/mandos/trunk : revision 560.1.2

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

42

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

37

import SocketServer as socketserver

47

38

import socket

48

39

import argparse

49

40

import datetime

50

41

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

55

49

import sys

56

50

import re

57

51

import os

66

60

import struct

67

61

import fcntl

68

62

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

63

import cPickle as pickle

73

64

import multiprocessing

74

65

import types

75

66

import binascii

76

67

import tempfile

77

68

import itertools

78

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

69

84

70

import dbus

85

71

import dbus.service

86

import gi

87

from gi.repository import GLib

72

import gobject

73

import avahi

88

74

from dbus.mainloop.glib import DBusGMainLoop

89

75

import ctypes

90

76

import ctypes.util

91

77

import xml.dom.minidom

92

78

import inspect

93

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

79

import GnuPGInterface

80

81

try:

122

82

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

83

except AttributeError:

124

84

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

85

from IN import SO_BINDTODEVICE

128

86

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.11"

87

SO_BINDTODEVICE = None

88

89

version = "1.5.3"

147

90

stored_state_file = "clients.pickle"

148

91

149

92

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

syslogger = None

93

syslogger = (logging.handlers.SysLogHandler

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

address = str("/dev/log")))

152

96

153

97

try:

154

if_nametoindex = ctypes.cdll.LoadLibrary(

155

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

156

101

except (OSError, AttributeError):

157

158

102

def if_nametoindex(interface):

159

103

"Get an interface index the hard way, i.e. using fcntl()"

160

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

161

105

with contextlib.closing(socket.socket()) as s:

162

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

163

struct.pack(b"16s16x", interface))

164

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

165

111

return interface_index

166

112

167

113

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

114

def initlogger(debug, level=logging.WARNING):

185

115

"""init logger and add loglevel"""

186

187

global syslogger

188

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

116

191

117

syslogger.setFormatter(logging.Formatter

192

118

('Mandos [%(process)d]: %(levelname)s:'

193

119

' %(message)s'))

194

120

logger.addHandler(syslogger)

195

121

196

122

if debug:

197

123

console = logging.StreamHandler()

198

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

208

134

pass

209

135

210

136

211

class PGPEngine:

137

class PGPEngine(object):

212

138

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

214

139

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

215

141

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

229

'--force-mdc',

230

'--quiet']

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

148

235

149

def __enter__(self):

236

150

return self

237

238

def __exit__(self, exc_type, exc_value, traceback):

151

152

def __exit__ (self, exc_type, exc_value, traceback):

239

153

self._cleanup()

240

154

return False

241

155

242

156

def __del__(self):

243

157

self._cleanup()

244

158

245

159

def _cleanup(self):

246

160

if self.tempdir is not None:

247

161

# Delete contents of tempdir

248

162

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

163

topdown = False):

250

164

for filename in files:

251

165

os.remove(os.path.join(root, filename))

252

166

for dirname in dirs:

254

168

# Remove tempdir

255

169

os.rmdir(self.tempdir)

256

170

self.tempdir = None

257

171

258

172

def password_encode(self, password):

259

173

# Passphrase can not be empty and can not contain newlines or

260

174

# NUL bytes. So we prefix it and hex encode it.

261

encoded = b"mandos" + binascii.hexlify(password)

262

if len(encoded) > 2048:

263

# GnuPG can't handle long passwords, so encode differently

264

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

265

.replace(b"\n", b"\\n")

266

.replace(b"\0", b"\\x00"))

267

return encoded

268

175

return b"mandos" + binascii.hexlify(password)

176

269

177

def encrypt(self, data, password):

270

passphrase = self.password_encode(password)

271

with tempfile.NamedTemporaryFile(

272

dir=self.tempdir) as passfile:

273

passfile.write(passphrase)

274

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

276

'--passphrase-file',

277

passfile.name]

278

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

283

if proc.returncode != 0:

284

raise PGPError(err)

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

285

192

return ciphertext

286

193

287

194

def decrypt(self, data, password):

288

passphrase = self.password_encode(password)

289

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

291

passfile.write(passphrase)

292

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

294

'--passphrase-file',

295

passfile.name]

296

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

301

if proc.returncode != 0:

302

raise PGPError(err)

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

303

209

return decrypted_plaintext

304

210

305

211

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

212

332

213

class AvahiError(Exception):

333

214

def __init__(self, value, *args, **kwargs):

334

215

self.value = value

335

return super(AvahiError, self).__init__(value, *args,

336

**kwargs)

337

216

super(AvahiError, self).__init__(value, *args, **kwargs)

217

def __unicode__(self):

218

return unicode(repr(self.value))

338

219

339

220

class AvahiServiceError(AvahiError):

340

221

pass

341

222

342

343

223

class AvahiGroupError(AvahiError):

344

224

pass

345

225

346

226

347

class AvahiService:

227

class AvahiService(object):

348

228

"""An Avahi (Zeroconf) service.

349

229

350

230

Attributes:

351

231

interface: integer; avahi.IF_UNSPEC or an interface index.

352

232

Used to optionally bind to the specified interface.

353

233

name: string; Example: 'Mandos'

354

234

type: string; Example: '_mandos._tcp'.

355

See <https://www.iana.org/assignments/service-names-port-numbers>

235

See <http://www.dns-sd.org/ServiceTypes.html>

356

236

port: integer; what port to announce

357

237

TXT: list of strings; TXT record for the service

358

238

domain: string; Domain to publish on, default to .local if empty.

364

244

server: D-Bus Server

365

245

bus: dbus.SystemBus()

366

246

"""

367

368

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

247

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

servicetype = None, port = None, TXT = None,

249

domain = "", host = "", max_renames = 32768,

250

protocol = avahi.PROTO_UNSPEC, bus = None):

379

251

self.interface = interface

380

252

self.name = name

381

253

self.type = servicetype

390

262

self.server = None

391

263

self.bus = bus

392

264

self.entry_group_state_changed_match = None

393

394

def rename(self, remove=True):

265

def rename(self):

395

266

"""Derived from the Avahi example code"""

396

267

if self.rename_count >= self.max_renames:

397

268

logger.critical("No suitable Zeroconf service name found"

398

269

" after %i retries, exiting.",

399

270

self.rename_count)

400

271

raise AvahiServiceError("Too many renames")

401

self.name = str(

402

self.server.GetAlternativeServiceName(self.name))

403

self.rename_count += 1

272

self.name = unicode(self.server

273

.GetAlternativeServiceName(self.name))

404

274

logger.info("Changing Zeroconf service name to %r ...",

405

275

self.name)

406

if remove:

407

self.remove()

276

self.remove()

408

277

try:

409

278

self.add()

410

279

except dbus.exceptions.DBusException as error:

411

if (error.get_dbus_name()

412

== "org.freedesktop.Avahi.CollisionError"):

413

logger.info("Local Zeroconf service name collision.")

414

return self.rename(remove=False)

415

else:

416

logger.critical("D-Bus Exception", exc_info=error)

417

self.cleanup()

418

os._exit(1)

419

280

logger.critical("DBusException: %s", error)

281

self.cleanup()

282

os._exit(1)

283

self.rename_count += 1

420

284

def remove(self):

421

285

"""Derived from the Avahi example code"""

422

286

if self.entry_group_state_changed_match is not None:

424

288

self.entry_group_state_changed_match = None

425

289

if self.group is not None:

426

290

self.group.Reset()

427

428

291

def add(self):

429

292

"""Derived from the Avahi example code"""

430

293

self.remove()

447

310

dbus.UInt16(self.port),

448

311

avahi.string_array_to_txt_array(self.TXT))

449

312

self.group.Commit()

450

451

313

def entry_group_state_changed(self, state, error):

452

314

"""Derived from the Avahi example code"""

453

315

logger.debug("Avahi entry group state change: %i", state)

454

316

455

317

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

318

logger.debug("Zeroconf service established.")

457

319

elif state == avahi.ENTRY_GROUP_COLLISION:

459

321

self.rename()

460

322

elif state == avahi.ENTRY_GROUP_FAILURE:

461

323

logger.critical("Avahi: Error in group state changed %s",

462

str(error))

463

raise AvahiGroupError("State changed: {!s}".format(error))

464

324

unicode(error))

325

raise AvahiGroupError("State changed: %s"

326

% unicode(error))

465

327

def cleanup(self):

466

328

"""Derived from the Avahi example code"""

467

329

if self.group is not None:

472

334

pass

473

335

self.group = None

474

336

self.remove()

475

476

337

def server_state_changed(self, state, error=None):

477

338

"""Derived from the Avahi example code"""

478

339

logger.debug("Avahi server state change: %i", state)

479

bad_states = {

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

avahi.SERVER_REGISTERING: None,

482

avahi.SERVER_COLLISION: "Zeroconf server name collision",

483

avahi.SERVER_FAILURE: "Zeroconf server failure",

484

}

340

bad_states = { avahi.SERVER_INVALID:

341

"Zeroconf server invalid",

342

avahi.SERVER_REGISTERING: None,

343

avahi.SERVER_COLLISION:

344

"Zeroconf server name collision",

345

avahi.SERVER_FAILURE:

346

"Zeroconf server failure" }

485

347

if state in bad_states:

486

348

if bad_states[state] is not None:

487

349

if error is None:

490

352

logger.error(bad_states[state] + ": %r", error)

491

353

self.cleanup()

492

354

elif state == avahi.SERVER_RUNNING:

493

try:

494

self.add()

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

logger.info("Local Zeroconf service name"

499

" collision.")

500

return self.rename(remove=False)

501

else:

502

logger.critical("D-Bus Exception", exc_info=error)

503

self.cleanup()

504

os._exit(1)

355

self.add()

505

356

else:

506

357

if error is None:

507

358

logger.debug("Unknown state: %r", state)

508

359

else:

509

360

logger.debug("Unknown state: %r: %r", state, error)

510

511

361

def activate(self):

512

362

"""Derived from the Avahi example code"""

513

363

if self.server is None:

517

367

follow_name_owner_changes=True),

518

368

avahi.DBUS_INTERFACE_SERVER)

519

369

self.server.connect_to_signal("StateChanged",

520

self.server_state_changed)

370

self.server_state_changed)

521

371

self.server_state_changed(self.server.GetState())

522

372

523

524

373

class AvahiServiceToSyslog(AvahiService):

525

def rename(self, *args, **kwargs):

374

def rename(self):

526

375

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

528

syslogger.setFormatter(logging.Formatter(

529

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

530

.format(self.name)))

376

ret = AvahiService.rename(self)

377

syslogger.setFormatter(logging.Formatter

378

('Mandos (%s) [%%(process)d]:'

379

' %%(levelname)s: %%(message)s'

380

% self.name))

531

381

return ret

532

382

533

534

# Pretend that we have a GnuTLS module

535

class gnutls:

536

"""This isn't so much a class as it is a module-like namespace."""

537

538

library = ctypes.util.find_library("gnutls")

539

if library is None:

540

library = ctypes.util.find_library("gnutls-deb0")

541

_library = ctypes.cdll.LoadLibrary(library)

542

del library

543

544

# Unless otherwise indicated, the constants and types below are

545

# all from the gnutls/gnutls.h C header file.

546

547

# Constants

548

E_SUCCESS = 0

549

E_INTERRUPTED = -52

550

E_AGAIN = -28

551

CRT_OPENPGP = 2

552

CRT_RAWPK = 3

553

CLIENT = 2

554

SHUT_RDWR = 0

555

CRD_CERTIFICATE = 1

556

E_NO_CERTIFICATE_FOUND = -49

557

X509_FMT_DER = 0

558

NO_TICKETS = 1<<10

559

ENABLE_RAWPK = 1<<18

560

CTYPE_PEERS = 3

561

KEYID_USE_SHA256 = 1 # gnutls/x509.h

562

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

563

564

# Types

565

class session_int(ctypes.Structure):

566

_fields_ = []

567

session_t = ctypes.POINTER(session_int)

568

569

class certificate_credentials_st(ctypes.Structure):

570

_fields_ = []

571

certificate_credentials_t = ctypes.POINTER(

572

certificate_credentials_st)

573

certificate_type_t = ctypes.c_int

574

575

class datum_t(ctypes.Structure):

576

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

577

('size', ctypes.c_uint)]

578

579

class openpgp_crt_int(ctypes.Structure):

580

_fields_ = []

581

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

582

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

583

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

584

credentials_type_t = ctypes.c_int

585

transport_ptr_t = ctypes.c_void_p

586

close_request_t = ctypes.c_int

587

588

# Exceptions

589

class Error(Exception):

590

def __init__(self, message=None, code=None, args=()):

591

# Default usage is by a message string, but if a return

592

# code is passed, convert it to a string with

593

# gnutls.strerror()

594

self.code = code

595

if message is None and code is not None:

596

message = gnutls.strerror(code)

597

return super(gnutls.Error, self).__init__(

598

message, *args)

599

600

class CertificateSecurityError(Error):

601

pass

602

603

# Classes

604

class Credentials:

605

def __init__(self):

606

self._c_object = gnutls.certificate_credentials_t()

607

gnutls.certificate_allocate_credentials(

608

ctypes.byref(self._c_object))

609

self.type = gnutls.CRD_CERTIFICATE

610

611

def __del__(self):

612

gnutls.certificate_free_credentials(self._c_object)

613

614

class ClientSession:

615

def __init__(self, socket, credentials=None):

616

self._c_object = gnutls.session_t()

617

gnutls_flags = gnutls.CLIENT

618

if gnutls.check_version(b"3.5.6"):

619

gnutls_flags |= gnutls.NO_TICKETS

620

if gnutls.has_rawpk:

621

gnutls_flags |= gnutls.ENABLE_RAWPK

622

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

623

del gnutls_flags

624

gnutls.set_default_priority(self._c_object)

625

gnutls.transport_set_ptr(self._c_object, socket.fileno())

626

gnutls.handshake_set_private_extensions(self._c_object,

627

True)

628

self.socket = socket

629

if credentials is None:

630

credentials = gnutls.Credentials()

631

gnutls.credentials_set(self._c_object, credentials.type,

632

ctypes.cast(credentials._c_object,

633

ctypes.c_void_p))

634

self.credentials = credentials

635

636

def __del__(self):

637

gnutls.deinit(self._c_object)

638

639

def handshake(self):

640

return gnutls.handshake(self._c_object)

641

642

def send(self, data):

643

data = bytes(data)

644

data_len = len(data)

645

while data_len > 0:

646

data_len -= gnutls.record_send(self._c_object,

647

data[-data_len:],

648

data_len)

649

650

def bye(self):

651

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

652

653

# Error handling functions

654

def _error_code(result):

655

"""A function to raise exceptions on errors, suitable

656

for the 'restype' attribute on ctypes functions"""

657

if result >= 0:

658

return result

659

if result == gnutls.E_NO_CERTIFICATE_FOUND:

660

raise gnutls.CertificateSecurityError(code=result)

661

raise gnutls.Error(code=result)

662

663

def _retry_on_error(result, func, arguments):

664

"""A function to retry on some errors, suitable

665

for the 'errcheck' attribute on ctypes functions"""

666

while result < 0:

667

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

668

return _error_code(result)

669

result = func(*arguments)

670

return result

671

672

# Unless otherwise indicated, the function declarations below are

673

# all from the gnutls/gnutls.h C header file.

674

675

# Functions

676

priority_set_direct = _library.gnutls_priority_set_direct

677

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

678

ctypes.POINTER(ctypes.c_char_p)]

679

priority_set_direct.restype = _error_code

680

681

init = _library.gnutls_init

682

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

683

init.restype = _error_code

684

685

set_default_priority = _library.gnutls_set_default_priority

686

set_default_priority.argtypes = [session_t]

687

set_default_priority.restype = _error_code

688

689

record_send = _library.gnutls_record_send

690

record_send.argtypes = [session_t, ctypes.c_void_p,

691

ctypes.c_size_t]

692

record_send.restype = ctypes.c_ssize_t

693

record_send.errcheck = _retry_on_error

694

695

certificate_allocate_credentials = (

696

_library.gnutls_certificate_allocate_credentials)

697

certificate_allocate_credentials.argtypes = [

698

ctypes.POINTER(certificate_credentials_t)]

699

certificate_allocate_credentials.restype = _error_code

700

701

certificate_free_credentials = (

702

_library.gnutls_certificate_free_credentials)

703

certificate_free_credentials.argtypes = [

704

certificate_credentials_t]

705

certificate_free_credentials.restype = None

706

707

handshake_set_private_extensions = (

708

_library.gnutls_handshake_set_private_extensions)

709

handshake_set_private_extensions.argtypes = [session_t,

710

ctypes.c_int]

711

handshake_set_private_extensions.restype = None

712

713

credentials_set = _library.gnutls_credentials_set

714

credentials_set.argtypes = [session_t, credentials_type_t,

715

ctypes.c_void_p]

716

credentials_set.restype = _error_code

717

718

strerror = _library.gnutls_strerror

719

strerror.argtypes = [ctypes.c_int]

720

strerror.restype = ctypes.c_char_p

721

722

certificate_type_get = _library.gnutls_certificate_type_get

723

certificate_type_get.argtypes = [session_t]

724

certificate_type_get.restype = _error_code

725

726

certificate_get_peers = _library.gnutls_certificate_get_peers

727

certificate_get_peers.argtypes = [session_t,

728

ctypes.POINTER(ctypes.c_uint)]

729

certificate_get_peers.restype = ctypes.POINTER(datum_t)

730

731

global_set_log_level = _library.gnutls_global_set_log_level

732

global_set_log_level.argtypes = [ctypes.c_int]

733

global_set_log_level.restype = None

734

735

global_set_log_function = _library.gnutls_global_set_log_function

736

global_set_log_function.argtypes = [log_func]

737

global_set_log_function.restype = None

738

739

deinit = _library.gnutls_deinit

740

deinit.argtypes = [session_t]

741

deinit.restype = None

742

743

handshake = _library.gnutls_handshake

744

handshake.argtypes = [session_t]

745

handshake.restype = _error_code

746

handshake.errcheck = _retry_on_error

747

748

transport_set_ptr = _library.gnutls_transport_set_ptr

749

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

750

transport_set_ptr.restype = None

751

752

bye = _library.gnutls_bye

753

bye.argtypes = [session_t, close_request_t]

754

bye.restype = _error_code

755

bye.errcheck = _retry_on_error

756

757

check_version = _library.gnutls_check_version

758

check_version.argtypes = [ctypes.c_char_p]

759

check_version.restype = ctypes.c_char_p

760

761

_need_version = b"3.3.0"

762

if check_version(_need_version) is None:

763

raise self.Error("Needs GnuTLS {} or later"

764

.format(_need_version))

765

766

_tls_rawpk_version = b"3.6.6"

767

has_rawpk = bool(check_version(_tls_rawpk_version))

768

769

if has_rawpk:

770

# Types

771

class pubkey_st(ctypes.Structure):

772

_fields = []

773

pubkey_t = ctypes.POINTER(pubkey_st)

774

775

x509_crt_fmt_t = ctypes.c_int

776

777

# All the function declarations below are from gnutls/abstract.h

778

pubkey_init = _library.gnutls_pubkey_init

779

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

780

pubkey_init.restype = _error_code

781

782

pubkey_import = _library.gnutls_pubkey_import

783

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

784

x509_crt_fmt_t]

785

pubkey_import.restype = _error_code

786

787

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

788

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

789

ctypes.POINTER(ctypes.c_ubyte),

790

ctypes.POINTER(ctypes.c_size_t)]

791

pubkey_get_key_id.restype = _error_code

792

793

pubkey_deinit = _library.gnutls_pubkey_deinit

794

pubkey_deinit.argtypes = [pubkey_t]

795

pubkey_deinit.restype = None

796

else:

797

# All the function declarations below are from gnutls/openpgp.h

798

799

openpgp_crt_init = _library.gnutls_openpgp_crt_init

800

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

801

openpgp_crt_init.restype = _error_code

802

803

openpgp_crt_import = _library.gnutls_openpgp_crt_import

804

openpgp_crt_import.argtypes = [openpgp_crt_t,

805

ctypes.POINTER(datum_t),

806

openpgp_crt_fmt_t]

807

openpgp_crt_import.restype = _error_code

808

809

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

810

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

811

ctypes.POINTER(ctypes.c_uint)]

812

openpgp_crt_verify_self.restype = _error_code

813

814

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

815

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

816

openpgp_crt_deinit.restype = None

817

818

openpgp_crt_get_fingerprint = (

819

_library.gnutls_openpgp_crt_get_fingerprint)

820

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

821

ctypes.c_void_p,

822

ctypes.POINTER(

823

ctypes.c_size_t)]

824

openpgp_crt_get_fingerprint.restype = _error_code

825

826

if check_version(b"3.6.4"):

827

certificate_type_get2 = _library.gnutls_certificate_type_get2

828

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

829

certificate_type_get2.restype = _error_code

830

831

# Remove non-public functions

832

del _error_code, _retry_on_error

833

834

835

def call_pipe(connection, # : multiprocessing.Connection

836

func, *args, **kwargs):

837

"""This function is meant to be called by multiprocessing.Process

838

839

This function runs func(*args, **kwargs), and writes the resulting

840

return value on the provided multiprocessing.Connection.

