To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 610
- compare with another revision
- download diff
- download tarball
- view history from revision 610
- Committer: Teddy Hogeborn
- Date: 2012-06-23 13:50:05 UTC
- Revision ID: teddy@recompile.se-20120623135005-t0wtkmlw0ymnr2kg
* mandos (Client.start_checker): Return True (retry later) if starting
checker failed. Check for ECHILD
from waitpid().
checker failed. Check for ECHILD
from waitpid().
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- debian/upstream
- dracut-module
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
try:
44
import SocketServer as socketserver
45
except ImportError:
46
import socketserver
39
import SocketServer as socketserver
47
40
import socket
48
41
import argparse
49
42
import datetime
50
43
import errno
51
try:
52
import ConfigParser as configparser
53
except ImportError:
54
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
55
51
import sys
56
52
import re
57
53
import os
66
62
import struct
67
63
import fcntl
68
64
import functools
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
65
import cPickle as pickle
73
66
import multiprocessing
74
67
import types
75
68
import binascii
76
69
import tempfile
77
70
import itertools
78
71
import collections
79
import codecs
80
72
81
73
import dbus
82
74
import dbus.service
83
import gi
84
from gi.repository import GLib
75
import gobject
76
import avahi
85
77
from dbus.mainloop.glib import DBusGMainLoop
86
78
import ctypes
87
79
import ctypes.util
88
80
import xml.dom.minidom
89
81
import inspect
90
91
if sys.version_info.major == 2:
92
__metaclass__ = type
93
94
# Try to find the value of SO_BINDTODEVICE:
82
import GnuPGInterface
83
95
84
try:
96
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
97
# newer, and it is also the most natural place for it:
98
85
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
99
86
except AttributeError:
100
87
try:
101
# This is where SO_BINDTODEVICE was up to and including Python
102
# 2.6, and also 3.2:
103
88
from IN import SO_BINDTODEVICE
104
89
except ImportError:
105
# In Python 2.7 it seems to have been removed entirely.
106
# Try running the C preprocessor:
107
try:
108
cc = subprocess.Popen(["cc", "--language=c", "-E",
109
"/dev/stdin"],
110
stdin=subprocess.PIPE,
111
stdout=subprocess.PIPE)
112
stdout = cc.communicate(
113
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
114
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
115
except (OSError, ValueError, IndexError):
116
# No value found
117
SO_BINDTODEVICE = None
118
119
if sys.version_info.major == 2:
120
str = unicode
121
122
if sys.version_info < (3, 2):
123
configparser.Configparser = configparser.SafeConfigParser
124
125
version = "1.8.8"
90
SO_BINDTODEVICE = None
91
92
version = "1.6.0"
126
93
stored_state_file = "clients.pickle"
127
94
128
95
logger = logging.getLogger()
129
syslogger = None
96
syslogger = (logging.handlers.SysLogHandler
97
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
98
address = str("/dev/log")))
130
99
131
100
try:
132
if_nametoindex = ctypes.cdll.LoadLibrary(
133
ctypes.util.find_library("c")).if_nametoindex
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
134
104
except (OSError, AttributeError):
135
136
105
def if_nametoindex(interface):
137
106
"Get an interface index the hard way, i.e. using fcntl()"
138
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
139
108
with contextlib.closing(socket.socket()) as s:
140
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
141
struct.pack(b"16s16x", interface))
142
interface_index = struct.unpack("I", ifreq[16:20])[0]
110
struct.pack(str("16s16x"),
111
interface))
112
interface_index = struct.unpack(str("I"),
113
ifreq[16:20])[0]
143
114
return interface_index
144
115
145
116
146
def copy_function(func):
147
"""Make a copy of a function"""
148
if sys.version_info.major == 2:
149
return types.FunctionType(func.func_code,
150
func.func_globals,
151
func.func_name,
152
func.func_defaults,
153
func.func_closure)
154
else:
155
return types.FunctionType(func.__code__,
156
func.__globals__,
157
func.__name__,
158
func.__defaults__,
159
func.__closure__)
160
161
162
117
def initlogger(debug, level=logging.WARNING):
163
118
"""init logger and add loglevel"""
164
165
global syslogger
166
syslogger = (logging.handlers.SysLogHandler(
167
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
168
address="/dev/log"))
119
169
120
syslogger.setFormatter(logging.Formatter
170
121
('Mandos [%(process)d]: %(levelname)s:'
171
122
' %(message)s'))
172
123
logger.addHandler(syslogger)
173
124
174
125
if debug:
175
126
console = logging.StreamHandler()
176
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
186
137
pass
187
138
188
139
189
class PGPEngine:
140
class PGPEngine(object):
190
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
191
192
142
def __init__(self):
143
self.gnupg = GnuPGInterface.GnuPG()
193
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
194
self.gpg = "gpg"
195
try:
196
output = subprocess.check_output(["gpgconf"])
197
for line in output.splitlines():
198
name, text, path = line.split(b":")
199
if name == "gpg":
200
self.gpg = path
201
break
202
except OSError as e:
203
if e.errno != errno.ENOENT:
204
raise
205
self.gnupgargs = ['--batch',
206
'--homedir', self.tempdir,
207
'--force-mdc',
208
'--quiet']
209
# Only GPG version 1 has the --no-use-agent option.
210
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
211
self.gnupgargs.append("--no-use-agent")
212
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
149
'--quiet',
150
'--no-use-agent'])
151
213
152
def __enter__(self):
214
153
return self
215
154
216
155
def __exit__(self, exc_type, exc_value, traceback):
217
156
self._cleanup()
218
157
return False
219
158
220
159
def __del__(self):
221
160
self._cleanup()
222
161
223
162
def _cleanup(self):
224
163
if self.tempdir is not None:
225
164
# Delete contents of tempdir
226
165
for root, dirs, files in os.walk(self.tempdir,
227
topdown=False):
166
topdown = False):
228
167
for filename in files:
229
168
os.remove(os.path.join(root, filename))
230
169
for dirname in dirs:
232
171
# Remove tempdir
233
172
os.rmdir(self.tempdir)
234
173
self.tempdir = None
235
174
236
175
def password_encode(self, password):
237
176
# Passphrase can not be empty and can not contain newlines or
238
177
# NUL bytes. So we prefix it and hex encode it.
239
encoded = b"mandos" + binascii.hexlify(password)
240
if len(encoded) > 2048:
241
# GnuPG can't handle long passwords, so encode differently
242
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
243
.replace(b"\n", b"\\n")
244
.replace(b"\0", b"\\x00"))
245
return encoded
246
178
return b"mandos" + binascii.hexlify(password)
179
247
180
def encrypt(self, data, password):
248
passphrase = self.password_encode(password)
249
with tempfile.NamedTemporaryFile(
250
dir=self.tempdir) as passfile:
251
passfile.write(passphrase)
252
passfile.flush()
253
proc = subprocess.Popen([self.gpg, '--symmetric',
254
'--passphrase-file',
255
passfile.name]
256
+ self.gnupgargs,
257
stdin=subprocess.PIPE,
258
stdout=subprocess.PIPE,
259
stderr=subprocess.PIPE)
260
ciphertext, err = proc.communicate(input=data)
261
if proc.returncode != 0:
262
raise PGPError(err)
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
183
try:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
188
f.write(data)
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
191
proc.wait()
192
except IOError as e:
193
raise PGPError(e)
194
self.gnupg.passphrase = None
263
195
return ciphertext
264
196
265
197
def decrypt(self, data, password):
266
passphrase = self.password_encode(password)
267
with tempfile.NamedTemporaryFile(
268
dir=self.tempdir) as passfile:
269
passfile.write(passphrase)
270
passfile.flush()
271
proc = subprocess.Popen([self.gpg, '--decrypt',
272
'--passphrase-file',
273
passfile.name]
274
+ self.gnupgargs,
275
stdin=subprocess.PIPE,
276
stdout=subprocess.PIPE,
277
stderr=subprocess.PIPE)
278
decrypted_plaintext, err = proc.communicate(input=data)
279
if proc.returncode != 0:
280
raise PGPError(err)
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
200
try:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
205
f.write(data)
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
208
proc.wait()
209
except IOError as e:
210
raise PGPError(e)
211
self.gnupg.passphrase = None
281
212
return decrypted_plaintext
282
213
283
214
284
# Pretend that we have an Avahi module
285
class avahi:
286
"""This isn't so much a class as it is a module-like namespace."""
287
IF_UNSPEC = -1 # avahi-common/address.h
288
PROTO_UNSPEC = -1 # avahi-common/address.h
289
PROTO_INET = 0 # avahi-common/address.h
290
PROTO_INET6 = 1 # avahi-common/address.h
291
DBUS_NAME = "org.freedesktop.Avahi"
292
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
293
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
294
DBUS_PATH_SERVER = "/"
295
296
@staticmethod
297
def string_array_to_txt_array(t):
298
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
299
for s in t), signature="ay")
300
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
301
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
302
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
303
SERVER_INVALID = 0 # avahi-common/defs.h
304
SERVER_REGISTERING = 1 # avahi-common/defs.h
305
SERVER_RUNNING = 2 # avahi-common/defs.h
306
SERVER_COLLISION = 3 # avahi-common/defs.h
307
SERVER_FAILURE = 4 # avahi-common/defs.h
308
309
310
215
class AvahiError(Exception):
311
216
def __init__(self, value, *args, **kwargs):
312
217
self.value = value
313
return super(AvahiError, self).__init__(value, *args,
314
**kwargs)
315
218
super(AvahiError, self).__init__(value, *args, **kwargs)
219
def __unicode__(self):
220
return unicode(repr(self.value))
316
221
317
222
class AvahiServiceError(AvahiError):
318
223
pass
319
224
320
321
225
class AvahiGroupError(AvahiError):
322
226
pass
323
227
324
228
325
class AvahiService:
229
class AvahiService(object):
326
230
"""An Avahi (Zeroconf) service.
327
231
328
232
Attributes:
329
233
interface: integer; avahi.IF_UNSPEC or an interface index.
330
234
Used to optionally bind to the specified interface.
331
235
name: string; Example: 'Mandos'
332
236
type: string; Example: '_mandos._tcp'.
333
See <https://www.iana.org/assignments/service-names-port-numbers>
237
See <http://www.dns-sd.org/ServiceTypes.html>
334
238
port: integer; what port to announce
335
239
TXT: list of strings; TXT record for the service
336
240
domain: string; Domain to publish on, default to .local if empty.
342
246
server: D-Bus Server
343
247
bus: dbus.SystemBus()
344
248
"""
345
346
def __init__(self,
347
interface=avahi.IF_UNSPEC,
348
name=None,
349
servicetype=None,
350
port=None,
351
TXT=None,
352
domain="",
353
host="",
354
max_renames=32768,
355
protocol=avahi.PROTO_UNSPEC,
356
bus=None):
249
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
253
protocol = avahi.PROTO_UNSPEC, bus = None):
357
254
self.interface = interface
358
255
self.name = name
359
256
self.type = servicetype
368
265
self.server = None
369
266
self.bus = bus
370
267
self.entry_group_state_changed_match = None
371
372
def rename(self, remove=True):
268
269
def rename(self):
373
270
"""Derived from the Avahi example code"""
374
271
if self.rename_count >= self.max_renames:
375
272
logger.critical("No suitable Zeroconf service name found"
376
273
" after %i retries, exiting.",
377
274
self.rename_count)
378
275
raise AvahiServiceError("Too many renames")
379
self.name = str(
380
self.server.GetAlternativeServiceName(self.name))
381
self.rename_count += 1
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
382
278
logger.info("Changing Zeroconf service name to %r ...",
383
279
self.name)
384
if remove:
385
self.remove()
280
self.remove()
386
281
try:
387
282
self.add()
388
283
except dbus.exceptions.DBusException as error:
389
if (error.get_dbus_name()
390
== "org.freedesktop.Avahi.CollisionError"):
391
logger.info("Local Zeroconf service name collision.")
392
return self.rename(remove=False)
393
else:
394
logger.critical("D-Bus Exception", exc_info=error)
395
self.cleanup()
396
os._exit(1)
397
284
logger.critical("D-Bus Exception", exc_info=error)
285
self.cleanup()
286
os._exit(1)
287
self.rename_count += 1
288
398
289
def remove(self):
399
290
"""Derived from the Avahi example code"""
400
291
if self.entry_group_state_changed_match is not None:
402
293
self.entry_group_state_changed_match = None
403
294
if self.group is not None:
404
295
self.group.Reset()
405
296
406
297
def add(self):
407
298
"""Derived from the Avahi example code"""
408
299
self.remove()
425
316
dbus.UInt16(self.port),
426
317
avahi.string_array_to_txt_array(self.TXT))
427
318
self.group.Commit()
428
319
429
320
def entry_group_state_changed(self, state, error):
430
321
"""Derived from the Avahi example code"""
431
322
logger.debug("Avahi entry group state change: %i", state)
432
323
433
324
if state == avahi.ENTRY_GROUP_ESTABLISHED:
434
325
logger.debug("Zeroconf service established.")
435
326
elif state == avahi.ENTRY_GROUP_COLLISION:
437
328
self.rename()
438
329
elif state == avahi.ENTRY_GROUP_FAILURE:
439
330
logger.critical("Avahi: Error in group state changed %s",
440
str(error))
441
raise AvahiGroupError("State changed: {!s}".format(error))
442
331
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
334
443
335
def cleanup(self):
444
336
"""Derived from the Avahi example code"""
445
337
if self.group is not None:
450
342
pass
451
343
self.group = None
452
344
self.remove()
453
345
454
346
def server_state_changed(self, state, error=None):
455
347
"""Derived from the Avahi example code"""
456
348
logger.debug("Avahi server state change: %i", state)
457
bad_states = {
458
avahi.SERVER_INVALID: "Zeroconf server invalid",
459
avahi.SERVER_REGISTERING: None,
460
avahi.SERVER_COLLISION: "Zeroconf server name collision",
461
avahi.SERVER_FAILURE: "Zeroconf server failure",
462
}
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
463
356
if state in bad_states:
464
357
if bad_states[state] is not None:
465
358
if error is None:
468
361
logger.error(bad_states[state] + ": %r", error)
469
362
self.cleanup()
470
363
elif state == avahi.SERVER_RUNNING:
471
try:
472
self.add()
473
except dbus.exceptions.DBusException as error:
474
if (error.get_dbus_name()
475
== "org.freedesktop.Avahi.CollisionError"):
476
logger.info("Local Zeroconf service name"
477
" collision.")
478
return self.rename(remove=False)
479
else:
480
logger.critical("D-Bus Exception", exc_info=error)
481
self.cleanup()
482
os._exit(1)
364
self.add()
483
365
else:
484
366
if error is None:
485
367
logger.debug("Unknown state: %r", state)
486
368
else:
487
369
logger.debug("Unknown state: %r: %r", state, error)
488
370
489
371
def activate(self):
490
372
"""Derived from the Avahi example code"""
491
373
if self.server is None:
495
377
follow_name_owner_changes=True),
496
378
avahi.DBUS_INTERFACE_SERVER)
497
379
self.server.connect_to_signal("StateChanged",
498
self.server_state_changed)
380
self.server_state_changed)
499
381
self.server_state_changed(self.server.GetState())
500
382
501
383
502
384
class AvahiServiceToSyslog(AvahiService):
503
def rename(self, *args, **kwargs):
385
def rename(self):
504
386
"""Add the new name to the syslog messages"""
505
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
506
syslogger.setFormatter(logging.Formatter(
507
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
508
.format(self.name)))
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
509
392
return ret
510
393
511
394
512
# Pretend that we have a GnuTLS module
513
class gnutls:
514
"""This isn't so much a class as it is a module-like namespace."""
515
516
library = ctypes.util.find_library("gnutls")
517
if library is None:
518
library = ctypes.util.find_library("gnutls-deb0")
519
_library = ctypes.cdll.LoadLibrary(library)
520
del library
521
522
# Unless otherwise indicated, the constants and types below are
523
# all from the gnutls/gnutls.h C header file.
524
525
# Constants
526
E_SUCCESS = 0
527
E_INTERRUPTED = -52
528
E_AGAIN = -28
529
CRT_OPENPGP = 2
530
CRT_RAWPK = 3
531
CLIENT = 2
532
SHUT_RDWR = 0
533
CRD_CERTIFICATE = 1
534
E_NO_CERTIFICATE_FOUND = -49
535
X509_FMT_DER = 0
536
NO_TICKETS = 1<<10
537
ENABLE_RAWPK = 1<<18
538
CTYPE_PEERS = 3
539
KEYID_USE_SHA256 = 1 # gnutls/x509.h
540
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
541
542
# Types
543
class session_int(ctypes.Structure):
544
_fields_ = []
545
session_t = ctypes.POINTER(session_int)
546
547
class certificate_credentials_st(ctypes.Structure):
548
_fields_ = []
549
certificate_credentials_t = ctypes.POINTER(
550
certificate_credentials_st)
551
certificate_type_t = ctypes.c_int
552
553
class datum_t(ctypes.Structure):
554
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
555
('size', ctypes.c_uint)]
556
557
class openpgp_crt_int(ctypes.Structure):
558
_fields_ = []
559
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
560
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
561
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
562
credentials_type_t = ctypes.c_int
563
transport_ptr_t = ctypes.c_void_p
564
close_request_t = ctypes.c_int
565
566
# Exceptions
567
class Error(Exception):
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
571
# gnutls.strerror()
572
self.code = code
573
if message is None and code is not None:
574
message = gnutls.strerror(code)
575
return super(gnutls.Error, self).__init__(
576
message, *args)
577
578
class CertificateSecurityError(Error):
579
pass
580
581
# Classes
582
class Credentials:
583
def __init__(self):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
588
589
def __del__(self):
590
gnutls.certificate_free_credentials(self._c_object)
591
592
class ClientSession:
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls_flags = gnutls.CLIENT
596
if gnutls.check_version(b"3.5.6"):
597
gnutls_flags |= gnutls.NO_TICKETS
598
if gnutls.has_rawpk:
599
gnutls_flags |= gnutls.ENABLE_RAWPK
600
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
601
del gnutls_flags
602
gnutls.set_default_priority(self._c_object)
603
gnutls.transport_set_ptr(self._c_object, socket.fileno())
604
gnutls.handshake_set_private_extensions(self._c_object,
605
True)
606
self.socket = socket
607
if credentials is None:
608
credentials = gnutls.Credentials()
609
gnutls.credentials_set(self._c_object, credentials.type,
610
ctypes.cast(credentials._c_object,
611
ctypes.c_void_p))
612
self.credentials = credentials
613
614
def __del__(self):
615
gnutls.deinit(self._c_object)
616
617
def handshake(self):
618
return gnutls.handshake(self._c_object)
619
620
def send(self, data):
621
data = bytes(data)
622
data_len = len(data)
623
while data_len > 0:
624
data_len -= gnutls.record_send(self._c_object,
625
data[-data_len:],
626
data_len)
627
628
def bye(self):
629
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
630
631
# Error handling functions
632
def _error_code(result):
633
"""A function to raise exceptions on errors, suitable
634
for the 'restype' attribute on ctypes functions"""
635
if result >= 0:
636
return result
637
if result == gnutls.E_NO_CERTIFICATE_FOUND:
638
raise gnutls.CertificateSecurityError(code=result)
639
raise gnutls.Error(code=result)
640
641
def _retry_on_error(result, func, arguments):
642
"""A function to retry on some errors, suitable
643
for the 'errcheck' attribute on ctypes functions"""
644
while result < 0:
645
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
646
return _error_code(result)
647
result = func(*arguments)
