

805

806

openpgp_crt_import = _library.gnutls_openpgp_crt_import

807

openpgp_crt_import.argtypes = [openpgp_crt_t,

808

ctypes.POINTER(datum_t),

809

openpgp_crt_fmt_t]

810

openpgp_crt_import.restype = _error_code

811

812

openpgp_crt_verify_self = \

813

_library.gnutls_openpgp_crt_verify_self

814

openpgp_crt_verify_self.argtypes = [

815

openpgp_crt_t,

816

ctypes.c_uint,

817

ctypes.POINTER(ctypes.c_uint),

818

]

819

openpgp_crt_verify_self.restype = _error_code

820

821

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

822

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

823

openpgp_crt_deinit.restype = None

824

825

openpgp_crt_get_fingerprint = (

826

_library.gnutls_openpgp_crt_get_fingerprint)

827

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

828

ctypes.c_void_p,

829

ctypes.POINTER(

830

ctypes.c_size_t)]

831

openpgp_crt_get_fingerprint.restype = _error_code

832

833

if check_version(b"3.6.4"):

834

certificate_type_get2 = _library.gnutls_certificate_type_get2

835

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

836

certificate_type_get2.restype = _error_code

837

838

# Remove non-public functions

839

del _error_code, _retry_on_error

840

841

842

def call_pipe(connection, # : multiprocessing.Connection

843

func, *args, **kwargs):

844

"""This function is meant to be called by multiprocessing.Process

845

846

This function runs func(*args, **kwargs), and writes the resulting

847

return value on the provided multiprocessing.Connection.

848

"""

849

connection.send(func(*args, **kwargs))

850

connection.close()

851

852

853

class Client:

404

class Client(object):

854

405

"""A representation of a client host served by this server.

855

406

856

407

Attributes:

857

408

approved: bool(); 'None' if not yet approved/disapproved

858

409

approval_delay: datetime.timedelta(); Time to wait for approval

859

410

approval_duration: datetime.timedelta(); Duration of one approval

860

checker: multiprocessing.Process(); a running checker process used

861

to see if the client lives. 'None' if no process is

862

running.

863

checker_callback_tag: a GLib event source tag, or None

411

checker: subprocess.Popen(); a running checker process used

412

to see if the client lives.

413

'None' if no process is running.

414

checker_callback_tag: a gobject event source tag, or None

864

415

checker_command: string; External command which is run to check

865

416

if client lives. %() expansions are done at

866

417

runtime with vars(self) as dict, so that for

867

418

instance %(name)s can be used in the command.

868

checker_initiator_tag: a GLib event source tag, or None

419

checker_initiator_tag: a gobject event source tag, or None

869

420

created: datetime.datetime(); (UTC) object creation

870

421

client_structure: Object describing what attributes a client has

871

422

and is used for storing the client at exit

872

423

current_checker_command: string; current running checker_command

873

disable_initiator_tag: a GLib event source tag, or None

424

disable_initiator_tag: a gobject event source tag, or None

874

425

enabled: bool()

875

426

fingerprint: string (40 or 32 hexadecimal digits); used to

876

uniquely identify an OpenPGP client

877

key_id: string (64 hexadecimal digits); used to uniquely identify

878

a client using raw public keys

427

uniquely identify the client

879

428

host: string; available for use by the checker command

880

429

interval: datetime.timedelta(); How often to start a new checker

881

430

last_approval_request: datetime.datetime(); (UTC) or None

883

432

last_checker_status: integer between 0 and 255 reflecting exit

884

433

status of last checker. -1 reflects crashed

885

434

checker, -2 means no checker completed yet.

886

last_checker_signal: The signal which killed the last checker, if

887

last_checker_status is -1

888

435

last_enabled: datetime.datetime(); (UTC) or None

889

436

name: string; from the config file, used in log messages and

890

437

D-Bus identifiers

897

444

disabled, or None

898

445

server_settings: The server_settings dict from main()

899

446

"""

900

447

901

448

runtime_expansions = ("approval_delay", "approval_duration",

902

"created", "enabled", "expires", "key_id",

449

"created", "enabled", "expires",

903

450

"fingerprint", "host", "interval",

904

451

"last_approval_request", "last_checked_ok",

905

452

"last_enabled", "name", "timeout")

906

client_defaults = {

907

"timeout": "PT5M",

908

"extended_timeout": "PT15M",

909

"interval": "PT2M",

910

"checker": "fping -q -- %%(host)s",

911

"host": "",

912

"approval_delay": "PT0S",

913

"approval_duration": "PT1S",

914

"approved_by_default": "True",

915

"enabled": "True",

916

}

917

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

463

918

464

@staticmethod

919

465

def config_parser(config):

920

466

"""Construct a new dict of client settings of this form:

927

473

for client_name in config.sections():

928

474

section = dict(config.items(client_name))

929

475

client = settings[client_name] = {}

930

476

931

477

client["host"] = section["host"]

932

478

# Reformat values from string types to Python types

933

479

client["approved_by_default"] = config.getboolean(

934

480

client_name, "approved_by_default")

935

481

client["enabled"] = config.getboolean(client_name,

936

482

"enabled")

937

938

# Uppercase and remove spaces from key_id and fingerprint

939

# for later comparison purposes with return value from the

940

# key_id() and fingerprint() functions

941

client["key_id"] = (section.get("key_id", "").upper()

942

.replace(" ", ""))

483

943

484

client["fingerprint"] = (section["fingerprint"].upper()

944

485

.replace(" ", ""))

945

486

if "secret" in section:

946

client["secret"] = codecs.decode(section["secret"]

947

.encode("utf-8"),

948

"base64")

487

client["secret"] = section["secret"].decode("base64")

949

488

elif "secfile" in section:

950

489

with open(os.path.expanduser(os.path.expandvars

951

490

(section["secfile"])),

966

505

client["last_approval_request"] = None

967

506

client["last_checked_ok"] = None

968

507

client["last_checker_status"] = -2

969

508

970

509

return settings

971

972

def __init__(self, settings, name=None, server_settings=None):

510

511

def __init__(self, settings, name = None, server_settings=None):

973

512

self.name = name

974

513

if server_settings is None:

975

514

server_settings = {}

977

516

# adding all client settings

978

517

for setting, value in settings.items():

979

518

setattr(self, setting, value)

980

519

981

520

if self.enabled:

982

521

if not hasattr(self, "last_enabled"):

983

522

self.last_enabled = datetime.datetime.utcnow()

987

526

else:

988

527

self.last_enabled = None

989

528

self.expires = None

990

529

991

530

logger.debug("Creating client %r", self.name)

992

logger.debug(" Key ID: %s", self.key_id)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

993

534

logger.debug(" Fingerprint: %s", self.fingerprint)

994

535

self.created = settings.get("created",

995

536

datetime.datetime.utcnow())

996

537

997

538

# attributes specific for this server instance

998

539

self.checker = None

999

540

self.checker_initiator_tag = None

1002

543

self.current_checker_command = None

1003

544

self.approved = None

1004

545

self.approvals_pending = 0

1005

self.changedstate = multiprocessing_manager.Condition(

1006

multiprocessing_manager.Lock())

1007

self.client_structure = [attr

1008

for attr in self.__dict__.keys()

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

1009

551

if not attr.startswith("_")]

1010

552

self.client_structure.append("client_structure")

1011

1012

for name, t in inspect.getmembers(

1013

type(self), lambda obj: isinstance(obj, property)):

553

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

1014

558

if not name.startswith("_"):

1015

559

self.client_structure.append(name)

1016

560

1017

561

# Send notice to process children that client state has changed

1018

562

def send_changedstate(self):

1019

563

with self.changedstate:

1020

564

self.changedstate.notify_all()

1021

565

1022

566

def enable(self):

1023

567

"""Start this client's checker and timeout hooks"""

1024

568

if getattr(self, "enabled", False):

1029

573

self.last_enabled = datetime.datetime.utcnow()

1030

574

self.init_checker()

1031

575

self.send_changedstate()

1032

576

1033

577

def disable(self, quiet=True):

1034

578

"""Disable this client."""

1035

579

if not getattr(self, "enabled", False):

1037

581

if not quiet:

1038

582

logger.info("Disabling client %s", self.name)

1039

583

if getattr(self, "disable_initiator_tag", None) is not None:

1040

GLib.source_remove(self.disable_initiator_tag)

584

gobject.source_remove(self.disable_initiator_tag)

1041

585

self.disable_initiator_tag = None

1042

586

self.expires = None

1043

587

if getattr(self, "checker_initiator_tag", None) is not None:

1044

GLib.source_remove(self.checker_initiator_tag)

588

gobject.source_remove(self.checker_initiator_tag)

1045

589

self.checker_initiator_tag = None

1046

590

self.stop_checker()

1047

591

self.enabled = False

1048

592

if not quiet:

1049

593

self.send_changedstate()

1050

# Do not run this again if called by a GLib.timeout_add

594

# Do not run this again if called by a gobject.timeout_add

1051

595

return False

1052

596

1053

597

def __del__(self):

1054

598

self.disable()

1055

599

1056

600

def init_checker(self):

1057

601

# Schedule a new checker to be started an 'interval' from now,

1058

602

# and every interval from then on.

1059

603

if self.checker_initiator_tag is not None:

1060

GLib.source_remove(self.checker_initiator_tag)

1061

self.checker_initiator_tag = GLib.timeout_add(

1062

random.randrange(int(self.interval.total_seconds() * 1000

1063

+ 1)),

1064

self.start_checker)

604

gobject.source_remove(self.checker_initiator_tag)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

1065

609

# Schedule a disable() when 'timeout' has passed

1066

610

if self.disable_initiator_tag is not None:

1067

GLib.source_remove(self.disable_initiator_tag)

1068

self.disable_initiator_tag = GLib.timeout_add(

1069

int(self.timeout.total_seconds() * 1000), self.disable)

611

gobject.source_remove(self.disable_initiator_tag)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

1070

616

# Also start a new checker *right now*.

1071

617

self.start_checker()

1072

1073

def checker_callback(self, source, condition, connection,

1074

command):

618

619

def checker_callback(self, pid, condition, command):

1075

620

"""The checker has completed, so take appropriate actions."""

1076

# Read return code from connection (see call_pipe)

1077

returncode = connection.recv()

1078

connection.close()

1079

if self.checker is not None:

1080

self.checker.join()

1081

621

self.checker_callback_tag = None

1082

622

self.checker = None

1083

1084

if returncode >= 0:

1085

self.last_checker_status = returncode

1086

self.last_checker_signal = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

1087

625

if self.last_checker_status == 0:

1088

626

logger.info("Checker for %(name)s succeeded",

1089

627

vars(self))

1090

628

self.checked_ok()

1091

629

else:

1092

logger.info("Checker for %(name)s failed", vars(self))

630

logger.info("Checker for %(name)s failed",

631

vars(self))

1093

632

else:

1094

633

self.last_checker_status = -1

1095

self.last_checker_signal = -returncode

1096

634

logger.warning("Checker for %(name)s crashed?",

1097

635

vars(self))

1098

return False

1099

636

1100

637

def checked_ok(self):

1101

638

"""Assert that the client has been seen, alive and well."""

1102

639

self.last_checked_ok = datetime.datetime.utcnow()

1103

640

self.last_checker_status = 0

1104

self.last_checker_signal = None

1105

641

self.bump_timeout()

1106

642

1107

643

def bump_timeout(self, timeout=None):

1108

644

"""Bump up the timeout for this client."""

1109

645

if timeout is None:

1110

646

timeout = self.timeout

1111

647

if self.disable_initiator_tag is not None:

1112

GLib.source_remove(self.disable_initiator_tag)

648

gobject.source_remove(self.disable_initiator_tag)

1113

649

self.disable_initiator_tag = None

1114

650

if getattr(self, "enabled", False):

1115

self.disable_initiator_tag = GLib.timeout_add(

1116

int(timeout.total_seconds() * 1000), self.disable)

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

1117

654

self.expires = datetime.datetime.utcnow() + timeout

1118

655

1119

656

def need_approval(self):

1120

657

self.last_approval_request = datetime.datetime.utcnow()

1121

658

1122

659

def start_checker(self):

1123

660

"""Start a new checker subprocess if one is not running.

1124

661

1125

662

If a checker already exists, leave it running and do

1126

663

nothing."""

1127

664

# The reason for not killing a running checker is that if we

1132

669

# checkers alone, the checker would have to take more time

1133

670

# than 'timeout' for the client to be disabled, which is as it

1134

671

# should be.

1135

1136

if self.checker is not None and not self.checker.is_alive():

1137

logger.warning("Checker was not alive; joining")

1138

self.checker.join()

1139

self.checker = None

672

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

1140

687

# Start a new checker if needed

1141

688

if self.checker is None:

1142

689

# Escape attributes for the shell

1143

escaped_attrs = {

1144

attr: shlex.quote(str(getattr(self, attr)))

1145

for attr in self.runtime_expansions}

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

1146

693

try:

1147

694

command = self.checker_command % escaped_attrs

1148

695

except TypeError as error:

1149

696

logger.error('Could not format string "%s"',

1150

self.checker_command,

697

self.checker_command, exc_info=error)

698

return True # Try again later

699

self.current_checker_command = command

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

# The exception is when not debugging but nevertheless

708

# running in the foreground; use the previously

709

# created wnull.

710

popen_args = {}

711

if (not self.server_settings["debug"]

712

and self.server_settings["foreground"]):

713

popen_args.update({"stdout": wnull,

714

"stderr": wnull })

715

self.checker = subprocess.Popen(command,

716

close_fds=True,

717

shell=True, cwd="/",

718

**popen_args)

719

except OSError as error:

720

logger.error("Failed to start subprocess",

1151

721

exc_info=error)

1152

return True # Try again later

1153

self.current_checker_command = command

1154

logger.info("Starting checker %r for %s", command,

1155

self.name)

1156

# We don't need to redirect stdout and stderr, since

1157

# in normal mode, that is already done by daemon(),

1158

# and in debug mode we don't want to. (Stdin is

1159

# always replaced by /dev/null.)

1160

# The exception is when not debugging but nevertheless

1161

# running in the foreground; use the previously

1162

# created wnull.

1163

popen_args = {"close_fds": True,

1164

"shell": True,

1165

"cwd": "/"}

1166

if (not self.server_settings["debug"]

1167

and self.server_settings["foreground"]):

1168

popen_args.update({"stdout": wnull,

1169

"stderr": wnull})

1170

pipe = multiprocessing.Pipe(duplex=False)

1171

self.checker = multiprocessing.Process(

1172

target=call_pipe,

1173

args=(pipe[1], subprocess.call, command),

1174

kwargs=popen_args)

1175

self.checker.start()

1176

self.checker_callback_tag = GLib.io_add_watch(

1177

GLib.IOChannel.unix_new(pipe[0].fileno()),

1178

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1179

self.checker_callback, pipe[0], command)

1180

# Re-run this periodically if run by GLib.timeout_add

722

return True

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

727

# The checker may have completed before the gobject

728

# watch was added. Check for this.

729

try:

730

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

731

except OSError as error:

732

if error.errno == errno.ECHILD:

733

# This should never happen

734

logger.error("Child process vanished",

735

exc_info=error)

736

return True

737

raise

738

if pid:

739

gobject.source_remove(self.checker_callback_tag)

740

self.checker_callback(pid, status, command)

741

# Re-run this periodically if run by gobject.timeout_add

1181

742

return True

1182

743

1183

744

def stop_checker(self):

1184

745

"""Force the checker process, if any, to stop."""

