To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 610
- compare with another revision
- download diff
- download tarball
- view history from revision 610
- Committer: Teddy Hogeborn
- Date: 2012-06-23 13:50:05 UTC
- Revision ID: teddy@recompile.se-20120623135005-t0wtkmlw0ymnr2kg
* mandos (Client.start_checker): Return True (retry later) if starting
checker failed. Check for ECHILD
from waitpid().
checker failed. Check for ECHILD
from waitpid().
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/upstream
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
try:
44
import SocketServer as socketserver
45
except ImportError:
46
import socketserver
39
import SocketServer as socketserver
47
40
import socket
48
41
import argparse
49
42
import datetime
50
43
import errno
51
try:
52
import ConfigParser as configparser
53
except ImportError:
54
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
55
51
import sys
56
52
import re
57
53
import os
66
62
import struct
67
63
import fcntl
68
64
import functools
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
65
import cPickle as pickle
73
66
import multiprocessing
74
67
import types
75
68
import binascii
76
69
import tempfile
77
70
import itertools
78
71
import collections
79
import codecs
80
72
81
73
import dbus
82
74
import dbus.service
83
from gi.repository import GLib
75
import gobject
76
import avahi
84
77
from dbus.mainloop.glib import DBusGMainLoop
85
78
import ctypes
86
79
import ctypes.util
87
80
import xml.dom.minidom
88
81
import inspect
82
import GnuPGInterface
89
83
90
# Try to find the value of SO_BINDTODEVICE:
91
84
try:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
94
85
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
86
except AttributeError:
96
87
try:
97
# This is where SO_BINDTODEVICE was up to and including Python
98
# 2.6, and also 3.2:
99
88
from IN import SO_BINDTODEVICE
100
89
except ImportError:
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
103
try:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
"/dev/stdin"],
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
112
# No value found
113
SO_BINDTODEVICE = None
114
115
if sys.version_info.major == 2:
116
str = unicode
117
118
version = "1.8.3"
90
SO_BINDTODEVICE = None
91
92
version = "1.6.0"
119
93
stored_state_file = "clients.pickle"
120
94
121
95
logger = logging.getLogger()
122
syslogger = None
96
syslogger = (logging.handlers.SysLogHandler
97
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
98
address = str("/dev/log")))
123
99
124
100
try:
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
127
104
except (OSError, AttributeError):
128
129
105
def if_nametoindex(interface):
130
106
"Get an interface index the hard way, i.e. using fcntl()"
131
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
132
108
with contextlib.closing(socket.socket()) as s:
133
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
110
struct.pack(str("16s16x"),
111
interface))
112
interface_index = struct.unpack(str("I"),
113
ifreq[16:20])[0]
136
114
return interface_index
137
115
138
116
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
143
func.func_globals,
144
func.func_name,
145
func.func_defaults,
146
func.func_closure)
147
else:
148
return types.FunctionType(func.__code__,
149
func.__globals__,
150
func.__name__,
151
func.__defaults__,
152
func.__closure__)
153
154
155
117
def initlogger(debug, level=logging.WARNING):
156
118
"""init logger and add loglevel"""
157
158
global syslogger
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
address="/dev/log"))
119
162
120
syslogger.setFormatter(logging.Formatter
163
121
('Mandos [%(process)d]: %(levelname)s:'
164
122
' %(message)s'))
165
123
logger.addHandler(syslogger)
166
124
167
125
if debug:
168
126
console = logging.StreamHandler()
169
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
181
139
182
140
class PGPEngine(object):
183
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
184
185
142
def __init__(self):
143
self.gnupg = GnuPGInterface.GnuPG()
186
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
187
self.gpg = "gpg"
188
try:
189
output = subprocess.check_output(["gpgconf"])
190
for line in output.splitlines():
191
name, text, path = line.split(b":")
192
if name == "gpg":
193
self.gpg = path
194
break
195
except OSError as e:
196
if e.errno != errno.ENOENT:
197
raise
198
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
200
'--force-mdc',
201
'--quiet']
202
# Only GPG version 1 has the --no-use-agent option.
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
self.gnupgargs.append("--no-use-agent")
205
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
149
'--quiet',
150
'--no-use-agent'])
151
206
152
def __enter__(self):
207
153
return self
208
154
209
155
def __exit__(self, exc_type, exc_value, traceback):
210
156
self._cleanup()
211
157
return False
212
158
213
159
def __del__(self):
214
160
self._cleanup()
215
161
216
162
def _cleanup(self):
217
163
if self.tempdir is not None:
218
164
# Delete contents of tempdir
219
165
for root, dirs, files in os.walk(self.tempdir,
220
topdown=False):
166
topdown = False):
221
167
for filename in files:
222
168
os.remove(os.path.join(root, filename))
223
169
for dirname in dirs:
225
171
# Remove tempdir
226
172
os.rmdir(self.tempdir)
227
173
self.tempdir = None
228
174
229
175
def password_encode(self, password):
230
176
# Passphrase can not be empty and can not contain newlines or
231
177
# NUL bytes. So we prefix it and hex encode it.
232
encoded = b"mandos" + binascii.hexlify(password)
233
if len(encoded) > 2048:
234
# GnuPG can't handle long passwords, so encode differently
235
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
236
.replace(b"\n", b"\\n")
237
.replace(b"\0", b"\\x00"))
238
return encoded
239
178
return b"mandos" + binascii.hexlify(password)
179
240
180
def encrypt(self, data, password):
241
passphrase = self.password_encode(password)
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
244
passfile.write(passphrase)
245
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--symmetric',
247
'--passphrase-file',
248
passfile.name]
249
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
254
if proc.returncode != 0:
255
raise PGPError(err)
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
183
try:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
188
f.write(data)
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
191
proc.wait()
192
except IOError as e:
193
raise PGPError(e)
194
self.gnupg.passphrase = None
256
195
return ciphertext
257
196
258
197
def decrypt(self, data, password):
259
passphrase = self.password_encode(password)
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
262
passfile.write(passphrase)
263
passfile.flush()
264
proc = subprocess.Popen([self.gpg, '--decrypt',
265
'--passphrase-file',
266
passfile.name]
267
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
272
if proc.returncode != 0:
273
raise PGPError(err)
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
200
try:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
205
f.write(data)
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
208
proc.wait()
209
except IOError as e:
210
raise PGPError(e)
211
self.gnupg.passphrase = None
274
212
return decrypted_plaintext
275
213
276
214
277
# Pretend that we have an Avahi module
278
class avahi(object):
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
288
289
@staticmethod
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
302
303
215
class AvahiError(Exception):
304
216
def __init__(self, value, *args, **kwargs):
305
217
self.value = value
306
return super(AvahiError, self).__init__(value, *args,
307
**kwargs)
308
218
super(AvahiError, self).__init__(value, *args, **kwargs)
219
def __unicode__(self):
220
return unicode(repr(self.value))
309
221
310
222
class AvahiServiceError(AvahiError):
311
223
pass
312
224
313
314
225
class AvahiGroupError(AvahiError):
315
226
pass
316
227
317
228
318
229
class AvahiService(object):
319
230
"""An Avahi (Zeroconf) service.
320
231
321
232
Attributes:
322
233
interface: integer; avahi.IF_UNSPEC or an interface index.
323
234
Used to optionally bind to the specified interface.
324
235
name: string; Example: 'Mandos'
325
236
type: string; Example: '_mandos._tcp'.
326
See <https://www.iana.org/assignments/service-names-port-numbers>
237
See <http://www.dns-sd.org/ServiceTypes.html>
327
238
port: integer; what port to announce
328
239
TXT: list of strings; TXT record for the service
329
240
domain: string; Domain to publish on, default to .local if empty.
