/mandos/trunk : revision 608

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

71

84

72

import dbus

85

73

import dbus.service

86

import gi

87

from gi.repository import GLib

74

import gobject

75

import avahi

88

76

from dbus.mainloop.glib import DBusGMainLoop

89

77

import ctypes

90

78

import ctypes.util

91

79

import xml.dom.minidom

92

80

import inspect

93

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

81

import GnuPGInterface

82

83

try:

122

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

85

except AttributeError:

124

86

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

87

from IN import SO_BINDTODEVICE

128

88

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.14"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.0"

147

92

stored_state_file = "clients.pickle"

148

93

149

94

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

152

98

153

99

try:

154

if_nametoindex = ctypes.cdll.LoadLibrary(

155

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

156

103

except (OSError, AttributeError):

157

158

104

def if_nametoindex(interface):

159

105

"Get an interface index the hard way, i.e. using fcntl()"

160

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

161

107

with contextlib.closing(socket.socket()) as s:

162

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

163

struct.pack(b"16s16x", interface))

164

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

165

113

return interface_index

166

114

167

115

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

116

def initlogger(debug, level=logging.WARNING):

185

117

"""init logger and add loglevel"""

186

187

global syslogger

188

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

118

191

119

syslogger.setFormatter(logging.Formatter

192

120

('Mandos [%(process)d]: %(levelname)s:'

193

121

' %(message)s'))

194

122

logger.addHandler(syslogger)

195

123

196

124

if debug:

197

125

console = logging.StreamHandler()

198

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

208

136

pass

209

137

210

138

211

class PGPEngine:

139

class PGPEngine(object):

212

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

214

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

215

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

229

'--force-mdc',

230

'--quiet']

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

235

151

def __enter__(self):

236

152

return self

237

153

238

154

def __exit__(self, exc_type, exc_value, traceback):

239

155

self._cleanup()

240

156

return False

241

157

242

158

def __del__(self):

243

159

self._cleanup()

244

160

245

161

def _cleanup(self):

246

162

if self.tempdir is not None:

247

163

# Delete contents of tempdir

248

164

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

165

topdown = False):

250

166

for filename in files:

251

167

os.remove(os.path.join(root, filename))

252

168

for dirname in dirs:

254

170

# Remove tempdir

255

171

os.rmdir(self.tempdir)

256

172

self.tempdir = None

257

173

258

174

def password_encode(self, password):

259

175

# Passphrase can not be empty and can not contain newlines or

260

176

# NUL bytes. So we prefix it and hex encode it.

261

encoded = b"mandos" + binascii.hexlify(password)

262

if len(encoded) > 2048:

263

# GnuPG can't handle long passwords, so encode differently

264

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

265

.replace(b"\n", b"\\n")

266

.replace(b"\0", b"\\x00"))

267

return encoded

268

177

return b"mandos" + binascii.hexlify(password)

178

269

179

def encrypt(self, data, password):

270

passphrase = self.password_encode(password)

271

with tempfile.NamedTemporaryFile(

272

dir=self.tempdir) as passfile:

273

passfile.write(passphrase)

274

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

276

'--passphrase-file',

277

passfile.name]

278

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

283

if proc.returncode != 0:

284

raise PGPError(err)

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

285

194

return ciphertext

286

195

287

196

def decrypt(self, data, password):

288

passphrase = self.password_encode(password)

289

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

291

passfile.write(passphrase)

292

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

294

'--passphrase-file',

295

passfile.name]

296

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

301

if proc.returncode != 0:

302

raise PGPError(err)

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

303

211

return decrypted_plaintext

304

212

305

213

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

214

class AvahiError(Exception):

333

215

def __init__(self, value, *args, **kwargs):

334

216

self.value = value

335

return super(AvahiError, self).__init__(value, *args,

336

**kwargs)

337

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

338

220

339

221

class AvahiServiceError(AvahiError):

340

222

pass

341

223

342

343

224

class AvahiGroupError(AvahiError):

344

225

pass

345

226

346

227

347

class AvahiService:

228

class AvahiService(object):

348

229

"""An Avahi (Zeroconf) service.

349

230

350

231

Attributes:

351

232

interface: integer; avahi.IF_UNSPEC or an interface index.

352

233

Used to optionally bind to the specified interface.

353

234

name: string; Example: 'Mandos'

354

235

type: string; Example: '_mandos._tcp'.

355

See <https://www.iana.org/assignments/service-names-port-numbers>

236

See <http://www.dns-sd.org/ServiceTypes.html>

356

237

port: integer; what port to announce

357

238

TXT: list of strings; TXT record for the service

358

239

domain: string; Domain to publish on, default to .local if empty.

364

245

server: D-Bus Server

365

246

bus: dbus.SystemBus()

366

247

"""

367

368

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

248

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

servicetype = None, port = None, TXT = None,

251

domain = "", host = "", max_renames = 32768,

252

protocol = avahi.PROTO_UNSPEC, bus = None):

379

253

self.interface = interface

380

254

self.name = name

381

255

self.type = servicetype

390

264

self.server = None

391

265

self.bus = bus

392

266

self.entry_group_state_changed_match = None

393

394

def rename(self, remove=True):

267

268

def rename(self):

395

269

"""Derived from the Avahi example code"""

396

270

if self.rename_count >= self.max_renames:

397

271

logger.critical("No suitable Zeroconf service name found"

398

272

" after %i retries, exiting.",

399

273

self.rename_count)

400

274

raise AvahiServiceError("Too many renames")

401

self.name = str(

402

self.server.GetAlternativeServiceName(self.name))

403

self.rename_count += 1

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

404

277

logger.info("Changing Zeroconf service name to %r ...",

405

278

self.name)

406

if remove:

407

self.remove()

279

self.remove()

408

280

try:

409

281

self.add()

410

282

except dbus.exceptions.DBusException as error:

411

if (error.get_dbus_name()

412

== "org.freedesktop.Avahi.CollisionError"):

413

logger.info("Local Zeroconf service name collision.")

414

return self.rename(remove=False)

415

else:

416

logger.critical("D-Bus Exception", exc_info=error)

417

self.cleanup()

418

os._exit(1)

419

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

286

self.rename_count += 1

287

420

288

def remove(self):

421

289

"""Derived from the Avahi example code"""

422

290

if self.entry_group_state_changed_match is not None:

424

292

self.entry_group_state_changed_match = None

425

293

if self.group is not None:

426

294

self.group.Reset()

427

295

428

296

def add(self):

429

297

"""Derived from the Avahi example code"""

430

298

self.remove()

447

315

dbus.UInt16(self.port),

448

316

avahi.string_array_to_txt_array(self.TXT))

449

317

self.group.Commit()

450

318

451

319

def entry_group_state_changed(self, state, error):

452

320

"""Derived from the Avahi example code"""

453

321

logger.debug("Avahi entry group state change: %i", state)

454

322

455

323

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

324

logger.debug("Zeroconf service established.")

457

325

elif state == avahi.ENTRY_GROUP_COLLISION:

459

327

self.rename()

460

328

elif state == avahi.ENTRY_GROUP_FAILURE:

461

329

logger.critical("Avahi: Error in group state changed %s",

462

str(error))

463

raise AvahiGroupError("State changed: {!s}".format(error))

464

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

465

334

def cleanup(self):

466

335

"""Derived from the Avahi example code"""

467

336

if self.group is not None:

472

341

pass

473

342

self.group = None

474

343

self.remove()

475

344

476

345

def server_state_changed(self, state, error=None):

477

346

"""Derived from the Avahi example code"""

478

347

logger.debug("Avahi server state change: %i", state)

479

bad_states = {

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

avahi.SERVER_REGISTERING: None,

482

avahi.SERVER_COLLISION: "Zeroconf server name collision",

483

avahi.SERVER_FAILURE: "Zeroconf server failure",

484

}

348

bad_states = { avahi.SERVER_INVALID:

349

"Zeroconf server invalid",

350

avahi.SERVER_REGISTERING: None,

351

avahi.SERVER_COLLISION:

352

"Zeroconf server name collision",

353

avahi.SERVER_FAILURE:

354

"Zeroconf server failure" }

485

355

if state in bad_states:

486

356

if bad_states[state] is not None:

487

357

if error is None:

490

360

logger.error(bad_states[state] + ": %r", error)

491

361

self.cleanup()

492

362

elif state == avahi.SERVER_RUNNING:

493

try:

494

self.add()

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

logger.info("Local Zeroconf service name"

499

" collision.")

500

return self.rename(remove=False)

501

else:

502

logger.critical("D-Bus Exception", exc_info=error)

503

self.cleanup()

504

os._exit(1)

363

self.add()

505

364

else:

506

365

if error is None:

507

366

logger.debug("Unknown state: %r", state)

508

367

else:

509

368

logger.debug("Unknown state: %r: %r", state, error)

510

369

511

370

def activate(self):

512

371

"""Derived from the Avahi example code"""

513

372

if self.server is None:

517

376

follow_name_owner_changes=True),

518

377

avahi.DBUS_INTERFACE_SERVER)

519

378

self.server.connect_to_signal("StateChanged",

520

self.server_state_changed)

379

self.server_state_changed)

521

380

self.server_state_changed(self.server.GetState())

522

381

523

382

524

383

class AvahiServiceToSyslog(AvahiService):

525

def rename(self, *args, **kwargs):

384

def rename(self):

526

385

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

529

syslogger.setFormatter(logging.Formatter(

530

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

.format(self.name)))

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

532

391

return ret

533

392

534

393

535

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

538

539

library = ctypes.util.find_library("gnutls")

540

if library is None:

541

library = ctypes.util.find_library("gnutls-deb0")

542

_library = ctypes.cdll.LoadLibrary(library)

543

del library

544

545

# Unless otherwise indicated, the constants and types below are

546

# all from the gnutls/gnutls.h C header file.

547

548

# Constants

549

E_SUCCESS = 0

550

E_INTERRUPTED = -52

551

E_AGAIN = -28

552

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

CLIENT = 2

555

SHUT_RDWR = 0

556

CRD_CERTIFICATE = 1

557

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

565

# Types

566

class session_int(ctypes.Structure):

567

_fields_ = []

568

session_t = ctypes.POINTER(session_int)

569

570

class certificate_credentials_st(ctypes.Structure):

571

_fields_ = []

572

certificate_credentials_t = ctypes.POINTER(

573

certificate_credentials_st)

574

certificate_type_t = ctypes.c_int

575

576

class datum_t(ctypes.Structure):

577

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

578

('size', ctypes.c_uint)]

579

580

class openpgp_crt_int(ctypes.Structure):

581

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

credentials_type_t = ctypes.c_int

586

transport_ptr_t = ctypes.c_void_p

587

close_request_t = ctypes.c_int

588

589

# Exceptions

590

class Error(Exception):

591

def __init__(self, message=None, code=None, args=()):

592

# Default usage is by a message string, but if a return

593

# code is passed, convert it to a string with

594

# gnutls.strerror()

595

self.code = code

596

if message is None and code is not None:

597

message = gnutls.strerror(code)

598

return super(gnutls.Error, self).__init__(

599

message, *args)

600

601

class CertificateSecurityError(Error):

602

pass

603

604

# Classes

605

class Credentials:

606

def __init__(self):

607

self._c_object = gnutls.certificate_credentials_t()

608

gnutls.certificate_allocate_credentials(

609

ctypes.byref(self._c_object))

610

self.type = gnutls.CRD_CERTIFICATE

611

612

def __del__(self):

613

gnutls.certificate_free_credentials(self._c_object)

614

615

class ClientSession:

616

def __init__(self, socket, credentials=None):

617

self._c_object = gnutls.session_t()

618

gnutls_flags = gnutls.CLIENT

619

if gnutls.check_version(b"3.5.6"):

620

gnutls_flags |= gnutls.NO_TICKETS

621

if gnutls.has_rawpk:

622

gnutls_flags |= gnutls.ENABLE_RAWPK

623

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

624

del gnutls_flags

625

gnutls.set_default_priority(self._c_object)

626

gnutls.transport_set_ptr(self._c_object, socket.fileno())

627

gnutls.handshake_set_private_extensions(self._c_object,

628

True)

629

self.socket = socket

630

if credentials is None:

631

credentials = gnutls.Credentials()

632

gnutls.credentials_set(self._c_object, credentials.type,

633

ctypes.cast(credentials._c_object,

634

ctypes.c_void_p))

635

self.credentials = credentials

636

637

def __del__(self):

638

gnutls.deinit(self._c_object)

639

640

def handshake(self):

641

return gnutls.handshake(self._c_object)

642

643

def send(self, data):

644

data = bytes(data)

645

data_len = len(data)

646

while data_len > 0:

647

data_len -= gnutls.record_send(self._c_object,

648

data[-data_len:],

649

data_len)

650

651

def bye(self):

652

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

653

654

# Error handling functions

655

def _error_code(result):

656

"""A function to raise exceptions on errors, suitable

657

for the 'restype' attribute on ctypes functions"""

658

if result >= 0:

659

return result

660

if result == gnutls.E_NO_CERTIFICATE_FOUND:

661

raise gnutls.CertificateSecurityError(code=result)

662

raise gnutls.Error(code=result)

663

664

def _retry_on_error(result, func, arguments):

665

"""A function to retry on some errors, suitable

666

for the 'errcheck' attribute on ctypes functions"""

667

while result < 0:

668

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

669

return _error_code(result)

670

result = func(*arguments)

671

return result

672

673

# Unless otherwise indicated, the function declarations below are

674

# all from the gnutls/gnutls.h C header file.

675

676

# Functions

677

priority_set_direct = _library.gnutls_priority_set_direct

678

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

679

ctypes.POINTER(ctypes.c_char_p)]

680

priority_set_direct.restype = _error_code

681

682

init = _library.gnutls_init

683

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

684

init.restype = _error_code

685

686

set_default_priority = _library.gnutls_set_default_priority

687

set_default_priority.argtypes = [session_t]

688

set_default_priority.restype = _error_code

689

690

record_send = _library.gnutls_record_send

691

record_send.argtypes = [session_t, ctypes.c_void_p,

692

ctypes.c_size_t]

693

record_send.restype = ctypes.c_ssize_t

694

record_send.errcheck = _retry_on_error

695

696

certificate_allocate_credentials = (

697

_library.gnutls_certificate_allocate_credentials)

698

certificate_allocate_credentials.argtypes = [

699

ctypes.POINTER(certificate_credentials_t)]

700

certificate_allocate_credentials.restype = _error_code

701

702

certificate_free_credentials = (

703

_library.gnutls_certificate_free_credentials)

704

certificate_free_credentials.argtypes = [

705

certificate_credentials_t]

706

certificate_free_credentials.restype = None

707

708

handshake_set_private_extensions = (

709

_library.gnutls_handshake_set_private_extensions)

710

handshake_set_private_extensions.argtypes = [session_t,

711

ctypes.c_int]

712

handshake_set_private_extensions.restype = None

713

714

credentials_set = _library.gnutls_credentials_set

715

credentials_set.argtypes = [session_t, credentials_type_t,

716

ctypes.c_void_p]

717

credentials_set.restype = _error_code

718

719

strerror = _library.gnutls_strerror

720

strerror.argtypes = [ctypes.c_int]

721

strerror.restype = ctypes.c_char_p

722

723

certificate_type_get = _library.gnutls_certificate_type_get

724

certificate_type_get.argtypes = [session_t]

725

certificate_type_get.restype = _error_code

726

727

certificate_get_peers = _library.gnutls_certificate_get_peers

728

certificate_get_peers.argtypes = [session_t,

729

ctypes.POINTER(ctypes.c_uint)]

730

certificate_get_peers.restype = ctypes.POINTER(datum_t)

731

732

global_set_log_level = _library.gnutls_global_set_log_level

733

global_set_log_level.argtypes = [ctypes.c_int]

734

global_set_log_level.restype = None

735

736

global_set_log_function = _library.gnutls_global_set_log_function

737

global_set_log_function.argtypes = [log_func]

738

global_set_log_function.restype = None

739

740

deinit = _library.gnutls_deinit

741

deinit.argtypes = [session_t]

742

deinit.restype = None

743

744

handshake = _library.gnutls_handshake

745

handshake.argtypes = [session_t]

746

handshake.restype = _error_code

747

handshake.errcheck = _retry_on_error

748

749

transport_set_ptr = _library.gnutls_transport_set_ptr

750

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

751

transport_set_ptr.restype = None

752

753

bye = _library.gnutls_bye

754

bye.argtypes = [session_t, close_request_t]

755

bye.restype = _error_code

756

bye.errcheck = _retry_on_error

757

758

check_version = _library.gnutls_check_version

759

check_version.argtypes = [ctypes.c_char_p]

760

check_version.restype = ctypes.c_char_p

761

762

_need_version = b"3.3.0"

763

if check_version(_need_version) is None:

764

raise self.Error("Needs GnuTLS {} or later"

765

.format(_need_version))

766

767

_tls_rawpk_version = b"3.6.6"

768

has_rawpk = bool(check_version(_tls_rawpk_version))

769

770

if has_rawpk:

771

# Types

772

class pubkey_st(ctypes.Structure):

773

_fields = []

774

pubkey_t = ctypes.POINTER(pubkey_st)

775

776

x509_crt_fmt_t = ctypes.c_int

777

778

# All the function declarations below are from

779

# gnutls/abstract.h

780

pubkey_init = _library.gnutls_pubkey_init

781

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

782

pubkey_init.restype = _error_code

783

784

pubkey_import = _library.gnutls_pubkey_import

785

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

786

x509_crt_fmt_t]

787

pubkey_import.restype = _error_code

788

789

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

790

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

791

ctypes.POINTER(ctypes.c_ubyte),

792

ctypes.POINTER(ctypes.c_size_t)]

793

pubkey_get_key_id.restype = _error_code

794

795

pubkey_deinit = _library.gnutls_pubkey_deinit

796

pubkey_deinit.argtypes = [pubkey_t]

797

pubkey_deinit.restype = None

798

else:

799

# All the function declarations below are from

800

# gnutls/openpgp.h

801

802

openpgp_crt_init = _library.gnutls_openpgp_crt_init

803

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

804

openpgp_crt_init.restype = _error_code

805

806

openpgp_crt_import = _library.gnutls_openpgp_crt_import

807

openpgp_crt_import.argtypes = [openpgp_crt_t,

808

ctypes.POINTER(datum_t),

809

openpgp_crt_fmt_t]

810

openpgp_crt_import.restype = _error_code

811

812

openpgp_crt_verify_self = \

813

_library.gnutls_openpgp_crt_verify_self

814

openpgp_crt_verify_self.argtypes = [

815

openpgp_crt_t,

816

ctypes.c_uint,

817

ctypes.POINTER(ctypes.c_uint),

818

]

819

openpgp_crt_verify_self.restype = _error_code

820

821

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

822

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

823

openpgp_crt_deinit.restype = None

824

825

openpgp_crt_get_fingerprint = (

826

_library.gnutls_openpgp_crt_get_fingerprint)

827

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

828

ctypes.c_void_p,

829

ctypes.POINTER(

830

ctypes.c_size_t)]

831

openpgp_crt_get_fingerprint.restype = _error_code

832

833

if check_version(b"3.6.4"):

834

certificate_type_get2 = _library.gnutls_certificate_type_get2

835

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

836

certificate_type_get2.restype = _error_code

837

838

# Remove non-public functions

839

del _error_code, _retry_on_error

840

841

842

def call_pipe(connection, # : multiprocessing.Connection

843

func, *args, **kwargs):

844

"""This function is meant to be called by multiprocessing.Process

845

846

This function runs func(*args, **kwargs), and writes the resulting

847

return value on the provided multiprocessing.Connection.