1185

746

if self.checker_callback_tag:

1186

GLib.source_remove(self.checker_callback_tag)

747

gobject.source_remove(self.checker_callback_tag)

1187

748

self.checker_callback_tag = None

1188

749

if getattr(self, "checker", None) is None:

1189

750

return

1190

751

logger.debug("Stopping checker for %(name)s", vars(self))

1191

self.checker.terminate()

752

try:

753

self.checker.terminate()

754

#time.sleep(0.5)

755

#if self.checker.poll() is None:

756

# self.checker.kill()

757

except OSError as error:

758

if error.errno != errno.ESRCH: # No such process

759

raise

1192

760

self.checker = None

1193

761

1194

762

1195

def dbus_service_property(dbus_interface,

1196

signature="v",

1197

access="readwrite",

1198

byte_arrays=False):

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

1199

765

"""Decorators for marking methods of a DBusObjectWithProperties to

1200

766

become properties on the D-Bus.

1201

767

1202

768

The decorated method will be called with no arguments by "Get"

1203

769

and with one argument by "Set".

1204

770

1205

771

The parameters, where they are supported, are the same as

1206

772

dbus.service.method, except there is only "signature", since the

1207

773

type from Get() and the type sent to Set() is the same.

1211

777

if byte_arrays and signature != "ay":

1212

778

raise ValueError("Byte arrays not supported for non-'ay'"

1213

779

" signature {!r}".format(signature))

1214

1215

780

def decorator(func):

1216

781

func._dbus_is_property = True

1217

782

func._dbus_interface = dbus_interface

1220

785

func._dbus_name = func.__name__

1221

786

if func._dbus_name.endswith("_dbus_property"):

1222

787

func._dbus_name = func._dbus_name[:-14]

1223

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

788

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1224

789

return func

1225

1226

790

return decorator

1227

791

1228

792

1229

793

def dbus_interface_annotations(dbus_interface):

1230

794

"""Decorator for marking functions returning interface annotations

1231

795

1232

796

Usage:

1233

797

1234

798

@dbus_interface_annotations("org.example.Interface")

1235

799

def _foo(self): # Function name does not matter

1236

800

return {"org.freedesktop.DBus.Deprecated": "true",

1237

801

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1238

802

"false"}

1239

803

"""

1240

1241

804

def decorator(func):

1242

805

func._dbus_is_interface = True

1243

806

func._dbus_interface = dbus_interface

1244

807

func._dbus_name = dbus_interface

1245

808

return func

1246

1247

809

return decorator

1248

810

1249

811

1250

812

def dbus_annotations(annotations):

1251

813

"""Decorator to annotate D-Bus methods, signals or properties

1252

814

Usage:

1253

815

1254

816

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1255

817

"org.freedesktop.DBus.Property."

1256

818

"EmitsChangedSignal": "false"})

1258

820

access="r")

1259

821

def Property_dbus_property(self):

1260

822

return dbus.Boolean(False)

1261

1262

See also the DBusObjectWithAnnotations class.

1263

823

"""

1264

1265

824

def decorator(func):

1266

825

func._dbus_annotations = annotations

1267

826

return func

1268

1269

827

return decorator

1270

828

1271

829

1274

832

"""

1275

833

pass

1276

834

1277

1278

835

class DBusPropertyAccessException(DBusPropertyException):

1279

836

"""A property's access permissions disallows an operation.

1280

837

"""

1287

844

pass

1288

845

1289

846

1290

class DBusObjectWithAnnotations(dbus.service.Object):

1291

"""A D-Bus object with annotations.

1292

1293

Classes inheriting from this can use the dbus_annotations

1294

decorator to add annotations to methods or signals.

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

849

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

1295

853

"""

1296

854

1297

855

@staticmethod

1298

856

def _is_dbus_thing(thing):

1299

857

"""Returns a function testing if an attribute is a D-Bus thing

1300

858

1301

859

If called like _is_dbus_thing("method") it returns a function

1302

860

suitable for use as predicate to inspect.getmembers().

1303

861

"""

1304

862

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1305

863

False)

1306

864

1307

865

def _get_all_dbus_things(self, thing):

1308

866

"""Returns a generator of (name, attribute) pairs

1309

867

"""

1310

return ((getattr(athing.__get__(self), "_dbus_name", name),

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

1311

870

athing.__get__(self))

1312

871

for cls in self.__class__.__mro__

1313

872

for name, athing in

1314

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1315

1316

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1317

out_signature="s",

1318

path_keyword='object_path',

1319

connection_keyword='connection')

1320

def Introspect(self, object_path, connection):

1321

"""Overloading of standard D-Bus method.

1322

1323

Inserts annotation tags on methods and signals.

1324

"""

1325

xmlstring = dbus.service.Object.Introspect(self, object_path,

1326

connection)

1327

try:

1328

document = xml.dom.minidom.parseString(xmlstring)

1329

1330

for if_tag in document.getElementsByTagName("interface"):

1331

# Add annotation tags

1332

for typ in ("method", "signal"):

1333

for tag in if_tag.getElementsByTagName(typ):

1334

annots = dict()

1335

for name, prop in (self.

1336

_get_all_dbus_things(typ)):

1337

if (name == tag.getAttribute("name")

1338

and prop._dbus_interface

1339

== if_tag.getAttribute("name")):

1340

annots.update(getattr(

1341

prop, "_dbus_annotations", {}))

1342

for name, value in annots.items():

1343

ann_tag = document.createElement(

1344

"annotation")

1345

ann_tag.setAttribute("name", name)

1346

ann_tag.setAttribute("value", value)

1347

tag.appendChild(ann_tag)

1348

# Add interface annotation tags

1349

for annotation, value in dict(

1350

itertools.chain.from_iterable(

1351

annotations().items()

1352

for name, annotations

1353

in self._get_all_dbus_things("interface")

1354

if name == if_tag.getAttribute("name")

1355

)).items():

1356

ann_tag = document.createElement("annotation")

1357

ann_tag.setAttribute("name", annotation)

1358

ann_tag.setAttribute("value", value)

1359

if_tag.appendChild(ann_tag)

1360

# Fix argument name for the Introspect method itself

1361

if (if_tag.getAttribute("name")

1362

== dbus.INTROSPECTABLE_IFACE):

1363

for cn in if_tag.getElementsByTagName("method"):

1364

if cn.getAttribute("name") == "Introspect":

1365

for arg in cn.getElementsByTagName("arg"):

1366

if (arg.getAttribute("direction")

1367

== "out"):

1368

arg.setAttribute("name",

1369

"xml_data")

1370

xmlstring = document.toxml("utf-8")

1371

document.unlink()

1372

except (AttributeError, xml.dom.DOMException,

1373

xml.parsers.expat.ExpatError) as error:

1374

logger.error("Failed to override Introspection method",

1375

exc_info=error)

1376

return xmlstring

1377

1378

1379

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1380

"""A D-Bus object with properties.

1381

1382

Classes inheriting from this can use the dbus_service_property

1383

decorator to expose methods as D-Bus properties. It exposes the

1384

standard Get(), Set(), and GetAll() methods on the D-Bus.

1385

"""

1386

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

875

1387

876

def _get_dbus_property(self, interface_name, property_name):

1388

877

"""Returns a bound method if one exists which is a D-Bus

1389

878

property with the specified name and interface.

1390

879

"""

1391

for cls in self.__class__.__mro__:

1392

for name, value in inspect.getmembers(

1393

cls, self._is_dbus_thing("property")):

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

1394

884

if (value._dbus_name == property_name

1395

885

and value._dbus_interface == interface_name):

1396

886

return value.__get__(self)

1397

887

1398

888

# No such property

1399

raise DBusPropertyNotFound("{}:{}.{}".format(

1400

self.dbus_object_path, interface_name, property_name))

1401

1402

@classmethod

1403

def _get_all_interface_names(cls):

1404

"""Get a sequence of all interfaces supported by an object"""

1405

return (name for name in set(getattr(getattr(x, attr),

1406

"_dbus_interface", None)

1407

for x in (inspect.getmro(cls))

1408

for attr in dir(x))

1409

if name is not None)

1410

1411

@dbus.service.method(dbus.PROPERTIES_IFACE,

1412

in_signature="ss",

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

892

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1413

894

out_signature="v")

1414

895

def Get(self, interface_name, property_name):

1415

896

"""Standard D-Bus property Get() method, see D-Bus standard.

1421

902

if not hasattr(value, "variant_level"):

1422

903

return value

1423

904

return type(value)(value, variant_level=value.variant_level+1)

1424

905

1425

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1426

907

def Set(self, interface_name, property_name, value):

1427

908

"""Standard D-Bus property Set() method, see D-Bus standard.

1436

917

raise ValueError("Byte arrays not supported for non-"

1437

918

"'ay' signature {!r}"

1438

919

.format(prop._dbus_signature))

1439

value = dbus.ByteArray(bytes(value))

920

value = dbus.ByteArray(b''.join(chr(byte)

921

for byte in value))

1440

922

prop(value)

1441

1442

@dbus.service.method(dbus.PROPERTIES_IFACE,

1443

in_signature="s",

923

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1444

925

out_signature="a{sv}")

1445

926

def GetAll(self, interface_name):

1446

927

"""Standard D-Bus property GetAll() method, see D-Bus

1447

928

standard.

1448

929

1449

930

Note: Will not include properties with access="write".

1450

931

"""

1451

932

properties = {}

1461

942

if not hasattr(value, "variant_level"):

1462

943

properties[name] = value

1463

944

continue

1464

properties[name] = type(value)(

1465

value, variant_level=value.variant_level + 1)

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

1466

947

return dbus.Dictionary(properties, signature="sv")

1467

948

1468

949

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1469

950

def PropertiesChanged(self, interface_name, changed_properties,

1470

951

invalidated_properties):

1472

953

standard.

1473

954

"""

1474

955

pass

1475

956

1476

957

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1477

958

out_signature="s",

1478

959

path_keyword='object_path',

1479

960

connection_keyword='connection')

1480

961

def Introspect(self, object_path, connection):

1481

962

"""Overloading of standard D-Bus method.

1482

963

1483

964

Inserts property tags and interface annotation tags.

1484

965

"""

1485

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1486

object_path,

1487

connection)

966

xmlstring = dbus.service.Object.Introspect(self, object_path,

967

connection)

1488

968

try:

1489

969

document = xml.dom.minidom.parseString(xmlstring)

1490

1491

970

def make_tag(document, name, prop):

1492

971

e = document.createElement("property")

1493

972

e.setAttribute("name", name)

1494

973

e.setAttribute("type", prop._dbus_signature)

1495

974

e.setAttribute("access", prop._dbus_access)

1496

975

return e

1497

1498

976

for if_tag in document.getElementsByTagName("interface"):

1499

977

# Add property tags

1500

978

for tag in (make_tag(document, name, prop)

1503

981

if prop._dbus_interface

1504

982

== if_tag.getAttribute("name")):

1505

983

if_tag.appendChild(tag)

1506

# Add annotation tags for properties

1507

for tag in if_tag.getElementsByTagName("property"):

1508

annots = dict()

1509

for name, prop in self._get_all_dbus_things(

1510

"property"):

1511

if (name == tag.getAttribute("name")

1512

and prop._dbus_interface

1513

== if_tag.getAttribute("name")):

1514

annots.update(getattr(

1515

prop, "_dbus_annotations", {}))

1516

for name, value in annots.items():

1517

ann_tag = document.createElement(

1518

"annotation")

1519

ann_tag.setAttribute("name", name)

1520

ann_tag.setAttribute("value", value)

1521

tag.appendChild(ann_tag)

984

# Add annotation tags

985

for typ in ("method", "signal", "property"):

986

for tag in if_tag.getElementsByTagName(typ):

987

annots = dict()

988

for name, prop in (self.

989

_get_all_dbus_things(typ)):

990

if (name == tag.getAttribute("name")

991

and prop._dbus_interface

992

== if_tag.getAttribute("name")):

993

annots.update(getattr

994

(prop,

995

"_dbus_annotations",

996

{}))

997

for name, value in annots.items():

998

ann_tag = document.createElement(

999

"annotation")

1000

ann_tag.setAttribute("name", name)

1001

ann_tag.setAttribute("value", value)

1002

tag.appendChild(ann_tag)

1003

# Add interface annotation tags

1004

for annotation, value in dict(

1005

itertools.chain.from_iterable(

1006

annotations().items()

1007

for name, annotations in

1008

self._get_all_dbus_things("interface")

1009

if name == if_tag.getAttribute("name")

1010

)).items():

1011

ann_tag = document.createElement("annotation")

1012

ann_tag.setAttribute("name", annotation)

1013

ann_tag.setAttribute("value", value)

1014

if_tag.appendChild(ann_tag)

1522

1015

# Add the names to the return values for the

1523

1016

# "org.freedesktop.DBus.Properties" methods

1524

1017

if (if_tag.getAttribute("name")

1543

1036

return xmlstring

1544

1037

1545

1038

1546

try:

1547

dbus.OBJECT_MANAGER_IFACE

1548

except AttributeError:

1549

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1550

1551

1552

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1553

"""A D-Bus object with an ObjectManager.

1554

1555

Classes inheriting from this exposes the standard

1556

GetManagedObjects call and the InterfacesAdded and

1557

InterfacesRemoved signals on the standard

1558

"org.freedesktop.DBus.ObjectManager" interface.

1559

1560

Note: No signals are sent automatically; they must be sent

1561

manually.

1562

"""

1563

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1564

out_signature="a{oa{sa{sv}}}")

1565

def GetManagedObjects(self):

1566

"""This function must be overridden"""

1567

raise NotImplementedError()

1568

1569

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1570

signature="oa{sa{sv}}")

1571

def InterfacesAdded(self, object_path, interfaces_and_properties):

1572

pass

1573

1574

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1575

def InterfacesRemoved(self, object_path, interfaces):

1576

pass

1577

1578

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1579

out_signature="s",

1580

path_keyword='object_path',

1581

connection_keyword='connection')

1582

def Introspect(self, object_path, connection):

1583

"""Overloading of standard D-Bus method.

