/mandos/trunk : revision 576

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

19

# the Free Software Foundation, either version 3 of the License, or

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

# GNU General Public License for more details.

26

#

26

#

27

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

#

31

# Contact the authors at <mandos@recompile.se>.

32

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

41

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

37

import SocketServer as socketserver

46

38

import socket

47

39

import argparse

48

40

import datetime

49

41

import errno

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

54

49

import sys

55

50

import re

56

51

import os

65

60

import struct

66

61

import fcntl

67

62

import functools

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

63

import cPickle as pickle

72

64

import multiprocessing

73

65

import types

74

66

import binascii

75

67

import tempfile

76

68

import itertools

77

import collections

78

import codecs

79

69

80

70

import dbus

81

71

import dbus.service

82

from gi.repository import GLib

72

import gobject

73

import avahi

83

74

from dbus.mainloop.glib import DBusGMainLoop

84

75

import ctypes

85

76

import ctypes.util

86

77

import xml.dom.minidom

87

78

import inspect

79

import GnuPGInterface

88

80

89

# Try to find the value of SO_BINDTODEVICE:

90

81

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

93

82

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

94

83

except AttributeError:

95

84

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

98

85

from IN import SO_BINDTODEVICE

99

86

except ImportError:

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

113

114

if sys.version_info.major == 2:

115

str = unicode

116

117

version = "1.7.14"

87

SO_BINDTODEVICE = None

88

89

version = "1.5.3"

118

90

stored_state_file = "clients.pickle"

119

91

120

92

logger = logging.getLogger()

121

syslogger = None

93

syslogger = (logging.handlers.SysLogHandler

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

address = str("/dev/log")))

122

96

123

97

try:

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

126

101

except (OSError, AttributeError):

127

128

102

def if_nametoindex(interface):

129

103

"Get an interface index the hard way, i.e. using fcntl()"

130

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

131

105

with contextlib.closing(socket.socket()) as s:

132

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

133

struct.pack(b"16s16x", interface))

134

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

135

111

return interface_index

136

112

137

113

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

154

114

def initlogger(debug, level=logging.WARNING):

155

115

"""init logger and add loglevel"""

156

157

global syslogger

158

syslogger = (logging.handlers.SysLogHandler(

159

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

160

address="/dev/log"))

116

161

117

syslogger.setFormatter(logging.Formatter

162

118

('Mandos [%(process)d]: %(levelname)s:'

163

119

' %(message)s'))

164

120

logger.addHandler(syslogger)

165

121

166

122

if debug:

167

123

console = logging.StreamHandler()

168

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

180

136

181

137

class PGPEngine(object):

182

138

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

184

139

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

185

141

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

199

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

204

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

148

205

149

def __enter__(self):

206

150

return self

207

208

def __exit__(self, exc_type, exc_value, traceback):

151

152

def __exit__ (self, exc_type, exc_value, traceback):

209

153

self._cleanup()

210

154

return False

211

155

212

156

def __del__(self):

213

157

self._cleanup()

214

158

215

159

def _cleanup(self):

216

160

if self.tempdir is not None:

217

161

# Delete contents of tempdir

218

162

for root, dirs, files in os.walk(self.tempdir,

219

topdown=False):

163

topdown = False):

220

164

for filename in files:

221

165

os.remove(os.path.join(root, filename))

222

166

for dirname in dirs:

224

168

# Remove tempdir

225

169

os.rmdir(self.tempdir)

226

170

self.tempdir = None

227

171

228

172

def password_encode(self, password):

229

173

# Passphrase can not be empty and can not contain newlines or

230

174

# NUL bytes. So we prefix it and hex encode it.

231

encoded = b"mandos" + binascii.hexlify(password)

232

if len(encoded) > 2048:

233

# GnuPG can't handle long passwords, so encode differently

234

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

235

.replace(b"\n", b"\\n")

236

.replace(b"\0", b"\\x00"))

237

return encoded

238

175

return b"mandos" + binascii.hexlify(password)

176

239

177

def encrypt(self, data, password):

240

passphrase = self.password_encode(password)

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

243

passfile.write(passphrase)

244

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

246

'--passphrase-file',

247

passfile.name]

248

+ self.gnupgargs,

249

stdin=subprocess.PIPE,

250

stdout=subprocess.PIPE,

251

stderr=subprocess.PIPE)

252

ciphertext, err = proc.communicate(input=data)

253

if proc.returncode != 0:

254

raise PGPError(err)

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

255

192

return ciphertext

256

193

257

194

def decrypt(self, data, password):

258

passphrase = self.password_encode(password)

259

with tempfile.NamedTemporaryFile(

260

dir=self.tempdir) as passfile:

261

passfile.write(passphrase)

262

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

264

'--passphrase-file',

265

passfile.name]

266

+ self.gnupgargs,

267

stdin=subprocess.PIPE,

268

stdout=subprocess.PIPE,

269

stderr=subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input=data)

271

if proc.returncode != 0:

272

raise PGPError(err)

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

273

209

return decrypted_plaintext

274

210

275

211

276

# Pretend that we have an Avahi module

277

class Avahi(object):

278

"""This isn't so much a class as it is a module-like namespace.

279

It is instantiated once, and simulates having an Avahi module."""

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

284

DBUS_NAME = "org.freedesktop.Avahi"

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

287

DBUS_PATH_SERVER = "/"

288

289

def string_array_to_txt_array(self, t):

290

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

291

for s in t), signature="ay")

292

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

293

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

294

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

295

SERVER_INVALID = 0 # avahi-common/defs.h

296

SERVER_REGISTERING = 1 # avahi-common/defs.h

297

SERVER_RUNNING = 2 # avahi-common/defs.h

298

SERVER_COLLISION = 3 # avahi-common/defs.h

299

SERVER_FAILURE = 4 # avahi-common/defs.h

300

avahi = Avahi()

301

302

303

212

class AvahiError(Exception):

304

213

def __init__(self, value, *args, **kwargs):

305

214

self.value = value

306

return super(AvahiError, self).__init__(value, *args,

307

**kwargs)

308

215

super(AvahiError, self).__init__(value, *args, **kwargs)

216

def __unicode__(self):

217

return unicode(repr(self.value))

309

218

310

219

class AvahiServiceError(AvahiError):

311

220

pass

312

221

313

314

222

class AvahiGroupError(AvahiError):

315

223

pass

316

224

317

225

318

226

class AvahiService(object):

319

227

"""An Avahi (Zeroconf) service.

320

228

321

229

Attributes:

322

230

interface: integer; avahi.IF_UNSPEC or an interface index.

323

231

Used to optionally bind to the specified interface.

324

232

name: string; Example: 'Mandos'

325

233

type: string; Example: '_mandos._tcp'.

326

See <https://www.iana.org/assignments/service-names-port-numbers>

234

See <http://www.dns-sd.org/ServiceTypes.html>

327

235

port: integer; what port to announce

328

236

TXT: list of strings; TXT record for the service

329

237

domain: string; Domain to publish on, default to .local if empty.

335

243

server: D-Bus Server

336

244

bus: dbus.SystemBus()

337

245

"""

338

339

def __init__(self,

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

246

247

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

servicetype = None, port = None, TXT = None,

249

domain = "", host = "", max_renames = 32768,

250

protocol = avahi.PROTO_UNSPEC, bus = None):

350

251

self.interface = interface

351

252

self.name = name

352

253

self.type = servicetype

361

262

self.server = None

362

263

self.bus = bus

363

264

self.entry_group_state_changed_match = None

364

365

def rename(self, remove=True):

265

266

def rename(self):

366

267

"""Derived from the Avahi example code"""

367

268

if self.rename_count >= self.max_renames:

368

269

logger.critical("No suitable Zeroconf service name found"

369

270

" after %i retries, exiting.",

370

271

self.rename_count)

371

272

raise AvahiServiceError("Too many renames")

372

self.name = str(

373

self.server.GetAlternativeServiceName(self.name))

374

self.rename_count += 1

273

self.name = unicode(self.server

274

.GetAlternativeServiceName(self.name))

375

275

logger.info("Changing Zeroconf service name to %r ...",

376

276

self.name)

377

if remove:

378

self.remove()

277

self.remove()

379

278

try:

380

279

self.add()

381

280

except dbus.exceptions.DBusException as error:

382

if (error.get_dbus_name()

383

== "org.freedesktop.Avahi.CollisionError"):

384

logger.info("Local Zeroconf service name collision.")

385

return self.rename(remove=False)

386

else:

387

logger.critical("D-Bus Exception", exc_info=error)

388

self.cleanup()

389

os._exit(1)

390

281

logger.critical("D-Bus Exception", exc_info=error)

282

self.cleanup()

283

os._exit(1)

284

self.rename_count += 1

285

391

286

def remove(self):

392

287

"""Derived from the Avahi example code"""

393

288

if self.entry_group_state_changed_match is not None:

395

290

self.entry_group_state_changed_match = None

396

291

if self.group is not None:

397

292

self.group.Reset()

398

293

399

294

def add(self):

400

295

"""Derived from the Avahi example code"""

401

296

self.remove()

418

313

dbus.UInt16(self.port),

419

314

avahi.string_array_to_txt_array(self.TXT))

420

315

self.group.Commit()

421

316

422

317

def entry_group_state_changed(self, state, error):

423

318

"""Derived from the Avahi example code"""

424

319

logger.debug("Avahi entry group state change: %i", state)

425

320

426

321

if state == avahi.ENTRY_GROUP_ESTABLISHED:

427

322

logger.debug("Zeroconf service established.")

428

323

elif state == avahi.ENTRY_GROUP_COLLISION:

430

325

self.rename()

431

326

elif state == avahi.ENTRY_GROUP_FAILURE:

432

327

logger.critical("Avahi: Error in group state changed %s",

433

str(error))

434

raise AvahiGroupError("State changed: {!s}".format(error))

435

328

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

331

436

332

def cleanup(self):

437

333

"""Derived from the Avahi example code"""

438

334

if self.group is not None:

443

339

pass

444

340

self.group = None

445

341

self.remove()

446

342

447

343

def server_state_changed(self, state, error=None):

448

344

"""Derived from the Avahi example code"""

449

345

logger.debug("Avahi server state change: %i", state)

450

bad_states = {

451

avahi.SERVER_INVALID: "Zeroconf server invalid",

452

avahi.SERVER_REGISTERING: None,

453

avahi.SERVER_COLLISION: "Zeroconf server name collision",

454

avahi.SERVER_FAILURE: "Zeroconf server failure",

455

}

346

bad_states = { avahi.SERVER_INVALID:

347

"Zeroconf server invalid",

348

avahi.SERVER_REGISTERING: None,

349

avahi.SERVER_COLLISION:

350

"Zeroconf server name collision",

351

avahi.SERVER_FAILURE:

352

"Zeroconf server failure" }

456

353

if state in bad_states:

457

354

if bad_states[state] is not None:

458

355

if error is None:

461

358

logger.error(bad_states[state] + ": %r", error)

462

359

self.cleanup()

463

360

elif state == avahi.SERVER_RUNNING:

464

try:

465

self.add()

466

except dbus.exceptions.DBusException as error:

467

if (error.get_dbus_name()

468

== "org.freedesktop.Avahi.CollisionError"):

469

logger.info("Local Zeroconf service name"

470

" collision.")

471

return self.rename(remove=False)

472

else:

473

logger.critical("D-Bus Exception", exc_info=error)

474

self.cleanup()

475

os._exit(1)

361

self.add()

476

362

else:

477

363

if error is None:

478

364

logger.debug("Unknown state: %r", state)

479

365

else:

480

366

logger.debug("Unknown state: %r: %r", state, error)

481

367

482

368

def activate(self):

483

369

"""Derived from the Avahi example code"""

484

370

if self.server is None:

488

374

follow_name_owner_changes=True),

489

375

avahi.DBUS_INTERFACE_SERVER)

490

376

self.server.connect_to_signal("StateChanged",

491

self.server_state_changed)

377

self.server_state_changed)

492

378

self.server_state_changed(self.server.GetState())

493

379

494

495

380

class AvahiServiceToSyslog(AvahiService):

496

def rename(self, *args, **kwargs):

381

def rename(self):

497

382

"""Add the new name to the syslog messages"""

498

ret = AvahiService.rename(self, *args, **kwargs)

499

syslogger.setFormatter(logging.Formatter(

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

501

.format(self.name)))

383

ret = AvahiService.rename(self)

384

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

502

388

return ret

503

389

504

505

# Pretend that we have a GnuTLS module

506

class GnuTLS(object):

507

"""This isn't so much a class as it is a module-like namespace.

508

It is instantiated once, and simulates having a GnuTLS module."""

509

510

library = ctypes.util.find_library("gnutls")

511

if library is None:

512

library = ctypes.util.find_library("gnutls-deb0")

513

_library = ctypes.cdll.LoadLibrary(library)

514

del library

515

_need_version = b"3.3.0"

516

517

def __init__(self):

518

# Need to use "self" here, since this method is called before

519

# the assignment to the "gnutls" global variable happens.

520

if self.check_version(self._need_version) is None:

521

raise self.Error("Needs GnuTLS {} or later"

522

.format(self._need_version))

523

524

# Unless otherwise indicated, the constants and types below are

525

# all from the gnutls/gnutls.h C header file.

526

527

# Constants

528

E_SUCCESS = 0

529

E_INTERRUPTED = -52

530

E_AGAIN = -28

531

CRT_OPENPGP = 2

532

CLIENT = 2

533

SHUT_RDWR = 0

534

CRD_CERTIFICATE = 1

535

E_NO_CERTIFICATE_FOUND = -49

536

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

537

538

# Types

539

class session_int(ctypes.Structure):

540

_fields_ = []

541

session_t = ctypes.POINTER(session_int)

542

543

class certificate_credentials_st(ctypes.Structure):

544

_fields_ = []

545

certificate_credentials_t = ctypes.POINTER(

546

certificate_credentials_st)

547

certificate_type_t = ctypes.c_int

548

549

class datum_t(ctypes.Structure):

550

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

551

('size', ctypes.c_uint)]

552

553

class openpgp_crt_int(ctypes.Structure):

554

_fields_ = []

555

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

556

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

557

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

558

credentials_type_t = ctypes.c_int

559

transport_ptr_t = ctypes.c_void_p

560

close_request_t = ctypes.c_int

561

562

# Exceptions

563

class Error(Exception):

564

# We need to use the class name "GnuTLS" here, since this

565

# exception might be raised from within GnuTLS.__init__,

566

# which is called before the assignment to the "gnutls"

567

# global variable has happened.

568

def __init__(self, message=None, code=None, args=()):

569

# Default usage is by a message string, but if a return

570

# code is passed, convert it to a string with

571

# gnutls.strerror()

572

self.code = code

573

if message is None and code is not None:

574

message = GnuTLS.strerror(code)

575

return super(GnuTLS.Error, self).__init__(

576

message, *args)

577

578

class CertificateSecurityError(Error):

579

pass

580

581

# Classes

582

class Credentials(object):

583

def __init__(self):

584

self._c_object = gnutls.certificate_credentials_t()

585

gnutls.certificate_allocate_credentials(

586

ctypes.byref(self._c_object))

587

self.type = gnutls.CRD_CERTIFICATE

588

589

def __del__(self):

590

gnutls.certificate_free_credentials(self._c_object)

591

592

class ClientSession(object):

593

def __init__(self, socket, credentials=None):

594

self._c_object = gnutls.session_t()

595

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

596

gnutls.set_default_priority(self._c_object)

597

gnutls.transport_set_ptr(self._c_object, socket.fileno())

598

gnutls.handshake_set_private_extensions(self._c_object,

599

True)

600

self.socket = socket

601

if credentials is None:

602

credentials = gnutls.Credentials()

603

gnutls.credentials_set(self._c_object, credentials.type,

604

ctypes.cast(credentials._c_object,

605

ctypes.c_void_p))

606

self.credentials = credentials

607

608

def __del__(self):

609

gnutls.deinit(self._c_object)

610

611

def handshake(self):

612

return gnutls.handshake(self._c_object)

613

614

def send(self, data):

615

data = bytes(data)

616

data_len = len(data)

617

while data_len > 0:

618

data_len -= gnutls.record_send(self._c_object,

619

data[-data_len:],

620

data_len)

621

622

def bye(self):

623

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

624

625

# Error handling functions

626

def _error_code(result):

627

"""A function to raise exceptions on errors, suitable

628

for the 'restype' attribute on ctypes functions"""

629

if result >= 0:

630

return result

631

if result == gnutls.E_NO_CERTIFICATE_FOUND:

632

raise gnutls.CertificateSecurityError(code=result)

633

raise gnutls.Error(code=result)

634

635

def _retry_on_error(result, func, arguments):

636

"""A function to retry on some errors, suitable

637

for the 'errcheck' attribute on ctypes functions"""

638

while result < 0:

639

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

640

return _error_code(result)

641

result = func(*arguments)

642

return result

643

644

# Unless otherwise indicated, the function declarations below are

645

# all from the gnutls/gnutls.h C header file.

646

647

# Functions

648

priority_set_direct = _library.gnutls_priority_set_direct

649

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

650

ctypes.POINTER(ctypes.c_char_p)]

651

priority_set_direct.restype = _error_code

652

653

init = _library.gnutls_init

654

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

655

init.restype = _error_code

656

657

set_default_priority = _library.gnutls_set_default_priority

658

set_default_priority.argtypes = [session_t]

659

set_default_priority.restype = _error_code

660

661

record_send = _library.gnutls_record_send

662

record_send.argtypes = [session_t, ctypes.c_void_p,

663

ctypes.c_size_t]

664

record_send.restype = ctypes.c_ssize_t

665

record_send.errcheck = _retry_on_error

666

667

certificate_allocate_credentials = (

668

_library.gnutls_certificate_allocate_credentials)

669

certificate_allocate_credentials.argtypes = [

670

ctypes.POINTER(certificate_credentials_t)]

671

certificate_allocate_credentials.restype = _error_code

672

673

certificate_free_credentials = (

674

_library.gnutls_certificate_free_credentials)