648
return result
649
650
# Unless otherwise indicated, the function declarations below are
651
# all from the gnutls/gnutls.h C header file.
652
653
# Functions
654
priority_set_direct = _library.gnutls_priority_set_direct
655
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
656
ctypes.POINTER(ctypes.c_char_p)]
657
priority_set_direct.restype = _error_code
658
659
init = _library.gnutls_init
660
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
661
init.restype = _error_code
662
663
set_default_priority = _library.gnutls_set_default_priority
664
set_default_priority.argtypes = [session_t]
665
set_default_priority.restype = _error_code
666
667
record_send = _library.gnutls_record_send
668
record_send.argtypes = [session_t, ctypes.c_void_p,
669
ctypes.c_size_t]
670
record_send.restype = ctypes.c_ssize_t
671
record_send.errcheck = _retry_on_error
672
673
certificate_allocate_credentials = (
674
_library.gnutls_certificate_allocate_credentials)
675
certificate_allocate_credentials.argtypes = [
676
ctypes.POINTER(certificate_credentials_t)]
677
certificate_allocate_credentials.restype = _error_code
678
679
certificate_free_credentials = (
680
_library.gnutls_certificate_free_credentials)
681
certificate_free_credentials.argtypes = [
682
certificate_credentials_t]
683
certificate_free_credentials.restype = None
684
685
handshake_set_private_extensions = (
686
_library.gnutls_handshake_set_private_extensions)
687
handshake_set_private_extensions.argtypes = [session_t,
688
ctypes.c_int]
689
handshake_set_private_extensions.restype = None
690
691
credentials_set = _library.gnutls_credentials_set
692
credentials_set.argtypes = [session_t, credentials_type_t,
693
ctypes.c_void_p]
694
credentials_set.restype = _error_code
695
696
strerror = _library.gnutls_strerror
697
strerror.argtypes = [ctypes.c_int]
698
strerror.restype = ctypes.c_char_p
699
700
certificate_type_get = _library.gnutls_certificate_type_get
701
certificate_type_get.argtypes = [session_t]
702
certificate_type_get.restype = _error_code
703
704
certificate_get_peers = _library.gnutls_certificate_get_peers
705
certificate_get_peers.argtypes = [session_t,
706
ctypes.POINTER(ctypes.c_uint)]
707
certificate_get_peers.restype = ctypes.POINTER(datum_t)
708
709
global_set_log_level = _library.gnutls_global_set_log_level
710
global_set_log_level.argtypes = [ctypes.c_int]
711
global_set_log_level.restype = None
712
713
global_set_log_function = _library.gnutls_global_set_log_function
714
global_set_log_function.argtypes = [log_func]
715
global_set_log_function.restype = None
716
717
deinit = _library.gnutls_deinit
718
deinit.argtypes = [session_t]
719
deinit.restype = None
720
721
handshake = _library.gnutls_handshake
722
handshake.argtypes = [session_t]
723
handshake.restype = _error_code
724
handshake.errcheck = _retry_on_error
725
726
transport_set_ptr = _library.gnutls_transport_set_ptr
727
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
728
transport_set_ptr.restype = None
729
730
bye = _library.gnutls_bye
731
bye.argtypes = [session_t, close_request_t]
732
bye.restype = _error_code
733
bye.errcheck = _retry_on_error
734
735
check_version = _library.gnutls_check_version
736
check_version.argtypes = [ctypes.c_char_p]
737
check_version.restype = ctypes.c_char_p
738
739
_need_version = b"3.3.0"
740
if check_version(_need_version) is None:
741
raise self.Error("Needs GnuTLS {} or later"
742
.format(_need_version))
743
744
_tls_rawpk_version = b"3.6.6"
745
has_rawpk = bool(check_version(_tls_rawpk_version))
746
747
if has_rawpk:
748
# Types
749
class pubkey_st(ctypes.Structure):
750
_fields = []
751
pubkey_t = ctypes.POINTER(pubkey_st)
752
753
x509_crt_fmt_t = ctypes.c_int
754
755
# All the function declarations below are from gnutls/abstract.h
756
pubkey_init = _library.gnutls_pubkey_init
757
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
758
pubkey_init.restype = _error_code
759
760
pubkey_import = _library.gnutls_pubkey_import
761
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
762
x509_crt_fmt_t]
763
pubkey_import.restype = _error_code
764
765
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
766
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
767
ctypes.POINTER(ctypes.c_ubyte),
768
ctypes.POINTER(ctypes.c_size_t)]
769
pubkey_get_key_id.restype = _error_code
770
771
pubkey_deinit = _library.gnutls_pubkey_deinit
772
pubkey_deinit.argtypes = [pubkey_t]
773
pubkey_deinit.restype = None
774
else:
775
# All the function declarations below are from gnutls/openpgp.h
776
777
openpgp_crt_init = _library.gnutls_openpgp_crt_init
778
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
779
openpgp_crt_init.restype = _error_code
780
781
openpgp_crt_import = _library.gnutls_openpgp_crt_import
782
openpgp_crt_import.argtypes = [openpgp_crt_t,
783
ctypes.POINTER(datum_t),
784
openpgp_crt_fmt_t]
785
openpgp_crt_import.restype = _error_code
786
787
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
788
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
789
ctypes.POINTER(ctypes.c_uint)]
790
openpgp_crt_verify_self.restype = _error_code
791
792
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
793
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
794
openpgp_crt_deinit.restype = None
795
796
openpgp_crt_get_fingerprint = (
797
_library.gnutls_openpgp_crt_get_fingerprint)
798
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
ctypes.c_void_p,
800
ctypes.POINTER(
801
ctypes.c_size_t)]
802
openpgp_crt_get_fingerprint.restype = _error_code
803
804
if check_version(b"3.6.4"):
805
certificate_type_get2 = _library.gnutls_certificate_type_get2
806
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
807
certificate_type_get2.restype = _error_code
808
809
# Remove non-public functions
810
del _error_code, _retry_on_error
811
812
813
def call_pipe(connection, # : multiprocessing.Connection
814
func, *args, **kwargs):
815
"""This function is meant to be called by multiprocessing.Process
816
817
This function runs func(*args, **kwargs), and writes the resulting
818
return value on the provided multiprocessing.Connection.
819
"""
820
connection.send(func(*args, **kwargs))
821
connection.close()
822
823
824
class Client:
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
401
402
class Client(object):
825
403
"""A representation of a client host served by this server.
826
404
827
405
Attributes:
828
406
approved: bool(); 'None' if not yet approved/disapproved
829
407
approval_delay: datetime.timedelta(); Time to wait for approval
830
408
approval_duration: datetime.timedelta(); Duration of one approval
831
checker: multiprocessing.Process(); a running checker process used
832
to see if the client lives. 'None' if no process is
833
running.
834
checker_callback_tag: a GLib event source tag, or None
409
checker: subprocess.Popen(); a running checker process used
410
to see if the client lives.
411
'None' if no process is running.
412
checker_callback_tag: a gobject event source tag, or None
835
413
checker_command: string; External command which is run to check
836
414
if client lives. %() expansions are done at
837
415
runtime with vars(self) as dict, so that for
838
416
instance %(name)s can be used in the command.
839
checker_initiator_tag: a GLib event source tag, or None
417
checker_initiator_tag: a gobject event source tag, or None
840
418
created: datetime.datetime(); (UTC) object creation
841
419
client_structure: Object describing what attributes a client has
842
420
and is used for storing the client at exit
843
421
current_checker_command: string; current running checker_command
844
disable_initiator_tag: a GLib event source tag, or None
422
disable_initiator_tag: a gobject event source tag, or None
845
423
enabled: bool()
846
424
fingerprint: string (40 or 32 hexadecimal digits); used to
847
uniquely identify an OpenPGP client
848
key_id: string (64 hexadecimal digits); used to uniquely identify
849
a client using raw public keys
425
uniquely identify the client
850
426
host: string; available for use by the checker command
851
427
interval: datetime.timedelta(); How often to start a new checker
852
428
last_approval_request: datetime.datetime(); (UTC) or None
854
430
last_checker_status: integer between 0 and 255 reflecting exit
855
431
status of last checker. -1 reflects crashed
856
432
checker, -2 means no checker completed yet.
857
last_checker_signal: The signal which killed the last checker, if
858
last_checker_status is -1
859
433
last_enabled: datetime.datetime(); (UTC) or None
860
434
name: string; from the config file, used in log messages and
861
435
D-Bus identifiers
866
440
runtime_expansions: Allowed attributes for runtime expansion.
867
441
expires: datetime.datetime(); time (UTC) when a client will be
868
442
disabled, or None
869
server_settings: The server_settings dict from main()
870
443
"""
871
444
872
445
runtime_expansions = ("approval_delay", "approval_duration",
873
"created", "enabled", "expires", "key_id",
446
"created", "enabled", "expires",
874
447
"fingerprint", "host", "interval",
875
448
"last_approval_request", "last_checked_ok",
876
449
"last_enabled", "name", "timeout")
877
client_defaults = {
878
"timeout": "PT5M",
879
"extended_timeout": "PT15M",
880
"interval": "PT2M",
881
"checker": "fping -q -- %%(host)s",
882
"host": "",
883
"approval_delay": "PT0S",
884
"approval_duration": "PT1S",
885
"approved_by_default": "True",
886
"enabled": "True",
887
}
888
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
460
461
def timeout_milliseconds(self):
462
"Return the 'timeout' attribute in milliseconds"
463
return timedelta_to_milliseconds(self.timeout)
464
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
468
469
def interval_milliseconds(self):
470
"Return the 'interval' attribute in milliseconds"
471
return timedelta_to_milliseconds(self.interval)
472
473
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
475
889
476
@staticmethod
890
477
def config_parser(config):
891
478
"""Construct a new dict of client settings of this form:
898
485
for client_name in config.sections():
899
486
section = dict(config.items(client_name))
900
487
client = settings[client_name] = {}
901
488
902
489
client["host"] = section["host"]
903
490
# Reformat values from string types to Python types
904
491
client["approved_by_default"] = config.getboolean(
905
492
client_name, "approved_by_default")
906
493
client["enabled"] = config.getboolean(client_name,
907
494
"enabled")
908
909
# Uppercase and remove spaces from key_id and fingerprint
910
# for later comparison purposes with return value from the
911
# key_id() and fingerprint() functions
912
client["key_id"] = (section.get("key_id", "").upper()
913
.replace(" ", ""))
495
914
496
client["fingerprint"] = (section["fingerprint"].upper()
915
497
.replace(" ", ""))
916
498
if "secret" in section:
917
client["secret"] = codecs.decode(section["secret"]
918
.encode("utf-8"),
919
"base64")
499
client["secret"] = section["secret"].decode("base64")
920
500
elif "secfile" in section:
921
501
with open(os.path.expanduser(os.path.expandvars
922
502
(section["secfile"])),
923
503
"rb") as secfile:
924
504
client["secret"] = secfile.read()
925
505
else:
926
raise TypeError("No secret or secfile for section {}"
506
raise TypeError("No secret or secfile for section {0}"
927
507
.format(section))
928
508
client["timeout"] = string_to_delta(section["timeout"])
929
509
client["extended_timeout"] = string_to_delta(
937
517
client["last_approval_request"] = None
938
518
client["last_checked_ok"] = None
939
519
client["last_checker_status"] = -2
940
520
941
521
return settings
942
943
def __init__(self, settings, name=None, server_settings=None):
522
523
def __init__(self, settings, name = None):
944
524
self.name = name
945
if server_settings is None:
946
server_settings = {}
947
self.server_settings = server_settings
948
525
# adding all client settings
949
for setting, value in settings.items():
526
for setting, value in settings.iteritems():
950
527
setattr(self, setting, value)
951
528
952
529
if self.enabled:
953
530
if not hasattr(self, "last_enabled"):
954
531
self.last_enabled = datetime.datetime.utcnow()
958
535
else:
959
536
self.last_enabled = None
960
537
self.expires = None
961
538
962
539
logger.debug("Creating client %r", self.name)
963
logger.debug(" Key ID: %s", self.key_id)
540
# Uppercase and remove spaces from fingerprint for later
541
# comparison purposes with return value from the fingerprint()
542
# function
964
543
logger.debug(" Fingerprint: %s", self.fingerprint)
965
544
self.created = settings.get("created",
966
545
datetime.datetime.utcnow())
967
546
968
547
# attributes specific for this server instance
969
548
self.checker = None
970
549
self.checker_initiator_tag = None
973
552
self.current_checker_command = None
974
553
self.approved = None
975
554
self.approvals_pending = 0
976
self.changedstate = multiprocessing_manager.Condition(
977
multiprocessing_manager.Lock())
978
self.client_structure = [attr
979
for attr in self.__dict__.keys()
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
557
.Lock()))
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
980
560
if not attr.startswith("_")]
981
561
self.client_structure.append("client_structure")
982
983
for name, t in inspect.getmembers(
984
type(self), lambda obj: isinstance(obj, property)):
562
563
for name, t in inspect.getmembers(type(self),
564
lambda obj:
565
isinstance(obj,
566
property)):
985
567
if not name.startswith("_"):
986
568
self.client_structure.append(name)
987
569
988
570
# Send notice to process children that client state has changed
989
571
def send_changedstate(self):
990
572
with self.changedstate:
991
573
self.changedstate.notify_all()
992
574
993
575
def enable(self):
994
576
"""Start this client's checker and timeout hooks"""
995
577
if getattr(self, "enabled", False):
1000
582
self.last_enabled = datetime.datetime.utcnow()
1001
583
self.init_checker()
1002
584
self.send_changedstate()
1003
585
1004
586
def disable(self, quiet=True):
1005
587
"""Disable this client."""
1006
588
if not getattr(self, "enabled", False):
1008
590
if not quiet:
1009
591
logger.info("Disabling client %s", self.name)
1010
592
if getattr(self, "disable_initiator_tag", None) is not None:
1011
GLib.source_remove(self.disable_initiator_tag)
593
gobject.source_remove(self.disable_initiator_tag)
1012
594
self.disable_initiator_tag = None
1013
595
self.expires = None
1014
596
if getattr(self, "checker_initiator_tag", None) is not None:
1015
GLib.source_remove(self.checker_initiator_tag)
597
gobject.source_remove(self.checker_initiator_tag)
1016
598
self.checker_initiator_tag = None
1017
599
self.stop_checker()
1018
600
self.enabled = False
1019
601
if not quiet:
1020
602
self.send_changedstate()
1021
# Do not run this again if called by a GLib.timeout_add
603
# Do not run this again if called by a gobject.timeout_add
1022
604
return False
1023
605
1024
606
def __del__(self):
1025
607
self.disable()
1026
608
1027
609
def init_checker(self):
1028
610
# Schedule a new checker to be started an 'interval' from now,
1029
611
# and every interval from then on.
1030
612
if self.checker_initiator_tag is not None:
1031
GLib.source_remove(self.checker_initiator_tag)
1032
self.checker_initiator_tag = GLib.timeout_add(
1033
int(self.interval.total_seconds() * 1000),
1034
self.start_checker)
613
gobject.source_remove(self.checker_initiator_tag)
614
self.checker_initiator_tag = (gobject.timeout_add
615
(self.interval_milliseconds(),
616
self.start_checker))
1035
617
# Schedule a disable() when 'timeout' has passed
1036
618
if self.disable_initiator_tag is not None:
1037
GLib.source_remove(self.disable_initiator_tag)
1038
self.disable_initiator_tag = GLib.timeout_add(
1039
int(self.timeout.total_seconds() * 1000), self.disable)
619
gobject.source_remove(self.disable_initiator_tag)
620
self.disable_initiator_tag = (gobject.timeout_add
621
(self.timeout_milliseconds(),
622
self.disable))
1040
623
# Also start a new checker *right now*.
1041
624
self.start_checker()
1042
1043
def checker_callback(self, source, condition, connection,
1044
command):
625
626
def checker_callback(self, pid, condition, command):
1045
627
"""The checker has completed, so take appropriate actions."""
1046
# Read return code from connection (see call_pipe)
1047
returncode = connection.recv()
1048
connection.close()
1049
self.checker.join()
1050
628
self.checker_callback_tag = None
1051
629
self.checker = None
1052
1053
if returncode >= 0:
1054
self.last_checker_status = returncode
1055
self.last_checker_signal = None
630
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
1056
632
if self.last_checker_status == 0:
1057
633
logger.info("Checker for %(name)s succeeded",
1058
634
vars(self))
1059
635
self.checked_ok()
1060
636
else:
1061
logger.info("Checker for %(name)s failed", vars(self))
637
logger.info("Checker for %(name)s failed",
638
vars(self))
1062
639
else:
1063
640
self.last_checker_status = -1
1064
self.last_checker_signal = -returncode
1065
641
logger.warning("Checker for %(name)s crashed?",
1066
642
vars(self))
1067
return False
1068
643
1069
644
def checked_ok(self):
1070
645
"""Assert that the client has been seen, alive and well."""
1071
646
self.last_checked_ok = datetime.datetime.utcnow()
1072
647
self.last_checker_status = 0
1073
self.last_checker_signal = None
1074
648
self.bump_timeout()
1075
649
1076
650
def bump_timeout(self, timeout=None):
1077
651
"""Bump up the timeout for this client."""
1078
652
if timeout is None:
1079
653
timeout = self.timeout
1080
654
if self.disable_initiator_tag is not None:
1081
GLib.source_remove(self.disable_initiator_tag)
655
gobject.source_remove(self.disable_initiator_tag)
1082
656
self.disable_initiator_tag = None
1083
657
if getattr(self, "enabled", False):
1084
self.disable_initiator_tag = GLib.timeout_add(
1085
int(timeout.total_seconds() * 1000), self.disable)
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
1086
661
self.expires = datetime.datetime.utcnow() + timeout
1087
662
1088
663
def need_approval(self):
1089
664
self.last_approval_request = datetime.datetime.utcnow()
1090
665
1091
666
def start_checker(self):
1092
667
"""Start a new checker subprocess if one is not running.