1584

1585

Override return argument name of GetManagedObjects to be

1586

"objpath_interfaces_and_properties"

1587

"""

1588

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1589

object_path,

1590

connection)

1591

try:

1592

document = xml.dom.minidom.parseString(xmlstring)

1593

1594

for if_tag in document.getElementsByTagName("interface"):

1595

# Fix argument name for the GetManagedObjects method

1596

if (if_tag.getAttribute("name")

1597

== dbus.OBJECT_MANAGER_IFACE):

1598

for cn in if_tag.getElementsByTagName("method"):

1599

if (cn.getAttribute("name")

1600

== "GetManagedObjects"):

1601

for arg in cn.getElementsByTagName("arg"):

1602

if (arg.getAttribute("direction")

1603

== "out"):

1604

arg.setAttribute(

1605

"name",

1606

"objpath_interfaces"

1607

"_and_properties")

1608

xmlstring = document.toxml("utf-8")

1609

document.unlink()

1610

except (AttributeError, xml.dom.DOMException,

1611

xml.parsers.expat.ExpatError) as error:

1612

logger.error("Failed to override Introspection method",

1613

exc_info=error)

1614

return xmlstring

1615

1616

1617

1039

def datetime_to_dbus(dt, variant_level=0):

1618

1040

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1619

1041

if dt is None:

1620

return dbus.String("", variant_level=variant_level)

1621

return dbus.String(dt.isoformat(), variant_level=variant_level)

1042

return dbus.String("", variant_level = variant_level)

1043

return dbus.String(dt.isoformat(),

1044

variant_level=variant_level)

1622

1045

1623

1046

1624

1047

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1626

1049

dbus.service.Object, it will add alternate D-Bus attributes with

1627

1050

interface names according to the "alt_interface_names" mapping.

1628

1051

Usage:

1629

1052

1630

1053

@alternate_dbus_interfaces({"org.example.Interface":

1631

1054

"net.example.AlternateInterface"})

1632

1055

class SampleDBusObject(dbus.service.Object):

1633

1056

@dbus.service.method("org.example.Interface")

1634

1057

def SampleDBusMethod():

1635

1058

pass

1636

1059

1637

1060

The above "SampleDBusMethod" on "SampleDBusObject" will be

1638

1061

reachable via two interfaces: "org.example.Interface" and

1639

1062

"net.example.AlternateInterface", the latter of which will have

1640

1063

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1641

1064

"true", unless "deprecate" is passed with a False value.

1642

1065

1643

1066

This works for methods and signals, and also for D-Bus properties

1644

1067

(from DBusObjectWithProperties) and interfaces (from the

1645

1068

dbus_interface_annotations decorator).

1646

1069

"""

1647

1648

1070

def wrapper(cls):

1649

1071

for orig_interface_name, alt_interface_name in (

1650

alt_interface_names.items()):

1072

alt_interface_names.items()):

1651

1073

attr = {}

1652

1074

interface_names = set()

1653

1075

# Go though all attributes of the class

1655

1077

# Ignore non-D-Bus attributes, and D-Bus attributes

1656

1078

# with the wrong interface name

1657

1079

if (not hasattr(attribute, "_dbus_interface")

1658

or not attribute._dbus_interface.startswith(

1659

orig_interface_name)):

1080

or not attribute._dbus_interface

1081

.startswith(orig_interface_name)):

1660

1082

continue

1661

1083

# Create an alternate D-Bus interface name based on

1662

1084

# the current name

1663

alt_interface = attribute._dbus_interface.replace(

1664

orig_interface_name, alt_interface_name)

1085

alt_interface = (attribute._dbus_interface

1086

.replace(orig_interface_name,

1087

alt_interface_name))

1665

1088

interface_names.add(alt_interface)

1666

1089

# Is this a D-Bus signal?

1667

1090

if getattr(attribute, "_dbus_is_signal", False):

1668

1091

# Extract the original non-method undecorated

1669

1092

# function by black magic

1670

if sys.version_info.major == 2:

1671

nonmethod_func = (dict(

1093

nonmethod_func = (dict(

1672

1094

zip(attribute.func_code.co_freevars,

1673

attribute.__closure__))

1674

["func"].cell_contents)

1675

else:

1676

nonmethod_func = (dict(

1677

zip(attribute.__code__.co_freevars,

1678

attribute.__closure__))

1679

["func"].cell_contents)

1095

attribute.__closure__))["func"]

1096

.cell_contents)

1680

1097

# Create a new, but exactly alike, function

1681

1098

# object, and decorate it to be a new D-Bus signal

1682

1099

# with the alternate D-Bus interface name

1683

new_function = copy_function(nonmethod_func)

1684

new_function = (dbus.service.signal(

1685

alt_interface,

1686

attribute._dbus_signature)(new_function))

1100

new_function = (dbus.service.signal

1101

(alt_interface,

1102

attribute._dbus_signature)

1103

(types.FunctionType(

1104

nonmethod_func.func_code,

1105

nonmethod_func.func_globals,

1106

nonmethod_func.func_name,

1107

nonmethod_func.func_defaults,

1108

nonmethod_func.func_closure)))

1687

1109

# Copy annotations, if any

1688

1110

try:

1689

new_function._dbus_annotations = dict(

1690

attribute._dbus_annotations)

1111

new_function._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1691

1113

except AttributeError:

1692

1114

pass

1693

1694

1115

# Define a creator of a function to call both the

1695

1116

# original and alternate functions, so both the

1696

1117

# original and alternate signals gets sent when

1699

1120

"""This function is a scope container to pass

1700

1121

func1 and func2 to the "call_both" function

1701

1122

outside of its arguments"""

1702

1703

@functools.wraps(func2)

1704

1123

def call_both(*args, **kwargs):

1705

1124

"""This function will emit two D-Bus

1706

1125

signals by calling func1 and func2"""

1707

1126

func1(*args, **kwargs)

1708

1127

func2(*args, **kwargs)

1709

# Make wrapper function look like a D-Bus

1710

# signal

1711

for name, attr in inspect.getmembers(func2):

1712

if name.startswith("_dbus_"):

1713

setattr(call_both, name, attr)

1714

1715

1128

return call_both

1716

1129

# Create the "call_both" function and add it to

1717

1130

# the class

1722

1135

# object. Decorate it to be a new D-Bus method

1723

1136

# with the alternate D-Bus interface name. Add it

1724

1137

# to the class.

1725

attr[attrname] = (

1726

dbus.service.method(

1727

alt_interface,

1728

attribute._dbus_in_signature,

1729

attribute._dbus_out_signature)

1730

(copy_function(attribute)))

1138

attr[attrname] = (dbus.service.method

1139

(alt_interface,

1140

attribute._dbus_in_signature,

1141

attribute._dbus_out_signature)

1142

(types.FunctionType

1143

(attribute.func_code,

1144

attribute.func_globals,

1145

attribute.func_name,

1146

attribute.func_defaults,

1147

attribute.func_closure)))

1731

1148

# Copy annotations, if any

1732

1149

try:

1733

attr[attrname]._dbus_annotations = dict(

1734

attribute._dbus_annotations)

1150

attr[attrname]._dbus_annotations = (

1151

dict(attribute._dbus_annotations))

1735

1152

except AttributeError:

1736

1153

pass

1737

1154

# Is this a D-Bus property?

1740

1157

# object, and decorate it to be a new D-Bus

1741

1158

# property with the alternate D-Bus interface

1742

1159

# name. Add it to the class.

1743

attr[attrname] = (dbus_service_property(

1744

alt_interface, attribute._dbus_signature,

1745

attribute._dbus_access,

1746

attribute._dbus_get_args_options

1747

["byte_arrays"])

1748

(copy_function(attribute)))

1160

attr[attrname] = (dbus_service_property

1161

(alt_interface,

1162

attribute._dbus_signature,

1163

attribute._dbus_access,

1164

attribute

1165

._dbus_get_args_options

1166

["byte_arrays"])

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1749

1173

# Copy annotations, if any

1750

1174

try:

1751

attr[attrname]._dbus_annotations = dict(

1752

attribute._dbus_annotations)

1175

attr[attrname]._dbus_annotations = (

1176

dict(attribute._dbus_annotations))

1753

1177

except AttributeError:

1754

1178

pass

1755

1179

# Is this a D-Bus interface?

1758

1182

# object. Decorate it to be a new D-Bus interface

1759

1183

# with the alternate D-Bus interface name. Add it

1760

1184

# to the class.

1761

attr[attrname] = (

1762

dbus_interface_annotations(alt_interface)

1763

(copy_function(attribute)))

1185

attr[attrname] = (dbus_interface_annotations

1186

(alt_interface)

1187

(types.FunctionType

1188

(attribute.func_code,

1189

attribute.func_globals,

1190

attribute.func_name,

1191

attribute.func_defaults,

1192

attribute.func_closure)))

1764

1193

if deprecate:

1765

1194

# Deprecate all alternate interfaces

1766

iname = "_AlternateDBusNames_interface_annotation{}"

1195

iname="_AlternateDBusNames_interface_annotation{}"

1767

1196

for interface_name in interface_names:

1768

1769

1197

@dbus_interface_annotations(interface_name)

1770

1198

def func(self):

1771

return {"org.freedesktop.DBus.Deprecated":

1772

"true"}

1199

return { "org.freedesktop.DBus.Deprecated":

1200

"true" }

1773

1201

# Find an unused name

1774

1202

for aname in (iname.format(i)

1775

1203

for i in itertools.count()):

1779

1207

if interface_names:

1780

1208

# Replace the class with a new subclass of it with

1781

1209

# methods, signals, etc. as created above.

1782

if sys.version_info.major == 2:

1783

cls = type(b"{}Alternate".format(cls.__name__),

1784

(cls, ), attr)

1785

else:

1786

cls = type("{}Alternate".format(cls.__name__),

1787

(cls, ), attr)

1210

cls = type(b"{}Alternate".format(cls.__name__),

1211

(cls,), attr)

1788

1212

return cls

1789

1790

1213

return wrapper

1791

1214

1792

1215

1793

1216

@alternate_dbus_interfaces({"se.recompile.Mandos":

1794

"se.bsnet.fukt.Mandos"})

1217

"se.bsnet.fukt.Mandos"})

1795

1218

class ClientDBus(Client, DBusObjectWithProperties):

1796

1219

"""A Client class using D-Bus

1797

1220

1798

1221

Attributes:

1799

1222

dbus_object_path: dbus.ObjectPath

1800

1223

bus: dbus.SystemBus()

1801

1224

"""

1802

1225

1803

1226

runtime_expansions = (Client.runtime_expansions

1804

+ ("dbus_object_path", ))

1805

1227

+ ("dbus_object_path",))

1228

1806

1229

_interface = "se.recompile.Mandos.Client"

1807

1230

1808

1231

# dbus.service.Object doesn't use super(), so we can't either.

1809

1810

def __init__(self, bus=None, *args, **kwargs):

1232

1233

def __init__(self, bus = None, *args, **kwargs):

1811

1234

self.bus = bus

1812

1235

Client.__init__(self, *args, **kwargs)

1813

1236

# Only now, when this client is initialized, can it show up on

1815

1238

client_object_name = str(self.name).translate(

1816

1239

{ord("."): ord("_"),

1817

1240

ord("-"): ord("_")})

1818

self.dbus_object_path = dbus.ObjectPath(

1819

"/clients/" + client_object_name)

1241

self.dbus_object_path = (dbus.ObjectPath

1242

("/clients/" + client_object_name))

1820

1243

DBusObjectWithProperties.__init__(self, self.bus,

1821

1244

self.dbus_object_path)

1822

1823

def notifychangeproperty(transform_func, dbus_name,

1824

type_func=lambda x: x,

1825

variant_level=1,

1826

invalidate_only=False,

1245

1246

def notifychangeproperty(transform_func,

1247

dbus_name, type_func=lambda x: x,

1248

variant_level=1, invalidate_only=False,

1827

1249

_interface=_interface):

1828

1250

""" Modify a variable so that it's a property which announces

1829

1251

its changes to DBus.

1830

1252

1831

1253

transform_fun: Function that takes a value and a variant_level

1832

1254

and transforms it to a D-Bus type.

1833

1255

dbus_name: D-Bus name of the variable

1836

1258

variant_level: D-Bus variant level. Default: 1

1837

1259

"""

1838

1260

attrname = "_{}".format(dbus_name)

1839

1840

1261

def setter(self, value):

1841

1262

if hasattr(self, "dbus_object_path"):

1842

1263

if (not hasattr(self, attrname) or

1843

1264

type_func(getattr(self, attrname, None))

1844

1265

!= type_func(value)):

1845

1266

if invalidate_only:

1846

self.PropertiesChanged(

1847

_interface, dbus.Dictionary(),

1848

dbus.Array((dbus_name, )))

1267

self.PropertiesChanged(_interface,

1268

dbus.Dictionary(),

1269

dbus.Array

1270

((dbus_name,)))

1849

1271

else:

1850

dbus_value = transform_func(

1851

type_func(value),

1852

variant_level=variant_level)

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1853

1275

self.PropertyChanged(dbus.String(dbus_name),

1854

1276

dbus_value)

1855

self.PropertiesChanged(

1856

_interface,

1857

dbus.Dictionary({dbus.String(dbus_name):

1858

dbus_value}),

1859

dbus.Array())

1277

self.PropertiesChanged(_interface,

1278

dbus.Dictionary({

1279

dbus.String(dbus_name):

1280

dbus_value }), dbus.Array())

1860

1281

setattr(self, attrname, value)

1861

1282

1862

1283

return property(lambda self: getattr(self, attrname), setter)

1863

1284

1864

1285

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1865

1286

approvals_pending = notifychangeproperty(dbus.Boolean,

1866

1287

"ApprovalPending",

1867

type_func=bool)

1288

type_func = bool)

1868

1289

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1869

1290

last_enabled = notifychangeproperty(datetime_to_dbus,

1870

1291

"LastEnabled")

1871

checker = notifychangeproperty(

1872

dbus.Boolean, "CheckerRunning",

1873

type_func=lambda checker: checker is not None)

1292

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1293

type_func = lambda checker:

1294

checker is not None)

1874

1295

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1875

1296

"LastCheckedOK")

1876

1297

last_checker_status = notifychangeproperty(dbus.Int16,

1879

1300

datetime_to_dbus, "LastApprovalRequest")

1880

1301

approved_by_default = notifychangeproperty(dbus.Boolean,

1881

1302

"ApprovedByDefault")

1882

approval_delay = notifychangeproperty(

1883

dbus.UInt64, "ApprovalDelay",

1884

type_func=lambda td: td.total_seconds() * 1000)

1303

approval_delay = notifychangeproperty(dbus.UInt64,

1304

"ApprovalDelay",

1305

type_func =

1306

lambda td: td.total_seconds()

1307

* 1000)

1885

1308

approval_duration = notifychangeproperty(

1886

1309

dbus.UInt64, "ApprovalDuration",

1887

type_func=lambda td: td.total_seconds() * 1000)

1310

type_func = lambda td: td.total_seconds() * 1000)

1888

1311

host = notifychangeproperty(dbus.String, "Host")

1889

timeout = notifychangeproperty(

1890

dbus.UInt64, "Timeout",

1891

type_func=lambda td: td.total_seconds() * 1000)