675

certificate_free_credentials.argtypes = [

676

certificate_credentials_t]

677

certificate_free_credentials.restype = None

678

679

handshake_set_private_extensions = (

680

_library.gnutls_handshake_set_private_extensions)

681

handshake_set_private_extensions.argtypes = [session_t,

682

ctypes.c_int]

683

handshake_set_private_extensions.restype = None

684

685

credentials_set = _library.gnutls_credentials_set

686

credentials_set.argtypes = [session_t, credentials_type_t,

687

ctypes.c_void_p]

688

credentials_set.restype = _error_code

689

690

strerror = _library.gnutls_strerror

691

strerror.argtypes = [ctypes.c_int]

692

strerror.restype = ctypes.c_char_p

693

694

certificate_type_get = _library.gnutls_certificate_type_get

695

certificate_type_get.argtypes = [session_t]

696

certificate_type_get.restype = _error_code

697

698

certificate_get_peers = _library.gnutls_certificate_get_peers

699

certificate_get_peers.argtypes = [session_t,

700

ctypes.POINTER(ctypes.c_uint)]

701

certificate_get_peers.restype = ctypes.POINTER(datum_t)

702

703

global_set_log_level = _library.gnutls_global_set_log_level

704

global_set_log_level.argtypes = [ctypes.c_int]

705

global_set_log_level.restype = None

706

707

global_set_log_function = _library.gnutls_global_set_log_function

708

global_set_log_function.argtypes = [log_func]

709

global_set_log_function.restype = None

710

711

deinit = _library.gnutls_deinit

712

deinit.argtypes = [session_t]

713

deinit.restype = None

714

715

handshake = _library.gnutls_handshake

716

handshake.argtypes = [session_t]

717

handshake.restype = _error_code

718

handshake.errcheck = _retry_on_error

719

720

transport_set_ptr = _library.gnutls_transport_set_ptr

721

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

722

transport_set_ptr.restype = None

723

724

bye = _library.gnutls_bye

725

bye.argtypes = [session_t, close_request_t]

726

bye.restype = _error_code

727

bye.errcheck = _retry_on_error

728

729

check_version = _library.gnutls_check_version

730

check_version.argtypes = [ctypes.c_char_p]

731

check_version.restype = ctypes.c_char_p

732

733

# All the function declarations below are from gnutls/openpgp.h

734

735

openpgp_crt_init = _library.gnutls_openpgp_crt_init

736

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

737

openpgp_crt_init.restype = _error_code

738

739

openpgp_crt_import = _library.gnutls_openpgp_crt_import

740

openpgp_crt_import.argtypes = [openpgp_crt_t,

741

ctypes.POINTER(datum_t),

742

openpgp_crt_fmt_t]

743

openpgp_crt_import.restype = _error_code

744

745

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

746

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

747

ctypes.POINTER(ctypes.c_uint)]

748

openpgp_crt_verify_self.restype = _error_code

749

750

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

751

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

752

openpgp_crt_deinit.restype = None

753

754

openpgp_crt_get_fingerprint = (

755

_library.gnutls_openpgp_crt_get_fingerprint)

756

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

757

ctypes.c_void_p,

758

ctypes.POINTER(

759

ctypes.c_size_t)]

760

openpgp_crt_get_fingerprint.restype = _error_code

761

762

# Remove non-public functions

763

del _error_code, _retry_on_error

764

# Create the global "gnutls" object, simulating a module

765

gnutls = GnuTLS()

766

767

768

def call_pipe(connection, # : multiprocessing.Connection

769

func, *args, **kwargs):

770

"""This function is meant to be called by multiprocessing.Process

771

772

This function runs func(*args, **kwargs), and writes the resulting

773

return value on the provided multiprocessing.Connection.

774

"""

775

connection.send(func(*args, **kwargs))

776

connection.close()

777

390

def timedelta_to_milliseconds(td):

391

"Convert a datetime.timedelta() to milliseconds"

392

return ((td.days * 24 * 60 * 60 * 1000)

393

+ (td.seconds * 1000)

394

+ (td.microseconds // 1000))

778

395

779

396

class Client(object):

780

397

"""A representation of a client host served by this server.

781

398

782

399

Attributes:

783

400

approved: bool(); 'None' if not yet approved/disapproved

784

401

approval_delay: datetime.timedelta(); Time to wait for approval

786

403

checker: subprocess.Popen(); a running checker process used

787

404

to see if the client lives.

788

405

'None' if no process is running.

789

checker_callback_tag: a GLib event source tag, or None

406

checker_callback_tag: a gobject event source tag, or None

790

407

checker_command: string; External command which is run to check

791

408

if client lives. %() expansions are done at

792

409

runtime with vars(self) as dict, so that for

793

410

instance %(name)s can be used in the command.

794

checker_initiator_tag: a GLib event source tag, or None

411

checker_initiator_tag: a gobject event source tag, or None

795

412

created: datetime.datetime(); (UTC) object creation

796

413

client_structure: Object describing what attributes a client has

797

414

and is used for storing the client at exit

798

415

current_checker_command: string; current running checker_command

799

disable_initiator_tag: a GLib event source tag, or None

416

disable_initiator_tag: a gobject event source tag, or None

800

417

enabled: bool()

801

418

fingerprint: string (40 or 32 hexadecimal digits); used to

802

419

uniquely identify the client

807

424

last_checker_status: integer between 0 and 255 reflecting exit

808

425

status of last checker. -1 reflects crashed

809

426

checker, -2 means no checker completed yet.

810

last_checker_signal: The signal which killed the last checker, if

811

last_checker_status is -1

812

427

last_enabled: datetime.datetime(); (UTC) or None

813

428

name: string; from the config file, used in log messages and

814

429

D-Bus identifiers

819

434

runtime_expansions: Allowed attributes for runtime expansion.

820

435

expires: datetime.datetime(); time (UTC) when a client will be

821

436

disabled, or None

822

server_settings: The server_settings dict from main()

823

437

"""

824

438

825

439

runtime_expansions = ("approval_delay", "approval_duration",

826

"created", "enabled", "expires",

827

"fingerprint", "host", "interval",

828

"last_approval_request", "last_checked_ok",

440

"created", "enabled", "fingerprint",

441

"host", "interval", "last_checked_ok",

829

442

"last_enabled", "name", "timeout")

830

client_defaults = {

831

"timeout": "PT5M",

832

"extended_timeout": "PT15M",

833

"interval": "PT2M",

834

"checker": "fping -q -- %%(host)s",

835

"host": "",

836

"approval_delay": "PT0S",

837

"approval_duration": "PT1S",

838

"approved_by_default": "True",

839

"enabled": "True",

840

}

841

443

client_defaults = { "timeout": "5m",

444

"extended_timeout": "15m",

445

"interval": "2m",

446

"checker": "fping -q -- %%(host)s",

447

"host": "",

448

"approval_delay": "0s",

449

"approval_duration": "1s",

450

"approved_by_default": "True",

451

"enabled": "True",

452

}

453

454

def timeout_milliseconds(self):

455

"Return the 'timeout' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.timeout)

457

458

def extended_timeout_milliseconds(self):

459

"Return the 'extended_timeout' attribute in milliseconds"

460

return timedelta_to_milliseconds(self.extended_timeout)

461

462

def interval_milliseconds(self):

463

"Return the 'interval' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.interval)

465

466

def approval_delay_milliseconds(self):

467

return timedelta_to_milliseconds(self.approval_delay)

468

842

469

@staticmethod

843

470

def config_parser(config):

844

471

"""Construct a new dict of client settings of this form:

851

478

for client_name in config.sections():

852

479

section = dict(config.items(client_name))

853

480

client = settings[client_name] = {}

854

481

855

482

client["host"] = section["host"]

856

483

# Reformat values from string types to Python types

857

484

client["approved_by_default"] = config.getboolean(

858

485

client_name, "approved_by_default")

859

486

client["enabled"] = config.getboolean(client_name,

860

487

"enabled")

861

862

# Uppercase and remove spaces from fingerprint for later

863

# comparison purposes with return value from the

864

# fingerprint() function

488

865

489

client["fingerprint"] = (section["fingerprint"].upper()

866

490

.replace(" ", ""))

867

491

if "secret" in section:

868

client["secret"] = codecs.decode(section["secret"]

869

.encode("utf-8"),

870

"base64")

492

client["secret"] = section["secret"].decode("base64")

871

493

elif "secfile" in section:

872

494

with open(os.path.expanduser(os.path.expandvars

873

495

(section["secfile"])),

874

496

"rb") as secfile:

875

497

client["secret"] = secfile.read()

876

498

else:

877

raise TypeError("No secret or secfile for section {}"

499

raise TypeError("No secret or secfile for section {0}"

878

500

.format(section))

879

501

client["timeout"] = string_to_delta(section["timeout"])

880

502

client["extended_timeout"] = string_to_delta(

888

510

client["last_approval_request"] = None

889

511

client["last_checked_ok"] = None

890

512

client["last_checker_status"] = -2

891

513

892

514

return settings

893

894

def __init__(self, settings, name=None, server_settings=None):

515

516

def __init__(self, settings, name = None):

895

517

self.name = name

896

if server_settings is None:

897

server_settings = {}

898

self.server_settings = server_settings

899

518

# adding all client settings

900

for setting, value in settings.items():

519

for setting, value in settings.iteritems():

901

520

setattr(self, setting, value)

902

521

903

522

if self.enabled:

904

523

if not hasattr(self, "last_enabled"):

905

524

self.last_enabled = datetime.datetime.utcnow()

909

528

else:

910

529

self.last_enabled = None

911

530

self.expires = None

912

531

913

532

logger.debug("Creating client %r", self.name)

533

# Uppercase and remove spaces from fingerprint for later

534

# comparison purposes with return value from the fingerprint()

535

# function

914

536

logger.debug(" Fingerprint: %s", self.fingerprint)

915

537

self.created = settings.get("created",

916

538

datetime.datetime.utcnow())

917

539

918

540

# attributes specific for this server instance

919

541

self.checker = None

920

542

self.checker_initiator_tag = None

923

545

self.current_checker_command = None

924

546

self.approved = None

925

547

self.approvals_pending = 0

926

self.changedstate = multiprocessing_manager.Condition(

927

multiprocessing_manager.Lock())

928

self.client_structure = [attr

929

for attr in self.__dict__.keys()

548

self.changedstate = (multiprocessing_manager

549

.Condition(multiprocessing_manager

550

.Lock()))

551

self.client_structure = [attr for attr in

552

self.__dict__.iterkeys()

930

553

if not attr.startswith("_")]

931

554

self.client_structure.append("client_structure")

932

933

for name, t in inspect.getmembers(

934

type(self), lambda obj: isinstance(obj, property)):

555

556

for name, t in inspect.getmembers(type(self),

557

lambda obj:

558

isinstance(obj,

559

property)):

935

560

if not name.startswith("_"):

936

561

self.client_structure.append(name)

937

562

938

563

# Send notice to process children that client state has changed

939

564

def send_changedstate(self):

940

565

with self.changedstate:

941

566

self.changedstate.notify_all()

942

567

943

568

def enable(self):

944

569

"""Start this client's checker and timeout hooks"""

945

570

if getattr(self, "enabled", False):

946

571

# Already enabled

947

572

return

573

self.send_changedstate()

948

574

self.expires = datetime.datetime.utcnow() + self.timeout

949

575

self.enabled = True

950

576

self.last_enabled = datetime.datetime.utcnow()

951

577

self.init_checker()

952

self.send_changedstate()

953

578

954

579

def disable(self, quiet=True):

955

580

"""Disable this client."""

956

581

if not getattr(self, "enabled", False):

957

582

return False

958

583

if not quiet:

584

self.send_changedstate()

585

if not quiet:

959

586

logger.info("Disabling client %s", self.name)

960

if getattr(self, "disable_initiator_tag", None) is not None:

961

GLib.source_remove(self.disable_initiator_tag)

587

if getattr(self, "disable_initiator_tag", False):

588

gobject.source_remove(self.disable_initiator_tag)

962

589

self.disable_initiator_tag = None

963

590

self.expires = None

964

if getattr(self, "checker_initiator_tag", None) is not None:

965

GLib.source_remove(self.checker_initiator_tag)

591

if getattr(self, "checker_initiator_tag", False):

592

gobject.source_remove(self.checker_initiator_tag)

966

593

self.checker_initiator_tag = None

967

594

self.stop_checker()

968

595

self.enabled = False

969

if not quiet:

970

self.send_changedstate()

971

# Do not run this again if called by a GLib.timeout_add

596

# Do not run this again if called by a gobject.timeout_add

972

597

return False

973

598

974

599

def __del__(self):

975

600

self.disable()

976

601

977

602

def init_checker(self):

978

603

# Schedule a new checker to be started an 'interval' from now,

979

604

# and every interval from then on.

980

if self.checker_initiator_tag is not None:

981

GLib.source_remove(self.checker_initiator_tag)

982

self.checker_initiator_tag = GLib.timeout_add(

983

int(self.interval.total_seconds() * 1000),

984

self.start_checker)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(self.interval_milliseconds(),

607

self.start_checker))

985

608

# Schedule a disable() when 'timeout' has passed

986

if self.disable_initiator_tag is not None:

987

GLib.source_remove(self.disable_initiator_tag)

988

self.disable_initiator_tag = GLib.timeout_add(

989

int(self.timeout.total_seconds() * 1000), self.disable)

609

self.disable_initiator_tag = (gobject.timeout_add

610

(self.timeout_milliseconds(),

611

self.disable))

990

612

# Also start a new checker *right now*.

991

613

self.start_checker()

992

993

def checker_callback(self, source, condition, connection,

994

command):

614

615

def checker_callback(self, pid, condition, command):

995

616

"""The checker has completed, so take appropriate actions."""

996

617

self.checker_callback_tag = None

997

618

self.checker = None

998

# Read return code from connection (see call_pipe)

999

returncode = connection.recv()

1000

connection.close()

1001

1002

if returncode >= 0:

1003

self.last_checker_status = returncode

1004

self.last_checker_signal = None

619

if os.WIFEXITED(condition):

620

self.last_checker_status = os.WEXITSTATUS(condition)

1005

621

if self.last_checker_status == 0:

1006

622

logger.info("Checker for %(name)s succeeded",

1007

623

vars(self))

1008

624

self.checked_ok()

1009

625

else:

1010

logger.info("Checker for %(name)s failed", vars(self))

626

logger.info("Checker for %(name)s failed",

627

vars(self))

1011

628

else:

1012

629

self.last_checker_status = -1

1013

self.last_checker_signal = -returncode

1014

630

logger.warning("Checker for %(name)s crashed?",

1015

631

vars(self))

1016

return False

1017

632

1018

633

def checked_ok(self):

1019

634

"""Assert that the client has been seen, alive and well."""

1020

635

self.last_checked_ok = datetime.datetime.utcnow()

1021

636

self.last_checker_status = 0

1022

self.last_checker_signal = None

1023

637

self.bump_timeout()

1024

638

1025

639

def bump_timeout(self, timeout=None):

1026

640

"""Bump up the timeout for this client."""

1027

641

if timeout is None:

1028

642

timeout = self.timeout

1029

643

if self.disable_initiator_tag is not None:

1030

GLib.source_remove(self.disable_initiator_tag)

1031

self.disable_initiator_tag = None

644

gobject.source_remove(self.disable_initiator_tag)

1032

645

if getattr(self, "enabled", False):

1033

self.disable_initiator_tag = GLib.timeout_add(

1034

int(timeout.total_seconds() * 1000), self.disable)

646

self.disable_initiator_tag = (gobject.timeout_add

647

(timedelta_to_milliseconds

648

(timeout), self.disable))

1035

649

self.expires = datetime.datetime.utcnow() + timeout

1036

650

1037

651

def need_approval(self):

1038

652

self.last_approval_request = datetime.datetime.utcnow()

1039

653

1040

654

def start_checker(self):

1041

655

"""Start a new checker subprocess if one is not running.

1042

656

1043

657

If a checker already exists, leave it running and do

1044

658

nothing."""