1093
668
1094
669
If a checker already exists, leave it running and do
1095
670
nothing."""
1096
671
# The reason for not killing a running checker is that if we
1101
676
# checkers alone, the checker would have to take more time
1102
677
# than 'timeout' for the client to be disabled, which is as it
1103
678
# should be.
1104
1105
if self.checker is not None and not self.checker.is_alive():
1106
logger.warning("Checker was not alive; joining")
1107
self.checker.join()
1108
self.checker = None
679
680
# If a checker exists, make sure it is not a zombie
681
try:
682
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
684
if (isinstance(error, OSError)
685
and error.errno != errno.ECHILD):
686
raise error
687
else:
688
if pid:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
1109
693
# Start a new checker if needed
1110
694
if self.checker is None:
1111
695
# Escape attributes for the shell
1112
escaped_attrs = {
1113
attr: re.escape(str(getattr(self, attr)))
1114
for attr in self.runtime_expansions}
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
698
for attr in
699
self.runtime_expansions)
1115
700
try:
1116
701
command = self.checker_command % escaped_attrs
1117
702
except TypeError as error:
1118
703
logger.error('Could not format string "%s"',
1119
self.checker_command,
704
self.checker_command, exc_info=error)
705
return True # Try again later
706
self.current_checker_command = command
707
try:
708
logger.info("Starting checker %r for %s",
709
command, self.name)
710
# We don't need to redirect stdout and stderr, since
711
# in normal mode, that is already done by daemon(),
712
# and in debug mode we don't want to. (Stdin is
713
# always replaced by /dev/null.)
714
self.checker = subprocess.Popen(command,
715
close_fds=True,
716
shell=True, cwd="/")
717
except OSError as error:
718
logger.error("Failed to start subprocess",
1120
719
exc_info=error)
1121
return True # Try again later
1122
self.current_checker_command = command
1123
logger.info("Starting checker %r for %s", command,
1124
self.name)
1125
# We don't need to redirect stdout and stderr, since
1126
# in normal mode, that is already done by daemon(),
1127
# and in debug mode we don't want to. (Stdin is
1128
# always replaced by /dev/null.)
1129
# The exception is when not debugging but nevertheless
1130
# running in the foreground; use the previously
1131
# created wnull.
1132
popen_args = {"close_fds": True,
1133
"shell": True,
1134
"cwd": "/"}
1135
if (not self.server_settings["debug"]
1136
and self.server_settings["foreground"]):
1137
popen_args.update({"stdout": wnull,
1138
"stderr": wnull})
1139
pipe = multiprocessing.Pipe(duplex=False)
1140
self.checker = multiprocessing.Process(
1141
target=call_pipe,
1142
args=(pipe[1], subprocess.call, command),
1143
kwargs=popen_args)
1144
self.checker.start()
1145
self.checker_callback_tag = GLib.io_add_watch(
1146
pipe[0].fileno(), GLib.IO_IN,
1147
self.checker_callback, pipe[0], command)
1148
# Re-run this periodically if run by GLib.timeout_add
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
728
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
729
except OSError as error:
730
if error.errno == errno.ECHILD:
731
logger.error("Child process vanished", exc_info=error)
732
return True
733
raise
734
if pid:
735
gobject.source_remove(self.checker_callback_tag)
736
self.checker_callback(pid, status, command)
737
# Re-run this periodically if run by gobject.timeout_add
1149
738
return True
1150
739
1151
740
def stop_checker(self):
1152
741
"""Force the checker process, if any, to stop."""
1153
742
if self.checker_callback_tag:
1154
GLib.source_remove(self.checker_callback_tag)
743
gobject.source_remove(self.checker_callback_tag)
1155
744
self.checker_callback_tag = None
1156
745
if getattr(self, "checker", None) is None:
1157
746
return
1158
747
logger.debug("Stopping checker for %(name)s", vars(self))
1159
self.checker.terminate()
748
try:
749
self.checker.terminate()
750
#time.sleep(0.5)
751
#if self.checker.poll() is None:
752
# self.checker.kill()
753
except OSError as error:
754
if error.errno != errno.ESRCH: # No such process
755
raise
1160
756
self.checker = None
1161
757
1162
758
1163
def dbus_service_property(dbus_interface,
1164
signature="v",
1165
access="readwrite",
1166
byte_arrays=False):
759
def dbus_service_property(dbus_interface, signature="v",
760
access="readwrite", byte_arrays=False):
1167
761
"""Decorators for marking methods of a DBusObjectWithProperties to
1168
762
become properties on the D-Bus.
1169
763
1170
764
The decorated method will be called with no arguments by "Get"
1171
765
and with one argument by "Set".
1172
766
1173
767
The parameters, where they are supported, are the same as
1174
768
dbus.service.method, except there is only "signature", since the
1175
769
type from Get() and the type sent to Set() is the same.
1178
772
# "Set" method, so we fail early here:
1179
773
if byte_arrays and signature != "ay":
1180
774
raise ValueError("Byte arrays not supported for non-'ay'"
1181
" signature {!r}".format(signature))
1182
775
" signature {0!r}".format(signature))
1183
776
def decorator(func):
1184
777
func._dbus_is_property = True
1185
778
func._dbus_interface = dbus_interface
1188
781
func._dbus_name = func.__name__
1189
782
if func._dbus_name.endswith("_dbus_property"):
1190
783
func._dbus_name = func._dbus_name[:-14]
1191
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
784
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1192
785
return func
1193
1194
786
return decorator
1195
787
1196
788
1197
789
def dbus_interface_annotations(dbus_interface):
1198
790
"""Decorator for marking functions returning interface annotations
1199
791
1200
792
Usage:
1201
793
1202
794
@dbus_interface_annotations("org.example.Interface")
1203
795
def _foo(self): # Function name does not matter
1204
796
return {"org.freedesktop.DBus.Deprecated": "true",
1205
797
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1206
798
"false"}
1207
799
"""
1208
1209
800
def decorator(func):
1210
801
func._dbus_is_interface = True
1211
802
func._dbus_interface = dbus_interface
1212
803
func._dbus_name = dbus_interface
1213
804
return func
1214
1215
805
return decorator
1216
806
1217
807
1218
808
def dbus_annotations(annotations):
1219
809
"""Decorator to annotate D-Bus methods, signals or properties
1220
810
Usage:
1221
1222
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1223
"org.freedesktop.DBus.Property."
1224
"EmitsChangedSignal": "false"})
811
1225
812
@dbus_service_property("org.example.Interface", signature="b",
1226
813
access="r")
814
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
815
"org.freedesktop.DBus.Property."
816
"EmitsChangedSignal": "false"})
1227
817
def Property_dbus_property(self):
1228
818
return dbus.Boolean(False)
1229
1230
See also the DBusObjectWithAnnotations class.
1231
819
"""
1232
1233
820
def decorator(func):
1234
821
func._dbus_annotations = annotations
1235
822
return func
1236
1237
823
return decorator
1238
824
1239
825
1240
826
class DBusPropertyException(dbus.exceptions.DBusException):
1241
827
"""A base class for D-Bus property-related exceptions
1242
828
"""
1243
pass
829
def __unicode__(self):
830
return unicode(str(self))
1244
831
1245
832
1246
833
class DBusPropertyAccessException(DBusPropertyException):
1255
842
pass
1256
843
1257
844
1258
class DBusObjectWithAnnotations(dbus.service.Object):
1259
"""A D-Bus object with annotations.
1260
1261
Classes inheriting from this can use the dbus_annotations
1262
decorator to add annotations to methods or signals.
845
class DBusObjectWithProperties(dbus.service.Object):
846
"""A D-Bus object with properties.
847
848
Classes inheriting from this can use the dbus_service_property
849
decorator to expose methods as D-Bus properties. It exposes the
850
standard Get(), Set(), and GetAll() methods on the D-Bus.
1263
851
"""
1264
852
1265
853
@staticmethod
1266
854
def _is_dbus_thing(thing):
1267
855
"""Returns a function testing if an attribute is a D-Bus thing
1268
856
1269
857
If called like _is_dbus_thing("method") it returns a function
1270
858
suitable for use as predicate to inspect.getmembers().
1271
859
"""
1272
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
860
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1273
861
False)
1274
862
1275
863
def _get_all_dbus_things(self, thing):
1276
864
"""Returns a generator of (name, attribute) pairs
1277
865
"""
1278
return ((getattr(athing.__get__(self), "_dbus_name", name),
866
return ((getattr(athing.__get__(self), "_dbus_name",
867
name),
1279
868
athing.__get__(self))
1280
869
for cls in self.__class__.__mro__
1281
870
for name, athing in
1282
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1283
1284
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1285
out_signature="s",
1286
path_keyword='object_path',
1287
connection_keyword='connection')
1288
def Introspect(self, object_path, connection):
1289
"""Overloading of standard D-Bus method.
1290
1291
Inserts annotation tags on methods and signals.
1292
"""
1293
xmlstring = dbus.service.Object.Introspect(self, object_path,
1294
connection)
1295
try:
1296
document = xml.dom.minidom.parseString(xmlstring)
1297
1298
for if_tag in document.getElementsByTagName("interface"):
1299
# Add annotation tags
1300
for typ in ("method", "signal"):
1301
for tag in if_tag.getElementsByTagName(typ):
1302
annots = dict()
1303
for name, prop in (self.
1304
_get_all_dbus_things(typ)):
1305
if (name == tag.getAttribute("name")
1306
and prop._dbus_interface
1307
== if_tag.getAttribute("name")):
1308
annots.update(getattr(
1309
prop, "_dbus_annotations", {}))
1310
for name, value in annots.items():
1311
ann_tag = document.createElement(
1312
"annotation")
1313
ann_tag.setAttribute("name", name)
1314
ann_tag.setAttribute("value", value)
1315
tag.appendChild(ann_tag)
1316
# Add interface annotation tags
1317
for annotation, value in dict(
1318
itertools.chain.from_iterable(
1319
annotations().items()
1320
for name, annotations
1321
in self._get_all_dbus_things("interface")
1322
if name == if_tag.getAttribute("name")
1323
)).items():
1324
ann_tag = document.createElement("annotation")
1325
ann_tag.setAttribute("name", annotation)
1326
ann_tag.setAttribute("value", value)
1327
if_tag.appendChild(ann_tag)
1328
# Fix argument name for the Introspect method itself
1329
if (if_tag.getAttribute("name")
1330
== dbus.INTROSPECTABLE_IFACE):
1331
for cn in if_tag.getElementsByTagName("method"):
1332
if cn.getAttribute("name") == "Introspect":
1333
for arg in cn.getElementsByTagName("arg"):
1334
if (arg.getAttribute("direction")
1335
== "out"):
1336
arg.setAttribute("name",
1337
"xml_data")
1338
xmlstring = document.toxml("utf-8")
1339
document.unlink()
1340
except (AttributeError, xml.dom.DOMException,
1341
xml.parsers.expat.ExpatError) as error:
1342
logger.error("Failed to override Introspection method",
1343
exc_info=error)
1344
return xmlstring
1345
1346
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1348
"""A D-Bus object with properties.
1349
1350
Classes inheriting from this can use the dbus_service_property
1351
decorator to expose methods as D-Bus properties. It exposes the
1352
standard Get(), Set(), and GetAll() methods on the D-Bus.
1353
"""
1354
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
873
1355
874
def _get_dbus_property(self, interface_name, property_name):
1356
875
"""Returns a bound method if one exists which is a D-Bus
1357
876
property with the specified name and interface.
1358
877
"""
1359
for cls in self.__class__.__mro__:
1360
for name, value in inspect.getmembers(
1361
cls, self._is_dbus_thing("property")):
878
for cls in self.__class__.__mro__:
879
for name, value in (inspect.getmembers
880
(cls,
881
self._is_dbus_thing("property"))):
1362
882
if (value._dbus_name == property_name
1363
883
and value._dbus_interface == interface_name):
1364
884
return value.__get__(self)
1365
885
1366
886
# No such property
1367
raise DBusPropertyNotFound("{}:{}.{}".format(
1368
self.dbus_object_path, interface_name, property_name))
1369
1370
@classmethod
1371
def _get_all_interface_names(cls):
1372
"""Get a sequence of all interfaces supported by an object"""
1373
return (name for name in set(getattr(getattr(x, attr),
1374
"_dbus_interface", None)
1375
for x in (inspect.getmro(cls))
1376
for attr in dir(x))
1377
if name is not None)
1378
1379
@dbus.service.method(dbus.PROPERTIES_IFACE,
1380
in_signature="ss",
887
raise DBusPropertyNotFound(self.dbus_object_path + ":"
888
+ interface_name + "."
889
+ property_name)
890
891
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1381
892
out_signature="v")
1382
893
def Get(self, interface_name, property_name):
1383
894
"""Standard D-Bus property Get() method, see D-Bus standard.
1389
900
if not hasattr(value, "variant_level"):
1390
901
return value
1391
902
return type(value)(value, variant_level=value.variant_level+1)
1392
903
1393
904
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1394
905
def Set(self, interface_name, property_name, value):
1395
906
"""Standard D-Bus property Set() method, see D-Bus standard.
1401
912
# The byte_arrays option is not supported yet on
1402
913
# signatures other than "ay".
1403
914
if prop._dbus_signature != "ay":
1404
raise ValueError("Byte arrays not supported for non-"
1405
"'ay' signature {!r}"
1406
.format(prop._dbus_signature))
915
raise ValueError
1407
916
value = dbus.ByteArray(b''.join(chr(byte)
1408
917
for byte in value))
1409
918
prop(value)
1410
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1412
in_signature="s",
919
920
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1413
921
out_signature="a{sv}")
1414
922
def GetAll(self, interface_name):
1415
923
"""Standard D-Bus property GetAll() method, see D-Bus
1416
924
standard.
1417
925
1418
926
Note: Will not include properties with access="write".
1419
927
"""
1420
928
properties = {}
1430
938
if not hasattr(value, "variant_level"):
1431
939
properties[name] = value
1432
940
continue
1433
properties[name] = type(value)(
1434
value, variant_level=value.variant_level + 1)
941
properties[name] = type(value)(value, variant_level=
942
value.variant_level+1)
1435
943
return dbus.Dictionary(properties, signature="sv")
1436
1437
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1438
def PropertiesChanged(self, interface_name, changed_properties,
1439
invalidated_properties):
1440
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1441
standard.
1442
"""
1443
pass
1444
944
1445
945
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1446
946
out_signature="s",
1447
947
path_keyword='object_path',
1448
948
connection_keyword='connection')
1449
949
def Introspect(self, object_path, connection):
1450
950
"""Overloading of standard D-Bus method.
1451
951
1452
952
Inserts property tags and interface annotation tags.
1453
953
"""
1454
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1455
object_path,
1456
connection)
954
xmlstring = dbus.service.Object.Introspect(self, object_path,
955
connection)
1457
956
try:
1458
957
document = xml.dom.minidom.parseString(xmlstring)
1459
1460
958
def make_tag(document, name, prop):
1461
959
e = document.createElement("property")
1462
960
e.setAttribute("name", name)
1463
961
e.setAttribute("type", prop._dbus_signature)
1464
962
e.setAttribute("access", prop._dbus_access)
1465
963
return e
1466
1467
964
for if_tag in document.getElementsByTagName("interface"):
1468
965
# Add property tags
1469
966
for tag in (make_tag(document, name, prop)
1472
969
if prop._dbus_interface
1473
970
== if_tag.getAttribute("name")):
1474
971
if_tag.appendChild(tag)
1475
# Add annotation tags for properties
1476
for tag in if_tag.getElementsByTagName("property"):
1477
annots = dict()
1478
for name, prop in self._get_all_dbus_things(
1479
"property"):
1480
if (name == tag.getAttribute("name")
1481
and prop._dbus_interface
1482
== if_tag.getAttribute("name")):
1483
annots.update(getattr(
1484
prop, "_dbus_annotations", {}))
1485
for name, value in annots.items():
1486
ann_tag = document.createElement(
1487
"annotation")
1488
ann_tag.setAttribute("name", name)
1489
ann_tag.setAttribute("value", value)
1490
tag.appendChild(ann_tag)
972
# Add annotation tags
973
for typ in ("method", "signal", "property"):
974
for tag in if_tag.getElementsByTagName(typ):
975
annots = dict()
976
for name, prop in (self.
977
_get_all_dbus_things(typ)):
978
if (name == tag.getAttribute("name")
979
and prop._dbus_interface
980
== if_tag.getAttribute("name")):
981
annots.update(getattr
982
(prop,
983
"_dbus_annotations",
984
{}))
985
for name, value in annots.iteritems():
986
ann_tag = document.createElement(
987
"annotation")
988
ann_tag.setAttribute("name", name)
989
ann_tag.setAttribute("value", value)
990
tag.appendChild(ann_tag)
991
# Add interface annotation tags
992
for annotation, value in dict(
993
itertools.chain.from_iterable(
994
annotations().iteritems()
995
for name, annotations in
996
self._get_all_dbus_things("interface")
997
if name == if_tag.getAttribute("name")
998
)).iteritems():
999
ann_tag = document.createElement("annotation")
1000
ann_tag.setAttribute("name", annotation)
1001
ann_tag.setAttribute("value", value)
1002
if_tag.appendChild(ann_tag)
1491
1003
# Add the names to the return values for the
1492
1004
# "org.freedesktop.DBus.Properties" methods
1493
1005
if (if_tag.getAttribute("name")
1512
1024
return xmlstring
1513
1025
1514
1026
1515
try:
1516
dbus.OBJECT_MANAGER_IFACE
1517
except AttributeError:
1518
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1519
1520
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1522
"""A D-Bus object with an ObjectManager.
1523
1524
Classes inheriting from this exposes the standard
1525
GetManagedObjects call and the InterfacesAdded and
1526
InterfacesRemoved signals on the standard
1527
"org.freedesktop.DBus.ObjectManager" interface.
1528
1529
Note: No signals are sent automatically; they must be sent
1530
manually.
1531
"""
1532
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1533
out_signature="a{oa{sa{sv}}}")
1534
def GetManagedObjects(self):
1535
"""This function must be overridden"""
1536
raise NotImplementedError()
1537
1538
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1539
signature="oa{sa{sv}}")
1540
def InterfacesAdded(self, object_path, interfaces_and_properties):
1541
pass
1542
1543
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1544
def InterfacesRemoved(self, object_path, interfaces):
1545
pass
1546
1547
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1548
out_signature="s",
1549
path_keyword='object_path',
1550
connection_keyword='connection')
1551
def Introspect(self, object_path, connection):
1552
"""Overloading of standard D-Bus method.