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func = lambda td:

1314

td.total_seconds() * 1000)

1892

1315

extended_timeout = notifychangeproperty(

1893

1316

dbus.UInt64, "ExtendedTimeout",

1894

type_func=lambda td: td.total_seconds() * 1000)

1895

interval = notifychangeproperty(

1896

dbus.UInt64, "Interval",

1897

type_func=lambda td: td.total_seconds() * 1000)

1317

type_func = lambda td: td.total_seconds() * 1000)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

lambda td: td.total_seconds()

1322

* 1000)

1898

1323

checker_command = notifychangeproperty(dbus.String, "Checker")

1899

1324

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1900

1325

invalidate_only=True)

1901

1326

1902

1327

del notifychangeproperty

1903

1328

1904

1329

def __del__(self, *args, **kwargs):

1905

1330

try:

1906

1331

self.remove_from_connection()

1909

1334

if hasattr(DBusObjectWithProperties, "__del__"):

1910

1335

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1911

1336

Client.__del__(self, *args, **kwargs)

1912

1913

def checker_callback(self, source, condition,

1914

connection, command, *args, **kwargs):

1915

ret = Client.checker_callback(self, source, condition,

1916

connection, command, *args,

1917

**kwargs)

1918

exitstatus = self.last_checker_status

1919

if exitstatus >= 0:

1337

1338

def checker_callback(self, pid, condition, command,

1339

*args, **kwargs):

1340

self.checker_callback_tag = None

1341

self.checker = None

1342

if os.WIFEXITED(condition):

1343

exitstatus = os.WEXITSTATUS(condition)

1920

1344

# Emit D-Bus signal

1921

1345

self.CheckerCompleted(dbus.Int16(exitstatus),

1922

# This is specific to GNU libC

1923

dbus.Int64(exitstatus << 8),

1346

dbus.Int64(condition),

1924

1347

dbus.String(command))

1925

1348

else:

1926

1349

# Emit D-Bus signal

1927

1350

self.CheckerCompleted(dbus.Int16(-1),

1928

dbus.Int64(

1929

# This is specific to GNU libC

1930

(exitstatus << 8)

1931

| self.last_checker_signal),

1351

dbus.Int64(condition),

1932

1352

dbus.String(command))

1933

return ret

1934

1353

1354

return Client.checker_callback(self, pid, condition, command,

1355

*args, **kwargs)

1356

1935

1357

def start_checker(self, *args, **kwargs):

1936

1358

old_checker_pid = getattr(self.checker, "pid", None)

1937

1359

r = Client.start_checker(self, *args, **kwargs)

1941

1363

# Emit D-Bus signal

1942

1364

self.CheckerStarted(self.current_checker_command)

1943

1365

return r

1944

1366

1945

1367

def _reset_approved(self):

1946

1368

self.approved = None

1947

1369

return False

1948

1370

1949

1371

def approve(self, value=True):

1950

1372

self.approved = value

1951

GLib.timeout_add(int(self.approval_duration.total_seconds()

1952

* 1000), self._reset_approved)

1373

gobject.timeout_add(int(self.approval_duration.total_seconds()

1374

* 1000), self._reset_approved)

1953

1375

self.send_changedstate()

1954

1955

# D-Bus methods, signals & properties

1956

1957

# Interfaces

1958

1959

# Signals

1960

1376

1377

## D-Bus methods, signals & properties

1378

1379

## Interfaces

1380

1381

## Signals

1382

1961

1383

# CheckerCompleted - signal

1962

1384

@dbus.service.signal(_interface, signature="nxs")

1963

1385

def CheckerCompleted(self, exitcode, waitstatus, command):

1964

1386

"D-Bus signal"

1965

1387

pass

1966

1388

1967

1389

# CheckerStarted - signal

1968

1390

@dbus.service.signal(_interface, signature="s")

1969

1391

def CheckerStarted(self, command):

1970

1392

"D-Bus signal"

1971

1393

pass

1972

1394

1973

1395

# PropertyChanged - signal

1974

1396

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1975

1397

@dbus.service.signal(_interface, signature="sv")

1976

1398

def PropertyChanged(self, property, value):

1977

1399

"D-Bus signal"

1978

1400

pass

1979

1401

1980

1402

# GotSecret - signal

1981

1403

@dbus.service.signal(_interface)

1982

1404

def GotSecret(self):

1985

1407

server to mandos-client

1986

1408

"""

1987

1409

pass

1988

1410

1989

1411

# Rejected - signal

1990

1412

@dbus.service.signal(_interface, signature="s")

1991

1413

def Rejected(self, reason):

1992

1414

"D-Bus signal"

1993

1415

pass

1994

1416

1995

1417

# NeedApproval - signal

1996

1418

@dbus.service.signal(_interface, signature="tb")

1997

1419

def NeedApproval(self, timeout, default):

1998

1420

"D-Bus signal"

1999

1421

return self.need_approval()

2000

2001

# Methods

2002

1422

1423

## Methods

1424

2003

1425

# Approve - method

2004

1426

@dbus.service.method(_interface, in_signature="b")

2005

1427

def Approve(self, value):

2006

1428

self.approve(value)

2007

1429

2008

1430

# CheckedOK - method

2009

1431

@dbus.service.method(_interface)

2010

1432

def CheckedOK(self):

2011

1433

self.checked_ok()

2012

1434

2013

1435

# Enable - method

2014

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1436

@dbus.service.method(_interface)

2016

1437

def Enable(self):

2017

1438

"D-Bus method"

2018

1439

self.enable()

2019

1440

2020

1441

# StartChecker - method

2021

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2022

1442

@dbus.service.method(_interface)

2023

1443

def StartChecker(self):

2024

1444

"D-Bus method"

2025

1445

self.start_checker()

2026

1446

2027

1447

# Disable - method

2028

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2029

1448

@dbus.service.method(_interface)

2030

1449

def Disable(self):

2031

1450

"D-Bus method"

2032

1451

self.disable()

2033

1452

2034

1453

# StopChecker - method

2035

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2036

1454

@dbus.service.method(_interface)

2037

1455

def StopChecker(self):

2038

1456

self.stop_checker()

2039

2040

# Properties

2041

1457

1458

## Properties

1459

2042

1460

# ApprovalPending - property

2043

1461

@dbus_service_property(_interface, signature="b", access="read")

2044

1462

def ApprovalPending_dbus_property(self):

2045

1463

return dbus.Boolean(bool(self.approvals_pending))

2046

1464

2047

1465

# ApprovedByDefault - property

2048

@dbus_service_property(_interface,

2049

signature="b",

1466

@dbus_service_property(_interface, signature="b",

2050

1467

access="readwrite")

2051

1468

def ApprovedByDefault_dbus_property(self, value=None):

2052

1469

if value is None: # get

2053

1470

return dbus.Boolean(self.approved_by_default)

2054

1471

self.approved_by_default = bool(value)

2055

1472

2056

1473

# ApprovalDelay - property

2057

@dbus_service_property(_interface,

2058

signature="t",

1474

@dbus_service_property(_interface, signature="t",

2059

1475

access="readwrite")

2060

1476

def ApprovalDelay_dbus_property(self, value=None):

2061

1477

if value is None: # get

2062

1478

return dbus.UInt64(self.approval_delay.total_seconds()

2063

1479

* 1000)

2064

1480

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2065

1481

2066

1482

# ApprovalDuration - property

2067

@dbus_service_property(_interface,

2068

signature="t",

1483

@dbus_service_property(_interface, signature="t",

2069

1484

access="readwrite")

2070

1485

def ApprovalDuration_dbus_property(self, value=None):

2071

1486

if value is None: # get

2072

1487

return dbus.UInt64(self.approval_duration.total_seconds()

2073

1488

* 1000)

2074

1489

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2075

1490

2076

1491

# Name - property

2077

@dbus_annotations(

2078

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2079

1492

@dbus_service_property(_interface, signature="s", access="read")

2080

1493

def Name_dbus_property(self):

2081

1494

return dbus.String(self.name)

2082

2083

# KeyID - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

@dbus_service_property(_interface, signature="s", access="read")

2087

def KeyID_dbus_property(self):

2088

return dbus.String(self.key_id)

2089

1495

2090

1496

# Fingerprint - property

2091

@dbus_annotations(

2092

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2093

1497

@dbus_service_property(_interface, signature="s", access="read")

2094

1498

def Fingerprint_dbus_property(self):

2095

1499

return dbus.String(self.fingerprint)

2096

1500

2097

1501

# Host - property

2098

@dbus_service_property(_interface,

2099

signature="s",

1502

@dbus_service_property(_interface, signature="s",

2100

1503

access="readwrite")

2101

1504

def Host_dbus_property(self, value=None):

2102

1505

if value is None: # get

2103

1506

return dbus.String(self.host)

2104

1507

self.host = str(value)

2105

1508

2106

1509

# Created - property

2107

@dbus_annotations(

2108

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2109

1510

@dbus_service_property(_interface, signature="s", access="read")

2110

1511

def Created_dbus_property(self):

2111

1512

return datetime_to_dbus(self.created)

2112

1513

2113

1514

# LastEnabled - property

2114

1515

@dbus_service_property(_interface, signature="s", access="read")

2115

1516

def LastEnabled_dbus_property(self):

2116

1517

return datetime_to_dbus(self.last_enabled)

2117

1518

2118

1519

# Enabled - property

2119

@dbus_service_property(_interface,

2120

signature="b",

1520

@dbus_service_property(_interface, signature="b",

2121

1521

access="readwrite")

2122

1522

def Enabled_dbus_property(self, value=None):

2123

1523

if value is None: # get

2126

1526

self.enable()

2127

1527

else:

2128

1528

self.disable()

2129

1529

2130

1530

# LastCheckedOK - property

2131

@dbus_service_property(_interface,

2132

signature="s",

1531

@dbus_service_property(_interface, signature="s",

2133

1532

access="readwrite")

2134

1533

def LastCheckedOK_dbus_property(self, value=None):

2135

1534

if value is not None:

2136

1535

self.checked_ok()

2137

1536

return

2138

1537

return datetime_to_dbus(self.last_checked_ok)

2139

1538

2140

1539

# LastCheckerStatus - property

2141

@dbus_service_property(_interface, signature="n", access="read")

1540

@dbus_service_property(_interface, signature="n",

1541

access="read")

2142

1542

def LastCheckerStatus_dbus_property(self):

2143

1543

return dbus.Int16(self.last_checker_status)

2144

1544

2145

1545

# Expires - property

2146

1546

@dbus_service_property(_interface, signature="s", access="read")

2147

1547

def Expires_dbus_property(self):

2148

1548

return datetime_to_dbus(self.expires)

2149

1549

2150

1550

# LastApprovalRequest - property

2151

1551

@dbus_service_property(_interface, signature="s", access="read")

2152

1552

def LastApprovalRequest_dbus_property(self):

2153

1553

return datetime_to_dbus(self.last_approval_request)

2154

1554

2155

1555

# Timeout - property

2156

@dbus_service_property(_interface,

2157

signature="t",

1556

@dbus_service_property(_interface, signature="t",

2158

1557

access="readwrite")

2159

1558

def Timeout_dbus_property(self, value=None):

2160

1559

if value is None: # get

2172

1571

if (getattr(self, "disable_initiator_tag", None)

2173

1572

is None):

2174

1573

return

2175

GLib.source_remove(self.disable_initiator_tag)

2176

self.disable_initiator_tag = GLib.timeout_add(

2177

int((self.expires - now).total_seconds() * 1000),

2178

self.disable)

2179

1574

gobject.source_remove(self.disable_initiator_tag)

1575

self.disable_initiator_tag = (

1576

gobject.timeout_add(

1577

int((self.expires - now).total_seconds()

1578

* 1000), self.disable))

1579

2180

1580

# ExtendedTimeout - property

2181

@dbus_service_property(_interface,

2182

signature="t",

1581

@dbus_service_property(_interface, signature="t",

2183

1582

access="readwrite")

2184

1583

def ExtendedTimeout_dbus_property(self, value=None):

2185

1584

if value is None: # get

2186

1585

return dbus.UInt64(self.extended_timeout.total_seconds()

2187

1586

* 1000)

2188

1587

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2189

1588

2190

1589

# Interval - property

2191

@dbus_service_property(_interface,

2192

signature="t",

1590

@dbus_service_property(_interface, signature="t",

2193

1591

access="readwrite")

2194

1592

def Interval_dbus_property(self, value=None):

2195

1593

if value is None: # get

2199

1597

return

2200

1598

if self.enabled:

2201

1599

# Reschedule checker run

2202

GLib.source_remove(self.checker_initiator_tag)

2203

self.checker_initiator_tag = GLib.timeout_add(

2204

value, self.start_checker)

2205

self.start_checker() # Start one now, too

2206

1600

gobject.source_remove(self.checker_initiator_tag)

1601

self.checker_initiator_tag = (gobject.timeout_add

1602

(value, self.start_checker))

1603

self.start_checker() # Start one now, too

1604

2207

1605

# Checker - property

2208

@dbus_service_property(_interface,

2209

signature="s",

1606

@dbus_service_property(_interface, signature="s",

2210

1607

access="readwrite")

2211

1608

def Checker_dbus_property(self, value=None):

2212

1609

if value is None: # get

2213

1610

return dbus.String(self.checker_command)

2214

1611

self.checker_command = str(value)

2215

1612

2216

1613

# CheckerRunning - property

2217

@dbus_service_property(_interface,

2218

signature="b",

1614

@dbus_service_property(_interface, signature="b",

2219

1615

access="readwrite")

2220

1616

def CheckerRunning_dbus_property(self, value=None):

2221

1617

if value is None: # get

2224

1620

self.start_checker()

2225

1621

else:

2226

1622

self.stop_checker()

2227

1623

2228

1624

# ObjectPath - property

2229

@dbus_annotations(

2230

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2231

"org.freedesktop.DBus.Deprecated": "true"})

2232

1625

@dbus_service_property(_interface, signature="o", access="read")

2233

1626

def ObjectPath_dbus_property(self):

2234

return self.dbus_object_path # is already a dbus.ObjectPath

2235

1627

return self.dbus_object_path # is already a dbus.ObjectPath

1628

2236

1629

# Secret = property

2237

@dbus_annotations(

2238

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2239

"invalidates"})

2240

@dbus_service_property(_interface,

2241

signature="ay",

2242

access="write",

2243

byte_arrays=True)

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

2244

1632

def Secret_dbus_property(self, value):

2245

1633

self.secret = bytes(value)

2246

1634

2247

1635

del _interface

2248

1636

2249

1637

2250

class ProxyClient:

2251

def __init__(self, child_pipe, key_id, fpr, address):

1638

class ProxyClient(object):

1639

def __init__(self, child_pipe, fpr, address):

2252

1640

self._pipe = child_pipe

2253

self._pipe.send(('init', key_id, fpr, address))

1641

self._pipe.send(('init', fpr, address))

2254

1642

if not self._pipe.recv():

2255

raise KeyError(key_id or fpr)

2256

1643

raise KeyError()

1644

2257

1645

def __getattribute__(self, name):

2258

1646

if name == '_pipe':

2259

1647

return super(ProxyClient, self).__getattribute__(name)

2262

1650

if data[0] == 'data':

2263

1651

return data[1]

2264

1652

if data[0] == 'function':

2265

2266

1653

def func(*args, **kwargs):

2267

1654

self._pipe.send(('funcall', name, args, kwargs))

2268

1655

return self._pipe.recv()[1]

2269

2270

1656

return func

2271

1657

2272

1658

def __setattr__(self, name, value):

2273

1659

if name == '_pipe':

2274

1660

return super(ProxyClient, self).__setattr__(name, value)

2277

1663

2278

1664

class ClientHandler(socketserver.BaseRequestHandler, object):

2279

1665

"""A class to handle client connections.