335
246
server: D-Bus Server
336
247
bus: dbus.SystemBus()
337
248
"""
338
339
def __init__(self,
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
249
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
253
protocol = avahi.PROTO_UNSPEC, bus = None):
350
254
self.interface = interface
351
255
self.name = name
352
256
self.type = servicetype
361
265
self.server = None
362
266
self.bus = bus
363
267
self.entry_group_state_changed_match = None
364
365
def rename(self, remove=True):
268
269
def rename(self):
366
270
"""Derived from the Avahi example code"""
367
271
if self.rename_count >= self.max_renames:
368
272
logger.critical("No suitable Zeroconf service name found"
369
273
" after %i retries, exiting.",
370
274
self.rename_count)
371
275
raise AvahiServiceError("Too many renames")
372
self.name = str(
373
self.server.GetAlternativeServiceName(self.name))
374
self.rename_count += 1
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
375
278
logger.info("Changing Zeroconf service name to %r ...",
376
279
self.name)
377
if remove:
378
self.remove()
280
self.remove()
379
281
try:
380
282
self.add()
381
283
except dbus.exceptions.DBusException as error:
382
if (error.get_dbus_name()
383
== "org.freedesktop.Avahi.CollisionError"):
384
logger.info("Local Zeroconf service name collision.")
385
return self.rename(remove=False)
386
else:
387
logger.critical("D-Bus Exception", exc_info=error)
388
self.cleanup()
389
os._exit(1)
390
284
logger.critical("D-Bus Exception", exc_info=error)
285
self.cleanup()
286
os._exit(1)
287
self.rename_count += 1
288
391
289
def remove(self):
392
290
"""Derived from the Avahi example code"""
393
291
if self.entry_group_state_changed_match is not None:
395
293
self.entry_group_state_changed_match = None
396
294
if self.group is not None:
397
295
self.group.Reset()
398
296
399
297
def add(self):
400
298
"""Derived from the Avahi example code"""
401
299
self.remove()
418
316
dbus.UInt16(self.port),
419
317
avahi.string_array_to_txt_array(self.TXT))
420
318
self.group.Commit()
421
319
422
320
def entry_group_state_changed(self, state, error):
423
321
"""Derived from the Avahi example code"""
424
322
logger.debug("Avahi entry group state change: %i", state)
425
323
426
324
if state == avahi.ENTRY_GROUP_ESTABLISHED:
427
325
logger.debug("Zeroconf service established.")
428
326
elif state == avahi.ENTRY_GROUP_COLLISION:
430
328
self.rename()
431
329
elif state == avahi.ENTRY_GROUP_FAILURE:
432
330
logger.critical("Avahi: Error in group state changed %s",
433
str(error))
434
raise AvahiGroupError("State changed: {!s}".format(error))
435
331
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
334
436
335
def cleanup(self):
437
336
"""Derived from the Avahi example code"""
438
337
if self.group is not None:
443
342
pass
444
343
self.group = None
445
344
self.remove()
446
345
447
346
def server_state_changed(self, state, error=None):
448
347
"""Derived from the Avahi example code"""
449
348
logger.debug("Avahi server state change: %i", state)
450
bad_states = {
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
452
avahi.SERVER_REGISTERING: None,
453
avahi.SERVER_COLLISION: "Zeroconf server name collision",
454
avahi.SERVER_FAILURE: "Zeroconf server failure",
455
}
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
456
356
if state in bad_states:
457
357
if bad_states[state] is not None:
458
358
if error is None:
461
361
logger.error(bad_states[state] + ": %r", error)
462
362
self.cleanup()
463
363
elif state == avahi.SERVER_RUNNING:
464
try:
465
self.add()
466
except dbus.exceptions.DBusException as error:
467
if (error.get_dbus_name()
468
== "org.freedesktop.Avahi.CollisionError"):
469
logger.info("Local Zeroconf service name"
470
" collision.")
471
return self.rename(remove=False)
472
else:
473
logger.critical("D-Bus Exception", exc_info=error)
474
self.cleanup()
475
os._exit(1)
364
self.add()
476
365
else:
477
366
if error is None:
478
367
logger.debug("Unknown state: %r", state)
479
368
else:
480
369
logger.debug("Unknown state: %r: %r", state, error)
481
370
482
371
def activate(self):
483
372
"""Derived from the Avahi example code"""
484
373
if self.server is None:
488
377
follow_name_owner_changes=True),
489
378
avahi.DBUS_INTERFACE_SERVER)
490
379
self.server.connect_to_signal("StateChanged",
491
self.server_state_changed)
380
self.server_state_changed)
492
381
self.server_state_changed(self.server.GetState())
493
382
494
383
495
384
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
385
def rename(self):
497
386
"""Add the new name to the syslog messages"""
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
.format(self.name)))
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
502
392
return ret
503
393
504
394
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
508
509
library = ctypes.util.find_library("gnutls")
510
if library is None:
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
513
del library
514
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
517
518
# Constants
519
E_SUCCESS = 0
520
E_INTERRUPTED = -52
521
E_AGAIN = -28
522
CRT_OPENPGP = 2
523
CRT_RAWPK = 3
524
CLIENT = 2
525
SHUT_RDWR = 0
526
CRD_CERTIFICATE = 1
527
E_NO_CERTIFICATE_FOUND = -49
528
X509_FMT_DER = 0
529
NO_TICKETS = 1<<10
530
ENABLE_RAWPK = 1<<18
531
CTYPE_PEERS = 3
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
534
535
# Types
536
class session_int(ctypes.Structure):
537
_fields_ = []
538
session_t = ctypes.POINTER(session_int)
539
540
class certificate_credentials_st(ctypes.Structure):
541
_fields_ = []
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
545
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
549
550
class openpgp_crt_int(ctypes.Structure):
551
_fields_ = []
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
558
559
# Exceptions
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
564
# gnutls.strerror()
565
self.code = code
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
569
message, *args)
570
571
class CertificateSecurityError(Error):
572
pass
573
574
# Classes
575
class Credentials(object):
576
def __init__(self):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
581
582
def __del__(self):
583
gnutls.certificate_free_credentials(self._c_object)
584
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version("3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
591
if gnutls.has_rawpk:
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
594
del gnutls_flags
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
598
True)
599
self.socket = socket
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
604
ctypes.c_void_p))
605
self.credentials = credentials
606
607
def __del__(self):
608
gnutls.deinit(self._c_object)
609
610
def handshake(self):
611
return gnutls.handshake(self._c_object)
612
613
def send(self, data):
614
data = bytes(data)
615
data_len = len(data)
616
while data_len > 0:
617
data_len -= gnutls.record_send(self._c_object,
618
data[-data_len:],
619
data_len)
620
621
def bye(self):
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
623
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
628
if result >= 0:
629
return result
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
633
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
637
while result < 0:
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
641
return result
642
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
645
646
# Functions
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
651
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
655
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
659
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
662
ctypes.c_size_t]
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
665
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
671
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
677
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
681
ctypes.c_int]
682
handshake_set_private_extensions.restype = None
683
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
686
ctypes.c_void_p]
687
credentials_set.restype = _error_code
688
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
692
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
696
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
701
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
705
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
709
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
713
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
718
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
722
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
727
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
731
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
736
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
739
740
if has_rawpk:
741
# Types
742
class pubkey_st(ctypes.Structure):
743
_fields = []
744
pubkey_t = ctypes.POINTER(pubkey_st)
745
746
x509_crt_fmt_t = ctypes.c_int
747
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
752
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
755
x509_crt_fmt_t]
756
pubkey_import.restype = _error_code
757
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
763
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
767
else:
768
# All the function declarations below are from gnutls/openpgp.h
769
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
773
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
777
openpgp_crt_fmt_t]
778
openpgp_crt_import.restype = _error_code
779
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
784
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
788
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
792
ctypes.c_void_p,
793
ctypes.POINTER(
794
ctypes.c_size_t)]
795
openpgp_crt_get_fingerprint.restype = _error_code
796
797
if check_version("3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
801
802
# Remove non-public functions
803
del _error_code, _retry_on_error
804
805
806
def call_pipe(connection, # : multiprocessing.Connection
807
func, *args, **kwargs):
808
"""This function is meant to be called by multiprocessing.Process
809
810
This function runs func(*args, **kwargs), and writes the resulting
811
return value on the provided multiprocessing.Connection.
812
"""
813
connection.send(func(*args, **kwargs))
814
connection.close()
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
815
400
816
401
817
402
class Client(object):
818
403
"""A representation of a client host served by this server.