848

"""

849

connection.send(func(*args, **kwargs))

850

connection.close()

851

852

853

class Client:

394

def timedelta_to_milliseconds(td):

395

"Convert a datetime.timedelta() to milliseconds"

396

return ((td.days * 24 * 60 * 60 * 1000)

397

+ (td.seconds * 1000)

398

+ (td.microseconds // 1000))

399

400

401

class Client(object):

854

402

"""A representation of a client host served by this server.

855

403

856

404

Attributes:

857

405

approved: bool(); 'None' if not yet approved/disapproved

858

406

approval_delay: datetime.timedelta(); Time to wait for approval

859

407

approval_duration: datetime.timedelta(); Duration of one approval

860

checker: multiprocessing.Process(); a running checker process used

861

to see if the client lives. 'None' if no process is

862

running.

863

checker_callback_tag: a GLib event source tag, or None

408

checker: subprocess.Popen(); a running checker process used

409

to see if the client lives.

410

'None' if no process is running.

411

checker_callback_tag: a gobject event source tag, or None

864

412

checker_command: string; External command which is run to check

865

413

if client lives. %() expansions are done at

866

414

runtime with vars(self) as dict, so that for

867

415

instance %(name)s can be used in the command.

868

checker_initiator_tag: a GLib event source tag, or None

416

checker_initiator_tag: a gobject event source tag, or None

869

417

created: datetime.datetime(); (UTC) object creation

870

418

client_structure: Object describing what attributes a client has

871

419

and is used for storing the client at exit

872

420

current_checker_command: string; current running checker_command

873

disable_initiator_tag: a GLib event source tag, or None

421

disable_initiator_tag: a gobject event source tag, or None

874

422

enabled: bool()

875

423

fingerprint: string (40 or 32 hexadecimal digits); used to

876

uniquely identify an OpenPGP client

877

key_id: string (64 hexadecimal digits); used to uniquely identify

878

a client using raw public keys

424

uniquely identify the client

879

425

host: string; available for use by the checker command

880

426

interval: datetime.timedelta(); How often to start a new checker

881

427

last_approval_request: datetime.datetime(); (UTC) or None

883

429

last_checker_status: integer between 0 and 255 reflecting exit

884

430

status of last checker. -1 reflects crashed

885

431

checker, -2 means no checker completed yet.

886

last_checker_signal: The signal which killed the last checker, if

887

last_checker_status is -1

888

432

last_enabled: datetime.datetime(); (UTC) or None

889

433

name: string; from the config file, used in log messages and

890

434

D-Bus identifiers

895

439

runtime_expansions: Allowed attributes for runtime expansion.

896

440

expires: datetime.datetime(); time (UTC) when a client will be

897

441

disabled, or None

898

server_settings: The server_settings dict from main()

899

442

"""

900

443

901

444

runtime_expansions = ("approval_delay", "approval_duration",

902

"created", "enabled", "expires", "key_id",

445

"created", "enabled", "expires",

903

446

"fingerprint", "host", "interval",

904

447

"last_approval_request", "last_checked_ok",

905

448

"last_enabled", "name", "timeout")

906

client_defaults = {

907

"timeout": "PT5M",

908

"extended_timeout": "PT15M",

909

"interval": "PT2M",

910

"checker": "fping -q -- %%(host)s",

911

"host": "",

912

"approval_delay": "PT0S",

913

"approval_duration": "PT1S",

914

"approved_by_default": "True",

915

"enabled": "True",

916

}

917

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

460

def timeout_milliseconds(self):

461

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

463

464

def extended_timeout_milliseconds(self):

465

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

467

468

def interval_milliseconds(self):

469

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

471

472

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

474

918

475

@staticmethod

919

476

def config_parser(config):

920

477

"""Construct a new dict of client settings of this form:

927

484

for client_name in config.sections():

928

485

section = dict(config.items(client_name))

929

486

client = settings[client_name] = {}

930

487

931

488

client["host"] = section["host"]

932

489

# Reformat values from string types to Python types

933

490

client["approved_by_default"] = config.getboolean(

934

491

client_name, "approved_by_default")

935

492

client["enabled"] = config.getboolean(client_name,

936

493

"enabled")

937

938

# Uppercase and remove spaces from key_id and fingerprint

939

# for later comparison purposes with return value from the

940

# key_id() and fingerprint() functions

941

client["key_id"] = (section.get("key_id", "").upper()

942

.replace(" ", ""))

494

943

495

client["fingerprint"] = (section["fingerprint"].upper()

944

496

.replace(" ", ""))

945

497

if "secret" in section:

946

client["secret"] = codecs.decode(section["secret"]

947

.encode("utf-8"),

948

"base64")

498

client["secret"] = section["secret"].decode("base64")

949

499

elif "secfile" in section:

950

500

with open(os.path.expanduser(os.path.expandvars

951

501

(section["secfile"])),

952

502

"rb") as secfile:

953

503

client["secret"] = secfile.read()

954

504

else:

955

raise TypeError("No secret or secfile for section {}"

505

raise TypeError("No secret or secfile for section {0}"

956

506

.format(section))

957

507

client["timeout"] = string_to_delta(section["timeout"])

958

508

client["extended_timeout"] = string_to_delta(

966

516

client["last_approval_request"] = None

967

517

client["last_checked_ok"] = None

968

518

client["last_checker_status"] = -2

969

519

970

520

return settings

971

972

def __init__(self, settings, name=None, server_settings=None):

521

522

def __init__(self, settings, name = None):

973

523

self.name = name

974

if server_settings is None:

975

server_settings = {}

976

self.server_settings = server_settings

977

524

# adding all client settings

978

for setting, value in settings.items():

525

for setting, value in settings.iteritems():

979

526

setattr(self, setting, value)

980

527

981

528

if self.enabled:

982

529

if not hasattr(self, "last_enabled"):

983

530

self.last_enabled = datetime.datetime.utcnow()

987

534

else:

988

535

self.last_enabled = None

989

536

self.expires = None

990

537

991

538

logger.debug("Creating client %r", self.name)

992

logger.debug(" Key ID: %s", self.key_id)

539

# Uppercase and remove spaces from fingerprint for later

540

# comparison purposes with return value from the fingerprint()

541

# function

993

542

logger.debug(" Fingerprint: %s", self.fingerprint)

994

543

self.created = settings.get("created",

995

544

datetime.datetime.utcnow())

996

545

997

546

# attributes specific for this server instance

998

547

self.checker = None

999

548

self.checker_initiator_tag = None

1002

551

self.current_checker_command = None

1003

552

self.approved = None

1004

553

self.approvals_pending = 0

1005

self.changedstate = multiprocessing_manager.Condition(

1006

multiprocessing_manager.Lock())

1007

self.client_structure = [attr

1008

for attr in self.__dict__.keys()

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

1009

559

if not attr.startswith("_")]

1010

560

self.client_structure.append("client_structure")

1011

1012

for name, t in inspect.getmembers(

1013

type(self), lambda obj: isinstance(obj, property)):

561

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

1014

566

if not name.startswith("_"):

1015

567

self.client_structure.append(name)

1016

568

1017

569

# Send notice to process children that client state has changed

1018

570

def send_changedstate(self):

1019

571

with self.changedstate:

1020

572

self.changedstate.notify_all()

1021

573

1022

574

def enable(self):

1023

575

"""Start this client's checker and timeout hooks"""

1024

576

if getattr(self, "enabled", False):

1029

581

self.last_enabled = datetime.datetime.utcnow()

1030

582

self.init_checker()

1031

583

self.send_changedstate()

1032

584

1033

585

def disable(self, quiet=True):

1034

586

"""Disable this client."""

1035

587

if not getattr(self, "enabled", False):

1037

589

if not quiet:

1038

590

logger.info("Disabling client %s", self.name)

1039

591

if getattr(self, "disable_initiator_tag", None) is not None:

1040

GLib.source_remove(self.disable_initiator_tag)

592

gobject.source_remove(self.disable_initiator_tag)

1041

593

self.disable_initiator_tag = None

1042

594

self.expires = None

1043

595

if getattr(self, "checker_initiator_tag", None) is not None:

1044

GLib.source_remove(self.checker_initiator_tag)

596

gobject.source_remove(self.checker_initiator_tag)

1045

597

self.checker_initiator_tag = None

1046

598

self.stop_checker()

1047

599

self.enabled = False

1048

600

if not quiet:

1049

601

self.send_changedstate()

1050

# Do not run this again if called by a GLib.timeout_add

602

# Do not run this again if called by a gobject.timeout_add

1051

603

return False

1052

604

1053

605

def __del__(self):

1054

606

self.disable()

1055

607

1056

608

def init_checker(self):

1057

609

# Schedule a new checker to be started an 'interval' from now,

1058

610

# and every interval from then on.

1059

611

if self.checker_initiator_tag is not None:

1060

GLib.source_remove(self.checker_initiator_tag)

1061

self.checker_initiator_tag = GLib.timeout_add(

1062

random.randrange(int(self.interval.total_seconds() * 1000

1063

+ 1)),

1064

self.start_checker)

612

gobject.source_remove(self.checker_initiator_tag)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

1065

616

# Schedule a disable() when 'timeout' has passed

1066

617

if self.disable_initiator_tag is not None:

1067

GLib.source_remove(self.disable_initiator_tag)

1068

self.disable_initiator_tag = GLib.timeout_add(

1069

int(self.timeout.total_seconds() * 1000), self.disable)

618

gobject.source_remove(self.disable_initiator_tag)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

1070

622

# Also start a new checker *right now*.

1071

623

self.start_checker()

1072

1073

def checker_callback(self, source, condition, connection,

1074

command):

624

625

def checker_callback(self, pid, condition, command):

1075

626

"""The checker has completed, so take appropriate actions."""

1076

# Read return code from connection (see call_pipe)

1077

returncode = connection.recv()

1078

connection.close()

1079

if self.checker is not None:

1080

self.checker.join()

1081

627

self.checker_callback_tag = None

1082

628

self.checker = None

1083

1084

if returncode >= 0:

1085

self.last_checker_status = returncode

1086

self.last_checker_signal = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

1087

631

if self.last_checker_status == 0:

1088

632

logger.info("Checker for %(name)s succeeded",

1089

633

vars(self))

1090

634

self.checked_ok()

1091

635

else:

1092

logger.info("Checker for %(name)s failed", vars(self))

636

logger.info("Checker for %(name)s failed",

637

vars(self))

1093

638

else:

1094

639

self.last_checker_status = -1

1095

self.last_checker_signal = -returncode

1096

640

logger.warning("Checker for %(name)s crashed?",

1097

641

vars(self))

1098

return False

1099

642

1100

643

def checked_ok(self):

1101

644

"""Assert that the client has been seen, alive and well."""

1102

645

self.last_checked_ok = datetime.datetime.utcnow()

1103

646

self.last_checker_status = 0

1104

self.last_checker_signal = None

1105

647

self.bump_timeout()

1106

648

1107

649

def bump_timeout(self, timeout=None):

1108

650

"""Bump up the timeout for this client."""

1109

651

if timeout is None:

1110

652

timeout = self.timeout

1111

653

if self.disable_initiator_tag is not None:

1112

GLib.source_remove(self.disable_initiator_tag)

654

gobject.source_remove(self.disable_initiator_tag)

1113

655

self.disable_initiator_tag = None

1114

656

if getattr(self, "enabled", False):

1115

self.disable_initiator_tag = GLib.timeout_add(

1116

int(timeout.total_seconds() * 1000), self.disable)

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

1117

660

self.expires = datetime.datetime.utcnow() + timeout

1118

661

1119

662

def need_approval(self):

1120

663

self.last_approval_request = datetime.datetime.utcnow()

1121

664

1122

665

def start_checker(self):

1123

666

"""Start a new checker subprocess if one is not running.

1124

667

1125

668

If a checker already exists, leave it running and do

1126

669

nothing."""

1127

670

# The reason for not killing a running checker is that if we

1132

675

# checkers alone, the checker would have to take more time

1133

676

# than 'timeout' for the client to be disabled, which is as it

1134

677

# should be.

1135

1136

if self.checker is not None and not self.checker.is_alive():

1137

logger.warning("Checker was not alive; joining")

1138

self.checker.join()

1139

self.checker = None

678

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except (AttributeError, OSError) as error:

683

if (isinstance(error, OSError)

684

and error.errno != errno.ECHILD):

685

raise error

686

else:

687

if pid:

688

logger.warning("Checker was a zombie")

689

gobject.source_remove(self.checker_callback_tag)

690

self.checker_callback(pid, status,

691

self.current_checker_command)

1140

692

# Start a new checker if needed

1141

693

if self.checker is None:

1142

694

# Escape attributes for the shell

1143

escaped_attrs = {

1144

attr: shlex.quote(str(getattr(self, attr)))

1145

for attr in self.runtime_expansions}

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

1146

699

try:

1147

700

command = self.checker_command % escaped_attrs

1148

701

except TypeError as error:

1149

702

logger.error('Could not format string "%s"',

1150

self.checker_command,

703

self.checker_command, exc_info=error)

704

return True # Try again later

705

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/")

716

except OSError as error:

717

logger.error("Failed to start subprocess",

1151

718

exc_info=error)

1152

return True # Try again later

1153

self.current_checker_command = command

1154

logger.info("Starting checker %r for %s", command,

1155

self.name)

1156

# We don't need to redirect stdout and stderr, since

1157

# in normal mode, that is already done by daemon(),

1158

# and in debug mode we don't want to. (Stdin is

1159

# always replaced by /dev/null.)

1160

# The exception is when not debugging but nevertheless

1161

# running in the foreground; use the previously

1162

# created wnull.

1163

popen_args = {"close_fds": True,

1164

"shell": True,

1165

"cwd": "/"}

1166

if (not self.server_settings["debug"]

1167

and self.server_settings["foreground"]):

1168

popen_args.update({"stdout": wnull,

1169

"stderr": wnull})

1170

pipe = multiprocessing.Pipe(duplex=False)

1171

self.checker = multiprocessing.Process(

1172

target=call_pipe,

1173

args=(pipe[1], subprocess.call, command),

1174

kwargs=popen_args)

1175

self.checker.start()

1176

self.checker_callback_tag = GLib.io_add_watch(

1177

GLib.IOChannel.unix_new(pipe[0].fileno()),

1178

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1179

self.checker_callback, pipe[0], command)

1180

# Re-run this periodically if run by GLib.timeout_add

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

729

# Re-run this periodically if run by gobject.timeout_add

1181

730

return True

1182

731

1183

732

def stop_checker(self):

1184

733

"""Force the checker process, if any, to stop."""

1185

734

if self.checker_callback_tag:

1186

GLib.source_remove(self.checker_callback_tag)

735

gobject.source_remove(self.checker_callback_tag)

1187

736

self.checker_callback_tag = None

1188

737

if getattr(self, "checker", None) is None:

1189

738

return

1190

739

logger.debug("Stopping checker for %(name)s", vars(self))

1191

self.checker.terminate()

740

try:

741

self.checker.terminate()

742

#time.sleep(0.5)

743

#if self.checker.poll() is None:

744

# self.checker.kill()

745

except OSError as error:

746

if error.errno != errno.ESRCH: # No such process

747

raise

1192

748

self.checker = None

1193

749

1194

750

1195

def dbus_service_property(dbus_interface,

1196

signature="v",

1197

access="readwrite",

1198

byte_arrays=False):

751

def dbus_service_property(dbus_interface, signature="v",

752

access="readwrite", byte_arrays=False):

1199

753

"""Decorators for marking methods of a DBusObjectWithProperties to

1200

754

become properties on the D-Bus.