2280

1666

2281

1667

Instantiated once for each connection to handle it.

2282

1668

Note: This will run in its own forked process."""

2283

1669

2284

1670

def handle(self):

2285

1671

with contextlib.closing(self.server.child_pipe) as child_pipe:

2286

1672

logger.info("TCP connection from: %s",

2287

1673

str(self.client_address))

2288

1674

logger.debug("Pipe FD: %d",

2289

1675

self.server.child_pipe.fileno())

2290

2291

session = gnutls.ClientSession(self.request)

2292

2293

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2294

# "+AES-256-CBC", "+SHA1",

2295

# "+COMP-NULL", "+CTYPE-OPENPGP",

2296

# "+DHE-DSS"))

1676

1677

session = (gnutls.connection

1678

.ClientSession(self.request,

1679

gnutls.connection

1680

.X509Credentials()))

1681

1682

# Note: gnutls.connection.X509Credentials is really a

1683

# generic GnuTLS certificate credentials object so long as

1684

# no X.509 keys are added to it. Therefore, we can use it

1685

# here despite using OpenPGP certificates.

1686

1687

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1688

# "+AES-256-CBC", "+SHA1",

1689

# "+COMP-NULL", "+CTYPE-OPENPGP",

1690

# "+DHE-DSS"))

2297

1691

# Use a fallback default, since this MUST be set.

2298

1692

priority = self.server.gnutls_priority

2299

1693

if priority is None:

2300

1694

priority = "NORMAL"

2301

gnutls.priority_set_direct(session._c_object,

2302

priority.encode("utf-8"),

2303

None)

2304

1695

(gnutls.library.functions

1696

.gnutls_priority_set_direct(session._c_object,

1697

priority, None))

1698

2305

1699

# Start communication using the Mandos protocol

2306

1700

# Get protocol number

2307

1701

line = self.request.makefile().readline()

2312

1706

except (ValueError, IndexError, RuntimeError) as error:

2313

1707

logger.error("Unknown protocol version: %s", error)

2314

1708

return

2315

1709

2316

1710

# Start GnuTLS connection

2317

1711

try:

2318

1712

session.handshake()

2319

except gnutls.Error as error:

1713

except gnutls.errors.GNUTLSError as error:

2320

1714

logger.warning("Handshake failed: %s", error)

2321

1715

# Do not run session.bye() here: the session is not

2322

1716

# established. Just abandon the request.

2323

1717

return

2324

1718

logger.debug("Handshake succeeded")

2325

1719

2326

1720

approval_required = False

2327

1721

try:

2328

if gnutls.has_rawpk:

2329

fpr = b""

2330

try:

2331

key_id = self.key_id(

2332

self.peer_certificate(session))

2333

except (TypeError, gnutls.Error) as error:

2334

logger.warning("Bad certificate: %s", error)

2335

return

2336

logger.debug("Key ID: %s", key_id)

2337

2338

else:

2339

key_id = b""

2340

try:

2341

fpr = self.fingerprint(

2342

self.peer_certificate(session))

2343

except (TypeError, gnutls.Error) as error:

2344

logger.warning("Bad certificate: %s", error)

2345

return

2346

logger.debug("Fingerprint: %s", fpr)

2347

2348

try:

2349

client = ProxyClient(child_pipe, key_id, fpr,

1722

try:

1723

fpr = self.fingerprint(self.peer_certificate

1724

(session))

1725

except (TypeError,

1726

gnutls.errors.GNUTLSError) as error:

1727

logger.warning("Bad certificate: %s", error)

1728

return

1729

logger.debug("Fingerprint: %s", fpr)

1730

1731

try:

1732

client = ProxyClient(child_pipe, fpr,

2350

1733

self.client_address)

2351

1734

except KeyError:

2352

1735

return

2353

1736

2354

1737

if client.approval_delay:

2355

1738

delay = client.approval_delay

2356

1739

client.approvals_pending += 1

2357

1740

approval_required = True

2358

1741

2359

1742

while True:

2360

1743

if not client.enabled:

2361

1744

logger.info("Client %s is disabled",

2362

client.name)

1745

client.name)

2363

1746

if self.server.use_dbus:

2364

1747

# Emit D-Bus signal

2365

1748

client.Rejected("Disabled")

2366

1749

return

2367

1750

2368

1751

if client.approved or not client.approval_delay:

2369

# We are approved or approval is disabled

1752

#We are approved or approval is disabled

2370

1753

break

2371

1754

elif client.approved is None:

2372

1755

logger.info("Client %s needs approval",

2383

1766

# Emit D-Bus signal

2384

1767

client.Rejected("Denied")

2385

1768

return

2386

2387

# wait until timeout or approved

1769

1770

#wait until timeout or approved

2388

1771

time = datetime.datetime.now()

2389

1772

client.changedstate.acquire()

2390

1773

client.changedstate.wait(delay.total_seconds())

2403

1786

break

2404

1787

else:

2405

1788

delay -= time2 - time

2406

2407

try:

2408

session.send(client.secret)

2409

except gnutls.Error as error:

2410

logger.warning("gnutls send failed",

2411

exc_info=error)

2412

return

2413

1789

1790

sent_size = 0

1791

while sent_size < len(client.secret):

1792

try:

1793

sent = session.send(client.secret[sent_size:])

1794

except gnutls.errors.GNUTLSError as error:

1795

logger.warning("gnutls send failed",

1796

exc_info=error)

1797

return

1798

logger.debug("Sent: %d, remaining: %d",

1799

sent, len(client.secret)

1800

- (sent_size + sent))

1801

sent_size += sent

1802

2414

1803

logger.info("Sending secret to %s", client.name)

2415

1804

# bump the timeout using extended_timeout

2416

1805

client.bump_timeout(client.extended_timeout)

2417

1806

if self.server.use_dbus:

2418

1807

# Emit D-Bus signal

2419

1808

client.GotSecret()

2420

1809

2421

1810

finally:

2422

1811

if approval_required:

2423

1812

client.approvals_pending -= 1

2424

1813

try:

2425

1814

session.bye()

2426

except gnutls.Error as error:

1815

except gnutls.errors.GNUTLSError as error:

2427

1816

logger.warning("GnuTLS bye failed",

2428

1817

exc_info=error)

2429

1818

2430

1819

@staticmethod

2431

1820

def peer_certificate(session):

2432

"Return the peer's certificate as a bytestring"

2433

try:

2434

cert_type = gnutls.certificate_type_get2(session._c_object,

2435

gnutls.CTYPE_PEERS)

2436

except AttributeError:

2437

cert_type = gnutls.certificate_type_get(session._c_object)

2438

if gnutls.has_rawpk:

2439

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2440

else:

2441

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2442

# If not a valid certificate type...

2443

if cert_type not in valid_cert_types:

2444

logger.info("Cert type %r not in %r", cert_type,

2445

valid_cert_types)

2446

# ...return invalid data

2447

return b""

1821

"Return the peer's OpenPGP certificate as a bytestring"

1822

# If not an OpenPGP certificate...

1823

if (gnutls.library.functions

1824

.gnutls_certificate_type_get(session._c_object)

1825

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1826

# ...do the normal thing

1827

return session.peer_certificate

2448

1828

list_size = ctypes.c_uint(1)

2449

cert_list = (gnutls.certificate_get_peers

1829

cert_list = (gnutls.library.functions

1830

.gnutls_certificate_get_peers

2450

1831

(session._c_object, ctypes.byref(list_size)))

2451

1832

if not bool(cert_list) and list_size.value != 0:

2452

raise gnutls.Error("error getting peer certificate")

1833

raise gnutls.errors.GNUTLSError("error getting peer"

1834

" certificate")

2453

1835

if list_size.value == 0:

2454

1836

return None

2455

1837

cert = cert_list[0]

2456

1838

return ctypes.string_at(cert.data, cert.size)

2457

2458

@staticmethod

2459

def key_id(certificate):

2460

"Convert a certificate bytestring to a hexdigit key ID"

2461

# New GnuTLS "datum" with the public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(certificate),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(certificate)))

2466

# XXX all these need to be created in the gnutls "module"

2467

# New empty GnuTLS certificate

2468

pubkey = gnutls.pubkey_t()

2469

gnutls.pubkey_init(ctypes.byref(pubkey))

2470

# Import the raw public key into the certificate

2471

gnutls.pubkey_import(pubkey,

2472

ctypes.byref(datum),

2473

gnutls.X509_FMT_DER)

2474

# New buffer for the key ID

2475

buf = ctypes.create_string_buffer(32)

2476

buf_len = ctypes.c_size_t(len(buf))

2477

# Get the key ID from the raw public key into the buffer

2478

gnutls.pubkey_get_key_id(

2479

pubkey,

2480

gnutls.KEYID_USE_SHA256,

2481

ctypes.cast(ctypes.byref(buf),

2482

ctypes.POINTER(ctypes.c_ubyte)),

2483

ctypes.byref(buf_len))

2484

# Deinit the certificate

2485

gnutls.pubkey_deinit(pubkey)

2486

2487

# Convert the buffer to a Python bytestring

2488

key_id = ctypes.string_at(buf, buf_len.value)

2489

# Convert the bytestring to hexadecimal notation

2490

hex_key_id = binascii.hexlify(key_id).upper()

2491

return hex_key_id

2492

1839

2493

1840

@staticmethod

2494

1841

def fingerprint(openpgp):

2495

1842

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2496

1843

# New GnuTLS "datum" with the OpenPGP public key

2497

datum = gnutls.datum_t(

2498

ctypes.cast(ctypes.c_char_p(openpgp),

2499

ctypes.POINTER(ctypes.c_ubyte)),

2500

ctypes.c_uint(len(openpgp)))

1844

datum = (gnutls.library.types

1845

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1846

ctypes.POINTER

1847

(ctypes.c_ubyte)),

1848

ctypes.c_uint(len(openpgp))))

2501

1849

# New empty GnuTLS certificate

2502

crt = gnutls.openpgp_crt_t()

2503

gnutls.openpgp_crt_init(ctypes.byref(crt))

1850

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2504

1853

# Import the OpenPGP public key into the certificate

2505

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2506

gnutls.OPENPGP_FMT_RAW)

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1856

gnutls.library.constants

1857

.GNUTLS_OPENPGP_FMT_RAW))

2507

1858

# Verify the self signature in the key

2508

1859

crtverify = ctypes.c_uint()

2509

gnutls.openpgp_crt_verify_self(crt, 0,

2510

ctypes.byref(crtverify))

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_verify_self(crt, 0,

1862

ctypes.byref(crtverify)))

2511

1863

if crtverify.value != 0:

2512

gnutls.openpgp_crt_deinit(crt)

2513

raise gnutls.CertificateSecurityError(code

2514

=crtverify.value)

1864

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1865

raise (gnutls.errors.CertificateSecurityError

1866

("Verify failed"))

2515

1867

# New buffer for the fingerprint

2516

1868

buf = ctypes.create_string_buffer(20)

2517

1869

buf_len = ctypes.c_size_t()

2518

1870

# Get the fingerprint from the certificate into the buffer

2519

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2520

ctypes.byref(buf_len))

1871

(gnutls.library.functions

1872

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1873

ctypes.byref(buf_len)))

2521

1874

# Deinit the certificate

2522

gnutls.openpgp_crt_deinit(crt)

1875

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2523

1876

# Convert the buffer to a Python bytestring

2524

1877

fpr = ctypes.string_at(buf, buf_len.value)

2525

1878

# Convert the bytestring to hexadecimal notation

2527

1880

return hex_fpr

2528

1881

2529

1882

2530

class MultiprocessingMixIn:

1883

class MultiprocessingMixIn(object):

2531

1884

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2532

2533

1885

def sub_process_main(self, request, address):

2534

1886

try:

2535

1887

self.finish_request(request, address)

2536

1888

except Exception:

2537

1889

self.handle_error(request, address)

2538

1890

self.close_request(request)

2539

1891

2540

1892

def process_request(self, request, address):

2541

1893

"""Start a new process to process the request."""

2542

proc = multiprocessing.Process(target=self.sub_process_main,

2543

args=(request, address))

1894

proc = multiprocessing.Process(target = self.sub_process_main,

1895

args = (request, address))

2544

1896

proc.start()

2545

1897

return proc

2546

1898

2547

1899

2548

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1900

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2549

1901

""" adds a pipe to the MixIn """

2550

2551

1902

def process_request(self, request, client_address):

2552

1903

"""Overrides and wraps the original process_request().

2553

1904

2554

1905

This function creates a new pipe in self.pipe

2555

1906

"""

2556

1907

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2557

1908

2558

1909

proc = MultiprocessingMixIn.process_request(self, request,

2559

1910

client_address)

2560

1911

self.child_pipe.close()

2561

1912

self.add_pipe(parent_pipe, proc)

2562

1913

2563

1914

def add_pipe(self, parent_pipe, proc):

2564

1915

"""Dummy function; override as necessary"""

2565

1916

raise NotImplementedError()

2566

1917

2567

1918

2568

1919

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2569

socketserver.TCPServer):

1920

socketserver.TCPServer, object):

2570

1921

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2571

1922

2572

1923

Attributes:

2573

1924

enabled: Boolean; whether this server is activated yet

2574

1925

interface: None or a network interface name (string)

2575

1926

use_ipv6: Boolean; to use IPv6 or not

2576

1927

"""

2577

2578

1928

def __init__(self, server_address, RequestHandlerClass,

2579

interface=None,

2580

use_ipv6=True,

2581

socketfd=None):

1929

interface=None, use_ipv6=True, socketfd=None):

2582

1930

"""If socketfd is set, use that file descriptor instead of

2583

1931

creating a new one with socket.socket().