841

"""

842

connection.send(func(*args, **kwargs))

843

connection.close()

844

845

846

class Client:

383

def timedelta_to_milliseconds(td):

384

"Convert a datetime.timedelta() to milliseconds"

385

return ((td.days * 24 * 60 * 60 * 1000)

386

+ (td.seconds * 1000)

387

+ (td.microseconds // 1000))

388

389

class Client(object):

847

390

"""A representation of a client host served by this server.

848

391

849

392

Attributes:

850

393

approved: bool(); 'None' if not yet approved/disapproved

851

394

approval_delay: datetime.timedelta(); Time to wait for approval

852

395

approval_duration: datetime.timedelta(); Duration of one approval

853

checker: multiprocessing.Process(); a running checker process used

854

to see if the client lives. 'None' if no process is

855

running.

856

checker_callback_tag: a GLib event source tag, or None

396

checker: subprocess.Popen(); a running checker process used

397

to see if the client lives.

398

'None' if no process is running.

399

checker_callback_tag: a gobject event source tag, or None

857

400

checker_command: string; External command which is run to check

858

401

if client lives. %() expansions are done at

859

402

runtime with vars(self) as dict, so that for

860

403

instance %(name)s can be used in the command.

861

checker_initiator_tag: a GLib event source tag, or None

404

checker_initiator_tag: a gobject event source tag, or None

862

405

created: datetime.datetime(); (UTC) object creation

863

406

client_structure: Object describing what attributes a client has

864

407

and is used for storing the client at exit

865

408

current_checker_command: string; current running checker_command

866

disable_initiator_tag: a GLib event source tag, or None

409

disable_initiator_tag: a gobject event source tag, or None

867

410

enabled: bool()

868

411

fingerprint: string (40 or 32 hexadecimal digits); used to

869

uniquely identify an OpenPGP client

870

key_id: string (64 hexadecimal digits); used to uniquely identify

871

a client using raw public keys

412

uniquely identify the client

872

413

host: string; available for use by the checker command

873

414

interval: datetime.timedelta(); How often to start a new checker

874

415

last_approval_request: datetime.datetime(); (UTC) or None

876

417

last_checker_status: integer between 0 and 255 reflecting exit

877

418

status of last checker. -1 reflects crashed

878

419

checker, -2 means no checker completed yet.

879

last_checker_signal: The signal which killed the last checker, if

880

last_checker_status is -1

881

420

last_enabled: datetime.datetime(); (UTC) or None

882

421

name: string; from the config file, used in log messages and

883

422

D-Bus identifiers

888

427

runtime_expansions: Allowed attributes for runtime expansion.

889

428

expires: datetime.datetime(); time (UTC) when a client will be

890

429

disabled, or None

891

server_settings: The server_settings dict from main()

892

430

"""

893

431

894

432

runtime_expansions = ("approval_delay", "approval_duration",

895

"created", "enabled", "expires", "key_id",

896

"fingerprint", "host", "interval",

897

"last_approval_request", "last_checked_ok",

433

"created", "enabled", "fingerprint",

434

"host", "interval", "last_checked_ok",

898

435

"last_enabled", "name", "timeout")

899

client_defaults = {

900

"timeout": "PT5M",

901

"extended_timeout": "PT15M",

902

"interval": "PT2M",

903

"checker": "fping -q -- %%(host)s",

904

"host": "",

905

"approval_delay": "PT0S",

906

"approval_duration": "PT1S",

907

"approved_by_default": "True",

908

"enabled": "True",

909

}

436

client_defaults = { "timeout": "5m",

437

"extended_timeout": "15m",

438

"interval": "2m",

439

"checker": "fping -q -- %%(host)s",

440

"host": "",

441

"approval_delay": "0s",

442

"approval_duration": "1s",

443

"approved_by_default": "True",

444

"enabled": "True",

445

}

446

447

def timeout_milliseconds(self):

448

"Return the 'timeout' attribute in milliseconds"

449

return timedelta_to_milliseconds(self.timeout)

450

451

def extended_timeout_milliseconds(self):

452

"Return the 'extended_timeout' attribute in milliseconds"

453

return timedelta_to_milliseconds(self.extended_timeout)

454

455

def interval_milliseconds(self):

456

"Return the 'interval' attribute in milliseconds"

457

return timedelta_to_milliseconds(self.interval)

458

459

def approval_delay_milliseconds(self):

460

return timedelta_to_milliseconds(self.approval_delay)

910

461

911

462

@staticmethod

912

463

def config_parser(config):

920

471

for client_name in config.sections():

921

472

section = dict(config.items(client_name))

922

473

client = settings[client_name] = {}

923

474

924

475

client["host"] = section["host"]

925

476

# Reformat values from string types to Python types

926

477

client["approved_by_default"] = config.getboolean(

927

478

client_name, "approved_by_default")

928

479

client["enabled"] = config.getboolean(client_name,

929

480

"enabled")

930

931

# Uppercase and remove spaces from key_id and fingerprint

932

# for later comparison purposes with return value from the

933

# key_id() and fingerprint() functions

934

client["key_id"] = (section.get("key_id", "").upper()

935

.replace(" ", ""))

481

936

482

client["fingerprint"] = (section["fingerprint"].upper()

937

483

.replace(" ", ""))

938

484

if "secret" in section:

939

client["secret"] = codecs.decode(section["secret"]

940

.encode("utf-8"),

941

"base64")

485

client["secret"] = section["secret"].decode("base64")

942

486

elif "secfile" in section:

943

487

with open(os.path.expanduser(os.path.expandvars

944

488

(section["secfile"])),

945

489

"rb") as secfile:

946

490

client["secret"] = secfile.read()

947

491

else:

948

raise TypeError("No secret or secfile for section {}"

949

.format(section))

492

raise TypeError("No secret or secfile for section %s"

493

% section)

950

494

client["timeout"] = string_to_delta(section["timeout"])

951

495

client["extended_timeout"] = string_to_delta(

952

496

section["extended_timeout"])

959

503

client["last_approval_request"] = None

960

504

client["last_checked_ok"] = None

961

505

client["last_checker_status"] = -2

962

506

963

507

return settings

964

965

def __init__(self, settings, name=None, server_settings=None):

508

509

510

def __init__(self, settings, name = None):

511

"""Note: the 'checker' key in 'config' sets the

512

'checker_command' attribute and *not* the 'checker'

513

attribute."""

966

514

self.name = name

967

if server_settings is None:

968

server_settings = {}

969

self.server_settings = server_settings

970

515

# adding all client settings

971

for setting, value in settings.items():

516

for setting, value in settings.iteritems():

972

517

setattr(self, setting, value)

973

518

974

519

if self.enabled:

975

520

if not hasattr(self, "last_enabled"):

976

521

self.last_enabled = datetime.datetime.utcnow()

980

525

else:

981

526

self.last_enabled = None

982

527

self.expires = None

983

528

984

529

logger.debug("Creating client %r", self.name)

985

logger.debug(" Key ID: %s", self.key_id)

530

# Uppercase and remove spaces from fingerprint for later

531

# comparison purposes with return value from the fingerprint()

532

# function

986

533

logger.debug(" Fingerprint: %s", self.fingerprint)

987

534

self.created = settings.get("created",

988

535

datetime.datetime.utcnow())

995

542

self.current_checker_command = None

996

543

self.approved = None

997

544

self.approvals_pending = 0

998

self.changedstate = multiprocessing_manager.Condition(

999

multiprocessing_manager.Lock())

1000

self.client_structure = [attr

1001

for attr in self.__dict__.keys()

545

self.changedstate = (multiprocessing_manager

546

.Condition(multiprocessing_manager

547

.Lock()))

548

self.client_structure = [attr for attr in

549

self.__dict__.iterkeys()

1002

550

if not attr.startswith("_")]

1003

551

self.client_structure.append("client_structure")

1004

1005

for name, t in inspect.getmembers(

1006

type(self), lambda obj: isinstance(obj, property)):

552

553

for name, t in inspect.getmembers(type(self),

554

lambda obj:

555

isinstance(obj,

556

property)):

1007

557

if not name.startswith("_"):

1008

558

self.client_structure.append(name)

1009

559

1010

560

# Send notice to process children that client state has changed

1011

561

def send_changedstate(self):

1012

562

with self.changedstate:

1013

563

self.changedstate.notify_all()

1014

564

1015

565

def enable(self):

1016

566

"""Start this client's checker and timeout hooks"""

1017

567

if getattr(self, "enabled", False):

1018

568

# Already enabled

1019

569

return

570

self.send_changedstate()

1020

571

self.expires = datetime.datetime.utcnow() + self.timeout

1021

572

self.enabled = True

1022

573

self.last_enabled = datetime.datetime.utcnow()

1023

574

self.init_checker()

1024

self.send_changedstate()

1025

575

1026

576

def disable(self, quiet=True):

1027

577

"""Disable this client."""

1028

578

if not getattr(self, "enabled", False):

1029

579

return False

1030

580

if not quiet:

581

self.send_changedstate()

582

if not quiet:

1031

583

logger.info("Disabling client %s", self.name)

1032

if getattr(self, "disable_initiator_tag", None) is not None:

1033

GLib.source_remove(self.disable_initiator_tag)

584

if getattr(self, "disable_initiator_tag", False):

585

gobject.source_remove(self.disable_initiator_tag)

1034

586

self.disable_initiator_tag = None

1035

587

self.expires = None

1036

if getattr(self, "checker_initiator_tag", None) is not None:

1037

GLib.source_remove(self.checker_initiator_tag)

588

if getattr(self, "checker_initiator_tag", False):

589

gobject.source_remove(self.checker_initiator_tag)

1038

590

self.checker_initiator_tag = None

1039

591

self.stop_checker()

1040

592

self.enabled = False

1041

if not quiet:

1042

self.send_changedstate()

1043

# Do not run this again if called by a GLib.timeout_add

593

# Do not run this again if called by a gobject.timeout_add

1044

594

return False

1045

595

1046

596

def __del__(self):

1047

597

self.disable()

1048

598

1049

599

def init_checker(self):

1050

600

# Schedule a new checker to be started an 'interval' from now,

1051

601

# and every interval from then on.

1052

if self.checker_initiator_tag is not None:

1053

GLib.source_remove(self.checker_initiator_tag)

1054

self.checker_initiator_tag = GLib.timeout_add(

1055

random.randrange(int(self.interval.total_seconds() * 1000

1056

+ 1)),

1057

self.start_checker)

602

self.checker_initiator_tag = (gobject.timeout_add

603

(self.interval_milliseconds(),

604

self.start_checker))

1058

605

# Schedule a disable() when 'timeout' has passed

1059

if self.disable_initiator_tag is not None:

1060

GLib.source_remove(self.disable_initiator_tag)

1061

self.disable_initiator_tag = GLib.timeout_add(

1062

int(self.timeout.total_seconds() * 1000), self.disable)

606

self.disable_initiator_tag = (gobject.timeout_add

607

(self.timeout_milliseconds(),

608

self.disable))

1063

609

# Also start a new checker *right now*.

1064

610

self.start_checker()

1065

1066

def checker_callback(self, source, condition, connection,

1067

command):

611

612

def checker_callback(self, pid, condition, command):

1068

613

"""The checker has completed, so take appropriate actions."""

1069

# Read return code from connection (see call_pipe)

1070

returncode = connection.recv()

1071

connection.close()

1072

if self.checker is not None:

1073

self.checker.join()

1074

614

self.checker_callback_tag = None

1075

615

self.checker = None

1076

1077

if returncode >= 0:

1078

self.last_checker_status = returncode

1079

self.last_checker_signal = None

616

if os.WIFEXITED(condition):

617

self.last_checker_status = os.WEXITSTATUS(condition)

1080

618

if self.last_checker_status == 0:

1081

619

logger.info("Checker for %(name)s succeeded",

1082

620

vars(self))

1083

621

self.checked_ok()

1084

622

else:

1085

logger.info("Checker for %(name)s failed", vars(self))

623

logger.info("Checker for %(name)s failed",

624

vars(self))

1086

625

else:

1087

626

self.last_checker_status = -1

1088

self.last_checker_signal = -returncode

1089

627

logger.warning("Checker for %(name)s crashed?",

1090

628

vars(self))

1091

return False

1092

629

1093

630

def checked_ok(self):

1094

631

"""Assert that the client has been seen, alive and well."""

1095

632

self.last_checked_ok = datetime.datetime.utcnow()

1096

633

self.last_checker_status = 0

1097

self.last_checker_signal = None

1098

634

self.bump_timeout()

1099

635

1100

636

def bump_timeout(self, timeout=None):

1101

637

"""Bump up the timeout for this client."""

1102

638

if timeout is None:

1103

639

timeout = self.timeout

1104

640

if self.disable_initiator_tag is not None:

1105

GLib.source_remove(self.disable_initiator_tag)

1106

self.disable_initiator_tag = None

641

gobject.source_remove(self.disable_initiator_tag)

1107

642

if getattr(self, "enabled", False):

1108

self.disable_initiator_tag = GLib.timeout_add(

1109

int(timeout.total_seconds() * 1000), self.disable)

643

self.disable_initiator_tag = (gobject.timeout_add

644

(timedelta_to_milliseconds

645

(timeout), self.disable))

1110

646

self.expires = datetime.datetime.utcnow() + timeout

1111

647

1112

648

def need_approval(self):

1113

649

self.last_approval_request = datetime.datetime.utcnow()

1114

650

1115

651

def start_checker(self):

1116

652

"""Start a new checker subprocess if one is not running.

1117

653

1118

654

If a checker already exists, leave it running and do

1119

655

nothing."""

1120

656

# The reason for not killing a running checker is that if we

1121

# did that, and if a checker (for some reason) started running

1122

# slowly and taking more than 'interval' time, then the client

1123

# would inevitably timeout, since no checker would get a

1124

# chance to run to completion. If we instead leave running

657

# did that, then if a checker (for some reason) started

658

# running slowly and taking more than 'interval' time, the

659

# client would inevitably timeout, since no checker would get

660

# a chance to run to completion. If we instead leave running

1125

661

# checkers alone, the checker would have to take more time

1126

662

# than 'timeout' for the client to be disabled, which is as it

1127

663

# should be.

1128

1129

if self.checker is not None and not self.checker.is_alive():

1130

logger.warning("Checker was not alive; joining")

1131

self.checker.join()

1132

self.checker = None

664

665

# If a checker exists, make sure it is not a zombie

666

try:

667

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

668

except (AttributeError, OSError) as error:

669

if (isinstance(error, OSError)

670

and error.errno != errno.ECHILD):

671

raise error

672

else:

673

if pid:

674

logger.warning("Checker was a zombie")

675

gobject.source_remove(self.checker_callback_tag)

676

self.checker_callback(pid, status,

677

self.current_checker_command)

1133

678

# Start a new checker if needed

1134

679

if self.checker is None:

1135

# Escape attributes for the shell

1136

escaped_attrs = {

1137

attr: shlex.quote(str(getattr(self, attr)))

1138

for attr in self.runtime_expansions}

1139

680

try:

1140

command = self.checker_command % escaped_attrs

1141

except TypeError as error:

1142

logger.error('Could not format string "%s"',

1143

self.checker_command,

1144

exc_info=error)

1145

return True # Try again later

681

# In case checker_command has exactly one % operator

682

command = self.checker_command % self.host

683

except TypeError:

684

# Escape attributes for the shell

685

escaped_attrs = dict(

686

(attr,

687

re.escape(unicode(str(getattr(self, attr, "")),

688

errors=

689

'replace')))

690

for attr in

691

self.runtime_expansions)

692

693

try:

694

command = self.checker_command % escaped_attrs

695

except TypeError as error:

696

logger.error('Could not format string "%s":'

697

' %s', self.checker_command, error)

698

return True # Try again later

1146

699

self.current_checker_command = command

1147

logger.info("Starting checker %r for %s", command,

1148

self.name)

1149

# We don't need to redirect stdout and stderr, since

1150

# in normal mode, that is already done by daemon(),

1151

# and in debug mode we don't want to. (Stdin is

1152

# always replaced by /dev/null.)

1153

# The exception is when not debugging but nevertheless

1154

# running in the foreground; use the previously

1155

# created wnull.

1156

popen_args = {"close_fds": True,

1157

"shell": True,

1158

"cwd": "/"}

1159

if (not self.server_settings["debug"]

1160

and self.server_settings["foreground"]):

1161

popen_args.update({"stdout": wnull,

1162

"stderr": wnull})

1163

pipe = multiprocessing.Pipe(duplex=False)

1164

self.checker = multiprocessing.Process(

1165

target=call_pipe,

1166

args=(pipe[1], subprocess.call, command),

1167

kwargs=popen_args)

1168

self.checker.start()

1169

self.checker_callback_tag = GLib.io_add_watch(

1170

GLib.IOChannel.unix_new(pipe[0].fileno()),

1171

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1172

self.checker_callback, pipe[0], command)

1173

# Re-run this periodically if run by GLib.timeout_add

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

self.checker = subprocess.Popen(command,

708

close_fds=True,

709

shell=True, cwd="/")

710

self.checker_callback_tag = (gobject.child_watch_add

711

(self.checker.pid,

712

self.checker_callback,

713

data=command))

714

# The checker may have completed before the gobject

715

# watch was added. Check for this.

716

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

717

if pid:

718

gobject.source_remove(self.checker_callback_tag)

719

self.checker_callback(pid, status, command)

720

except OSError as error:

721

logger.error("Failed to start subprocess: %s",

722

error)

723

# Re-run this periodically if run by gobject.timeout_add

1174

724

return True

1175

725

1176

726

def stop_checker(self):

1177

727

"""Force the checker process, if any, to stop."""