1201

755

1202

756

The decorated method will be called with no arguments by "Get"

1203

757

and with one argument by "Set".

1204

758

1205

759

The parameters, where they are supported, are the same as

1206

760

dbus.service.method, except there is only "signature", since the

1207

761

type from Get() and the type sent to Set() is the same.

1210

764

# "Set" method, so we fail early here:

1211

765

if byte_arrays and signature != "ay":

1212

766

raise ValueError("Byte arrays not supported for non-'ay'"

1213

" signature {!r}".format(signature))

1214

767

" signature {0!r}".format(signature))

1215

768

def decorator(func):

1216

769

func._dbus_is_property = True

1217

770

func._dbus_interface = dbus_interface

1220

773

func._dbus_name = func.__name__

1221

774

if func._dbus_name.endswith("_dbus_property"):

1222

775

func._dbus_name = func._dbus_name[:-14]

1223

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

776

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1224

777

return func

1225

1226

778

return decorator

1227

779

1228

780

1229

781

def dbus_interface_annotations(dbus_interface):

1230

782

"""Decorator for marking functions returning interface annotations

1231

783

1232

784

Usage:

1233

785

1234

786

@dbus_interface_annotations("org.example.Interface")

1235

787

def _foo(self): # Function name does not matter

1236

788

return {"org.freedesktop.DBus.Deprecated": "true",

1237

789

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1238

790

"false"}

1239

791

"""

1240

1241

792

def decorator(func):

1242

793

func._dbus_is_interface = True

1243

794

func._dbus_interface = dbus_interface

1244

795

func._dbus_name = dbus_interface

1245

796

return func

1246

1247

797

return decorator

1248

798

1249

799

1250

800

def dbus_annotations(annotations):

1251

801

"""Decorator to annotate D-Bus methods, signals or properties

1252

802

Usage:

1253

1254

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1255

"org.freedesktop.DBus.Property."

1256

"EmitsChangedSignal": "false"})

803

1257

804

@dbus_service_property("org.example.Interface", signature="b",

1258

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

1259

809

def Property_dbus_property(self):

1260

810

return dbus.Boolean(False)

1261

1262

See also the DBusObjectWithAnnotations class.

1263

811

"""

1264

1265

812

def decorator(func):

1266

813

func._dbus_annotations = annotations

1267

814

return func

1268

1269

815

return decorator

1270

816

1271

817

1272

818

class DBusPropertyException(dbus.exceptions.DBusException):

1273

819

"""A base class for D-Bus property-related exceptions

1274

820

"""

1275

pass

821

def __unicode__(self):

822

return unicode(str(self))

1276

823

1277

824

1278

825

class DBusPropertyAccessException(DBusPropertyException):

1287

834

pass

1288

835

1289

836

1290

class DBusObjectWithAnnotations(dbus.service.Object):

1291

"""A D-Bus object with annotations.

1292

1293

Classes inheriting from this can use the dbus_annotations

1294

decorator to add annotations to methods or signals.

837

class DBusObjectWithProperties(dbus.service.Object):

838

"""A D-Bus object with properties.

839

840

Classes inheriting from this can use the dbus_service_property

841

decorator to expose methods as D-Bus properties. It exposes the

842

standard Get(), Set(), and GetAll() methods on the D-Bus.

1295

843

"""

1296

844

1297

845

@staticmethod

1298

846

def _is_dbus_thing(thing):

1299

847

"""Returns a function testing if an attribute is a D-Bus thing

1300

848

1301

849

If called like _is_dbus_thing("method") it returns a function

1302

850

suitable for use as predicate to inspect.getmembers().

1303

851

"""

1304

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1305

853

False)

1306

854

1307

855

def _get_all_dbus_things(self, thing):

1308

856

"""Returns a generator of (name, attribute) pairs

1309

857

"""

1310

return ((getattr(athing.__get__(self), "_dbus_name", name),

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

1311

860

athing.__get__(self))

1312

861

for cls in self.__class__.__mro__

1313

862

for name, athing in

1314

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1315

1316

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1317

out_signature="s",

1318

path_keyword='object_path',

1319

connection_keyword='connection')

1320

def Introspect(self, object_path, connection):

1321

"""Overloading of standard D-Bus method.

1322

1323

Inserts annotation tags on methods and signals.

1324

"""

1325

xmlstring = dbus.service.Object.Introspect(self, object_path,

1326

connection)

1327

try:

1328

document = xml.dom.minidom.parseString(xmlstring)

1329

1330

for if_tag in document.getElementsByTagName("interface"):

1331

# Add annotation tags

1332

for typ in ("method", "signal"):

1333

for tag in if_tag.getElementsByTagName(typ):

1334

annots = dict()

1335

for name, prop in (self.

1336

_get_all_dbus_things(typ)):

1337

if (name == tag.getAttribute("name")

1338

and prop._dbus_interface

1339

== if_tag.getAttribute("name")):

1340

annots.update(getattr(

1341

prop, "_dbus_annotations", {}))

1342

for name, value in annots.items():

1343

ann_tag = document.createElement(

1344

"annotation")

1345

ann_tag.setAttribute("name", name)

1346

ann_tag.setAttribute("value", value)

1347

tag.appendChild(ann_tag)

1348

# Add interface annotation tags

1349

for annotation, value in dict(

1350

itertools.chain.from_iterable(

1351

annotations().items()

1352

for name, annotations

1353

in self._get_all_dbus_things("interface")

1354

if name == if_tag.getAttribute("name")

1355

)).items():

1356

ann_tag = document.createElement("annotation")

1357

ann_tag.setAttribute("name", annotation)

1358

ann_tag.setAttribute("value", value)

1359

if_tag.appendChild(ann_tag)

1360

# Fix argument name for the Introspect method itself

1361

if (if_tag.getAttribute("name")

1362

== dbus.INTROSPECTABLE_IFACE):

1363

for cn in if_tag.getElementsByTagName("method"):

1364

if cn.getAttribute("name") == "Introspect":

1365

for arg in cn.getElementsByTagName("arg"):

1366

if (arg.getAttribute("direction")

1367

== "out"):

1368

arg.setAttribute("name",

1369

"xml_data")

1370

xmlstring = document.toxml("utf-8")

1371

document.unlink()

1372

except (AttributeError, xml.dom.DOMException,

1373

xml.parsers.expat.ExpatError) as error:

1374

logger.error("Failed to override Introspection method",

1375

exc_info=error)

1376

return xmlstring

1377

1378

1379

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1380

"""A D-Bus object with properties.

1381

1382

Classes inheriting from this can use the dbus_service_property

1383

decorator to expose methods as D-Bus properties. It exposes the

1384

standard Get(), Set(), and GetAll() methods on the D-Bus.

1385

"""

1386

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

865

1387

866

def _get_dbus_property(self, interface_name, property_name):

1388

867

"""Returns a bound method if one exists which is a D-Bus

1389

868

property with the specified name and interface.

1390

869

"""

1391

for cls in self.__class__.__mro__:

1392

for name, value in inspect.getmembers(

1393

cls, self._is_dbus_thing("property")):

870

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

1394

874

if (value._dbus_name == property_name

1395

875

and value._dbus_interface == interface_name):

1396

876

return value.__get__(self)

1397

877

1398

878

# No such property

1399

raise DBusPropertyNotFound("{}:{}.{}".format(

1400

self.dbus_object_path, interface_name, property_name))

1401

1402

@classmethod

1403

def _get_all_interface_names(cls):

1404

"""Get a sequence of all interfaces supported by an object"""

1405

return (name for name in set(getattr(getattr(x, attr),

1406

"_dbus_interface", None)

1407

for x in (inspect.getmro(cls))

1408

for attr in dir(x))

1409

if name is not None)

1410

1411

@dbus.service.method(dbus.PROPERTIES_IFACE,

1412

in_signature="ss",

879

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

+ interface_name + "."

881

+ property_name)

882

883

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1413

884

out_signature="v")

1414

885

def Get(self, interface_name, property_name):

1415

886

"""Standard D-Bus property Get() method, see D-Bus standard.

1421

892

if not hasattr(value, "variant_level"):

1422

893

return value

1423

894

return type(value)(value, variant_level=value.variant_level+1)

1424

895

1425

896

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1426

897

def Set(self, interface_name, property_name, value):

1427

898

"""Standard D-Bus property Set() method, see D-Bus standard.

1433

904

# The byte_arrays option is not supported yet on

1434

905

# signatures other than "ay".

1435

906

if prop._dbus_signature != "ay":

1436

raise ValueError("Byte arrays not supported for non-"

1437

"'ay' signature {!r}"

1438

.format(prop._dbus_signature))

1439

value = dbus.ByteArray(bytes(value))

907

raise ValueError

908

value = dbus.ByteArray(b''.join(chr(byte)

909

for byte in value))

1440

910

prop(value)

1441

1442

@dbus.service.method(dbus.PROPERTIES_IFACE,

1443

in_signature="s",

911

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1444

913

out_signature="a{sv}")

1445

914

def GetAll(self, interface_name):

1446

915

"""Standard D-Bus property GetAll() method, see D-Bus

1447

916

standard.

1448

917

1449

918

Note: Will not include properties with access="write".

1450

919

"""

1451

920

properties = {}

1461

930

if not hasattr(value, "variant_level"):

1462

931

properties[name] = value

1463

932

continue

1464

properties[name] = type(value)(

1465

value, variant_level=value.variant_level + 1)

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

1466

935

return dbus.Dictionary(properties, signature="sv")

1467

1468

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1469

def PropertiesChanged(self, interface_name, changed_properties,

1470

invalidated_properties):

1471

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1472

standard.

1473

"""

1474

pass

1475

936

1476

937

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1477

938

out_signature="s",

1478

939

path_keyword='object_path',

1479

940

connection_keyword='connection')

1480

941

def Introspect(self, object_path, connection):

1481

942

"""Overloading of standard D-Bus method.

1482

943

1483

944

Inserts property tags and interface annotation tags.

1484

945

"""

1485

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1486

object_path,

1487

connection)

946

xmlstring = dbus.service.Object.Introspect(self, object_path,

947

connection)

1488

948

try:

1489

949

document = xml.dom.minidom.parseString(xmlstring)

1490

1491

950

def make_tag(document, name, prop):

1492

951

e = document.createElement("property")

1493

952

e.setAttribute("name", name)

1494

953

e.setAttribute("type", prop._dbus_signature)

1495

954

e.setAttribute("access", prop._dbus_access)

1496

955

return e

1497

1498

956

for if_tag in document.getElementsByTagName("interface"):

1499

957

# Add property tags

1500

958

for tag in (make_tag(document, name, prop)

1503

961

if prop._dbus_interface

1504

962

== if_tag.getAttribute("name")):

1505

963

if_tag.appendChild(tag)

1506

# Add annotation tags for properties

1507

for tag in if_tag.getElementsByTagName("property"):

1508

annots = dict()

1509

for name, prop in self._get_all_dbus_things(

1510

"property"):

1511

if (name == tag.getAttribute("name")

1512

and prop._dbus_interface

1513

== if_tag.getAttribute("name")):

1514

annots.update(getattr(

1515

prop, "_dbus_annotations", {}))

1516

for name, value in annots.items():

1517

ann_tag = document.createElement(

1518

"annotation")

1519

ann_tag.setAttribute("name", name)

1520

ann_tag.setAttribute("value", value)

1521

tag.appendChild(ann_tag)

964

# Add annotation tags

965

for typ in ("method", "signal", "property"):

966

for tag in if_tag.getElementsByTagName(typ):

967

annots = dict()

968

for name, prop in (self.

969

_get_all_dbus_things(typ)):

970

if (name == tag.getAttribute("name")

971

and prop._dbus_interface

972

== if_tag.getAttribute("name")):

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

978

ann_tag = document.createElement(

979

"annotation")

980

ann_tag.setAttribute("name", name)

981

ann_tag.setAttribute("value", value)

982

tag.appendChild(ann_tag)

983

# Add interface annotation tags

984

for annotation, value in dict(

985

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

989

if name == if_tag.getAttribute("name")

990

)).iteritems():

991

ann_tag = document.createElement("annotation")

992

ann_tag.setAttribute("name", annotation)

993

ann_tag.setAttribute("value", value)

994

if_tag.appendChild(ann_tag)

1522

995

# Add the names to the return values for the

1523

996

# "org.freedesktop.DBus.Properties" methods

1524

997

if (if_tag.getAttribute("name")

1543

1016

return xmlstring

1544

1017

1545

1018

1546

try:

1547

dbus.OBJECT_MANAGER_IFACE

1548

except AttributeError:

1549

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1550

1551

1552

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1553

"""A D-Bus object with an ObjectManager.

1554

1555

Classes inheriting from this exposes the standard

1556

GetManagedObjects call and the InterfacesAdded and

1557

InterfacesRemoved signals on the standard

1558

"org.freedesktop.DBus.ObjectManager" interface.

1559

1560

Note: No signals are sent automatically; they must be sent

1561

manually.

1562

"""

1563

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1564

out_signature="a{oa{sa{sv}}}")

1565

def GetManagedObjects(self):

1566

"""This function must be overridden"""

1567

raise NotImplementedError()

1568

1569

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1570

signature="oa{sa{sv}}")

1571

def InterfacesAdded(self, object_path, interfaces_and_properties):

1572

pass

1573

1574

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1575

def InterfacesRemoved(self, object_path, interfaces):

1576

pass

1577

1578

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1579

out_signature="s",

1580

path_keyword='object_path',

1581

connection_keyword='connection')

1582

def Introspect(self, object_path, connection):

1583

"""Overloading of standard D-Bus method.

1584

1585

Override return argument name of GetManagedObjects to be

1586

"objpath_interfaces_and_properties"

1587

"""

1588

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1589

object_path,

1590

connection)

1591

try:

1592

document = xml.dom.minidom.parseString(xmlstring)

1593

1594

for if_tag in document.getElementsByTagName("interface"):

1595

# Fix argument name for the GetManagedObjects method

1596

if (if_tag.getAttribute("name")

1597

== dbus.OBJECT_MANAGER_IFACE):

1598

for cn in if_tag.getElementsByTagName("method"):

1599

if (cn.getAttribute("name")

1600

== "GetManagedObjects"):

1601

for arg in cn.getElementsByTagName("arg"):

1602

if (arg.getAttribute("direction")

1603

== "out"):

1604

arg.setAttribute(

1605

"name",

1606

"objpath_interfaces"

1607

"_and_properties")

1608

xmlstring = document.toxml("utf-8")

1609

document.unlink()

1610

except (AttributeError, xml.dom.DOMException,

1611

xml.parsers.expat.ExpatError) as error:

1612

logger.error("Failed to override Introspection method",

1613

exc_info=error)

1614

return xmlstring

1615

1616

1617

1019

def datetime_to_dbus(dt, variant_level=0):

1618

1020

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1619

1021

if dt is None:

1620

return dbus.String("", variant_level=variant_level)

1621

return dbus.String(dt.isoformat(), variant_level=variant_level)

1022

return dbus.String("", variant_level = variant_level)

1023

return dbus.String(dt.isoformat(),

1024

variant_level=variant_level)

1622

1025

1623

1026

1624

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1626

1029

dbus.service.Object, it will add alternate D-Bus attributes with

1627

1030

interface names according to the "alt_interface_names" mapping.

1628

1031

Usage:

1629

1032

1630

1033

@alternate_dbus_interfaces({"org.example.Interface":

1631

1034

"net.example.AlternateInterface"})

1632

1035

class SampleDBusObject(dbus.service.Object):

1633

1036

@dbus.service.method("org.example.Interface")

1634

1037

def SampleDBusMethod():

1635

1038

pass

1636

1039

1637

1040

The above "SampleDBusMethod" on "SampleDBusObject" will be

1638

1041

reachable via two interfaces: "org.example.Interface" and

1639

1042

"net.example.AlternateInterface", the latter of which will have

1640

1043

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1641

1044

"true", unless "deprecate" is passed with a False value.

1642

1045

1643

1046

This works for methods and signals, and also for D-Bus properties

1644

1047

(from DBusObjectWithProperties) and interfaces (from the

1645

1048

dbus_interface_annotations decorator).