1045

659

# The reason for not killing a running checker is that if we

1046

# did that, and if a checker (for some reason) started running

1047

# slowly and taking more than 'interval' time, then the client

1048

# would inevitably timeout, since no checker would get a

1049

# chance to run to completion. If we instead leave running

660

# did that, then if a checker (for some reason) started

661

# running slowly and taking more than 'interval' time, the

662

# client would inevitably timeout, since no checker would get

663

# a chance to run to completion. If we instead leave running

1050

664

# checkers alone, the checker would have to take more time

1051

665

# than 'timeout' for the client to be disabled, which is as it

1052

666

# should be.

1053

1054

if self.checker is not None and not self.checker.is_alive():

1055

logger.warning("Checker was not alive; joining")

1056

self.checker.join()

1057

self.checker = None

667

668

# If a checker exists, make sure it is not a zombie

669

try:

670

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

671

except (AttributeError, OSError) as error:

672

if (isinstance(error, OSError)

673

and error.errno != errno.ECHILD):

674

raise error

675

else:

676

if pid:

677

logger.warning("Checker was a zombie")

678

gobject.source_remove(self.checker_callback_tag)

679

self.checker_callback(pid, status,

680

self.current_checker_command)

1058

681

# Start a new checker if needed

1059

682

if self.checker is None:

1060

# Escape attributes for the shell

1061

escaped_attrs = {

1062

attr: re.escape(str(getattr(self, attr)))

1063

for attr in self.runtime_expansions}

1064

try:

1065

command = self.checker_command % escaped_attrs

1066

except TypeError as error:

1067

logger.error('Could not format string "%s"',

1068

self.checker_command,

683

try:

684

# In case checker_command has exactly one % operator

685

command = self.checker_command % self.host

686

except TypeError:

687

# Escape attributes for the shell

688

escaped_attrs = dict(

689

(attr,

690

re.escape(unicode(str(getattr(self, attr, "")),

691

errors=

692

'replace')))

693

for attr in

694

self.runtime_expansions)

695

696

try:

697

command = self.checker_command % escaped_attrs

698

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

701

return True # Try again later

702

self.current_checker_command = command

703

try:

704

logger.info("Starting checker %r for %s",

705

command, self.name)

706

# We don't need to redirect stdout and stderr, since

707

# in normal mode, that is already done by daemon(),

708

# and in debug mode we don't want to. (Stdin is

709

# always replaced by /dev/null.)

710

self.checker = subprocess.Popen(command,

711

close_fds=True,

712

shell=True, cwd="/")

713

self.checker_callback_tag = (gobject.child_watch_add

714

(self.checker.pid,

715

self.checker_callback,

716

data=command))

717

# The checker may have completed before the gobject

718

# watch was added. Check for this.

719

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

720

if pid:

721

gobject.source_remove(self.checker_callback_tag)

722

self.checker_callback(pid, status, command)

723

except OSError as error:

724

logger.error("Failed to start subprocess",

1069

725

exc_info=error)

1070

return True # Try again later

1071

self.current_checker_command = command

1072

logger.info("Starting checker %r for %s", command,

1073

self.name)

1074

# We don't need to redirect stdout and stderr, since

1075

# in normal mode, that is already done by daemon(),

1076

# and in debug mode we don't want to. (Stdin is

1077

# always replaced by /dev/null.)

1078

# The exception is when not debugging but nevertheless

1079

# running in the foreground; use the previously

1080

# created wnull.

1081

popen_args = {"close_fds": True,

1082

"shell": True,

1083

"cwd": "/"}

1084

if (not self.server_settings["debug"]

1085

and self.server_settings["foreground"]):

1086

popen_args.update({"stdout": wnull,

1087

"stderr": wnull})

1088

pipe = multiprocessing.Pipe(duplex=False)

1089

self.checker = multiprocessing.Process(

1090

target=call_pipe,

1091

args=(pipe[1], subprocess.call, command),

1092

kwargs=popen_args)

1093

self.checker.start()

1094

self.checker_callback_tag = GLib.io_add_watch(

1095

pipe[0].fileno(), GLib.IO_IN,

1096

self.checker_callback, pipe[0], command)

1097

# Re-run this periodically if run by GLib.timeout_add

726

# Re-run this periodically if run by gobject.timeout_add

1098

727

return True

1099

728

1100

729

def stop_checker(self):

1101

730

"""Force the checker process, if any, to stop."""

1102

731

if self.checker_callback_tag:

1103

GLib.source_remove(self.checker_callback_tag)

732

gobject.source_remove(self.checker_callback_tag)

1104

733

self.checker_callback_tag = None

1105

734

if getattr(self, "checker", None) is None:

1106

735

return

1107

736

logger.debug("Stopping checker for %(name)s", vars(self))

1108

self.checker.terminate()

737

try:

738

self.checker.terminate()

739

#time.sleep(0.5)

740

#if self.checker.poll() is None:

741

# self.checker.kill()

742

except OSError as error:

743

if error.errno != errno.ESRCH: # No such process

744

raise

1109

745

self.checker = None

1110

746

1111

747

1112

def dbus_service_property(dbus_interface,

1113

signature="v",

1114

access="readwrite",

1115

byte_arrays=False):

748

def dbus_service_property(dbus_interface, signature="v",

749

access="readwrite", byte_arrays=False):

1116

750

"""Decorators for marking methods of a DBusObjectWithProperties to

1117

751

become properties on the D-Bus.

1118

752

1119

753

The decorated method will be called with no arguments by "Get"

1120

754

and with one argument by "Set".

1121

755

1122

756

The parameters, where they are supported, are the same as

1123

757

dbus.service.method, except there is only "signature", since the

1124

758

type from Get() and the type sent to Set() is the same.

1127

761

# "Set" method, so we fail early here:

1128

762

if byte_arrays and signature != "ay":

1129

763

raise ValueError("Byte arrays not supported for non-'ay'"

1130

" signature {!r}".format(signature))

1131

764

" signature {0!r}".format(signature))

1132

765

def decorator(func):

1133

766

func._dbus_is_property = True

1134

767

func._dbus_interface = dbus_interface

1137

770

func._dbus_name = func.__name__

1138

771

if func._dbus_name.endswith("_dbus_property"):

1139

772

func._dbus_name = func._dbus_name[:-14]

1140

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

773

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1141

774

return func

1142

1143

775

return decorator

1144

776

1145

777

1146

778

def dbus_interface_annotations(dbus_interface):

1147

779

"""Decorator for marking functions returning interface annotations

1148

780

1149

781

Usage:

1150

782

1151

783

@dbus_interface_annotations("org.example.Interface")

1152

784

def _foo(self): # Function name does not matter

1153

785

return {"org.freedesktop.DBus.Deprecated": "true",

1154

786

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1155

787

"false"}

1156

788

"""

1157

1158

789

def decorator(func):

1159

790

func._dbus_is_interface = True

1160

791

func._dbus_interface = dbus_interface

1161

792

func._dbus_name = dbus_interface

1162

793

return func

1163

1164

794

return decorator

1165

795

1166

796

1167

797

def dbus_annotations(annotations):

1168

798

"""Decorator to annotate D-Bus methods, signals or properties

1169

799

Usage:

1170

1171

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1172

"org.freedesktop.DBus.Property."

1173

"EmitsChangedSignal": "false"})

800

1174

801

@dbus_service_property("org.example.Interface", signature="b",

1175

802

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

1176

806

def Property_dbus_property(self):

1177

807

return dbus.Boolean(False)

1178

1179

See also the DBusObjectWithAnnotations class.

1180

808

"""

1181

1182

809

def decorator(func):

1183

810

func._dbus_annotations = annotations

1184

811

return func

1185

1186

812

return decorator

1187

813

1188

814

1189

815

class DBusPropertyException(dbus.exceptions.DBusException):

1190

816

"""A base class for D-Bus property-related exceptions

1191

817

"""

1192

pass

818

def __unicode__(self):

819

return unicode(str(self))

1193

820

1194

821

1195

822

class DBusPropertyAccessException(DBusPropertyException):

1204

831

pass

1205

832

1206

833

1207

class DBusObjectWithAnnotations(dbus.service.Object):

1208

"""A D-Bus object with annotations.

1209

1210

Classes inheriting from this can use the dbus_annotations

1211

decorator to add annotations to methods or signals.

834

class DBusObjectWithProperties(dbus.service.Object):

835

"""A D-Bus object with properties.

836

837

Classes inheriting from this can use the dbus_service_property

838

decorator to expose methods as D-Bus properties. It exposes the

839

standard Get(), Set(), and GetAll() methods on the D-Bus.

1212

840

"""

1213

841

1214

842

@staticmethod

1215

843

def _is_dbus_thing(thing):

1216

844

"""Returns a function testing if an attribute is a D-Bus thing

1217

845

1218

846

If called like _is_dbus_thing("method") it returns a function

1219

847

suitable for use as predicate to inspect.getmembers().

1220

848

"""

1221

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1222

850

False)

1223

851

1224

852

def _get_all_dbus_things(self, thing):

1225

853

"""Returns a generator of (name, attribute) pairs

1226

854

"""

1227

return ((getattr(athing.__get__(self), "_dbus_name", name),

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

1228

857

athing.__get__(self))

1229

858

for cls in self.__class__.__mro__

1230

859

for name, athing in

1231

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1232

1233

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1234

out_signature="s",

1235

path_keyword='object_path',

1236

connection_keyword='connection')

1237

def Introspect(self, object_path, connection):

1238

"""Overloading of standard D-Bus method.

1239

1240

Inserts annotation tags on methods and signals.

1241

"""

1242

xmlstring = dbus.service.Object.Introspect(self, object_path,

1243

connection)

1244

try:

1245

document = xml.dom.minidom.parseString(xmlstring)

1246

1247

for if_tag in document.getElementsByTagName("interface"):

1248

# Add annotation tags

1249

for typ in ("method", "signal"):

1250

for tag in if_tag.getElementsByTagName(typ):

1251

annots = dict()

1252

for name, prop in (self.

1253

_get_all_dbus_things(typ)):

1254

if (name == tag.getAttribute("name")

1255

and prop._dbus_interface

1256

== if_tag.getAttribute("name")):

1257

annots.update(getattr(

1258

prop, "_dbus_annotations", {}))

1259

for name, value in annots.items():

1260

ann_tag = document.createElement(

1261

"annotation")

1262

ann_tag.setAttribute("name", name)

1263

ann_tag.setAttribute("value", value)

1264

tag.appendChild(ann_tag)

1265

# Add interface annotation tags

1266

for annotation, value in dict(

1267

itertools.chain.from_iterable(

1268

annotations().items()

1269

for name, annotations

1270

in self._get_all_dbus_things("interface")

1271

if name == if_tag.getAttribute("name")

1272

)).items():

1273

ann_tag = document.createElement("annotation")

1274

ann_tag.setAttribute("name", annotation)

1275

ann_tag.setAttribute("value", value)

1276

if_tag.appendChild(ann_tag)

1277

# Fix argument name for the Introspect method itself

1278

if (if_tag.getAttribute("name")

1279

== dbus.INTROSPECTABLE_IFACE):

1280

for cn in if_tag.getElementsByTagName("method"):

1281

if cn.getAttribute("name") == "Introspect":

1282

for arg in cn.getElementsByTagName("arg"):

1283

if (arg.getAttribute("direction")

1284

== "out"):

1285

arg.setAttribute("name",

1286

"xml_data")

1287

xmlstring = document.toxml("utf-8")

1288

document.unlink()

1289

except (AttributeError, xml.dom.DOMException,

1290

xml.parsers.expat.ExpatError) as error:

1291

logger.error("Failed to override Introspection method",

1292

exc_info=error)

1293

return xmlstring

1294

1295

1296

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1297

"""A D-Bus object with properties.

1298

1299

Classes inheriting from this can use the dbus_service_property

1300

decorator to expose methods as D-Bus properties. It exposes the

1301

standard Get(), Set(), and GetAll() methods on the D-Bus.

1302

"""

1303

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

862

1304

863

def _get_dbus_property(self, interface_name, property_name):

1305

864

"""Returns a bound method if one exists which is a D-Bus

1306

865

property with the specified name and interface.

1307

866

"""

1308

for cls in self.__class__.__mro__:

1309

for name, value in inspect.getmembers(

1310

cls, self._is_dbus_thing("property")):

867

for cls in self.__class__.__mro__:

868

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

1311

871

if (value._dbus_name == property_name

1312

872

and value._dbus_interface == interface_name):

1313

873

return value.__get__(self)

1314

874

1315

875

# No such property

1316

raise DBusPropertyNotFound("{}:{}.{}".format(

1317

self.dbus_object_path, interface_name, property_name))

1318

1319

@classmethod

1320

def _get_all_interface_names(cls):

1321

"""Get a sequence of all interfaces supported by an object"""

1322

return (name for name in set(getattr(getattr(x, attr),

1323

"_dbus_interface", None)

1324

for x in (inspect.getmro(cls))

1325

for attr in dir(x))

1326

if name is not None)

1327

1328

@dbus.service.method(dbus.PROPERTIES_IFACE,

1329

in_signature="ss",

876

raise DBusPropertyNotFound(self.dbus_object_path + ":"

877

+ interface_name + "."

878

+ property_name)

879

880

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1330

881

out_signature="v")

1331

882

def Get(self, interface_name, property_name):

1332

883

"""Standard D-Bus property Get() method, see D-Bus standard.

1338

889

if not hasattr(value, "variant_level"):

1339

890

return value

1340

891

return type(value)(value, variant_level=value.variant_level+1)

1341

892

1342

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1343

894

def Set(self, interface_name, property_name, value):

1344

895

"""Standard D-Bus property Set() method, see D-Bus standard.

1350

901

# The byte_arrays option is not supported yet on

1351

902

# signatures other than "ay".

1352

903

if prop._dbus_signature != "ay":

1353

raise ValueError("Byte arrays not supported for non-"

1354

"'ay' signature {!r}"

1355

.format(prop._dbus_signature))

904

raise ValueError

1356

905

value = dbus.ByteArray(b''.join(chr(byte)

1357

906

for byte in value))

1358

907

prop(value)

1359

1360

@dbus.service.method(dbus.PROPERTIES_IFACE,

1361

in_signature="s",

908

909

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1362

910

out_signature="a{sv}")

1363

911

def GetAll(self, interface_name):

1364

912

"""Standard D-Bus property GetAll() method, see D-Bus

1365

913

standard.

1366

914

1367

915

Note: Will not include properties with access="write".

1368

916

"""

1369

917

properties = {}

1379

927

if not hasattr(value, "variant_level"):

1380

928

properties[name] = value

1381

929

continue

1382

properties[name] = type(value)(

1383

value, variant_level=value.variant_level + 1)

930

properties[name] = type(value)(value, variant_level=

931

value.variant_level+1)

1384

932

return dbus.Dictionary(properties, signature="sv")

1385

1386

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1387

def PropertiesChanged(self, interface_name, changed_properties,

1388

invalidated_properties):

1389

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1390

standard.

1391

"""

1392

pass

1393

933

1394

934

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1395

935

out_signature="s",

1396

936

path_keyword='object_path',

1397

937

connection_keyword='connection')

1398

938

def Introspect(self, object_path, connection):

1399

939

"""Overloading of standard D-Bus method.

1400

940

1401

941

Inserts property tags and interface annotation tags.

1402

942

"""

1403

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1404

object_path,

1405

connection)

943

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

connection)

1406

945

try:

1407

946

document = xml.dom.minidom.parseString(xmlstring)

1408

1409

947

def make_tag(document, name, prop):

1410

948

e = document.createElement("property")

1411

949

e.setAttribute("name", name)

1412

950

e.setAttribute("type", prop._dbus_signature)

1413

951

e.setAttribute("access", prop._dbus_access)

1414

952

return e

1415

1416

953

for if_tag in document.getElementsByTagName("interface"):

1417

954

# Add property tags

1418

955

for tag in (make_tag(document, name, prop)

1421

958

if prop._dbus_interface

1422

959

== if_tag.getAttribute("name")):

1423

960

if_tag.appendChild(tag)

1424

# Add annotation tags for properties

1425

for tag in if_tag.getElementsByTagName("property"):

1426

annots = dict()

1427

for name, prop in self._get_all_dbus_things(

1428

"property"):

1429

if (name == tag.getAttribute("name")

1430

and prop._dbus_interface

1431

== if_tag.getAttribute("name")):

1432

annots.update(getattr(

1433

prop, "_dbus_annotations", {}))

1434

for name, value in annots.items():

1435

ann_tag = document.createElement(

1436

"annotation")

1437

ann_tag.setAttribute("name", name)

1438

ann_tag.setAttribute("value", value)

1439

tag.appendChild(ann_tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain.from_iterable(

983

annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

)).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

1440

992

# Add the names to the return values for the

1441

993

# "org.freedesktop.DBus.Properties" methods

1442

994

if (if_tag.getAttribute("name")

1461

1013

return xmlstring

1462

1014

1463

1015

1464

try:

1465

dbus.OBJECT_MANAGER_IFACE

1466

except AttributeError:

1467

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1468

1469

1470

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1471

"""A D-Bus object with an ObjectManager.

1472

1473

Classes inheriting from this exposes the standard

1474

GetManagedObjects call and the InterfacesAdded and

1475

InterfacesRemoved signals on the standard

1476

"org.freedesktop.DBus.ObjectManager" interface.

1477

1478

Note: No signals are sent automatically; they must be sent

1479

manually.

1480

"""

1481

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1482

out_signature="a{oa{sa{sv}}}")

1483

def GetManagedObjects(self):

1484

"""This function must be overridden"""

1485

raise NotImplementedError()

1486

1487

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1488

signature="oa{sa{sv}}")

1489

def InterfacesAdded(self, object_path, interfaces_and_properties):

1490

pass

1491

1492

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1493

def InterfacesRemoved(self, object_path, interfaces):

1494

pass

1495

1496

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1497

out_signature="s",

1498

path_keyword='object_path',

1499

connection_keyword='connection')

1500

def Introspect(self, object_path, connection):

1501

"""Overloading of standard D-Bus method.

1502

1503

Override return argument name of GetManagedObjects to be

1504

"objpath_interfaces_and_properties"

1505

"""

1506

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1507

object_path,

1508

connection)

1509

try:

1510

document = xml.dom.minidom.parseString(xmlstring)

1511

1512

for if_tag in document.getElementsByTagName("interface"):

1513

# Fix argument name for the GetManagedObjects method

1514

if (if_tag.getAttribute("name")

1515

== dbus.OBJECT_MANAGER_IFACE):

1516

for cn in if_tag.getElementsByTagName("method"):

1517

if (cn.getAttribute("name")

1518

== "GetManagedObjects"):

1519

for arg in cn.getElementsByTagName("arg"):

1520

if (arg.getAttribute("direction")

1521

== "out"):

1522

arg.setAttribute(

1523

"name",

1524

"objpath_interfaces"

1525

"_and_properties")

1526

xmlstring = document.toxml("utf-8")

1527

document.unlink()

1528

except (AttributeError, xml.dom.DOMException,

1529

xml.parsers.expat.ExpatError) as error:

1530

logger.error("Failed to override Introspection method",

1531

exc_info=error)

1532

return xmlstring

1533

1534

1535

def datetime_to_dbus(dt, variant_level=0):

1016

def datetime_to_dbus (dt, variant_level=0):

1536

1017

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1537

1018

if dt is None:

1538

return dbus.String("", variant_level=variant_level)

1539

return dbus.String(dt.isoformat(), variant_level=variant_level)

1019

return dbus.String("", variant_level = variant_level)

1020

return dbus.String(dt.isoformat(),

1021

variant_level=variant_level)

1540

1022

1541

1023

1542

1024

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1544

1026

dbus.service.Object, it will add alternate D-Bus attributes with

1545

1027

interface names according to the "alt_interface_names" mapping.