1178

728

if self.checker_callback_tag:

1179

GLib.source_remove(self.checker_callback_tag)

729

gobject.source_remove(self.checker_callback_tag)

1180

730

self.checker_callback_tag = None

1181

731

if getattr(self, "checker", None) is None:

1182

732

return

1183

733

logger.debug("Stopping checker for %(name)s", vars(self))

1184

self.checker.terminate()

734

try:

735

os.kill(self.checker.pid, signal.SIGTERM)

736

#time.sleep(0.5)

737

#if self.checker.poll() is None:

738

# os.kill(self.checker.pid, signal.SIGKILL)

739

except OSError as error:

740

if error.errno != errno.ESRCH: # No such process

741

raise

1185

742

self.checker = None

1186

743

1187

744

1188

def dbus_service_property(dbus_interface,

1189

signature="v",

1190

access="readwrite",

1191

byte_arrays=False):

745

def dbus_service_property(dbus_interface, signature="v",

746

access="readwrite", byte_arrays=False):

1192

747

"""Decorators for marking methods of a DBusObjectWithProperties to

1193

748

become properties on the D-Bus.

1194

749

1195

750

The decorated method will be called with no arguments by "Get"

1196

751

and with one argument by "Set".

1197

752

1198

753

The parameters, where they are supported, are the same as

1199

754

dbus.service.method, except there is only "signature", since the

1200

755

type from Get() and the type sent to Set() is the same.

1203

758

# "Set" method, so we fail early here:

1204

759

if byte_arrays and signature != "ay":

1205

760

raise ValueError("Byte arrays not supported for non-'ay'"

1206

" signature {!r}".format(signature))

1207

761

" signature %r" % signature)

1208

762

def decorator(func):

1209

763

func._dbus_is_property = True

1210

764

func._dbus_interface = dbus_interface

1213

767

func._dbus_name = func.__name__

1214

768

if func._dbus_name.endswith("_dbus_property"):

1215

769

func._dbus_name = func._dbus_name[:-14]

1216

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

770

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1217

771

return func

1218

1219

772

return decorator

1220

773

1221

774

1222

775

def dbus_interface_annotations(dbus_interface):

1223

"""Decorator for marking functions returning interface annotations

1224

776

"""Decorator for marking functions returning interface annotations.

777

1225

778

Usage:

1226

779

1227

780

@dbus_interface_annotations("org.example.Interface")

1228

781

def _foo(self): # Function name does not matter

1229

782

return {"org.freedesktop.DBus.Deprecated": "true",

1230

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1231

784

"false"}

1232

785

"""

1233

1234

786

def decorator(func):

1235

787

func._dbus_is_interface = True

1236

788

func._dbus_interface = dbus_interface

1237

789

func._dbus_name = dbus_interface

1238

790

return func

1239

1240

return decorator

1241

1242

1243

def dbus_annotations(annotations):

1244

"""Decorator to annotate D-Bus methods, signals or properties

1245

Usage:

1246

1247

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1248

"org.freedesktop.DBus.Property."

1249

"EmitsChangedSignal": "false"})

1250

@dbus_service_property("org.example.Interface", signature="b",

1251

access="r")

1252

def Property_dbus_property(self):

1253

return dbus.Boolean(False)

1254

1255

See also the DBusObjectWithAnnotations class.

1256

"""

1257

1258

def decorator(func):

1259

func._dbus_annotations = annotations

1260

return func

1261

1262

791

return decorator

1263

792

1264

793

1265

794

class DBusPropertyException(dbus.exceptions.DBusException):

1266

795

"""A base class for D-Bus property-related exceptions

1267

796

"""

1268

pass

797

def __unicode__(self):

798

return unicode(str(self))

1269

799

1270

800

1271

801

class DBusPropertyAccessException(DBusPropertyException):

1280

810

pass

1281

811

1282

812

1283

class DBusObjectWithAnnotations(dbus.service.Object):

1284

"""A D-Bus object with annotations.

1285

1286

Classes inheriting from this can use the dbus_annotations

1287

decorator to add annotations to methods or signals.

813

class DBusObjectWithProperties(dbus.service.Object):

814

"""A D-Bus object with properties.

815

816

Classes inheriting from this can use the dbus_service_property

817

decorator to expose methods as D-Bus properties. It exposes the

818

standard Get(), Set(), and GetAll() methods on the D-Bus.

1288

819

"""

1289

820

1290

821

@staticmethod

1291

822

def _is_dbus_thing(thing):

1292

823

"""Returns a function testing if an attribute is a D-Bus thing

1293

824

1294

825

If called like _is_dbus_thing("method") it returns a function

1295

826

suitable for use as predicate to inspect.getmembers().

1296

827

"""

1297

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

828

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1298

829

False)

1299

830

1300

831

def _get_all_dbus_things(self, thing):

1301

832

"""Returns a generator of (name, attribute) pairs

1302

833

"""

1303

return ((getattr(athing.__get__(self), "_dbus_name", name),

834

return ((athing.__get__(self)._dbus_name,

1304

835

athing.__get__(self))

1305

836

for cls in self.__class__.__mro__

1306

837

for name, athing in

1307

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1308

1309

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1310

out_signature="s",

1311

path_keyword='object_path',

1312

connection_keyword='connection')

1313

def Introspect(self, object_path, connection):

1314

"""Overloading of standard D-Bus method.

1315

1316

Inserts annotation tags on methods and signals.

1317

"""

1318

xmlstring = dbus.service.Object.Introspect(self, object_path,

1319

connection)

1320

try:

1321

document = xml.dom.minidom.parseString(xmlstring)

1322

1323

for if_tag in document.getElementsByTagName("interface"):

1324

# Add annotation tags

1325

for typ in ("method", "signal"):

1326

for tag in if_tag.getElementsByTagName(typ):

1327

annots = dict()

1328

for name, prop in (self.

1329

_get_all_dbus_things(typ)):

1330

if (name == tag.getAttribute("name")

1331

and prop._dbus_interface

1332

== if_tag.getAttribute("name")):

1333

annots.update(getattr(

1334

prop, "_dbus_annotations", {}))

1335

for name, value in annots.items():

1336

ann_tag = document.createElement(

1337

"annotation")

1338

ann_tag.setAttribute("name", name)

1339

ann_tag.setAttribute("value", value)

1340

tag.appendChild(ann_tag)

1341

# Add interface annotation tags

1342

for annotation, value in dict(

1343

itertools.chain.from_iterable(

1344

annotations().items()

1345

for name, annotations

1346

in self._get_all_dbus_things("interface")

1347

if name == if_tag.getAttribute("name")

1348

)).items():

1349

ann_tag = document.createElement("annotation")

1350

ann_tag.setAttribute("name", annotation)

1351

ann_tag.setAttribute("value", value)

1352

if_tag.appendChild(ann_tag)

1353

# Fix argument name for the Introspect method itself

1354

if (if_tag.getAttribute("name")

1355

== dbus.INTROSPECTABLE_IFACE):

1356

for cn in if_tag.getElementsByTagName("method"):

1357

if cn.getAttribute("name") == "Introspect":

1358

for arg in cn.getElementsByTagName("arg"):

1359

if (arg.getAttribute("direction")

1360

== "out"):

1361

arg.setAttribute("name",

1362

"xml_data")

1363

xmlstring = document.toxml("utf-8")

1364

document.unlink()

1365

except (AttributeError, xml.dom.DOMException,

1366

xml.parsers.expat.ExpatError) as error:

1367

logger.error("Failed to override Introspection method",

1368

exc_info=error)

1369

return xmlstring

1370

1371

1372

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1373

"""A D-Bus object with properties.

1374

1375

Classes inheriting from this can use the dbus_service_property

1376

decorator to expose methods as D-Bus properties. It exposes the

1377

standard Get(), Set(), and GetAll() methods on the D-Bus.

1378

"""

1379

838

inspect.getmembers(cls,

839

self._is_dbus_thing(thing)))

840

1380

841

def _get_dbus_property(self, interface_name, property_name):

1381

842

"""Returns a bound method if one exists which is a D-Bus

1382

843

property with the specified name and interface.

1383

844

"""

1384

for cls in self.__class__.__mro__:

1385

for name, value in inspect.getmembers(

1386

cls, self._is_dbus_thing("property")):

845

for cls in self.__class__.__mro__:

846

for name, value in (inspect.getmembers

847

(cls,

848

self._is_dbus_thing("property"))):

1387

849

if (value._dbus_name == property_name

1388

850

and value._dbus_interface == interface_name):

1389

851

return value.__get__(self)

1390

852

1391

853

# No such property

1392

raise DBusPropertyNotFound("{}:{}.{}".format(

1393

self.dbus_object_path, interface_name, property_name))

1394

1395

@classmethod

1396

def _get_all_interface_names(cls):

1397

"""Get a sequence of all interfaces supported by an object"""

1398

return (name for name in set(getattr(getattr(x, attr),

1399

"_dbus_interface", None)

1400

for x in (inspect.getmro(cls))

1401

for attr in dir(x))

1402

if name is not None)

1403

1404

@dbus.service.method(dbus.PROPERTIES_IFACE,

1405

in_signature="ss",

854

raise DBusPropertyNotFound(self.dbus_object_path + ":"

855

+ interface_name + "."

856

+ property_name)

857

858

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1406

859

out_signature="v")

1407

860

def Get(self, interface_name, property_name):

1408

861

"""Standard D-Bus property Get() method, see D-Bus standard.

1414

867

if not hasattr(value, "variant_level"):

1415

868

return value

1416

869

return type(value)(value, variant_level=value.variant_level+1)

1417

870

1418

871

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1419

872

def Set(self, interface_name, property_name, value):

1420

873

"""Standard D-Bus property Set() method, see D-Bus standard.

1426

879

# The byte_arrays option is not supported yet on

1427

880

# signatures other than "ay".

1428

881

if prop._dbus_signature != "ay":

1429

raise ValueError("Byte arrays not supported for non-"

1430

"'ay' signature {!r}"

1431

.format(prop._dbus_signature))

1432

value = dbus.ByteArray(bytes(value))

882

raise ValueError

883

value = dbus.ByteArray(b''.join(chr(byte)

884

for byte in value))

1433

885

prop(value)

1434

1435

@dbus.service.method(dbus.PROPERTIES_IFACE,

1436

in_signature="s",

886

887

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1437

888

out_signature="a{sv}")

1438

889

def GetAll(self, interface_name):

1439

890

"""Standard D-Bus property GetAll() method, see D-Bus

1440

891

standard.

1441

892

1442

893

Note: Will not include properties with access="write".

1443

894

"""

1444

895

properties = {}

1454

905

if not hasattr(value, "variant_level"):

1455

906

properties[name] = value

1456

907

continue

1457

properties[name] = type(value)(

1458

value, variant_level=value.variant_level + 1)

908

properties[name] = type(value)(value, variant_level=

909

value.variant_level+1)

1459

910

return dbus.Dictionary(properties, signature="sv")

1460

1461

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1462

def PropertiesChanged(self, interface_name, changed_properties,

1463

invalidated_properties):

1464

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1465

standard.

1466

"""

1467

pass

1468

911

1469

912

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1470

913

out_signature="s",

1471

914

path_keyword='object_path',

1472

915

connection_keyword='connection')

1473

916

def Introspect(self, object_path, connection):

1474

917

"""Overloading of standard D-Bus method.

1475

918

1476

919

Inserts property tags and interface annotation tags.

1477

920

"""

1478

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1479

object_path,

1480

connection)

921

xmlstring = dbus.service.Object.Introspect(self, object_path,

922

connection)

1481

923

try:

1482

924

document = xml.dom.minidom.parseString(xmlstring)

1483

1484

925

def make_tag(document, name, prop):

1485

926

e = document.createElement("property")

1486

927

e.setAttribute("name", name)

1487

928

e.setAttribute("type", prop._dbus_signature)

1488

929

e.setAttribute("access", prop._dbus_access)

1489

930

return e

1490

1491

931

for if_tag in document.getElementsByTagName("interface"):

1492

932

# Add property tags

1493

933

for tag in (make_tag(document, name, prop)

1496

936

if prop._dbus_interface

1497

937

== if_tag.getAttribute("name")):

1498

938

if_tag.appendChild(tag)

1499

# Add annotation tags for properties

1500

for tag in if_tag.getElementsByTagName("property"):

1501

annots = dict()

1502

for name, prop in self._get_all_dbus_things(

1503

"property"):

1504

if (name == tag.getAttribute("name")

1505

and prop._dbus_interface

1506

== if_tag.getAttribute("name")):

1507

annots.update(getattr(

1508

prop, "_dbus_annotations", {}))

1509

for name, value in annots.items():

1510

ann_tag = document.createElement(

1511

"annotation")

1512

ann_tag.setAttribute("name", name)

1513

ann_tag.setAttribute("value", value)

1514

tag.appendChild(ann_tag)

939

# Add interface annotation tags

940

for annotation, value in dict(

941

itertools.chain(

942

*(annotations().iteritems()

943

for name, annotations in

944

self._get_all_dbus_things("interface")

945

if name == if_tag.getAttribute("name")

946

))).iteritems():

947

attr_tag = document.createElement("annotation")

948

attr_tag.setAttribute("name", annotation)

949

attr_tag.setAttribute("value", value)

950

if_tag.appendChild(attr_tag)

1515

951

# Add the names to the return values for the

1516

952

# "org.freedesktop.DBus.Properties" methods

1517

953

if (if_tag.getAttribute("name")

1532

968

except (AttributeError, xml.dom.DOMException,

1533

969

xml.parsers.expat.ExpatError) as error:

1534

970

logger.error("Failed to override Introspection method",

1535

exc_info=error)

1536

return xmlstring

1537

1538

1539

try:

1540

dbus.OBJECT_MANAGER_IFACE

1541

except AttributeError:

1542

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1543

1544

1545

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1546

"""A D-Bus object with an ObjectManager.

1547

1548

Classes inheriting from this exposes the standard

1549

GetManagedObjects call and the InterfacesAdded and

1550

InterfacesRemoved signals on the standard

1551

"org.freedesktop.DBus.ObjectManager" interface.

1552

1553

Note: No signals are sent automatically; they must be sent

1554

manually.

1555

"""

1556

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1557

out_signature="a{oa{sa{sv}}}")

1558

def GetManagedObjects(self):

1559

"""This function must be overridden"""

1560

raise NotImplementedError()

1561

1562

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1563

signature="oa{sa{sv}}")

1564

def InterfacesAdded(self, object_path, interfaces_and_properties):

1565

pass

1566

1567

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1568

def InterfacesRemoved(self, object_path, interfaces):

1569

pass

1570

1571

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1572

out_signature="s",

1573

path_keyword='object_path',

1574

connection_keyword='connection')

1575

def Introspect(self, object_path, connection):

1576

"""Overloading of standard D-Bus method.

1577

1578

Override return argument name of GetManagedObjects to be

1579

"objpath_interfaces_and_properties"

1580

"""

1581

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1582

object_path,

1583

connection)

1584

try:

1585

document = xml.dom.minidom.parseString(xmlstring)

1586

1587

for if_tag in document.getElementsByTagName("interface"):

1588

# Fix argument name for the GetManagedObjects method

1589

if (if_tag.getAttribute("name")

1590

== dbus.OBJECT_MANAGER_IFACE):

1591

for cn in if_tag.getElementsByTagName("method"):

1592

if (cn.getAttribute("name")

1593

== "GetManagedObjects"):

1594

for arg in cn.getElementsByTagName("arg"):

1595

if (arg.getAttribute("direction")

1596

== "out"):

1597

arg.setAttribute(

1598

"name",

1599

"objpath_interfaces"

1600

"_and_properties")

1601

xmlstring = document.toxml("utf-8")

1602

document.unlink()

1603

except (AttributeError, xml.dom.DOMException,

1604

xml.parsers.expat.ExpatError) as error:

1605

logger.error("Failed to override Introspection method",

1606

exc_info=error)

1607

return xmlstring

1608

1609

1610

def datetime_to_dbus(dt, variant_level=0):

971

error)

972

return xmlstring

973

974

975

def datetime_to_dbus (dt, variant_level=0):

1611

976

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1612

977

if dt is None:

1613

return dbus.String("", variant_level=variant_level)

1614

return dbus.String(dt.isoformat(), variant_level=variant_level)

1615

1616

1617

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1618

"""A class decorator; applied to a subclass of

1619

dbus.service.Object, it will add alternate D-Bus attributes with

1620

interface names according to the "alt_interface_names" mapping.

1621

Usage:

1622

1623

@alternate_dbus_interfaces({"org.example.Interface":

1624

"net.example.AlternateInterface"})

1625

class SampleDBusObject(dbus.service.Object):

1626

@dbus.service.method("org.example.Interface")

1627

def SampleDBusMethod():

1628

pass

1629

1630

The above "SampleDBusMethod" on "SampleDBusObject" will be

1631

reachable via two interfaces: "org.example.Interface" and

1632

"net.example.AlternateInterface", the latter of which will have

1633

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1634

"true", unless "deprecate" is passed with a False value.

1635

1636

This works for methods and signals, and also for D-Bus properties

1637

(from DBusObjectWithProperties) and interfaces (from the

1638

dbus_interface_annotations decorator).

978

return dbus.String("", variant_level = variant_level)

979

return dbus.String(dt.isoformat(),

980

variant_level=variant_level)

981

982

983

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

984

.__metaclass__):

985

"""Applied to an empty subclass of a D-Bus object, this metaclass

986

will add additional D-Bus attributes matching a certain pattern.