1646

1049

"""

1647

1648

1050

def wrapper(cls):

1649

1051

for orig_interface_name, alt_interface_name in (

1650

alt_interface_names.items()):

1052

alt_interface_names.iteritems()):

1651

1053

attr = {}

1652

1054

interface_names = set()

1653

1055

# Go though all attributes of the class

1655

1057

# Ignore non-D-Bus attributes, and D-Bus attributes

1656

1058

# with the wrong interface name

1657

1059

if (not hasattr(attribute, "_dbus_interface")

1658

or not attribute._dbus_interface.startswith(

1659

orig_interface_name)):

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1660

1062

continue

1661

1063

# Create an alternate D-Bus interface name based on

1662

1064

# the current name

1663

alt_interface = attribute._dbus_interface.replace(

1664

orig_interface_name, alt_interface_name)

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1665

1068

interface_names.add(alt_interface)

1666

1069

# Is this a D-Bus signal?

1667

1070

if getattr(attribute, "_dbus_is_signal", False):

1668

# Extract the original non-method undecorated

1669

# function by black magic

1670

if sys.version_info.major == 2:

1671

nonmethod_func = (dict(

1071

# Extract the original non-method function by

1072

# black magic

1073

nonmethod_func = (dict(

1672

1074

zip(attribute.func_code.co_freevars,

1673

attribute.__closure__))

1674

["func"].cell_contents)

1675

else:

1676

nonmethod_func = (dict(

1677

zip(attribute.__code__.co_freevars,

1678

attribute.__closure__))

1679

["func"].cell_contents)

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1680

1077

# Create a new, but exactly alike, function

1681

1078

# object, and decorate it to be a new D-Bus signal

1682

1079

# with the alternate D-Bus interface name

1683

new_function = copy_function(nonmethod_func)

1684

new_function = (dbus.service.signal(

1685

alt_interface,

1686

attribute._dbus_signature)(new_function))

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1083

(types.FunctionType(

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1687

1089

# Copy annotations, if any

1688

1090

try:

1689

new_function._dbus_annotations = dict(

1690

attribute._dbus_annotations)

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1691

1093

except AttributeError:

1692

1094

pass

1693

1694

1095

# Define a creator of a function to call both the

1695

1096

# original and alternate functions, so both the

1696

1097

# original and alternate signals gets sent when

1699

1100

"""This function is a scope container to pass

1700

1101

func1 and func2 to the "call_both" function

1701

1102

outside of its arguments"""

1702

1703

@functools.wraps(func2)

1704

1103

def call_both(*args, **kwargs):

1705

1104

"""This function will emit two D-Bus

1706

1105

signals by calling func1 and func2"""

1707

1106

func1(*args, **kwargs)

1708

1107

func2(*args, **kwargs)

1709

# Make wrapper function look like a D-Bus

1710

# signal

1711

for name, attr in inspect.getmembers(func2):

1712

if name.startswith("_dbus_"):

1713

setattr(call_both, name, attr)

1714

1715

1108

return call_both

1716

1109

# Create the "call_both" function and add it to

1717

1110

# the class

1722

1115

# object. Decorate it to be a new D-Bus method

1723

1116

# with the alternate D-Bus interface name. Add it

1724

1117

# to the class.

1725

attr[attrname] = (

1726

dbus.service.method(

1727

alt_interface,

1728

attribute._dbus_in_signature,

1729

attribute._dbus_out_signature)

1730

(copy_function(attribute)))

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1731

1128

# Copy annotations, if any

1732

1129

try:

1733

attr[attrname]._dbus_annotations = dict(

1734

attribute._dbus_annotations)

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1735

1132

except AttributeError:

1736

1133

pass

1737

1134

# Is this a D-Bus property?

1740

1137

# object, and decorate it to be a new D-Bus

1741

1138

# property with the alternate D-Bus interface

1742

1139

# name. Add it to the class.

1743

attr[attrname] = (dbus_service_property(

1744

alt_interface, attribute._dbus_signature,

1745

attribute._dbus_access,

1746

attribute._dbus_get_args_options

1747

["byte_arrays"])

1748

(copy_function(attribute)))

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1749

1153

# Copy annotations, if any

1750

1154

try:

1751

attr[attrname]._dbus_annotations = dict(

1752

attribute._dbus_annotations)

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1753

1157

except AttributeError:

1754

1158

pass

1755

1159

# Is this a D-Bus interface?

1758

1162

# object. Decorate it to be a new D-Bus interface

1759

1163

# with the alternate D-Bus interface name. Add it

1760

1164

# to the class.

1761

attr[attrname] = (

1762

dbus_interface_annotations(alt_interface)

1763

(copy_function(attribute)))

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1764

1173

if deprecate:

1765

1174

# Deprecate all alternate interfaces

1766

iname = "_AlternateDBusNames_interface_annotation{}"

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1767

1176

for interface_name in interface_names:

1768

1769

1177

@dbus_interface_annotations(interface_name)

1770

1178

def func(self):

1771

return {"org.freedesktop.DBus.Deprecated":

1772

"true"}

1179

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1773

1181

# Find an unused name

1774

1182

for aname in (iname.format(i)

1775

1183

for i in itertools.count()):

1779

1187

if interface_names:

1780

1188

# Replace the class with a new subclass of it with

1781

1189

# methods, signals, etc. as created above.

1782

if sys.version_info.major == 2:

1783

cls = type(b"{}Alternate".format(cls.__name__),

1784

(cls, ), attr)

1785

else:

1786

cls = type("{}Alternate".format(cls.__name__),

1787

(cls, ), attr)

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1788

1192

return cls

1789

1790

1193

return wrapper

1791

1194

1792

1195

1793

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1794

"se.bsnet.fukt.Mandos"})

1197

"se.bsnet.fukt.Mandos"})

1795

1198

class ClientDBus(Client, DBusObjectWithProperties):

1796

1199

"""A Client class using D-Bus

1797

1200

1798

1201

Attributes:

1799

1202

dbus_object_path: dbus.ObjectPath

1800

1203

bus: dbus.SystemBus()

1801

1204

"""

1802

1205

1803

1206

runtime_expansions = (Client.runtime_expansions

1804

+ ("dbus_object_path", ))

1805

1806

_interface = "se.recompile.Mandos.Client"

1807

1207

+ ("dbus_object_path",))

1208

1808

1209

# dbus.service.Object doesn't use super(), so we can't either.

1809

1810

def __init__(self, bus=None, *args, **kwargs):

1210

1211

def __init__(self, bus = None, *args, **kwargs):

1811

1212

self.bus = bus

1812

1213

Client.__init__(self, *args, **kwargs)

1813

1214

# Only now, when this client is initialized, can it show up on

1814

1215

# the D-Bus

1815

client_object_name = str(self.name).translate(

1216

client_object_name = unicode(self.name).translate(

1816

1217

{ord("."): ord("_"),

1817

1218

ord("-"): ord("_")})

1818

self.dbus_object_path = dbus.ObjectPath(

1819

"/clients/" + client_object_name)

1219

self.dbus_object_path = (dbus.ObjectPath

1220

("/clients/" + client_object_name))

1820

1221

DBusObjectWithProperties.__init__(self, self.bus,

1821

1222

self.dbus_object_path)

1822

1823

def notifychangeproperty(transform_func, dbus_name,

1824

type_func=lambda x: x,

1825

variant_level=1,

1826

invalidate_only=False,

1827

_interface=_interface):

1223

1224

def notifychangeproperty(transform_func,

1225

dbus_name, type_func=lambda x: x,

1226

variant_level=1):

1828

1227

""" Modify a variable so that it's a property which announces

1829

1228

its changes to DBus.

1830

1229

1831

1230

transform_fun: Function that takes a value and a variant_level

1832

1231

and transforms it to a D-Bus type.

1833

1232

dbus_name: D-Bus name of the variable

1835

1234

to the D-Bus. Default: no transform

1836

1235

variant_level: D-Bus variant level. Default: 1

1837

1236

"""

1838

attrname = "_{}".format(dbus_name)

1839

1237

attrname = "_{0}".format(dbus_name)

1840

1238

def setter(self, value):

1841

1239

if hasattr(self, "dbus_object_path"):

1842

1240

if (not hasattr(self, attrname) or

1843

1241

type_func(getattr(self, attrname, None))

1844

1242

!= type_func(value)):

1845

if invalidate_only:

1846

self.PropertiesChanged(

1847

_interface, dbus.Dictionary(),

1848

dbus.Array((dbus_name, )))

1849

else:

1850

dbus_value = transform_func(

1851

type_func(value),

1852

variant_level=variant_level)

1853

self.PropertyChanged(dbus.String(dbus_name),

1854

dbus_value)

1855

self.PropertiesChanged(

1856

_interface,

1857

dbus.Dictionary({dbus.String(dbus_name):

1858

dbus_value}),

1859

dbus.Array())

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

1246

self.PropertyChanged(dbus.String(dbus_name),

1247

dbus_value)

1860

1248

setattr(self, attrname, value)

1861

1249

1862

1250

return property(lambda self: getattr(self, attrname), setter)

1863

1251

1864

1252

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1865

1253

approvals_pending = notifychangeproperty(dbus.Boolean,

1866

1254

"ApprovalPending",

1867

type_func=bool)

1255

type_func = bool)

1868

1256

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1869

1257

last_enabled = notifychangeproperty(datetime_to_dbus,

1870

1258

"LastEnabled")

1871

checker = notifychangeproperty(

1872

dbus.Boolean, "CheckerRunning",

1873

type_func=lambda checker: checker is not None)

1259

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

1874

1262

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1875

1263

"LastCheckedOK")

1876

1264

last_checker_status = notifychangeproperty(dbus.Int16,

1879

1267

datetime_to_dbus, "LastApprovalRequest")

1880

1268

approved_by_default = notifychangeproperty(dbus.Boolean,

1881

1269

"ApprovedByDefault")

1882

approval_delay = notifychangeproperty(

1883

dbus.UInt64, "ApprovalDelay",

1884

type_func=lambda td: td.total_seconds() * 1000)

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1885

1274

approval_duration = notifychangeproperty(

1886

1275

dbus.UInt64, "ApprovalDuration",

1887

type_func=lambda td: td.total_seconds() * 1000)

1276

type_func = timedelta_to_milliseconds)

1888

1277

host = notifychangeproperty(dbus.String, "Host")

1889

timeout = notifychangeproperty(

1890

dbus.UInt64, "Timeout",

1891

type_func=lambda td: td.total_seconds() * 1000)

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1892

1281

extended_timeout = notifychangeproperty(

1893

1282

dbus.UInt64, "ExtendedTimeout",

1894

type_func=lambda td: td.total_seconds() * 1000)

1895

interval = notifychangeproperty(

1896

dbus.UInt64, "Interval",

1897

type_func=lambda td: td.total_seconds() * 1000)

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

1898

1288

checker_command = notifychangeproperty(dbus.String, "Checker")

1899

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1900

invalidate_only=True)

1901

1289

1902

1290

del notifychangeproperty

1903

1291

1904

1292

def __del__(self, *args, **kwargs):

1905

1293

try:

1906

1294

self.remove_from_connection()

1909

1297

if hasattr(DBusObjectWithProperties, "__del__"):

1910

1298

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1911

1299

Client.__del__(self, *args, **kwargs)

1912

1913

def checker_callback(self, source, condition,

1914

connection, command, *args, **kwargs):

1915

ret = Client.checker_callback(self, source, condition,

1916

connection, command, *args,

1917

**kwargs)

1918

exitstatus = self.last_checker_status

1919

if exitstatus >= 0:

1300

1301

def checker_callback(self, pid, condition, command,

1302

*args, **kwargs):

1303

self.checker_callback_tag = None

1304

self.checker = None

1305

if os.WIFEXITED(condition):

1306

exitstatus = os.WEXITSTATUS(condition)

1920

1307

# Emit D-Bus signal

1921

1308

self.CheckerCompleted(dbus.Int16(exitstatus),

1922

# This is specific to GNU libC

1923

dbus.Int64(exitstatus << 8),

1309

dbus.Int64(condition),

1924

1310

dbus.String(command))

1925

1311

else:

1926

1312

# Emit D-Bus signal

1927

1313

self.CheckerCompleted(dbus.Int16(-1),

1928

dbus.Int64(

1929

# This is specific to GNU libC

1930

(exitstatus << 8)

1931

| self.last_checker_signal),

1314

dbus.Int64(condition),

1932

1315

dbus.String(command))

1933

return ret

1934

1316

1317

return Client.checker_callback(self, pid, condition, command,

1318

*args, **kwargs)

1319

1935

1320

def start_checker(self, *args, **kwargs):

1936

old_checker_pid = getattr(self.checker, "pid", None)

1321

old_checker = self.checker

1322

if self.checker is not None:

1323

old_checker_pid = self.checker.pid

1324

else:

1325

old_checker_pid = None

1937

1326

r = Client.start_checker(self, *args, **kwargs)

1938

1327

# Only if new checker process was started

1939

1328

if (self.checker is not None

1941

1330

# Emit D-Bus signal

1942

1331

self.CheckerStarted(self.current_checker_command)

1943

1332

return r

1944

1333

1945

1334

def _reset_approved(self):

1946

1335

self.approved = None

1947

1336

return False

1948

1337

1949

1338

def approve(self, value=True):

1950

1339

self.approved = value

1951

GLib.timeout_add(int(self.approval_duration.total_seconds()

1952

* 1000), self._reset_approved)

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

1953

1343

self.send_changedstate()

1954

1955

# D-Bus methods, signals & properties

1956

1957

# Interfaces

1958

1959

# Signals

1960

1344

1345

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1347

1348

## Interfaces

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

1355

## Signals

1356

1961

1357

# CheckerCompleted - signal

1962

1358

@dbus.service.signal(_interface, signature="nxs")

1963

1359

def CheckerCompleted(self, exitcode, waitstatus, command):

1964

1360

"D-Bus signal"

1965

1361

pass

1966

1362

1967

1363

# CheckerStarted - signal

1968

1364

@dbus.service.signal(_interface, signature="s")

1969

1365

def CheckerStarted(self, command):

1970

1366

"D-Bus signal"

1971

1367

pass

1972

1368

1973

1369

# PropertyChanged - signal

1974

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1975

1370

@dbus.service.signal(_interface, signature="sv")

1976

1371

def PropertyChanged(self, property, value):

1977

1372

"D-Bus signal"

1978

1373

pass

1979

1374

1980

1375

# GotSecret - signal

1981

1376

@dbus.service.signal(_interface)

1982

1377

def GotSecret(self):

1985

1380

server to mandos-client

1986

1381

"""

1987

1382

pass

1988

1383

1989

1384

# Rejected - signal

1990

1385

@dbus.service.signal(_interface, signature="s")

1991

1386

def Rejected(self, reason):

1992

1387

"D-Bus signal"

1993

1388

pass

1994

1389

1995

1390

# NeedApproval - signal

1996

1391

@dbus.service.signal(_interface, signature="tb")

1997

1392

def NeedApproval(self, timeout, default):

1998

1393

"D-Bus signal"

1999

1394

return self.need_approval()

2000

2001

# Methods

2002

1395

1396

## Methods

1397

2003

1398

# Approve - method

2004

1399

@dbus.service.method(_interface, in_signature="b")

2005

1400

def Approve(self, value):

2006

1401

self.approve(value)

2007

1402

2008

1403

# CheckedOK - method

2009

1404

@dbus.service.method(_interface)

2010

1405

def CheckedOK(self):

2011

1406

self.checked_ok()

2012

1407

2013

1408

# Enable - method

2014

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1409

@dbus.service.method(_interface)

2016

1410

def Enable(self):

2017

1411

"D-Bus method"

2018

1412

self.enable()

2019

1413

2020

1414

# StartChecker - method

2021

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2022

1415

@dbus.service.method(_interface)

2023

1416

def StartChecker(self):

2024

1417

"D-Bus method"

2025

1418

self.start_checker()

2026

1419

2027

1420

# Disable - method

2028

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2029

1421

@dbus.service.method(_interface)

2030

1422

def Disable(self):

2031

1423

"D-Bus method"

2032

1424

self.disable()

2033

1425

2034

1426

# StopChecker - method

2035

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2036

1427

@dbus.service.method(_interface)

2037

1428

def StopChecker(self):

2038

1429

self.stop_checker()

2039

2040

# Properties

2041

1430

1431

## Properties

1432

2042

1433

# ApprovalPending - property

2043

1434

@dbus_service_property(_interface, signature="b", access="read")

2044

1435

def ApprovalPending_dbus_property(self):

2045

1436

return dbus.Boolean(bool(self.approvals_pending))

2046

1437

2047

1438

# ApprovedByDefault - property

2048

@dbus_service_property(_interface,

2049

signature="b",

1439

@dbus_service_property(_interface, signature="b",

2050

1440

access="readwrite")

2051

1441

def ApprovedByDefault_dbus_property(self, value=None):

2052

1442

if value is None: # get

2053

1443

return dbus.Boolean(self.approved_by_default)

2054

1444

self.approved_by_default = bool(value)

2055

1445

2056

1446

# ApprovalDelay - property

2057

@dbus_service_property(_interface,

2058

signature="t",

1447

@dbus_service_property(_interface, signature="t",

2059

1448

access="readwrite")

2060

1449

def ApprovalDelay_dbus_property(self, value=None):

2061

1450

if value is None: # get

2062

return dbus.UInt64(self.approval_delay.total_seconds()

2063

* 1000)

1451

return dbus.UInt64(self.approval_delay_milliseconds())

2064

1452

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2065

1453

2066

1454

# ApprovalDuration - property

2067

@dbus_service_property(_interface,

2068

signature="t",

1455

@dbus_service_property(_interface, signature="t",

2069

1456

access="readwrite")

2070

1457

def ApprovalDuration_dbus_property(self, value=None):

2071

1458

if value is None: # get

2072

return dbus.UInt64(self.approval_duration.total_seconds()

2073

* 1000)

1459

return dbus.UInt64(timedelta_to_milliseconds(

1460

self.approval_duration))

2074

1461

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2075

1462

2076

1463

# Name - property

2077

@dbus_annotations(

2078

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2079

1464

@dbus_service_property(_interface, signature="s", access="read")

2080

1465

def Name_dbus_property(self):

2081

1466

return dbus.String(self.name)

2082

2083

# KeyID - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

@dbus_service_property(_interface, signature="s", access="read")

2087

def KeyID_dbus_property(self):

2088

return dbus.String(self.key_id)