819
404
820
405
Attributes:
821
406
approved: bool(); 'None' if not yet approved/disapproved
822
407
approval_delay: datetime.timedelta(); Time to wait for approval
824
409
checker: subprocess.Popen(); a running checker process used
825
410
to see if the client lives.
826
411
'None' if no process is running.
827
checker_callback_tag: a GLib event source tag, or None
412
checker_callback_tag: a gobject event source tag, or None
828
413
checker_command: string; External command which is run to check
829
414
if client lives. %() expansions are done at
830
415
runtime with vars(self) as dict, so that for
831
416
instance %(name)s can be used in the command.
832
checker_initiator_tag: a GLib event source tag, or None
417
checker_initiator_tag: a gobject event source tag, or None
833
418
created: datetime.datetime(); (UTC) object creation
834
419
client_structure: Object describing what attributes a client has
835
420
and is used for storing the client at exit
836
421
current_checker_command: string; current running checker_command
837
disable_initiator_tag: a GLib event source tag, or None
422
disable_initiator_tag: a gobject event source tag, or None
838
423
enabled: bool()
839
424
fingerprint: string (40 or 32 hexadecimal digits); used to
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
425
uniquely identify the client
843
426
host: string; available for use by the checker command
844
427
interval: datetime.timedelta(); How often to start a new checker
845
428
last_approval_request: datetime.datetime(); (UTC) or None
847
430
last_checker_status: integer between 0 and 255 reflecting exit
848
431
status of last checker. -1 reflects crashed
849
432
checker, -2 means no checker completed yet.
850
last_checker_signal: The signal which killed the last checker, if
851
last_checker_status is -1
852
433
last_enabled: datetime.datetime(); (UTC) or None
853
434
name: string; from the config file, used in log messages and
854
435
D-Bus identifiers
859
440
runtime_expansions: Allowed attributes for runtime expansion.
860
441
expires: datetime.datetime(); time (UTC) when a client will be
861
442
disabled, or None
862
server_settings: The server_settings dict from main()
863
443
"""
864
444
865
445
runtime_expansions = ("approval_delay", "approval_duration",
866
"created", "enabled", "expires", "key_id",
446
"created", "enabled", "expires",
867
447
"fingerprint", "host", "interval",
868
448
"last_approval_request", "last_checked_ok",
869
449
"last_enabled", "name", "timeout")
870
client_defaults = {
871
"timeout": "PT5M",
872
"extended_timeout": "PT15M",
873
"interval": "PT2M",
874
"checker": "fping -q -- %%(host)s",
875
"host": "",
876
"approval_delay": "PT0S",
877
"approval_duration": "PT1S",
878
"approved_by_default": "True",
879
"enabled": "True",
880
}
881
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
460
461
def timeout_milliseconds(self):
462
"Return the 'timeout' attribute in milliseconds"
463
return timedelta_to_milliseconds(self.timeout)
464
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
468
469
def interval_milliseconds(self):
470
"Return the 'interval' attribute in milliseconds"
471
return timedelta_to_milliseconds(self.interval)
472
473
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
475
882
476
@staticmethod
883
477
def config_parser(config):
884
478
"""Construct a new dict of client settings of this form:
891
485
for client_name in config.sections():
892
486
section = dict(config.items(client_name))
893
487
client = settings[client_name] = {}
894
488
895
489
client["host"] = section["host"]
896
490
# Reformat values from string types to Python types
897
491
client["approved_by_default"] = config.getboolean(
898
492
client_name, "approved_by_default")
899
493
client["enabled"] = config.getboolean(client_name,
900
494
"enabled")
901
902
# Uppercase and remove spaces from key_id and fingerprint
903
# for later comparison purposes with return value from the
904
# key_id() and fingerprint() functions
905
client["key_id"] = (section.get("key_id", "").upper()
906
.replace(" ", ""))
495
907
496
client["fingerprint"] = (section["fingerprint"].upper()
908
497
.replace(" ", ""))
909
498
if "secret" in section:
910
client["secret"] = codecs.decode(section["secret"]
911
.encode("utf-8"),
912
"base64")
499
client["secret"] = section["secret"].decode("base64")
913
500
elif "secfile" in section:
914
501
with open(os.path.expanduser(os.path.expandvars
915
502
(section["secfile"])),
916
503
"rb") as secfile:
917
504
client["secret"] = secfile.read()
918
505
else:
919
raise TypeError("No secret or secfile for section {}"
506
raise TypeError("No secret or secfile for section {0}"
920
507
.format(section))
921
508
client["timeout"] = string_to_delta(section["timeout"])
922
509
client["extended_timeout"] = string_to_delta(
930
517
client["last_approval_request"] = None
931
518
client["last_checked_ok"] = None
932
519
client["last_checker_status"] = -2
933
520
934
521
return settings
935
936
def __init__(self, settings, name=None, server_settings=None):
522
523
def __init__(self, settings, name = None):
937
524
self.name = name
938
if server_settings is None:
939
server_settings = {}
940
self.server_settings = server_settings
941
525
# adding all client settings
942
for setting, value in settings.items():
526
for setting, value in settings.iteritems():
943
527
setattr(self, setting, value)
944
528
945
529
if self.enabled:
946
530
if not hasattr(self, "last_enabled"):
947
531
self.last_enabled = datetime.datetime.utcnow()
951
535
else:
952
536
self.last_enabled = None
953
537
self.expires = None
954
538
955
539
logger.debug("Creating client %r", self.name)
956
logger.debug(" Key ID: %s", self.key_id)
540
# Uppercase and remove spaces from fingerprint for later
541
# comparison purposes with return value from the fingerprint()
542
# function
957
543
logger.debug(" Fingerprint: %s", self.fingerprint)
958
544
self.created = settings.get("created",
959
545
datetime.datetime.utcnow())
960
546
961
547
# attributes specific for this server instance
962
548
self.checker = None
963
549
self.checker_initiator_tag = None
966
552
self.current_checker_command = None
967
553
self.approved = None
968
554
self.approvals_pending = 0
969
self.changedstate = multiprocessing_manager.Condition(
970
multiprocessing_manager.Lock())
971
self.client_structure = [attr
972
for attr in self.__dict__.keys()
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
557
.Lock()))
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
973
560
if not attr.startswith("_")]
974
561
self.client_structure.append("client_structure")
975
976
for name, t in inspect.getmembers(
977
type(self), lambda obj: isinstance(obj, property)):
562
563
for name, t in inspect.getmembers(type(self),
564
lambda obj:
565
isinstance(obj,
566
property)):
978
567
if not name.startswith("_"):
979
568
self.client_structure.append(name)
980
569
981
570
# Send notice to process children that client state has changed
982
571
def send_changedstate(self):
983
572
with self.changedstate:
984
573
self.changedstate.notify_all()
985
574
986
575
def enable(self):
987
576
"""Start this client's checker and timeout hooks"""
988
577
if getattr(self, "enabled", False):
993
582
self.last_enabled = datetime.datetime.utcnow()
994
583
self.init_checker()
995
584
self.send_changedstate()
996
585
997
586
def disable(self, quiet=True):
998
587
"""Disable this client."""