1639

987

"""

1640

1641

def wrapper(cls):

1642

for orig_interface_name, alt_interface_name in (

1643

alt_interface_names.items()):

1644

attr = {}

1645

interface_names = set()

1646

# Go though all attributes of the class

1647

for attrname, attribute in inspect.getmembers(cls):

988

def __new__(mcs, name, bases, attr):

989

# Go through all the base classes which could have D-Bus

990

# methods, signals, or properties in them

991

old_interface_names = []

992

for base in (b for b in bases

993

if issubclass(b, dbus.service.Object)):

994

# Go though all attributes of the base class

995

for attrname, attribute in inspect.getmembers(base):

1648

996

# Ignore non-D-Bus attributes, and D-Bus attributes

1649

997

# with the wrong interface name

1650

998

if (not hasattr(attribute, "_dbus_interface")

1651

or not attribute._dbus_interface.startswith(

1652

orig_interface_name)):

999

or not attribute._dbus_interface

1000

.startswith("se.recompile.Mandos")):

1653

1001

continue

1654

1002

# Create an alternate D-Bus interface name based on

1655

1003

# the current name

1656

alt_interface = attribute._dbus_interface.replace(

1657

orig_interface_name, alt_interface_name)

1658

interface_names.add(alt_interface)

1004

alt_interface = (attribute._dbus_interface

1005

.replace("se.recompile.Mandos",

1006

"se.bsnet.fukt.Mandos"))

1007

if alt_interface != attribute._dbus_interface:

1008

old_interface_names.append(alt_interface)

1659

1009

# Is this a D-Bus signal?

1660

1010

if getattr(attribute, "_dbus_is_signal", False):

1661

# Extract the original non-method undecorated

1662

# function by black magic

1663

if sys.version_info.major == 2:

1664

nonmethod_func = (dict(

1011

# Extract the original non-method function by

1012

# black magic

1013

nonmethod_func = (dict(

1665

1014

zip(attribute.func_code.co_freevars,

1666

attribute.__closure__))

1667

["func"].cell_contents)

1668

else:

1669

nonmethod_func = (dict(

1670

zip(attribute.__code__.co_freevars,

1671

attribute.__closure__))

1672

["func"].cell_contents)

1015

attribute.__closure__))["func"]

1016

.cell_contents)

1673

1017

# Create a new, but exactly alike, function

1674

1018

# object, and decorate it to be a new D-Bus signal

1675

1019

# with the alternate D-Bus interface name

1676

new_function = copy_function(nonmethod_func)

1677

new_function = (dbus.service.signal(

1678

alt_interface,

1679

attribute._dbus_signature)(new_function))

1680

# Copy annotations, if any

1681

try:

1682

new_function._dbus_annotations = dict(

1683

attribute._dbus_annotations)

1684

except AttributeError:

1685

pass

1686

1020

new_function = (dbus.service.signal

1021

(alt_interface,

1022

attribute._dbus_signature)

1023

(types.FunctionType(

1024

nonmethod_func.func_code,

1025

nonmethod_func.func_globals,

1026

nonmethod_func.func_name,

1027

nonmethod_func.func_defaults,

1028

nonmethod_func.func_closure)))

1687

1029

# Define a creator of a function to call both the

1688

# original and alternate functions, so both the

1689

# original and alternate signals gets sent when

1690

# the function is called

1030

# old and new functions, so both the old and new

1031

# signals gets sent when the function is called

1691

1032

def fixscope(func1, func2):

1692

1033

"""This function is a scope container to pass

1693

1034

func1 and func2 to the "call_both" function

1694

1035

outside of its arguments"""

1695

1696

@functools.wraps(func2)

1697

1036

def call_both(*args, **kwargs):

1698

1037

"""This function will emit two D-Bus

1699

1038

signals by calling func1 and func2"""

1700

1039

func1(*args, **kwargs)

1701

1040

func2(*args, **kwargs)

1702

# Make wrapper function look like a D-Bus

1703

# signal

1704

for name, attr in inspect.getmembers(func2):

1705

if name.startswith("_dbus_"):

1706

setattr(call_both, name, attr)

1707

1708

1041

return call_both

1709

1042

# Create the "call_both" function and add it to

1710

1043

# the class

1711

attr[attrname] = fixscope(attribute, new_function)

1044

attr[attrname] = fixscope(attribute,

1045

new_function)

1712

1046

# Is this a D-Bus method?

1713

1047

elif getattr(attribute, "_dbus_is_method", False):

1714

1048

# Create a new, but exactly alike, function

1715

1049

# object. Decorate it to be a new D-Bus method

1716

1050

# with the alternate D-Bus interface name. Add it

1717

1051

# to the class.

1718

attr[attrname] = (

1719

dbus.service.method(

1720

alt_interface,

1721

attribute._dbus_in_signature,

1722

attribute._dbus_out_signature)

1723

(copy_function(attribute)))

1724

# Copy annotations, if any

1725

try:

1726

attr[attrname]._dbus_annotations = dict(

1727

attribute._dbus_annotations)

1728

except AttributeError:

1729

pass

1052

attr[attrname] = (dbus.service.method

1053

(alt_interface,

1054

attribute._dbus_in_signature,

1055

attribute._dbus_out_signature)

1056

(types.FunctionType

1057

(attribute.func_code,

1058

attribute.func_globals,

1059

attribute.func_name,

1060

attribute.func_defaults,

1061

attribute.func_closure)))

1730

1062

# Is this a D-Bus property?

1731

1063

elif getattr(attribute, "_dbus_is_property", False):

1732

1064

# Create a new, but exactly alike, function

1733

1065

# object, and decorate it to be a new D-Bus

1734

1066

# property with the alternate D-Bus interface

1735

1067

# name. Add it to the class.

1736

attr[attrname] = (dbus_service_property(

1737

alt_interface, attribute._dbus_signature,

1738

attribute._dbus_access,

1739

attribute._dbus_get_args_options

1740

["byte_arrays"])

1741

(copy_function(attribute)))

1742

# Copy annotations, if any

1743

try:

1744

attr[attrname]._dbus_annotations = dict(

1745

attribute._dbus_annotations)

1746

except AttributeError:

1747

pass

1068

attr[attrname] = (dbus_service_property

1069

(alt_interface,

1070

attribute._dbus_signature,

1071

attribute._dbus_access,

1072

attribute

1073

._dbus_get_args_options

1074

["byte_arrays"])

1075

(types.FunctionType

1076

(attribute.func_code,

1077

attribute.func_globals,

1078

attribute.func_name,

1079

attribute.func_defaults,

1080

attribute.func_closure)))

1748

1081

# Is this a D-Bus interface?

1749

1082

elif getattr(attribute, "_dbus_is_interface", False):

1750

1083

# Create a new, but exactly alike, function

1751

1084

# object. Decorate it to be a new D-Bus interface

1752

1085

# with the alternate D-Bus interface name. Add it

1753

1086

# to the class.

1754

attr[attrname] = (

1755

dbus_interface_annotations(alt_interface)

1756

(copy_function(attribute)))

1757

if deprecate:

1758

# Deprecate all alternate interfaces

1759

iname = "_AlternateDBusNames_interface_annotation{}"

1760

for interface_name in interface_names:

1761

1762

@dbus_interface_annotations(interface_name)

1763

def func(self):

1764

return {"org.freedesktop.DBus.Deprecated":

1765

"true"}

1766

# Find an unused name

1767

for aname in (iname.format(i)

1768

for i in itertools.count()):

1769

if aname not in attr:

1770

attr[aname] = func

1771

break

1772

if interface_names:

1773

# Replace the class with a new subclass of it with

1774

# methods, signals, etc. as created above.

1775

if sys.version_info.major == 2:

1776

cls = type(b"{}Alternate".format(cls.__name__),

1777

(cls, ), attr)

1778

else:

1779

cls = type("{}Alternate".format(cls.__name__),

1780

(cls, ), attr)

1781

return cls

1782

1783

return wrapper

1784

1785

1786

@alternate_dbus_interfaces({"se.recompile.Mandos":

1787

"se.bsnet.fukt.Mandos"})

1087

attr[attrname] = (dbus_interface_annotations

1088

(alt_interface)

1089

(types.FunctionType

1090

(attribute.func_code,

1091

attribute.func_globals,

1092

attribute.func_name,

1093

attribute.func_defaults,

1094

attribute.func_closure)))

1095

# Deprecate all old interfaces

1096

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1097

for old_interface_name in old_interface_names:

1098

@dbus_interface_annotations(old_interface_name)

1099

def func(self):

1100

return { "org.freedesktop.DBus.Deprecated": "true" }

1101

# Find an unused name

1102

for aname in (basename.format(i) for i in

1103

itertools.count()):

1104

if aname not in attr:

1105

attr[aname] = func

1106

break

1107

return type.__new__(mcs, name, bases, attr)

1108

1109

1788

1110

class ClientDBus(Client, DBusObjectWithProperties):

1789

1111

"""A Client class using D-Bus

1790

1112

1791

1113

Attributes:

1792

1114

dbus_object_path: dbus.ObjectPath

1793

1115

bus: dbus.SystemBus()

1794

1116

"""

1795

1117

1796

1118

runtime_expansions = (Client.runtime_expansions

1797

+ ("dbus_object_path", ))

1798

1799

_interface = "se.recompile.Mandos.Client"

1800

1119

+ ("dbus_object_path",))

1120

1801

1121

# dbus.service.Object doesn't use super(), so we can't either.

1802

1803

def __init__(self, bus=None, *args, **kwargs):

1122

1123

def __init__(self, bus = None, *args, **kwargs):

1804

1124

self.bus = bus

1805

1125

Client.__init__(self, *args, **kwargs)

1806

1126

# Only now, when this client is initialized, can it show up on

1807

1127

# the D-Bus

1808

client_object_name = str(self.name).translate(

1128

client_object_name = unicode(self.name).translate(

1809

1129

{ord("."): ord("_"),

1810

1130

ord("-"): ord("_")})

1811

self.dbus_object_path = dbus.ObjectPath(

1812

"/clients/" + client_object_name)

1131

self.dbus_object_path = (dbus.ObjectPath

1132

("/clients/" + client_object_name))

1813

1133

DBusObjectWithProperties.__init__(self, self.bus,

1814

1134

self.dbus_object_path)

1815

1816

def notifychangeproperty(transform_func, dbus_name,

1817

type_func=lambda x: x,

1818

variant_level=1,

1819

invalidate_only=False,

1820

_interface=_interface):

1135

1136

def notifychangeproperty(transform_func,

1137

dbus_name, type_func=lambda x: x,

1138

variant_level=1):

1821

1139

""" Modify a variable so that it's a property which announces

1822

1140

its changes to DBus.

1823

1141

1824

1142

transform_fun: Function that takes a value and a variant_level

1825

1143

and transforms it to a D-Bus type.

1826

1144

dbus_name: D-Bus name of the variable

1828

1146

to the D-Bus. Default: no transform

1829

1147

variant_level: D-Bus variant level. Default: 1

1830

1148

"""

1831

attrname = "_{}".format(dbus_name)

1832

1149

attrname = "_{0}".format(dbus_name)

1833

1150

def setter(self, value):

1834

1151

if hasattr(self, "dbus_object_path"):

1835

1152

if (not hasattr(self, attrname) or

1836

1153

type_func(getattr(self, attrname, None))

1837

1154

!= type_func(value)):

1838

if invalidate_only:

1839

self.PropertiesChanged(

1840

_interface, dbus.Dictionary(),

1841

dbus.Array((dbus_name, )))

1842

else:

1843

dbus_value = transform_func(

1844

type_func(value),

1845

variant_level=variant_level)

1846

self.PropertyChanged(dbus.String(dbus_name),

1847

dbus_value)

1848

self.PropertiesChanged(

1849

_interface,

1850

dbus.Dictionary({dbus.String(dbus_name):

1851

dbus_value}),

1852

dbus.Array())

1155

dbus_value = transform_func(type_func(value),

1156

variant_level

1157

=variant_level)

1158

self.PropertyChanged(dbus.String(dbus_name),

1159

dbus_value)

1853

1160

setattr(self, attrname, value)

1854

1161

1855

1162

return property(lambda self: getattr(self, attrname), setter)

1856

1163

1164

1857

1165

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1858

1166

approvals_pending = notifychangeproperty(dbus.Boolean,

1859

1167

"ApprovalPending",

1860

type_func=bool)

1168

type_func = bool)

1861

1169

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1862

1170

last_enabled = notifychangeproperty(datetime_to_dbus,

1863

1171

"LastEnabled")

1864

checker = notifychangeproperty(

1865

dbus.Boolean, "CheckerRunning",

1866

type_func=lambda checker: checker is not None)

1172

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1173

type_func = lambda checker:

1174

checker is not None)

1867

1175

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1868

1176

"LastCheckedOK")

1869

1177

last_checker_status = notifychangeproperty(dbus.Int16,

1872

1180

datetime_to_dbus, "LastApprovalRequest")

1873

1181

approved_by_default = notifychangeproperty(dbus.Boolean,

1874

1182

"ApprovedByDefault")

1875

approval_delay = notifychangeproperty(

1876

dbus.UInt64, "ApprovalDelay",

1877

type_func=lambda td: td.total_seconds() * 1000)

1183

approval_delay = notifychangeproperty(dbus.UInt64,

1184

"ApprovalDelay",

1185

type_func =

1186

timedelta_to_milliseconds)

1878

1187

approval_duration = notifychangeproperty(

1879

1188

dbus.UInt64, "ApprovalDuration",

1880

type_func=lambda td: td.total_seconds() * 1000)

1189

type_func = timedelta_to_milliseconds)

1881

1190

host = notifychangeproperty(dbus.String, "Host")

1882

timeout = notifychangeproperty(

1883

dbus.UInt64, "Timeout",

1884

type_func=lambda td: td.total_seconds() * 1000)

1191

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1192

type_func =

1193

timedelta_to_milliseconds)

1885

1194

extended_timeout = notifychangeproperty(

1886

1195

dbus.UInt64, "ExtendedTimeout",

1887

type_func=lambda td: td.total_seconds() * 1000)

1888

interval = notifychangeproperty(

1889

dbus.UInt64, "Interval",

1890

type_func=lambda td: td.total_seconds() * 1000)

1196

type_func = timedelta_to_milliseconds)

1197

interval = notifychangeproperty(dbus.UInt64,

1198

"Interval",

1199

type_func =

1200

timedelta_to_milliseconds)

1891

1201

checker_command = notifychangeproperty(dbus.String, "Checker")

1892

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1893

invalidate_only=True)

1894

1202

1895

1203

del notifychangeproperty

1896

1204

1897

1205

def __del__(self, *args, **kwargs):

1898

1206

try:

1899

1207

self.remove_from_connection()

1902

1210

if hasattr(DBusObjectWithProperties, "__del__"):

1903

1211

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1904

1212

Client.__del__(self, *args, **kwargs)

1905

1906

def checker_callback(self, source, condition,

1907

connection, command, *args, **kwargs):

1908

ret = Client.checker_callback(self, source, condition,

1909

connection, command, *args,

1910

**kwargs)

1911

exitstatus = self.last_checker_status

1912

if exitstatus >= 0:

1213

1214

def checker_callback(self, pid, condition, command,

1215

*args, **kwargs):

1216

self.checker_callback_tag = None

1217

self.checker = None

1218

if os.WIFEXITED(condition):

1219

exitstatus = os.WEXITSTATUS(condition)

1913

1220

# Emit D-Bus signal

1914

1221

self.CheckerCompleted(dbus.Int16(exitstatus),

1915

# This is specific to GNU libC

1916

dbus.Int64(exitstatus << 8),

1222

dbus.Int64(condition),

1917

1223

dbus.String(command))

1918

1224

else:

1919

1225

# Emit D-Bus signal

1920

1226

self.CheckerCompleted(dbus.Int16(-1),

1921

dbus.Int64(

1922

# This is specific to GNU libC

1923

(exitstatus << 8)

1924

| self.last_checker_signal),

1227

dbus.Int64(condition),

1925

1228

dbus.String(command))

1926

return ret

1927

1229

1230

return Client.checker_callback(self, pid, condition, command,

1231

*args, **kwargs)

1232

1928

1233

def start_checker(self, *args, **kwargs):

1929

old_checker_pid = getattr(self.checker, "pid", None)

1234

old_checker = self.checker

1235

if self.checker is not None:

1236

old_checker_pid = self.checker.pid

1237

else:

1238

old_checker_pid = None

1930

1239

r = Client.start_checker(self, *args, **kwargs)

1931

1240

# Only if new checker process was started

1932

1241

if (self.checker is not None

1934

1243

# Emit D-Bus signal

1935

1244

self.CheckerStarted(self.current_checker_command)

1936

1245

return r

1937

1246

1938

1247

def _reset_approved(self):

1939

1248

self.approved = None

1940

1249

return False

1941

1250

1942

1251

def approve(self, value=True):

1252

self.send_changedstate()

1943

1253

self.approved = value

1944

GLib.timeout_add(int(self.approval_duration.total_seconds()

1945

* 1000), self._reset_approved)

1946

self.send_changedstate()

1947

1948

# D-Bus methods, signals & properties

1949

1950

# Interfaces

1951

1952

# Signals

1953

1254

gobject.timeout_add(timedelta_to_milliseconds

1255

(self.approval_duration),

1256

self._reset_approved)

1257

1258

1259

## D-Bus methods, signals & properties

1260

_interface = "se.recompile.Mandos.Client"

1261

1262

## Interfaces

1263

1264

@dbus_interface_annotations(_interface)

1265

def _foo(self):

1266

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1267

"false"}

1268

1269

## Signals

1270

1954

1271

# CheckerCompleted - signal

1955

1272

@dbus.service.signal(_interface, signature="nxs")

1956

1273

def CheckerCompleted(self, exitcode, waitstatus, command):

1957

1274

"D-Bus signal"

1958

1275

pass

1959

1276

1960

1277

# CheckerStarted - signal

1961

1278

@dbus.service.signal(_interface, signature="s")

1962

1279

def CheckerStarted(self, command):

1963

1280

"D-Bus signal"

1964

1281

pass

1965

1282

1966

1283

# PropertyChanged - signal

1967

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1968

1284

@dbus.service.signal(_interface, signature="sv")

1969

1285

def PropertyChanged(self, property, value):

1970

1286

"D-Bus signal"

1971

1287

pass

1972

1288

1973

1289

# GotSecret - signal

1974

1290

@dbus.service.signal(_interface)

1975

1291

def GotSecret(self):

1978

1294

server to mandos-client

1979

1295

"""

1980

1296

pass

1981

1297

1982

1298

# Rejected - signal

1983

1299

@dbus.service.signal(_interface, signature="s")

1984

1300

def Rejected(self, reason):

1985

1301

"D-Bus signal"

1986

1302

pass

1987

1303

1988

1304

# NeedApproval - signal

1989

1305

@dbus.service.signal(_interface, signature="tb")

1990

1306

def NeedApproval(self, timeout, default):

1991

1307

"D-Bus signal"

1992

1308

return self.need_approval()

1993

1994

# Methods

1995

1309

1310

## Methods

1311

1996

1312

# Approve - method

1997

1313

@dbus.service.method(_interface, in_signature="b")

1998

1314

def Approve(self, value):

1999

1315

self.approve(value)

2000

1316

2001

1317

# CheckedOK - method

2002

1318

@dbus.service.method(_interface)

2003

1319

def CheckedOK(self):

2004

1320

self.checked_ok()

2005

1321

2006

1322

# Enable - method

2007

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2008

1323

@dbus.service.method(_interface)

2009

1324

def Enable(self):

2010

1325

"D-Bus method"

2011

1326

self.enable()

2012

1327

2013

1328

# StartChecker - method

2014

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1329

@dbus.service.method(_interface)

2016

1330

def StartChecker(self):

2017

1331

"D-Bus method"

2018

1332

self.start_checker()

2019

1333

2020

1334

# Disable - method

2021

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2022

1335

@dbus.service.method(_interface)