1546

1028

Usage:

1547

1548

@alternate_dbus_interfaces({"org.example.Interface":

1549

"net.example.AlternateInterface"})

1029

1030

@alternate_dbus_names({"org.example.Interface":

1031

"net.example.AlternateInterface"})

1550

1032

class SampleDBusObject(dbus.service.Object):

1551

1033

@dbus.service.method("org.example.Interface")

1552

1034

def SampleDBusMethod():

1553

1035

pass

1554

1036

1555

1037

The above "SampleDBusMethod" on "SampleDBusObject" will be

1556

1038

reachable via two interfaces: "org.example.Interface" and

1557

1039

"net.example.AlternateInterface", the latter of which will have

1558

1040

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1559

1041

"true", unless "deprecate" is passed with a False value.

1560

1042

1561

1043

This works for methods and signals, and also for D-Bus properties

1562

1044

(from DBusObjectWithProperties) and interfaces (from the

1563

1045

dbus_interface_annotations decorator).

1564

1046

"""

1565

1566

1047

def wrapper(cls):

1567

1048

for orig_interface_name, alt_interface_name in (

1568

alt_interface_names.items()):

1049

alt_interface_names.iteritems()):

1569

1050

attr = {}

1570

1051

interface_names = set()

1571

1052

# Go though all attributes of the class

1573

1054

# Ignore non-D-Bus attributes, and D-Bus attributes

1574

1055

# with the wrong interface name

1575

1056

if (not hasattr(attribute, "_dbus_interface")

1576

or not attribute._dbus_interface.startswith(

1577

orig_interface_name)):

1057

or not attribute._dbus_interface

1058

.startswith(orig_interface_name)):

1578

1059

continue

1579

1060

# Create an alternate D-Bus interface name based on

1580

1061

# the current name

1581

alt_interface = attribute._dbus_interface.replace(

1582

orig_interface_name, alt_interface_name)

1062

alt_interface = (attribute._dbus_interface

1063

.replace(orig_interface_name,

1064

alt_interface_name))

1583

1065

interface_names.add(alt_interface)

1584

1066

# Is this a D-Bus signal?

1585

1067

if getattr(attribute, "_dbus_is_signal", False):

1586

# Extract the original non-method undecorated

1587

# function by black magic

1588

if sys.version_info.major == 2:

1589

nonmethod_func = (dict(

1068

# Extract the original non-method function by

1069

# black magic

1070

nonmethod_func = (dict(

1590

1071

zip(attribute.func_code.co_freevars,

1591

attribute.__closure__))

1592

["func"].cell_contents)

1593

else:

1594

nonmethod_func = (dict(

1595

zip(attribute.__code__.co_freevars,

1596

attribute.__closure__))

1597

["func"].cell_contents)

1072

attribute.__closure__))["func"]

1073

.cell_contents)

1598

1074

# Create a new, but exactly alike, function

1599

1075

# object, and decorate it to be a new D-Bus signal

1600

1076

# with the alternate D-Bus interface name

1601

new_function = copy_function(nonmethod_func)

1602

new_function = (dbus.service.signal(

1603

alt_interface,

1604

attribute._dbus_signature)(new_function))

1077

new_function = (dbus.service.signal

1078

(alt_interface,

1079

attribute._dbus_signature)

1080

(types.FunctionType(

1081

nonmethod_func.func_code,

1082

nonmethod_func.func_globals,

1083

nonmethod_func.func_name,

1084

nonmethod_func.func_defaults,

1085

nonmethod_func.func_closure)))

1605

1086

# Copy annotations, if any

1606

1087

try:

1607

new_function._dbus_annotations = dict(

1608

attribute._dbus_annotations)

1088

new_function._dbus_annotations = (

1089

dict(attribute._dbus_annotations))

1609

1090

except AttributeError:

1610

1091

pass

1611

1612

1092

# Define a creator of a function to call both the

1613

1093

# original and alternate functions, so both the

1614

1094

# original and alternate signals gets sent when

1617

1097

"""This function is a scope container to pass

1618

1098

func1 and func2 to the "call_both" function

1619

1099

outside of its arguments"""

1620

1621

@functools.wraps(func2)

1622

1100

def call_both(*args, **kwargs):

1623

1101

"""This function will emit two D-Bus

1624

1102

signals by calling func1 and func2"""

1625

1103

func1(*args, **kwargs)

1626

1104

func2(*args, **kwargs)

1627

# Make wrapper function look like a D-Bus

1628

# signal

1629

for name, attr in inspect.getmembers(func2):

1630

if name.startswith("_dbus_"):

1631

setattr(call_both, name, attr)

1632

1633

1105

return call_both

1634

1106

# Create the "call_both" function and add it to

1635

1107

# the class

1640

1112

# object. Decorate it to be a new D-Bus method

1641

1113

# with the alternate D-Bus interface name. Add it

1642

1114

# to the class.

1643

attr[attrname] = (

1644

dbus.service.method(

1645

alt_interface,

1646

attribute._dbus_in_signature,

1647

attribute._dbus_out_signature)

1648

(copy_function(attribute)))

1115

attr[attrname] = (dbus.service.method

1116

(alt_interface,

1117

attribute._dbus_in_signature,

1118

attribute._dbus_out_signature)

1119

(types.FunctionType

1120

(attribute.func_code,

1121

attribute.func_globals,

1122

attribute.func_name,

1123

attribute.func_defaults,

1124

attribute.func_closure)))

1649

1125

# Copy annotations, if any

1650

1126

try:

1651

attr[attrname]._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1127

attr[attrname]._dbus_annotations = (

1128

dict(attribute._dbus_annotations))

1653

1129

except AttributeError:

1654

1130

pass

1655

1131

# Is this a D-Bus property?

1658

1134

# object, and decorate it to be a new D-Bus

1659

1135

# property with the alternate D-Bus interface

1660

1136

# name. Add it to the class.

1661

attr[attrname] = (dbus_service_property(

1662

alt_interface, attribute._dbus_signature,

1663

attribute._dbus_access,

1664

attribute._dbus_get_args_options

1665

["byte_arrays"])

1666

(copy_function(attribute)))

1137

attr[attrname] = (dbus_service_property

1138

(alt_interface,

1139

attribute._dbus_signature,

1140

attribute._dbus_access,

1141

attribute

1142

._dbus_get_args_options

1143

["byte_arrays"])

1144

(types.FunctionType

1145

(attribute.func_code,

1146

attribute.func_globals,

1147

attribute.func_name,

1148

attribute.func_defaults,

1149

attribute.func_closure)))

1667

1150

# Copy annotations, if any

1668

1151

try:

1669

attr[attrname]._dbus_annotations = dict(

1670

attribute._dbus_annotations)

1152

attr[attrname]._dbus_annotations = (

1153

dict(attribute._dbus_annotations))

1671

1154

except AttributeError:

1672

1155

pass

1673

1156

# Is this a D-Bus interface?

1676

1159

# object. Decorate it to be a new D-Bus interface

1677

1160

# with the alternate D-Bus interface name. Add it

1678

1161

# to the class.

1679

attr[attrname] = (

1680

dbus_interface_annotations(alt_interface)

1681

(copy_function(attribute)))

1162

attr[attrname] = (dbus_interface_annotations

1163

(alt_interface)

1164

(types.FunctionType

1165

(attribute.func_code,

1166

attribute.func_globals,

1167

attribute.func_name,

1168

attribute.func_defaults,

1169

attribute.func_closure)))

1682

1170

if deprecate:

1683

1171

# Deprecate all alternate interfaces

1684

iname = "_AlternateDBusNames_interface_annotation{}"

1172

iname="_AlternateDBusNames_interface_annotation{0}"

1685

1173

for interface_name in interface_names:

1686

1687

1174

@dbus_interface_annotations(interface_name)

1688

1175

def func(self):

1689

return {"org.freedesktop.DBus.Deprecated":

1690

"true"}

1176

return { "org.freedesktop.DBus.Deprecated":

1177

"true" }

1691

1178

# Find an unused name

1692

1179

for aname in (iname.format(i)

1693

1180

for i in itertools.count()):

1697

1184

if interface_names:

1698

1185

# Replace the class with a new subclass of it with

1699

1186

# methods, signals, etc. as created above.

1700

if sys.version_info.major == 2:

1701

cls = type(b"{}Alternate".format(cls.__name__),

1702

(cls, ), attr)

1703

else:

1704

cls = type("{}Alternate".format(cls.__name__),

1705

(cls, ), attr)

1187

cls = type(b"{0}Alternate".format(cls.__name__),

1188

(cls,), attr)

1706

1189

return cls

1707

1708

1190

return wrapper

1709

1191

1710

1192

1711

1193

@alternate_dbus_interfaces({"se.recompile.Mandos":

1712

"se.bsnet.fukt.Mandos"})

1194

"se.bsnet.fukt.Mandos"})

1713

1195

class ClientDBus(Client, DBusObjectWithProperties):

1714

1196

"""A Client class using D-Bus

1715

1197

1716

1198

Attributes:

1717

1199

dbus_object_path: dbus.ObjectPath

1718

1200

bus: dbus.SystemBus()

1719

1201

"""

1720

1202

1721

1203

runtime_expansions = (Client.runtime_expansions

1722

+ ("dbus_object_path", ))

1723

1724

_interface = "se.recompile.Mandos.Client"

1725

1204

+ ("dbus_object_path",))

1205

1726

1206

# dbus.service.Object doesn't use super(), so we can't either.

1727

1728

def __init__(self, bus=None, *args, **kwargs):

1207

1208

def __init__(self, bus = None, *args, **kwargs):

1729

1209

self.bus = bus

1730

1210

Client.__init__(self, *args, **kwargs)

1731

1211

# Only now, when this client is initialized, can it show up on

1732

1212

# the D-Bus

1733

client_object_name = str(self.name).translate(

1213

client_object_name = unicode(self.name).translate(

1734

1214

{ord("."): ord("_"),

1735

1215

ord("-"): ord("_")})

1736

self.dbus_object_path = dbus.ObjectPath(

1737

"/clients/" + client_object_name)

1216

self.dbus_object_path = (dbus.ObjectPath

1217

("/clients/" + client_object_name))

1738

1218

DBusObjectWithProperties.__init__(self, self.bus,

1739

1219

self.dbus_object_path)

1740

1741

def notifychangeproperty(transform_func, dbus_name,

1742

type_func=lambda x: x,

1743

variant_level=1,

1744

invalidate_only=False,

1745

_interface=_interface):

1220

1221

def notifychangeproperty(transform_func,

1222

dbus_name, type_func=lambda x: x,

1223

variant_level=1):

1746

1224

""" Modify a variable so that it's a property which announces

1747

1225

its changes to DBus.

1748

1226

1749

1227

transform_fun: Function that takes a value and a variant_level

1750

1228

and transforms it to a D-Bus type.

1751

1229

dbus_name: D-Bus name of the variable

1753

1231

to the D-Bus. Default: no transform

1754

1232

variant_level: D-Bus variant level. Default: 1

1755

1233

"""

1756

attrname = "_{}".format(dbus_name)

1757

1234

attrname = "_{0}".format(dbus_name)

1758

1235

def setter(self, value):

1759

1236

if hasattr(self, "dbus_object_path"):

1760

1237

if (not hasattr(self, attrname) or

1761

1238

type_func(getattr(self, attrname, None))

1762

1239

!= type_func(value)):

1763

if invalidate_only:

1764

self.PropertiesChanged(

1765

_interface, dbus.Dictionary(),

1766

dbus.Array((dbus_name, )))

1767

else:

1768

dbus_value = transform_func(

1769

type_func(value),

1770

variant_level=variant_level)

1771

self.PropertyChanged(dbus.String(dbus_name),

1772

dbus_value)

1773

self.PropertiesChanged(

1774

_interface,

1775

dbus.Dictionary({dbus.String(dbus_name):

1776

dbus_value}),

1777

dbus.Array())

1240

dbus_value = transform_func(type_func(value),

1241

variant_level

1242

=variant_level)

1243

self.PropertyChanged(dbus.String(dbus_name),

1244

dbus_value)

1778

1245

setattr(self, attrname, value)

1779

1246

1780

1247

return property(lambda self: getattr(self, attrname), setter)

1781

1248

1782

1249

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1783

1250

approvals_pending = notifychangeproperty(dbus.Boolean,

1784

1251

"ApprovalPending",

1785

type_func=bool)

1252

type_func = bool)

1786

1253

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1787

1254

last_enabled = notifychangeproperty(datetime_to_dbus,

1788

1255

"LastEnabled")

1789

checker = notifychangeproperty(

1790

dbus.Boolean, "CheckerRunning",

1791

type_func=lambda checker: checker is not None)

1256

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1257

type_func = lambda checker:

1258

checker is not None)

1792

1259

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1793

1260

"LastCheckedOK")

1794

1261

last_checker_status = notifychangeproperty(dbus.Int16,

1797

1264

datetime_to_dbus, "LastApprovalRequest")

1798

1265

approved_by_default = notifychangeproperty(dbus.Boolean,

1799

1266

"ApprovedByDefault")

1800

approval_delay = notifychangeproperty(

1801

dbus.UInt64, "ApprovalDelay",

1802

type_func=lambda td: td.total_seconds() * 1000)

1267

approval_delay = notifychangeproperty(dbus.UInt64,

1268

"ApprovalDelay",

1269

type_func =

1270

timedelta_to_milliseconds)

1803

1271

approval_duration = notifychangeproperty(

1804

1272

dbus.UInt64, "ApprovalDuration",

1805

type_func=lambda td: td.total_seconds() * 1000)

1273

type_func = timedelta_to_milliseconds)

1806

1274

host = notifychangeproperty(dbus.String, "Host")

1807

timeout = notifychangeproperty(

1808

dbus.UInt64, "Timeout",

1809

type_func=lambda td: td.total_seconds() * 1000)

1275

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1276

type_func =

1277

timedelta_to_milliseconds)

1810

1278

extended_timeout = notifychangeproperty(

1811

1279

dbus.UInt64, "ExtendedTimeout",

1812

type_func=lambda td: td.total_seconds() * 1000)

1813

interval = notifychangeproperty(

1814

dbus.UInt64, "Interval",

1815

type_func=lambda td: td.total_seconds() * 1000)

1280

type_func = timedelta_to_milliseconds)

1281

interval = notifychangeproperty(dbus.UInt64,

1282

"Interval",

1283

type_func =

1284

timedelta_to_milliseconds)

1816

1285

checker_command = notifychangeproperty(dbus.String, "Checker")

1817

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1818

invalidate_only=True)

1819

1286

1820

1287

del notifychangeproperty

1821

1288

1822

1289

def __del__(self, *args, **kwargs):

1823

1290

try:

1824

1291

self.remove_from_connection()

1827

1294

if hasattr(DBusObjectWithProperties, "__del__"):

1828

1295

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1829

1296

Client.__del__(self, *args, **kwargs)

1830

1831

def checker_callback(self, source, condition,

1832

connection, command, *args, **kwargs):

1833

ret = Client.checker_callback(self, source, condition,

1834

connection, command, *args,

1835

**kwargs)

1836

exitstatus = self.last_checker_status

1837

if exitstatus >= 0:

1297

1298

def checker_callback(self, pid, condition, command,

1299

*args, **kwargs):

1300

self.checker_callback_tag = None

1301

self.checker = None

1302

if os.WIFEXITED(condition):

1303

exitstatus = os.WEXITSTATUS(condition)

1838

1304

# Emit D-Bus signal

1839

1305

self.CheckerCompleted(dbus.Int16(exitstatus),

1840

# This is specific to GNU libC

1841

dbus.Int64(exitstatus << 8),

1306

dbus.Int64(condition),

1842

1307

dbus.String(command))

1843

1308

else:

1844

1309

# Emit D-Bus signal

1845

1310

self.CheckerCompleted(dbus.Int16(-1),

1846

dbus.Int64(

1847

# This is specific to GNU libC

1848

(exitstatus << 8)

1849

| self.last_checker_signal),

1311

dbus.Int64(condition),

1850

1312

dbus.String(command))

1851

return ret

1852

1313

1314

return Client.checker_callback(self, pid, condition, command,

1315

*args, **kwargs)

1316

1853

1317

def start_checker(self, *args, **kwargs):

1854

old_checker_pid = getattr(self.checker, "pid", None)

1318

old_checker = self.checker

1319

if self.checker is not None:

1320

old_checker_pid = self.checker.pid

1321

else:

1322

old_checker_pid = None

1855

1323

r = Client.start_checker(self, *args, **kwargs)

1856

1324

# Only if new checker process was started

1857

1325

if (self.checker is not None

1859

1327

# Emit D-Bus signal

1860

1328

self.CheckerStarted(self.current_checker_command)

1861

1329

return r

1862

1330

1863

1331

def _reset_approved(self):

1864

1332

self.approved = None

1865

1333

return False

1866

1334

1867

1335

def approve(self, value=True):

1336

self.send_changedstate()

1868

1337

self.approved = value

1869

GLib.timeout_add(int(self.approval_duration.total_seconds()

1870

* 1000), self._reset_approved)

1871

self.send_changedstate()

1872

1873

# D-Bus methods, signals & properties

1874

1875

# Interfaces

1876

1877

# Signals

1878

1338

gobject.timeout_add(timedelta_to_milliseconds

1339

(self.approval_duration),

1340

self._reset_approved)

1341

1342

## D-Bus methods, signals & properties

1343

_interface = "se.recompile.Mandos.Client"

1344

1345

## Interfaces

1346

1347

@dbus_interface_annotations(_interface)

1348

def _foo(self):

1349

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1350

"false"}

1351

1352

## Signals

1353

1879

1354

# CheckerCompleted - signal

1880

1355

@dbus.service.signal(_interface, signature="nxs")

1881

1356

def CheckerCompleted(self, exitcode, waitstatus, command):

1882

1357

"D-Bus signal"

1883

1358

pass

1884

1359

1885

1360

# CheckerStarted - signal

1886

1361

@dbus.service.signal(_interface, signature="s")