999
588
if not getattr(self, "enabled", False):
1001
590
if not quiet:
1002
591
logger.info("Disabling client %s", self.name)
1003
592
if getattr(self, "disable_initiator_tag", None) is not None:
1004
GLib.source_remove(self.disable_initiator_tag)
593
gobject.source_remove(self.disable_initiator_tag)
1005
594
self.disable_initiator_tag = None
1006
595
self.expires = None
1007
596
if getattr(self, "checker_initiator_tag", None) is not None:
1008
GLib.source_remove(self.checker_initiator_tag)
597
gobject.source_remove(self.checker_initiator_tag)
1009
598
self.checker_initiator_tag = None
1010
599
self.stop_checker()
1011
600
self.enabled = False
1012
601
if not quiet:
1013
602
self.send_changedstate()
1014
# Do not run this again if called by a GLib.timeout_add
603
# Do not run this again if called by a gobject.timeout_add
1015
604
return False
1016
605
1017
606
def __del__(self):
1018
607
self.disable()
1019
608
1020
609
def init_checker(self):
1021
610
# Schedule a new checker to be started an 'interval' from now,
1022
611
# and every interval from then on.
1023
612
if self.checker_initiator_tag is not None:
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
1026
int(self.interval.total_seconds() * 1000),
1027
self.start_checker)
613
gobject.source_remove(self.checker_initiator_tag)
614
self.checker_initiator_tag = (gobject.timeout_add
615
(self.interval_milliseconds(),
616
self.start_checker))
1028
617
# Schedule a disable() when 'timeout' has passed
1029
618
if self.disable_initiator_tag is not None:
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(self.timeout.total_seconds() * 1000), self.disable)
619
gobject.source_remove(self.disable_initiator_tag)
620
self.disable_initiator_tag = (gobject.timeout_add
621
(self.timeout_milliseconds(),
622
self.disable))
1033
623
# Also start a new checker *right now*.
1034
624
self.start_checker()
1035
1036
def checker_callback(self, source, condition, connection,
1037
command):
625
626
def checker_callback(self, pid, condition, command):
1038
627
"""The checker has completed, so take appropriate actions."""
1039
628
self.checker_callback_tag = None
1040
629
self.checker = None
1041
# Read return code from connection (see call_pipe)
1042
returncode = connection.recv()
1043
connection.close()
1044
1045
if returncode >= 0:
1046
self.last_checker_status = returncode
1047
self.last_checker_signal = None
630
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
1048
632
if self.last_checker_status == 0:
1049
633
logger.info("Checker for %(name)s succeeded",
1050
634
vars(self))
1051
635
self.checked_ok()
1052
636
else:
1053
logger.info("Checker for %(name)s failed", vars(self))
637
logger.info("Checker for %(name)s failed",
638
vars(self))
1054
639
else:
1055
640
self.last_checker_status = -1
1056
self.last_checker_signal = -returncode
1057
641
logger.warning("Checker for %(name)s crashed?",
1058
642
vars(self))
1059
return False
1060
643
1061
644
def checked_ok(self):
1062
645
"""Assert that the client has been seen, alive and well."""
1063
646
self.last_checked_ok = datetime.datetime.utcnow()
1064
647
self.last_checker_status = 0
1065
self.last_checker_signal = None
1066
648
self.bump_timeout()
1067
649
1068
650
def bump_timeout(self, timeout=None):
1069
651
"""Bump up the timeout for this client."""
1070
652
if timeout is None:
1071
653
timeout = self.timeout
1072
654
if self.disable_initiator_tag is not None:
1073
GLib.source_remove(self.disable_initiator_tag)
655
gobject.source_remove(self.disable_initiator_tag)
1074
656
self.disable_initiator_tag = None
1075
657
if getattr(self, "enabled", False):
1076
self.disable_initiator_tag = GLib.timeout_add(
1077
int(timeout.total_seconds() * 1000), self.disable)
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
1078
661
self.expires = datetime.datetime.utcnow() + timeout
1079
662
1080
663
def need_approval(self):
1081
664
self.last_approval_request = datetime.datetime.utcnow()
1082
665
1083
666
def start_checker(self):
1084
667
"""Start a new checker subprocess if one is not running.
1085
668
1086
669
If a checker already exists, leave it running and do
1087
670
nothing."""
1088
671
# The reason for not killing a running checker is that if we
1093
676
# checkers alone, the checker would have to take more time
1094
677
# than 'timeout' for the client to be disabled, which is as it
1095
678
# should be.
1096
1097
if self.checker is not None and not self.checker.is_alive():
1098
logger.warning("Checker was not alive; joining")
1099
self.checker.join()
1100
self.checker = None
679
680
# If a checker exists, make sure it is not a zombie
681
try:
682
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
684
if (isinstance(error, OSError)
685
and error.errno != errno.ECHILD):
686
raise error
687
else:
688
if pid:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
1101
693
# Start a new checker if needed
1102
694
if self.checker is None:
1103
695
# Escape attributes for the shell
1104
escaped_attrs = {
1105
attr: re.escape(str(getattr(self, attr)))
1106
for attr in self.runtime_expansions}
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
698
for attr in
699
self.runtime_expansions)
1107
700
try:
1108
701
command = self.checker_command % escaped_attrs
1109
702
except TypeError as error:
1110
703
logger.error('Could not format string "%s"',
1111
self.checker_command,
704
self.checker_command, exc_info=error)
705
return True # Try again later
706
self.current_checker_command = command
707
try:
708
logger.info("Starting checker %r for %s",
709
command, self.name)
710
# We don't need to redirect stdout and stderr, since
711
# in normal mode, that is already done by daemon(),
712
# and in debug mode we don't want to. (Stdin is
713
# always replaced by /dev/null.)
714
self.checker = subprocess.Popen(command,
715
close_fds=True,
716
shell=True, cwd="/")
717
except OSError as error:
718
logger.error("Failed to start subprocess",
1112
719
exc_info=error)
1113
return True # Try again later
1114
self.current_checker_command = command
1115
logger.info("Starting checker %r for %s", command,
1116
self.name)
1117
# We don't need to redirect stdout and stderr, since
1118
# in normal mode, that is already done by daemon(),
1119
# and in debug mode we don't want to. (Stdin is
1120
# always replaced by /dev/null.)
1121
# The exception is when not debugging but nevertheless
1122
# running in the foreground; use the previously
1123
# created wnull.
1124
popen_args = {"close_fds": True,
1125
"shell": True,
1126
"cwd": "/"}
1127
if (not self.server_settings["debug"]
1128
and self.server_settings["foreground"]):
1129
popen_args.update({"stdout": wnull,
1130
"stderr": wnull})
1131
pipe = multiprocessing.Pipe(duplex=False)
1132
self.checker = multiprocessing.Process(
1133
target=call_pipe,
1134
args=(pipe[1], subprocess.call, command),
1135
kwargs=popen_args)
1136
self.checker.start()
1137
self.checker_callback_tag = GLib.io_add_watch(
1138
pipe[0].fileno(), GLib.IO_IN,
1139
self.checker_callback, pipe[0], command)
1140
# Re-run this periodically if run by GLib.timeout_add
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
728
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
729
except OSError as error:
730
if error.errno == errno.ECHILD:
731
logger.error("Child process vanished", exc_info=error)
732
return True
733
raise
734
if pid:
735
gobject.source_remove(self.checker_callback_tag)
736
self.checker_callback(pid, status, command)
737
# Re-run this periodically if run by gobject.timeout_add
1141
738
return True
1142
739
1143
740
def stop_checker(self):
1144
741
"""Force the checker process, if any, to stop."""
1145
742
if self.checker_callback_tag:
1146
GLib.source_remove(self.checker_callback_tag)
743
gobject.source_remove(self.checker_callback_tag)
1147
744
self.checker_callback_tag = None
1148
745
if getattr(self, "checker", None) is None:
1149
746
return
1150
747
logger.debug("Stopping checker for %(name)s", vars(self))
1151
self.checker.terminate()
748
try:
749
self.checker.terminate()
750
#time.sleep(0.5)
751
#if self.checker.poll() is None:
752
# self.checker.kill()
753
except OSError as error:
754
if error.errno != errno.ESRCH: # No such process
755
raise
1152
756
self.checker = None
1153
757
1154
758
1155
def dbus_service_property(dbus_interface,
1156
signature="v",
1157
access="readwrite",
1158
byte_arrays=False):
759
def dbus_service_property(dbus_interface, signature="v",
760
access="readwrite", byte_arrays=False):
1159
761
"""Decorators for marking methods of a DBusObjectWithProperties to
1160
762
become properties on the D-Bus.
1161
763
1162
764
The decorated method will be called with no arguments by "Get"
1163
765
and with one argument by "Set".
1164
766
1165
767
The parameters, where they are supported, are the same as
1166
768
dbus.service.method, except there is only "signature", since the
1167
769
type from Get() and the type sent to Set() is the same.