1553
1554
Override return argument name of GetManagedObjects to be
1555
"objpath_interfaces_and_properties"
1556
"""
1557
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1558
object_path,
1559
connection)
1560
try:
1561
document = xml.dom.minidom.parseString(xmlstring)
1562
1563
for if_tag in document.getElementsByTagName("interface"):
1564
# Fix argument name for the GetManagedObjects method
1565
if (if_tag.getAttribute("name")
1566
== dbus.OBJECT_MANAGER_IFACE):
1567
for cn in if_tag.getElementsByTagName("method"):
1568
if (cn.getAttribute("name")
1569
== "GetManagedObjects"):
1570
for arg in cn.getElementsByTagName("arg"):
1571
if (arg.getAttribute("direction")
1572
== "out"):
1573
arg.setAttribute(
1574
"name",
1575
"objpath_interfaces"
1576
"_and_properties")
1577
xmlstring = document.toxml("utf-8")
1578
document.unlink()
1579
except (AttributeError, xml.dom.DOMException,
1580
xml.parsers.expat.ExpatError) as error:
1581
logger.error("Failed to override Introspection method",
1582
exc_info=error)
1583
return xmlstring
1584
1585
1586
1027
def datetime_to_dbus(dt, variant_level=0):
1587
1028
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1588
1029
if dt is None:
1589
return dbus.String("", variant_level=variant_level)
1590
return dbus.String(dt.isoformat(), variant_level=variant_level)
1030
return dbus.String("", variant_level = variant_level)
1031
return dbus.String(dt.isoformat(),
1032
variant_level=variant_level)
1591
1033
1592
1034
1593
1035
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1595
1037
dbus.service.Object, it will add alternate D-Bus attributes with
1596
1038
interface names according to the "alt_interface_names" mapping.
1597
1039
Usage:
1598
1040
1599
1041
@alternate_dbus_interfaces({"org.example.Interface":
1600
1042
"net.example.AlternateInterface"})
1601
1043
class SampleDBusObject(dbus.service.Object):
1602
1044
@dbus.service.method("org.example.Interface")
1603
1045
def SampleDBusMethod():
1604
1046
pass
1605
1047
1606
1048
The above "SampleDBusMethod" on "SampleDBusObject" will be
1607
1049
reachable via two interfaces: "org.example.Interface" and
1608
1050
"net.example.AlternateInterface", the latter of which will have
1609
1051
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1610
1052
"true", unless "deprecate" is passed with a False value.
1611
1053
1612
1054
This works for methods and signals, and also for D-Bus properties
1613
1055
(from DBusObjectWithProperties) and interfaces (from the
1614
1056
dbus_interface_annotations decorator).
1615
1057
"""
1616
1617
1058
def wrapper(cls):
1618
1059
for orig_interface_name, alt_interface_name in (
1619
alt_interface_names.items()):
1060
alt_interface_names.iteritems()):
1620
1061
attr = {}
1621
1062
interface_names = set()
1622
1063
# Go though all attributes of the class
1624
1065
# Ignore non-D-Bus attributes, and D-Bus attributes
1625
1066
# with the wrong interface name
1626
1067
if (not hasattr(attribute, "_dbus_interface")
1627
or not attribute._dbus_interface.startswith(
1628
orig_interface_name)):
1068
or not attribute._dbus_interface
1069
.startswith(orig_interface_name)):
1629
1070
continue
1630
1071
# Create an alternate D-Bus interface name based on
1631
1072
# the current name
1632
alt_interface = attribute._dbus_interface.replace(
1633
orig_interface_name, alt_interface_name)
1073
alt_interface = (attribute._dbus_interface
1074
.replace(orig_interface_name,
1075
alt_interface_name))
1634
1076
interface_names.add(alt_interface)
1635
1077
# Is this a D-Bus signal?
1636
1078
if getattr(attribute, "_dbus_is_signal", False):
1637
# Extract the original non-method undecorated
1638
# function by black magic
1639
if sys.version_info.major == 2:
1640
nonmethod_func = (dict(
1079
# Extract the original non-method function by
1080
# black magic
1081
nonmethod_func = (dict(
1641
1082
zip(attribute.func_code.co_freevars,
1642
attribute.__closure__))
1643
["func"].cell_contents)
1644
else:
1645
nonmethod_func = (dict(
1646
zip(attribute.__code__.co_freevars,
1647
attribute.__closure__))
1648
["func"].cell_contents)
1083
attribute.__closure__))["func"]
1084
.cell_contents)
1649
1085
# Create a new, but exactly alike, function
1650
1086
# object, and decorate it to be a new D-Bus signal
1651
1087
# with the alternate D-Bus interface name
1652
new_function = copy_function(nonmethod_func)
1653
new_function = (dbus.service.signal(
1654
alt_interface,
1655
attribute._dbus_signature)(new_function))
1088
new_function = (dbus.service.signal
1089
(alt_interface,
1090
attribute._dbus_signature)
1091
(types.FunctionType(
1092
nonmethod_func.func_code,
1093
nonmethod_func.func_globals,
1094
nonmethod_func.func_name,
1095
nonmethod_func.func_defaults,
1096
nonmethod_func.func_closure)))
1656
1097
# Copy annotations, if any
1657
1098
try:
1658
new_function._dbus_annotations = dict(
1659
attribute._dbus_annotations)
1099
new_function._dbus_annotations = (
1100
dict(attribute._dbus_annotations))
1660
1101
except AttributeError:
1661
1102
pass
1662
1663
1103
# Define a creator of a function to call both the
1664
1104
# original and alternate functions, so both the
1665
1105
# original and alternate signals gets sent when
1668
1108
"""This function is a scope container to pass
1669
1109
func1 and func2 to the "call_both" function
1670
1110
outside of its arguments"""
1671
1672
@functools.wraps(func2)
1673
1111
def call_both(*args, **kwargs):
1674
1112
"""This function will emit two D-Bus
1675
1113
signals by calling func1 and func2"""
1676
1114
func1(*args, **kwargs)
1677
1115
func2(*args, **kwargs)
1678
# Make wrapper function look like a D-Bus
1679
# signal
1680
for name, attr in inspect.getmembers(func2):
1681
if name.startswith("_dbus_"):
1682
setattr(call_both, name, attr)
1683
1684
1116
return call_both
1685
1117
# Create the "call_both" function and add it to
1686
1118
# the class
1691
1123
# object. Decorate it to be a new D-Bus method
1692
1124
# with the alternate D-Bus interface name. Add it
1693
1125
# to the class.
1694
attr[attrname] = (
1695
dbus.service.method(
1696
alt_interface,
1697
attribute._dbus_in_signature,
1698
attribute._dbus_out_signature)
1699
(copy_function(attribute)))
1126
attr[attrname] = (dbus.service.method
1127
(alt_interface,
1128
attribute._dbus_in_signature,
1129
attribute._dbus_out_signature)
1130
(types.FunctionType
1131
(attribute.func_code,
1132
attribute.func_globals,
1133
attribute.func_name,
1134
attribute.func_defaults,
1135
attribute.func_closure)))
1700
1136
# Copy annotations, if any
1701
1137
try:
1702
attr[attrname]._dbus_annotations = dict(
1703
attribute._dbus_annotations)
1138
attr[attrname]._dbus_annotations = (
1139
dict(attribute._dbus_annotations))
1704
1140
except AttributeError:
1705
1141
pass
1706
1142
# Is this a D-Bus property?
1709
1145
# object, and decorate it to be a new D-Bus
1710
1146
# property with the alternate D-Bus interface
1711
1147
# name. Add it to the class.
1712
attr[attrname] = (dbus_service_property(
1713
alt_interface, attribute._dbus_signature,
1714
attribute._dbus_access,
1715
attribute._dbus_get_args_options
1716
["byte_arrays"])
1717
(copy_function(attribute)))
1148
attr[attrname] = (dbus_service_property
1149
(alt_interface,
1150
attribute._dbus_signature,
1151
attribute._dbus_access,
1152
attribute
1153
._dbus_get_args_options
1154
["byte_arrays"])
1155
(types.FunctionType
1156
(attribute.func_code,
1157
attribute.func_globals,
1158
attribute.func_name,
1159
attribute.func_defaults,
1160
attribute.func_closure)))
1718
1161
# Copy annotations, if any
1719
1162
try:
1720
attr[attrname]._dbus_annotations = dict(
1721
attribute._dbus_annotations)
1163
attr[attrname]._dbus_annotations = (
1164
dict(attribute._dbus_annotations))
1722
1165
except AttributeError:
1723
1166
pass
1724
1167
# Is this a D-Bus interface?
1727
1170
# object. Decorate it to be a new D-Bus interface
1728
1171
# with the alternate D-Bus interface name. Add it
1729
1172
# to the class.
1730
attr[attrname] = (
1731
dbus_interface_annotations(alt_interface)
1732
(copy_function(attribute)))
1173
attr[attrname] = (dbus_interface_annotations
1174
(alt_interface)
1175
(types.FunctionType
1176
(attribute.func_code,
1177
attribute.func_globals,
1178
attribute.func_name,
1179
attribute.func_defaults,
1180
attribute.func_closure)))
1733
1181
if deprecate:
1734
1182
# Deprecate all alternate interfaces
1735
iname = "_AlternateDBusNames_interface_annotation{}"
1183
iname="_AlternateDBusNames_interface_annotation{0}"
1736
1184
for interface_name in interface_names:
1737
1738
1185
@dbus_interface_annotations(interface_name)
1739
1186
def func(self):
1740
return {"org.freedesktop.DBus.Deprecated":
1741
"true"}
1187
return { "org.freedesktop.DBus.Deprecated":
1188
"true" }
1742
1189
# Find an unused name
1743
1190
for aname in (iname.format(i)
1744
1191
for i in itertools.count()):
1748
1195
if interface_names:
1749
1196
# Replace the class with a new subclass of it with
1750
1197
# methods, signals, etc. as created above.
1751
if sys.version_info.major == 2:
1752
cls = type(b"{}Alternate".format(cls.__name__),
1753
(cls, ), attr)
1754
else:
1755
cls = type("{}Alternate".format(cls.__name__),
1756
(cls, ), attr)
1198
cls = type(b"{0}Alternate".format(cls.__name__),
1199
(cls,), attr)
1757
1200
return cls
1758
1759
1201
return wrapper
1760
1202
1761
1203
1762
1204
@alternate_dbus_interfaces({"se.recompile.Mandos":
1763
"se.bsnet.fukt.Mandos"})
1205
"se.bsnet.fukt.Mandos"})
1764
1206
class ClientDBus(Client, DBusObjectWithProperties):
1765
1207
"""A Client class using D-Bus
1766
1208
1767
1209
Attributes:
1768
1210
dbus_object_path: dbus.ObjectPath
1769
1211
bus: dbus.SystemBus()
1770
1212
"""
1771
1213
1772
1214
runtime_expansions = (Client.runtime_expansions
1773
+ ("dbus_object_path", ))
1774
1775
_interface = "se.recompile.Mandos.Client"
1776
1215
+ ("dbus_object_path",))
1216
1777
1217
# dbus.service.Object doesn't use super(), so we can't either.
1778
1779
def __init__(self, bus=None, *args, **kwargs):
1218
1219
def __init__(self, bus = None, *args, **kwargs):
1780
1220
self.bus = bus
1781
1221
Client.__init__(self, *args, **kwargs)
1782
1222
# Only now, when this client is initialized, can it show up on
1783
1223
# the D-Bus
1784
client_object_name = str(self.name).translate(
1224
client_object_name = unicode(self.name).translate(
1785
1225
{ord("."): ord("_"),
1786
1226
ord("-"): ord("_")})
1787
self.dbus_object_path = dbus.ObjectPath(
1788
"/clients/" + client_object_name)
1227
self.dbus_object_path = (dbus.ObjectPath
1228
("/clients/" + client_object_name))
1789
1229
DBusObjectWithProperties.__init__(self, self.bus,
1790
1230
self.dbus_object_path)
1791
1792
def notifychangeproperty(transform_func, dbus_name,
1793
type_func=lambda x: x,
1794
variant_level=1,
1795
invalidate_only=False,
1796
_interface=_interface):
1231
1232
def notifychangeproperty(transform_func,
1233
dbus_name, type_func=lambda x: x,
1234
variant_level=1):
1797
1235
""" Modify a variable so that it's a property which announces
1798
1236
its changes to DBus.
1799
1237
1800
1238
transform_fun: Function that takes a value and a variant_level
1801
1239
and transforms it to a D-Bus type.
1802
1240
dbus_name: D-Bus name of the variable
1804
1242
to the D-Bus. Default: no transform
1805
1243
variant_level: D-Bus variant level. Default: 1
1806
1244
"""
1807
attrname = "_{}".format(dbus_name)
1808
1245
attrname = "_{0}".format(dbus_name)
1809
1246
def setter(self, value):
1810
1247
if hasattr(self, "dbus_object_path"):
1811
1248
if (not hasattr(self, attrname) or
1812
1249
type_func(getattr(self, attrname, None))
1813
1250
!= type_func(value)):
1814
if invalidate_only:
1815
self.PropertiesChanged(
1816
_interface, dbus.Dictionary(),
1817
dbus.Array((dbus_name, )))
1818
else:
1819
dbus_value = transform_func(
1820
type_func(value),
1821
variant_level=variant_level)
1822
self.PropertyChanged(dbus.String(dbus_name),
1823
dbus_value)
1824
self.PropertiesChanged(
1825
_interface,
1826
dbus.Dictionary({dbus.String(dbus_name):
1827
dbus_value}),
1828
dbus.Array())
1251
dbus_value = transform_func(type_func(value),
1252
variant_level
1253
=variant_level)
1254
self.PropertyChanged(dbus.String(dbus_name),
1255
dbus_value)
1829
1256
setattr(self, attrname, value)
1830
1257
1831
1258
return property(lambda self: getattr(self, attrname), setter)
1832
1259
1833
1260
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1834
1261
approvals_pending = notifychangeproperty(dbus.Boolean,
1835
1262
"ApprovalPending",
1836
type_func=bool)
1263
type_func = bool)
1837
1264
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1838
1265
last_enabled = notifychangeproperty(datetime_to_dbus,
1839
1266
"LastEnabled")
1840
checker = notifychangeproperty(
1841
dbus.Boolean, "CheckerRunning",
1842
type_func=lambda checker: checker is not None)
1267
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1268
type_func = lambda checker:
1269
checker is not None)
1843
1270
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1844
1271
"LastCheckedOK")
1845
1272
last_checker_status = notifychangeproperty(dbus.Int16,
1848
1275
datetime_to_dbus, "LastApprovalRequest")
1849
1276
approved_by_default = notifychangeproperty(dbus.Boolean,
1850
1277
"ApprovedByDefault")
1851
approval_delay = notifychangeproperty(
1852
dbus.UInt64, "ApprovalDelay",
1853
type_func=lambda td: td.total_seconds() * 1000)
1278
approval_delay = notifychangeproperty(dbus.UInt64,
1279
"ApprovalDelay",
1280
type_func =
1281
timedelta_to_milliseconds)
1854
1282
approval_duration = notifychangeproperty(
1855
1283
dbus.UInt64, "ApprovalDuration",
1856
type_func=lambda td: td.total_seconds() * 1000)
1284
type_func = timedelta_to_milliseconds)
1857
1285
host = notifychangeproperty(dbus.String, "Host")
1858
timeout = notifychangeproperty(
1859
dbus.UInt64, "Timeout",
1860
type_func=lambda td: td.total_seconds() * 1000)
1286
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1287
type_func =
1288
timedelta_to_milliseconds)
1861
1289
extended_timeout = notifychangeproperty(
1862
1290
dbus.UInt64, "ExtendedTimeout",
1863
type_func=lambda td: td.total_seconds() * 1000)
1864
interval = notifychangeproperty(
1865
dbus.UInt64, "Interval",
1866
type_func=lambda td: td.total_seconds() * 1000)
1291
type_func = timedelta_to_milliseconds)
1292
interval = notifychangeproperty(dbus.UInt64,
1293
"Interval",
1294
type_func =
1295
timedelta_to_milliseconds)
1867
1296
checker_command = notifychangeproperty(dbus.String, "Checker")
1868
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1869
invalidate_only=True)
1870
1297
1871
1298
del notifychangeproperty
1872
1299
1873
1300
def __del__(self, *args, **kwargs):
1874
1301
try:
1875
1302
self.remove_from_connection()
1878
1305
if hasattr(DBusObjectWithProperties, "__del__"):
1879
1306
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1880
1307
Client.__del__(self, *args, **kwargs)
1881
1882
def checker_callback(self, source, condition,
1883
connection, command, *args, **kwargs):
1884
ret = Client.checker_callback(self, source, condition,
1885
connection, command, *args,
1886
**kwargs)
1887
exitstatus = self.last_checker_status
1888
if exitstatus >= 0:
1308
1309
def checker_callback(self, pid, condition, command,
1310
*args, **kwargs):
1311
self.checker_callback_tag = None
1312
self.checker = None
1313
if os.WIFEXITED(condition):
1314
exitstatus = os.WEXITSTATUS(condition)
1889
1315
# Emit D-Bus signal
1890
1316
self.CheckerCompleted(dbus.Int16(exitstatus),
1891
# This is specific to GNU libC
1892
dbus.Int64(exitstatus << 8),
1317
dbus.Int64(condition),
1893
1318
dbus.String(command))
1894
1319
else:
1895
1320
# Emit D-Bus signal
1896
1321
self.CheckerCompleted(dbus.Int16(-1),
1897
dbus.Int64(
1898
# This is specific to GNU libC
1899
(exitstatus << 8)
1900
| self.last_checker_signal),
1322
dbus.Int64(condition),
1901
1323
dbus.String(command))
1902
return ret
1903
1324
1325
return Client.checker_callback(self, pid, condition, command,
1326
*args, **kwargs)
1327
1904
1328