2023

1336

def Disable(self):

2024

1337

"D-Bus method"

2025

1338

self.disable()

2026

1339

2027

1340

# StopChecker - method

2028

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2029

1341

@dbus.service.method(_interface)

2030

1342

def StopChecker(self):

2031

1343

self.stop_checker()

2032

2033

# Properties

2034

1344

1345

## Properties

1346

2035

1347

# ApprovalPending - property

2036

1348

@dbus_service_property(_interface, signature="b", access="read")

2037

1349

def ApprovalPending_dbus_property(self):

2038

1350

return dbus.Boolean(bool(self.approvals_pending))

2039

1351

2040

1352

# ApprovedByDefault - property

2041

@dbus_service_property(_interface,

2042

signature="b",

1353

@dbus_service_property(_interface, signature="b",

2043

1354

access="readwrite")

2044

1355

def ApprovedByDefault_dbus_property(self, value=None):

2045

1356

if value is None: # get

2046

1357

return dbus.Boolean(self.approved_by_default)

2047

1358

self.approved_by_default = bool(value)

2048

1359

2049

1360

# ApprovalDelay - property

2050

@dbus_service_property(_interface,

2051

signature="t",

1361

@dbus_service_property(_interface, signature="t",

2052

1362

access="readwrite")

2053

1363

def ApprovalDelay_dbus_property(self, value=None):

2054

1364

if value is None: # get

2055

return dbus.UInt64(self.approval_delay.total_seconds()

2056

* 1000)

1365

return dbus.UInt64(self.approval_delay_milliseconds())

2057

1366

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2058

1367

2059

1368

# ApprovalDuration - property

2060

@dbus_service_property(_interface,

2061

signature="t",

1369

@dbus_service_property(_interface, signature="t",

2062

1370

access="readwrite")

2063

1371

def ApprovalDuration_dbus_property(self, value=None):

2064

1372

if value is None: # get

2065

return dbus.UInt64(self.approval_duration.total_seconds()

2066

* 1000)

1373

return dbus.UInt64(timedelta_to_milliseconds(

1374

self.approval_duration))

2067

1375

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2068

1376

2069

1377

# Name - property

2070

@dbus_annotations(

2071

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2072

1378

@dbus_service_property(_interface, signature="s", access="read")

2073

1379

def Name_dbus_property(self):

2074

1380

return dbus.String(self.name)

2075

2076

# KeyID - property

2077

@dbus_annotations(

2078

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2079

@dbus_service_property(_interface, signature="s", access="read")

2080

def KeyID_dbus_property(self):

2081

return dbus.String(self.key_id)

2082

1381

2083

1382

# Fingerprint - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

1383

@dbus_service_property(_interface, signature="s", access="read")

2087

1384

def Fingerprint_dbus_property(self):

2088

1385

return dbus.String(self.fingerprint)

2089

1386

2090

1387

# Host - property

2091

@dbus_service_property(_interface,

2092

signature="s",

1388

@dbus_service_property(_interface, signature="s",

2093

1389

access="readwrite")

2094

1390

def Host_dbus_property(self, value=None):

2095

1391

if value is None: # get

2096

1392

return dbus.String(self.host)

2097

self.host = str(value)

2098

1393

self.host = unicode(value)

1394

2099

1395

# Created - property

2100

@dbus_annotations(

2101

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2102

1396

@dbus_service_property(_interface, signature="s", access="read")

2103

1397

def Created_dbus_property(self):

2104

1398

return datetime_to_dbus(self.created)

2105

1399

2106

1400

# LastEnabled - property

2107

1401

@dbus_service_property(_interface, signature="s", access="read")

2108

1402

def LastEnabled_dbus_property(self):

2109

1403

return datetime_to_dbus(self.last_enabled)

2110

1404

2111

1405

# Enabled - property

2112

@dbus_service_property(_interface,

2113

signature="b",

1406

@dbus_service_property(_interface, signature="b",

2114

1407

access="readwrite")

2115

1408

def Enabled_dbus_property(self, value=None):

2116

1409

if value is None: # get

2119

1412

self.enable()

2120

1413

else:

2121

1414

self.disable()

2122

1415

2123

1416

# LastCheckedOK - property

2124

@dbus_service_property(_interface,

2125

signature="s",

1417

@dbus_service_property(_interface, signature="s",

2126

1418

access="readwrite")

2127

1419

def LastCheckedOK_dbus_property(self, value=None):

2128

1420

if value is not None:

2129

1421

self.checked_ok()

2130

1422

return

2131

1423

return datetime_to_dbus(self.last_checked_ok)

2132

1424

2133

1425

# LastCheckerStatus - property

2134

@dbus_service_property(_interface, signature="n", access="read")

1426

@dbus_service_property(_interface, signature="n",

1427

access="read")

2135

1428

def LastCheckerStatus_dbus_property(self):

2136

1429

return dbus.Int16(self.last_checker_status)

2137

1430

2138

1431

# Expires - property

2139

1432

@dbus_service_property(_interface, signature="s", access="read")

2140

1433

def Expires_dbus_property(self):

2141

1434

return datetime_to_dbus(self.expires)

2142

1435

2143

1436

# LastApprovalRequest - property

2144

1437

@dbus_service_property(_interface, signature="s", access="read")

2145

1438

def LastApprovalRequest_dbus_property(self):

2146

1439

return datetime_to_dbus(self.last_approval_request)

2147

1440

2148

1441

# Timeout - property

2149

@dbus_service_property(_interface,

2150

signature="t",

1442

@dbus_service_property(_interface, signature="t",

2151

1443

access="readwrite")

2152

1444

def Timeout_dbus_property(self, value=None):

2153

1445

if value is None: # get

2154

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2155

old_timeout = self.timeout

1446

return dbus.UInt64(self.timeout_milliseconds())

2156

1447

self.timeout = datetime.timedelta(0, 0, 0, value)

2157

# Reschedule disabling

1448

# Reschedule timeout

2158

1449

if self.enabled:

2159

1450

now = datetime.datetime.utcnow()

2160

self.expires += self.timeout - old_timeout

2161

if self.expires <= now:

1451

time_to_die = timedelta_to_milliseconds(

1452

(self.last_checked_ok + self.timeout) - now)

1453

if time_to_die <= 0:

2162

1454

# The timeout has passed

2163

1455

self.disable()

2164

1456

else:

1457

self.expires = (now +

1458

datetime.timedelta(milliseconds =

1459

time_to_die))

2165

1460

if (getattr(self, "disable_initiator_tag", None)

2166

1461

is None):

2167

1462

return

2168

GLib.source_remove(self.disable_initiator_tag)

2169

self.disable_initiator_tag = GLib.timeout_add(

2170

int((self.expires - now).total_seconds() * 1000),

2171

self.disable)

2172

1463

gobject.source_remove(self.disable_initiator_tag)

1464

self.disable_initiator_tag = (gobject.timeout_add

1465

(time_to_die,

1466

self.disable))

1467

2173

1468

# ExtendedTimeout - property

2174

@dbus_service_property(_interface,

2175

signature="t",

1469

@dbus_service_property(_interface, signature="t",

2176

1470

access="readwrite")

2177

1471

def ExtendedTimeout_dbus_property(self, value=None):

2178

1472

if value is None: # get

2179

return dbus.UInt64(self.extended_timeout.total_seconds()

2180

* 1000)

1473

return dbus.UInt64(self.extended_timeout_milliseconds())

2181

1474

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2182

1475

2183

1476

# Interval - property

2184

@dbus_service_property(_interface,

2185

signature="t",

1477

@dbus_service_property(_interface, signature="t",

2186

1478

access="readwrite")

2187

1479

def Interval_dbus_property(self, value=None):

2188

1480

if value is None: # get

2189

return dbus.UInt64(self.interval.total_seconds() * 1000)

1481

return dbus.UInt64(self.interval_milliseconds())

2190

1482

self.interval = datetime.timedelta(0, 0, 0, value)

2191

1483

if getattr(self, "checker_initiator_tag", None) is None:

2192

1484

return

2193

1485

if self.enabled:

2194

1486

# Reschedule checker run

2195

GLib.source_remove(self.checker_initiator_tag)

2196

self.checker_initiator_tag = GLib.timeout_add(

2197

value, self.start_checker)

2198

self.start_checker() # Start one now, too

2199

1487

gobject.source_remove(self.checker_initiator_tag)

1488

self.checker_initiator_tag = (gobject.timeout_add

1489

(value, self.start_checker))

1490

self.start_checker() # Start one now, too

1491

2200

1492

# Checker - property

2201

@dbus_service_property(_interface,

2202

signature="s",

1493

@dbus_service_property(_interface, signature="s",

2203

1494

access="readwrite")

2204

1495

def Checker_dbus_property(self, value=None):

2205

1496

if value is None: # get

2206

1497

return dbus.String(self.checker_command)

2207

self.checker_command = str(value)

2208

1498

self.checker_command = unicode(value)

1499

2209

1500

# CheckerRunning - property

2210

@dbus_service_property(_interface,

2211

signature="b",

1501

@dbus_service_property(_interface, signature="b",

2212

1502

access="readwrite")

2213

1503

def CheckerRunning_dbus_property(self, value=None):

2214

1504

if value is None: # get

2217

1507

self.start_checker()

2218

1508

else:

2219

1509

self.stop_checker()

2220

1510

2221

1511

# ObjectPath - property

2222

@dbus_annotations(

2223

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2224

"org.freedesktop.DBus.Deprecated": "true"})

2225

1512

@dbus_service_property(_interface, signature="o", access="read")

2226

1513

def ObjectPath_dbus_property(self):

2227

return self.dbus_object_path # is already a dbus.ObjectPath

2228

1514

return self.dbus_object_path # is already a dbus.ObjectPath

1515

2229

1516

# Secret = property

2230

@dbus_annotations(

2231

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2232

"invalidates"})

2233

@dbus_service_property(_interface,

2234

signature="ay",

2235

access="write",

2236

byte_arrays=True)

1517

@dbus_service_property(_interface, signature="ay",

1518

access="write", byte_arrays=True)

2237

1519

def Secret_dbus_property(self, value):

2238

self.secret = bytes(value)

2239

1520

self.secret = str(value)

1521

2240

1522

del _interface

2241

1523

2242

1524

2243

class ProxyClient:

2244

def __init__(self, child_pipe, key_id, fpr, address):

1525

class ProxyClient(object):

1526

def __init__(self, child_pipe, fpr, address):

2245

1527

self._pipe = child_pipe

2246

self._pipe.send(('init', key_id, fpr, address))

1528

self._pipe.send(('init', fpr, address))

2247

1529

if not self._pipe.recv():

2248

raise KeyError(key_id or fpr)

2249

1530

raise KeyError()

1531

2250

1532

def __getattribute__(self, name):

2251

1533

if name == '_pipe':

2252

1534

return super(ProxyClient, self).__getattribute__(name)

2255

1537

if data[0] == 'data':

2256

1538

return data[1]

2257

1539

if data[0] == 'function':

2258

2259

1540

def func(*args, **kwargs):

2260

1541

self._pipe.send(('funcall', name, args, kwargs))

2261

1542

return self._pipe.recv()[1]

2262

2263

1543

return func

2264

1544

2265

1545

def __setattr__(self, name, value):

2266

1546

if name == '_pipe':

2267

1547

return super(ProxyClient, self).__setattr__(name, value)

2268

1548

self._pipe.send(('setattr', name, value))

2269

1549

2270

1550

1551

class ClientDBusTransitional(ClientDBus):

1552

__metaclass__ = AlternateDBusNamesMetaclass

1553

1554

2271

1555

class ClientHandler(socketserver.BaseRequestHandler, object):

2272

1556

"""A class to handle client connections.

2273

1557

2274

1558

Instantiated once for each connection to handle it.

2275

1559

Note: This will run in its own forked process."""

2276

1560

2277

1561

def handle(self):

2278

1562

with contextlib.closing(self.server.child_pipe) as child_pipe:

2279

1563

logger.info("TCP connection from: %s",

2280

str(self.client_address))

1564

unicode(self.client_address))

2281

1565

logger.debug("Pipe FD: %d",

2282

1566

self.server.child_pipe.fileno())

2283

2284

session = gnutls.ClientSession(self.request)

2285

2286

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2287

# "+AES-256-CBC", "+SHA1",

2288

# "+COMP-NULL", "+CTYPE-OPENPGP",

2289

# "+DHE-DSS"))

1567

1568

session = (gnutls.connection

1569

.ClientSession(self.request,

1570

gnutls.connection

1571

.X509Credentials()))

1572

1573

# Note: gnutls.connection.X509Credentials is really a

1574

# generic GnuTLS certificate credentials object so long as

1575

# no X.509 keys are added to it. Therefore, we can use it

1576

# here despite using OpenPGP certificates.

1577

1578

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1579

# "+AES-256-CBC", "+SHA1",

1580

# "+COMP-NULL", "+CTYPE-OPENPGP",

1581

# "+DHE-DSS"))

2290

1582

# Use a fallback default, since this MUST be set.

2291

1583

priority = self.server.gnutls_priority

2292

1584

if priority is None:

2293

1585

priority = "NORMAL"

2294

gnutls.priority_set_direct(session._c_object,

2295

priority.encode("utf-8"),

2296

None)

2297

1586

(gnutls.library.functions

1587

.gnutls_priority_set_direct(session._c_object,

1588

priority, None))

1589

2298

1590

# Start communication using the Mandos protocol

2299

1591

# Get protocol number

2300

1592

line = self.request.makefile().readline()

2301

1593

logger.debug("Protocol version: %r", line)

2302

1594

try:

2303

1595

if int(line.strip().split()[0]) > 1:

2304

raise RuntimeError(line)

1596

raise RuntimeError

2305

1597

except (ValueError, IndexError, RuntimeError) as error:

2306

1598

logger.error("Unknown protocol version: %s", error)

2307

1599

return

2308

1600

2309

1601

# Start GnuTLS connection

2310

1602

try:

2311

1603

session.handshake()

2312

except gnutls.Error as error:

1604

except gnutls.errors.GNUTLSError as error:

2313

1605

logger.warning("Handshake failed: %s", error)

2314

1606

# Do not run session.bye() here: the session is not

2315

1607

# established. Just abandon the request.

2316

1608

return

2317

1609

logger.debug("Handshake succeeded")

2318

1610

2319

1611

approval_required = False

2320

1612

try:

2321

if gnutls.has_rawpk:

2322

fpr = b""

2323

try:

2324

key_id = self.key_id(

2325

self.peer_certificate(session))

2326

except (TypeError, gnutls.Error) as error:

2327

logger.warning("Bad certificate: %s", error)

2328

return

2329

logger.debug("Key ID: %s", key_id)

2330

2331

else:

2332

key_id = b""

2333

try:

2334

fpr = self.fingerprint(

2335

self.peer_certificate(session))

2336

except (TypeError, gnutls.Error) as error:

2337

logger.warning("Bad certificate: %s", error)

2338

return

2339

logger.debug("Fingerprint: %s", fpr)

2340

2341

try:

2342

client = ProxyClient(child_pipe, key_id, fpr,

1613

try:

1614

fpr = self.fingerprint(self.peer_certificate

1615

(session))

1616

except (TypeError,

1617

gnutls.errors.GNUTLSError) as error:

1618

logger.warning("Bad certificate: %s", error)

1619

return

1620

logger.debug("Fingerprint: %s", fpr)

1621

1622

try:

1623

client = ProxyClient(child_pipe, fpr,

2343

1624

self.client_address)

2344

1625

except KeyError:

2345

1626

return

2346

1627

2347

1628

if client.approval_delay:

2348

1629

delay = client.approval_delay

2349

1630

client.approvals_pending += 1

2350

1631

approval_required = True

2351

1632

2352

1633

while True:

2353

1634

if not client.enabled:

2354

1635

logger.info("Client %s is disabled",

2355

client.name)

1636

client.name)

2356

1637

if self.server.use_dbus:

2357

1638

# Emit D-Bus signal

2358

1639

client.Rejected("Disabled")

2359

1640

return

2360

1641

2361

1642

if client.approved or not client.approval_delay:

2362

# We are approved or approval is disabled

1643

#We are approved or approval is disabled

2363

1644

break

2364

1645

elif client.approved is None:

2365

1646

logger.info("Client %s needs approval",

2367

1648

if self.server.use_dbus:

2368

1649

# Emit D-Bus signal

2369

1650

client.NeedApproval(

2370

client.approval_delay.total_seconds()

2371

* 1000, client.approved_by_default)

1651

client.approval_delay_milliseconds(),

1652

client.approved_by_default)

2372

1653

else:

2373

1654

logger.warning("Client %s was not approved",

2374

1655

client.name)

2376

1657

# Emit D-Bus signal

2377

1658

client.Rejected("Denied")

2378

1659

return

2379

2380

# wait until timeout or approved

1660

1661

#wait until timeout or approved

2381

1662

time = datetime.datetime.now()

2382

1663

client.changedstate.acquire()

2383

client.changedstate.wait(delay.total_seconds())

1664

(client.changedstate.wait

1665

(float(client.timedelta_to_milliseconds(delay)

1666

/ 1000)))

2384

1667

client.changedstate.release()

2385

1668

time2 = datetime.datetime.now()

2386

1669

if (time2 - time) >= delay:

2396

1679

break

2397

1680

else:

2398

1681

delay -= time2 - time

2399

2400

try:

2401

session.send(client.secret)

2402

except gnutls.Error as error:

2403

logger.warning("gnutls send failed",

2404

exc_info=error)

2405

return

2406

1682

1683

sent_size = 0

1684

while sent_size < len(client.secret):

1685

try:

1686

sent = session.send(client.secret[sent_size:])

1687

except gnutls.errors.GNUTLSError as error:

1688

logger.warning("gnutls send failed")

1689

return

1690

logger.debug("Sent: %d, remaining: %d",

1691

sent, len(client.secret)

1692

- (sent_size + sent))

1693

sent_size += sent

1694

2407

1695

logger.info("Sending secret to %s", client.name)

2408

1696

# bump the timeout using extended_timeout

2409

1697

client.bump_timeout(client.extended_timeout)

2410

1698

if self.server.use_dbus:

2411

1699

# Emit D-Bus signal

2412

1700

client.GotSecret()

2413

1701

2414

1702

finally:

2415

1703

if approval_required:

2416

1704

client.approvals_pending -= 1

2417

1705

try:

2418

1706

session.bye()

2419

except gnutls.Error as error:

2420

logger.warning("GnuTLS bye failed",

2421

exc_info=error)

2422

1707

except gnutls.errors.GNUTLSError as error:

1708

logger.warning("GnuTLS bye failed")

1709

2423

1710

@staticmethod

2424

1711

def peer_certificate(session):

2425

"Return the peer's certificate as a bytestring"

2426

try:

2427

cert_type = gnutls.certificate_type_get2(session._c_object,

2428

gnutls.CTYPE_PEERS)

2429

except AttributeError:

2430

cert_type = gnutls.certificate_type_get(session._c_object)

2431

if gnutls.has_rawpk:

2432

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2433

else:

2434

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2435

# If not a valid certificate type...

2436

if cert_type not in valid_cert_types:

2437

logger.info("Cert type %r not in %r", cert_type,

2438

valid_cert_types)

2439

# ...return invalid data

2440

return b""

1712

"Return the peer's OpenPGP certificate as a bytestring"

1713

# If not an OpenPGP certificate...

1714

if (gnutls.library.functions

1715

.gnutls_certificate_type_get(session._c_object)

1716

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1717

# ...do the normal thing

1718

return session.peer_certificate

2441

1719

list_size = ctypes.c_uint(1)

2442

cert_list = (gnutls.certificate_get_peers

1720

cert_list = (gnutls.library.functions

1721

.gnutls_certificate_get_peers

2443

1722

(session._c_object, ctypes.byref(list_size)))

2444

1723

if not bool(cert_list) and list_size.value != 0:

2445

raise gnutls.Error("error getting peer certificate")

1724

raise gnutls.errors.GNUTLSError("error getting peer"

1725

" certificate")

2446

1726

if list_size.value == 0:

2447

1727

return None

2448

1728

cert = cert_list[0]

2449

1729

return ctypes.string_at(cert.data, cert.size)

2450

2451

@staticmethod

2452

def key_id(certificate):

2453

"Convert a certificate bytestring to a hexdigit key ID"

2454

# New GnuTLS "datum" with the public key

2455

datum = gnutls.datum_t(

2456

ctypes.cast(ctypes.c_char_p(certificate),

2457

ctypes.POINTER(ctypes.c_ubyte)),

2458

ctypes.c_uint(len(certificate)))

2459

# XXX all these need to be created in the gnutls "module"

2460

# New empty GnuTLS certificate

2461

pubkey = gnutls.pubkey_t()

2462

gnutls.pubkey_init(ctypes.byref(pubkey))

2463

# Import the raw public key into the certificate

2464

gnutls.pubkey_import(pubkey,

2465

ctypes.byref(datum),

2466

gnutls.X509_FMT_DER)

2467

# New buffer for the key ID

2468

buf = ctypes.create_string_buffer(32)

2469

buf_len = ctypes.c_size_t(len(buf))

2470

# Get the key ID from the raw public key into the buffer

2471

gnutls.pubkey_get_key_id(pubkey,

2472

gnutls.KEYID_USE_SHA256,

2473

ctypes.cast(ctypes.byref(buf),

2474

ctypes.POINTER(ctypes.c_ubyte)),

2475

ctypes.byref(buf_len))

2476

# Deinit the certificate

2477

gnutls.pubkey_deinit(pubkey)

2478

2479

# Convert the buffer to a Python bytestring

2480

key_id = ctypes.string_at(buf, buf_len.value)

2481

# Convert the bytestring to hexadecimal notation

2482

hex_key_id = binascii.hexlify(key_id).upper()

2483

return hex_key_id

2484

1730

2485

1731

@staticmethod

2486

1732

def fingerprint(openpgp):

2487

1733

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2488

1734

# New GnuTLS "datum" with the OpenPGP public key

2489

datum = gnutls.datum_t(

2490

ctypes.cast(ctypes.c_char_p(openpgp),

2491

ctypes.POINTER(ctypes.c_ubyte)),

2492

ctypes.c_uint(len(openpgp)))

1735

datum = (gnutls.library.types

1736

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1737

ctypes.POINTER

1738

(ctypes.c_ubyte)),

1739

ctypes.c_uint(len(openpgp))))

2493

1740

# New empty GnuTLS certificate

2494

crt = gnutls.openpgp_crt_t()

2495

gnutls.openpgp_crt_init(ctypes.byref(crt))

1741

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1742

(gnutls.library.functions

1743

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2496

1744

# Import the OpenPGP public key into the certificate

2497

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2498

gnutls.OPENPGP_FMT_RAW)

1745

(gnutls.library.functions

1746

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1747

gnutls.library.constants

1748

.GNUTLS_OPENPGP_FMT_RAW))

2499

1749

# Verify the self signature in the key

2500

1750

crtverify = ctypes.c_uint()

2501

gnutls.openpgp_crt_verify_self(crt, 0,

2502

ctypes.byref(crtverify))

1751

(gnutls.library.functions

1752

.gnutls_openpgp_crt_verify_self(crt, 0,

1753

ctypes.byref(crtverify)))

2503

1754

if crtverify.value != 0:

2504

gnutls.openpgp_crt_deinit(crt)

2505

raise gnutls.CertificateSecurityError(code

2506

=crtverify.value)

1755

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1756

raise (gnutls.errors.CertificateSecurityError

1757

("Verify failed"))

2507

1758

# New buffer for the fingerprint

2508

1759

buf = ctypes.create_string_buffer(20)

2509

1760

buf_len = ctypes.c_size_t()

2510

1761

# Get the fingerprint from the certificate into the buffer

2511

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2512

ctypes.byref(buf_len))

1762

(gnutls.library.functions

1763

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1764

ctypes.byref(buf_len)))

2513

1765

# Deinit the certificate

2514

gnutls.openpgp_crt_deinit(crt)

1766

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2515

1767

# Convert the buffer to a Python bytestring

2516

1768

fpr = ctypes.string_at(buf, buf_len.value)

2517

1769

# Convert the bytestring to hexadecimal notation

2519

1771

return hex_fpr

2520

1772

2521

1773

2522

class MultiprocessingMixIn:

1774

class MultiprocessingMixIn(object):

2523

1775

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2524

2525

1776

def sub_process_main(self, request, address):

2526

1777

try:

2527

1778

self.finish_request(request, address)

2528

1779

except Exception:

2529

1780

self.handle_error(request, address)

2530

1781

self.close_request(request)

2531

1782

2532

1783

def process_request(self, request, address):

2533

1784

"""Start a new process to process the request."""

2534

proc = multiprocessing.Process(target=self.sub_process_main,

2535

args=(request, address))

1785

proc = multiprocessing.Process(target = self.sub_process_main,

1786

args = (request,

1787

address))

2536

1788

proc.start()

2537

1789

return proc

2538

1790

2539

1791

2540

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1792

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2541

1793

""" adds a pipe to the MixIn """

2542

2543

1794

def process_request(self, request, client_address):

2544

1795

"""Overrides and wraps the original process_request().

2545

1796

2546

1797

This function creates a new pipe in self.pipe

2547

1798

"""

2548

1799

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2549

1800

2550

1801

proc = MultiprocessingMixIn.process_request(self, request,

2551

1802

client_address)

2552

1803

self.child_pipe.close()

2553

1804

self.add_pipe(parent_pipe, proc)

2554

1805

2555

1806

def add_pipe(self, parent_pipe, proc):

2556

1807

"""Dummy function; override as necessary"""

2557

raise NotImplementedError()

1808

raise NotImplementedError

2558

1809

2559

1810

2560

1811

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2561

socketserver.TCPServer):

1812

socketserver.TCPServer, object):

2562

1813

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2563

1814

2564

1815

Attributes:

2565

1816

enabled: Boolean; whether this server is activated yet

2566

1817

interface: None or a network interface name (string)

2567

1818

use_ipv6: Boolean; to use IPv6 or not

2568

1819

"""

2569

2570

1820

def __init__(self, server_address, RequestHandlerClass,

2571

interface=None,

2572

use_ipv6=True,

2573

socketfd=None):

2574

"""If socketfd is set, use that file descriptor instead of

2575

creating a new one with socket.socket().

2576

"""

1821

interface=None, use_ipv6=True):

2577

1822

self.interface = interface

2578

1823

if use_ipv6:

2579

1824

self.address_family = socket.AF_INET6

2580

if socketfd is not None:

2581

# Save the file descriptor

2582

self.socketfd = socketfd

2583

# Save the original socket.socket() function

2584

self.socket_socket = socket.socket

2585

2586

# To implement --socket, we monkey patch socket.socket.

2587

#

2588

# (When socketserver.TCPServer is a new-style class, we

2589

# could make self.socket into a property instead of monkey

2590

# patching socket.socket.)

2591

#

2592

# Create a one-time-only replacement for socket.socket()

2593

@functools.wraps(socket.socket)

2594

def socket_wrapper(*args, **kwargs):

2595

# Restore original function so subsequent calls are

2596

# not affected.

2597

socket.socket = self.socket_socket

2598

del self.socket_socket

2599

# This time only, return a new socket object from the

2600

# saved file descriptor.

2601

return socket.fromfd(self.socketfd, *args, **kwargs)

2602

# Replace socket.socket() function with wrapper

2603

socket.socket = socket_wrapper

2604

# The socketserver.TCPServer.__init__ will call

2605

# socket.socket(), which might be our replacement,

2606

# socket_wrapper(), if socketfd was set.

2607

1825

socketserver.TCPServer.__init__(self, server_address,

2608

1826

RequestHandlerClass)

2609

2610

1827

def server_bind(self):

2611

1828

"""This overrides the normal server_bind() function

2612

1829

to bind to an interface if one was specified, and also NOT to

2613

1830

bind to an address or port if they were not specified."""

2614

global SO_BINDTODEVICE

2615

1831

if self.interface is not None:

2616

1832

if SO_BINDTODEVICE is None:

2617

# Fall back to a hard-coded value which seems to be

2618

# common enough.

2619

logger.warning("SO_BINDTODEVICE not found, trying 25")

2620

SO_BINDTODEVICE = 25

2621

try:

2622

self.socket.setsockopt(

2623

socket.SOL_SOCKET, SO_BINDTODEVICE,

2624

(self.interface + "\0").encode("utf-8"))

2625

except socket.error as error:

2626

if error.errno == errno.EPERM:

2627

logger.error("No permission to bind to"

2628

" interface %s", self.interface)

2629

elif error.errno == errno.ENOPROTOOPT:

2630

logger.error("SO_BINDTODEVICE not available;"

2631

" cannot bind to interface %s",

2632

self.interface)

2633

elif error.errno == errno.ENODEV:

2634

logger.error("Interface %s does not exist,"

2635

" cannot bind", self.interface)

2636

else:

2637

raise

1833

logger.error("SO_BINDTODEVICE does not exist;"

1834

" cannot bind to interface %s",

1835

self.interface)

1836

else:

1837

try:

1838

self.socket.setsockopt(socket.SOL_SOCKET,

1839

SO_BINDTODEVICE,

1840

str(self.interface

1841

+ '\0'))

1842

except socket.error as error:

1843

if error[0] == errno.EPERM:

1844

logger.error("No permission to"

1845

" bind to interface %s",

1846

self.interface)

1847

elif error[0] == errno.ENOPROTOOPT:

1848

logger.error("SO_BINDTODEVICE not available;"

1849

" cannot bind to interface %s",

1850

self.interface)

1851

else:

1852

raise

2638

1853

# Only bind(2) the socket if we really need to.

2639

1854

if self.server_address[0] or self.server_address[1]:

2640

if self.server_address[1]:

2641

self.allow_reuse_address = True

2642

1855

if not self.server_address[0]:

2643

1856

if self.address_family == socket.AF_INET6:

2644

any_address = "::" # in6addr_any

1857

any_address = "::" # in6addr_any

2645

1858

else:

2646

any_address = "0.0.0.0" # INADDR_ANY

1859

any_address = socket.INADDR_ANY

2647

1860

self.server_address = (any_address,

2648

1861

self.server_address[1])

2649

1862

elif not self.server_address[1]:

2650

self.server_address = (self.server_address[0], 0)

1863

self.server_address = (self.server_address[0],

1864

0)

2651

1865

# if self.interface:

2652

1866

# self.server_address = (self.server_address[0],

2653

1867

# 0, # port

2659

1873

2660

1874

class MandosServer(IPv6_TCPServer):

2661

1875

"""Mandos server.

2662

1876

2663

1877

Attributes:

2664

1878

clients: set of Client objects

2665

1879

gnutls_priority GnuTLS priority string

2666

1880

use_dbus: Boolean; to emit D-Bus signals or not

2667

2668

Assumes a GLib.MainLoop event loop.

1881

1882

Assumes a gobject.MainLoop event loop.

2669

1883

"""

2670

2671

1884

def __init__(self, server_address, RequestHandlerClass,

2672

interface=None,

2673

use_ipv6=True,

2674

clients=None,

2675

gnutls_priority=None,

2676

use_dbus=True,

2677

socketfd=None):

1885

interface=None, use_ipv6=True, clients=None,

1886

gnutls_priority=None, use_dbus=True):

2678

1887

self.enabled = False

2679

1888

self.clients = clients

2680

1889

if self.clients is None:

2683

1892

self.gnutls_priority = gnutls_priority

2684

1893

IPv6_TCPServer.__init__(self, server_address,

2685

1894

RequestHandlerClass,

2686

interface=interface,

2687

use_ipv6=use_ipv6,

2688

socketfd=socketfd)

2689

1895

interface = interface,

1896

use_ipv6 = use_ipv6)

2690

1897

def server_activate(self):

2691

1898

if self.enabled:

2692

1899

return socketserver.TCPServer.server_activate(self)

2693

1900

2694

1901

def enable(self):

2695

1902

self.enabled = True

2696

1903

2697

1904

def add_pipe(self, parent_pipe, proc):

2698

1905

# Call "handle_ipc" for both data and EOF events

2699

GLib.io_add_watch(

2700

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2701

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2702

functools.partial(self.handle_ipc,

2703

parent_pipe=parent_pipe,

2704

proc=proc))

2705

2706

def handle_ipc(self, source, condition,

2707

parent_pipe=None,

2708

proc=None,

2709

client_object=None):

1906

gobject.io_add_watch(parent_pipe.fileno(),

1907

gobject.IO_IN | gobject.IO_HUP,

1908

functools.partial(self.handle_ipc,

1909

parent_pipe =

1910

parent_pipe,

1911

proc = proc))

1912

1913

def handle_ipc(self, source, condition, parent_pipe=None,

1914

proc = None, client_object=None):

1915

condition_names = {

1916

gobject.IO_IN: "IN", # There is data to read.

1917

gobject.IO_OUT: "OUT", # Data can be written (without

1918

# blocking).

1919

gobject.IO_PRI: "PRI", # There is urgent data to read.

1920

gobject.IO_ERR: "ERR", # Error condition.

1921

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1922

# broken, usually for pipes and

1923

# sockets).

1924

}

1925

conditions_string = ' | '.join(name

1926

for cond, name in

1927

condition_names.iteritems()

1928

if cond & condition)

2710

1929

# error, or the other end of multiprocessing.Pipe has closed

2711

if condition & (GLib.IO_ERR | GLib.IO_HUP):

1930

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2712

1931

# Wait for other process to exit

2713

1932

proc.join()

2714

1933

return False

2715

1934

2716

1935

# Read a request from the child

2717

1936

request = parent_pipe.recv()

2718

1937

command = request[0]

2719

1938

2720

1939

if command == 'init':

2721

key_id = request[1].decode("ascii")

2722

fpr = request[2].decode("ascii")

2723

address = request[3]

2724

2725

for c in self.clients.values():

2726

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2727

continue

2728

if key_id and c.key_id == key_id:

2729

client = c

2730

break

2731

if fpr and c.fingerprint == fpr:

1940

fpr = request[1]

1941

address = request[2]

1942

1943

for c in self.clients.itervalues():

1944

if c.fingerprint == fpr:

2732

1945

client = c

2733

1946

break

2734

1947

else:

2735

logger.info("Client not found for key ID: %s, address"

2736

": %s", key_id or fpr, address)

1948

logger.info("Client not found for fingerprint: %s, ad"

1949

"dress: %s", fpr, address)

2737

1950

if self.use_dbus:

2738

1951

# Emit D-Bus signal

2739

mandos_dbus_service.ClientNotFound(key_id or fpr,

1952

mandos_dbus_service.ClientNotFound(fpr,

2740

1953

address[0])

2741

1954

parent_pipe.send(False)

2742

1955

return False

2743

2744

GLib.io_add_watch(

2745

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2746

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2747

functools.partial(self.handle_ipc,

2748

parent_pipe=parent_pipe,

2749

proc=proc,

2750

client_object=client))

1956

1957

gobject.io_add_watch(parent_pipe.fileno(),

1958

gobject.IO_IN | gobject.IO_HUP,

1959

functools.partial(self.handle_ipc,

1960

parent_pipe =

1961

parent_pipe,

1962

proc = proc,

1963

client_object =

1964

client))

2751

1965

parent_pipe.send(True)

2752

1966

# remove the old hook in favor of the new above hook on

2753

1967

# same fileno

2756

1970

funcname = request[1]

2757

1971

args = request[2]

2758

1972

kwargs = request[3]

2759

1973

2760

1974

parent_pipe.send(('data', getattr(client_object,

2761

1975

funcname)(*args,

2762

**kwargs)))

2763

1976

**kwargs)))

1977

2764

1978

if command == 'getattr':

2765

1979

attrname = request[1]

2766

if isinstance(client_object.__getattribute__(attrname),

2767

collections.abc.Callable):

2768

parent_pipe.send(('function', ))

1980

if callable(client_object.__getattribute__(attrname)):

1981

parent_pipe.send(('function',))

2769

1982

else:

2770

parent_pipe.send((

2771

'data', client_object.__getattribute__(attrname)))

2772

1983

parent_pipe.send(('data', client_object

1984

.__getattribute__(attrname)))

1985

2773

1986

if command == 'setattr':

2774

1987

attrname = request[1]

2775

1988

value = request[2]

2776

1989

setattr(client_object, attrname, value)

2777

1990

2778

1991

return True

2779

1992

2780

1993

2781

def rfc3339_duration_to_delta(duration):

2782

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2783

2784

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2785

True

2786

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2787

True

2788

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2789

True

2790

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2791

True

2792

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2793

True

2794

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2795

True

2796

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2797

True

2798

"""

2799

2800

# Parsing an RFC 3339 duration with regular expressions is not

2801

# possible - there would have to be multiple places for the same

2802

# values, like seconds. The current code, while more esoteric, is

2803

# cleaner without depending on a parsing library. If Python had a

2804

# built-in library for parsing we would use it, but we'd like to

2805

# avoid excessive use of external libraries.

2806

2807

# New type for defining tokens, syntax, and semantics all-in-one

2808

Token = collections.namedtuple("Token", (

2809

"regexp", # To match token; if "value" is not None, must have

2810

# a "group" containing digits

2811

"value", # datetime.timedelta or None

2812

"followers")) # Tokens valid after this token

2813

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2814

# the "duration" ABNF definition in RFC 3339, Appendix A.

2815

token_end = Token(re.compile(r"$"), None, frozenset())

2816

token_second = Token(re.compile(r"(\d+)S"),

2817

datetime.timedelta(seconds=1),

2818

frozenset((token_end, )))

2819

token_minute = Token(re.compile(r"(\d+)M"),

2820

datetime.timedelta(minutes=1),

2821

frozenset((token_second, token_end)))

2822

token_hour = Token(re.compile(r"(\d+)H"),

2823

datetime.timedelta(hours=1),

2824

frozenset((token_minute, token_end)))

2825

token_time = Token(re.compile(r"T"),

2826

None,

2827

frozenset((token_hour, token_minute,

2828

token_second)))