1887

1362

def CheckerStarted(self, command):

1888

1363

"D-Bus signal"

1889

1364

pass

1890

1365

1891

1366

# PropertyChanged - signal

1892

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1893

1367

@dbus.service.signal(_interface, signature="sv")

1894

1368

def PropertyChanged(self, property, value):

1895

1369

"D-Bus signal"

1896

1370

pass

1897

1371

1898

1372

# GotSecret - signal

1899

1373

@dbus.service.signal(_interface)

1900

1374

def GotSecret(self):

1903

1377

server to mandos-client

1904

1378

"""

1905

1379

pass

1906

1380

1907

1381

# Rejected - signal

1908

1382

@dbus.service.signal(_interface, signature="s")

1909

1383

def Rejected(self, reason):

1910

1384

"D-Bus signal"

1911

1385

pass

1912

1386

1913

1387

# NeedApproval - signal

1914

1388

@dbus.service.signal(_interface, signature="tb")

1915

1389

def NeedApproval(self, timeout, default):

1916

1390

"D-Bus signal"

1917

1391

return self.need_approval()

1918

1919

# Methods

1920

1392

1393

## Methods

1394

1921

1395

# Approve - method

1922

1396

@dbus.service.method(_interface, in_signature="b")

1923

1397

def Approve(self, value):

1924

1398

self.approve(value)

1925

1399

1926

1400

# CheckedOK - method

1927

1401

@dbus.service.method(_interface)

1928

1402

def CheckedOK(self):

1929

1403

self.checked_ok()

1930

1404

1931

1405

# Enable - method

1932

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1933

1406

@dbus.service.method(_interface)

1934

1407

def Enable(self):

1935

1408

"D-Bus method"

1936

1409

self.enable()

1937

1410

1938

1411

# StartChecker - method

1939

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1940

1412

@dbus.service.method(_interface)

1941

1413

def StartChecker(self):

1942

1414

"D-Bus method"

1943

1415

self.start_checker()

1944

1416

1945

1417

# Disable - method

1946

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1947

1418

@dbus.service.method(_interface)

1948

1419

def Disable(self):

1949

1420

"D-Bus method"

1950

1421

self.disable()

1951

1422

1952

1423

# StopChecker - method

1953

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1954

1424

@dbus.service.method(_interface)

1955

1425

def StopChecker(self):

1956

1426

self.stop_checker()

1957

1958

# Properties

1959

1427

1428

## Properties

1429

1960

1430

# ApprovalPending - property

1961

1431

@dbus_service_property(_interface, signature="b", access="read")

1962

1432

def ApprovalPending_dbus_property(self):

1963

1433

return dbus.Boolean(bool(self.approvals_pending))

1964

1434

1965

1435

# ApprovedByDefault - property

1966

@dbus_service_property(_interface,

1967

signature="b",

1436

@dbus_service_property(_interface, signature="b",

1968

1437

access="readwrite")

1969

1438

def ApprovedByDefault_dbus_property(self, value=None):

1970

1439

if value is None: # get

1971

1440

return dbus.Boolean(self.approved_by_default)

1972

1441

self.approved_by_default = bool(value)

1973

1442

1974

1443

# ApprovalDelay - property

1975

@dbus_service_property(_interface,

1976

signature="t",

1444

@dbus_service_property(_interface, signature="t",

1977

1445

access="readwrite")

1978

1446

def ApprovalDelay_dbus_property(self, value=None):

1979

1447

if value is None: # get

1980

return dbus.UInt64(self.approval_delay.total_seconds()

1981

* 1000)

1448

return dbus.UInt64(self.approval_delay_milliseconds())

1982

1449

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1983

1450

1984

1451

# ApprovalDuration - property

1985

@dbus_service_property(_interface,

1986

signature="t",

1452

@dbus_service_property(_interface, signature="t",

1987

1453

access="readwrite")

1988

1454

def ApprovalDuration_dbus_property(self, value=None):

1989

1455

if value is None: # get

1990

return dbus.UInt64(self.approval_duration.total_seconds()

1991

* 1000)

1456

return dbus.UInt64(timedelta_to_milliseconds(

1457

self.approval_duration))

1992

1458

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1993

1459

1994

1460

# Name - property

1995

@dbus_annotations(

1996

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1997

1461

@dbus_service_property(_interface, signature="s", access="read")

1998

1462

def Name_dbus_property(self):

1999

1463

return dbus.String(self.name)

2000

1464

2001

1465

# Fingerprint - property

2002

@dbus_annotations(

2003

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2004

1466

@dbus_service_property(_interface, signature="s", access="read")

2005

1467

def Fingerprint_dbus_property(self):

2006

1468

return dbus.String(self.fingerprint)

2007

1469

2008

1470

# Host - property

2009

@dbus_service_property(_interface,

2010

signature="s",

1471

@dbus_service_property(_interface, signature="s",

2011

1472

access="readwrite")

2012

1473

def Host_dbus_property(self, value=None):

2013

1474

if value is None: # get

2014

1475

return dbus.String(self.host)

2015

self.host = str(value)

2016

1476

self.host = unicode(value)

1477

2017

1478

# Created - property

2018

@dbus_annotations(

2019

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2020

1479

@dbus_service_property(_interface, signature="s", access="read")

2021

1480

def Created_dbus_property(self):

2022

1481

return datetime_to_dbus(self.created)

2023

1482

2024

1483

# LastEnabled - property

2025

1484

@dbus_service_property(_interface, signature="s", access="read")

2026

1485

def LastEnabled_dbus_property(self):

2027

1486

return datetime_to_dbus(self.last_enabled)

2028

1487

2029

1488

# Enabled - property

2030

@dbus_service_property(_interface,

2031

signature="b",

1489

@dbus_service_property(_interface, signature="b",

2032

1490

access="readwrite")

2033

1491

def Enabled_dbus_property(self, value=None):

2034

1492

if value is None: # get

2037

1495

self.enable()

2038

1496

else:

2039

1497

self.disable()

2040

1498

2041

1499

# LastCheckedOK - property

2042

@dbus_service_property(_interface,

2043

signature="s",

1500

@dbus_service_property(_interface, signature="s",

2044

1501

access="readwrite")

2045

1502

def LastCheckedOK_dbus_property(self, value=None):

2046

1503

if value is not None:

2047

1504

self.checked_ok()

2048

1505

return

2049

1506

return datetime_to_dbus(self.last_checked_ok)

2050

1507

2051

1508

# LastCheckerStatus - property

2052

@dbus_service_property(_interface, signature="n", access="read")

1509

@dbus_service_property(_interface, signature="n",

1510

access="read")

2053

1511

def LastCheckerStatus_dbus_property(self):

2054

1512

return dbus.Int16(self.last_checker_status)

2055

1513

2056

1514

# Expires - property

2057

1515

@dbus_service_property(_interface, signature="s", access="read")

2058

1516

def Expires_dbus_property(self):

2059

1517

return datetime_to_dbus(self.expires)

2060

1518

2061

1519

# LastApprovalRequest - property

2062

1520

@dbus_service_property(_interface, signature="s", access="read")

2063

1521

def LastApprovalRequest_dbus_property(self):

2064

1522

return datetime_to_dbus(self.last_approval_request)

2065

1523

2066

1524

# Timeout - property

2067

@dbus_service_property(_interface,

2068

signature="t",

1525

@dbus_service_property(_interface, signature="t",

2069

1526

access="readwrite")

2070

1527

def Timeout_dbus_property(self, value=None):

2071

1528

if value is None: # get

2072

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2073

old_timeout = self.timeout

1529

return dbus.UInt64(self.timeout_milliseconds())

2074

1530

self.timeout = datetime.timedelta(0, 0, 0, value)

2075

# Reschedule disabling

1531

# Reschedule timeout

2076

1532

if self.enabled:

2077

1533

now = datetime.datetime.utcnow()

2078

self.expires += self.timeout - old_timeout

2079

if self.expires <= now:

1534

time_to_die = timedelta_to_milliseconds(

1535

(self.last_checked_ok + self.timeout) - now)

1536

if time_to_die <= 0:

2080

1537

# The timeout has passed

2081

1538

self.disable()

2082

1539

else:

1540

self.expires = (now +

1541

datetime.timedelta(milliseconds =

1542

time_to_die))

2083

1543

if (getattr(self, "disable_initiator_tag", None)

2084

1544

is None):

2085

1545

return

2086

GLib.source_remove(self.disable_initiator_tag)

2087

self.disable_initiator_tag = GLib.timeout_add(

2088

int((self.expires - now).total_seconds() * 1000),

2089

self.disable)

2090

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (gobject.timeout_add

1548

(time_to_die,

1549

self.disable))

1550

2091

1551

# ExtendedTimeout - property

2092

@dbus_service_property(_interface,

2093

signature="t",

1552

@dbus_service_property(_interface, signature="t",

2094

1553

access="readwrite")

2095

1554

def ExtendedTimeout_dbus_property(self, value=None):

2096

1555

if value is None: # get

2097

return dbus.UInt64(self.extended_timeout.total_seconds()

2098

* 1000)

1556

return dbus.UInt64(self.extended_timeout_milliseconds())

2099

1557

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2100

1558

2101

1559

# Interval - property

2102

@dbus_service_property(_interface,

2103

signature="t",

1560

@dbus_service_property(_interface, signature="t",

2104

1561

access="readwrite")

2105

1562

def Interval_dbus_property(self, value=None):

2106

1563

if value is None: # get

2107

return dbus.UInt64(self.interval.total_seconds() * 1000)

1564

return dbus.UInt64(self.interval_milliseconds())

2108

1565

self.interval = datetime.timedelta(0, 0, 0, value)

2109

1566

if getattr(self, "checker_initiator_tag", None) is None:

2110

1567

return

2111

1568

if self.enabled:

2112

1569

# Reschedule checker run

2113

GLib.source_remove(self.checker_initiator_tag)

2114

self.checker_initiator_tag = GLib.timeout_add(

2115

value, self.start_checker)

2116

self.start_checker() # Start one now, too

2117

1570

gobject.source_remove(self.checker_initiator_tag)

1571

self.checker_initiator_tag = (gobject.timeout_add

1572

(value, self.start_checker))

1573

self.start_checker() # Start one now, too

1574

2118

1575

# Checker - property

2119

@dbus_service_property(_interface,

2120

signature="s",

1576

@dbus_service_property(_interface, signature="s",

2121

1577

access="readwrite")

2122

1578

def Checker_dbus_property(self, value=None):

2123

1579

if value is None: # get

2124

1580

return dbus.String(self.checker_command)

2125

self.checker_command = str(value)

2126

1581

self.checker_command = unicode(value)

1582

2127

1583

# CheckerRunning - property

2128

@dbus_service_property(_interface,

2129

signature="b",

1584

@dbus_service_property(_interface, signature="b",

2130

1585

access="readwrite")

2131

1586

def CheckerRunning_dbus_property(self, value=None):

2132

1587

if value is None: # get

2135

1590

self.start_checker()

2136

1591

else:

2137

1592

self.stop_checker()

2138

1593

2139

1594

# ObjectPath - property

2140

@dbus_annotations(

2141

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2142

"org.freedesktop.DBus.Deprecated": "true"})

2143

1595

@dbus_service_property(_interface, signature="o", access="read")

2144

1596

def ObjectPath_dbus_property(self):

2145

return self.dbus_object_path # is already a dbus.ObjectPath

2146

1597

return self.dbus_object_path # is already a dbus.ObjectPath

1598

2147

1599

# Secret = property

2148

@dbus_annotations(

2149

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2150

"invalidates"})

2151

@dbus_service_property(_interface,

2152

signature="ay",

2153

access="write",

2154

byte_arrays=True)

1600

@dbus_service_property(_interface, signature="ay",

1601

access="write", byte_arrays=True)

2155

1602

def Secret_dbus_property(self, value):

2156

self.secret = bytes(value)

2157

1603

self.secret = str(value)

1604

2158

1605

del _interface

2159

1606

2160

1607

2163

1610

self._pipe = child_pipe

2164

1611

self._pipe.send(('init', fpr, address))

2165

1612

if not self._pipe.recv():

2166

raise KeyError(fpr)

2167

1613

raise KeyError()

1614

2168

1615

def __getattribute__(self, name):

2169

1616

if name == '_pipe':

2170

1617

return super(ProxyClient, self).__getattribute__(name)

2173

1620

if data[0] == 'data':

2174

1621

return data[1]

2175

1622

if data[0] == 'function':

2176

2177

1623

def func(*args, **kwargs):

2178

1624

self._pipe.send(('funcall', name, args, kwargs))

2179

1625

return self._pipe.recv()[1]

2180

2181

1626

return func

2182

1627

2183

1628

def __setattr__(self, name, value):

2184

1629

if name == '_pipe':

2185

1630

return super(ProxyClient, self).__setattr__(name, value)

2188

1633

2189

1634

class ClientHandler(socketserver.BaseRequestHandler, object):

2190

1635

"""A class to handle client connections.

2191

1636

2192

1637

Instantiated once for each connection to handle it.

2193

1638

Note: This will run in its own forked process."""

2194

1639

2195

1640

def handle(self):

2196

1641

with contextlib.closing(self.server.child_pipe) as child_pipe:

2197

1642

logger.info("TCP connection from: %s",

2198

str(self.client_address))

1643

unicode(self.client_address))

2199

1644

logger.debug("Pipe FD: %d",

2200

1645

self.server.child_pipe.fileno())

2201

2202

session = gnutls.ClientSession(self.request)

2203

2204

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2205

# "+AES-256-CBC", "+SHA1",

2206

# "+COMP-NULL", "+CTYPE-OPENPGP",

2207

# "+DHE-DSS"))

1646

1647

session = (gnutls.connection

1648

.ClientSession(self.request,

1649

gnutls.connection

1650

.X509Credentials()))

1651

1652

# Note: gnutls.connection.X509Credentials is really a

1653

# generic GnuTLS certificate credentials object so long as

1654

# no X.509 keys are added to it. Therefore, we can use it

1655

# here despite using OpenPGP certificates.

1656

1657

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1658

# "+AES-256-CBC", "+SHA1",

1659

# "+COMP-NULL", "+CTYPE-OPENPGP",

1660

# "+DHE-DSS"))

2208

1661

# Use a fallback default, since this MUST be set.

2209

1662

priority = self.server.gnutls_priority

2210

1663

if priority is None:

2211

1664

priority = "NORMAL"

2212

gnutls.priority_set_direct(session._c_object,

2213

priority.encode("utf-8"),

2214

None)

2215

1665

(gnutls.library.functions

1666

.gnutls_priority_set_direct(session._c_object,

1667

priority, None))

1668

2216

1669

# Start communication using the Mandos protocol

2217

1670

# Get protocol number

2218

1671

line = self.request.makefile().readline()

2219

1672

logger.debug("Protocol version: %r", line)

2220

1673

try:

2221

1674

if int(line.strip().split()[0]) > 1:

2222

raise RuntimeError(line)

1675

raise RuntimeError

2223

1676

except (ValueError, IndexError, RuntimeError) as error:

2224

1677

logger.error("Unknown protocol version: %s", error)

2225

1678

return

2226

1679

2227

1680

# Start GnuTLS connection

2228

1681

try:

2229

1682

session.handshake()

2230

except gnutls.Error as error:

1683

except gnutls.errors.GNUTLSError as error:

2231

1684

logger.warning("Handshake failed: %s", error)

2232

1685

# Do not run session.bye() here: the session is not

2233

1686

# established. Just abandon the request.

2234

1687

return

2235

1688

logger.debug("Handshake succeeded")

2236

1689

2237

1690

approval_required = False

2238

1691

try:

2239

1692

try:

2240

fpr = self.fingerprint(

2241

self.peer_certificate(session))

2242

except (TypeError, gnutls.Error) as error:

1693

fpr = self.fingerprint(self.peer_certificate

1694

(session))

1695

except (TypeError,

1696

gnutls.errors.GNUTLSError) as error:

2243

1697

logger.warning("Bad certificate: %s", error)

2244

1698

return

2245

1699

logger.debug("Fingerprint: %s", fpr)

2246

1700

2247

1701

try:

2248

1702

client = ProxyClient(child_pipe, fpr,

2249

1703

self.client_address)

2250

1704

except KeyError:

2251

1705

return

2252

1706

2253

1707

if client.approval_delay:

2254

1708

delay = client.approval_delay

2255

1709

client.approvals_pending += 1

2256

1710

approval_required = True

2257

1711

2258

1712

while True:

2259

1713

if not client.enabled:

2260

1714

logger.info("Client %s is disabled",

2261

client.name)

1715

client.name)

2262

1716

if self.server.use_dbus:

2263

1717

# Emit D-Bus signal

2264

1718

client.Rejected("Disabled")

2265

1719

return

2266

1720

2267

1721

if client.approved or not client.approval_delay:

2268

# We are approved or approval is disabled

1722

#We are approved or approval is disabled

2269

1723

break

2270

1724

elif client.approved is None:

2271

1725

logger.info("Client %s needs approval",

2273

1727

if self.server.use_dbus:

2274

1728

# Emit D-Bus signal

2275

1729

client.NeedApproval(

2276

client.approval_delay.total_seconds()

2277

* 1000, client.approved_by_default)

1730

client.approval_delay_milliseconds(),

1731

client.approved_by_default)

2278

1732

else:

2279

1733

logger.warning("Client %s was not approved",

2280

1734

client.name)

2282

1736

# Emit D-Bus signal

2283

1737

client.Rejected("Denied")

2284

1738

return

2285

2286

# wait until timeout or approved

1739

1740

#wait until timeout or approved

2287

1741

time = datetime.datetime.now()

2288

1742

client.changedstate.acquire()

2289

client.changedstate.wait(delay.total_seconds())

1743

(client.changedstate.wait

1744

(float(client.timedelta_to_milliseconds(delay)

1745

/ 1000)))

2290

1746

client.changedstate.release()

2291

1747

time2 = datetime.datetime.now()