def start_checker(self, *args, **kwargs):
1905
old_checker_pid = getattr(self.checker, "pid", None)
1329
old_checker = self.checker
1330
if self.checker is not None:
1331
old_checker_pid = self.checker.pid
1332
else:
1333
old_checker_pid = None
1906
1334
r = Client.start_checker(self, *args, **kwargs)
1907
1335
# Only if new checker process was started
1908
1336
if (self.checker is not None
1910
1338
# Emit D-Bus signal
1911
1339
self.CheckerStarted(self.current_checker_command)
1912
1340
return r
1913
1341
1914
1342
def _reset_approved(self):
1915
1343
self.approved = None
1916
1344
return False
1917
1345
1918
1346
def approve(self, value=True):
1919
1347
self.approved = value
1920
GLib.timeout_add(int(self.approval_duration.total_seconds()
1921
* 1000), self._reset_approved)
1348
gobject.timeout_add(timedelta_to_milliseconds
1349
(self.approval_duration),
1350
self._reset_approved)
1922
1351
self.send_changedstate()
1923
1924
# D-Bus methods, signals & properties
1925
1926
# Interfaces
1927
1928
# Signals
1929
1352
1353
## D-Bus methods, signals & properties
1354
_interface = "se.recompile.Mandos.Client"
1355
1356
## Interfaces
1357
1358
@dbus_interface_annotations(_interface)
1359
def _foo(self):
1360
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1361
"false"}
1362
1363
## Signals
1364
1930
1365
# CheckerCompleted - signal
1931
1366
@dbus.service.signal(_interface, signature="nxs")
1932
1367
def CheckerCompleted(self, exitcode, waitstatus, command):
1933
1368
"D-Bus signal"
1934
1369
pass
1935
1370
1936
1371
# CheckerStarted - signal
1937
1372
@dbus.service.signal(_interface, signature="s")
1938
1373
def CheckerStarted(self, command):
1939
1374
"D-Bus signal"
1940
1375
pass
1941
1376
1942
1377
# PropertyChanged - signal
1943
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1944
1378
@dbus.service.signal(_interface, signature="sv")
1945
1379
def PropertyChanged(self, property, value):
1946
1380
"D-Bus signal"
1947
1381
pass
1948
1382
1949
1383
# GotSecret - signal
1950
1384
@dbus.service.signal(_interface)
1951
1385
def GotSecret(self):
1954
1388
server to mandos-client
1955
1389
"""
1956
1390
pass
1957
1391
1958
1392
# Rejected - signal
1959
1393
@dbus.service.signal(_interface, signature="s")
1960
1394
def Rejected(self, reason):
1961
1395
"D-Bus signal"
1962
1396
pass
1963
1397
1964
1398
# NeedApproval - signal
1965
1399
@dbus.service.signal(_interface, signature="tb")
1966
1400
def NeedApproval(self, timeout, default):
1967
1401
"D-Bus signal"
1968
1402
return self.need_approval()
1969
1970
# Methods
1971
1403
1404
## Methods
1405
1972
1406
# Approve - method
1973
1407
@dbus.service.method(_interface, in_signature="b")
1974
1408
def Approve(self, value):
1975
1409
self.approve(value)
1976
1410
1977
1411
# CheckedOK - method
1978
1412
@dbus.service.method(_interface)
1979
1413
def CheckedOK(self):
1980
1414
self.checked_ok()
1981
1415
1982
1416
# Enable - method
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1984
1417
@dbus.service.method(_interface)
1985
1418
def Enable(self):
1986
1419
"D-Bus method"
1987
1420
self.enable()
1988
1421
1989
1422
# StartChecker - method
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1991
1423
@dbus.service.method(_interface)
1992
1424
def StartChecker(self):
1993
1425
"D-Bus method"
1994
1426
self.start_checker()
1995
1427
1996
1428
# Disable - method
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1998
1429
@dbus.service.method(_interface)
1999
1430
def Disable(self):
2000
1431
"D-Bus method"
2001
1432
self.disable()
2002
1433
2003
1434
# StopChecker - method
2004
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2005
1435
@dbus.service.method(_interface)
2006
1436
def StopChecker(self):
2007
1437
self.stop_checker()
2008
2009
# Properties
2010
1438
1439
## Properties
1440
2011
1441
# ApprovalPending - property
2012
1442
@dbus_service_property(_interface, signature="b", access="read")
2013
1443
def ApprovalPending_dbus_property(self):
2014
1444
return dbus.Boolean(bool(self.approvals_pending))
2015
1445
2016
1446
# ApprovedByDefault - property
2017
@dbus_service_property(_interface,
2018
signature="b",
1447
@dbus_service_property(_interface, signature="b",
2019
1448
access="readwrite")
2020
1449
def ApprovedByDefault_dbus_property(self, value=None):
2021
1450
if value is None: # get
2022
1451
return dbus.Boolean(self.approved_by_default)
2023
1452
self.approved_by_default = bool(value)
2024
1453
2025
1454
# ApprovalDelay - property
2026
@dbus_service_property(_interface,
2027
signature="t",
1455
@dbus_service_property(_interface, signature="t",
2028
1456
access="readwrite")
2029
1457
def ApprovalDelay_dbus_property(self, value=None):
2030
1458
if value is None: # get
2031
return dbus.UInt64(self.approval_delay.total_seconds()
2032
* 1000)
1459
return dbus.UInt64(self.approval_delay_milliseconds())
2033
1460
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2034
1461
2035
1462
# ApprovalDuration - property
2036
@dbus_service_property(_interface,
2037
signature="t",
1463
@dbus_service_property(_interface, signature="t",
2038
1464
access="readwrite")
2039
1465
def ApprovalDuration_dbus_property(self, value=None):
2040
1466
if value is None: # get
2041
return dbus.UInt64(self.approval_duration.total_seconds()
2042
* 1000)
1467
return dbus.UInt64(timedelta_to_milliseconds(
1468
self.approval_duration))
2043
1469
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2044
1470
2045
1471
# Name - property
2046
@dbus_annotations(
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2048
1472
@dbus_service_property(_interface, signature="s", access="read")
2049
1473
def Name_dbus_property(self):
2050
1474
return dbus.String(self.name)
2051
2052
# KeyID - property
2053
@dbus_annotations(
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2055
@dbus_service_property(_interface, signature="s", access="read")
2056
def KeyID_dbus_property(self):
2057
return dbus.String(self.key_id)
2058
1475
2059
1476
# Fingerprint - property
2060
@dbus_annotations(
2061
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2062
1477
@dbus_service_property(_interface, signature="s", access="read")
2063
1478
def Fingerprint_dbus_property(self):
2064
1479
return dbus.String(self.fingerprint)
2065
1480
2066
1481
# Host - property
2067
@dbus_service_property(_interface,
2068
signature="s",
1482
@dbus_service_property(_interface, signature="s",
2069
1483
access="readwrite")
2070
1484
def Host_dbus_property(self, value=None):
2071
1485
if value is None: # get
2072
1486
return dbus.String(self.host)
2073
self.host = str(value)
2074
1487
self.host = unicode(value)
1488
2075
1489
# Created - property
2076
@dbus_annotations(
2077
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2078
1490
@dbus_service_property(_interface, signature="s", access="read")
2079
1491
def Created_dbus_property(self):
2080
1492
return datetime_to_dbus(self.created)
2081
1493
2082
1494
# LastEnabled - property
2083
1495
@dbus_service_property(_interface, signature="s", access="read")
2084
1496
def LastEnabled_dbus_property(self):
2085
1497
return datetime_to_dbus(self.last_enabled)
2086
1498
2087
1499
# Enabled - property
2088
@dbus_service_property(_interface,
2089
signature="b",
1500
@dbus_service_property(_interface, signature="b",
2090
1501
access="readwrite")
2091
1502
def Enabled_dbus_property(self, value=None):
2092
1503
if value is None: # get
2095
1506
self.enable()
2096
1507
else:
2097
1508
self.disable()
2098
1509
2099
1510
# LastCheckedOK - property
2100
@dbus_service_property(_interface,
2101
signature="s",
1511
@dbus_service_property(_interface, signature="s",
2102
1512
access="readwrite")
2103
1513
def LastCheckedOK_dbus_property(self, value=None):
2104
1514
if value is not None:
2105
1515
self.checked_ok()
2106
1516
return
2107
1517
return datetime_to_dbus(self.last_checked_ok)
2108
1518
2109
1519
# LastCheckerStatus - property
2110
@dbus_service_property(_interface, signature="n", access="read")
1520
@dbus_service_property(_interface, signature="n",
1521
access="read")
2111
1522
def LastCheckerStatus_dbus_property(self):
2112
1523
return dbus.Int16(self.last_checker_status)
2113
1524
2114
1525
# Expires - property
2115
1526
@dbus_service_property(_interface, signature="s", access="read")
2116
1527
def Expires_dbus_property(self):
2117
1528
return datetime_to_dbus(self.expires)
2118
1529
2119
1530
# LastApprovalRequest - property
2120
1531
@dbus_service_property(_interface, signature="s", access="read")
2121
1532
def LastApprovalRequest_dbus_property(self):
2122
1533
return datetime_to_dbus(self.last_approval_request)
2123
1534
2124
1535
# Timeout - property
2125
@dbus_service_property(_interface,
2126
signature="t",
1536
@dbus_service_property(_interface, signature="t",
2127
1537
access="readwrite")
2128
1538
def Timeout_dbus_property(self, value=None):
2129
1539
if value is None: # get
2130
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1540
return dbus.UInt64(self.timeout_milliseconds())
2131
1541
old_timeout = self.timeout
2132
1542
self.timeout = datetime.timedelta(0, 0, 0, value)
2133
1543
# Reschedule disabling
2141
1551
if (getattr(self, "disable_initiator_tag", None)
2142
1552
is None):
2143
1553
return
2144
GLib.source_remove(self.disable_initiator_tag)
2145
self.disable_initiator_tag = GLib.timeout_add(
2146
int((self.expires - now).total_seconds() * 1000),
2147
self.disable)
2148
1554
gobject.source_remove(self.disable_initiator_tag)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
timedelta_to_milliseconds(self.expires - now),
1558
self.disable))
1559
2149
1560
# ExtendedTimeout - property
2150
@dbus_service_property(_interface,
2151
signature="t",
1561
@dbus_service_property(_interface, signature="t",
2152
1562
access="readwrite")
2153
1563
def ExtendedTimeout_dbus_property(self, value=None):
2154
1564
if value is None: # get
2155
return dbus.UInt64(self.extended_timeout.total_seconds()
2156
* 1000)
1565
return dbus.UInt64(self.extended_timeout_milliseconds())
2157
1566
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2158
1567
2159
1568
# Interval - property
2160
@dbus_service_property(_interface,
2161
signature="t",
1569
@dbus_service_property(_interface, signature="t",
2162
1570
access="readwrite")
2163
1571
def Interval_dbus_property(self, value=None):
2164
1572
if value is None: # get
2165
return dbus.UInt64(self.interval.total_seconds() * 1000)
1573
return dbus.UInt64(self.interval_milliseconds())
2166
1574
self.interval = datetime.timedelta(0, 0, 0, value)
2167
1575
if getattr(self, "checker_initiator_tag", None) is None:
2168
1576
return
2169
1577
if self.enabled:
2170
1578
# Reschedule checker run
2171
GLib.source_remove(self.checker_initiator_tag)
2172
self.checker_initiator_tag = GLib.timeout_add(
2173
value, self.start_checker)
2174
self.start_checker() # Start one now, too
2175
1579
gobject.source_remove(self.checker_initiator_tag)
1580
self.checker_initiator_tag = (gobject.timeout_add
1581
(value, self.start_checker))
1582
self.start_checker() # Start one now, too
1583
2176
1584
# Checker - property
2177
@dbus_service_property(_interface,
2178
signature="s",
1585
@dbus_service_property(_interface, signature="s",
2179
1586
access="readwrite")
2180
1587
def Checker_dbus_property(self, value=None):
2181
1588
if value is None: # get
2182
1589
return dbus.String(self.checker_command)
2183
self.checker_command = str(value)
2184
1590
self.checker_command = unicode(value)
1591
2185
1592
# CheckerRunning - property
2186
@dbus_service_property(_interface,
2187
signature="b",
1593
@dbus_service_property(_interface, signature="b",
2188
1594
access="readwrite")
2189
1595
def CheckerRunning_dbus_property(self, value=None):
2190
1596
if value is None: # get
2193
1599
self.start_checker()
2194
1600
else:
2195
1601
self.stop_checker()
2196
1602
2197
1603
# ObjectPath - property
2198
@dbus_annotations(
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2200
"org.freedesktop.DBus.Deprecated": "true"})
2201
1604
@dbus_service_property(_interface, signature="o", access="read")
2202
1605
def ObjectPath_dbus_property(self):
2203
return self.dbus_object_path # is already a dbus.ObjectPath
2204
1606
return self.dbus_object_path # is already a dbus.ObjectPath
1607
2205
1608
# Secret = property
2206
@dbus_annotations(
2207
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2208
"invalidates"})
2209
@dbus_service_property(_interface,
2210
signature="ay",
2211
access="write",
2212
byte_arrays=True)
1609
@dbus_service_property(_interface, signature="ay",
1610
access="write", byte_arrays=True)
2213
1611
def Secret_dbus_property(self, value):
2214
self.secret = bytes(value)
2215
1612
self.secret = str(value)
1613
2216
1614
del _interface
2217
1615
2218
1616
2219
class ProxyClient:
2220
def __init__(self, child_pipe, key_id, fpr, address):
1617
class ProxyClient(object):
1618
def __init__(self, child_pipe, fpr, address):
2221
1619
self._pipe = child_pipe
2222
self._pipe.send(('init', key_id, fpr, address))
1620
self._pipe.send(('init', fpr, address))
2223
1621
if not self._pipe.recv():
2224
raise KeyError(key_id or fpr)
2225
1622
raise KeyError()
1623
2226
1624
def __getattribute__(self, name):
2227
1625
if name == '_pipe':
2228
1626
return super(ProxyClient, self).__getattribute__(name)
2231
1629
if data[0] == 'data':
2232
1630
return data[1]
2233
1631
if data[0] == 'function':
2234
2235
1632
def func(*args, **kwargs):
2236
1633
self._pipe.send(('funcall', name, args, kwargs))
2237
1634
return self._pipe.recv()[1]
2238
2239
1635
return func
2240
1636
2241
1637
def __setattr__(self, name, value):
2242
1638
if name == '_pipe':
2243
1639
return super(ProxyClient, self).__setattr__(name, value)
2246
1642
2247
1643
class ClientHandler(socketserver.BaseRequestHandler, object):
2248
1644
"""A class to handle client connections.
2249
1645
2250
1646
Instantiated once for each connection to handle it.
2251
1647
Note: This will run in its own forked process."""
2252
1648
2253
1649
def handle(self):
2254
1650
with contextlib.closing(self.server.child_pipe) as child_pipe:
2255
1651
logger.info("TCP connection from: %s",
2256
str(self.client_address))
1652
unicode(self.client_address))
2257
1653
logger.debug("Pipe FD: %d",
2258
1654
self.server.child_pipe.fileno())
2259
2260
session = gnutls.ClientSession(self.request)
2261
2262
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2263
# "+AES-256-CBC", "+SHA1",
2264
# "+COMP-NULL", "+CTYPE-OPENPGP",
2265
# "+DHE-DSS"))
1655
1656
session = (gnutls.connection
1657
.ClientSession(self.request,
1658
gnutls.connection
1659
.X509Credentials()))
1660
1661
# Note: gnutls.connection.X509Credentials is really a
1662
# generic GnuTLS certificate credentials object so long as
1663
# no X.509 keys are added to it. Therefore, we can use it
1664
# here despite using OpenPGP certificates.
1665
1666
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1667
# "+AES-256-CBC", "+SHA1",
1668
# "+COMP-NULL", "+CTYPE-OPENPGP",
1669
# "+DHE-DSS"))
2266
1670
# Use a fallback default, since this MUST be set.
2267
1671
priority = self.server.gnutls_priority
2268
1672
if priority is None:
2269
1673
priority = "NORMAL"
2270
gnutls.priority_set_direct(session._c_object,
2271
priority.encode("utf-8"),
2272
None)
2273
1674
(gnutls.library.functions
1675
.gnutls_priority_set_direct(session._c_object,
1676
priority, None))
1677
2274
1678
# Start communication using the Mandos protocol
2275
1679
# Get protocol number
2276
1680
line = self.request.makefile().readline()
2277
1681
logger.debug("Protocol version: %r", line)
2278
1682
try:
2279
1683
if int(line.strip().split()[0]) > 1:
2280
raise RuntimeError(line)
1684
raise RuntimeError
2281
1685
except (ValueError, IndexError, RuntimeError) as error:
2282
1686
logger.error("Unknown protocol version: %s", error)
2283
1687
return
2284
1688
2285
1689
# Start GnuTLS connection
2286
1690
try:
2287
1691
session.handshake()
2288
except gnutls.Error as error:
1692
except gnutls.errors.GNUTLSError as error:
2289
1693
logger.warning("Handshake failed: %s", error)