1170
772
# "Set" method, so we fail early here:
1171
773
if byte_arrays and signature != "ay":
1172
774
raise ValueError("Byte arrays not supported for non-'ay'"
1173
" signature {!r}".format(signature))
1174
775
" signature {0!r}".format(signature))
1175
776
def decorator(func):
1176
777
func._dbus_is_property = True
1177
778
func._dbus_interface = dbus_interface
1180
781
func._dbus_name = func.__name__
1181
782
if func._dbus_name.endswith("_dbus_property"):
1182
783
func._dbus_name = func._dbus_name[:-14]
1183
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
784
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1184
785
return func
1185
1186
786
return decorator
1187
787
1188
788
1189
789
def dbus_interface_annotations(dbus_interface):
1190
790
"""Decorator for marking functions returning interface annotations
1191
791
1192
792
Usage:
1193
793
1194
794
@dbus_interface_annotations("org.example.Interface")
1195
795
def _foo(self): # Function name does not matter
1196
796
return {"org.freedesktop.DBus.Deprecated": "true",
1197
797
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1198
798
"false"}
1199
799
"""
1200
1201
800
def decorator(func):
1202
801
func._dbus_is_interface = True
1203
802
func._dbus_interface = dbus_interface
1204
803
func._dbus_name = dbus_interface
1205
804
return func
1206
1207
805
return decorator
1208
806
1209
807
1210
808
def dbus_annotations(annotations):
1211
809
"""Decorator to annotate D-Bus methods, signals or properties
1212
810
Usage:
1213
1214
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1215
"org.freedesktop.DBus.Property."
1216
"EmitsChangedSignal": "false"})
811
1217
812
@dbus_service_property("org.example.Interface", signature="b",
1218
813
access="r")
814
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
815
"org.freedesktop.DBus.Property."
816
"EmitsChangedSignal": "false"})
1219
817
def Property_dbus_property(self):
1220
818
return dbus.Boolean(False)
1221
1222
See also the DBusObjectWithAnnotations class.
1223
819
"""
1224
1225
820
def decorator(func):
1226
821
func._dbus_annotations = annotations
1227
822
return func
1228
1229
823
return decorator
1230
824
1231
825
1232
826
class DBusPropertyException(dbus.exceptions.DBusException):
1233
827
"""A base class for D-Bus property-related exceptions
1234
828
"""
1235
pass
829
def __unicode__(self):
830
return unicode(str(self))
1236
831
1237
832
1238
833
class DBusPropertyAccessException(DBusPropertyException):
1247
842
pass
1248
843
1249
844
1250
class DBusObjectWithAnnotations(dbus.service.Object):
1251
"""A D-Bus object with annotations.
1252
1253
Classes inheriting from this can use the dbus_annotations
1254
decorator to add annotations to methods or signals.
845
class DBusObjectWithProperties(dbus.service.Object):
846
"""A D-Bus object with properties.
847
848
Classes inheriting from this can use the dbus_service_property
849
decorator to expose methods as D-Bus properties. It exposes the
850
standard Get(), Set(), and GetAll() methods on the D-Bus.
1255
851
"""
1256
852
1257
853
@staticmethod
1258
854
def _is_dbus_thing(thing):
1259
855
"""Returns a function testing if an attribute is a D-Bus thing
1260
856
1261
857
If called like _is_dbus_thing("method") it returns a function
1262
858
suitable for use as predicate to inspect.getmembers().
1263
859
"""
1264
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
860
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1265
861
False)
1266
862
1267
863
def _get_all_dbus_things(self, thing):
1268
864
"""Returns a generator of (name, attribute) pairs
1269
865
"""
1270
return ((getattr(athing.__get__(self), "_dbus_name", name),
866
return ((getattr(athing.__get__(self), "_dbus_name",
867
name),
1271
868
athing.__get__(self))
1272
869
for cls in self.__class__.__mro__
1273
870
for name, athing in
1274
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1275
1276
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1277
out_signature="s",
1278
path_keyword='object_path',
1279
connection_keyword='connection')
1280
def Introspect(self, object_path, connection):
1281
"""Overloading of standard D-Bus method.
1282
1283
Inserts annotation tags on methods and signals.
1284
"""
1285
xmlstring = dbus.service.Object.Introspect(self, object_path,
1286
connection)
1287
try:
1288
document = xml.dom.minidom.parseString(xmlstring)
1289
1290
for if_tag in document.getElementsByTagName("interface"):
1291
# Add annotation tags
1292
for typ in ("method", "signal"):
1293
for tag in if_tag.getElementsByTagName(typ):
1294
annots = dict()
1295
for name, prop in (self.
1296
_get_all_dbus_things(typ)):
1297
if (name == tag.getAttribute("name")
1298
and prop._dbus_interface
1299
== if_tag.getAttribute("name")):
1300
annots.update(getattr(
1301
prop, "_dbus_annotations", {}))
1302
for name, value in annots.items():
1303
ann_tag = document.createElement(
1304
"annotation")
1305
ann_tag.setAttribute("name", name)
1306
ann_tag.setAttribute("value", value)
1307
tag.appendChild(ann_tag)
1308
# Add interface annotation tags
1309
for annotation, value in dict(
1310
itertools.chain.from_iterable(
1311
annotations().items()
1312
for name, annotations
1313
in self._get_all_dbus_things("interface")
1314
if name == if_tag.getAttribute("name")
1315
)).items():
1316
ann_tag = document.createElement("annotation")
1317
ann_tag.setAttribute("name", annotation)
1318
ann_tag.setAttribute("value", value)
1319
if_tag.appendChild(ann_tag)
1320
# Fix argument name for the Introspect method itself
1321
if (if_tag.getAttribute("name")
1322
== dbus.INTROSPECTABLE_IFACE):
1323
for cn in if_tag.getElementsByTagName("method"):
1324
if cn.getAttribute("name") == "Introspect":
1325
for arg in cn.getElementsByTagName("arg"):
1326
if (arg.getAttribute("direction")
1327
== "out"):
1328
arg.setAttribute("name",
1329
"xml_data")
1330
xmlstring = document.toxml("utf-8")
1331
document.unlink()
1332
except (AttributeError, xml.dom.DOMException,
1333
xml.parsers.expat.ExpatError) as error:
1334
logger.error("Failed to override Introspection method",
1335
exc_info=error)
1336
return xmlstring
1337
1338
1339
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1340
"""A D-Bus object with properties.
1341
1342
Classes inheriting from this can use the dbus_service_property
1343
decorator to expose methods as D-Bus properties. It exposes the
1344
standard Get(), Set(), and GetAll() methods on the D-Bus.
1345
"""
1346
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
873
1347
874
def _get_dbus_property(self, interface_name, property_name):
1348
875
"""Returns a bound method if one exists which is a D-Bus
1349
876
property with the specified name and interface.
1350
877
"""
1351
for cls in self.__class__.__mro__:
1352
for name, value in inspect.getmembers(
1353
cls, self._is_dbus_thing("property")):
878
for cls in self.__class__.__mro__:
879
for name, value in (inspect.getmembers
880
(cls,
881
self._is_dbus_thing("property"))):
1354
882
if (value._dbus_name == property_name
1355
883
and value._dbus_interface == interface_name):
1356
884
return value.__get__(self)
1357
885
1358
886
# No such property
1359
raise DBusPropertyNotFound("{}:{}.{}".format(
1360
self.dbus_object_path, interface_name, property_name))
1361
1362
@classmethod
1363
def _get_all_interface_names(cls):
1364
"""Get a sequence of all interfaces supported by an object"""
1365
return (name for name in set(getattr(getattr(x, attr),
1366
"_dbus_interface", None)
1367
for x in (inspect.getmro(cls))
1368
for attr in dir(x))
1369
if name is not None)
1370
1371
@dbus.service.method(dbus.PROPERTIES_IFACE,
1372
in_signature="ss",
887
raise DBusPropertyNotFound(self.dbus_object_path + ":"
888
+ interface_name + "."
889
+ property_name)
890
891
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1373
892
out_signature="v")
1374
893
def Get(self, interface_name, property_name):
1375
894
"""Standard D-Bus property Get() method, see D-Bus standard.