2584

1932

"""

2590

1938

self.socketfd = socketfd

2591

1939

# Save the original socket.socket() function

2592

1940

self.socket_socket = socket.socket

2593

2594

1941

# To implement --socket, we monkey patch socket.socket.

2595

#

1942

#

2596

1943

# (When socketserver.TCPServer is a new-style class, we

2597

1944

# could make self.socket into a property instead of monkey

2598

1945

# patching socket.socket.)

2599

#

1946

#

2600

1947

# Create a one-time-only replacement for socket.socket()

2601

1948

@functools.wraps(socket.socket)

2602

1949

def socket_wrapper(*args, **kwargs):

2614

1961

# socket_wrapper(), if socketfd was set.

2615

1962

socketserver.TCPServer.__init__(self, server_address,

2616

1963

RequestHandlerClass)

2617

1964

2618

1965

def server_bind(self):

2619

1966

"""This overrides the normal server_bind() function

2620

1967

to bind to an interface if one was specified, and also NOT to

2621

1968

bind to an address or port if they were not specified."""

2622

global SO_BINDTODEVICE

2623

1969

if self.interface is not None:

2624

1970

if SO_BINDTODEVICE is None:

2625

# Fall back to a hard-coded value which seems to be

2626

# common enough.

2627

logger.warning("SO_BINDTODEVICE not found, trying 25")

2628

SO_BINDTODEVICE = 25

2629

try:

2630

self.socket.setsockopt(

2631

socket.SOL_SOCKET, SO_BINDTODEVICE,

2632

(self.interface + "\0").encode("utf-8"))

2633

except socket.error as error:

2634

if error.errno == errno.EPERM:

2635

logger.error("No permission to bind to"

2636

" interface %s", self.interface)

2637

elif error.errno == errno.ENOPROTOOPT:

2638

logger.error("SO_BINDTODEVICE not available;"

2639

" cannot bind to interface %s",

2640

self.interface)

2641

elif error.errno == errno.ENODEV:

2642

logger.error("Interface %s does not exist,"

2643

" cannot bind", self.interface)

2644

else:

2645

raise

1971

logger.error("SO_BINDTODEVICE does not exist;"

1972

" cannot bind to interface %s",

1973

self.interface)

1974

else:

1975

try:

1976

self.socket.setsockopt(socket.SOL_SOCKET,

1977

SO_BINDTODEVICE,

1978

(self.interface + "\0")

1979

.encode("utf-8"))

1980

except socket.error as error:

1981

if error.errno == errno.EPERM:

1982

logger.error("No permission to bind to"

1983

" interface %s", self.interface)

1984

elif error.errno == errno.ENOPROTOOPT:

1985

logger.error("SO_BINDTODEVICE not available;"

1986

" cannot bind to interface %s",

1987

self.interface)

1988

elif error.errno == errno.ENODEV:

1989

logger.error("Interface %s does not exist,"

1990

" cannot bind", self.interface)

1991

else:

1992

raise

2646

1993

# Only bind(2) the socket if we really need to.

2647

1994

if self.server_address[0] or self.server_address[1]:

2648

if self.server_address[1]:

2649

self.allow_reuse_address = True

2650

1995

if not self.server_address[0]:

2651

1996

if self.address_family == socket.AF_INET6:

2652

any_address = "::" # in6addr_any

1997

any_address = "::" # in6addr_any

2653

1998

else:

2654

any_address = "0.0.0.0" # INADDR_ANY

1999

any_address = "0.0.0.0" # INADDR_ANY

2655

2000

self.server_address = (any_address,

2656

2001

self.server_address[1])

2657

2002

elif not self.server_address[1]:

2658

self.server_address = (self.server_address[0], 0)

2003

self.server_address = (self.server_address[0],

2004

0)

2659

2005

# if self.interface:

2660

2006

# self.server_address = (self.server_address[0],

2661

2007

# 0, # port

2667

2013

2668

2014

class MandosServer(IPv6_TCPServer):

2669

2015

"""Mandos server.

2670

2016

2671

2017

Attributes:

2672

2018

clients: set of Client objects

2673

2019

gnutls_priority GnuTLS priority string

2674

2020

use_dbus: Boolean; to emit D-Bus signals or not

2675

2676

Assumes a GLib.MainLoop event loop.

2021

2022

Assumes a gobject.MainLoop event loop.

2677

2023

"""

2678

2679

2024

def __init__(self, server_address, RequestHandlerClass,

2680

interface=None,

2681

use_ipv6=True,

2682

clients=None,

2683

gnutls_priority=None,

2684

use_dbus=True,

2685

socketfd=None):

2025

interface=None, use_ipv6=True, clients=None,

2026

gnutls_priority=None, use_dbus=True, socketfd=None):

2686

2027

self.enabled = False

2687

2028

self.clients = clients

2688

2029

if self.clients is None:

2691

2032

self.gnutls_priority = gnutls_priority

2692

2033

IPv6_TCPServer.__init__(self, server_address,

2693

2034

RequestHandlerClass,

2694

interface=interface,

2695

use_ipv6=use_ipv6,

2696

socketfd=socketfd)

2697

2035

interface = interface,

2036

use_ipv6 = use_ipv6,

2037

socketfd = socketfd)

2698

2038

def server_activate(self):

2699

2039

if self.enabled:

2700

2040

return socketserver.TCPServer.server_activate(self)

2701

2041

2702

2042

def enable(self):

2703

2043

self.enabled = True

2704

2044

2705

2045

def add_pipe(self, parent_pipe, proc):

2706

2046

# Call "handle_ipc" for both data and EOF events

2707

GLib.io_add_watch(

2708

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2709

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2710

functools.partial(self.handle_ipc,

2711

parent_pipe=parent_pipe,

2712

proc=proc))

2713

2714

def handle_ipc(self, source, condition,

2715

parent_pipe=None,

2716

proc=None,

2717

client_object=None):

2047

gobject.io_add_watch(parent_pipe.fileno(),

2048

gobject.IO_IN | gobject.IO_HUP,

2049

functools.partial(self.handle_ipc,

2050

parent_pipe =

2051

parent_pipe,

2052

proc = proc))

2053

2054

def handle_ipc(self, source, condition, parent_pipe=None,

2055

proc = None, client_object=None):

2718

2056

# error, or the other end of multiprocessing.Pipe has closed

2719

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2057

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2720

2058

# Wait for other process to exit

2721

2059

proc.join()

2722

2060

return False

2723

2061

2724

2062

# Read a request from the child

2725

2063

request = parent_pipe.recv()

2726

2064

command = request[0]

2727

2065

2728

2066

if command == 'init':

2729

key_id = request[1].decode("ascii")

2730

fpr = request[2].decode("ascii")

2731

address = request[3]

2732

2733

for c in self.clients.values():

2734

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2735

"27AE41E4649B934CA495991B7852B855"):

2736

continue

2737

if key_id and c.key_id == key_id:

2738

client = c

2739

break

2740

if fpr and c.fingerprint == fpr:

2067

fpr = request[1]

2068

address = request[2]

2069

2070

for c in self.clients.itervalues():

2071

if c.fingerprint == fpr:

2741

2072

client = c

2742

2073

break

2743

2074

else:

2744

logger.info("Client not found for key ID: %s, address"

2745

": %s", key_id or fpr, address)

2075

logger.info("Client not found for fingerprint: %s, ad"

2076

"dress: %s", fpr, address)

2746

2077

if self.use_dbus:

2747

2078

# Emit D-Bus signal

2748

mandos_dbus_service.ClientNotFound(key_id or fpr,

2079

mandos_dbus_service.ClientNotFound(fpr,

2749

2080

address[0])

2750

2081

parent_pipe.send(False)

2751

2082

return False

2752

2753

GLib.io_add_watch(

2754

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2755

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2756

functools.partial(self.handle_ipc,

2757

parent_pipe=parent_pipe,

2758

proc=proc,

2759

client_object=client))

2083

2084

gobject.io_add_watch(parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe =

2088

parent_pipe,

2089

proc = proc,

2090

client_object =

2091

client))

2760

2092

parent_pipe.send(True)

2761

2093

# remove the old hook in favor of the new above hook on

2762

2094

# same fileno

2765

2097

funcname = request[1]

2766

2098

args = request[2]

2767

2099

kwargs = request[3]

2768

2100

2769

2101

parent_pipe.send(('data', getattr(client_object,

2770

2102

funcname)(*args,

2771

**kwargs)))

2772

2103

**kwargs)))

2104

2773

2105

if command == 'getattr':

2774

2106

attrname = request[1]

2775

if isinstance(client_object.__getattribute__(attrname),

2776

collections.abc.Callable):

2777

parent_pipe.send(('function', ))

2107

if callable(client_object.__getattribute__(attrname)):

2108

parent_pipe.send(('function',))

2778

2109

else:

2779

parent_pipe.send((

2780

'data', client_object.__getattribute__(attrname)))

2781

2110

parent_pipe.send(('data', client_object

2111

.__getattribute__(attrname)))

2112

2782

2113

if command == 'setattr':

2783

2114

attrname = request[1]

2784

2115

value = request[2]

2785

2116

setattr(client_object, attrname, value)

2786

2117

2787

2118

return True

2788

2119

2789

2120

2790

2121

def rfc3339_duration_to_delta(duration):

2791

2122

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2792

2793

>>> timedelta = datetime.timedelta

2794

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2795

True

2796

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2797

True

2798

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2799

True

2800

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2801

True

2802

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2803

True

2804

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2805

True

2806

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2807

True

2808

>>> del timedelta

2123

2124

>>> rfc3339_duration_to_delta("P7D")

2125

datetime.timedelta(7)

2126

>>> rfc3339_duration_to_delta("PT60S")

2127

datetime.timedelta(0, 60)

2128

>>> rfc3339_duration_to_delta("PT60M")

2129

datetime.timedelta(0, 3600)

2130

>>> rfc3339_duration_to_delta("PT24H")

2131

datetime.timedelta(1)

2132

>>> rfc3339_duration_to_delta("P1W")

2133

datetime.timedelta(7)

2134

>>> rfc3339_duration_to_delta("PT5M30S")

2135

datetime.timedelta(0, 330)

2136

>>> rfc3339_duration_to_delta("P1DT3M20S")

2137

datetime.timedelta(1, 200)

2809

2138

"""

2810

2139

2811

2140

# Parsing an RFC 3339 duration with regular expressions is not

2812

2141

# possible - there would have to be multiple places for the same

2813

2142

# values, like seconds. The current code, while more esoteric, is

2814

2143

# cleaner without depending on a parsing library. If Python had a

2815

2144

# built-in library for parsing we would use it, but we'd like to

2816

2145

# avoid excessive use of external libraries.

2817

2146

2818

2147

# New type for defining tokens, syntax, and semantics all-in-one

2819

Token = collections.namedtuple("Token", (

2820

"regexp", # To match token; if "value" is not None, must have

2821

# a "group" containing digits

2822

"value", # datetime.timedelta or None

2823

"followers")) # Tokens valid after this token

2148

Token = collections.namedtuple("Token",

2149

("regexp", # To match token; if

2150

# "value" is not None,

2151

# must have a "group"

2152

# containing digits

2153

"value", # datetime.timedelta or

2154

# None

2155

"followers")) # Tokens valid after

2156

# this token

2824

2157

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2825

2158

# the "duration" ABNF definition in RFC 3339, Appendix A.

2826

2159

token_end = Token(re.compile(r"$"), None, frozenset())

2827

2160

token_second = Token(re.compile(r"(\d+)S"),

2828

2161

datetime.timedelta(seconds=1),

2829

frozenset((token_end, )))

2162

frozenset((token_end,)))

2830

2163

token_minute = Token(re.compile(r"(\d+)M"),

2831

2164

datetime.timedelta(minutes=1),

2832

2165

frozenset((token_second, token_end)))

2848

2181

frozenset((token_month, token_end)))

2849

2182

token_week = Token(re.compile(r"(\d+)W"),

2850

2183

datetime.timedelta(weeks=1),

2851

frozenset((token_end, )))

2184

frozenset((token_end,)))

2852

2185

token_duration = Token(re.compile(r"P"), None,

2853

2186

frozenset((token_year, token_month,

2854

2187

token_day, token_time,

2855

2188

token_week)))

2856

# Define starting values:

2857

# Value so far

2858

value = datetime.timedelta()

2189

# Define starting values

2190

value = datetime.timedelta() # Value so far

2859

2191

found_token = None

2860

# Following valid tokens

2861

followers = frozenset((token_duration, ))

2862

# String left to parse

2863

s = duration

2192

followers = frozenset((token_duration,)) # Following valid tokens

2193

s = duration # String left to parse

2864

2194

# Loop until end token is found

2865

2195

while found_token is not token_end:

2866

2196

# Search for any currently valid tokens

2882

2212

break

2883

2213

else:

2884

2214

# No currently valid tokens were found

2885

raise ValueError("Invalid RFC 3339 duration: {!r}"

2886

.format(duration))

2215

raise ValueError("Invalid RFC 3339 duration")

2887

2216

# End token found

2888

2217

return value

2889

2218

2890

2219

2891

2220

def string_to_delta(interval):

2892

2221

"""Parse a string and return a datetime.timedelta

2893

2894

>>> string_to_delta('7d') == datetime.timedelta(7)

2895

True

2896

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2897

True

2898

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2899

True

2900

>>> string_to_delta('24h') == datetime.timedelta(1)

2901

True

2902

>>> string_to_delta('1w') == datetime.timedelta(7)

2903

True

2904

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2905

True

2222

2223

>>> string_to_delta('7d')

2224

datetime.timedelta(7)

2225

>>> string_to_delta('60s')

2226

datetime.timedelta(0, 60)

2227

>>> string_to_delta('60m')

2228

datetime.timedelta(0, 3600)

2229

>>> string_to_delta('24h')

2230

datetime.timedelta(1)

2231

>>> string_to_delta('1w')

2232

datetime.timedelta(7)

2233

>>> string_to_delta('5m 30s')

2234

datetime.timedelta(0, 330)

2906

2235

"""

2907

2236

2908

2237

try:

2909

2238

return rfc3339_duration_to_delta(interval)

2910

2239

except ValueError:

2911

2240

pass

2912

2241

2913

2242

timevalue = datetime.timedelta(0)

2914

2243

for s in interval.split():

2915

2244

try:

2926

2255

elif suffix == "w":

2927

2256

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2928

2257

else:

2929

raise ValueError("Unknown suffix {!r}".format(suffix))

2258

raise ValueError("Unknown suffix {!r}"

2259

.format(suffix))

2930

2260

except IndexError as e:

2931

2261

raise ValueError(*(e.args))

2932

2262

timevalue += delta

2933

2263

return timevalue

2934

2264

2935

2265

2936

def daemon(nochdir=False, noclose=False):

2266

def daemon(nochdir = False, noclose = False):

2937

2267

"""See daemon(3). Standard BSD Unix function.

2938

2268

2939

2269

This should really exist as os.daemon, but it doesn't (yet)."""