2829

token_day = Token(re.compile(r"(\d+)D"),

2830

datetime.timedelta(days=1),

2831

frozenset((token_time, token_end)))

2832

token_month = Token(re.compile(r"(\d+)M"),

2833

datetime.timedelta(weeks=4),

2834

frozenset((token_day, token_end)))

2835

token_year = Token(re.compile(r"(\d+)Y"),

2836

datetime.timedelta(weeks=52),

2837

frozenset((token_month, token_end)))

2838

token_week = Token(re.compile(r"(\d+)W"),

2839

datetime.timedelta(weeks=1),

2840

frozenset((token_end, )))

2841

token_duration = Token(re.compile(r"P"), None,

2842

frozenset((token_year, token_month,

2843

token_day, token_time,

2844

token_week)))

2845

# Define starting values:

2846

# Value so far

2847

value = datetime.timedelta()

2848

found_token = None

2849

# Following valid tokens

2850

followers = frozenset((token_duration, ))

2851

# String left to parse

2852

s = duration

2853

# Loop until end token is found

2854

while found_token is not token_end:

2855

# Search for any currently valid tokens

2856

for token in followers:

2857

match = token.regexp.match(s)

2858

if match is not None:

2859

# Token found

2860

if token.value is not None:

2861

# Value found, parse digits

2862

factor = int(match.group(1), 10)

2863

# Add to value so far

2864

value += factor * token.value

2865

# Strip token from string

2866

s = token.regexp.sub("", s, 1)

2867

# Go to found token

2868

found_token = token

2869

# Set valid next tokens

2870

followers = found_token.followers

2871

break

2872

else:

2873

# No currently valid tokens were found

2874

raise ValueError("Invalid RFC 3339 duration: {!r}"

2875

.format(duration))

2876

# End token found

2877

return value

2878

2879

2880

1994

def string_to_delta(interval):

2881

1995

"""Parse a string and return a datetime.timedelta

2882

2883

>>> string_to_delta('7d') == datetime.timedelta(7)

2884

True

2885

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2886

True

2887

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2888

True

2889

>>> string_to_delta('24h') == datetime.timedelta(1)

2890

True

2891

>>> string_to_delta('1w') == datetime.timedelta(7)

2892

True

2893

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2894

True

1996

1997

>>> string_to_delta('7d')

1998

datetime.timedelta(7)

1999

>>> string_to_delta('60s')

2000

datetime.timedelta(0, 60)

2001

>>> string_to_delta('60m')

2002

datetime.timedelta(0, 3600)

2003

>>> string_to_delta('24h')

2004

datetime.timedelta(1)

2005

>>> string_to_delta('1w')

2006

datetime.timedelta(7)

2007

>>> string_to_delta('5m 30s')

2008

datetime.timedelta(0, 330)

2895

2009

"""

2896

2897

try:

2898

return rfc3339_duration_to_delta(interval)

2899

except ValueError:

2900

pass

2901

2902

2010

timevalue = datetime.timedelta(0)

2903

2011

for s in interval.split():

2904

2012

try:

2905

suffix = s[-1]

2013

suffix = unicode(s[-1])

2906

2014

value = int(s[:-1])

2907

2015

if suffix == "d":

2908

2016

delta = datetime.timedelta(value)

2915

2023

elif suffix == "w":

2916

2024

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2917

2025

else:

2918

raise ValueError("Unknown suffix {!r}".format(suffix))

2919

except IndexError as e:

2026

raise ValueError("Unknown suffix %r" % suffix)

2027

except (ValueError, IndexError) as e:

2920

2028

raise ValueError(*(e.args))

2921

2029

timevalue += delta

2922

2030

return timevalue

2923

2031

2924

2032

2925

def daemon(nochdir=False, noclose=False):

2033

def daemon(nochdir = False, noclose = False):

2926

2034

"""See daemon(3). Standard BSD Unix function.

2927

2035

2928

2036

This should really exist as os.daemon, but it doesn't (yet)."""

2929

2037

if os.fork():

2930

2038

sys.exit()

2938

2046

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2939

2047

if not stat.S_ISCHR(os.fstat(null).st_mode):

2940

2048

raise OSError(errno.ENODEV,

2941

"{} not a character device"

2942

.format(os.devnull))

2049

"%s not a character device"

2050

% os.devnull)

2943

2051

os.dup2(null, sys.stdin.fileno())

2944

2052

os.dup2(null, sys.stdout.fileno())

2945

2053

os.dup2(null, sys.stderr.fileno())

2948

2056

2949

2057

2950

2058

def main():

2951

2059

2952

2060

##################################################################

2953

2061

# Parsing of options, both command line and config file

2954

2062

2955

2063

parser = argparse.ArgumentParser()

2956

2064

parser.add_argument("-v", "--version", action="version",

2957

version="%(prog)s {}".format(version),

2065

version = "%%(prog)s %s" % version,

2958

2066

help="show version number and exit")

2959

2067

parser.add_argument("-i", "--interface", metavar="IF",

2960

2068

help="Bind to interface IF")

2966

2074

help="Run self-test")

2967

2075

parser.add_argument("--debug", action="store_true",

2968

2076

help="Debug mode; run in foreground and log"

2969

" to terminal", default=None)

2077

" to terminal")

2970

2078

parser.add_argument("--debuglevel", metavar="LEVEL",

2971

2079

help="Debug level for stdout output")

2972

2080

parser.add_argument("--priority", help="GnuTLS"

2979

2087

" files")

2980

2088

parser.add_argument("--no-dbus", action="store_false",

2981

2089

dest="use_dbus", help="Do not provide D-Bus"

2982

" system bus interface", default=None)

2090

" system bus interface")

2983

2091

parser.add_argument("--no-ipv6", action="store_false",

2984

dest="use_ipv6", help="Do not use IPv6",

2985

default=None)

2092

dest="use_ipv6", help="Do not use IPv6")

2986

2093

parser.add_argument("--no-restore", action="store_false",

2987

2094

dest="restore", help="Do not restore stored"

2988

" state", default=None)

2989

parser.add_argument("--socket", type=int,

2990

help="Specify a file descriptor to a network"

2991

" socket to use instead of creating one")

2095

" state")

2992

2096

parser.add_argument("--statedir", metavar="DIR",

2993

2097

help="Directory to save/restore state in")

2994

parser.add_argument("--foreground", action="store_true",

2995

help="Run in foreground", default=None)

2996

parser.add_argument("--no-zeroconf", action="store_false",

2997

dest="zeroconf", help="Do not use Zeroconf",

2998

default=None)

2999

2098

3000

2099

options = parser.parse_args()

3001

2100

2101

if options.check:

2102

import doctest

2103

doctest.testmod()

2104

sys.exit()

2105

3002

2106

# Default values for config file for server-global settings

3003

if gnutls.has_rawpk:

3004

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3005

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3006

else:

3007

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3008

":+SIGN-DSA-SHA256")

3009

server_defaults = {"interface": "",

3010

"address": "",

3011

"port": "",

3012

"debug": "False",

3013

"priority": priority,

3014

"servicename": "Mandos",

3015

"use_dbus": "True",

3016

"use_ipv6": "True",

3017

"debuglevel": "",

3018

"restore": "True",

3019

"socket": "",

3020

"statedir": "/var/lib/mandos",

3021

"foreground": "False",

3022

"zeroconf": "True",

3023

}

3024

del priority

3025

2107

server_defaults = { "interface": "",

2108

"address": "",

2109

"port": "",

2110

"debug": "False",

2111

"priority":

2112

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2113

"servicename": "Mandos",

2114

"use_dbus": "True",

2115

"use_ipv6": "True",

2116

"debuglevel": "",

2117

"restore": "True",

2118

"statedir": "/var/lib/mandos"

2119

}

2120

3026

2121

# Parse config file for server-global settings

3027

server_config = configparser.ConfigParser(server_defaults)

2122

server_config = configparser.SafeConfigParser(server_defaults)

3028

2123

del server_defaults

3029

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3030

# Convert the ConfigParser object to a dict

2124

server_config.read(os.path.join(options.configdir,

2125

"mandos.conf"))

2126

# Convert the SafeConfigParser object to a dict

3031

2127

server_settings = server_config.defaults()

3032

2128

# Use the appropriate methods on the non-string config options

3033

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3034

"foreground", "zeroconf"):

2129

for option in ("debug", "use_dbus", "use_ipv6"):

3035

2130

server_settings[option] = server_config.getboolean("DEFAULT",

3036

2131

option)

3037

2132

if server_settings["port"]:

3038

2133

server_settings["port"] = server_config.getint("DEFAULT",

3039

2134

"port")

3040

if server_settings["socket"]:

3041

server_settings["socket"] = server_config.getint("DEFAULT",

3042

"socket")

3043

# Later, stdin will, and stdout and stderr might, be dup'ed

3044

# over with an opened os.devnull. But we don't want this to

3045

# happen with a supplied network socket.

3046

if 0 <= server_settings["socket"] <= 2:

3047

server_settings["socket"] = os.dup(server_settings

3048

["socket"])

3049

2135

del server_config

3050

2136

3051

2137

# Override the settings from the config file with command line

3052

2138

# options, if set.

3053

2139

for option in ("interface", "address", "port", "debug",

3054

"priority", "servicename", "configdir", "use_dbus",

3055

"use_ipv6", "debuglevel", "restore", "statedir",

3056

"socket", "foreground", "zeroconf"):

2140

"priority", "servicename", "configdir",

2141

"use_dbus", "use_ipv6", "debuglevel", "restore",

2142

"statedir"):

3057

2143

value = getattr(options, option)

3058

2144

if value is not None:

3059

2145

server_settings[option] = value

3060

2146

del options

3061

2147

# Force all strings to be unicode

3062

2148

for option in server_settings.keys():

3063

if isinstance(server_settings[option], bytes):

3064

server_settings[option] = (server_settings[option]

3065

.decode("utf-8"))

3066

# Force all boolean options to be boolean

3067

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3068

"foreground", "zeroconf"):

3069

server_settings[option] = bool(server_settings[option])

3070

# Debug implies foreground

3071

if server_settings["debug"]:

3072

server_settings["foreground"] = True

2149

if type(server_settings[option]) is str:

2150

server_settings[option] = unicode(server_settings[option])

3073

2151

# Now we have our good server settings in "server_settings"

3074

2152

3075

2153

##################################################################

3076

3077

if (not server_settings["zeroconf"]

3078

and not (server_settings["port"]

3079

or server_settings["socket"] != "")):

3080

parser.error("Needs port or socket to work without Zeroconf")

3081

2154

3082

2155

# For convenience

3083

2156

debug = server_settings["debug"]

3084

2157

debuglevel = server_settings["debuglevel"]

3086

2159

use_ipv6 = server_settings["use_ipv6"]

3087

2160

stored_state_path = os.path.join(server_settings["statedir"],

3088

2161

stored_state_file)

3089

foreground = server_settings["foreground"]

3090

zeroconf = server_settings["zeroconf"]

3091

2162

3092

2163

if debug:

3093

2164

initlogger(debug, logging.DEBUG)

3094

2165

else:

3097

2168

else:

3098

2169

level = getattr(logging, debuglevel.upper())

3099

2170

initlogger(debug, level)

3100

2171

3101

2172

if server_settings["servicename"] != "Mandos":

3102

syslogger.setFormatter(

3103

logging.Formatter('Mandos ({}) [%(process)d]:'

3104

' %(levelname)s: %(message)s'.format(

3105

server_settings["servicename"])))

3106

2173

syslogger.setFormatter(logging.Formatter

2174

('Mandos (%s) [%%(process)d]:'

2175

' %%(levelname)s: %%(message)s'

2176

% server_settings["servicename"]))

2177

3107

2178

# Parse config file with clients

3108

client_config = configparser.ConfigParser(Client.client_defaults)

2179

client_config = configparser.SafeConfigParser(Client

2180

.client_defaults)

3109

2181

client_config.read(os.path.join(server_settings["configdir"],

3110

2182

"clients.conf"))

3111

2183

3112

2184

global mandos_dbus_service

3113

2185

mandos_dbus_service = None

3114

3115

socketfd = None

3116

if server_settings["socket"] != "":

3117

socketfd = server_settings["socket"]

3118

tcp_server = MandosServer(

3119

(server_settings["address"], server_settings["port"]),

3120

ClientHandler,

3121

interface=(server_settings["interface"] or None),

3122

use_ipv6=use_ipv6,

3123

gnutls_priority=server_settings["priority"],

3124

use_dbus=use_dbus,

3125

socketfd=socketfd)

3126

if not foreground:

3127

pidfilename = "/run/mandos.pid"

3128

if not os.path.isdir("/run/."):

3129

pidfilename = "/var/run/mandos.pid"

3130

pidfile = None

3131

try:

3132

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3133

except IOError as e:

3134

logger.error("Could not open file %r", pidfilename,

3135

exc_info=e)

3136

3137

for name, group in (("_mandos", "_mandos"),

3138

("mandos", "mandos"),

3139

("nobody", "nogroup")):

3140

try:

3141

uid = pwd.getpwnam(name).pw_uid

3142

gid = pwd.getpwnam(group).pw_gid

3143

break

2186

2187

tcp_server = MandosServer((server_settings["address"],

2188

server_settings["port"]),

2189

ClientHandler,

2190

interface=(server_settings["interface"]

2191

or None),

2192

use_ipv6=use_ipv6,

2193

gnutls_priority=

2194

server_settings["priority"],

2195

use_dbus=use_dbus)

2196

if not debug:

2197

pidfilename = "/var/run/mandos.pid"

2198

try:

2199

pidfile = open(pidfilename, "w")

2200

except IOError:

2201

logger.error("Could not open file %r", pidfilename)

2202

2203

try:

2204

uid = pwd.getpwnam("_mandos").pw_uid

2205

gid = pwd.getpwnam("_mandos").pw_gid

2206

except KeyError:

2207

try:

2208

uid = pwd.getpwnam("mandos").pw_uid

2209

gid = pwd.getpwnam("mandos").pw_gid

3144

2210

except KeyError:

3145

continue

3146

else:

3147

uid = 65534

3148

gid = 65534

2211

try:

2212

uid = pwd.getpwnam("nobody").pw_uid

2213

gid = pwd.getpwnam("nobody").pw_gid

2214

except KeyError:

2215

uid = 65534

2216

gid = 65534

3149

2217

try:

3150

2218

os.setgid(gid)

3151

2219

os.setuid(uid)

3152

if debug:

3153

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3154

gid))

3155

2220

except OSError as error:

3156

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3157

.format(uid, gid, os.strerror(error.errno)))

3158

if error.errno != errno.EPERM:

3159

raise

3160

2221

if error[0] != errno.EPERM:

2222

raise error

2223

3161

2224

if debug:

3162

2225

# Enable all possible GnuTLS debugging

3163

2226

3164

2227

# "Use a log level over 10 to enable all debugging options."

3165

2228

# - GnuTLS manual

3166

gnutls.global_set_log_level(11)

3167

3168

@gnutls.log_func

2229

gnutls.library.functions.gnutls_global_set_log_level(11)

2230

2231

@gnutls.library.types.gnutls_log_func

3169

2232

def debug_gnutls(level, string):

3170

2233

logger.debug("GnuTLS: %s", string[:-1])

3171

3172

gnutls.global_set_log_function(debug_gnutls)

3173

2234

2235

(gnutls.library.functions

2236

.gnutls_global_set_log_function(debug_gnutls))

2237

3174

2238

# Redirect stdin so all checkers get /dev/null

3175

2239

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3176

2240

os.dup2(null, sys.stdin.fileno())

3177

2241

if null > 2:

3178

2242

os.close(null)

3179

2243

3180

2244

# Need to fork before connecting to D-Bus

3181

if not foreground:

2245

if not debug:

3182

2246

# Close all input and output, do double fork, etc.

3183

2247

daemon()

3184

3185

if gi.version_info < (3, 10, 2):

3186

# multiprocessing will use threads, so before we use GLib we

3187

# need to inform GLib that threads will be used.

3188

GLib.threads_init()

3189

2248

2249

gobject.threads_init()

2250

3190

2251

global main_loop

3191

2252

# From the Avahi example code

3192

2253

DBusGMainLoop(set_as_default=True)

3193

main_loop = GLib.MainLoop()

2254

main_loop = gobject.MainLoop()

3194

2255

bus = dbus.SystemBus()

3195

2256

# End of Avahi example code

3196

2257

if use_dbus:

3197

2258

try:

3198

2259

bus_name = dbus.service.BusName("se.recompile.Mandos",

3199

bus,

3200

do_not_queue=True)

3201

old_bus_name = dbus.service.BusName(

3202

"se.bsnet.fukt.Mandos", bus,

3203

do_not_queue=True)

3204

except dbus.exceptions.DBusException as e:

3205

logger.error("Disabling D-Bus:", exc_info=e)

2260

bus, do_not_queue=True)

2261

old_bus_name = (dbus.service.BusName

2262

("se.bsnet.fukt.Mandos", bus,

2263

do_not_queue=True))

2264

except dbus.exceptions.NameExistsException as e:

2265

logger.error(unicode(e) + ", disabling D-Bus")

3206

2266

use_dbus = False

3207

2267

server_settings["use_dbus"] = False

3208

2268

tcp_server.use_dbus = False

3209

if zeroconf:

3210

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3211

service = AvahiServiceToSyslog(

3212

name=server_settings["servicename"],

3213

servicetype="_mandos._tcp",

3214

protocol=protocol,

3215

bus=bus)

3216

if server_settings["interface"]:

3217

service.interface = if_nametoindex(

3218

server_settings["interface"].encode("utf-8"))

3219

2269

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2270

service = AvahiServiceToSyslog(name =

2271

server_settings["servicename"],

2272

servicetype = "_mandos._tcp",

2273

protocol = protocol, bus = bus)

2274

if server_settings["interface"]:

2275

service.interface = (if_nametoindex

2276

(str(server_settings["interface"])))

2277

3220

2278

global multiprocessing_manager

3221

2279

multiprocessing_manager = multiprocessing.Manager()

3222

2280

3223

2281

client_class = Client

3224

2282

if use_dbus:

3225

client_class = functools.partial(ClientDBus, bus=bus)

3226

2283

client_class = functools.partial(ClientDBusTransitional,

2284

bus = bus)

2285

3227

2286

client_settings = Client.config_parser(client_config)

3228

2287

old_client_settings = {}

3229

2288

clients_data = {}

3230

3231

# This is used to redirect stdout and stderr for checker processes

3232

global wnull

3233

wnull = open(os.devnull, "w") # A writable /dev/null

3234

# Only used if server is running in foreground but not in debug

3235

# mode

3236

if debug or not foreground:

3237

wnull.close()

3238

2289

3239

2290

# Get client data and settings from last running state.

3240

2291

if server_settings["restore"]:

3241

2292

try:

3242

2293

with open(stored_state_path, "rb") as stored_state:

3243

if sys.version_info.major == 2:

3244

clients_data, old_client_settings = pickle.load(

3245

stored_state)

3246

else:

3247

bytes_clients_data, bytes_old_client_settings = (

3248

pickle.load(stored_state, encoding="bytes"))