2089

1467

2090

1468

# Fingerprint - property

2091

@dbus_annotations(

2092

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2093

1469

@dbus_service_property(_interface, signature="s", access="read")

2094

1470

def Fingerprint_dbus_property(self):

2095

1471

return dbus.String(self.fingerprint)

2096

1472

2097

1473

# Host - property

2098

@dbus_service_property(_interface,

2099

signature="s",

1474

@dbus_service_property(_interface, signature="s",

2100

1475

access="readwrite")

2101

1476

def Host_dbus_property(self, value=None):

2102

1477

if value is None: # get

2103

1478

return dbus.String(self.host)

2104

self.host = str(value)

2105

1479

self.host = unicode(value)

1480

2106

1481

# Created - property

2107

@dbus_annotations(

2108

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2109

1482

@dbus_service_property(_interface, signature="s", access="read")

2110

1483

def Created_dbus_property(self):

2111

1484

return datetime_to_dbus(self.created)

2112

1485

2113

1486

# LastEnabled - property

2114

1487

@dbus_service_property(_interface, signature="s", access="read")

2115

1488

def LastEnabled_dbus_property(self):

2116

1489

return datetime_to_dbus(self.last_enabled)

2117

1490

2118

1491

# Enabled - property

2119

@dbus_service_property(_interface,

2120

signature="b",

1492

@dbus_service_property(_interface, signature="b",

2121

1493

access="readwrite")

2122

1494

def Enabled_dbus_property(self, value=None):

2123

1495

if value is None: # get

2126

1498

self.enable()

2127

1499

else:

2128

1500

self.disable()

2129

1501

2130

1502

# LastCheckedOK - property

2131

@dbus_service_property(_interface,

2132

signature="s",

1503

@dbus_service_property(_interface, signature="s",

2133

1504

access="readwrite")

2134

1505

def LastCheckedOK_dbus_property(self, value=None):

2135

1506

if value is not None:

2136

1507

self.checked_ok()

2137

1508

return

2138

1509

return datetime_to_dbus(self.last_checked_ok)

2139

1510

2140

1511

# LastCheckerStatus - property

2141

@dbus_service_property(_interface, signature="n", access="read")

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

2142

1514

def LastCheckerStatus_dbus_property(self):

2143

1515

return dbus.Int16(self.last_checker_status)

2144

1516

2145

1517

# Expires - property

2146

1518

@dbus_service_property(_interface, signature="s", access="read")

2147

1519

def Expires_dbus_property(self):

2148

1520

return datetime_to_dbus(self.expires)

2149

1521

2150

1522

# LastApprovalRequest - property

2151

1523

@dbus_service_property(_interface, signature="s", access="read")

2152

1524

def LastApprovalRequest_dbus_property(self):

2153

1525

return datetime_to_dbus(self.last_approval_request)

2154

1526

2155

1527

# Timeout - property

2156

@dbus_service_property(_interface,

2157

signature="t",

1528

@dbus_service_property(_interface, signature="t",

2158

1529

access="readwrite")

2159

1530

def Timeout_dbus_property(self, value=None):

2160

1531

if value is None: # get

2161

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1532

return dbus.UInt64(self.timeout_milliseconds())

2162

1533

old_timeout = self.timeout

2163

1534

self.timeout = datetime.timedelta(0, 0, 0, value)

2164

1535

# Reschedule disabling

2172

1543

if (getattr(self, "disable_initiator_tag", None)

2173

1544

is None):

2174

1545

return

2175

GLib.source_remove(self.disable_initiator_tag)

2176

self.disable_initiator_tag = GLib.timeout_add(

2177

int((self.expires - now).total_seconds() * 1000),

2178

self.disable)

2179

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1551

2180

1552

# ExtendedTimeout - property

2181

@dbus_service_property(_interface,

2182

signature="t",

1553

@dbus_service_property(_interface, signature="t",

2183

1554

access="readwrite")

2184

1555

def ExtendedTimeout_dbus_property(self, value=None):

2185

1556

if value is None: # get

2186

return dbus.UInt64(self.extended_timeout.total_seconds()

2187

* 1000)

1557

return dbus.UInt64(self.extended_timeout_milliseconds())

2188

1558

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2189

1559

2190

1560

# Interval - property

2191

@dbus_service_property(_interface,

2192

signature="t",

1561

@dbus_service_property(_interface, signature="t",

2193

1562

access="readwrite")

2194

1563

def Interval_dbus_property(self, value=None):

2195

1564

if value is None: # get

2196

return dbus.UInt64(self.interval.total_seconds() * 1000)

1565

return dbus.UInt64(self.interval_milliseconds())

2197

1566

self.interval = datetime.timedelta(0, 0, 0, value)

2198

1567

if getattr(self, "checker_initiator_tag", None) is None:

2199

1568

return

2200

1569

if self.enabled:

2201

1570

# Reschedule checker run

2202

GLib.source_remove(self.checker_initiator_tag)

2203

self.checker_initiator_tag = GLib.timeout_add(

2204

value, self.start_checker)

2205

self.start_checker() # Start one now, too

2206

1571

gobject.source_remove(self.checker_initiator_tag)

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1575

2207

1576

# Checker - property

2208

@dbus_service_property(_interface,

2209

signature="s",

1577

@dbus_service_property(_interface, signature="s",

2210

1578

access="readwrite")

2211

1579

def Checker_dbus_property(self, value=None):

2212

1580

if value is None: # get

2213

1581

return dbus.String(self.checker_command)

2214

self.checker_command = str(value)

2215

1582

self.checker_command = unicode(value)

1583

2216

1584

# CheckerRunning - property

2217

@dbus_service_property(_interface,

2218

signature="b",

1585

@dbus_service_property(_interface, signature="b",

2219

1586

access="readwrite")

2220

1587

def CheckerRunning_dbus_property(self, value=None):

2221

1588

if value is None: # get

2224

1591

self.start_checker()

2225

1592

else:

2226

1593

self.stop_checker()

2227

1594

2228

1595

# ObjectPath - property

2229

@dbus_annotations(

2230

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2231

"org.freedesktop.DBus.Deprecated": "true"})

2232

1596

@dbus_service_property(_interface, signature="o", access="read")

2233

1597

def ObjectPath_dbus_property(self):

2234

return self.dbus_object_path # is already a dbus.ObjectPath

2235

1598

return self.dbus_object_path # is already a dbus.ObjectPath

1599

2236

1600

# Secret = property

2237

@dbus_annotations(

2238

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2239

"invalidates"})

2240

@dbus_service_property(_interface,

2241

signature="ay",

2242

access="write",

2243

byte_arrays=True)

1601

@dbus_service_property(_interface, signature="ay",

1602

access="write", byte_arrays=True)

2244

1603

def Secret_dbus_property(self, value):

2245

self.secret = bytes(value)

2246

1604

self.secret = str(value)

1605

2247

1606

del _interface

2248

1607

2249

1608

2250

class ProxyClient:

2251

def __init__(self, child_pipe, key_id, fpr, address):

1609

class ProxyClient(object):

1610

def __init__(self, child_pipe, fpr, address):

2252

1611

self._pipe = child_pipe

2253

self._pipe.send(('init', key_id, fpr, address))

1612

self._pipe.send(('init', fpr, address))

2254

1613

if not self._pipe.recv():

2255

raise KeyError(key_id or fpr)

2256

1614

raise KeyError()

1615

2257

1616

def __getattribute__(self, name):

2258

1617

if name == '_pipe':

2259

1618

return super(ProxyClient, self).__getattribute__(name)

2262

1621

if data[0] == 'data':

2263

1622

return data[1]

2264

1623

if data[0] == 'function':

2265

2266

1624

def func(*args, **kwargs):

2267

1625

self._pipe.send(('funcall', name, args, kwargs))

2268

1626

return self._pipe.recv()[1]

2269

2270

1627

return func

2271

1628

2272

1629

def __setattr__(self, name, value):

2273

1630

if name == '_pipe':

2274

1631

return super(ProxyClient, self).__setattr__(name, value)

2277

1634

2278

1635

class ClientHandler(socketserver.BaseRequestHandler, object):

2279

1636

"""A class to handle client connections.

2280

1637

2281

1638

Instantiated once for each connection to handle it.

2282

1639

Note: This will run in its own forked process."""

2283

1640

2284

1641

def handle(self):

2285

1642

with contextlib.closing(self.server.child_pipe) as child_pipe:

2286

1643

logger.info("TCP connection from: %s",

2287

str(self.client_address))

1644

unicode(self.client_address))

2288

1645

logger.debug("Pipe FD: %d",

2289

1646

self.server.child_pipe.fileno())

2290

2291

session = gnutls.ClientSession(self.request)

2292

2293

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2294

# "+AES-256-CBC", "+SHA1",

2295

# "+COMP-NULL", "+CTYPE-OPENPGP",

2296

# "+DHE-DSS"))

1647

1648

session = (gnutls.connection

1649

.ClientSession(self.request,

1650

gnutls.connection

1651

.X509Credentials()))

1652

1653

# Note: gnutls.connection.X509Credentials is really a

1654

# generic GnuTLS certificate credentials object so long as

1655

# no X.509 keys are added to it. Therefore, we can use it

1656

# here despite using OpenPGP certificates.

1657

1658

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1659

# "+AES-256-CBC", "+SHA1",

1660

# "+COMP-NULL", "+CTYPE-OPENPGP",

1661

# "+DHE-DSS"))

2297

1662

# Use a fallback default, since this MUST be set.

2298

1663

priority = self.server.gnutls_priority

2299

1664

if priority is None:

2300

1665

priority = "NORMAL"

2301

gnutls.priority_set_direct(session._c_object,

2302

priority.encode("utf-8"),

2303

None)

2304

1666

(gnutls.library.functions

1667

.gnutls_priority_set_direct(session._c_object,

1668

priority, None))

1669

2305

1670

# Start communication using the Mandos protocol

2306

1671

# Get protocol number

2307

1672

line = self.request.makefile().readline()

2308

1673

logger.debug("Protocol version: %r", line)

2309

1674

try:

2310

1675

if int(line.strip().split()[0]) > 1:

2311

raise RuntimeError(line)

1676

raise RuntimeError

2312

1677

except (ValueError, IndexError, RuntimeError) as error:

2313

1678

logger.error("Unknown protocol version: %s", error)

2314

1679

return

2315

1680

2316

1681

# Start GnuTLS connection

2317

1682

try:

2318

1683

session.handshake()

2319

except gnutls.Error as error:

1684

except gnutls.errors.GNUTLSError as error:

2320

1685

logger.warning("Handshake failed: %s", error)

2321

1686

# Do not run session.bye() here: the session is not

2322

1687

# established. Just abandon the request.

2323

1688

return

2324

1689

logger.debug("Handshake succeeded")

2325

1690

2326

1691

approval_required = False

2327

1692

try:

2328

if gnutls.has_rawpk:

2329

fpr = b""

2330

try:

2331

key_id = self.key_id(

2332

self.peer_certificate(session))

2333

except (TypeError, gnutls.Error) as error:

2334

logger.warning("Bad certificate: %s", error)

2335

return

2336

logger.debug("Key ID: %s", key_id)

2337

2338

else:

2339

key_id = b""

2340

try:

2341

fpr = self.fingerprint(

2342

self.peer_certificate(session))

2343

except (TypeError, gnutls.Error) as error:

2344

logger.warning("Bad certificate: %s", error)

2345

return

2346

logger.debug("Fingerprint: %s", fpr)

2347

2348

try:

2349

client = ProxyClient(child_pipe, key_id, fpr,

1693

try:

1694

fpr = self.fingerprint(self.peer_certificate

1695

(session))

1696

except (TypeError,

1697

gnutls.errors.GNUTLSError) as error:

1698

logger.warning("Bad certificate: %s", error)

1699

return

1700

logger.debug("Fingerprint: %s", fpr)

1701

1702

try:

1703

client = ProxyClient(child_pipe, fpr,

2350

1704

self.client_address)

2351

1705

except KeyError:

2352

1706

return

2353

1707

2354

1708

if client.approval_delay:

2355

1709

delay = client.approval_delay

2356

1710

client.approvals_pending += 1

2357

1711

approval_required = True

2358

1712

2359

1713

while True:

2360

1714

if not client.enabled:

2361

1715

logger.info("Client %s is disabled",

2362

client.name)

1716

client.name)

2363

1717

if self.server.use_dbus:

2364

1718

# Emit D-Bus signal

2365

1719

client.Rejected("Disabled")

2366

1720

return

2367

1721

2368

1722

if client.approved or not client.approval_delay:

2369

# We are approved or approval is disabled

1723

#We are approved or approval is disabled

2370

1724

break

2371

1725

elif client.approved is None:

2372

1726

logger.info("Client %s needs approval",

2374

1728

if self.server.use_dbus:

2375

1729

# Emit D-Bus signal

2376

1730

client.NeedApproval(

2377

client.approval_delay.total_seconds()

2378

* 1000, client.approved_by_default)

1731

client.approval_delay_milliseconds(),

1732

client.approved_by_default)

2379

1733

else:

2380

1734

logger.warning("Client %s was not approved",

2381

1735

client.name)

2383

1737

# Emit D-Bus signal

2384

1738

client.Rejected("Denied")

2385

1739

return

2386

2387

# wait until timeout or approved

1740

1741

#wait until timeout or approved

2388

1742

time = datetime.datetime.now()

2389

1743

client.changedstate.acquire()

2390

client.changedstate.wait(delay.total_seconds())

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

2391

1747

client.changedstate.release()

2392

1748

time2 = datetime.datetime.now()

2393

1749

if (time2 - time) >= delay:

2403

1759

break

2404

1760

else:

2405

1761

delay -= time2 - time

2406

2407

try:

2408

session.send(client.secret)

2409

except gnutls.Error as error:

2410

logger.warning("gnutls send failed",

2411

exc_info=error)

2412

return

2413

1762

1763

sent_size = 0

1764

while sent_size < len(client.secret):

1765

try:

1766

sent = session.send(client.secret[sent_size:])

1767

except gnutls.errors.GNUTLSError as error:

1768

logger.warning("gnutls send failed",

1769

exc_info=error)

1770

return

1771

logger.debug("Sent: %d, remaining: %d",

1772

sent, len(client.secret)

1773

- (sent_size + sent))

1774

sent_size += sent

1775

2414

1776

logger.info("Sending secret to %s", client.name)

2415

1777

# bump the timeout using extended_timeout

2416

1778

client.bump_timeout(client.extended_timeout)

2417

1779

if self.server.use_dbus:

2418

1780

# Emit D-Bus signal

2419

1781

client.GotSecret()

2420

1782

2421

1783

finally:

2422

1784

if approval_required:

2423

1785

client.approvals_pending -= 1

2424

1786

try:

2425

1787

session.bye()

2426

except gnutls.Error as error:

1788

except gnutls.errors.GNUTLSError as error:

2427

1789

logger.warning("GnuTLS bye failed",

2428

1790

exc_info=error)

2429

1791

2430

1792

@staticmethod

2431

1793

def peer_certificate(session):

2432

"Return the peer's certificate as a bytestring"

2433

try:

2434

cert_type = gnutls.certificate_type_get2(session._c_object,

2435

gnutls.CTYPE_PEERS)

2436

except AttributeError:

2437

cert_type = gnutls.certificate_type_get(session._c_object)

2438

if gnutls.has_rawpk:

2439

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2440

else:

2441

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2442

# If not a valid certificate type...

2443

if cert_type not in valid_cert_types:

2444

logger.info("Cert type %r not in %r", cert_type,

2445

valid_cert_types)

2446

# ...return invalid data

2447

return b""

1794

"Return the peer's OpenPGP certificate as a bytestring"

1795

# If not an OpenPGP certificate...

1796

if (gnutls.library.functions

1797

.gnutls_certificate_type_get(session._c_object)

1798

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1799

# ...do the normal thing

1800

return session.peer_certificate

2448

1801

list_size = ctypes.c_uint(1)

2449

cert_list = (gnutls.certificate_get_peers

1802

cert_list = (gnutls.library.functions

1803

.gnutls_certificate_get_peers

2450

1804

(session._c_object, ctypes.byref(list_size)))

2451

1805

if not bool(cert_list) and list_size.value != 0:

2452

raise gnutls.Error("error getting peer certificate")

1806

raise gnutls.errors.GNUTLSError("error getting peer"

1807

" certificate")

2453

1808

if list_size.value == 0:

2454

1809

return None

2455

1810

cert = cert_list[0]

2456

1811

return ctypes.string_at(cert.data, cert.size)

2457

2458

@staticmethod

2459

def key_id(certificate):

2460

"Convert a certificate bytestring to a hexdigit key ID"

2461

# New GnuTLS "datum" with the public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(certificate),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(certificate)))

2466

# XXX all these need to be created in the gnutls "module"

2467

# New empty GnuTLS certificate

2468

pubkey = gnutls.pubkey_t()

2469

gnutls.pubkey_init(ctypes.byref(pubkey))

2470

# Import the raw public key into the certificate

2471

gnutls.pubkey_import(pubkey,

2472

ctypes.byref(datum),

2473

gnutls.X509_FMT_DER)

2474

# New buffer for the key ID

2475

buf = ctypes.create_string_buffer(32)

2476

buf_len = ctypes.c_size_t(len(buf))

2477

# Get the key ID from the raw public key into the buffer

2478

gnutls.pubkey_get_key_id(

2479

pubkey,

2480

gnutls.KEYID_USE_SHA256,

2481

ctypes.cast(ctypes.byref(buf),

2482

ctypes.POINTER(ctypes.c_ubyte)),

2483

ctypes.byref(buf_len))