2292

1748

if (time2 - time) >= delay:

2302

1758

break

2303

1759

else:

2304

1760

delay -= time2 - time

2305

2306

try:

2307

session.send(client.secret)

2308

except gnutls.Error as error:

2309

logger.warning("gnutls send failed",

2310

exc_info=error)

2311

return

2312

1761

1762

sent_size = 0

1763

while sent_size < len(client.secret):

1764

try:

1765

sent = session.send(client.secret[sent_size:])

1766

except gnutls.errors.GNUTLSError as error:

1767

logger.warning("gnutls send failed",

1768

exc_info=error)

1769

return

1770

logger.debug("Sent: %d, remaining: %d",

1771

sent, len(client.secret)

1772

- (sent_size + sent))

1773

sent_size += sent

1774

2313

1775

logger.info("Sending secret to %s", client.name)

2314

1776

# bump the timeout using extended_timeout

2315

1777

client.bump_timeout(client.extended_timeout)

2316

1778

if self.server.use_dbus:

2317

1779

# Emit D-Bus signal

2318

1780

client.GotSecret()

2319

1781

2320

1782

finally:

2321

1783

if approval_required:

2322

1784

client.approvals_pending -= 1

2323

1785

try:

2324

1786

session.bye()

2325

except gnutls.Error as error:

1787

except gnutls.errors.GNUTLSError as error:

2326

1788

logger.warning("GnuTLS bye failed",

2327

1789

exc_info=error)

2328

1790

2329

1791

@staticmethod

2330

1792

def peer_certificate(session):

2331

1793

"Return the peer's OpenPGP certificate as a bytestring"

2332

1794

# If not an OpenPGP certificate...

2333

if (gnutls.certificate_type_get(session._c_object)

2334

!= gnutls.CRT_OPENPGP):

2335

# ...return invalid data

2336

return b""

1795

if (gnutls.library.functions

1796

.gnutls_certificate_type_get(session._c_object)

1797

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1798

# ...do the normal thing

1799

return session.peer_certificate

2337

1800

list_size = ctypes.c_uint(1)

2338

cert_list = (gnutls.certificate_get_peers

1801

cert_list = (gnutls.library.functions

1802

.gnutls_certificate_get_peers

2339

1803

(session._c_object, ctypes.byref(list_size)))

2340

1804

if not bool(cert_list) and list_size.value != 0:

2341

raise gnutls.Error("error getting peer certificate")

1805

raise gnutls.errors.GNUTLSError("error getting peer"

1806

" certificate")

2342

1807

if list_size.value == 0:

2343

1808

return None

2344

1809

cert = cert_list[0]

2345

1810

return ctypes.string_at(cert.data, cert.size)

2346

1811

2347

1812

@staticmethod

2348

1813

def fingerprint(openpgp):

2349

1814

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2350

1815

# New GnuTLS "datum" with the OpenPGP public key

2351

datum = gnutls.datum_t(

2352

ctypes.cast(ctypes.c_char_p(openpgp),

2353

ctypes.POINTER(ctypes.c_ubyte)),

2354

ctypes.c_uint(len(openpgp)))

1816

datum = (gnutls.library.types

1817

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1818

ctypes.POINTER

1819

(ctypes.c_ubyte)),

1820

ctypes.c_uint(len(openpgp))))

2355

1821

# New empty GnuTLS certificate

2356

crt = gnutls.openpgp_crt_t()

2357

gnutls.openpgp_crt_init(ctypes.byref(crt))

1822

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1823

(gnutls.library.functions

1824

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2358

1825

# Import the OpenPGP public key into the certificate

2359

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2360

gnutls.OPENPGP_FMT_RAW)

1826

(gnutls.library.functions

1827

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1828

gnutls.library.constants

1829

.GNUTLS_OPENPGP_FMT_RAW))

2361

1830

# Verify the self signature in the key

2362

1831

crtverify = ctypes.c_uint()

2363

gnutls.openpgp_crt_verify_self(crt, 0,

2364

ctypes.byref(crtverify))

1832

(gnutls.library.functions

1833

.gnutls_openpgp_crt_verify_self(crt, 0,

1834

ctypes.byref(crtverify)))

2365

1835

if crtverify.value != 0:

2366

gnutls.openpgp_crt_deinit(crt)

2367

raise gnutls.CertificateSecurityError("Verify failed")

1836

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1837

raise (gnutls.errors.CertificateSecurityError

1838

("Verify failed"))

2368

1839

# New buffer for the fingerprint

2369

1840

buf = ctypes.create_string_buffer(20)

2370

1841

buf_len = ctypes.c_size_t()

2371

1842

# Get the fingerprint from the certificate into the buffer

2372

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2373

ctypes.byref(buf_len))

1843

(gnutls.library.functions

1844

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1845

ctypes.byref(buf_len)))

2374

1846

# Deinit the certificate

2375

gnutls.openpgp_crt_deinit(crt)

1847

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2376

1848

# Convert the buffer to a Python bytestring

2377

1849

fpr = ctypes.string_at(buf, buf_len.value)

2378

1850

# Convert the bytestring to hexadecimal notation

2382

1854

2383

1855

class MultiprocessingMixIn(object):

2384

1856

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2385

2386

1857

def sub_process_main(self, request, address):

2387

1858

try:

2388

1859

self.finish_request(request, address)

2389

1860

except Exception:

2390

1861

self.handle_error(request, address)

2391

1862

self.close_request(request)

2392

1863

2393

1864

def process_request(self, request, address):

2394

1865

"""Start a new process to process the request."""

2395

proc = multiprocessing.Process(target=self.sub_process_main,

2396

args=(request, address))

1866

proc = multiprocessing.Process(target = self.sub_process_main,

1867

args = (request,

1868

address))

2397

1869

proc.start()

2398

1870

return proc

2399

1871

2400

1872

2401

1873

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2402

1874

""" adds a pipe to the MixIn """

2403

2404

1875

def process_request(self, request, client_address):

2405

1876

"""Overrides and wraps the original process_request().

2406

1877

2407

1878

This function creates a new pipe in self.pipe

2408

1879

"""

2409

1880

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2410

1881

2411

1882

proc = MultiprocessingMixIn.process_request(self, request,

2412

1883

client_address)

2413

1884

self.child_pipe.close()

2414

1885

self.add_pipe(parent_pipe, proc)

2415

1886

2416

1887

def add_pipe(self, parent_pipe, proc):

2417

1888

"""Dummy function; override as necessary"""

2418

raise NotImplementedError()

1889

raise NotImplementedError

2419

1890

2420

1891

2421

1892

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2422

1893

socketserver.TCPServer, object):

2423

1894

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2424

1895

2425

1896

Attributes:

2426

1897

enabled: Boolean; whether this server is activated yet

2427

1898

interface: None or a network interface name (string)

2428

1899

use_ipv6: Boolean; to use IPv6 or not

2429

1900

"""

2430

2431

1901

def __init__(self, server_address, RequestHandlerClass,

2432

interface=None,

2433

use_ipv6=True,

2434

socketfd=None):

2435

"""If socketfd is set, use that file descriptor instead of

2436

creating a new one with socket.socket().

2437

"""

1902

interface=None, use_ipv6=True):

2438

1903

self.interface = interface

2439

1904

if use_ipv6:

2440

1905

self.address_family = socket.AF_INET6

2441

if socketfd is not None:

2442

# Save the file descriptor

2443

self.socketfd = socketfd

2444

# Save the original socket.socket() function

2445

self.socket_socket = socket.socket

2446

2447

# To implement --socket, we monkey patch socket.socket.

2448

#

2449

# (When socketserver.TCPServer is a new-style class, we

2450

# could make self.socket into a property instead of monkey

2451

# patching socket.socket.)

2452

#

2453

# Create a one-time-only replacement for socket.socket()

2454

@functools.wraps(socket.socket)

2455

def socket_wrapper(*args, **kwargs):

2456

# Restore original function so subsequent calls are

2457

# not affected.

2458

socket.socket = self.socket_socket

2459

del self.socket_socket

2460

# This time only, return a new socket object from the

2461

# saved file descriptor.

2462

return socket.fromfd(self.socketfd, *args, **kwargs)

2463

# Replace socket.socket() function with wrapper

2464

socket.socket = socket_wrapper

2465

# The socketserver.TCPServer.__init__ will call

2466

# socket.socket(), which might be our replacement,

2467

# socket_wrapper(), if socketfd was set.

2468

1906

socketserver.TCPServer.__init__(self, server_address,

2469

1907

RequestHandlerClass)

2470

2471

1908

def server_bind(self):

2472

1909

"""This overrides the normal server_bind() function

2473

1910

to bind to an interface if one was specified, and also NOT to

2474

1911

bind to an address or port if they were not specified."""

2475

global SO_BINDTODEVICE

2476

1912

if self.interface is not None:

2477

1913

if SO_BINDTODEVICE is None:

2478

# Fall back to a hard-coded value which seems to be

2479

# common enough.

2480

logger.warning("SO_BINDTODEVICE not found, trying 25")

2481

SO_BINDTODEVICE = 25

2482

try:

2483

self.socket.setsockopt(

2484

socket.SOL_SOCKET, SO_BINDTODEVICE,

2485

(self.interface + "\0").encode("utf-8"))

2486

except socket.error as error:

2487

if error.errno == errno.EPERM:

2488

logger.error("No permission to bind to"

2489

" interface %s", self.interface)

2490

elif error.errno == errno.ENOPROTOOPT:

2491

logger.error("SO_BINDTODEVICE not available;"

2492

" cannot bind to interface %s",

2493

self.interface)

2494

elif error.errno == errno.ENODEV:

2495

logger.error("Interface %s does not exist,"

2496

" cannot bind", self.interface)

2497

else:

2498

raise

1914

logger.error("SO_BINDTODEVICE does not exist;"

1915

" cannot bind to interface %s",

1916

self.interface)

1917

else:

1918

try:

1919

self.socket.setsockopt(socket.SOL_SOCKET,

1920

SO_BINDTODEVICE,

1921

str(self.interface

1922

+ '\0'))

1923

except socket.error as error:

1924

if error[0] == errno.EPERM:

1925

logger.error("No permission to"

1926

" bind to interface %s",

1927

self.interface)

1928

elif error[0] == errno.ENOPROTOOPT:

1929

logger.error("SO_BINDTODEVICE not available;"

1930

" cannot bind to interface %s",

1931

self.interface)

1932

else:

1933

raise

2499

1934

# Only bind(2) the socket if we really need to.

2500

1935

if self.server_address[0] or self.server_address[1]:

2501

1936

if not self.server_address[0]:

2502

1937

if self.address_family == socket.AF_INET6:

2503

any_address = "::" # in6addr_any

1938

any_address = "::" # in6addr_any

2504

1939

else:

2505

any_address = "0.0.0.0" # INADDR_ANY

1940

any_address = socket.INADDR_ANY

2506

1941

self.server_address = (any_address,

2507

1942

self.server_address[1])

2508

1943

elif not self.server_address[1]:

2509

self.server_address = (self.server_address[0], 0)

1944

self.server_address = (self.server_address[0],

1945

0)

2510

1946

# if self.interface:

2511

1947

# self.server_address = (self.server_address[0],

2512

1948

# 0, # port

2518

1954

2519

1955

class MandosServer(IPv6_TCPServer):

2520

1956

"""Mandos server.

2521

1957

2522

1958

Attributes:

2523

1959

clients: set of Client objects

2524

1960

gnutls_priority GnuTLS priority string

2525

1961

use_dbus: Boolean; to emit D-Bus signals or not

2526

2527

Assumes a GLib.MainLoop event loop.

1962

1963

Assumes a gobject.MainLoop event loop.

2528

1964

"""

2529

2530

1965

def __init__(self, server_address, RequestHandlerClass,

2531

interface=None,

2532

use_ipv6=True,

2533

clients=None,

2534

gnutls_priority=None,

2535

use_dbus=True,

2536

socketfd=None):

1966

interface=None, use_ipv6=True, clients=None,

1967

gnutls_priority=None, use_dbus=True):

2537

1968

self.enabled = False

2538

1969

self.clients = clients

2539

1970

if self.clients is None:

2542

1973

self.gnutls_priority = gnutls_priority

2543

1974

IPv6_TCPServer.__init__(self, server_address,

2544

1975

RequestHandlerClass,

2545

interface=interface,

2546

use_ipv6=use_ipv6,

2547

socketfd=socketfd)

2548

1976

interface = interface,

1977

use_ipv6 = use_ipv6)

2549

1978

def server_activate(self):

2550

1979

if self.enabled:

2551

1980

return socketserver.TCPServer.server_activate(self)

2552

1981

2553

1982

def enable(self):

2554

1983

self.enabled = True

2555

1984

2556

1985

def add_pipe(self, parent_pipe, proc):

2557

1986

# Call "handle_ipc" for both data and EOF events

2558

GLib.io_add_watch(

2559

parent_pipe.fileno(),

2560

GLib.IO_IN | GLib.IO_HUP,

2561

functools.partial(self.handle_ipc,

2562

parent_pipe=parent_pipe,

2563

proc=proc))

2564

2565

def handle_ipc(self, source, condition,

2566

parent_pipe=None,

2567

proc=None,

2568

client_object=None):

1987

gobject.io_add_watch(parent_pipe.fileno(),

1988

gobject.IO_IN | gobject.IO_HUP,

1989

functools.partial(self.handle_ipc,

1990

parent_pipe =

1991

parent_pipe,

1992

proc = proc))

1993

1994

def handle_ipc(self, source, condition, parent_pipe=None,

1995

proc = None, client_object=None):

1996

condition_names = {

1997

gobject.IO_IN: "IN", # There is data to read.

1998

gobject.IO_OUT: "OUT", # Data can be written (without

1999

# blocking).

2000

gobject.IO_PRI: "PRI", # There is urgent data to read.

2001

gobject.IO_ERR: "ERR", # Error condition.

2002

gobject.IO_HUP: "HUP" # Hung up (the connection has been

2003

# broken, usually for pipes and

2004

# sockets).

2005

}

2006

conditions_string = ' | '.join(name

2007

for cond, name in

2008

condition_names.iteritems()

2009

if cond & condition)

2569

2010

# error, or the other end of multiprocessing.Pipe has closed

2570

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2011

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2571

2012

# Wait for other process to exit

2572

2013

proc.join()

2573

2014

return False

2574

2015

2575

2016

# Read a request from the child

2576

2017

request = parent_pipe.recv()

2577

2018

command = request[0]

2578

2019

2579

2020

if command == 'init':

2580

2021

fpr = request[1]

2581

2022

address = request[2]

2582

2583

for c in self.clients.values():

2023

2024

for c in self.clients.itervalues():

2584

2025

if c.fingerprint == fpr:

2585

2026

client = c

2586

2027

break

2593

2034

address[0])

2594

2035

parent_pipe.send(False)

2595

2036

return False

2596

2597

GLib.io_add_watch(

2598

parent_pipe.fileno(),

2599

GLib.IO_IN | GLib.IO_HUP,

2600

functools.partial(self.handle_ipc,

2601

parent_pipe=parent_pipe,

2602

proc=proc,

2603

client_object=client))

2037

2038

gobject.io_add_watch(parent_pipe.fileno(),

2039

gobject.IO_IN | gobject.IO_HUP,

2040

functools.partial(self.handle_ipc,

2041

parent_pipe =

2042

parent_pipe,

2043

proc = proc,

2044

client_object =

2045

client))

2604

2046

parent_pipe.send(True)

2605

2047

# remove the old hook in favor of the new above hook on

2606

2048

# same fileno

2609

2051

funcname = request[1]

2610

2052

args = request[2]

2611

2053

kwargs = request[3]

2612

2054

2613

2055

parent_pipe.send(('data', getattr(client_object,

2614

2056

funcname)(*args,

2615

**kwargs)))

2616

2057

**kwargs)))

2058

2617

2059

if command == 'getattr':

2618

2060

attrname = request[1]

2619

if isinstance(client_object.__getattribute__(attrname),

2620

collections.Callable):

2621

parent_pipe.send(('function', ))

2061

if callable(client_object.__getattribute__(attrname)):

2062

parent_pipe.send(('function',))

2622

2063

else:

2623

parent_pipe.send((

2624

'data', client_object.__getattribute__(attrname)))

2625

2064

parent_pipe.send(('data', client_object

2065

.__getattribute__(attrname)))

2066

2626

2067

if command == 'setattr':

2627

2068

attrname = request[1]

2628

2069

value = request[2]

2629

2070

setattr(client_object, attrname, value)

2630

2071

2631

2072

return True

2632

2073

2633

2074

2634

def rfc3339_duration_to_delta(duration):

2635

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2636

2637

>>> rfc3339_duration_to_delta("P7D")

2638

datetime.timedelta(7)

2639

>>> rfc3339_duration_to_delta("PT60S")

2640

datetime.timedelta(0, 60)

2641

>>> rfc3339_duration_to_delta("PT60M")

2642

datetime.timedelta(0, 3600)

2643

>>> rfc3339_duration_to_delta("PT24H")

2644

datetime.timedelta(1)

2645

>>> rfc3339_duration_to_delta("P1W")

2646

datetime.timedelta(7)

2647

>>> rfc3339_duration_to_delta("PT5M30S")

2648

datetime.timedelta(0, 330)

2649

>>> rfc3339_duration_to_delta("P1DT3M20S")

2650

datetime.timedelta(1, 200)

2651

"""

2652

2653

# Parsing an RFC 3339 duration with regular expressions is not

2654

# possible - there would have to be multiple places for the same

2655

# values, like seconds. The current code, while more esoteric, is

2656

# cleaner without depending on a parsing library. If Python had a

2657

# built-in library for parsing we would use it, but we'd like to

2658

# avoid excessive use of external libraries.

2659

2660

# New type for defining tokens, syntax, and semantics all-in-one

2661

Token = collections.namedtuple("Token", (

2662

"regexp", # To match token; if "value" is not None, must have

2663

# a "group" containing digits

2664

"value", # datetime.timedelta or None

2665

"followers")) # Tokens valid after this token

2666

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2667

# the "duration" ABNF definition in RFC 3339, Appendix A.

2668

token_end = Token(re.compile(r"$"), None, frozenset())