1381
900
if not hasattr(value, "variant_level"):
1382
901
return value
1383
902
return type(value)(value, variant_level=value.variant_level+1)
1384
903
1385
904
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1386
905
def Set(self, interface_name, property_name, value):
1387
906
"""Standard D-Bus property Set() method, see D-Bus standard.
1393
912
# The byte_arrays option is not supported yet on
1394
913
# signatures other than "ay".
1395
914
if prop._dbus_signature != "ay":
1396
raise ValueError("Byte arrays not supported for non-"
1397
"'ay' signature {!r}"
1398
.format(prop._dbus_signature))
915
raise ValueError
1399
916
value = dbus.ByteArray(b''.join(chr(byte)
1400
917
for byte in value))
1401
918
prop(value)
1402
1403
@dbus.service.method(dbus.PROPERTIES_IFACE,
1404
in_signature="s",
919
920
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1405
921
out_signature="a{sv}")
1406
922
def GetAll(self, interface_name):
1407
923
"""Standard D-Bus property GetAll() method, see D-Bus
1408
924
standard.
1409
925
1410
926
Note: Will not include properties with access="write".
1411
927
"""
1412
928
properties = {}
1422
938
if not hasattr(value, "variant_level"):
1423
939
properties[name] = value
1424
940
continue
1425
properties[name] = type(value)(
1426
value, variant_level=value.variant_level + 1)
941
properties[name] = type(value)(value, variant_level=
942
value.variant_level+1)
1427
943
return dbus.Dictionary(properties, signature="sv")
1428
1429
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1430
def PropertiesChanged(self, interface_name, changed_properties,
1431
invalidated_properties):
1432
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1433
standard.
1434
"""
1435
pass
1436
944
1437
945
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1438
946
out_signature="s",
1439
947
path_keyword='object_path',
1440
948
connection_keyword='connection')
1441
949
def Introspect(self, object_path, connection):
1442
950
"""Overloading of standard D-Bus method.
1443
951
1444
952
Inserts property tags and interface annotation tags.
1445
953
"""
1446
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1447
object_path,
1448
connection)
954
xmlstring = dbus.service.Object.Introspect(self, object_path,
955
connection)
1449
956
try:
1450
957
document = xml.dom.minidom.parseString(xmlstring)
1451
1452
958
def make_tag(document, name, prop):
1453
959
e = document.createElement("property")
1454
960
e.setAttribute("name", name)
1455
961
e.setAttribute("type", prop._dbus_signature)
1456
962
e.setAttribute("access", prop._dbus_access)
1457
963
return e
1458
1459
964
for if_tag in document.getElementsByTagName("interface"):
1460
965
# Add property tags
1461
966
for tag in (make_tag(document, name, prop)
1464
969
if prop._dbus_interface
1465
970
== if_tag.getAttribute("name")):
1466
971
if_tag.appendChild(tag)
1467
# Add annotation tags for properties
1468
for tag in if_tag.getElementsByTagName("property"):
1469
annots = dict()
1470
for name, prop in self._get_all_dbus_things(
1471
"property"):
1472
if (name == tag.getAttribute("name")
1473
and prop._dbus_interface
1474
== if_tag.getAttribute("name")):
1475
annots.update(getattr(
1476
prop, "_dbus_annotations", {}))
1477
for name, value in annots.items():
1478
ann_tag = document.createElement(
1479
"annotation")
1480
ann_tag.setAttribute("name", name)
1481
ann_tag.setAttribute("value", value)
1482
tag.appendChild(ann_tag)
972
# Add annotation tags
973
for typ in ("method", "signal", "property"):
974
for tag in if_tag.getElementsByTagName(typ):
975
annots = dict()
976
for name, prop in (self.
977
_get_all_dbus_things(typ)):
978
if (name == tag.getAttribute("name")
979
and prop._dbus_interface
980
== if_tag.getAttribute("name")):
981
annots.update(getattr
982
(prop,
983
"_dbus_annotations",
984
{}))
985
for name, value in annots.iteritems():
986
ann_tag = document.createElement(
987
"annotation")
988
ann_tag.setAttribute("name", name)
989
ann_tag.setAttribute("value", value)
990
tag.appendChild(ann_tag)
991
# Add interface annotation tags
992
for annotation, value in dict(
993
itertools.chain.from_iterable(
994
annotations().iteritems()
995
for name, annotations in
996
self._get_all_dbus_things("interface")
997
if name == if_tag.getAttribute("name")
998
)).iteritems():
999
ann_tag = document.createElement("annotation")
1000
ann_tag.setAttribute("name", annotation)
1001
ann_tag.setAttribute("value", value)
1002
if_tag.appendChild(ann_tag)
1483
1003
# Add the names to the return values for the
1484
1004
# "org.freedesktop.DBus.Properties" methods
1485
1005
if (if_tag.getAttribute("name")
1504
1024
return xmlstring
1505
1025
1506
1026
1507
try:
1508
dbus.OBJECT_MANAGER_IFACE
1509
except AttributeError:
1510
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1511
1512
1513
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1514
"""A D-Bus object with an ObjectManager.
1515
1516
Classes inheriting from this exposes the standard
1517
GetManagedObjects call and the InterfacesAdded and
1518
InterfacesRemoved signals on the standard
1519
"org.freedesktop.DBus.ObjectManager" interface.
1520
1521
Note: No signals are sent automatically; they must be sent
1522
manually.
1523
"""
1524
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1525
out_signature="a{oa{sa{sv}}}")
1526
def GetManagedObjects(self):
1527
"""This function must be overridden"""
1528
raise NotImplementedError()
1529
1530
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1531
signature="oa{sa{sv}}")
1532
def InterfacesAdded(self, object_path, interfaces_and_properties):
1533
pass
1534
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1536
def InterfacesRemoved(self, object_path, interfaces):
1537
pass
1538
1539
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1540
out_signature="s",
1541
path_keyword='object_path',
1542
connection_keyword='connection')
1543
def Introspect(self, object_path, connection):
1544
"""Overloading of standard D-Bus method.
1545
1546
Override return argument name of GetManagedObjects to be
1547
"objpath_interfaces_and_properties"
1548
"""
1549
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1550
object_path,
1551
connection)
1552
try:
1553
document = xml.dom.minidom.parseString(xmlstring)
1554
1555
for if_tag in document.getElementsByTagName("interface"):
1556
# Fix argument name for the GetManagedObjects method
1557
if (if_tag.getAttribute("name")
1558
== dbus.OBJECT_MANAGER_IFACE):
1559
for cn in if_tag.getElementsByTagName("method"):
1560
if (cn.getAttribute("name")
1561
== "GetManagedObjects"):
1562
for arg in cn.getElementsByTagName("arg"):
1563
if (arg.getAttribute("direction")
1564
== "out"):
1565
arg.setAttribute(
1566
"name",
1567
"objpath_interfaces"
1568
"_and_properties")
1569
xmlstring = document.toxml("utf-8")
1570
document.unlink()
1571
except (AttributeError, xml.dom.DOMException,
1572
xml.parsers.expat.ExpatError) as error:
1573
logger.error("Failed to override Introspection method",
1574
exc_info=error)
1575
return xmlstring
1576
1577
1578
1027
def datetime_to_dbus(dt, variant_level=0):
1579
1028
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1580
1029
if dt is None:
1581
return dbus.String("", variant_level=variant_level)
1582
return dbus.String(dt.isoformat(), variant_level=variant_level)
1030
return dbus.String("", variant_level = variant_level)
1031
return dbus.String(dt.isoformat(),
1032
variant_level=variant_level)
1583
1033
1584
1034
1585
1035
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1587
1037
dbus.service.Object, it will add alternate D-Bus attributes with
1588
1038
interface names according to the "alt_interface_names" mapping.
1589
1039
Usage:
1590
1040
1591
1041
@alternate_dbus_interfaces({"org.example.Interface":
1592
1042
"net.example.AlternateInterface"})
1593
1043
class SampleDBusObject(dbus.service.Object):
1594
1044
@dbus.service.method("org.example.Interface")
1595
1045
def SampleDBusMethod():
1596
1046
pass
1597
1047
1598
1048
The above "SampleDBusMethod" on "SampleDBusObject" will be
1599
1049
reachable via two interfaces: "org.example.Interface" and
1600
1050
"net.example.AlternateInterface", the latter of which will have
1601
1051
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1602
1052
"true", unless "deprecate" is passed with a False value.