2484

# Deinit the certificate

2485

gnutls.pubkey_deinit(pubkey)

2486

2487

# Convert the buffer to a Python bytestring

2488

key_id = ctypes.string_at(buf, buf_len.value)

2489

# Convert the bytestring to hexadecimal notation

2490

hex_key_id = binascii.hexlify(key_id).upper()

2491

return hex_key_id

2492

1812

2493

1813

@staticmethod

2494

1814

def fingerprint(openpgp):

2495

1815

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2496

1816

# New GnuTLS "datum" with the OpenPGP public key

2497

datum = gnutls.datum_t(

2498

ctypes.cast(ctypes.c_char_p(openpgp),

2499

ctypes.POINTER(ctypes.c_ubyte)),

2500

ctypes.c_uint(len(openpgp)))

1817

datum = (gnutls.library.types

1818

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1819

ctypes.POINTER

1820

(ctypes.c_ubyte)),

1821

ctypes.c_uint(len(openpgp))))

2501

1822

# New empty GnuTLS certificate

2502

crt = gnutls.openpgp_crt_t()

2503

gnutls.openpgp_crt_init(ctypes.byref(crt))

1823

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1824

(gnutls.library.functions

1825

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2504

1826

# Import the OpenPGP public key into the certificate

2505

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2506

gnutls.OPENPGP_FMT_RAW)

1827

(gnutls.library.functions

1828

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1829

gnutls.library.constants

1830

.GNUTLS_OPENPGP_FMT_RAW))

2507

1831

# Verify the self signature in the key

2508

1832

crtverify = ctypes.c_uint()

2509

gnutls.openpgp_crt_verify_self(crt, 0,

2510

ctypes.byref(crtverify))

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_verify_self(crt, 0,

1835

ctypes.byref(crtverify)))

2511

1836

if crtverify.value != 0:

2512

gnutls.openpgp_crt_deinit(crt)

2513

raise gnutls.CertificateSecurityError(code

2514

=crtverify.value)

1837

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1838

raise (gnutls.errors.CertificateSecurityError

1839

("Verify failed"))

2515

1840

# New buffer for the fingerprint

2516

1841

buf = ctypes.create_string_buffer(20)

2517

1842

buf_len = ctypes.c_size_t()

2518

1843

# Get the fingerprint from the certificate into the buffer

2519

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2520

ctypes.byref(buf_len))

1844

(gnutls.library.functions

1845

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1846

ctypes.byref(buf_len)))

2521

1847

# Deinit the certificate

2522

gnutls.openpgp_crt_deinit(crt)

1848

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2523

1849

# Convert the buffer to a Python bytestring

2524

1850

fpr = ctypes.string_at(buf, buf_len.value)

2525

1851

# Convert the bytestring to hexadecimal notation

2527

1853

return hex_fpr

2528

1854

2529

1855

2530

class MultiprocessingMixIn:

1856

class MultiprocessingMixIn(object):

2531

1857

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2532

2533

1858

def sub_process_main(self, request, address):

2534

1859

try:

2535

1860

self.finish_request(request, address)

2536

1861

except Exception:

2537

1862

self.handle_error(request, address)

2538

1863

self.close_request(request)

2539

1864

2540

1865

def process_request(self, request, address):

2541

1866

"""Start a new process to process the request."""

2542

proc = multiprocessing.Process(target=self.sub_process_main,

2543

args=(request, address))

1867

proc = multiprocessing.Process(target = self.sub_process_main,

1868

args = (request, address))

2544

1869

proc.start()

2545

1870

return proc

2546

1871

2547

1872

2548

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1873

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2549

1874

""" adds a pipe to the MixIn """

2550

2551

1875

def process_request(self, request, client_address):

2552

1876

"""Overrides and wraps the original process_request().

2553

1877

2554

1878

This function creates a new pipe in self.pipe

2555

1879

"""

2556

1880

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2557

1881

2558

1882

proc = MultiprocessingMixIn.process_request(self, request,

2559

1883

client_address)

2560

1884

self.child_pipe.close()

2561

1885

self.add_pipe(parent_pipe, proc)

2562

1886

2563

1887

def add_pipe(self, parent_pipe, proc):

2564

1888

"""Dummy function; override as necessary"""

2565

raise NotImplementedError()

1889

raise NotImplementedError

2566

1890

2567

1891

2568

1892

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2569

socketserver.TCPServer):

1893

socketserver.TCPServer, object):

2570

1894

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2571

1895

2572

1896

Attributes:

2573

1897

enabled: Boolean; whether this server is activated yet

2574

1898

interface: None or a network interface name (string)

2575

1899

use_ipv6: Boolean; to use IPv6 or not

2576

1900

"""

2577

2578

1901

def __init__(self, server_address, RequestHandlerClass,

2579

interface=None,

2580

use_ipv6=True,

2581

socketfd=None):

1902

interface=None, use_ipv6=True, socketfd=None):

2582

1903

"""If socketfd is set, use that file descriptor instead of

2583

1904

creating a new one with socket.socket().

2584

1905

"""

2590

1911

self.socketfd = socketfd

2591

1912

# Save the original socket.socket() function

2592

1913

self.socket_socket = socket.socket

2593

2594

1914

# To implement --socket, we monkey patch socket.socket.

2595

#

1915

#

2596

1916

# (When socketserver.TCPServer is a new-style class, we

2597

1917

# could make self.socket into a property instead of monkey

2598

1918

# patching socket.socket.)

2599

#

1919

#

2600

1920

# Create a one-time-only replacement for socket.socket()

2601

1921

@functools.wraps(socket.socket)

2602

1922

def socket_wrapper(*args, **kwargs):

2614

1934

# socket_wrapper(), if socketfd was set.

2615

1935

socketserver.TCPServer.__init__(self, server_address,

2616

1936

RequestHandlerClass)

2617

1937

2618

1938

def server_bind(self):

2619

1939

"""This overrides the normal server_bind() function

2620

1940

to bind to an interface if one was specified, and also NOT to

2621

1941

bind to an address or port if they were not specified."""

2622

global SO_BINDTODEVICE

2623

1942

if self.interface is not None:

2624

1943

if SO_BINDTODEVICE is None:

2625

# Fall back to a hard-coded value which seems to be

2626

# common enough.

2627

logger.warning("SO_BINDTODEVICE not found, trying 25")

2628

SO_BINDTODEVICE = 25

2629

try:

2630

self.socket.setsockopt(

2631

socket.SOL_SOCKET, SO_BINDTODEVICE,

2632

(self.interface + "\0").encode("utf-8"))

2633

except socket.error as error:

2634

if error.errno == errno.EPERM:

2635

logger.error("No permission to bind to"

2636

" interface %s", self.interface)

2637

elif error.errno == errno.ENOPROTOOPT:

2638

logger.error("SO_BINDTODEVICE not available;"

2639

" cannot bind to interface %s",

2640

self.interface)

2641

elif error.errno == errno.ENODEV:

2642

logger.error("Interface %s does not exist,"

2643

" cannot bind", self.interface)

2644

else:

2645

raise

1944

logger.error("SO_BINDTODEVICE does not exist;"

1945

" cannot bind to interface %s",

1946

self.interface)

1947

else:

1948

try:

1949

self.socket.setsockopt(socket.SOL_SOCKET,

1950

SO_BINDTODEVICE,

1951

str(self.interface + '\0'))

1952

except socket.error as error:

1953

if error.errno == errno.EPERM:

1954

logger.error("No permission to bind to"

1955

" interface %s", self.interface)

1956

elif error.errno == errno.ENOPROTOOPT:

1957

logger.error("SO_BINDTODEVICE not available;"

1958

" cannot bind to interface %s",

1959

self.interface)

1960

elif error.errno == errno.ENODEV:

1961

logger.error("Interface %s does not exist,"

1962

" cannot bind", self.interface)

1963

else:

1964

raise

2646

1965

# Only bind(2) the socket if we really need to.

2647

1966

if self.server_address[0] or self.server_address[1]:

2648

if self.server_address[1]:

2649

self.allow_reuse_address = True

2650

1967

if not self.server_address[0]:

2651

1968

if self.address_family == socket.AF_INET6:

2652

any_address = "::" # in6addr_any

1969

any_address = "::" # in6addr_any

2653

1970

else:

2654

any_address = "0.0.0.0" # INADDR_ANY

1971

any_address = socket.INADDR_ANY

2655

1972

self.server_address = (any_address,

2656

1973

self.server_address[1])

2657

1974

elif not self.server_address[1]:

2658

self.server_address = (self.server_address[0], 0)

1975

self.server_address = (self.server_address[0],

1976

0)

2659

1977

# if self.interface:

2660

1978

# self.server_address = (self.server_address[0],

2661

1979

# 0, # port

2667

1985

2668

1986

class MandosServer(IPv6_TCPServer):

2669

1987

"""Mandos server.

2670

1988

2671

1989

Attributes:

2672

1990

clients: set of Client objects

2673

1991

gnutls_priority GnuTLS priority string

2674

1992

use_dbus: Boolean; to emit D-Bus signals or not

2675

2676

Assumes a GLib.MainLoop event loop.

1993

1994

Assumes a gobject.MainLoop event loop.

2677

1995

"""

2678

2679

1996

def __init__(self, server_address, RequestHandlerClass,

2680

interface=None,

2681

use_ipv6=True,

2682

clients=None,

2683

gnutls_priority=None,

2684

use_dbus=True,

2685

socketfd=None):

1997

interface=None, use_ipv6=True, clients=None,

1998

gnutls_priority=None, use_dbus=True, socketfd=None):

2686

1999

self.enabled = False

2687

2000

self.clients = clients

2688

2001

if self.clients is None:

2691

2004

self.gnutls_priority = gnutls_priority

2692

2005

IPv6_TCPServer.__init__(self, server_address,

2693

2006

RequestHandlerClass,

2694

interface=interface,

2695

use_ipv6=use_ipv6,

2696

socketfd=socketfd)

2697

2007

interface = interface,

2008

use_ipv6 = use_ipv6,

2009

socketfd = socketfd)

2698

2010

def server_activate(self):

2699

2011

if self.enabled:

2700

2012

return socketserver.TCPServer.server_activate(self)

2701

2013

2702

2014

def enable(self):

2703

2015

self.enabled = True

2704

2016

2705

2017

def add_pipe(self, parent_pipe, proc):

2706

2018

# Call "handle_ipc" for both data and EOF events

2707

GLib.io_add_watch(

2708

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2709

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2710

functools.partial(self.handle_ipc,

2711

parent_pipe=parent_pipe,

2712

proc=proc))

2713

2714

def handle_ipc(self, source, condition,

2715

parent_pipe=None,

2716

proc=None,

2717

client_object=None):

2019

gobject.io_add_watch(parent_pipe.fileno(),

2020

gobject.IO_IN | gobject.IO_HUP,

2021

functools.partial(self.handle_ipc,

2022

parent_pipe =

2023

parent_pipe,

2024

proc = proc))

2025

2026

def handle_ipc(self, source, condition, parent_pipe=None,

2027

proc = None, client_object=None):

2718

2028

# error, or the other end of multiprocessing.Pipe has closed

2719

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2029

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2720

2030

# Wait for other process to exit

2721

2031

proc.join()

2722

2032

return False

2723

2033

2724

2034

# Read a request from the child

2725

2035

request = parent_pipe.recv()

2726

2036

command = request[0]

2727

2037

2728

2038

if command == 'init':

2729

key_id = request[1].decode("ascii")

2730

fpr = request[2].decode("ascii")

2731

address = request[3]

2732

2733

for c in self.clients.values():

2734

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2735

"27AE41E4649B934CA495991B7852B855"):

2736

continue

2737

if key_id and c.key_id == key_id:

2738

client = c

2739

break

2740

if fpr and c.fingerprint == fpr:

2039

fpr = request[1]

2040

address = request[2]

2041

2042

for c in self.clients.itervalues():

2043

if c.fingerprint == fpr:

2741

2044

client = c

2742

2045

break

2743

2046

else:

2744

logger.info("Client not found for key ID: %s, address"

2745

": %s", key_id or fpr, address)

2047

logger.info("Client not found for fingerprint: %s, ad"

2048

"dress: %s", fpr, address)

2746

2049

if self.use_dbus:

2747

2050

# Emit D-Bus signal

2748

mandos_dbus_service.ClientNotFound(key_id or fpr,

2051

mandos_dbus_service.ClientNotFound(fpr,

2749

2052

address[0])

2750

2053

parent_pipe.send(False)

2751

2054

return False

2752

2753

GLib.io_add_watch(

2754

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2755

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2756

functools.partial(self.handle_ipc,

2757

parent_pipe=parent_pipe,

2758

proc=proc,

2759

client_object=client))

2055

2056

gobject.io_add_watch(parent_pipe.fileno(),

2057

gobject.IO_IN | gobject.IO_HUP,

2058

functools.partial(self.handle_ipc,

2059

parent_pipe =

2060

parent_pipe,

2061

proc = proc,

2062

client_object =

2063

client))

2760

2064

parent_pipe.send(True)

2761

2065

# remove the old hook in favor of the new above hook on

2762

2066

# same fileno

2765

2069

funcname = request[1]

2766

2070

args = request[2]

2767

2071

kwargs = request[3]

2768

2072

2769

2073

parent_pipe.send(('data', getattr(client_object,

2770

2074

funcname)(*args,

2771

**kwargs)))

2772

2075

**kwargs)))

2076

2773

2077

if command == 'getattr':

2774

2078

attrname = request[1]

2775

if isinstance(client_object.__getattribute__(attrname),

2776

collections.abc.Callable):

2777

parent_pipe.send(('function', ))

2079

if callable(client_object.__getattribute__(attrname)):

2080

parent_pipe.send(('function',))

2778

2081

else:

2779

parent_pipe.send((

2780

'data', client_object.__getattribute__(attrname)))

2781

2082

parent_pipe.send(('data', client_object

2083

.__getattribute__(attrname)))

2084

2782

2085

if command == 'setattr':

2783

2086

attrname = request[1]

2784

2087

value = request[2]

2785

2088

setattr(client_object, attrname, value)

2786

2089

2787

2090

return True

2788

2091

2789

2092

2790

def rfc3339_duration_to_delta(duration):

2791

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2792

2793

>>> timedelta = datetime.timedelta

2794

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2795

True

2796

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2797

True

2798

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2799

True

2800

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2801

True

2802

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2803

True

2804

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2805

True

2806

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2807

True

2808

>>> del timedelta

2809

"""

2810

2811

# Parsing an RFC 3339 duration with regular expressions is not

2812

# possible - there would have to be multiple places for the same

2813

# values, like seconds. The current code, while more esoteric, is

2814

# cleaner without depending on a parsing library. If Python had a

2815

# built-in library for parsing we would use it, but we'd like to

2816

# avoid excessive use of external libraries.

2817

2818

# New type for defining tokens, syntax, and semantics all-in-one

2819

Token = collections.namedtuple("Token", (

2820

"regexp", # To match token; if "value" is not None, must have

2821

# a "group" containing digits

2822

"value", # datetime.timedelta or None

2823

"followers")) # Tokens valid after this token

2824

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2825

# the "duration" ABNF definition in RFC 3339, Appendix A.

2826

token_end = Token(re.compile(r"$"), None, frozenset())

2827

token_second = Token(re.compile(r"(\d+)S"),

2828

datetime.timedelta(seconds=1),

2829

frozenset((token_end, )))

2830

token_minute = Token(re.compile(r"(\d+)M"),

2831

datetime.timedelta(minutes=1),

2832

frozenset((token_second, token_end)))

2833

token_hour = Token(re.compile(r"(\d+)H"),

2834

datetime.timedelta(hours=1),

2835

frozenset((token_minute, token_end)))

2836

token_time = Token(re.compile(r"T"),

2837

None,

2838

frozenset((token_hour, token_minute,

2839

token_second)))

2840

token_day = Token(re.compile(r"(\d+)D"),

2841

datetime.timedelta(days=1),

2842

frozenset((token_time, token_end)))

2843

token_month = Token(re.compile(r"(\d+)M"),

2844

datetime.timedelta(weeks=4),

2845

frozenset((token_day, token_end)))

2846

token_year = Token(re.compile(r"(\d+)Y"),

2847

datetime.timedelta(weeks=52),

2848

frozenset((token_month, token_end)))

2849

token_week = Token(re.compile(r"(\d+)W"),

2850

datetime.timedelta(weeks=1),

2851

frozenset((token_end, )))

2852

token_duration = Token(re.compile(r"P"), None,

2853

frozenset((token_year, token_month,

2854

token_day, token_time,

2855

token_week)))

2856

# Define starting values:

2857

# Value so far

2858

value = datetime.timedelta()

2859

found_token = None

2860

# Following valid tokens

2861

followers = frozenset((token_duration, ))

2862

# String left to parse

2863

s = duration

2864

# Loop until end token is found

2865

while found_token is not token_end:

2866

# Search for any currently valid tokens

2867

for token in followers:

2868

match = token.regexp.match(s)

2869

if match is not None:

2870

# Token found

2871

if token.value is not None:

2872

# Value found, parse digits

2873

factor = int(match.group(1), 10)

2874

# Add to value so far

2875

value += factor * token.value

2876

# Strip token from string

2877

s = token.regexp.sub("", s, 1)

2878

# Go to found token

2879

found_token = token

2880

# Set valid next tokens

2881

followers = found_token.followers

2882

break

2883

else:

2884

# No currently valid tokens were found

2885

raise ValueError("Invalid RFC 3339 duration: {!r}"

2886

.format(duration))

2887

# End token found

2888

return value

2889

2890

2891

2093

def string_to_delta(interval):

2892

2094

"""Parse a string and return a datetime.timedelta

2893

2894

>>> string_to_delta('7d') == datetime.timedelta(7)

2895

True

2896

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2897

True

2898

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2899

True

2900

>>> string_to_delta('24h') == datetime.timedelta(1)

2901

True

2902

>>> string_to_delta('1w') == datetime.timedelta(7)

2903

True

2904

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2905

True

2095

2096

>>> string_to_delta('7d')

2097

datetime.timedelta(7)

2098

>>> string_to_delta('60s')

2099

datetime.timedelta(0, 60)

2100

>>> string_to_delta('60m')

2101

datetime.timedelta(0, 3600)

2102

>>> string_to_delta('24h')

2103

datetime.timedelta(1)

2104

>>> string_to_delta('1w')

2105

datetime.timedelta(7)

2106

>>> string_to_delta('5m 30s')

2107

datetime.timedelta(0, 330)

2906

2108

"""

2907

2908

try:

2909

return rfc3339_duration_to_delta(interval)

2910

except ValueError:

2911

pass

2912

2913

2109

timevalue = datetime.timedelta(0)

2914

2110

for s in interval.split():

2915

2111

try:

2916

suffix = s[-1]

2112

suffix = unicode(s[-1])

2917

2113

value = int(s[:-1])

2918

2114

if suffix == "d":

2919

2115

delta = datetime.timedelta(value)

2926

2122

elif suffix == "w":

2927

2123

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2928

2124

else:

2929

raise ValueError("Unknown suffix {!r}".format(suffix))

2930

except IndexError as e:

2125

raise ValueError("Unknown suffix {0!r}"

2126

.format(suffix))

2127

except (ValueError, IndexError) as e:

2931

2128

raise ValueError(*(e.args))

2932

2129

timevalue += delta

2933

2130

return timevalue

2934

2131

2935

2132

2936

def daemon(nochdir=False, noclose=False):

2133

def daemon(nochdir = False, noclose = False):

2937

2134

"""See daemon(3). Standard BSD Unix function.