2940

2270

if os.fork():

2941

2271

sys.exit()

2948

2278

# Close all standard open file descriptors

2949

2279

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2950

2280

if not stat.S_ISCHR(os.fstat(null).st_mode):

2951

raise OSError(errno.ENODEV,

2952

"{} not a character device"

2281

raise OSError(errno.ENODEV, "{} not a character device"

2953

2282

.format(os.devnull))

2954

2283

os.dup2(null, sys.stdin.fileno())

2955

2284

os.dup2(null, sys.stdout.fileno())

2959

2288

2960

2289

2961

2290

def main():

2962

2291

2963

2292

##################################################################

2964

2293

# Parsing of options, both command line and config file

2965

2294

2966

2295

parser = argparse.ArgumentParser()

2967

2296

parser.add_argument("-v", "--version", action="version",

2968

version="%(prog)s {}".format(version),

2297

version = "%(prog)s {}".format(version),

2969

2298

help="show version number and exit")

2970

2299

parser.add_argument("-i", "--interface", metavar="IF",

2971

2300

help="Bind to interface IF")

3007

2336

parser.add_argument("--no-zeroconf", action="store_false",

3008

2337

dest="zeroconf", help="Do not use Zeroconf",

3009

2338

default=None)

3010

2339

3011

2340

options = parser.parse_args()

3012

2341

2342

if options.check:

2343

import doctest

2344

fail_count, test_count = doctest.testmod()

2345

sys.exit(os.EX_OK if fail_count == 0 else 1)

2346

3013

2347

# Default values for config file for server-global settings

3014

if gnutls.has_rawpk:

3015

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3016

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3017

else:

3018

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3019

":+SIGN-DSA-SHA256")

3020

server_defaults = {"interface": "",

3021

"address": "",

3022

"port": "",

3023

"debug": "False",

3024

"priority": priority,

3025

"servicename": "Mandos",

3026

"use_dbus": "True",

3027

"use_ipv6": "True",

3028

"debuglevel": "",

3029

"restore": "True",

3030

"socket": "",

3031

"statedir": "/var/lib/mandos",

3032

"foreground": "False",

3033

"zeroconf": "True",

3034

}

3035

del priority

3036

2348

server_defaults = { "interface": "",

2349

"address": "",

2350

"port": "",

2351

"debug": "False",

2352

"priority":

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2354

"servicename": "Mandos",

2355

"use_dbus": "True",

2356

"use_ipv6": "True",

2357

"debuglevel": "",

2358

"restore": "True",

2359

"socket": "",

2360

"statedir": "/var/lib/mandos",

2361

"foreground": "False",

2362

"zeroconf": "True",

2363

}

2364

3037

2365

# Parse config file for server-global settings

3038

server_config = configparser.ConfigParser(server_defaults)

2366

server_config = configparser.SafeConfigParser(server_defaults)

3039

2367

del server_defaults

3040

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3041

# Convert the ConfigParser object to a dict

2368

server_config.read(os.path.join(options.configdir,

2369

"mandos.conf"))

2370

# Convert the SafeConfigParser object to a dict

3042

2371

server_settings = server_config.defaults()

3043

2372

# Use the appropriate methods on the non-string config options

3044

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3045

"foreground", "zeroconf"):

2373

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3046

2374

server_settings[option] = server_config.getboolean("DEFAULT",

3047

2375

option)

3048

2376

if server_settings["port"]:

3058

2386

server_settings["socket"] = os.dup(server_settings

3059

2387

["socket"])

3060

2388

del server_config

3061

2389

3062

2390

# Override the settings from the config file with command line

3063

2391

# options, if set.

3064

2392

for option in ("interface", "address", "port", "debug",

3065

"priority", "servicename", "configdir", "use_dbus",

3066

"use_ipv6", "debuglevel", "restore", "statedir",

3067

"socket", "foreground", "zeroconf"):

2393

"priority", "servicename", "configdir",

2394

"use_dbus", "use_ipv6", "debuglevel", "restore",

2395

"statedir", "socket", "foreground", "zeroconf"):

3068

2396

value = getattr(options, option)

3069

2397

if value is not None:

3070

2398

server_settings[option] = value

3082

2410

if server_settings["debug"]:

3083

2411

server_settings["foreground"] = True

3084

2412

# Now we have our good server settings in "server_settings"

3085

2413

3086

2414

##################################################################

3087

3088

if (not server_settings["zeroconf"]

3089

and not (server_settings["port"]

3090

or server_settings["socket"] != "")):

3091

parser.error("Needs port or socket to work without Zeroconf")

3092

2415

2416

if (not server_settings["zeroconf"] and

2417

not (server_settings["port"]

2418

or server_settings["socket"] != "")):

2419

parser.error("Needs port or socket to work without"

2420

" Zeroconf")

2421

3093

2422

# For convenience

3094

2423

debug = server_settings["debug"]

3095

2424

debuglevel = server_settings["debuglevel"]

3099

2428

stored_state_file)

3100

2429

foreground = server_settings["foreground"]

3101

2430

zeroconf = server_settings["zeroconf"]

3102

2431

3103

2432

if debug:

3104

2433

initlogger(debug, logging.DEBUG)

3105

2434

else:

3108

2437

else:

3109

2438

level = getattr(logging, debuglevel.upper())

3110

2439

initlogger(debug, level)

3111

2440

3112

2441

if server_settings["servicename"] != "Mandos":

3113

syslogger.setFormatter(

3114

logging.Formatter('Mandos ({}) [%(process)d]:'

3115

' %(levelname)s: %(message)s'.format(

3116

server_settings["servicename"])))

3117

2442

syslogger.setFormatter(logging.Formatter

2443

('Mandos ({}) [%(process)d]:'

2444

' %(levelname)s: %(message)s'

2445

.format(server_settings

2446

["servicename"])))

2447

3118

2448

# Parse config file with clients

3119

client_config = configparser.ConfigParser(Client.client_defaults)

2449

client_config = configparser.SafeConfigParser(Client

2450

.client_defaults)

3120

2451

client_config.read(os.path.join(server_settings["configdir"],

3121

2452

"clients.conf"))

3122

2453

3123

2454

global mandos_dbus_service

3124

2455

mandos_dbus_service = None

3125

2456

3126

2457

socketfd = None

3127

2458

if server_settings["socket"] != "":

3128

2459

socketfd = server_settings["socket"]

3129

tcp_server = MandosServer(

3130

(server_settings["address"], server_settings["port"]),

3131

ClientHandler,

3132

interface=(server_settings["interface"] or None),

3133

use_ipv6=use_ipv6,

3134

gnutls_priority=server_settings["priority"],

3135

use_dbus=use_dbus,

3136

socketfd=socketfd)

2460

tcp_server = MandosServer((server_settings["address"],

2461

server_settings["port"]),

2462

ClientHandler,

2463

interface=(server_settings["interface"]

2464

or None),

2465

use_ipv6=use_ipv6,

2466

gnutls_priority=

2467

server_settings["priority"],

2468

use_dbus=use_dbus,

2469

socketfd=socketfd)

3137

2470

if not foreground:

3138

2471

pidfilename = "/run/mandos.pid"

3139

2472

if not os.path.isdir("/run/."):

3140

2473

pidfilename = "/var/run/mandos.pid"

3141

2474

pidfile = None

3142

2475

try:

3143

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2476

pidfile = open(pidfilename, "w")

3144

2477

except IOError as e:

3145

2478

logger.error("Could not open file %r", pidfilename,

3146

2479

exc_info=e)

3147

3148

for name, group in (("_mandos", "_mandos"),

3149

("mandos", "mandos"),

3150

("nobody", "nogroup")):

2480

2481

for name in ("_mandos", "mandos", "nobody"):

3151

2482

try:

3152

2483

uid = pwd.getpwnam(name).pw_uid

3153

gid = pwd.getpwnam(group).pw_gid

2484

gid = pwd.getpwnam(name).pw_gid

3154

2485

break

3155

2486

except KeyError:

3156

2487

continue

3160

2491

try:

3161

2492

os.setgid(gid)

3162

2493

os.setuid(uid)

3163

if debug:

3164

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3165

gid))

3166

2494

except OSError as error:

3167

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3168

.format(uid, gid, os.strerror(error.errno)))

3169

2495

if error.errno != errno.EPERM:

3170

2496

raise

3171

2497

3172

2498

if debug:

3173

2499

# Enable all possible GnuTLS debugging

3174

2500

3175

2501

# "Use a log level over 10 to enable all debugging options."

3176

2502

# - GnuTLS manual

3177

gnutls.global_set_log_level(11)

3178

3179

@gnutls.log_func

2503

gnutls.library.functions.gnutls_global_set_log_level(11)

2504

2505

@gnutls.library.types.gnutls_log_func

3180

2506

def debug_gnutls(level, string):

3181

2507

logger.debug("GnuTLS: %s", string[:-1])

3182

3183

gnutls.global_set_log_function(debug_gnutls)

3184

2508

2509

(gnutls.library.functions

2510

.gnutls_global_set_log_function(debug_gnutls))

2511

3185

2512

# Redirect stdin so all checkers get /dev/null

3186

2513

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3187

2514

os.dup2(null, sys.stdin.fileno())

3188

2515

if null > 2:

3189

2516

os.close(null)

3190

2517

3191

2518

# Need to fork before connecting to D-Bus

3192

2519

if not foreground:

3193

2520

# Close all input and output, do double fork, etc.

3194

2521

daemon()

3195

3196

if gi.version_info < (3, 10, 2):

3197

# multiprocessing will use threads, so before we use GLib we

3198

# need to inform GLib that threads will be used.

3199

GLib.threads_init()

3200

2522

2523

# multiprocessing will use threads, so before we use gobject we

2524

# need to inform gobject that threads will be used.

2525

gobject.threads_init()

2526

3201

2527

global main_loop

3202

2528

# From the Avahi example code

3203

2529

DBusGMainLoop(set_as_default=True)

3204

main_loop = GLib.MainLoop()

2530

main_loop = gobject.MainLoop()

3205

2531

bus = dbus.SystemBus()

3206

2532

# End of Avahi example code

3207

2533

if use_dbus:

3208

2534

try:

3209

2535

bus_name = dbus.service.BusName("se.recompile.Mandos",

3210

bus,

3211

do_not_queue=True)

3212

old_bus_name = dbus.service.BusName(

3213

"se.bsnet.fukt.Mandos", bus,

3214

do_not_queue=True)

3215

except dbus.exceptions.DBusException as e:

2536

bus, do_not_queue=True)

2537

old_bus_name = (dbus.service.BusName

2538

("se.bsnet.fukt.Mandos", bus,

2539

do_not_queue=True))

2540

except dbus.exceptions.NameExistsException as e:

3216

2541

logger.error("Disabling D-Bus:", exc_info=e)

3217

2542

use_dbus = False

3218

2543

server_settings["use_dbus"] = False

3219

2544

tcp_server.use_dbus = False

3220

2545

if zeroconf:

3221

2546

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3222

service = AvahiServiceToSyslog(

3223

name=server_settings["servicename"],

3224

servicetype="_mandos._tcp",

3225

protocol=protocol,

3226

bus=bus)

2547

service = AvahiServiceToSyslog(name =

2548

server_settings["servicename"],

2549

servicetype = "_mandos._tcp",

2550

protocol = protocol, bus = bus)

3227

2551

if server_settings["interface"]:

3228

service.interface = if_nametoindex(

3229

server_settings["interface"].encode("utf-8"))

3230

2552

service.interface = (if_nametoindex

2553

(server_settings["interface"]

2554

.encode("utf-8")))

2555

3231

2556

global multiprocessing_manager

3232

2557

multiprocessing_manager = multiprocessing.Manager()

3233

2558

3234

2559

client_class = Client

3235

2560

if use_dbus:

3236

client_class = functools.partial(ClientDBus, bus=bus)

3237

2561

client_class = functools.partial(ClientDBus, bus = bus)

2562

3238

2563

client_settings = Client.config_parser(client_config)

3239

2564

old_client_settings = {}

3240

2565

clients_data = {}

3241

2566

3242

2567

# This is used to redirect stdout and stderr for checker processes

3243

2568

global wnull

3244

wnull = open(os.devnull, "w") # A writable /dev/null

2569

wnull = open(os.devnull, "w") # A writable /dev/null

3245

2570

# Only used if server is running in foreground but not in debug

3246

2571

# mode

3247

2572

if debug or not foreground:

3248

2573

wnull.close()

3249

2574

3250

2575

# Get client data and settings from last running state.

3251

2576

if server_settings["restore"]:

3252

2577

try:

3253

2578

with open(stored_state_path, "rb") as stored_state:

3254

if sys.version_info.major == 2:

3255

clients_data, old_client_settings = pickle.load(

3256

stored_state)

3257

else:

3258

bytes_clients_data, bytes_old_client_settings = (

3259

pickle.load(stored_state, encoding="bytes"))

3260

# Fix bytes to strings

3261

# clients_data

3262

# .keys()

3263

clients_data = {(key.decode("utf-8")

3264

if isinstance(key, bytes)

3265

else key): value

3266

for key, value in

3267

bytes_clients_data.items()}

3268

del bytes_clients_data

3269

for key in clients_data:

3270

value = {(k.decode("utf-8")

3271

if isinstance(k, bytes) else k): v

3272

for k, v in

3273

clients_data[key].items()}

3274

clients_data[key] = value

3275

# .client_structure

3276

value["client_structure"] = [

3277

(s.decode("utf-8")

3278

if isinstance(s, bytes)

3279

else s) for s in

3280

value["client_structure"]]

3281

# .name, .host, and .checker_command

3282

for k in ("name", "host", "checker_command"):

3283

if isinstance(value[k], bytes):

3284

value[k] = value[k].decode("utf-8")

3285

if "key_id" not in value:

3286

value["key_id"] = ""

3287

elif "fingerprint" not in value:

3288

value["fingerprint"] = ""

3289

# old_client_settings

3290

# .keys()

3291

old_client_settings = {

3292

(key.decode("utf-8")

3293

if isinstance(key, bytes)

3294

else key): value

3295

for key, value in

3296

bytes_old_client_settings.items()}

3297

del bytes_old_client_settings

3298

# .host and .checker_command

3299

for value in old_client_settings.values():

3300

for attribute in ("host", "checker_command"):

3301

if isinstance(value[attribute], bytes):

3302

value[attribute] = (value[attribute]

3303

.decode("utf-8"))

2579

clients_data, old_client_settings = (pickle.load

2580

(stored_state))

3304

2581

os.remove(stored_state_path)

3305

2582

except IOError as e:

3306

2583

if e.errno == errno.ENOENT:

3307

logger.warning("Could not load persistent state:"

3308

" {}".format(os.strerror(e.errno)))

2584

logger.warning("Could not load persistent state: {}"

2585

.format(os.strerror(e.errno)))

3309

2586

else:

3310

2587

logger.critical("Could not load persistent state:",

3311

2588

exc_info=e)

3312

2589

raise

3313

2590

except EOFError as e:

3314

2591

logger.warning("Could not load persistent state: "

3315

"EOFError:",

3316

exc_info=e)

3317

2592

"EOFError:", exc_info=e)

2593

3318

2594

with PGPEngine() as pgp:

3319

2595

for client_name, client in clients_data.items():