2669

token_second = Token(re.compile(r"(\d+)S"),

2670

datetime.timedelta(seconds=1),

2671

frozenset((token_end, )))

2672

token_minute = Token(re.compile(r"(\d+)M"),

2673

datetime.timedelta(minutes=1),

2674

frozenset((token_second, token_end)))

2675

token_hour = Token(re.compile(r"(\d+)H"),

2676

datetime.timedelta(hours=1),

2677

frozenset((token_minute, token_end)))

2678

token_time = Token(re.compile(r"T"),

2679

None,

2680

frozenset((token_hour, token_minute,

2681

token_second)))

2682

token_day = Token(re.compile(r"(\d+)D"),

2683

datetime.timedelta(days=1),

2684

frozenset((token_time, token_end)))

2685

token_month = Token(re.compile(r"(\d+)M"),

2686

datetime.timedelta(weeks=4),

2687

frozenset((token_day, token_end)))

2688

token_year = Token(re.compile(r"(\d+)Y"),

2689

datetime.timedelta(weeks=52),

2690

frozenset((token_month, token_end)))

2691

token_week = Token(re.compile(r"(\d+)W"),

2692

datetime.timedelta(weeks=1),

2693

frozenset((token_end, )))

2694

token_duration = Token(re.compile(r"P"), None,

2695

frozenset((token_year, token_month,

2696

token_day, token_time,

2697

token_week)))

2698

# Define starting values:

2699

# Value so far

2700

value = datetime.timedelta()

2701

found_token = None

2702

# Following valid tokens

2703

followers = frozenset((token_duration, ))

2704

# String left to parse

2705

s = duration

2706

# Loop until end token is found

2707

while found_token is not token_end:

2708

# Search for any currently valid tokens

2709

for token in followers:

2710

match = token.regexp.match(s)

2711

if match is not None:

2712

# Token found

2713

if token.value is not None:

2714

# Value found, parse digits

2715

factor = int(match.group(1), 10)

2716

# Add to value so far

2717

value += factor * token.value

2718

# Strip token from string

2719

s = token.regexp.sub("", s, 1)

2720

# Go to found token

2721

found_token = token

2722

# Set valid next tokens

2723

followers = found_token.followers

2724

break

2725

else:

2726

# No currently valid tokens were found

2727

raise ValueError("Invalid RFC 3339 duration: {!r}"

2728

.format(duration))

2729

# End token found

2730

return value

2731

2732

2733

2075

def string_to_delta(interval):

2734

2076

"""Parse a string and return a datetime.timedelta

2735

2077

2736

2078

>>> string_to_delta('7d')

2737

2079

datetime.timedelta(7)

2738

2080

>>> string_to_delta('60s')

2746

2088

>>> string_to_delta('5m 30s')

2747

2089

datetime.timedelta(0, 330)

2748

2090

"""

2749

2750

try:

2751

return rfc3339_duration_to_delta(interval)

2752

except ValueError:

2753

pass

2754

2755

2091

timevalue = datetime.timedelta(0)

2756

2092

for s in interval.split():

2757

2093

try:

2758

suffix = s[-1]

2094

suffix = unicode(s[-1])

2759

2095

value = int(s[:-1])

2760

2096

if suffix == "d":

2761

2097

delta = datetime.timedelta(value)

2768

2104

elif suffix == "w":

2769

2105

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2770

2106

else:

2771

raise ValueError("Unknown suffix {!r}".format(suffix))

2772

except IndexError as e:

2107

raise ValueError("Unknown suffix {0!r}"

2108

.format(suffix))

2109

except (ValueError, IndexError) as e:

2773

2110

raise ValueError(*(e.args))

2774

2111

timevalue += delta

2775

2112

return timevalue

2776

2113

2777

2114

2778

def daemon(nochdir=False, noclose=False):

2115

def daemon(nochdir = False, noclose = False):

2779

2116

"""See daemon(3). Standard BSD Unix function.

2780

2117

2781

2118

This should really exist as os.daemon, but it doesn't (yet)."""

2782

2119

if os.fork():

2783

2120

sys.exit()

2791

2128

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2792

2129

if not stat.S_ISCHR(os.fstat(null).st_mode):

2793

2130

raise OSError(errno.ENODEV,

2794

"{} not a character device"

2131

"{0} not a character device"

2795

2132

.format(os.devnull))

2796

2133

os.dup2(null, sys.stdin.fileno())

2797

2134

os.dup2(null, sys.stdout.fileno())

2801

2138

2802

2139

2803

2140

def main():

2804

2141

2805

2142

##################################################################

2806

2143

# Parsing of options, both command line and config file

2807

2144

2808

2145

parser = argparse.ArgumentParser()

2809

2146

parser.add_argument("-v", "--version", action="version",

2810

version="%(prog)s {}".format(version),

2147

version = "%(prog)s {0}".format(version),

2811

2148

help="show version number and exit")

2812

2149

parser.add_argument("-i", "--interface", metavar="IF",

2813

2150

help="Bind to interface IF")

2819

2156

help="Run self-test")

2820

2157

parser.add_argument("--debug", action="store_true",

2821

2158

help="Debug mode; run in foreground and log"

2822

" to terminal", default=None)

2159

" to terminal")

2823

2160

parser.add_argument("--debuglevel", metavar="LEVEL",

2824

2161

help="Debug level for stdout output")

2825

2162

parser.add_argument("--priority", help="GnuTLS"

2832

2169

" files")

2833

2170

parser.add_argument("--no-dbus", action="store_false",

2834

2171

dest="use_dbus", help="Do not provide D-Bus"

2835

" system bus interface", default=None)

2172

" system bus interface")

2836

2173

parser.add_argument("--no-ipv6", action="store_false",

2837

dest="use_ipv6", help="Do not use IPv6",

2838

default=None)

2174

dest="use_ipv6", help="Do not use IPv6")

2839

2175

parser.add_argument("--no-restore", action="store_false",

2840

2176

dest="restore", help="Do not restore stored"

2841

" state", default=None)

2842

parser.add_argument("--socket", type=int,

2843

help="Specify a file descriptor to a network"

2844

" socket to use instead of creating one")

2177

" state")

2845

2178

parser.add_argument("--statedir", metavar="DIR",

2846

2179

help="Directory to save/restore state in")

2847

parser.add_argument("--foreground", action="store_true",

2848

help="Run in foreground", default=None)

2849

parser.add_argument("--no-zeroconf", action="store_false",

2850

dest="zeroconf", help="Do not use Zeroconf",

2851

default=None)

2852

2180

2853

2181

options = parser.parse_args()

2854

2182

2855

2183

if options.check:

2856

2184

import doctest

2857

fail_count, test_count = doctest.testmod()

2858

sys.exit(os.EX_OK if fail_count == 0 else 1)

2859

2185

doctest.testmod()

2186

sys.exit()

2187

2860

2188

# Default values for config file for server-global settings

2861

server_defaults = {"interface": "",

2862

"address": "",

2863

"port": "",

2864

"debug": "False",

2865

"priority":

2866

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2867

":+SIGN-DSA-SHA256",

2868

"servicename": "Mandos",

2869

"use_dbus": "True",

2870

"use_ipv6": "True",

2871

"debuglevel": "",

2872

"restore": "True",

2873

"socket": "",

2874

"statedir": "/var/lib/mandos",

2875

"foreground": "False",

2876

"zeroconf": "True",

2877

}

2878

2189

server_defaults = { "interface": "",

2190

"address": "",

2191

"port": "",

2192

"debug": "False",

2193

"priority":

2194

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2195

"servicename": "Mandos",

2196

"use_dbus": "True",

2197

"use_ipv6": "True",

2198

"debuglevel": "",

2199

"restore": "True",

2200

"statedir": "/var/lib/mandos"

2201

}

2202

2879

2203

# Parse config file for server-global settings

2880

2204

server_config = configparser.SafeConfigParser(server_defaults)

2881

2205

del server_defaults

2882

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2206

server_config.read(os.path.join(options.configdir,

2207

"mandos.conf"))

2883

2208

# Convert the SafeConfigParser object to a dict

2884

2209

server_settings = server_config.defaults()

2885

2210

# Use the appropriate methods on the non-string config options

2886

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2211

for option in ("debug", "use_dbus", "use_ipv6"):

2887

2212

server_settings[option] = server_config.getboolean("DEFAULT",

2888

2213

option)

2889

2214

if server_settings["port"]:

2890

2215

server_settings["port"] = server_config.getint("DEFAULT",

2891

2216

"port")

2892

if server_settings["socket"]:

2893

server_settings["socket"] = server_config.getint("DEFAULT",

2894

"socket")

2895

# Later, stdin will, and stdout and stderr might, be dup'ed

2896

# over with an opened os.devnull. But we don't want this to

2897

# happen with a supplied network socket.

2898

if 0 <= server_settings["socket"] <= 2:

2899

server_settings["socket"] = os.dup(server_settings

2900

["socket"])

2901

2217

del server_config

2902

2218

2903

2219

# Override the settings from the config file with command line

2904

2220

# options, if set.

2905

2221

for option in ("interface", "address", "port", "debug",

2906

"priority", "servicename", "configdir", "use_dbus",

2907

"use_ipv6", "debuglevel", "restore", "statedir",

2908

"socket", "foreground", "zeroconf"):

2222

"priority", "servicename", "configdir",

2223

"use_dbus", "use_ipv6", "debuglevel", "restore",

2224

"statedir"):

2909

2225

value = getattr(options, option)

2910

2226

if value is not None:

2911

2227

server_settings[option] = value

2912

2228

del options

2913

2229

# Force all strings to be unicode

2914

2230

for option in server_settings.keys():

2915

if isinstance(server_settings[option], bytes):

2916

server_settings[option] = (server_settings[option]

2917

.decode("utf-8"))

2918

# Force all boolean options to be boolean

2919

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2920

"foreground", "zeroconf"):

2921

server_settings[option] = bool(server_settings[option])

2922

# Debug implies foreground

2923

if server_settings["debug"]:

2924

server_settings["foreground"] = True

2231

if type(server_settings[option]) is str:

2232

server_settings[option] = unicode(server_settings[option])

2925

2233

# Now we have our good server settings in "server_settings"

2926

2234

2927

2235

##################################################################

2928

2929

if (not server_settings["zeroconf"]

2930

and not (server_settings["port"]

2931

or server_settings["socket"] != "")):

2932

parser.error("Needs port or socket to work without Zeroconf")

2933

2236

2934

2237

# For convenience

2935

2238

debug = server_settings["debug"]

2936

2239

debuglevel = server_settings["debuglevel"]

2938

2241

use_ipv6 = server_settings["use_ipv6"]

2939

2242

stored_state_path = os.path.join(server_settings["statedir"],

2940

2243

stored_state_file)

2941

foreground = server_settings["foreground"]

2942

zeroconf = server_settings["zeroconf"]

2943

2244

2944

2245

if debug:

2945

2246

initlogger(debug, logging.DEBUG)

2946

2247

else:

2949

2250

else:

2950

2251

level = getattr(logging, debuglevel.upper())

2951

2252

initlogger(debug, level)

2952

2253

2953

2254

if server_settings["servicename"] != "Mandos":

2954

syslogger.setFormatter(

2955

logging.Formatter('Mandos ({}) [%(process)d]:'

2956

' %(levelname)s: %(message)s'.format(

2957

server_settings["servicename"])))

2958

2255

syslogger.setFormatter(logging.Formatter

2256

('Mandos ({0}) [%(process)d]:'

2257

' %(levelname)s: %(message)s'

2258

.format(server_settings

2259

["servicename"])))

2260

2959

2261

# Parse config file with clients

2960

2262

client_config = configparser.SafeConfigParser(Client

2961

2263

.client_defaults)

2962

2264

client_config.read(os.path.join(server_settings["configdir"],

2963

2265

"clients.conf"))

2964

2266

2965

2267

global mandos_dbus_service

2966

2268

mandos_dbus_service = None

2967

2968

socketfd = None

2969

if server_settings["socket"] != "":

2970

socketfd = server_settings["socket"]

2971

tcp_server = MandosServer(

2972

(server_settings["address"], server_settings["port"]),

2973

ClientHandler,

2974

interface=(server_settings["interface"] or None),

2975

use_ipv6=use_ipv6,

2976

gnutls_priority=server_settings["priority"],

2977

use_dbus=use_dbus,

2978

socketfd=socketfd)

2979

if not foreground:

2980

pidfilename = "/run/mandos.pid"

2981

if not os.path.isdir("/run/."):

2982

pidfilename = "/var/run/mandos.pid"

2983

pidfile = None

2269

2270

tcp_server = MandosServer((server_settings["address"],

2271

server_settings["port"]),

2272

ClientHandler,

2273

interface=(server_settings["interface"]

2274

or None),

2275

use_ipv6=use_ipv6,

2276

gnutls_priority=

2277

server_settings["priority"],

2278

use_dbus=use_dbus)

2279

if not debug:

2280

pidfilename = "/var/run/mandos.pid"

2984

2281

try:

2985

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2282

pidfile = open(pidfilename, "w")

2986

2283

except IOError as e:

2987

2284

logger.error("Could not open file %r", pidfilename,

2988

2285

exc_info=e)

2989

2990

for name, group in (("_mandos", "_mandos"),

2991

("mandos", "mandos"),

2992

("nobody", "nogroup")):

2286

2287

for name in ("_mandos", "mandos", "nobody"):

2993

2288

try:

2994

2289

uid = pwd.getpwnam(name).pw_uid

2995

gid = pwd.getpwnam(group).pw_gid

2290

gid = pwd.getpwnam(name).pw_gid

2996

2291

break

2997

2292

except KeyError:

2998

2293

continue

3002

2297

try:

3003

2298

os.setgid(gid)

3004

2299

os.setuid(uid)

3005

if debug:

3006

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3007

gid))

3008

2300

except OSError as error:

3009

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3010

.format(uid, gid, os.strerror(error.errno)))

3011

if error.errno != errno.EPERM:

3012

raise

3013

2301

if error[0] != errno.EPERM:

2302

raise error

2303

3014

2304

if debug:

3015

2305

# Enable all possible GnuTLS debugging

3016

2306

3017

2307

# "Use a log level over 10 to enable all debugging options."

3018

2308

# - GnuTLS manual

3019

gnutls.global_set_log_level(11)

3020

3021

@gnutls.log_func

2309

gnutls.library.functions.gnutls_global_set_log_level(11)

2310

2311

@gnutls.library.types.gnutls_log_func

3022

2312

def debug_gnutls(level, string):

3023

2313

logger.debug("GnuTLS: %s", string[:-1])

3024

3025

gnutls.global_set_log_function(debug_gnutls)

3026

2314

2315

(gnutls.library.functions

2316

.gnutls_global_set_log_function(debug_gnutls))

2317

3027

2318

# Redirect stdin so all checkers get /dev/null

3028

2319

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3029

2320

os.dup2(null, sys.stdin.fileno())

3030

2321

if null > 2:

3031

2322

os.close(null)

3032

2323

3033

2324

# Need to fork before connecting to D-Bus

3034

if not foreground:

2325

if not debug:

3035

2326

# Close all input and output, do double fork, etc.

3036

2327

daemon()

3037

3038

# multiprocessing will use threads, so before we use GLib we need

3039

# to inform GLib that threads will be used.

3040

GLib.threads_init()

3041

2328

2329

gobject.threads_init()

2330

3042

2331

global main_loop

3043

2332

# From the Avahi example code

3044

2333

DBusGMainLoop(set_as_default=True)

3045

main_loop = GLib.MainLoop()

2334

main_loop = gobject.MainLoop()

3046

2335

bus = dbus.SystemBus()

3047

2336

# End of Avahi example code

3048

2337

if use_dbus:

3049

2338

try:

3050

2339

bus_name = dbus.service.BusName("se.recompile.Mandos",

3051

bus,

3052

do_not_queue=True)

3053

old_bus_name = dbus.service.BusName(

3054

"se.bsnet.fukt.Mandos", bus,

3055

do_not_queue=True)

3056

except dbus.exceptions.DBusException as e:

2340

bus, do_not_queue=True)

2341

old_bus_name = (dbus.service.BusName

2342

("se.bsnet.fukt.Mandos", bus,

2343

do_not_queue=True))

2344

except dbus.exceptions.NameExistsException as e:

3057

2345

logger.error("Disabling D-Bus:", exc_info=e)

3058

2346

use_dbus = False

3059

2347

server_settings["use_dbus"] = False

3060

2348

tcp_server.use_dbus = False

3061

if zeroconf:

3062

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3063

service = AvahiServiceToSyslog(

3064

name=server_settings["servicename"],

3065

servicetype="_mandos._tcp",

3066

protocol=protocol,

3067

bus=bus)

3068

if server_settings["interface"]:

3069

service.interface = if_nametoindex(

3070

server_settings["interface"].encode("utf-8"))

3071

2349

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2350

service = AvahiServiceToSyslog(name =

2351

server_settings["servicename"],

2352

servicetype = "_mandos._tcp",

2353

protocol = protocol, bus = bus)

2354

if server_settings["interface"]:

2355

service.interface = (if_nametoindex

2356

(str(server_settings["interface"])))

2357

3072

2358

global multiprocessing_manager

3073

2359

multiprocessing_manager = multiprocessing.Manager()

3074

2360

3075

2361

client_class = Client

3076

2362

if use_dbus:

3077

client_class = functools.partial(ClientDBus, bus=bus)

3078

2363

client_class = functools.partial(ClientDBus, bus = bus)

2364

3079

2365

client_settings = Client.config_parser(client_config)

3080

2366

old_client_settings = {}

3081

2367

clients_data = {}

3082

3083

# This is used to redirect stdout and stderr for checker processes

3084

global wnull

3085

wnull = open(os.devnull, "w") # A writable /dev/null

3086

# Only used if server is running in foreground but not in debug

3087

# mode

3088

if debug or not foreground:

3089

wnull.close()

3090

2368

3091

2369

# Get client data and settings from last running state.

3092

2370

if server_settings["restore"]:

3093

2371

try:

3094

2372

with open(stored_state_path, "rb") as stored_state:

3095

if sys.version_info.major == 2:

3096

clients_data, old_client_settings = pickle.load(

3097

stored_state)

3098

else:

3099

bytes_clients_data, bytes_old_client_settings = (

3100

pickle.load(stored_state, encoding="bytes"))

3101

# Fix bytes to strings

3102

# clients_data

3103

# .keys()

3104

clients_data = {(key.decode("utf-8")

3105

if isinstance(key, bytes)

3106

else key): value

3107

for key, value in

3108

bytes_clients_data.items()}

3109

del bytes_clients_data

3110

for key in clients_data:

3111

value = {(k.decode("utf-8")

3112

if isinstance(k, bytes) else k): v

3113

for k, v in

3114

clients_data[key].items()}

3115

clients_data[key] = value

3116

# .client_structure

3117

value["client_structure"] = [

3118

(s.decode("utf-8")

3119

if isinstance(s, bytes)

3120

else s) for s in

3121

value["client_structure"]]

3122

# .name & .host

3123

for k in ("name", "host"):

3124

if isinstance(value[k], bytes):

3125

value[k] = value[k].decode("utf-8")

3126

# old_client_settings

3127

# .keys()

3128

old_client_settings = {

3129

(key.decode("utf-8")

3130

if isinstance(key, bytes)

3131

else key): value

3132

for key, value in

3133

bytes_old_client_settings.items()}

3134

del bytes_old_client_settings

3135

# .host

3136

for value in old_client_settings.values():

3137

if isinstance(value["host"], bytes):

3138

value["host"] = (value["host"]

3139

.decode("utf-8"))

2373

clients_data, old_client_settings = (pickle.load

2374

(stored_state))

3140

2375

os.remove(stored_state_path)

3141

2376

except IOError as e:

3142

2377

if e.errno == errno.ENOENT:

3143

logger.warning("Could not load persistent state:"

3144

" {}".format(os.strerror(e.errno)))

2378

logger.warning("Could not load persistent state: {0}"

2379

.format(os.strerror(e.errno)))

3145

2380

else:

3146

2381

logger.critical("Could not load persistent state:",

3147

2382

exc_info=e)

3148

2383

raise

3149

2384

except EOFError as e:

3150

2385

logger.warning("Could not load persistent state: "

3151

"EOFError:",

3152

exc_info=e)

3153

2386

"EOFError:", exc_info=e)

2387

3154

2388

with PGPEngine() as pgp:

3155

for client_name, client in clients_data.items():

3156

# Skip removed clients

3157

if client_name not in client_settings:

3158

continue

3159

2389

for client_name, client in clients_data.iteritems():

3160

2390

# Decide which value to use after restoring saved state.

3161

2391

# We have three different values: Old config file,

3162

2392

# new config file, and saved state.

3167

2397

# For each value in new config, check if it

3168

2398

# differs from the old config value (Except for

3169

2399

# the "secret" attribute)

3170

if (name != "secret"

3171

and (value !=

3172

old_client_settings[client_name][name])):

2400

if (name != "secret" and

2401

value != old_client_settings[client_name]

2402

[name]):

3173

2403

client[name] = value

3174

2404

except KeyError:

3175

2405

pass

3176

2406

3177

2407

# Clients who has passed its expire date can still be

3178

# enabled if its last checker was successful. A Client

2408

# enabled if its last checker was successful. Clients

3179

2409

# whose checker succeeded before we stored its state is

3180

2410

# assumed to have successfully run all checkers during

3181

2411

# downtime.

3183

2413

if datetime.datetime.utcnow() >= client["expires"]:

3184

2414

if not client["last_checked_ok"]:

3185

2415

logger.warning(

3186

"disabling client {} - Client never "

3187

"performed a successful checker".format(

3188

client_name))

2416

"disabling client {0} - Client never "

2417

"performed a successful checker"

2418

.format(client_name))

3189

2419

client["enabled"] = False

3190

2420

elif client["last_checker_status"] != 0:

3191

2421

logger.warning(

3192

"disabling client {} - Client last"

3193

" checker failed with error code"

3194

" {}".format(

3195

client_name,

3196

client["last_checker_status"]))

2422

"disabling client {0} - Client "

2423

"last checker failed with error code {1}"

2424

.format(client_name,

2425

client["last_checker_status"]))

3197

2426

client["enabled"] = False

3198

2427

else:

3199

client["expires"] = (

3200

datetime.datetime.utcnow()

3201

+ client["timeout"])

2428

client["expires"] = (datetime.datetime

2429

.utcnow()

2430

+ client["timeout"])

3202

2431

logger.debug("Last checker succeeded,"

3203

" keeping {} enabled".format(

3204

client_name))

2432

" keeping {0} enabled"

2433

.format(client_name))

3205

2434

try:

3206

client["secret"] = pgp.decrypt(

3207

client["encrypted_secret"],

3208

client_settings[client_name]["secret"])

2435

client["secret"] = (

2436

pgp.decrypt(client["encrypted_secret"],

2437

client_settings[client_name]

2438

["secret"]))

3209

2439

except PGPError:

3210

2440

# If decryption fails, we use secret from new settings

3211

logger.debug("Failed to decrypt {} old secret".format(

3212

client_name))

3213

client["secret"] = (client_settings[client_name]

3214

["secret"])

3215

2441

logger.debug("Failed to decrypt {0} old secret"

2442

.format(client_name))

2443

client["secret"] = (

2444

client_settings[client_name]["secret"])

2445

3216

2446

# Add/remove clients based on new changes made to config

3217

2447

for client_name in (set(old_client_settings)

3218

2448

- set(client_settings)):

3220

2450

for client_name in (set(client_settings)

3221

2451

- set(old_client_settings)):

3222

2452

clients_data[client_name] = client_settings[client_name]

3223

2453

3224

2454

# Create all client objects

3225

for client_name, client in clients_data.items():

2455

for client_name, client in clients_data.iteritems():

3226

2456

tcp_server.clients[client_name] = client_class(

3227

name=client_name,

3228

settings=client,

3229

server_settings=server_settings)

3230

2457

name = client_name, settings = client)

2458

3231

2459

if not tcp_server.clients:

3232

2460

logger.warning("No clients defined")

3233

3234

if not foreground:

3235

if pidfile is not None:

3236

pid = os.getpid()

3237

try:

3238

with pidfile:

3239

print(pid, file=pidfile)

3240

except IOError:

3241

logger.error("Could not write to file %r with PID %d",

3242

pidfilename, pid)

3243

del pidfile

2461

2462

if not debug:

2463

try:

2464

with pidfile:

2465

pid = os.getpid()

2466

pidfile.write(str(pid) + "\n".encode("utf-8"))

2467

del pidfile

2468

except IOError:

2469

logger.error("Could not write to file %r with PID %d",

2470

pidfilename, pid)

2471

except NameError:

2472

# "pidfile" was never created

2473

pass

3244

2474

del pidfilename

3245

3246

for termsig in (signal.SIGHUP, signal.SIGTERM):

3247

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3248

lambda: main_loop.quit() and False)

3249

2475

signal.signal(signal.SIGINT, signal.SIG_IGN)

2476

2477

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2478

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2479

3250

2480

if use_dbus:

3251

3252

@alternate_dbus_interfaces(

3253

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3254

class MandosDBusService(DBusObjectWithObjectManager):

2481

@alternate_dbus_interfaces({"se.recompile.Mandos":

2482

"se.bsnet.fukt.Mandos"})

2483

class MandosDBusService(DBusObjectWithProperties):

3255

2484

"""A D-Bus proxy object"""

3256

3257

2485

def __init__(self):

3258

2486

dbus.service.Object.__init__(self, bus, "/")

3259

3260

2487

_interface = "se.recompile.Mandos"

3261

2488

2489

@dbus_interface_annotations(_interface)

2490

def _foo(self):

2491

return { "org.freedesktop.DBus.Property"

2492

".EmitsChangedSignal":

2493

"false"}

2494

3262

2495

@dbus.service.signal(_interface, signature="o")

3263

2496

def ClientAdded(self, objpath):

3264

2497

"D-Bus signal"

3265

2498

pass

3266

2499

3267

2500

@dbus.service.signal(_interface, signature="ss")

3268

2501

def ClientNotFound(self, fingerprint, address):

3269

2502

"D-Bus signal"

3270

2503

pass

3271

3272

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3273

"true"})

2504

3274

2505

@dbus.service.signal(_interface, signature="os")

3275

2506

def ClientRemoved(self, objpath, name):

3276

2507

"D-Bus signal"

3277

2508

pass

3278

3279

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3280

"true"})

2509

3281

2510

@dbus.service.method(_interface, out_signature="ao")

3282

2511

def GetAllClients(self):

3283

2512

"D-Bus method"

3284

return dbus.Array(c.dbus_object_path for c in

3285

tcp_server.clients.values())

3286

3287

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3288

"true"})

2513

return dbus.Array(c.dbus_object_path

2514

for c in

2515

tcp_server.clients.itervalues())

2516

3289

2517

@dbus.service.method(_interface,

3290

2518

out_signature="a{oa{sv}}")

3291

2519

def GetAllClientsWithProperties(self):

3292

2520

"D-Bus method"

3293

2521

return dbus.Dictionary(

3294

{c.dbus_object_path: c.GetAll(

3295

"se.recompile.Mandos.Client")

3296

for c in tcp_server.clients.values()},

2522

((c.dbus_object_path, c.GetAll(""))

2523

for c in tcp_server.clients.itervalues()),

3297

2524

signature="oa{sv}")

3298

2525

3299

2526

@dbus.service.method(_interface, in_signature="o")

3300

2527

def RemoveClient(self, object_path):

3301

2528

"D-Bus method"

3302

for c in tcp_server.clients.values():

2529

for c in tcp_server.clients.itervalues():

3303

2530

if c.dbus_object_path == object_path:

3304

2531

del tcp_server.clients[c.name]

3305

2532

c.remove_from_connection()

3306

# Don't signal the disabling

2533

# Don't signal anything except ClientRemoved

3307

2534

c.disable(quiet=True)

3308

# Emit D-Bus signal for removal

3309

self.client_removed_signal(c)

2535

# Emit D-Bus signal

2536

self.ClientRemoved(object_path, c.name)

3310

2537

return

3311

2538

raise KeyError(object_path)

3312

2539

3313

2540

del _interface

3314

3315

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3316

out_signature="a{oa{sa{sv}}}")

3317

def GetManagedObjects(self):

3318

"""D-Bus method"""

3319

return dbus.Dictionary(

3320

{client.dbus_object_path:

3321

dbus.Dictionary(

3322

{interface: client.GetAll(interface)

3323

for interface in

3324

client._get_all_interface_names()})

3325

for client in tcp_server.clients.values()})

3326

3327

def client_added_signal(self, client):

3328

"""Send the new standard signal and the old signal"""

3329

if use_dbus:

3330

# New standard signal

3331

self.InterfacesAdded(

3332

client.dbus_object_path,

3333

dbus.Dictionary(

3334

{interface: client.GetAll(interface)

3335

for interface in

3336

client._get_all_interface_names()}))

3337

# Old signal

3338

self.ClientAdded(client.dbus_object_path)

3339

3340

def client_removed_signal(self, client):

3341

"""Send the new standard signal and the old signal"""

3342

if use_dbus:

3343

# New standard signal

3344

self.InterfacesRemoved(

3345

client.dbus_object_path,

3346

client._get_all_interface_names())

3347

# Old signal

3348

self.ClientRemoved(client.dbus_object_path,

3349

client.name)

3350

2541

3351

2542

mandos_dbus_service = MandosDBusService()

3352

3353

# Save modules to variables to exempt the modules from being

3354

# unloaded before the function registered with atexit() is run.

3355

mp = multiprocessing

3356

wn = wnull

3357

2543

3358

2544

def cleanup():

3359

2545

"Cleanup function; run on exit"

3360

if zeroconf:

3361

service.cleanup()

3362

3363

mp.active_children()

3364

wn.close()

2546

service.cleanup()

2547

2548

multiprocessing.active_children()

3365

2549

if not (tcp_server.clients or client_settings):

3366

2550

return

3367

2551

3368

2552

# Store client before exiting. Secrets are encrypted with key

3369

2553

# based on what config file has. If config file is

3370

2554

# removed/edited, old secret will thus be unrecovable.

3371

2555

clients = {}

3372

2556

with PGPEngine() as pgp:

3373

for client in tcp_server.clients.values():

2557

for client in tcp_server.clients.itervalues():

3374

2558

key = client_settings[client.name]["secret"]

3375

2559

client.encrypted_secret = pgp.encrypt(client.secret,

3376

2560

key)

3377

2561

client_dict = {}

3378

2562

3379

2563

# A list of attributes that can not be pickled

3380

2564

# + secret.

3381

exclude = {"bus", "changedstate", "secret",

3382

"checker", "server_settings"}

3383

for name, typ in inspect.getmembers(dbus.service

3384

.Object):

2565

exclude = set(("bus", "changedstate", "secret",

2566

"checker"))

2567

for name, typ in (inspect.getmembers

2568

(dbus.service.Object)):

3385

2569

exclude.add(name)

3386

2570

3387

2571

client_dict["encrypted_secret"] = (client

3388

2572

.encrypted_secret)

3389

2573

for attr in client.client_structure:

3390

2574

if attr not in exclude:

3391

2575

client_dict[attr] = getattr(client, attr)

3392

2576

3393

2577

clients[client.name] = client_dict

3394

2578

del client_settings[client.name]["secret"]

3395

2579

3396

2580

try:

3397

with tempfile.NamedTemporaryFile(

3398

mode='wb',

3399

suffix=".pickle",

3400

prefix='clients-',

3401

dir=os.path.dirname(stored_state_path),

3402

delete=False) as stored_state:

3403

pickle.dump((clients, client_settings), stored_state,

3404

protocol=2)

3405

tempname = stored_state.name

2581

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2582

prefix="clients-",

2583

dir=os.path.dirname

2584

(stored_state_path))

2585

with os.fdopen(tempfd, "wb") as stored_state:

2586

pickle.dump((clients, client_settings), stored_state)

3406

2587

os.rename(tempname, stored_state_path)

3407

2588

except (IOError, OSError) as e:

3408

2589

if not debug:

3411

2592

except NameError:

3412

2593

pass

3413

2594

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3414

logger.warning("Could not save persistent state: {}"

2595

logger.warning("Could not save persistent state: {0}"

3415

2596

.format(os.strerror(e.errno)))

3416

2597

else:

3417

2598

logger.warning("Could not save persistent state:",

3418

2599

exc_info=e)

3419

raise

3420

2600

raise e

2601

3421

2602

# Delete all clients, and settings from config

3422

2603

while tcp_server.clients:

3423

2604

name, client = tcp_server.clients.popitem()

3424

2605

if use_dbus:

3425

2606

client.remove_from_connection()

3426

# Don't signal the disabling

2607

# Don't signal anything except ClientRemoved

3427

2608

client.disable(quiet=True)

3428

# Emit D-Bus signal for removal

3429

2609

if use_dbus:

3430

mandos_dbus_service.client_removed_signal(client)

2610

# Emit D-Bus signal

2611

mandos_dbus_service.ClientRemoved(client

2612

.dbus_object_path,

2613

client.name)

3431

2614

client_settings.clear()

3432

2615

3433

2616

atexit.register(cleanup)

3434

3435

for client in tcp_server.clients.values():

2617

2618

for client in tcp_server.clients.itervalues():

3436

2619

if use_dbus:

3437

# Emit D-Bus signal for adding

3438

mandos_dbus_service.client_added_signal(client)

2620

# Emit D-Bus signal

2621

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3439

2622

# Need to initiate checking of clients

3440

2623

if client.enabled:

3441

2624

client.init_checker()

3442

2625

3443

2626

tcp_server.enable()

3444

2627

tcp_server.server_activate()

3445

2628

3446

2629

# Find out what port we got

3447

if zeroconf:

3448

service.port = tcp_server.socket.getsockname()[1]

2630

service.port = tcp_server.socket.getsockname()[1]

3449

2631

if use_ipv6:

3450

2632

logger.info("Now listening on address %r, port %d,"

3451

2633

" flowinfo %d, scope_id %d",

3453

2635

else: # IPv4

3454

2636

logger.info("Now listening on address %r, port %d",

3455

2637

*tcp_server.socket.getsockname())

3456

3457

# service.interface = tcp_server.socket.getsockname()[3]

3458

2638

2639

#service.interface = tcp_server.socket.getsockname()[3]

2640

3459

2641

try:

3460

if zeroconf:

3461

# From the Avahi example code

3462

try:

3463

service.activate()

3464

except dbus.exceptions.DBusException as error:

3465

logger.critical("D-Bus Exception", exc_info=error)

3466

cleanup()

3467

sys.exit(1)

3468

# End of Avahi example code

3469

3470

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3471

lambda *args, **kwargs:

3472

(tcp_server.handle_request

3473

(*args[2:], **kwargs) or True))

3474

2642

# From the Avahi example code

2643

try:

2644

service.activate()

2645

except dbus.exceptions.DBusException as error:

2646

logger.critical("D-Bus Exception", exc_info=error)

2647

cleanup()

2648

sys.exit(1)

2649

# End of Avahi example code

2650

2651

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2652

lambda *args, **kwargs:

2653

(tcp_server.handle_request

2654

(*args[2:], **kwargs) or True))

2655

3475

2656

logger.debug("Starting main loop")

3476

2657

main_loop.run()

3477

2658

except AvahiError as error:

3486

2667

# Must run before the D-Bus bus name gets deregistered

3487

2668

cleanup()

3488

2669

3489

3490

2670

if __name__ == '__main__':

3491

2671

main()