2938

2135

2939

2136

This should really exist as os.daemon, but it doesn't (yet)."""

2940

2137

if os.fork():

2941

2138

sys.exit()

2949

2146

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2950

2147

if not stat.S_ISCHR(os.fstat(null).st_mode):

2951

2148

raise OSError(errno.ENODEV,

2952

"{} not a character device"

2149

"{0} not a character device"

2953

2150

.format(os.devnull))

2954

2151

os.dup2(null, sys.stdin.fileno())

2955

2152

os.dup2(null, sys.stdout.fileno())

2959

2156

2960

2157

2961

2158

def main():

2962

2159

2963

2160

##################################################################

2964

2161

# Parsing of options, both command line and config file

2965

2162

2966

2163

parser = argparse.ArgumentParser()

2967

2164

parser.add_argument("-v", "--version", action="version",

2968

version="%(prog)s {}".format(version),

2165

version = "%(prog)s {0}".format(version),

2969

2166

help="show version number and exit")

2970

2167

parser.add_argument("-i", "--interface", metavar="IF",

2971

2168

help="Bind to interface IF")

2977

2174

help="Run self-test")

2978

2175

parser.add_argument("--debug", action="store_true",

2979

2176

help="Debug mode; run in foreground and log"

2980

" to terminal", default=None)

2177

" to terminal")

2981

2178

parser.add_argument("--debuglevel", metavar="LEVEL",

2982

2179

help="Debug level for stdout output")

2983

2180

parser.add_argument("--priority", help="GnuTLS"

2990

2187

" files")

2991

2188

parser.add_argument("--no-dbus", action="store_false",

2992

2189

dest="use_dbus", help="Do not provide D-Bus"

2993

" system bus interface", default=None)

2190

" system bus interface")

2994

2191

parser.add_argument("--no-ipv6", action="store_false",

2995

dest="use_ipv6", help="Do not use IPv6",

2996

default=None)

2192

dest="use_ipv6", help="Do not use IPv6")

2997

2193

parser.add_argument("--no-restore", action="store_false",

2998

2194

dest="restore", help="Do not restore stored"

2999

" state", default=None)

2195

" state")

3000

2196

parser.add_argument("--socket", type=int,

3001

2197

help="Specify a file descriptor to a network"

3002

2198

" socket to use instead of creating one")

3003

2199

parser.add_argument("--statedir", metavar="DIR",

3004

2200

help="Directory to save/restore state in")

3005

2201

parser.add_argument("--foreground", action="store_true",

3006

help="Run in foreground", default=None)

3007

parser.add_argument("--no-zeroconf", action="store_false",

3008

dest="zeroconf", help="Do not use Zeroconf",

3009

default=None)

3010

2202

help="Run in foreground")

2203

3011

2204

options = parser.parse_args()

3012

2205

2206

if options.check:

2207

import doctest

2208

doctest.testmod()

2209

sys.exit()

2210

3013

2211

# Default values for config file for server-global settings

3014

if gnutls.has_rawpk:

3015

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3016

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3017

else:

3018

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3019

":+SIGN-DSA-SHA256")

3020

server_defaults = {"interface": "",

3021

"address": "",

3022

"port": "",

3023

"debug": "False",

3024

"priority": priority,

3025

"servicename": "Mandos",

3026

"use_dbus": "True",

3027

"use_ipv6": "True",

3028

"debuglevel": "",

3029

"restore": "True",

3030

"socket": "",

3031

"statedir": "/var/lib/mandos",

3032

"foreground": "False",

3033

"zeroconf": "True",

3034

}

3035

del priority

3036

2212

server_defaults = { "interface": "",

2213

"address": "",

2214

"port": "",

2215

"debug": "False",

2216

"priority":

2217

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2218

"servicename": "Mandos",

2219

"use_dbus": "True",

2220

"use_ipv6": "True",

2221

"debuglevel": "",

2222

"restore": "True",

2223

"socket": "",

2224

"statedir": "/var/lib/mandos",

2225

"foreground": "False",

2226

}

2227

3037

2228

# Parse config file for server-global settings

3038

server_config = configparser.ConfigParser(server_defaults)

2229

server_config = configparser.SafeConfigParser(server_defaults)

3039

2230

del server_defaults

3040

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3041

# Convert the ConfigParser object to a dict

2231

server_config.read(os.path.join(options.configdir,

2232

"mandos.conf"))

2233

# Convert the SafeConfigParser object to a dict

3042

2234

server_settings = server_config.defaults()

3043

2235

# Use the appropriate methods on the non-string config options

3044

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3045

"foreground", "zeroconf"):

2236

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3046

2237

server_settings[option] = server_config.getboolean("DEFAULT",

3047

2238

option)

3048

2239

if server_settings["port"]:

3058

2249

server_settings["socket"] = os.dup(server_settings

3059

2250

["socket"])

3060

2251

del server_config

3061

2252

3062

2253

# Override the settings from the config file with command line

3063

2254

# options, if set.

3064

2255

for option in ("interface", "address", "port", "debug",

3065

"priority", "servicename", "configdir", "use_dbus",

3066

"use_ipv6", "debuglevel", "restore", "statedir",

3067

"socket", "foreground", "zeroconf"):

2256

"priority", "servicename", "configdir",

2257

"use_dbus", "use_ipv6", "debuglevel", "restore",

2258

"statedir", "socket", "foreground"):

3068

2259

value = getattr(options, option)

3069

2260

if value is not None:

3070

2261

server_settings[option] = value

3071

2262

del options

3072

2263

# Force all strings to be unicode

3073

2264

for option in server_settings.keys():

3074

if isinstance(server_settings[option], bytes):

3075

server_settings[option] = (server_settings[option]

3076

.decode("utf-8"))

3077

# Force all boolean options to be boolean

3078

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3079

"foreground", "zeroconf"):

3080

server_settings[option] = bool(server_settings[option])

2265

if type(server_settings[option]) is str:

2266

server_settings[option] = unicode(server_settings[option])

3081

2267

# Debug implies foreground

3082

2268

if server_settings["debug"]:

3083

2269

server_settings["foreground"] = True

3084

2270

# Now we have our good server settings in "server_settings"

3085

2271

3086

2272

##################################################################

3087

3088

if (not server_settings["zeroconf"]

3089

and not (server_settings["port"]

3090

or server_settings["socket"] != "")):

3091

parser.error("Needs port or socket to work without Zeroconf")

3092

2273

3093

2274

# For convenience

3094

2275

debug = server_settings["debug"]

3095

2276

debuglevel = server_settings["debuglevel"]

3098

2279

stored_state_path = os.path.join(server_settings["statedir"],

3099

2280

stored_state_file)

3100

2281

foreground = server_settings["foreground"]

3101

zeroconf = server_settings["zeroconf"]

3102

2282

3103

2283

if debug:

3104

2284

initlogger(debug, logging.DEBUG)

3105

2285

else:

3108

2288

else:

3109

2289

level = getattr(logging, debuglevel.upper())

3110

2290

initlogger(debug, level)

3111

2291

3112

2292

if server_settings["servicename"] != "Mandos":

3113

syslogger.setFormatter(

3114

logging.Formatter('Mandos ({}) [%(process)d]:'

3115

' %(levelname)s: %(message)s'.format(

3116

server_settings["servicename"])))

3117

2293

syslogger.setFormatter(logging.Formatter

2294

('Mandos ({0}) [%(process)d]:'

2295

' %(levelname)s: %(message)s'

2296

.format(server_settings

2297

["servicename"])))

2298

3118

2299

# Parse config file with clients

3119

client_config = configparser.ConfigParser(Client.client_defaults)

2300

client_config = configparser.SafeConfigParser(Client

2301

.client_defaults)

3120

2302

client_config.read(os.path.join(server_settings["configdir"],

3121

2303

"clients.conf"))

3122

2304

3123

2305

global mandos_dbus_service

3124

2306

mandos_dbus_service = None

3125

3126

socketfd = None

3127

if server_settings["socket"] != "":

3128

socketfd = server_settings["socket"]

3129

tcp_server = MandosServer(

3130

(server_settings["address"], server_settings["port"]),

3131

ClientHandler,

3132

interface=(server_settings["interface"] or None),

3133

use_ipv6=use_ipv6,

3134

gnutls_priority=server_settings["priority"],

3135

use_dbus=use_dbus,

3136

socketfd=socketfd)

2307

2308

tcp_server = MandosServer((server_settings["address"],

2309

server_settings["port"]),

2310

ClientHandler,

2311

interface=(server_settings["interface"]

2312

or None),

2313

use_ipv6=use_ipv6,

2314

gnutls_priority=

2315

server_settings["priority"],

2316

use_dbus=use_dbus,

2317

socketfd=(server_settings["socket"]

2318

or None))

3137

2319

if not foreground:

3138

pidfilename = "/run/mandos.pid"

3139

if not os.path.isdir("/run/."):

3140

pidfilename = "/var/run/mandos.pid"

2320

pidfilename = "/var/run/mandos.pid"

3141

2321

pidfile = None

3142

2322

try:

3143

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2323

pidfile = open(pidfilename, "w")

3144

2324

except IOError as e:

3145

2325

logger.error("Could not open file %r", pidfilename,

3146

2326

exc_info=e)

3147

3148

for name, group in (("_mandos", "_mandos"),

3149

("mandos", "mandos"),

3150

("nobody", "nogroup")):

2327

2328

for name in ("_mandos", "mandos", "nobody"):

3151

2329

try:

3152

2330

uid = pwd.getpwnam(name).pw_uid

3153

gid = pwd.getpwnam(group).pw_gid

2331

gid = pwd.getpwnam(name).pw_gid

3154

2332

break

3155

2333

except KeyError:

3156

2334

continue

3160

2338

try:

3161

2339

os.setgid(gid)

3162

2340

os.setuid(uid)

3163

if debug:

3164

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3165

gid))

3166

2341

except OSError as error:

3167

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3168

.format(uid, gid, os.strerror(error.errno)))

3169

2342

if error.errno != errno.EPERM:

3170

raise

3171

2343

raise error

2344

3172

2345

if debug:

3173

2346

# Enable all possible GnuTLS debugging

3174

2347

3175

2348

# "Use a log level over 10 to enable all debugging options."

3176

2349

# - GnuTLS manual

3177

gnutls.global_set_log_level(11)

3178

3179

@gnutls.log_func

2350

gnutls.library.functions.gnutls_global_set_log_level(11)

2351

2352

@gnutls.library.types.gnutls_log_func

3180

2353

def debug_gnutls(level, string):

3181

2354

logger.debug("GnuTLS: %s", string[:-1])

3182

3183

gnutls.global_set_log_function(debug_gnutls)

3184

2355

2356

(gnutls.library.functions

2357

.gnutls_global_set_log_function(debug_gnutls))

2358

3185

2359

# Redirect stdin so all checkers get /dev/null

3186

2360

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3187

2361

os.dup2(null, sys.stdin.fileno())

3188

2362

if null > 2:

3189

2363

os.close(null)

3190

2364

3191

2365

# Need to fork before connecting to D-Bus

3192

2366

if not foreground:

3193

2367

# Close all input and output, do double fork, etc.

3194

2368

daemon()

3195

3196

if gi.version_info < (3, 10, 2):

3197

# multiprocessing will use threads, so before we use GLib we

3198

# need to inform GLib that threads will be used.

3199

GLib.threads_init()

3200

2369

2370

# multiprocessing will use threads, so before we use gobject we

2371

# need to inform gobject that threads will be used.

2372

gobject.threads_init()

2373

3201

2374

global main_loop

3202

2375

# From the Avahi example code

3203

2376

DBusGMainLoop(set_as_default=True)

3204

main_loop = GLib.MainLoop()

2377

main_loop = gobject.MainLoop()

3205

2378

bus = dbus.SystemBus()

3206

2379

# End of Avahi example code

3207

2380

if use_dbus:

3208

2381

try:

3209

2382

bus_name = dbus.service.BusName("se.recompile.Mandos",

3210

bus,

3211

do_not_queue=True)

3212

old_bus_name = dbus.service.BusName(

3213

"se.bsnet.fukt.Mandos", bus,

3214

do_not_queue=True)

3215

except dbus.exceptions.DBusException as e:

2383

bus, do_not_queue=True)

2384

old_bus_name = (dbus.service.BusName

2385

("se.bsnet.fukt.Mandos", bus,

2386

do_not_queue=True))

2387

except dbus.exceptions.NameExistsException as e:

3216

2388

logger.error("Disabling D-Bus:", exc_info=e)

3217

2389

use_dbus = False

3218

2390

server_settings["use_dbus"] = False

3219

2391

tcp_server.use_dbus = False

3220

if zeroconf:

3221

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3222

service = AvahiServiceToSyslog(

3223

name=server_settings["servicename"],

3224

servicetype="_mandos._tcp",

3225

protocol=protocol,

3226

bus=bus)

3227

if server_settings["interface"]:

3228

service.interface = if_nametoindex(

3229

server_settings["interface"].encode("utf-8"))

3230

2392

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2393

service = AvahiServiceToSyslog(name =

2394

server_settings["servicename"],

2395

servicetype = "_mandos._tcp",

2396

protocol = protocol, bus = bus)

2397

if server_settings["interface"]:

2398

service.interface = (if_nametoindex

2399

(str(server_settings["interface"])))

2400

3231

2401

global multiprocessing_manager

3232

2402

multiprocessing_manager = multiprocessing.Manager()

3233

2403

3234

2404

client_class = Client

3235

2405

if use_dbus:

3236

client_class = functools.partial(ClientDBus, bus=bus)

3237

2406

client_class = functools.partial(ClientDBus, bus = bus)

2407

3238

2408

client_settings = Client.config_parser(client_config)

3239

2409

old_client_settings = {}

3240

2410

clients_data = {}

3241

3242

# This is used to redirect stdout and stderr for checker processes

3243

global wnull

3244

wnull = open(os.devnull, "w") # A writable /dev/null

3245

# Only used if server is running in foreground but not in debug

3246

# mode

3247

if debug or not foreground:

3248

wnull.close()

3249

2411

3250

2412

# Get client data and settings from last running state.

3251

2413

if server_settings["restore"]:

3252

2414

try:

3253

2415

with open(stored_state_path, "rb") as stored_state:

3254

if sys.version_info.major == 2:

3255

clients_data, old_client_settings = pickle.load(

3256

stored_state)

3257

else:

3258

bytes_clients_data, bytes_old_client_settings = (

3259

pickle.load(stored_state, encoding="bytes"))

3260

# Fix bytes to strings

3261

# clients_data

3262

# .keys()

3263

clients_data = {(key.decode("utf-8")

3264

if isinstance(key, bytes)

3265

else key): value

3266

for key, value in

3267

bytes_clients_data.items()}

3268

del bytes_clients_data

3269

for key in clients_data:

3270

value = {(k.decode("utf-8")

3271

if isinstance(k, bytes) else k): v

3272

for k, v in

3273

clients_data[key].items()}

3274

clients_data[key] = value

3275

# .client_structure

3276

value["client_structure"] = [

3277

(s.decode("utf-8")

3278

if isinstance(s, bytes)

3279

else s) for s in

3280

value["client_structure"]]

3281

# .name, .host, and .checker_command

3282

for k in ("name", "host", "checker_command"):

3283

if isinstance(value[k], bytes):

3284

value[k] = value[k].decode("utf-8")