3320

2596

# Skip removed clients

3321

2597

if client_name not in client_settings:

3322

2598

continue

3323

2599

3324

2600

# Decide which value to use after restoring saved state.

3325

2601

# We have three different values: Old config file,

3326

2602

# new config file, and saved state.

3331

2607

# For each value in new config, check if it

3332

2608

# differs from the old config value (Except for

3333

2609

# the "secret" attribute)

3334

if (name != "secret"

3335

and (value !=

3336

old_client_settings[client_name][name])):

2610

if (name != "secret" and

2611

value != old_client_settings[client_name]

2612

[name]):

3337

2613

client[name] = value

3338

2614

except KeyError:

3339

2615

pass

3340

2616

3341

2617

# Clients who has passed its expire date can still be

3342

# enabled if its last checker was successful. A Client

2618

# enabled if its last checker was successful. Clients

3343

2619

# whose checker succeeded before we stored its state is

3344

2620

# assumed to have successfully run all checkers during

3345

2621

# downtime.

3348

2624

if not client["last_checked_ok"]:

3349

2625

logger.warning(

3350

2626

"disabling client {} - Client never "

3351

"performed a successful checker".format(

3352

client_name))

2627

"performed a successful checker"

2628

.format(client_name))

3353

2629

client["enabled"] = False

3354

2630

elif client["last_checker_status"] != 0:

3355

2631

logger.warning(

3356

2632

"disabling client {} - Client last"

3357

" checker failed with error code"

3358

" {}".format(

3359

client_name,

3360

client["last_checker_status"]))

2633

" checker failed with error code {}"

2634

.format(client_name,

2635

client["last_checker_status"]))

3361

2636

client["enabled"] = False

3362

2637

else:

3363

client["expires"] = (

3364

datetime.datetime.utcnow()

3365

+ client["timeout"])

2638

client["expires"] = (datetime.datetime

2639

.utcnow()

2640

+ client["timeout"])

3366

2641

logger.debug("Last checker succeeded,"

3367

" keeping {} enabled".format(

3368

client_name))

2642

" keeping {} enabled"

2643

.format(client_name))

3369

2644

try:

3370

client["secret"] = pgp.decrypt(

3371

client["encrypted_secret"],

3372

client_settings[client_name]["secret"])

2645

client["secret"] = (

2646

pgp.decrypt(client["encrypted_secret"],

2647

client_settings[client_name]

2648

["secret"]))

3373

2649

except PGPError:

3374

2650

# If decryption fails, we use secret from new settings

3375

logger.debug("Failed to decrypt {} old secret".format(

3376

client_name))

3377

client["secret"] = (client_settings[client_name]

3378

["secret"])

3379

2651

logger.debug("Failed to decrypt {} old secret"

2652

.format(client_name))

2653

client["secret"] = (

2654

client_settings[client_name]["secret"])

2655

3380

2656

# Add/remove clients based on new changes made to config

3381

2657

for client_name in (set(old_client_settings)

3382

2658

- set(client_settings)):

3384

2660

for client_name in (set(client_settings)

3385

2661

- set(old_client_settings)):

3386

2662

clients_data[client_name] = client_settings[client_name]

3387

2663

3388

2664

# Create all client objects

3389

2665

for client_name, client in clients_data.items():

3390

2666

tcp_server.clients[client_name] = client_class(

3391

name=client_name,

3392

settings=client,

3393

server_settings=server_settings)

3394

2667

name = client_name, settings = client,

2668

server_settings = server_settings)

2669

3395

2670

if not tcp_server.clients:

3396

2671

logger.warning("No clients defined")

3397

2672

3398

2673

if not foreground:

3399

2674

if pidfile is not None:

3400

pid = os.getpid()

3401

2675

try:

3402

2676

with pidfile:

3403

print(pid, file=pidfile)

2677

pid = os.getpid()

2678

pidfile.write("{}\n".format(pid).encode("utf-8"))

3404

2679

except IOError:

3405

2680

logger.error("Could not write to file %r with PID %d",

3406

2681

pidfilename, pid)

3407

2682

del pidfile

3408

2683

del pidfilename

3409

3410

for termsig in (signal.SIGHUP, signal.SIGTERM):

3411

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3412

lambda: main_loop.quit() and False)

3413

2684

2685

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2686

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2687

3414

2688

if use_dbus:

3415

3416

@alternate_dbus_interfaces(

3417

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3418

class MandosDBusService(DBusObjectWithObjectManager):

2689

@alternate_dbus_interfaces({"se.recompile.Mandos":

2690

"se.bsnet.fukt.Mandos"})

2691

class MandosDBusService(DBusObjectWithProperties):

3419

2692

"""A D-Bus proxy object"""

3420

3421

2693

def __init__(self):

3422

2694

dbus.service.Object.__init__(self, bus, "/")

3423

3424

2695

_interface = "se.recompile.Mandos"

3425

2696

2697

@dbus_interface_annotations(_interface)

2698

def _foo(self):

2699

return { "org.freedesktop.DBus.Property"

2700

".EmitsChangedSignal":

2701

"false"}

2702

3426

2703

@dbus.service.signal(_interface, signature="o")

3427

2704

def ClientAdded(self, objpath):

3428

2705

"D-Bus signal"

3429

2706

pass

3430

2707

3431

2708

@dbus.service.signal(_interface, signature="ss")

3432

def ClientNotFound(self, key_id, address):

2709

def ClientNotFound(self, fingerprint, address):

3433

2710

"D-Bus signal"

3434

2711

pass

3435

3436

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3437

"true"})

2712

3438

2713

@dbus.service.signal(_interface, signature="os")

3439

2714

def ClientRemoved(self, objpath, name):

3440

2715

"D-Bus signal"

3441

2716

pass

3442

3443

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3444

"true"})

2717

3445

2718

@dbus.service.method(_interface, out_signature="ao")

3446

2719

def GetAllClients(self):

3447

2720

"D-Bus method"

3448

return dbus.Array(c.dbus_object_path for c in

3449

tcp_server.clients.values())

3450

3451

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3452

"true"})

2721

return dbus.Array(c.dbus_object_path

2722

for c in

2723

tcp_server.clients.itervalues())

2724

3453

2725

@dbus.service.method(_interface,

3454

2726

out_signature="a{oa{sv}}")

3455

2727

def GetAllClientsWithProperties(self):

3456

2728

"D-Bus method"

3457

2729

return dbus.Dictionary(

3458

{c.dbus_object_path: c.GetAll(

3459

"se.recompile.Mandos.Client")

3460

for c in tcp_server.clients.values()},

2730

{ c.dbus_object_path: c.GetAll("")

2731

for c in tcp_server.clients.itervalues() },

3461

2732

signature="oa{sv}")

3462

2733

3463

2734

@dbus.service.method(_interface, in_signature="o")

3464

2735

def RemoveClient(self, object_path):

3465

2736

"D-Bus method"

3466

for c in tcp_server.clients.values():

2737

for c in tcp_server.clients.itervalues():

3467

2738

if c.dbus_object_path == object_path:

3468

2739

del tcp_server.clients[c.name]

3469

2740

c.remove_from_connection()

3470

# Don't signal the disabling

2741

# Don't signal anything except ClientRemoved

3471

2742

c.disable(quiet=True)

3472

# Emit D-Bus signal for removal

3473

self.client_removed_signal(c)

2743

# Emit D-Bus signal

2744

self.ClientRemoved(object_path, c.name)

3474

2745

return

3475

2746

raise KeyError(object_path)

3476

2747

3477

2748

del _interface

3478

3479

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3480

out_signature="a{oa{sa{sv}}}")

3481

def GetManagedObjects(self):

3482

"""D-Bus method"""

3483

return dbus.Dictionary(

3484

{client.dbus_object_path:

3485

dbus.Dictionary(

3486

{interface: client.GetAll(interface)

3487

for interface in

3488

client._get_all_interface_names()})

3489

for client in tcp_server.clients.values()})

3490

3491

def client_added_signal(self, client):

3492

"""Send the new standard signal and the old signal"""

3493

if use_dbus:

3494

# New standard signal

3495

self.InterfacesAdded(

3496

client.dbus_object_path,

3497

dbus.Dictionary(

3498

{interface: client.GetAll(interface)

3499

for interface in

3500

client._get_all_interface_names()}))

3501

# Old signal

3502

self.ClientAdded(client.dbus_object_path)

3503

3504

def client_removed_signal(self, client):

3505

"""Send the new standard signal and the old signal"""

3506

if use_dbus:

3507

# New standard signal

3508

self.InterfacesRemoved(

3509

client.dbus_object_path,

3510

client._get_all_interface_names())

3511

# Old signal

3512

self.ClientRemoved(client.dbus_object_path,

3513

client.name)

3514

2749

3515

2750

mandos_dbus_service = MandosDBusService()

3516

3517

# Save modules to variables to exempt the modules from being

3518

# unloaded before the function registered with atexit() is run.

3519

mp = multiprocessing

3520

wn = wnull

3521

2751

3522

2752

def cleanup():

3523

2753

"Cleanup function; run on exit"

3524

2754

if zeroconf:

3525

2755

service.cleanup()

3526

3527

mp.active_children()

3528

wn.close()

2756

2757

multiprocessing.active_children()

2758

wnull.close()

3529

2759

if not (tcp_server.clients or client_settings):

3530

2760

return

3531

2761

3532

2762

# Store client before exiting. Secrets are encrypted with key

3533

2763

# based on what config file has. If config file is

3534

2764

# removed/edited, old secret will thus be unrecovable.

3535

2765

clients = {}

3536

2766

with PGPEngine() as pgp:

3537

for client in tcp_server.clients.values():

2767

for client in tcp_server.clients.itervalues():

3538

2768

key = client_settings[client.name]["secret"]

3539

2769

client.encrypted_secret = pgp.encrypt(client.secret,

3540

2770

key)

3541

2771

client_dict = {}

3542

2772

3543

2773

# A list of attributes that can not be pickled

3544

2774

# + secret.

3545

exclude = {"bus", "changedstate", "secret",

3546

"checker", "server_settings"}

3547

for name, typ in inspect.getmembers(dbus.service

3548

.Object):

2775

exclude = { "bus", "changedstate", "secret",

2776

"checker", "server_settings" }

2777

for name, typ in (inspect.getmembers

2778

(dbus.service.Object)):

3549

2779

exclude.add(name)

3550

2780

3551

2781

client_dict["encrypted_secret"] = (client

3552

2782

.encrypted_secret)

3553

2783

for attr in client.client_structure:

3554

2784

if attr not in exclude:

3555

2785

client_dict[attr] = getattr(client, attr)

3556

2786

3557

2787

clients[client.name] = client_dict

3558

2788

del client_settings[client.name]["secret"]

3559

2789

3560

2790

try:

3561

with tempfile.NamedTemporaryFile(

3562

mode='wb',

3563

suffix=".pickle",

3564

prefix='clients-',

3565

dir=os.path.dirname(stored_state_path),

3566

delete=False) as stored_state:

3567

pickle.dump((clients, client_settings), stored_state,

3568

protocol=2)

3569

tempname = stored_state.name

2791

with (tempfile.NamedTemporaryFile

2792

(mode='wb', suffix=".pickle", prefix='clients-',

2793

dir=os.path.dirname(stored_state_path),

2794

delete=False)) as stored_state:

2795

pickle.dump((clients, client_settings), stored_state)

2796

tempname=stored_state.name

3570

2797

os.rename(tempname, stored_state_path)

3571

2798

except (IOError, OSError) as e:

3572

2799

if not debug:

3581

2808

logger.warning("Could not save persistent state:",

3582

2809

exc_info=e)

3583

2810

raise

3584

2811

3585

2812

# Delete all clients, and settings from config

3586

2813

while tcp_server.clients:

3587

2814

name, client = tcp_server.clients.popitem()

3588

2815

if use_dbus:

3589

2816

client.remove_from_connection()

3590

# Don't signal the disabling

2817

# Don't signal anything except ClientRemoved

3591

2818

client.disable(quiet=True)

3592

# Emit D-Bus signal for removal

3593

2819

if use_dbus:

3594

mandos_dbus_service.client_removed_signal(client)

2820

# Emit D-Bus signal

2821

mandos_dbus_service.ClientRemoved(client

2822

.dbus_object_path,

2823

client.name)

3595

2824

client_settings.clear()

3596

2825

3597

2826

atexit.register(cleanup)

3598

3599

for client in tcp_server.clients.values():

2827

2828

for client in tcp_server.clients.itervalues():

3600

2829

if use_dbus:

3601

# Emit D-Bus signal for adding

3602

mandos_dbus_service.client_added_signal(client)

2830

# Emit D-Bus signal

2831

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3603

2832

# Need to initiate checking of clients

3604

2833

if client.enabled:

3605

2834

client.init_checker()

3606

2835

3607

2836

tcp_server.enable()

3608

2837

tcp_server.server_activate()

3609

2838

3610

2839

# Find out what port we got

3611

2840

if zeroconf:

3612

2841

service.port = tcp_server.socket.getsockname()[1]

3617

2846

else: # IPv4

3618

2847

logger.info("Now listening on address %r, port %d",

3619

2848

*tcp_server.socket.getsockname())

3620

3621

# service.interface = tcp_server.socket.getsockname()[3]

3622

2849

2850

#service.interface = tcp_server.socket.getsockname()[3]

2851

3623

2852

try:

3624

2853

if zeroconf:

3625

2854

# From the Avahi example code

3630

2859

cleanup()

3631

2860

sys.exit(1)

3632

2861

# End of Avahi example code

3633

3634

GLib.io_add_watch(

3635

GLib.IOChannel.unix_new(tcp_server.fileno()),

3636

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3637

lambda *args, **kwargs: (tcp_server.handle_request

3638

(*args[2:], **kwargs) or True))

3639

2862

2863

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2864

lambda *args, **kwargs:

2865

(tcp_server.handle_request

2866

(*args[2:], **kwargs) or True))

2867

3640

2868

logger.debug("Starting main loop")

3641

2869

main_loop.run()

3642

2870

except AvahiError as error:

3651

2879

# Must run before the D-Bus bus name gets deregistered

3652

2880

cleanup()

3653

2881

3654

3655

def should_only_run_tests():

3656

parser = argparse.ArgumentParser(add_help=False)

3657

parser.add_argument("--check", action='store_true')

3658

args, unknown_args = parser.parse_known_args()

3659

run_tests = args.check

3660

if run_tests:

3661

# Remove --check argument from sys.argv

3662

sys.argv[1:] = unknown_args

3663

return run_tests

3664

3665

# Add all tests from doctest strings

3666

def load_tests(loader, tests, none):

3667

import doctest

3668

tests.addTests(doctest.DocTestSuite())

3669

return tests

3670

3671

2882

if __name__ == '__main__':

3672

try:

3673

if should_only_run_tests():

3674

# Call using ./mandos --check [--verbose]

3675

unittest.main()

3676

else:

3677

main()

3678

finally:

3679

logging.shutdown()

2883

main()