3249

# Fix bytes to strings

3250

# clients_data

3251

# .keys()

3252

clients_data = {(key.decode("utf-8")

3253

if isinstance(key, bytes)

3254

else key): value

3255

for key, value in

3256

bytes_clients_data.items()}

3257

del bytes_clients_data

3258

for key in clients_data:

3259

value = {(k.decode("utf-8")

3260

if isinstance(k, bytes) else k): v

3261

for k, v in

3262

clients_data[key].items()}

3263

clients_data[key] = value

3264

# .client_structure

3265

value["client_structure"] = [

3266

(s.decode("utf-8")

3267

if isinstance(s, bytes)

3268

else s) for s in

3269

value["client_structure"]]

3270

# .name, .host, and .checker_command

3271

for k in ("name", "host", "checker_command"):

3272

if isinstance(value[k], bytes):

3273

value[k] = value[k].decode("utf-8")

3274

if "key_id" not in value:

3275

value["key_id"] = ""

3276

elif "fingerprint" not in value:

3277

value["fingerprint"] = ""

3278

# old_client_settings

3279

# .keys()

3280

old_client_settings = {

3281

(key.decode("utf-8")

3282

if isinstance(key, bytes)

3283

else key): value

3284

for key, value in

3285

bytes_old_client_settings.items()}

3286

del bytes_old_client_settings

3287

# .host and .checker_command

3288

for value in old_client_settings.values():

3289

for attribute in ("host", "checker_command"):

3290

if isinstance(value[attribute], bytes):

3291

value[attribute] = (value[attribute]

3292

.decode("utf-8"))

2294

clients_data, old_client_settings = (pickle.load

2295

(stored_state))

3293

2296

os.remove(stored_state_path)

3294

2297

except IOError as e:

3295

if e.errno == errno.ENOENT:

3296

logger.warning("Could not load persistent state:"

3297

" {}".format(os.strerror(e.errno)))

3298

else:

3299

logger.critical("Could not load persistent state:",

3300

exc_info=e)

2298

logger.warning("Could not load persistent state: {0}"

2299

.format(e))

2300

if e.errno != errno.ENOENT:

3301

2301

raise

3302

2302

except EOFError as e:

3303

2303

logger.warning("Could not load persistent state: "

3304

"EOFError:",

3305

exc_info=e)

3306

2304

"EOFError: {0}".format(e))

2305

3307

2306

with PGPEngine() as pgp:

3308

for client_name, client in clients_data.items():

3309

# Skip removed clients

3310

if client_name not in client_settings:

3311

continue

3312

2307

for client_name, client in clients_data.iteritems():

3313

2308

# Decide which value to use after restoring saved state.

3314

2309

# We have three different values: Old config file,

3315

2310

# new config file, and saved state.

3320

2315

# For each value in new config, check if it

3321

2316

# differs from the old config value (Except for

3322

2317

# the "secret" attribute)

3323

if (name != "secret"

3324

and (value !=

3325

old_client_settings[client_name][name])):

2318

if (name != "secret" and

2319

value != old_client_settings[client_name]

2320

[name]):

3326

2321

client[name] = value

3327

2322

except KeyError:

3328

2323

pass

3329

2324

3330

2325

# Clients who has passed its expire date can still be

3331

# enabled if its last checker was successful. A Client

2326

# enabled if its last checker was successful. Clients

3332

2327

# whose checker succeeded before we stored its state is

3333

2328

# assumed to have successfully run all checkers during

3334

2329

# downtime.

3336

2331

if datetime.datetime.utcnow() >= client["expires"]:

3337

2332

if not client["last_checked_ok"]:

3338

2333

logger.warning(

3339

"disabling client {} - Client never "

3340

"performed a successful checker".format(

3341

client_name))

2334

"disabling client {0} - Client never "

2335

"performed a successful checker"

2336

.format(client_name))

3342

2337

client["enabled"] = False

3343

2338

elif client["last_checker_status"] != 0:

3344

2339

logger.warning(

3345

"disabling client {} - Client last"

3346

" checker failed with error code"

3347

" {}".format(

3348

client_name,

3349

client["last_checker_status"]))

2340

"disabling client {0} - Client "

2341

"last checker failed with error code {1}"

2342

.format(client_name,

2343

client["last_checker_status"]))

3350

2344

client["enabled"] = False

3351

2345

else:

3352

client["expires"] = (

3353

datetime.datetime.utcnow()

3354

+ client["timeout"])

2346

client["expires"] = (datetime.datetime

2347

.utcnow()

2348

+ client["timeout"])

3355

2349

logger.debug("Last checker succeeded,"

3356

" keeping {} enabled".format(

3357

client_name))

2350

" keeping {0} enabled"

2351

.format(client_name))

3358

2352

try:

3359

client["secret"] = pgp.decrypt(

3360

client["encrypted_secret"],

3361

client_settings[client_name]["secret"])

2353

client["secret"] = (

2354

pgp.decrypt(client["encrypted_secret"],

2355

client_settings[client_name]

2356

["secret"]))

3362

2357

except PGPError:

3363

2358

# If decryption fails, we use secret from new settings

3364

logger.debug("Failed to decrypt {} old secret".format(

3365

client_name))

3366

client["secret"] = (client_settings[client_name]

3367

["secret"])

2359

logger.debug("Failed to decrypt {0} old secret"

2360

.format(client_name))

2361

client["secret"] = (

2362

client_settings[client_name]["secret"])

3368

2363

2364

3369

2365

# Add/remove clients based on new changes made to config

3370

2366

for client_name in (set(old_client_settings)

3371

2367

- set(client_settings)):

3375

2371

clients_data[client_name] = client_settings[client_name]

3376

2372

3377

2373

# Create all client objects

3378

for client_name, client in clients_data.items():

2374

for client_name, client in clients_data.iteritems():

3379

2375

tcp_server.clients[client_name] = client_class(

3380

name=client_name,

3381

settings=client,

3382

server_settings=server_settings)

3383

2376

name = client_name, settings = client)

2377

3384

2378

if not tcp_server.clients:

3385

2379

logger.warning("No clients defined")

3386

3387

if not foreground:

3388

if pidfile is not None:

3389

pid = os.getpid()

3390

try:

3391

with pidfile:

3392

print(pid, file=pidfile)

3393

except IOError:

3394

logger.error("Could not write to file %r with PID %d",

3395

pidfilename, pid)

3396

del pidfile

2380

2381

if not debug:

2382

try:

2383

with pidfile:

2384

pid = os.getpid()

2385

pidfile.write(str(pid) + "\n".encode("utf-8"))

2386

del pidfile

2387

except IOError:

2388

logger.error("Could not write to file %r with PID %d",

2389

pidfilename, pid)

2390

except NameError:

2391

# "pidfile" was never created

2392

pass

3397

2393

del pidfilename

3398

3399

for termsig in (signal.SIGHUP, signal.SIGTERM):

3400

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3401

lambda: main_loop.quit() and False)

3402

2394

signal.signal(signal.SIGINT, signal.SIG_IGN)

2395

2396

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2397

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2398

3403

2399

if use_dbus:

3404

3405

@alternate_dbus_interfaces(

3406

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3407

class MandosDBusService(DBusObjectWithObjectManager):

2400

class MandosDBusService(DBusObjectWithProperties):

3408

2401

"""A D-Bus proxy object"""

3409

3410

2402

def __init__(self):

3411

2403

dbus.service.Object.__init__(self, bus, "/")

3412

3413

2404

_interface = "se.recompile.Mandos"

3414

2405

2406

@dbus_interface_annotations(_interface)

2407

def _foo(self):

2408

return { "org.freedesktop.DBus.Property"

2409

".EmitsChangedSignal":

2410

"false"}

2411

3415

2412

@dbus.service.signal(_interface, signature="o")

3416

2413

def ClientAdded(self, objpath):

3417

2414

"D-Bus signal"

3418

2415

pass

3419

2416

3420

2417

@dbus.service.signal(_interface, signature="ss")

3421

def ClientNotFound(self, key_id, address):

2418

def ClientNotFound(self, fingerprint, address):

3422

2419

"D-Bus signal"

3423

2420

pass

3424

3425

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3426

"true"})

2421

3427

2422

@dbus.service.signal(_interface, signature="os")

3428

2423

def ClientRemoved(self, objpath, name):

3429

2424

"D-Bus signal"

3430

2425

pass

3431

3432

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3433

"true"})

2426

3434

2427

@dbus.service.method(_interface, out_signature="ao")

3435

2428

def GetAllClients(self):

3436

2429

"D-Bus method"

3437

return dbus.Array(c.dbus_object_path for c in

3438

tcp_server.clients.values())

3439

3440

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3441

"true"})

2430

return dbus.Array(c.dbus_object_path

2431

for c in

2432

tcp_server.clients.itervalues())

2433

3442

2434

@dbus.service.method(_interface,

3443

2435

out_signature="a{oa{sv}}")

3444

2436

def GetAllClientsWithProperties(self):

3445

2437

"D-Bus method"

3446

2438

return dbus.Dictionary(

3447

{c.dbus_object_path: c.GetAll(

3448

"se.recompile.Mandos.Client")

3449

for c in tcp_server.clients.values()},

2439

((c.dbus_object_path, c.GetAll(""))

2440

for c in tcp_server.clients.itervalues()),

3450

2441

signature="oa{sv}")

3451

2442

3452

2443

@dbus.service.method(_interface, in_signature="o")

3453

2444

def RemoveClient(self, object_path):

3454

2445

"D-Bus method"

3455

for c in tcp_server.clients.values():

2446

for c in tcp_server.clients.itervalues():

3456

2447

if c.dbus_object_path == object_path:

3457

2448

del tcp_server.clients[c.name]

3458

2449

c.remove_from_connection()

3459

# Don't signal the disabling

2450

# Don't signal anything except ClientRemoved

3460

2451

c.disable(quiet=True)

3461

# Emit D-Bus signal for removal

3462

self.client_removed_signal(c)

2452

# Emit D-Bus signal

2453

self.ClientRemoved(object_path, c.name)

3463

2454

return

3464

2455

raise KeyError(object_path)

3465

2456

3466

2457

del _interface

3467

3468

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3469

out_signature="a{oa{sa{sv}}}")

3470

def GetManagedObjects(self):

3471

"""D-Bus method"""

3472

return dbus.Dictionary(

3473

{client.dbus_object_path:

3474

dbus.Dictionary(

3475

{interface: client.GetAll(interface)

3476

for interface in

3477

client._get_all_interface_names()})

3478

for client in tcp_server.clients.values()})

3479

3480

def client_added_signal(self, client):

3481

"""Send the new standard signal and the old signal"""

3482

if use_dbus:

3483

# New standard signal

3484

self.InterfacesAdded(

3485

client.dbus_object_path,

3486

dbus.Dictionary(

3487

{interface: client.GetAll(interface)

3488

for interface in

3489

client._get_all_interface_names()}))

3490

# Old signal

3491

self.ClientAdded(client.dbus_object_path)

3492

3493

def client_removed_signal(self, client):

3494

"""Send the new standard signal and the old signal"""

3495

if use_dbus:

3496

# New standard signal

3497

self.InterfacesRemoved(

3498

client.dbus_object_path,

3499

client._get_all_interface_names())

3500

# Old signal

3501

self.ClientRemoved(client.dbus_object_path,

3502

client.name)

3503

3504

mandos_dbus_service = MandosDBusService()

3505

3506

# Save modules to variables to exempt the modules from being

3507

# unloaded before the function registered with atexit() is run.

3508

mp = multiprocessing

3509

wn = wnull

3510

2458

2459

class MandosDBusServiceTransitional(MandosDBusService):

2460

__metaclass__ = AlternateDBusNamesMetaclass

2461

mandos_dbus_service = MandosDBusServiceTransitional()

2462

3511

2463

def cleanup():

3512

2464

"Cleanup function; run on exit"

3513

if zeroconf:

3514

service.cleanup()

3515

3516

mp.active_children()

3517

wn.close()

2465

service.cleanup()

2466

2467

multiprocessing.active_children()

3518

2468

if not (tcp_server.clients or client_settings):

3519

2469

return

3520

2470

3521

2471

# Store client before exiting. Secrets are encrypted with key

3522

2472

# based on what config file has. If config file is

3523

2473

# removed/edited, old secret will thus be unrecovable.

3524

2474

clients = {}

3525

2475

with PGPEngine() as pgp:

3526

for client in tcp_server.clients.values():

2476

for client in tcp_server.clients.itervalues():

3527

2477

key = client_settings[client.name]["secret"]

3528

2478

client.encrypted_secret = pgp.encrypt(client.secret,

3529

2479

key)

3530

2480

client_dict = {}

3531

2481

3532

2482

# A list of attributes that can not be pickled

3533

2483

# + secret.

3534

exclude = {"bus", "changedstate", "secret",

3535

"checker", "server_settings"}

3536

for name, typ in inspect.getmembers(dbus.service

3537

.Object):

2484

exclude = set(("bus", "changedstate", "secret",

2485

"checker"))

2486

for name, typ in (inspect.getmembers

2487

(dbus.service.Object)):

3538

2488

exclude.add(name)

3539

2489

3540

2490

client_dict["encrypted_secret"] = (client

3541

2491

.encrypted_secret)

3542

2492

for attr in client.client_structure:

3543

2493

if attr not in exclude:

3544

2494

client_dict[attr] = getattr(client, attr)

3545

2495

3546

2496

clients[client.name] = client_dict

3547

2497

del client_settings[client.name]["secret"]

3548

2498

3549

2499

try:

3550

with tempfile.NamedTemporaryFile(

3551

mode='wb',

3552

suffix=".pickle",

3553

prefix='clients-',

3554

dir=os.path.dirname(stored_state_path),

3555

delete=False) as stored_state:

3556

pickle.dump((clients, client_settings), stored_state,

3557

protocol=2)

3558

tempname = stored_state.name

2500

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2501

prefix="clients-",

2502

dir=os.path.dirname

2503

(stored_state_path))

2504

with os.fdopen(tempfd, "wb") as stored_state:

2505

pickle.dump((clients, client_settings), stored_state)

3559

2506

os.rename(tempname, stored_state_path)

3560

2507

except (IOError, OSError) as e:

2508

logger.warning("Could not save persistent state: {0}"

2509

.format(e))

3561

2510

if not debug:

3562

2511

try:

3563

2512

os.remove(tempname)

3564

2513

except NameError:

3565

2514

pass

3566

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3567

logger.warning("Could not save persistent state: {}"

3568

.format(os.strerror(e.errno)))

3569

else:

3570

logger.warning("Could not save persistent state:",

3571

exc_info=e)

3572

raise

3573

2515

if e.errno not in set((errno.ENOENT, errno.EACCES,

2516

errno.EEXIST)):

2517

raise e

2518

3574

2519

# Delete all clients, and settings from config

3575

2520

while tcp_server.clients:

3576

2521

name, client = tcp_server.clients.popitem()

3577

2522

if use_dbus:

3578

2523

client.remove_from_connection()

3579

# Don't signal the disabling

2524

# Don't signal anything except ClientRemoved

3580

2525

client.disable(quiet=True)

3581

# Emit D-Bus signal for removal

3582

2526

if use_dbus:

3583

mandos_dbus_service.client_removed_signal(client)

2527

# Emit D-Bus signal

2528

mandos_dbus_service.ClientRemoved(client

2529

.dbus_object_path,

2530

client.name)

3584

2531

client_settings.clear()

3585

2532

3586

2533

atexit.register(cleanup)

3587

3588

for client in tcp_server.clients.values():

2534

2535

for client in tcp_server.clients.itervalues():

3589

2536

if use_dbus:

3590

# Emit D-Bus signal for adding

3591

mandos_dbus_service.client_added_signal(client)

2537

# Emit D-Bus signal

2538

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3592

2539

# Need to initiate checking of clients

3593

2540

if client.enabled:

3594

2541

client.init_checker()

3595

2542

3596

2543

tcp_server.enable()

3597

2544

tcp_server.server_activate()

3598

2545

3599

2546

# Find out what port we got

3600

if zeroconf:

3601

service.port = tcp_server.socket.getsockname()[1]

2547

service.port = tcp_server.socket.getsockname()[1]

3602

2548

if use_ipv6:

3603

2549

logger.info("Now listening on address %r, port %d,"

3604

" flowinfo %d, scope_id %d",

3605

*tcp_server.socket.getsockname())

2550

" flowinfo %d, scope_id %d"

2551

% tcp_server.socket.getsockname())

3606

2552

else: # IPv4

3607

logger.info("Now listening on address %r, port %d",

3608

*tcp_server.socket.getsockname())

3609

3610

# service.interface = tcp_server.socket.getsockname()[3]

3611

2553

logger.info("Now listening on address %r, port %d"

2554

% tcp_server.socket.getsockname())

2555

2556

#service.interface = tcp_server.socket.getsockname()[3]

2557

3612

2558

try:

3613

if zeroconf:

3614

# From the Avahi example code

3615

try:

3616

service.activate()

3617

except dbus.exceptions.DBusException as error:

3618

logger.critical("D-Bus Exception", exc_info=error)

3619

cleanup()

3620

sys.exit(1)

3621

# End of Avahi example code

3622

3623

GLib.io_add_watch(

3624

GLib.IOChannel.unix_new(tcp_server.fileno()),

3625

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3626

lambda *args, **kwargs: (tcp_server.handle_request

3627

(*args[2:], **kwargs) or True))

3628

2559

# From the Avahi example code

2560

try:

2561

service.activate()

2562

except dbus.exceptions.DBusException as error:

2563

logger.critical("DBusException: %s", error)

2564

cleanup()

2565

sys.exit(1)

2566

# End of Avahi example code

2567

2568

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2569

lambda *args, **kwargs:

2570

(tcp_server.handle_request

2571

(*args[2:], **kwargs) or True))

2572

3629

2573

logger.debug("Starting main loop")

3630

2574

main_loop.run()

3631

2575

except AvahiError as error:

3632

logger.critical("Avahi Error", exc_info=error)

2576

logger.critical("AvahiError: %s", error)

3633

2577

cleanup()

3634

2578

sys.exit(1)

3635

2579

except KeyboardInterrupt:

3640

2584

# Must run before the D-Bus bus name gets deregistered

3641

2585

cleanup()

3642

2586

3643

3644

def should_only_run_tests():

3645

parser = argparse.ArgumentParser(add_help=False)

3646

parser.add_argument("--check", action='store_true')

3647

args, unknown_args = parser.parse_known_args()

3648

run_tests = args.check

3649

if run_tests:

3650

# Remove --check argument from sys.argv

3651

sys.argv[1:] = unknown_args

3652

return run_tests

3653

3654

# Add all tests from doctest strings

3655

def load_tests(loader, tests, none):

3656

import doctest

3657

tests.addTests(doctest.DocTestSuite())

3658

return tests

3659

3660

2587

if __name__ == '__main__':

3661

try:

3662

if should_only_run_tests():

3663

# Call using ./mandos --check [--verbose]

3664

unittest.main()

3665

else:

3666

main()

3667

finally:

3668

logging.shutdown()

2588

main()