3285

if "key_id" not in value:

3286

value["key_id"] = ""

3287

elif "fingerprint" not in value:

3288

value["fingerprint"] = ""

3289

# old_client_settings

3290

# .keys()

3291

old_client_settings = {

3292

(key.decode("utf-8")

3293

if isinstance(key, bytes)

3294

else key): value

3295

for key, value in

3296

bytes_old_client_settings.items()}

3297

del bytes_old_client_settings

3298

# .host and .checker_command

3299

for value in old_client_settings.values():

3300

for attribute in ("host", "checker_command"):

3301

if isinstance(value[attribute], bytes):

3302

value[attribute] = (value[attribute]

3303

.decode("utf-8"))

2416

clients_data, old_client_settings = (pickle.load

2417

(stored_state))

3304

2418

os.remove(stored_state_path)

3305

2419

except IOError as e:

3306

2420

if e.errno == errno.ENOENT:

3307

logger.warning("Could not load persistent state:"

3308

" {}".format(os.strerror(e.errno)))

2421

logger.warning("Could not load persistent state: {0}"

2422

.format(os.strerror(e.errno)))

3309

2423

else:

3310

2424

logger.critical("Could not load persistent state:",

3311

2425

exc_info=e)

3312

2426

raise

3313

2427

except EOFError as e:

3314

2428

logger.warning("Could not load persistent state: "

3315

"EOFError:",

3316

exc_info=e)

3317

2429

"EOFError:", exc_info=e)

2430

3318

2431

with PGPEngine() as pgp:

3319

for client_name, client in clients_data.items():

3320

# Skip removed clients

3321

if client_name not in client_settings:

3322

continue

3323

2432

for client_name, client in clients_data.iteritems():

3324

2433

# Decide which value to use after restoring saved state.

3325

2434

# We have three different values: Old config file,

3326

2435

# new config file, and saved state.

3331

2440

# For each value in new config, check if it

3332

2441

# differs from the old config value (Except for

3333

2442

# the "secret" attribute)

3334

if (name != "secret"

3335

and (value !=

3336

old_client_settings[client_name][name])):

2443

if (name != "secret" and

2444

value != old_client_settings[client_name]

2445

[name]):

3337

2446

client[name] = value

3338

2447

except KeyError:

3339

2448

pass

3340

2449

3341

2450

# Clients who has passed its expire date can still be

3342

# enabled if its last checker was successful. A Client

2451

# enabled if its last checker was successful. Clients

3343

2452

# whose checker succeeded before we stored its state is

3344

2453

# assumed to have successfully run all checkers during

3345

2454

# downtime.

3347

2456

if datetime.datetime.utcnow() >= client["expires"]:

3348

2457

if not client["last_checked_ok"]:

3349

2458

logger.warning(

3350

"disabling client {} - Client never "

3351

"performed a successful checker".format(

3352

client_name))

2459

"disabling client {0} - Client never "

2460

"performed a successful checker"

2461

.format(client_name))

3353

2462

client["enabled"] = False

3354

2463

elif client["last_checker_status"] != 0:

3355

2464

logger.warning(

3356

"disabling client {} - Client last"

3357

" checker failed with error code"

3358

" {}".format(

3359

client_name,

3360

client["last_checker_status"]))

2465

"disabling client {0} - Client "

2466

"last checker failed with error code {1}"

2467

.format(client_name,

2468

client["last_checker_status"]))

3361

2469

client["enabled"] = False

3362

2470

else:

3363

client["expires"] = (

3364

datetime.datetime.utcnow()

3365

+ client["timeout"])

2471

client["expires"] = (datetime.datetime

2472

.utcnow()

2473

+ client["timeout"])

3366

2474

logger.debug("Last checker succeeded,"

3367

" keeping {} enabled".format(

3368

client_name))

2475

" keeping {0} enabled"

2476

.format(client_name))

3369

2477

try:

3370

client["secret"] = pgp.decrypt(

3371

client["encrypted_secret"],

3372

client_settings[client_name]["secret"])

2478

client["secret"] = (

2479

pgp.decrypt(client["encrypted_secret"],

2480

client_settings[client_name]

2481

["secret"]))

3373

2482

except PGPError:

3374

2483

# If decryption fails, we use secret from new settings

3375

logger.debug("Failed to decrypt {} old secret".format(

3376

client_name))

3377

client["secret"] = (client_settings[client_name]

3378

["secret"])

3379

2484

logger.debug("Failed to decrypt {0} old secret"

2485

.format(client_name))

2486

client["secret"] = (

2487

client_settings[client_name]["secret"])

2488

3380

2489

# Add/remove clients based on new changes made to config

3381

2490

for client_name in (set(old_client_settings)

3382

2491

- set(client_settings)):

3384

2493

for client_name in (set(client_settings)

3385

2494

- set(old_client_settings)):

3386

2495

clients_data[client_name] = client_settings[client_name]

3387

2496

3388

2497

# Create all client objects

3389

for client_name, client in clients_data.items():

2498

for client_name, client in clients_data.iteritems():

3390

2499

tcp_server.clients[client_name] = client_class(

3391

name=client_name,

3392

settings=client,

3393

server_settings=server_settings)

3394

2500

name = client_name, settings = client)

2501

3395

2502

if not tcp_server.clients:

3396

2503

logger.warning("No clients defined")

3397

2504

3398

2505

if not foreground:

3399

2506

if pidfile is not None:

3400

pid = os.getpid()

3401

2507

try:

3402

2508

with pidfile:

3403

print(pid, file=pidfile)

2509

pid = os.getpid()

2510

pidfile.write(str(pid) + "\n".encode("utf-8"))

3404

2511

except IOError:

3405

2512

logger.error("Could not write to file %r with PID %d",

3406

2513

pidfilename, pid)

3407

2514

del pidfile

3408

2515

del pidfilename

3409

3410

for termsig in (signal.SIGHUP, signal.SIGTERM):

3411

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3412

lambda: main_loop.quit() and False)

3413

2516

2517

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2518

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2519

3414

2520

if use_dbus:

3415

3416

@alternate_dbus_interfaces(

3417

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3418

class MandosDBusService(DBusObjectWithObjectManager):

2521

@alternate_dbus_interfaces({"se.recompile.Mandos":

2522

"se.bsnet.fukt.Mandos"})

2523

class MandosDBusService(DBusObjectWithProperties):

3419

2524

"""A D-Bus proxy object"""

3420

3421

2525

def __init__(self):

3422

2526

dbus.service.Object.__init__(self, bus, "/")

3423

3424

2527

_interface = "se.recompile.Mandos"

3425

2528

2529

@dbus_interface_annotations(_interface)

2530

def _foo(self):

2531

return { "org.freedesktop.DBus.Property"

2532

".EmitsChangedSignal":

2533

"false"}

2534

3426

2535

@dbus.service.signal(_interface, signature="o")

3427

2536

def ClientAdded(self, objpath):

3428

2537

"D-Bus signal"

3429

2538

pass

3430

2539

3431

2540

@dbus.service.signal(_interface, signature="ss")

3432

def ClientNotFound(self, key_id, address):

2541

def ClientNotFound(self, fingerprint, address):

3433

2542

"D-Bus signal"

3434

2543

pass

3435

3436

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3437

"true"})

2544

3438

2545

@dbus.service.signal(_interface, signature="os")

3439

2546

def ClientRemoved(self, objpath, name):

3440

2547

"D-Bus signal"

3441

2548

pass

3442

3443

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3444

"true"})

2549

3445

2550

@dbus.service.method(_interface, out_signature="ao")

3446

2551

def GetAllClients(self):

3447

2552

"D-Bus method"

3448

return dbus.Array(c.dbus_object_path for c in

3449

tcp_server.clients.values())

3450

3451

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3452

"true"})

2553

return dbus.Array(c.dbus_object_path

2554

for c in

2555

tcp_server.clients.itervalues())

2556

3453

2557

@dbus.service.method(_interface,

3454

2558

out_signature="a{oa{sv}}")

3455

2559

def GetAllClientsWithProperties(self):

3456

2560

"D-Bus method"

3457

2561

return dbus.Dictionary(

3458

{c.dbus_object_path: c.GetAll(

3459

"se.recompile.Mandos.Client")

3460

for c in tcp_server.clients.values()},

2562

((c.dbus_object_path, c.GetAll(""))

2563

for c in tcp_server.clients.itervalues()),

3461

2564

signature="oa{sv}")

3462

2565

3463

2566

@dbus.service.method(_interface, in_signature="o")

3464

2567

def RemoveClient(self, object_path):

3465

2568

"D-Bus method"

3466

for c in tcp_server.clients.values():

2569

for c in tcp_server.clients.itervalues():

3467

2570

if c.dbus_object_path == object_path:

3468

2571

del tcp_server.clients[c.name]

3469

2572

c.remove_from_connection()

3470

# Don't signal the disabling

2573

# Don't signal anything except ClientRemoved

3471

2574

c.disable(quiet=True)

3472

# Emit D-Bus signal for removal

3473

self.client_removed_signal(c)

2575

# Emit D-Bus signal

2576

self.ClientRemoved(object_path, c.name)

3474

2577

return

3475

2578

raise KeyError(object_path)

3476

2579

3477

2580

del _interface

3478

3479

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3480

out_signature="a{oa{sa{sv}}}")

3481

def GetManagedObjects(self):

3482

"""D-Bus method"""

3483

return dbus.Dictionary(

3484

{client.dbus_object_path:

3485

dbus.Dictionary(

3486

{interface: client.GetAll(interface)

3487

for interface in

3488

client._get_all_interface_names()})

3489

for client in tcp_server.clients.values()})

3490

3491

def client_added_signal(self, client):

3492

"""Send the new standard signal and the old signal"""

3493

if use_dbus:

3494

# New standard signal

3495

self.InterfacesAdded(

3496

client.dbus_object_path,

3497

dbus.Dictionary(

3498

{interface: client.GetAll(interface)

3499

for interface in

3500

client._get_all_interface_names()}))

3501

# Old signal

3502

self.ClientAdded(client.dbus_object_path)

3503

3504

def client_removed_signal(self, client):

3505

"""Send the new standard signal and the old signal"""

3506

if use_dbus:

3507

# New standard signal

3508

self.InterfacesRemoved(

3509

client.dbus_object_path,

3510

client._get_all_interface_names())

3511

# Old signal

3512

self.ClientRemoved(client.dbus_object_path,

3513

client.name)

3514

2581

3515

2582

mandos_dbus_service = MandosDBusService()

3516

3517

# Save modules to variables to exempt the modules from being

3518

# unloaded before the function registered with atexit() is run.

3519

mp = multiprocessing

3520

wn = wnull

3521

2583

3522

2584

def cleanup():

3523

2585

"Cleanup function; run on exit"

3524

if zeroconf:

3525

service.cleanup()

3526

3527

mp.active_children()

3528

wn.close()

2586

service.cleanup()

2587

2588

multiprocessing.active_children()

3529

2589

if not (tcp_server.clients or client_settings):

3530

2590

return

3531

2591

3532

2592

# Store client before exiting. Secrets are encrypted with key

3533

2593

# based on what config file has. If config file is

3534

2594

# removed/edited, old secret will thus be unrecovable.

3535

2595

clients = {}

3536

2596

with PGPEngine() as pgp:

3537

for client in tcp_server.clients.values():

2597

for client in tcp_server.clients.itervalues():

3538

2598

key = client_settings[client.name]["secret"]

3539

2599

client.encrypted_secret = pgp.encrypt(client.secret,

3540

2600

key)

3541

2601

client_dict = {}

3542

2602

3543

2603

# A list of attributes that can not be pickled

3544

2604

# + secret.

3545

exclude = {"bus", "changedstate", "secret",

3546

"checker", "server_settings"}

3547

for name, typ in inspect.getmembers(dbus.service

3548

.Object):

2605

exclude = set(("bus", "changedstate", "secret",

2606

"checker"))

2607

for name, typ in (inspect.getmembers

2608

(dbus.service.Object)):

3549

2609

exclude.add(name)

3550

2610

3551

2611

client_dict["encrypted_secret"] = (client

3552

2612

.encrypted_secret)

3553

2613

for attr in client.client_structure:

3554

2614

if attr not in exclude:

3555

2615

client_dict[attr] = getattr(client, attr)

3556

2616

3557

2617

clients[client.name] = client_dict

3558

2618

del client_settings[client.name]["secret"]

3559

2619

3560

2620

try:

3561

with tempfile.NamedTemporaryFile(

3562

mode='wb',

3563

suffix=".pickle",

3564

prefix='clients-',

3565

dir=os.path.dirname(stored_state_path),

3566

delete=False) as stored_state:

3567

pickle.dump((clients, client_settings), stored_state,

3568

protocol=2)

3569

tempname = stored_state.name

2621

with (tempfile.NamedTemporaryFile

2622

(mode='wb', suffix=".pickle", prefix='clients-',

2623

dir=os.path.dirname(stored_state_path),

2624

delete=False)) as stored_state:

2625

pickle.dump((clients, client_settings), stored_state)

2626

tempname=stored_state.name

3570

2627

os.rename(tempname, stored_state_path)

3571

2628

except (IOError, OSError) as e:

3572

2629

if not debug:

3575

2632

except NameError:

3576

2633

pass

3577

2634

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3578

logger.warning("Could not save persistent state: {}"

2635

logger.warning("Could not save persistent state: {0}"

3579

2636

.format(os.strerror(e.errno)))

3580

2637

else:

3581

2638

logger.warning("Could not save persistent state:",

3582

2639

exc_info=e)

3583

raise

3584

2640

raise e

2641

3585

2642

# Delete all clients, and settings from config

3586

2643

while tcp_server.clients:

3587

2644

name, client = tcp_server.clients.popitem()

3588

2645

if use_dbus:

3589

2646

client.remove_from_connection()

3590

# Don't signal the disabling

2647

# Don't signal anything except ClientRemoved

3591

2648

client.disable(quiet=True)

3592

# Emit D-Bus signal for removal

3593

2649

if use_dbus:

3594

mandos_dbus_service.client_removed_signal(client)

2650

# Emit D-Bus signal

2651

mandos_dbus_service.ClientRemoved(client

2652

.dbus_object_path,

2653

client.name)

3595

2654

client_settings.clear()

3596

2655

3597

2656

atexit.register(cleanup)

3598

3599

for client in tcp_server.clients.values():

2657

2658

for client in tcp_server.clients.itervalues():

3600

2659

if use_dbus:

3601

# Emit D-Bus signal for adding

3602

mandos_dbus_service.client_added_signal(client)

2660

# Emit D-Bus signal

2661

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3603

2662

# Need to initiate checking of clients

3604

2663

if client.enabled:

3605

2664

client.init_checker()

3606

2665

3607

2666

tcp_server.enable()

3608

2667

tcp_server.server_activate()

3609

2668

3610

2669

# Find out what port we got

3611

if zeroconf:

3612

service.port = tcp_server.socket.getsockname()[1]

2670

service.port = tcp_server.socket.getsockname()[1]

3613

2671

if use_ipv6:

3614

2672

logger.info("Now listening on address %r, port %d,"

3615

2673

" flowinfo %d, scope_id %d",

3617

2675

else: # IPv4

3618

2676

logger.info("Now listening on address %r, port %d",

3619

2677

*tcp_server.socket.getsockname())

3620

3621

# service.interface = tcp_server.socket.getsockname()[3]

3622

2678

2679

#service.interface = tcp_server.socket.getsockname()[3]

2680

3623

2681

try:

3624

if zeroconf:

3625

# From the Avahi example code

3626

try:

3627

service.activate()

3628

except dbus.exceptions.DBusException as error:

3629

logger.critical("D-Bus Exception", exc_info=error)

3630

cleanup()

3631

sys.exit(1)

3632

# End of Avahi example code

3633

3634

GLib.io_add_watch(

3635

GLib.IOChannel.unix_new(tcp_server.fileno()),

3636

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3637

lambda *args, **kwargs: (tcp_server.handle_request

3638

(*args[2:], **kwargs) or True))

3639

2682

# From the Avahi example code

2683

try:

2684

service.activate()

2685

except dbus.exceptions.DBusException as error:

2686

logger.critical("D-Bus Exception", exc_info=error)

2687

cleanup()

2688

sys.exit(1)

2689

# End of Avahi example code

2690

2691

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2692

lambda *args, **kwargs:

2693

(tcp_server.handle_request

2694

(*args[2:], **kwargs) or True))

2695

3640

2696

logger.debug("Starting main loop")

3641

2697

main_loop.run()

3642

2698

except AvahiError as error:

3651

2707

# Must run before the D-Bus bus name gets deregistered

3652

2708

cleanup()

3653

2709

3654

3655

def should_only_run_tests():

3656

parser = argparse.ArgumentParser(add_help=False)

3657

parser.add_argument("--check", action='store_true')

3658

args, unknown_args = parser.parse_known_args()

3659

run_tests = args.check

3660

if run_tests:

3661

# Remove --check argument from sys.argv

3662

sys.argv[1:] = unknown_args

3663

return run_tests

3664

3665

# Add all tests from doctest strings

3666

def load_tests(loader, tests, none):

3667

import doctest

3668

tests.addTests(doctest.DocTestSuite())

3669

return tests

3670

3671

2710

if __name__ == '__main__':

3672

try:

3673

if should_only_run_tests():

3674

# Call using ./mandos --check [--verbose]

3675

unittest.main()

3676

else:

3677

main()

3678

finally:

3679

logging.shutdown()

2711

main()