2290
1694
# Do not run session.bye() here: the session is not
2291
1695
# established. Just abandon the request.
2292
1696
return
2293
1697
logger.debug("Handshake succeeded")
2294
1698
2295
1699
approval_required = False
2296
1700
try:
2297
if gnutls.has_rawpk:
2298
fpr = b""
2299
try:
2300
key_id = self.key_id(
2301
self.peer_certificate(session))
2302
except (TypeError, gnutls.Error) as error:
2303
logger.warning("Bad certificate: %s", error)
2304
return
2305
logger.debug("Key ID: %s", key_id)
2306
2307
else:
2308
key_id = b""
2309
try:
2310
fpr = self.fingerprint(
2311
self.peer_certificate(session))
2312
except (TypeError, gnutls.Error) as error:
2313
logger.warning("Bad certificate: %s", error)
2314
return
2315
logger.debug("Fingerprint: %s", fpr)
2316
2317
try:
2318
client = ProxyClient(child_pipe, key_id, fpr,
1701
try:
1702
fpr = self.fingerprint(self.peer_certificate
1703
(session))
1704
except (TypeError,
1705
gnutls.errors.GNUTLSError) as error:
1706
logger.warning("Bad certificate: %s", error)
1707
return
1708
logger.debug("Fingerprint: %s", fpr)
1709
1710
try:
1711
client = ProxyClient(child_pipe, fpr,
2319
1712
self.client_address)
2320
1713
except KeyError:
2321
1714
return
2322
1715
2323
1716
if client.approval_delay:
2324
1717
delay = client.approval_delay
2325
1718
client.approvals_pending += 1
2326
1719
approval_required = True
2327
1720
2328
1721
while True:
2329
1722
if not client.enabled:
2330
1723
logger.info("Client %s is disabled",
2331
client.name)
1724
client.name)
2332
1725
if self.server.use_dbus:
2333
1726
# Emit D-Bus signal
2334
1727
client.Rejected("Disabled")
2335
1728
return
2336
1729
2337
1730
if client.approved or not client.approval_delay:
2338
# We are approved or approval is disabled
1731
#We are approved or approval is disabled
2339
1732
break
2340
1733
elif client.approved is None:
2341
1734
logger.info("Client %s needs approval",
2343
1736
if self.server.use_dbus:
2344
1737
# Emit D-Bus signal
2345
1738
client.NeedApproval(
2346
client.approval_delay.total_seconds()
2347
* 1000, client.approved_by_default)
1739
client.approval_delay_milliseconds(),
1740
client.approved_by_default)
2348
1741
else:
2349
1742
logger.warning("Client %s was not approved",
2350
1743
client.name)
2352
1745
# Emit D-Bus signal
2353
1746
client.Rejected("Denied")
2354
1747
return
2355
2356
# wait until timeout or approved
1748
1749
#wait until timeout or approved
2357
1750
time = datetime.datetime.now()
2358
1751
client.changedstate.acquire()
2359
client.changedstate.wait(delay.total_seconds())
1752
client.changedstate.wait(
1753
float(timedelta_to_milliseconds(delay)
1754
/ 1000))
2360
1755
client.changedstate.release()
2361
1756
time2 = datetime.datetime.now()
2362
1757
if (time2 - time) >= delay:
2372
1767
break
2373
1768
else:
2374
1769
delay -= time2 - time
2375
2376
try:
2377
session.send(client.secret)
2378
except gnutls.Error as error:
2379
logger.warning("gnutls send failed",
2380
exc_info=error)
2381
return
2382
1770
1771
sent_size = 0
1772
while sent_size < len(client.secret):
1773
try:
1774
sent = session.send(client.secret[sent_size:])
1775
except gnutls.errors.GNUTLSError as error:
1776
logger.warning("gnutls send failed",
1777
exc_info=error)
1778
return
1779
logger.debug("Sent: %d, remaining: %d",
1780
sent, len(client.secret)
1781
- (sent_size + sent))
1782
sent_size += sent
1783
2383
1784
logger.info("Sending secret to %s", client.name)
2384
1785
# bump the timeout using extended_timeout
2385
1786
client.bump_timeout(client.extended_timeout)
2386
1787
if self.server.use_dbus:
2387
1788
# Emit D-Bus signal
2388
1789
client.GotSecret()
2389
1790
2390
1791
finally:
2391
1792
if approval_required:
2392
1793
client.approvals_pending -= 1
2393
1794
try:
2394
1795
session.bye()
2395
except gnutls.Error as error:
1796
except gnutls.errors.GNUTLSError as error:
2396
1797
logger.warning("GnuTLS bye failed",
2397
1798
exc_info=error)
2398
1799
2399
1800
@staticmethod
2400
1801
def peer_certificate(session):
2401
"Return the peer's certificate as a bytestring"
2402
try:
2403
cert_type = gnutls.certificate_type_get2(session._c_object,
2404
gnutls.CTYPE_PEERS)
2405
except AttributeError:
2406
cert_type = gnutls.certificate_type_get(session._c_object)
2407
if gnutls.has_rawpk:
2408
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2409
else:
2410
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2411
# If not a valid certificate type...
2412
if cert_type not in valid_cert_types:
2413
logger.info("Cert type %r not in %r", cert_type,
2414
valid_cert_types)
2415
# ...return invalid data
2416
return b""
1802
"Return the peer's OpenPGP certificate as a bytestring"
1803
# If not an OpenPGP certificate...
1804
if (gnutls.library.functions
1805
.gnutls_certificate_type_get(session._c_object)
1806
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1807
# ...do the normal thing
1808
return session.peer_certificate
2417
1809
list_size = ctypes.c_uint(1)
2418
cert_list = (gnutls.certificate_get_peers
1810
cert_list = (gnutls.library.functions
1811
.gnutls_certificate_get_peers
2419
1812
(session._c_object, ctypes.byref(list_size)))
2420
1813
if not bool(cert_list) and list_size.value != 0:
2421
raise gnutls.Error("error getting peer certificate")
1814
raise gnutls.errors.GNUTLSError("error getting peer"
1815
" certificate")
2422
1816
if list_size.value == 0:
2423
1817
return None
2424
1818
cert = cert_list[0]
2425
1819
return ctypes.string_at(cert.data, cert.size)
2426
2427
@staticmethod
2428
def key_id(certificate):
2429
"Convert a certificate bytestring to a hexdigit key ID"
2430
# New GnuTLS "datum" with the public key
2431
datum = gnutls.datum_t(
2432
ctypes.cast(ctypes.c_char_p(certificate),
2433
ctypes.POINTER(ctypes.c_ubyte)),
2434
ctypes.c_uint(len(certificate)))
2435
# XXX all these need to be created in the gnutls "module"
2436
# New empty GnuTLS certificate
2437
pubkey = gnutls.pubkey_t()
2438
gnutls.pubkey_init(ctypes.byref(pubkey))
2439
# Import the raw public key into the certificate
2440
gnutls.pubkey_import(pubkey,
2441
ctypes.byref(datum),
2442
gnutls.X509_FMT_DER)
2443
# New buffer for the key ID
2444
buf = ctypes.create_string_buffer(32)
2445
buf_len = ctypes.c_size_t(len(buf))
2446
# Get the key ID from the raw public key into the buffer
2447
gnutls.pubkey_get_key_id(pubkey,
2448
gnutls.KEYID_USE_SHA256,
2449
ctypes.cast(ctypes.byref(buf),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.byref(buf_len))
2452
# Deinit the certificate
2453
gnutls.pubkey_deinit(pubkey)
2454
2455
# Convert the buffer to a Python bytestring
2456
key_id = ctypes.string_at(buf, buf_len.value)
2457
# Convert the bytestring to hexadecimal notation
2458
hex_key_id = binascii.hexlify(key_id).upper()
2459
return hex_key_id
2460
1820
2461
1821
@staticmethod
2462
1822
def fingerprint(openpgp):
2463
1823
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2464
1824
# New GnuTLS "datum" with the OpenPGP public key
2465
datum = gnutls.datum_t(
2466
ctypes.cast(ctypes.c_char_p(openpgp),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.c_uint(len(openpgp)))
1825
datum = (gnutls.library.types
1826
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1827
ctypes.POINTER
1828
(ctypes.c_ubyte)),
1829
ctypes.c_uint(len(openpgp))))
2469
1830
# New empty GnuTLS certificate
2470
crt = gnutls.openpgp_crt_t()
2471
gnutls.openpgp_crt_init(ctypes.byref(crt))
1831
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1832
(gnutls.library.functions
1833
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2472
1834
# Import the OpenPGP public key into the certificate
2473
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2474
gnutls.OPENPGP_FMT_RAW)
1835
(gnutls.library.functions
1836
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1837
gnutls.library.constants
1838
.GNUTLS_OPENPGP_FMT_RAW))
2475
1839
# Verify the self signature in the key
2476
1840
crtverify = ctypes.c_uint()
2477
gnutls.openpgp_crt_verify_self(crt, 0,
2478
ctypes.byref(crtverify))
1841
(gnutls.library.functions
1842
.gnutls_openpgp_crt_verify_self(crt, 0,
1843
ctypes.byref(crtverify)))
2479
1844
if crtverify.value != 0:
2480
gnutls.openpgp_crt_deinit(crt)
2481
raise gnutls.CertificateSecurityError(code
2482
=crtverify.value)
1845
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1846
raise (gnutls.errors.CertificateSecurityError
1847
("Verify failed"))
2483
1848
# New buffer for the fingerprint
2484
1849
buf = ctypes.create_string_buffer(20)
2485
1850
buf_len = ctypes.c_size_t()
2486
1851
# Get the fingerprint from the certificate into the buffer
2487
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2488
ctypes.byref(buf_len))
1852
(gnutls.library.functions
1853
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1854
ctypes.byref(buf_len)))
2489
1855
# Deinit the certificate
2490
gnutls.openpgp_crt_deinit(crt)
1856
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2491
1857
# Convert the buffer to a Python bytestring
2492
1858
fpr = ctypes.string_at(buf, buf_len.value)
2493
1859
# Convert the bytestring to hexadecimal notation
2495
1861
return hex_fpr
2496
1862
2497
1863
2498
class MultiprocessingMixIn:
1864
class MultiprocessingMixIn(object):
2499
1865
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2500
2501
1866
def sub_process_main(self, request, address):
2502
1867
try:
2503
1868
self.finish_request(request, address)
2504
1869
except Exception:
2505
1870
self.handle_error(request, address)
2506
1871
self.close_request(request)
2507
1872
2508
1873
def process_request(self, request, address):
2509
1874
"""Start a new process to process the request."""
2510
proc = multiprocessing.Process(target=self.sub_process_main,
2511
args=(request, address))
1875
proc = multiprocessing.Process(target = self.sub_process_main,
1876
args = (request, address))
2512
1877
proc.start()
2513
1878
return proc
2514
1879
2515
1880
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1881
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2517
1882
""" adds a pipe to the MixIn """
2518
2519
1883
def process_request(self, request, client_address):
2520
1884
"""Overrides and wraps the original process_request().
2521
1885
2522
1886
This function creates a new pipe in self.pipe
2523
1887
"""
2524
1888
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2525
1889
2526
1890
proc = MultiprocessingMixIn.process_request(self, request,
2527
1891
client_address)
2528
1892
self.child_pipe.close()
2529
1893
self.add_pipe(parent_pipe, proc)
2530
1894
2531
1895
def add_pipe(self, parent_pipe, proc):
2532
1896
"""Dummy function; override as necessary"""
2533
raise NotImplementedError()
1897
raise NotImplementedError
2534
1898
2535
1899
2536
1900
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2537
socketserver.TCPServer):
1901
socketserver.TCPServer, object):
2538
1902
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2539
1903
2540
1904
Attributes:
2541
1905
enabled: Boolean; whether this server is activated yet
2542
1906
interface: None or a network interface name (string)
2543
1907
use_ipv6: Boolean; to use IPv6 or not
2544
1908
"""
2545
2546
1909
def __init__(self, server_address, RequestHandlerClass,
2547
interface=None,
2548
use_ipv6=True,
2549
socketfd=None):
1910
interface=None, use_ipv6=True, socketfd=None):
2550
1911
"""If socketfd is set, use that file descriptor instead of
2551
1912
creating a new one with socket.socket().
2552
1913
"""
2558
1919
self.socketfd = socketfd
2559
1920
# Save the original socket.socket() function
2560
1921
self.socket_socket = socket.socket
2561
2562
1922
# To implement --socket, we monkey patch socket.socket.
2563
#
1923
#
2564
1924
# (When socketserver.TCPServer is a new-style class, we
2565
1925
# could make self.socket into a property instead of monkey
2566
1926
# patching socket.socket.)
2567
#
1927
#
2568
1928
# Create a one-time-only replacement for socket.socket()
2569
1929
@functools.wraps(socket.socket)
2570
1930
def socket_wrapper(*args, **kwargs):
2582
1942
# socket_wrapper(), if socketfd was set.
2583
1943
socketserver.TCPServer.__init__(self, server_address,
2584
1944
RequestHandlerClass)
2585
1945
2586
1946
def server_bind(self):
2587
1947
"""This overrides the normal server_bind() function
2588
1948
to bind to an interface if one was specified, and also NOT to
2589
1949
bind to an address or port if they were not specified."""
2590
global SO_BINDTODEVICE
2591
1950
if self.interface is not None:
2592
1951
if SO_BINDTODEVICE is None:
2593
# Fall back to a hard-coded value which seems to be
2594
# common enough.
2595
logger.warning("SO_BINDTODEVICE not found, trying 25")
2596
SO_BINDTODEVICE = 25
2597
try:
2598
self.socket.setsockopt(
2599
socket.SOL_SOCKET, SO_BINDTODEVICE,
2600
(self.interface + "\0").encode("utf-8"))
2601
except socket.error as error:
2602
if error.errno == errno.EPERM:
2603
logger.error("No permission to bind to"
2604
" interface %s", self.interface)
2605
elif error.errno == errno.ENOPROTOOPT:
2606
logger.error("SO_BINDTODEVICE not available;"
2607
" cannot bind to interface %s",
2608
self.interface)
2609
elif error.errno == errno.ENODEV:
2610
logger.error("Interface %s does not exist,"
2611
" cannot bind", self.interface)
2612
else:
2613
raise
1952
logger.error("SO_BINDTODEVICE does not exist;"
1953
" cannot bind to interface %s",
1954
self.interface)
1955
else:
1956
try:
1957
self.socket.setsockopt(socket.SOL_SOCKET,
1958
SO_BINDTODEVICE,
1959
str(self.interface + '\0'))
1960
except socket.error as error:
1961
if error.errno == errno.EPERM:
1962
logger.error("No permission to bind to"
1963
" interface %s", self.interface)
1964
elif error.errno == errno.ENOPROTOOPT:
1965
logger.error("SO_BINDTODEVICE not available;"
1966
" cannot bind to interface %s",
1967
self.interface)
1968
elif error.errno == errno.ENODEV:
1969
logger.error("Interface %s does not exist,"
1970
" cannot bind", self.interface)
1971
else:
1972
raise
2614
1973
# Only bind(2) the socket if we really need to.
2615
1974
if self.server_address[0] or self.server_address[1]:
2616
if self.server_address[1]:
2617
self.allow_reuse_address = True
2618
1975
if not self.server_address[0]:
2619
1976
if self.address_family == socket.AF_INET6:
2620
any_address = "::" # in6addr_any
1977
any_address = "::" # in6addr_any
2621
1978
else:
2622
any_address = "0.0.0.0" # INADDR_ANY
1979
any_address = socket.INADDR_ANY
2623
1980
self.server_address = (any_address,
2624
1981
self.server_address[1])
2625
1982
elif not self.server_address[1]:
2626
self.server_address = (self.server_address[0], 0)
1983
self.server_address = (self.server_address[0],
1984
0)
2627
1985
# if self.interface:
2628
1986
# self.server_address = (self.server_address[0],
2629
1987
# 0, # port
2635
1993
2636
1994
class MandosServer(IPv6_TCPServer):
2637
1995
"""Mandos server.
2638
1996
2639
1997
Attributes:
2640
1998
clients: set of Client objects
2641
1999
gnutls_priority GnuTLS priority string
2642
2000
use_dbus: Boolean; to emit D-Bus signals or not
2643
2644
Assumes a GLib.MainLoop event loop.
2001
2002
Assumes a gobject.MainLoop event loop.
2645
2003
"""
2646
2647
2004
def __init__(self, server_address, RequestHandlerClass,
2648
interface=None,
2649
use_ipv6=True,
2650
clients=None,
2651
gnutls_priority=None,
2652
use_dbus=True,
2653
socketfd=None):
2005
interface=None, use_ipv6=True, clients=None,
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
2654
2007
self.enabled = False
2655
2008
self.clients = clients
2656
2009
if self.clients is None:
2659
2012
self.gnutls_priority = gnutls_priority
2660
2013
IPv6_TCPServer.__init__(self, server_address,
2661
2014
RequestHandlerClass,
2662
interface=interface,
2663
use_ipv6=use_ipv6,
2664
socketfd=socketfd)
2665
2015
interface = interface,
2016
use_ipv6 = use_ipv6,
2017
socketfd = socketfd)
2666
2018
def server_activate(self):
2667
2019
if self.enabled:
2668
2020
return socketserver.TCPServer.server_activate(self)
2669
2021
2670
2022
def enable(self):
2671
2023
self.enabled = True
2672
2024
2673
2025
def add_pipe(self, parent_pipe, proc):
2674
2026
# Call "handle_ipc" for both data and EOF events
2675
GLib.io_add_watch(
2676
parent_pipe.fileno(),
2677
GLib.IO_IN | GLib.IO_HUP,
2678
functools.partial(self.handle_ipc,
2679
parent_pipe=parent_pipe,
2680
proc=proc))
2681
2682
def handle_ipc(self, source, condition,
2683
parent_pipe=None,
2684
proc=None,
2685
client_object=None):
2027
gobject.io_add_watch(parent_pipe.fileno(),
2028
gobject.IO_IN | gobject.IO_HUP,
2029
functools.partial(self.handle_ipc,
2030
parent_pipe =
2031
parent_pipe,
2032
proc = proc))
2033
2034
def handle_ipc(self, source, condition, parent_pipe=None,
2035
proc = None, client_object=None):
2686
2036
# error, or the other end of multiprocessing.Pipe has closed
2687
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2688
2038
# Wait for other process to exit
2689
2039
proc.join()
2690
2040
return False
2691
2041
2692
2042
# Read a request from the child
2693
2043
request = parent_pipe.recv()
2694
2044
command = request[0]
2695
2045
2696
2046
if command == 'init':
2697
key_id = request[1].decode("ascii")
2698
fpr = request[2].decode("ascii")
2699
address = request[3]
2700
2701
for c in self.clients.values():
2702
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2703
continue
2704
if key_id and c.key_id == key_id:
2705
client = c
2706
break
2707
if fpr and c.fingerprint == fpr:
2047
fpr = request[1]
2048
address = request[2]
2049
2050
for c in self.clients.itervalues():
2051
if c.fingerprint == fpr:
2708
2052
client = c
2709
2053
break
2710
2054
else:
2711
logger.info("Client not found for key ID: %s, address"
2712
": %s", key_id or fpr, address)
2055
logger.info("Client not found for fingerprint: %s, ad"
2056
"dress: %s", fpr, address)
2713
2057
if self.use_dbus:
2714
2058
# Emit D-Bus signal
2715
mandos_dbus_service.ClientNotFound(key_id or fpr,
2059
mandos_dbus_service.ClientNotFound(fpr,
2716
2060
address[0])
2717
2061
parent_pipe.send(False)
2718
2062
return False
2719
2720
GLib.io_add_watch(
2721
parent_pipe.fileno(),
2722
GLib.IO_IN | GLib.IO_HUP,
2723
functools.partial(self.handle_ipc,
2724
parent_pipe=parent_pipe,
2725
proc=proc,
2726
client_object=client))
2063
2064
gobject.io_add_watch(parent_pipe.fileno(),
2065
gobject.IO_IN | gobject.IO_HUP,
2066
functools.partial(self.handle_ipc,
2067
parent_pipe =
2068
parent_pipe,
2069
proc = proc,
2070
client_object =
2071
client))
2727
2072
parent_pipe.send(True)
2728
2073
# remove the old hook in favor of the new above hook on
2729
2074
# same fileno
2732
2077
funcname = request[1]
2733
2078
args = request[2]
2734
2079
kwargs = request[3]
2735
2080
2736
2081
parent_pipe.send(('data', getattr(client_object,
2737
2082
funcname)(*args,
2738
**kwargs)))
2739
2083
**kwargs)))
2084
2740
2085
if command == 'getattr':
2741
2086
attrname = request[1]
2742
if isinstance(client_object.__getattribute__(attrname),
2743
collections.Callable):
2744
parent_pipe.send(('function', ))
2087
if callable(client_object.__getattribute__(attrname)):
2088
parent_pipe.send(('function',))
2745
2089
else:
2746
parent_pipe.send((
2747
'data', client_object.__getattribute__(attrname)))
2748
2090
parent_pipe.send(('data', client_object
2091
.__getattribute__(attrname)))
2092
2749
2093
if command == 'setattr':
2750
2094
attrname = request[1]
2751
2095
value = request[2]
2752
2096
setattr(client_object, attrname, value)
2753
2097
2754
2098
return True
2755
2099
2756
2100
2757
2101
def rfc3339_duration_to_delta(duration):
2758
2102
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2759
2103
2760
2104
>>> rfc3339_duration_to_delta("P7D")
2761
2105
datetime.timedelta(7)
2762
2106
>>> rfc3339_duration_to_delta("PT60S")
2772
2116
>>> rfc3339_duration_to_delta("P1DT3M20S")
2773
2117
datetime.timedelta(1, 200)
2774
2118
"""
2775
2119
2776
2120
# Parsing an RFC 3339 duration with regular expressions is not
2777
2121
# possible - there would have to be multiple places for the same
2778
2122
# values, like seconds. The current code, while more esoteric, is
2779
2123
# cleaner without depending on a parsing library. If Python had a
2780
2124
# built-in library for parsing we would use it, but we'd like to
2781
2125
# avoid excessive use of external libraries.
2782
2126
2783
2127
# New type for defining tokens, syntax, and semantics all-in-one
2784
Token = collections.namedtuple("Token", (
2785
"regexp", # To match token; if "value" is not None, must have
2786
# a "group" containing digits
2787
"value", # datetime.timedelta or None
2788
"followers")) # Tokens valid after this token
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2132
# containing digits
2133
"value", # datetime.timedelta or
2134
# None
2135
"followers")) # Tokens valid after
2136
# this token
2789
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2790
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2791
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2792
2140
token_second = Token(re.compile(r"(\d+)S"),
2793
2141
datetime.timedelta(seconds=1),
2794
frozenset((token_end, )))
2142
frozenset((token_end,)))
2795
2143
token_minute = Token(re.compile(r"(\d+)M"),
2796
2144
datetime.timedelta(minutes=1),
2797
2145
frozenset((token_second, token_end)))
2813
2161
frozenset((token_month, token_end)))
2814
2162
token_week = Token(re.compile(r"(\d+)W"),
2815
2163
datetime.timedelta(weeks=1),
2816
frozenset((token_end, )))
2164
frozenset((token_end,)))
2817
2165
token_duration = Token(re.compile(r"P"), None,
2818
2166
frozenset((token_year, token_month,
2819
2167
token_day, token_time,
2820
token_week)))
2821
# Define starting values:
2822
# Value so far
2823
value = datetime.timedelta()
2168
token_week))),
2169
# Define starting values
2170
value = datetime.timedelta() # Value so far
2824
2171
found_token = None
2825
# Following valid tokens
2826
followers = frozenset((token_duration, ))
2827
# String left to parse
2828
s = duration
2172
followers = frozenset(token_duration,) # Following valid tokens
2173
s = duration # String left to parse
2829
2174
# Loop until end token is found
2830
2175
while found_token is not token_end:
2831
2176
# Search for any currently valid tokens
2847
2192
break
2848
2193
else:
2849
2194
# No currently valid tokens were found
2850
raise ValueError("Invalid RFC 3339 duration: {!r}"
2851
.format(duration))
2195
raise ValueError("Invalid RFC 3339 duration")
2852
2196
# End token found
2853
2197
return value
2854
2198
2855
2199
2856
2200
def string_to_delta(interval):
2857
2201
"""Parse a string and return a datetime.timedelta
2858
2202
2859
2203
>>> string_to_delta('7d')
2860
2204
datetime.timedelta(7)
2861
2205
>>> string_to_delta('60s')
2869
2213
>>> string_to_delta('5m 30s')
2870
2214
datetime.timedelta(0, 330)
2871
2215
"""
2872
2216
2873
2217
try:
2874
2218
return rfc3339_duration_to_delta(interval)
2875
2219
except ValueError:
2876
2220
pass
2877
2221
2878
2222
timevalue = datetime.timedelta(0)
2879
2223
for s in interval.split():
2880
2224
try:
2881
suffix = s[-1]
2225
suffix = unicode(s[-1])
2882
2226
value = int(s[:-1])
2883
2227
if suffix == "d":
2884
2228
delta = datetime.timedelta(value)
2891
2235
elif suffix == "w":
2892
2236
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2893
2237
else:
2894
raise ValueError("Unknown suffix {!r}".format(suffix))
2895
except IndexError as e:
2238
raise ValueError("Unknown suffix {0!r}"
2239
.format(suffix))
2240
except (ValueError, IndexError) as e:
2896
2241
raise ValueError(*(e.args))
2897
2242
timevalue += delta
2898
2243
return timevalue
2899
2244
2900
2245
2901
def daemon(nochdir=False, noclose=False):
2246
def daemon(nochdir = False, noclose = False):
2902
2247
"""See daemon(3). Standard BSD Unix function.
2903
2248
2904
2249
This should really exist as os.daemon, but it doesn't (yet)."""
2905
2250
if os.fork():
2906
2251
sys.exit()
2914
2259
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2915
2260
if not stat.S_ISCHR(os.fstat(null).st_mode):
2916
2261
raise OSError(errno.ENODEV,
2917
"{} not a character device"
2262
"{0} not a character device"
2918
2263
.format(os.devnull))
2919
2264
os.dup2(null, sys.stdin.fileno())
2920
2265
os.dup2(null, sys.stdout.fileno())
2924
2269
2925
2270
2926
2271
def main():
2927
2272
2928
2273
##################################################################
2929
2274
# Parsing of options, both command line and config file
2930
2275
2931
2276
parser = argparse.ArgumentParser()
2932
2277
parser.add_argument("-v", "--version", action="version",
2933
version="%(prog)s {}".format(version),
2278
version = "%(prog)s {0}".format(version),
2934
2279
help="show version number and exit")
2935
2280
parser.add_argument("-i", "--interface", metavar="IF",
2936
2281
help="Bind to interface IF")
2942
2287
help="Run self-test")
2943
2288
parser.add_argument("--debug", action="store_true",
2944
2289
help="Debug mode; run in foreground and log"
2945
" to terminal", default=None)
2290
" to terminal")
2946
2291
parser.add_argument("--debuglevel", metavar="LEVEL",
2947
2292
help="Debug level for stdout output")
2948
2293
parser.add_argument("--priority", help="GnuTLS"
2955
2300
" files")
2956
2301
parser.add_argument("--no-dbus", action="store_false",
2957
2302
dest="use_dbus", help="Do not provide D-Bus"
2958
" system bus interface", default=None)
2303
" system bus interface")
2959
2304
parser.add_argument("--no-ipv6", action="store_false",
2960
dest="use_ipv6", help="Do not use IPv6",
2961
default=None)
2305
dest="use_ipv6", help="Do not use IPv6")
2962
2306
parser.add_argument("--no-restore", action="store_false",
2963
2307
dest="restore", help="Do not restore stored"
2964
" state", default=None)
2308
" state")
2965
2309
parser.add_argument("--socket", type=int,
2966
2310
help="Specify a file descriptor to a network"
2967
2311
" socket to use instead of creating one")
2968
2312
parser.add_argument("--statedir", metavar="DIR",
2969
2313
help="Directory to save/restore state in")
2970
2314
parser.add_argument("--foreground", action="store_true",
2971
help="Run in foreground", default=None)
2972
parser.add_argument("--no-zeroconf", action="store_false",
2973
dest="zeroconf", help="Do not use Zeroconf",
2974
default=None)
2975
2315
help="Run in foreground")
2316
2976
2317
options = parser.parse_args()
2977
2318
2978
2319
if options.check:
2979
2320
import doctest
2980
fail_count, test_count = doctest.testmod()
2981
sys.exit(os.EX_OK if fail_count == 0 else 1)
2982
2321
doctest.testmod()
2322
sys.exit()
2323
2983
2324
# Default values for config file for server-global settings
2984
if gnutls.has_rawpk:
2985
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2986
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2987
else:
2988
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2989
":+SIGN-DSA-SHA256")
2990
server_defaults = {"interface": "",
2991
"address": "",
2992
"port": "",
2993
"debug": "False",
2994
"priority": priority,
2995
"servicename": "Mandos",
2996
"use_dbus": "True",
2997
"use_ipv6": "True",
2998
"debuglevel": "",
2999
"restore": "True",
3000
"socket": "",
3001
"statedir": "/var/lib/mandos",
3002
"foreground": "False",
3003
"zeroconf": "True",
3004
}
3005
del priority
3006
2325
server_defaults = { "interface": "",
2326
"address": "",
2327
"port": "",
2328
"debug": "False",
2329
"priority":
2330
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2331
"servicename": "Mandos",
2332
"use_dbus": "True",
2333
"use_ipv6": "True",
2334
"debuglevel": "",
2335
"restore": "True",
2336
"socket": "",
2337
"statedir": "/var/lib/mandos",
2338
"foreground": "False",
2339
}
2340
3007
2341
# Parse config file for server-global settings
3008
server_config = configparser.ConfigParser(server_defaults)
2342
server_config = configparser.SafeConfigParser(server_defaults)
3009
2343
del server_defaults
3010
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3011
# Convert the ConfigParser object to a dict
2344
server_config.read(os.path.join(options.configdir,
2345
"mandos.conf"))
2346
# Convert the SafeConfigParser object to a dict
3012
2347
server_settings = server_config.defaults()
3013
2348
# Use the appropriate methods on the non-string config options
3014
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3015
"foreground", "zeroconf"):
2349
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3016
2350
server_settings[option] = server_config.getboolean("DEFAULT",
3017
2351
option)
3018
2352
if server_settings["port"]:
3028
2362
server_settings["socket"] = os.dup(server_settings
3029
2363
["socket"])
3030
2364
del server_config
3031
2365
3032
2366
# Override the settings from the config file with command line
3033
2367
# options, if set.
3034
2368
for option in ("interface", "address", "port", "debug",
3035
"priority", "servicename", "configdir", "use_dbus",
3036
"use_ipv6", "debuglevel", "restore", "statedir",
3037
"socket", "foreground", "zeroconf"):
2369
"priority", "servicename", "configdir",
2370
"use_dbus", "use_ipv6", "debuglevel", "restore",
2371
"statedir", "socket", "foreground"):
3038
2372
value = getattr(options, option)
3039
2373
if value is not None:
3040
2374
server_settings[option] = value
3041
2375
del options
3042
2376
# Force all strings to be unicode
3043
2377
for option in server_settings.keys():
3044
if isinstance(server_settings[option], bytes):
3045
server_settings[option] = (server_settings[option]
3046
.decode("utf-8"))
3047
# Force all boolean options to be boolean
3048
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3049
"foreground", "zeroconf"):
3050
server_settings[option] = bool(server_settings[option])
2378
if type(server_settings[option]) is str:
2379
server_settings[option] = unicode(server_settings[option])
3051
2380
# Debug implies foreground
3052
2381
if server_settings["debug"]:
3053
2382
server_settings["foreground"] = True
3054
2383
# Now we have our good server settings in "server_settings"
3055
2384
3056
2385
##################################################################
3057
3058
if (not server_settings["zeroconf"]
3059
and not (server_settings["port"]
3060
or server_settings["socket"] != "")):
3061
parser.error("Needs port or socket to work without Zeroconf")
3062
2386
3063
2387
# For convenience
3064
2388
debug = server_settings["debug"]
3065
2389
debuglevel = server_settings["debuglevel"]
3068
2392
stored_state_path = os.path.join(server_settings["statedir"],
3069
2393
stored_state_file)
3070
2394
foreground = server_settings["foreground"]
3071
zeroconf = server_settings["zeroconf"]
3072
2395
3073
2396
if debug:
3074
2397
initlogger(debug, logging.DEBUG)
3075
2398
else:
3078
2401
else:
3079
2402
level = getattr(logging, debuglevel.upper())
3080
2403
initlogger(debug, level)
3081
2404
3082
2405
if server_settings["servicename"] != "Mandos":
3083
syslogger.setFormatter(
3084
logging.Formatter('Mandos ({}) [%(process)d]:'
3085
' %(levelname)s: %(message)s'.format(
3086
server_settings["servicename"])))
3087
2406
syslogger.setFormatter(logging.Formatter
2407
('Mandos ({0}) [%(process)d]:'
2408
' %(levelname)s: %(message)s'
2409
.format(server_settings
2410
["servicename"])))
2411
3088
2412
# Parse config file with clients
3089
client_config = configparser.ConfigParser(Client.client_defaults)
2413
client_config = configparser.SafeConfigParser(Client
2414
.client_defaults)
3090
2415
client_config.read(os.path.join(server_settings["configdir"],
3091
2416
"clients.conf"))
3092
2417
3093
2418
global mandos_dbus_service
3094
2419
mandos_dbus_service = None
3095
3096
socketfd = None
3097
if server_settings["socket"] != "":
3098
socketfd = server_settings["socket"]
3099
tcp_server = MandosServer(
3100
(server_settings["address"], server_settings["port"]),
3101
ClientHandler,
3102
interface=(server_settings["interface"] or None),
3103
use_ipv6=use_ipv6,
3104
gnutls_priority=server_settings["priority"],
3105
use_dbus=use_dbus,
3106
socketfd=socketfd)
2420
2421
tcp_server = MandosServer((server_settings["address"],
2422
server_settings["port"]),
2423
ClientHandler,
2424
interface=(server_settings["interface"]
2425
or None),
2426
use_ipv6=use_ipv6,
2427
gnutls_priority=
2428
server_settings["priority"],
2429
use_dbus=use_dbus,
2430
socketfd=(server_settings["socket"]
2431
or None))
3107
2432
if not foreground:
3108
pidfilename = "/run/mandos.pid"
3109
if not os.path.isdir("/run/."):
3110
pidfilename = "/var/run/mandos.pid"
2433
pidfilename = "/var/run/mandos.pid"
3111
2434
pidfile = None
3112
2435
try:
3113
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2436
pidfile = open(pidfilename, "w")
3114
2437
except IOError as e:
3115
2438
logger.error("Could not open file %r", pidfilename,
3116
2439
exc_info=e)
3117
3118
for name, group in (("_mandos", "_mandos"),
3119
("mandos", "mandos"),
3120
("nobody", "nogroup")):
2440
2441
for name in ("_mandos", "mandos", "nobody"):
3121
2442
try:
3122
2443
uid = pwd.getpwnam(name).pw_uid
3123
gid = pwd.getpwnam(group).pw_gid
2444
gid = pwd.getpwnam(name).pw_gid
3124
2445
break
3125
2446
except KeyError:
3126
2447
continue
3130
2451
try:
3131
2452
os.setgid(gid)
3132
2453
os.setuid(uid)
3133
if debug:
3134
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3135
gid))
3136
2454
except OSError as error:
3137
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3138
.format(uid, gid, os.strerror(error.errno)))
3139
2455
if error.errno != errno.EPERM:
3140
raise
3141
2456
raise error
2457
3142
2458
if debug:
3143
2459
# Enable all possible GnuTLS debugging
3144
2460
3145
2461
# "Use a log level over 10 to enable all debugging options."
3146
2462
# - GnuTLS manual
3147
gnutls.global_set_log_level(11)
3148
3149
@gnutls.log_func
2463
gnutls.library.functions.gnutls_global_set_log_level(11)
2464
2465
@gnutls.library.types.gnutls_log_func
3150
2466
def debug_gnutls(level, string):
3151
2467
logger.debug("GnuTLS: %s", string[:-1])
3152
3153
gnutls.global_set_log_function(debug_gnutls)
3154
2468
2469
(gnutls.library.functions
2470
.gnutls_global_set_log_function(debug_gnutls))
2471
3155
2472
# Redirect stdin so all checkers get /dev/null
3156
2473
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3157
2474
os.dup2(null, sys.stdin.fileno())
3158
2475
if null > 2:
3159
2476
os.close(null)
3160
2477
3161
2478
# Need to fork before connecting to D-Bus
3162
2479
if not foreground:
3163
2480
# Close all input and output, do double fork, etc.
3164
2481
daemon()
3165
3166
if gi.version_info < (3, 10, 2):
3167
# multiprocessing will use threads, so before we use GLib we
3168
# need to inform GLib that threads will be used.
3169
GLib.threads_init()
3170
2482
2483
# multiprocessing will use threads, so before we use gobject we
2484
# need to inform gobject that threads will be used.
2485
gobject.threads_init()
2486
3171
2487
global main_loop
3172
2488
# From the Avahi example code
3173
2489
DBusGMainLoop(set_as_default=True)
3174
main_loop = GLib.MainLoop()
2490
main_loop = gobject.MainLoop()
3175
2491
bus = dbus.SystemBus()
3176
2492
# End of Avahi example code
3177
2493
if use_dbus:
3178
2494
try:
3179
2495
bus_name = dbus.service.BusName("se.recompile.Mandos",
3180
bus,
3181
do_not_queue=True)
3182
old_bus_name = dbus.service.BusName(
3183
"se.bsnet.fukt.Mandos", bus,
3184
do_not_queue=True)
3185
except dbus.exceptions.DBusException as e:
2496
bus, do_not_queue=True)
2497
old_bus_name = (dbus.service.BusName
2498
("se.bsnet.fukt.Mandos", bus,
2499
do_not_queue=True))
2500
except dbus.exceptions.NameExistsException as e:
3186
2501
logger.error("Disabling D-Bus:", exc_info=e)
3187
2502
use_dbus = False
3188
2503
server_settings["use_dbus"] = False
3189
2504
tcp_server.use_dbus = False
3190
if zeroconf:
3191
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3192
service = AvahiServiceToSyslog(
3193
name=server_settings["servicename"],
3194
servicetype="_mandos._tcp",
3195
protocol=protocol,
3196
bus=bus)
3197
if server_settings["interface"]:
3198
service.interface = if_nametoindex(
3199
server_settings["interface"].encode("utf-8"))
3200
2505
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2506
service = AvahiServiceToSyslog(name =
2507
server_settings["servicename"],
2508
servicetype = "_mandos._tcp",
2509
protocol = protocol, bus = bus)
2510
if server_settings["interface"]:
2511
service.interface = (if_nametoindex
2512
(str(server_settings["interface"])))
2513
3201
2514
global multiprocessing_manager
3202
2515
multiprocessing_manager = multiprocessing.Manager()
3203
2516
3204
2517
client_class = Client
3205
2518
if use_dbus:
3206
client_class = functools.partial(ClientDBus, bus=bus)
3207
2519
client_class = functools.partial(ClientDBus, bus = bus)
2520
3208
2521
client_settings = Client.config_parser(client_config)
3209
2522
old_client_settings = {}
3210
2523
clients_data = {}
3211
3212
# This is used to redirect stdout and stderr for checker processes
3213
global wnull
3214
wnull = open(os.devnull, "w") # A writable /dev/null
3215
# Only used if server is running in foreground but not in debug
3216
# mode
3217
if debug or not foreground:
3218
wnull.close()
3219
2524
3220
2525
# Get client data and settings from last running state.
3221
2526
if server_settings["restore"]:
3222
2527
try:
3223
2528
with open(stored_state_path, "rb") as stored_state:
3224
if sys.version_info.major == 2:
3225
clients_data, old_client_settings = pickle.load(
3226
stored_state)
3227
else:
3228
bytes_clients_data, bytes_old_client_settings = (
3229
pickle.load(stored_state, encoding="bytes"))
3230
# Fix bytes to strings
3231
# clients_data
3232
# .keys()
3233
clients_data = {(key.decode("utf-8")
3234
if isinstance(key, bytes)
3235
else key): value
3236
for key, value in
3237
bytes_clients_data.items()}
3238
del bytes_clients_data
3239
for key in clients_data:
3240
value = {(k.decode("utf-8")
3241
if isinstance(k, bytes) else k): v
3242
for k, v in
3243
clients_data[key].items()}
3244
clients_data[key] = value
3245
# .client_structure
3246
value["client_structure"] = [
3247
(s.decode("utf-8")
3248
if isinstance(s, bytes)
3249
else s) for s in
3250
value["client_structure"]]
3251
# .name & .host
3252
for k in ("name", "host"):
3253
if isinstance(value[k], bytes):
3254
value[k] = value[k].decode("utf-8")
3255
if "key_id" not in value:
3256
value["key_id"] = ""
3257
elif "fingerprint" not in value:
3258
value["fingerprint"] = ""
3259
# old_client_settings
3260
# .keys()
3261
old_client_settings = {
3262
(key.decode("utf-8")
3263
if isinstance(key, bytes)
3264
else key): value
3265
for key, value in
3266
bytes_old_client_settings.items()}
3267
del bytes_old_client_settings
3268
# .host
3269
for value in old_client_settings.values():
3270
if isinstance(value["host"], bytes):
3271
value["host"] = (value["host"]
3272
.decode("utf-8"))
2529
clients_data, old_client_settings = (pickle.load
2530
(stored_state))
3273
2531
os.remove(stored_state_path)
3274
2532
except IOError as e:
3275
2533
if e.errno == errno.ENOENT:
3276
logger.warning("Could not load persistent state:"
3277
" {}".format(os.strerror(e.errno)))
2534
logger.warning("Could not load persistent state: {0}"
2535
.format(os.strerror(e.errno)))
3278
2536
else:
3279
2537
logger.critical("Could not load persistent state:",
3280
2538
exc_info=e)
3281
2539
raise
3282
2540
except EOFError as e:
3283
2541
logger.warning("Could not load persistent state: "
3284
"EOFError:",
3285
exc_info=e)
3286
2542
"EOFError:", exc_info=e)
2543
3287
2544
with PGPEngine() as pgp:
3288
for client_name, client in clients_data.items():
3289
# Skip removed clients
3290
if client_name not in client_settings:
3291
continue
3292
2545
for client_name, client in clients_data.iteritems():
3293
2546
# Decide which value to use after restoring saved state.
3294
2547
# We have three different values: Old config file,
3295
2548
# new config file, and saved state.
3300
2553
# For each value in new config, check if it
3301
2554
# differs from the old config value (Except for
3302
2555
# the "secret" attribute)
3303
if (name != "secret"
3304
and (value !=
3305
old_client_settings[client_name][name])):
2556
if (name != "secret" and
2557
value != old_client_settings[client_name]
2558
[name]):
3306
2559
client[name] = value
3307
2560
except KeyError:
3308
2561
pass
3309
2562
3310
2563
# Clients who has passed its expire date can still be
3311
# enabled if its last checker was successful. A Client
2564
# enabled if its last checker was successful. Clients
3312
2565
# whose checker succeeded before we stored its state is
3313
2566
# assumed to have successfully run all checkers during
3314
2567
# downtime.
3316
2569
if datetime.datetime.utcnow() >= client["expires"]:
3317
2570
if not client["last_checked_ok"]:
3318
2571
logger.warning(
3319
"disabling client {} - Client never "
3320
"performed a successful checker".format(
3321
client_name))
2572
"disabling client {0} - Client never "
2573
"performed a successful checker"
2574
.format(client_name))
3322
2575
client["enabled"] = False
3323
2576
elif client["last_checker_status"] != 0:
3324
2577
logger.warning(
3325
"disabling client {} - Client last"
3326
" checker failed with error code"
3327
" {}".format(
3328
client_name,
3329
client["last_checker_status"]))
2578
"disabling client {0} - Client "
2579
"last checker failed with error code {1}"
2580
.format(client_name,
2581
client["last_checker_status"]))
3330
2582
client["enabled"] = False
3331
2583
else:
3332
client["expires"] = (
3333
datetime.datetime.utcnow()
3334
+ client["timeout"])
2584
client["expires"] = (datetime.datetime
2585
.utcnow()
2586
+ client["timeout"])
3335
2587
logger.debug("Last checker succeeded,"
3336
" keeping {} enabled".format(
3337
client_name))
2588
" keeping {0} enabled"
2589
.format(client_name))
3338
2590
try:
3339
client["secret"] = pgp.decrypt(
3340
client["encrypted_secret"],
3341
client_settings[client_name]["secret"])
2591
client["secret"] = (
2592
pgp.decrypt(client["encrypted_secret"],
2593
client_settings[client_name]
2594
["secret"]))
3342
2595
except PGPError:
3343
2596
# If decryption fails, we use secret from new settings
3344
logger.debug("Failed to decrypt {} old secret".format(
3345
client_name))
3346
client["secret"] = (client_settings[client_name]
3347
["secret"])
3348
2597
logger.debug("Failed to decrypt {0} old secret"
2598
.format(client_name))
2599
client["secret"] = (
2600
client_settings[client_name]["secret"])
2601
3349
2602
# Add/remove clients based on new changes made to config
3350
2603
for client_name in (set(old_client_settings)
3351
2604
- set(client_settings)):
3353
2606
for client_name in (set(client_settings)
3354
2607
- set(old_client_settings)):
3355
2608
clients_data[client_name] = client_settings[client_name]
3356
2609
3357
2610
# Create all client objects
3358
for client_name, client in clients_data.items():
2611
for client_name, client in clients_data.iteritems():
3359
2612
tcp_server.clients[client_name] = client_class(
3360
name=client_name,
3361
settings=client,
3362
server_settings=server_settings)
3363
2613
name = client_name, settings = client)
2614
3364
2615
if not tcp_server.clients:
3365
2616
logger.warning("No clients defined")
3366
2617
3367
2618
if not foreground:
3368
2619
if pidfile is not None:
3369
pid = os.getpid()
3370
2620
try:
3371
2621
with pidfile:
3372
print(pid, file=pidfile)
2622
pid = os.getpid()
2623
pidfile.write(str(pid) + "\n".encode("utf-8"))
3373
2624
except IOError:
3374
2625
logger.error("Could not write to file %r with PID %d",
3375
2626
pidfilename, pid)
3376
2627
del pidfile
3377
2628
del pidfilename
3378
3379
for termsig in (signal.SIGHUP, signal.SIGTERM):
3380
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3381
lambda: main_loop.quit() and False)
3382
2629
2630
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2631
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2632
3383
2633
if use_dbus:
3384
3385
@alternate_dbus_interfaces(
3386
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3387
class MandosDBusService(DBusObjectWithObjectManager):
2634
@alternate_dbus_interfaces({"se.recompile.Mandos":
2635
"se.bsnet.fukt.Mandos"})
2636
class MandosDBusService(DBusObjectWithProperties):
3388
2637
"""A D-Bus proxy object"""
3389
3390
2638
def __init__(self):
3391
2639
dbus.service.Object.__init__(self, bus, "/")
3392
3393
2640
_interface = "se.recompile.Mandos"
3394
2641
2642
@dbus_interface_annotations(_interface)
2643
def _foo(self):
2644
return { "org.freedesktop.DBus.Property"
2645
".EmitsChangedSignal":
2646
"false"}
2647
3395
2648
@dbus.service.signal(_interface, signature="o")
3396
2649
def ClientAdded(self, objpath):
3397
2650
"D-Bus signal"
3398
2651
pass
3399
2652
3400
2653
@dbus.service.signal(_interface, signature="ss")
3401
def ClientNotFound(self, key_id, address):
2654
def ClientNotFound(self, fingerprint, address):
3402
2655
"D-Bus signal"
3403
2656
pass
3404
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3406
"true"})
2657
3407
2658
@dbus.service.signal(_interface, signature="os")
3408
2659
def ClientRemoved(self, objpath, name):
3409
2660
"D-Bus signal"
3410
2661
pass
3411
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3413
"true"})
2662
3414
2663
@dbus.service.method(_interface, out_signature="ao")
3415
2664
def GetAllClients(self):
3416
2665
"D-Bus method"
3417
return dbus.Array(c.dbus_object_path for c in
3418
tcp_server.clients.values())
3419
3420
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3421
"true"})
2666
return dbus.Array(c.dbus_object_path
2667
for c in
2668
tcp_server.clients.itervalues())
2669
3422
2670
@dbus.service.method(_interface,
3423
2671
out_signature="a{oa{sv}}")
3424
2672
def GetAllClientsWithProperties(self):
3425
2673
"D-Bus method"
3426
2674
return dbus.Dictionary(
3427
{c.dbus_object_path: c.GetAll(
3428
"se.recompile.Mandos.Client")
3429
for c in tcp_server.clients.values()},
2675
((c.dbus_object_path, c.GetAll(""))
2676
for c in tcp_server.clients.itervalues()),
3430
2677
signature="oa{sv}")
3431
2678
3432
2679
@dbus.service.method(_interface, in_signature="o")
3433
2680
def RemoveClient(self, object_path):
3434
2681
"D-Bus method"
3435
for c in tcp_server.clients.values():
2682
for c in tcp_server.clients.itervalues():
3436
2683
if c.dbus_object_path == object_path:
3437
2684
del tcp_server.clients[c.name]
3438
2685
c.remove_from_connection()
3439
# Don't signal the disabling
2686
# Don't signal anything except ClientRemoved
3440
2687
c.disable(quiet=True)
3441
# Emit D-Bus signal for removal
3442
self.client_removed_signal(c)
2688
# Emit D-Bus signal
2689
self.ClientRemoved(object_path, c.name)
3443
2690
return
3444
2691
raise KeyError(object_path)
3445
2692
3446
2693
del _interface
3447
3448
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3449
out_signature="a{oa{sa{sv}}}")
3450
def GetManagedObjects(self):
3451
"""D-Bus method"""
3452
return dbus.Dictionary(
3453
{client.dbus_object_path:
3454
dbus.Dictionary(
3455
{interface: client.GetAll(interface)
3456
for interface in
3457
client._get_all_interface_names()})
3458
for client in tcp_server.clients.values()})
3459
3460
def client_added_signal(self, client):
3461
"""Send the new standard signal and the old signal"""
3462
if use_dbus:
3463
# New standard signal
3464
self.InterfacesAdded(
3465
client.dbus_object_path,
3466
dbus.Dictionary(
3467
{interface: client.GetAll(interface)
3468
for interface in
3469
client._get_all_interface_names()}))
3470
# Old signal
3471
self.ClientAdded(client.dbus_object_path)
3472
3473
def client_removed_signal(self, client):
3474
"""Send the new standard signal and the old signal"""
3475
if use_dbus:
3476
# New standard signal
3477
self.InterfacesRemoved(
3478
client.dbus_object_path,
3479
client._get_all_interface_names())
3480
# Old signal
3481
self.ClientRemoved(client.dbus_object_path,
3482
client.name)
3483
2694
3484
2695
mandos_dbus_service = MandosDBusService()
3485
3486
# Save modules to variables to exempt the modules from being
3487
# unloaded before the function registered with atexit() is run.
3488
mp = multiprocessing
3489
wn = wnull
3490
2696
3491
2697
def cleanup():
3492
2698
"Cleanup function; run on exit"
3493
if zeroconf:
3494
service.cleanup()
3495
3496
mp.active_children()
3497
wn.close()
2699
service.cleanup()
2700
2701
multiprocessing.active_children()
3498
2702
if not (tcp_server.clients or client_settings):
3499
2703
return
3500
2704
3501
2705
# Store client before exiting. Secrets are encrypted with key
3502
2706
# based on what config file has. If config file is
3503
2707
# removed/edited, old secret will thus be unrecovable.
3504
2708
clients = {}
3505
2709
with PGPEngine() as pgp:
3506
for client in tcp_server.clients.values():
2710
for client in tcp_server.clients.itervalues():
3507
2711
key = client_settings[client.name]["secret"]
3508
2712
client.encrypted_secret = pgp.encrypt(client.secret,
3509
2713
key)
3510
2714
client_dict = {}
3511
2715
3512
2716
# A list of attributes that can not be pickled
3513
2717
# + secret.
3514
exclude = {"bus", "changedstate", "secret",
3515
"checker", "server_settings"}
3516
for name, typ in inspect.getmembers(dbus.service
3517
.Object):
2718
exclude = set(("bus", "changedstate", "secret",
2719
"checker"))
2720
for name, typ in (inspect.getmembers
2721
(dbus.service.Object)):
3518
2722
exclude.add(name)
3519
2723
3520
2724
client_dict["encrypted_secret"] = (client
3521
2725
.encrypted_secret)
3522
2726
for attr in client.client_structure:
3523
2727
if attr not in exclude:
3524
2728
client_dict[attr] = getattr(client, attr)
3525
2729
3526
2730
clients[client.name] = client_dict
3527
2731
del client_settings[client.name]["secret"]
3528
2732
3529
2733
try:
3530
with tempfile.NamedTemporaryFile(
3531
mode='wb',
3532
suffix=".pickle",
3533
prefix='clients-',
3534
dir=os.path.dirname(stored_state_path),
3535
delete=False) as stored_state:
3536
pickle.dump((clients, client_settings), stored_state,
3537
protocol=2)
3538
tempname = stored_state.name
2734
with (tempfile.NamedTemporaryFile
2735
(mode='wb', suffix=".pickle", prefix='clients-',
2736
dir=os.path.dirname(stored_state_path),
2737
delete=False)) as stored_state:
2738
pickle.dump((clients, client_settings), stored_state)
2739
tempname=stored_state.name
3539
2740
os.rename(tempname, stored_state_path)
3540
2741
except (IOError, OSError) as e:
3541
2742
if not debug:
3544
2745
except NameError:
3545
2746
pass
3546
2747
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3547
logger.warning("Could not save persistent state: {}"
2748
logger.warning("Could not save persistent state: {0}"
3548
2749
.format(os.strerror(e.errno)))
3549
2750
else:
3550
2751
logger.warning("Could not save persistent state:",
3551
2752
exc_info=e)
3552
raise
3553
2753
raise e
2754
3554
2755
# Delete all clients, and settings from config
3555
2756
while tcp_server.clients:
3556
2757
name, client = tcp_server.clients.popitem()
3557
2758
if use_dbus:
3558
2759
client.remove_from_connection()
3559
# Don't signal the disabling
2760
# Don't signal anything except ClientRemoved
3560
2761
client.disable(quiet=True)
3561
# Emit D-Bus signal for removal
3562
2762
if use_dbus:
3563
mandos_dbus_service.client_removed_signal(client)
2763
# Emit D-Bus signal
2764
mandos_dbus_service.ClientRemoved(client
2765
.dbus_object_path,
2766
client.name)
3564
2767
client_settings.clear()
3565
2768
3566
2769
atexit.register(cleanup)
3567
3568
for client in tcp_server.clients.values():
2770
2771
for client in tcp_server.clients.itervalues():
3569
2772
if use_dbus:
3570
# Emit D-Bus signal for adding
3571
mandos_dbus_service.client_added_signal(client)
2773
# Emit D-Bus signal
2774
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3572
2775
# Need to initiate checking of clients
3573
2776
if client.enabled:
3574
2777
client.init_checker()
3575
2778
3576
2779
tcp_server.enable()
3577
2780
tcp_server.server_activate()
3578
2781
3579
2782
# Find out what port we got
3580
if zeroconf:
3581
service.port = tcp_server.socket.getsockname()[1]
2783
service.port = tcp_server.socket.getsockname()[1]
3582
2784
if use_ipv6:
3583
2785
logger.info("Now listening on address %r, port %d,"
3584
2786
" flowinfo %d, scope_id %d",
3586
2788
else: # IPv4
3587
2789
logger.info("Now listening on address %r, port %d",
3588
2790
*tcp_server.socket.getsockname())
3589
3590
# service.interface = tcp_server.socket.getsockname()[3]
3591
2791
2792
#service.interface = tcp_server.socket.getsockname()[3]
2793
3592
2794
try:
3593
if zeroconf:
3594
# From the Avahi example code
3595
try:
3596
service.activate()
3597
except dbus.exceptions.DBusException as error:
3598
logger.critical("D-Bus Exception", exc_info=error)
3599
cleanup()
3600
sys.exit(1)
3601
# End of Avahi example code
3602
3603
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3604
lambda *args, **kwargs:
3605
(tcp_server.handle_request
3606
(*args[2:], **kwargs) or True))
3607
2795
# From the Avahi example code
2796
try:
2797
service.activate()
2798
except dbus.exceptions.DBusException as error:
2799
logger.critical("D-Bus Exception", exc_info=error)
2800
cleanup()
2801
sys.exit(1)
2802
# End of Avahi example code
2803
2804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2805
lambda *args, **kwargs:
2806
(tcp_server.handle_request
2807
(*args[2:], **kwargs) or True))
2808
3608
2809
logger.debug("Starting main loop")
3609
2810
main_loop.run()
3610
2811
except AvahiError as error:
3619
2820
# Must run before the D-Bus bus name gets deregistered
3620
2821
cleanup()
3621
2822
3622
3623
2823
if __name__ == '__main__':
3624
2824
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0