1603
1053
1604
1054
This works for methods and signals, and also for D-Bus properties
1605
1055
(from DBusObjectWithProperties) and interfaces (from the
1606
1056
dbus_interface_annotations decorator).
1607
1057
"""
1608
1609
1058
def wrapper(cls):
1610
1059
for orig_interface_name, alt_interface_name in (
1611
alt_interface_names.items()):
1060
alt_interface_names.iteritems()):
1612
1061
attr = {}
1613
1062
interface_names = set()
1614
1063
# Go though all attributes of the class
1616
1065
# Ignore non-D-Bus attributes, and D-Bus attributes
1617
1066
# with the wrong interface name
1618
1067
if (not hasattr(attribute, "_dbus_interface")
1619
or not attribute._dbus_interface.startswith(
1620
orig_interface_name)):
1068
or not attribute._dbus_interface
1069
.startswith(orig_interface_name)):
1621
1070
continue
1622
1071
# Create an alternate D-Bus interface name based on
1623
1072
# the current name
1624
alt_interface = attribute._dbus_interface.replace(
1625
orig_interface_name, alt_interface_name)
1073
alt_interface = (attribute._dbus_interface
1074
.replace(orig_interface_name,
1075
alt_interface_name))
1626
1076
interface_names.add(alt_interface)
1627
1077
# Is this a D-Bus signal?
1628
1078
if getattr(attribute, "_dbus_is_signal", False):
1629
# Extract the original non-method undecorated
1630
# function by black magic
1631
if sys.version_info.major == 2:
1632
nonmethod_func = (dict(
1079
# Extract the original non-method function by
1080
# black magic
1081
nonmethod_func = (dict(
1633
1082
zip(attribute.func_code.co_freevars,
1634
attribute.__closure__))
1635
["func"].cell_contents)
1636
else:
1637
nonmethod_func = (dict(
1638
zip(attribute.__code__.co_freevars,
1639
attribute.__closure__))
1640
["func"].cell_contents)
1083
attribute.__closure__))["func"]
1084
.cell_contents)
1641
1085
# Create a new, but exactly alike, function
1642
1086
# object, and decorate it to be a new D-Bus signal
1643
1087
# with the alternate D-Bus interface name
1644
new_function = copy_function(nonmethod_func)
1645
new_function = (dbus.service.signal(
1646
alt_interface,
1647
attribute._dbus_signature)(new_function))
1088
new_function = (dbus.service.signal
1089
(alt_interface,
1090
attribute._dbus_signature)
1091
(types.FunctionType(
1092
nonmethod_func.func_code,
1093
nonmethod_func.func_globals,
1094
nonmethod_func.func_name,
1095
nonmethod_func.func_defaults,
1096
nonmethod_func.func_closure)))
1648
1097
# Copy annotations, if any
1649
1098
try:
1650
new_function._dbus_annotations = dict(
1651
attribute._dbus_annotations)
1099
new_function._dbus_annotations = (
1100
dict(attribute._dbus_annotations))
1652
1101
except AttributeError:
1653
1102
pass
1654
1655
1103
# Define a creator of a function to call both the
1656
1104
# original and alternate functions, so both the
1657
1105
# original and alternate signals gets sent when
1660
1108
"""This function is a scope container to pass
1661
1109
func1 and func2 to the "call_both" function
1662
1110
outside of its arguments"""
1663
1664
@functools.wraps(func2)
1665
1111
def call_both(*args, **kwargs):
1666
1112
"""This function will emit two D-Bus
1667
1113
signals by calling func1 and func2"""
1668
1114
func1(*args, **kwargs)
1669
1115
func2(*args, **kwargs)
1670
# Make wrapper function look like a D-Bus
1671
# signal
1672
for name, attr in inspect.getmembers(func2):
1673
if name.startswith("_dbus_"):
1674
setattr(call_both, name, attr)
1675
1676
1116
return call_both
1677
1117
# Create the "call_both" function and add it to
1678
1118
# the class
1683
1123
# object. Decorate it to be a new D-Bus method
1684
1124
# with the alternate D-Bus interface name. Add it
1685
1125
# to the class.
1686
attr[attrname] = (
1687
dbus.service.method(
1688
alt_interface,
1689
attribute._dbus_in_signature,
1690
attribute._dbus_out_signature)
1691
(copy_function(attribute)))
1126
attr[attrname] = (dbus.service.method
1127
(alt_interface,
1128
attribute._dbus_in_signature,
1129
attribute._dbus_out_signature)
1130
(types.FunctionType
1131
(attribute.func_code,
1132
attribute.func_globals,
1133
attribute.func_name,
1134
attribute.func_defaults,
1135
attribute.func_closure)))
1692
1136
# Copy annotations, if any
1693
1137
try:
1694
attr[attrname]._dbus_annotations = dict(
1695
attribute._dbus_annotations)
1138
attr[attrname]._dbus_annotations = (
1139
dict(attribute._dbus_annotations))
1696
1140
except AttributeError:
1697
1141
pass
1698
1142
# Is this a D-Bus property?
1701
1145
# object, and decorate it to be a new D-Bus
1702
1146
# property with the alternate D-Bus interface
1703
1147
# name. Add it to the class.
1704
attr[attrname] = (dbus_service_property(
1705
alt_interface, attribute._dbus_signature,
1706
attribute._dbus_access,
1707
attribute._dbus_get_args_options
1708
["byte_arrays"])
1709
(copy_function(attribute)))
1148
attr[attrname] = (dbus_service_property
1149
(alt_interface,
1150
attribute._dbus_signature,
1151
attribute._dbus_access,
1152
attribute
1153
._dbus_get_args_options
1154
["byte_arrays"])
1155
(types.FunctionType
1156
(attribute.func_code,
1157
attribute.func_globals,
1158
attribute.func_name,
1159
attribute.func_defaults,
1160
attribute.func_closure)))
1710
1161
# Copy annotations, if any
1711
1162
try:
1712
attr[attrname]._dbus_annotations = dict(
1713
attribute._dbus_annotations)
1163
attr[attrname]._dbus_annotations = (
1164
dict(attribute._dbus_annotations))
1714
1165
except AttributeError:
1715
1166
pass
1716
1167
# Is this a D-Bus interface?
1719
1170
# object. Decorate it to be a new D-Bus interface
1720
1171
# with the alternate D-Bus interface name. Add it
1721
1172
# to the class.
1722
attr[attrname] = (
1723
dbus_interface_annotations(alt_interface)
1724
(copy_function(attribute)))
1173
attr[attrname] = (dbus_interface_annotations
1174
(alt_interface)
1175
(types.FunctionType
1176
(attribute.func_code,
1177
attribute.func_globals,
1178
attribute.func_name,
1179
attribute.func_defaults,
1180
attribute.func_closure)))
1725
1181
if deprecate:
1726
1182
# Deprecate all alternate interfaces
1727
iname = "_AlternateDBusNames_interface_annotation{}"
1183
iname="_AlternateDBusNames_interface_annotation{0}"
1728
1184
for interface_name in interface_names:
1729
1730
1185
@dbus_interface_annotations(interface_name)
1731
1186
def func(self):
1732
return {"org.freedesktop.DBus.Deprecated":
1733
"true"}
1187
return { "org.freedesktop.DBus.Deprecated":
1188
"true" }
1734
1189
# Find an unused name
1735
1190
for aname in (iname.format(i)
1736
1191
for i in itertools.count()):
1740
1195
if interface_names:
1741
1196
# Replace the class with a new subclass of it with
1742
1197
# methods, signals, etc. as created above.
1743
if sys.version_info.major == 2:
1744
cls = type(b"{}Alternate".format(cls.__name__),
1745
(cls, ), attr)
1746
else:
1747
cls = type("{}Alternate".format(cls.__name__),
1748
(cls, ), attr)
1198
cls = type(b"{0}Alternate".format(cls.__name__),
1199
(cls,), attr)
1749
1200
return cls
1750
1751
1201
return wrapper
1752
1202
1753
1203
1754
1204
@alternate_dbus_interfaces({"se.recompile.Mandos":
1755
"se.bsnet.fukt.Mandos"})
1205
"se.bsnet.fukt.Mandos"})
1756
1206
class ClientDBus(Client, DBusObjectWithProperties):
1757
1207
"""A Client class using D-Bus
1758
1208
1759
1209
Attributes:
1760
1210
dbus_object_path: dbus.ObjectPath
1761
1211
bus: dbus.SystemBus()
1762
1212
"""
1763
1213
1764
1214
runtime_expansions = (Client.runtime_expansions
1765
+ ("dbus_object_path", ))
1766
1767
_interface = "se.recompile.Mandos.Client"
1768
1215
+ ("dbus_object_path",))
1216
1769
1217
# dbus.service.Object doesn't use super(), so we can't either.
1770
1771
def __init__(self, bus=None, *args, **kwargs):
1218
1219
def __init__(self, bus = None, *args, **kwargs):
1772
1220
self.bus = bus
1773
1221
Client.__init__(self, *args, **kwargs)
1774
1222
# Only now, when this client is initialized, can it show up on
1775
1223
# the D-Bus
1776
client_object_name = str(self.name).translate(
1224
client_object_name = unicode(self.name).translate(
1777
1225
{ord("."): ord("_"),
1778
1226
ord("-"): ord("_")})
1779
self.dbus_object_path = dbus.ObjectPath(
1780
"/clients/" + client_object_name)
1227
self.dbus_object_path = (dbus.ObjectPath
1228
("/clients/" + client_object_name))
1781
1229
DBusObjectWithProperties.__init__(self, self.bus,
1782
1230
self.dbus_object_path)
1783
1784
def notifychangeproperty(transform_func, dbus_name,
1785
type_func=lambda x: x,
1786
variant_level=1,
1787
invalidate_only=False,
1788
_interface=_interface):
1231
1232
def notifychangeproperty(transform_func,
1233
dbus_name, type_func=lambda x: x,
1234
variant_level=1):
1789
1235
""" Modify a variable so that it's a property which announces
1790
1236
its changes to DBus.
1791
1237
1792
1238
transform_fun: Function that takes a value and a variant_level
1793
1239
and transforms it to a D-Bus type.
1794
1240
dbus_name: D-Bus name of the variable
1796
1242
to the D-Bus. Default: no transform
1797
1243
variant_level: D-Bus variant level. Default: 1
1798
1244
"""
1799
attrname = "_{}".format(dbus_name)
1800
1245
attrname = "_{0}".format(dbus_name)
1801
1246
def setter(self, value):
1802
1247
if hasattr(self, "dbus_object_path"):
1803
1248
if (not hasattr(self, attrname) or
1804
1249
type_func(getattr(self, attrname, None))
1805
1250
!= type_func(value)):
1806
if invalidate_only:
1807
self.PropertiesChanged(
1808
_interface, dbus.Dictionary(),
1809
dbus.Array((dbus_name, )))
1810
else:
1811
dbus_value = transform_func(
1812
type_func(value),
1813
variant_level=variant_level)
1814
self.PropertyChanged(dbus.String(dbus_name),
1815
dbus_value)
1816
self.PropertiesChanged(
1817
_interface,
1818
dbus.Dictionary({dbus.String(dbus_name):
1819
dbus_value}),
1820
dbus.Array())
1251
dbus_value = transform_func(type_func(value),
1252
variant_level
1253
=variant_level)
1254
self.PropertyChanged(dbus.String(dbus_name),
1255
dbus_value)
1821
1256
setattr(self, attrname, value)
1822
1257
1823
1258
return property(lambda self: getattr(self, attrname), setter)
1824
1259
1825
1260
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1826
1261
approvals_pending = notifychangeproperty(dbus.Boolean,
1827
1262
"ApprovalPending",
1828
type_func=bool)
1263
type_func = bool)
1829
1264
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1830
1265
last_enabled = notifychangeproperty(datetime_to_dbus,
1831
1266
"LastEnabled")
1832
checker = notifychangeproperty(
1833
dbus.Boolean, "CheckerRunning",
1834
type_func=lambda checker: checker is not None)
1267
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1268
type_func = lambda checker:
1269
checker is not None)
1835
1270
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1836
1271
"LastCheckedOK")
1837
1272
last_checker_status = notifychangeproperty(dbus.Int16,
1840
1275
datetime_to_dbus, "LastApprovalRequest")
1841
1276
approved_by_default = notifychangeproperty(dbus.Boolean,
1842
1277
"ApprovedByDefault")
1843
approval_delay = notifychangeproperty(
1844
dbus.UInt64, "ApprovalDelay",
1845
type_func=lambda td: td.total_seconds() * 1000)
1278
approval_delay = notifychangeproperty(dbus.UInt64,
1279
"ApprovalDelay",
1280
type_func =
1281
timedelta_to_milliseconds)
1846
1282
approval_duration = notifychangeproperty(
1847
1283
dbus.UInt64, "ApprovalDuration",
1848
type_func=lambda td: td.total_seconds() * 1000)
1284
type_func = timedelta_to_milliseconds)
1849
1285
host = notifychangeproperty(dbus.String, "Host")
1850
timeout = notifychangeproperty(
1851
dbus.UInt64, "Timeout",
1852
type_func=lambda td: td.total_seconds() * 1000)
1286
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1287
type_func =
1288
timedelta_to_milliseconds)
1853
1289
extended_timeout = notifychangeproperty(
1854
1290
dbus.UInt64, "ExtendedTimeout",
1855
type_func=lambda td: td.total_seconds() * 1000)
1856
interval = notifychangeproperty(
1857
dbus.UInt64, "Interval",
1858
type_func=lambda td: td.total_seconds() * 1000)
1291
type_func = timedelta_to_milliseconds)
1292
interval = notifychangeproperty(dbus.UInt64,
1293
"Interval",
1294
type_func =
1295
timedelta_to_milliseconds)
1859
1296
checker_command = notifychangeproperty(dbus.String, "Checker")
1860
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1861
invalidate_only=True)
1862
1297
1863
1298
del notifychangeproperty
1864
1299
1865
1300
def __del__(self, *args, **kwargs):
1866
1301
try:
1867
1302
self.remove_from_connection()
1870
1305
if hasattr(DBusObjectWithProperties, "__del__"):
1871
1306
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1872
1307
Client.__del__(self, *args, **kwargs)
1873
1874
def checker_callback(self, source, condition,
1875
connection, command, *args, **kwargs):
1876
ret = Client.checker_callback(self, source, condition,
1877
connection, command, *args,
1878
**kwargs)
1879
exitstatus = self.last_checker_status
1880
if exitstatus >= 0:
1308
1309
def checker_callback(self, pid, condition, command,
1310
*args, **kwargs):
1311
self.checker_callback_tag = None
1312
self.checker = None
1313
if os.WIFEXITED(condition):
1314
exitstatus = os.WEXITSTATUS(condition)
1881
1315
# Emit D-Bus signal
1882
1316
self.CheckerCompleted(dbus.Int16(exitstatus),
1883
# This is specific to GNU libC
1884
dbus.Int64(exitstatus << 8),
1317
dbus.Int64(condition),
1885
1318
dbus.String(command))
1886
1319
else:
1887
1320
# Emit D-Bus signal
1888
1321
self.CheckerCompleted(dbus.Int16(-1),
1889
dbus.Int64(
1890
# This is specific to GNU libC
1891
(exitstatus << 8)
1892
| self.last_checker_signal),
1322
dbus.Int64(condition),
1893
1323
dbus.String(command))
1894
return ret
1895
1324
1325
return Client.checker_callback(self, pid, condition, command,
1326
*args, **kwargs)
1327
1896
1328
def start_checker(self, *args, **kwargs):
1897
old_checker_pid = getattr(self.checker, "pid", None)
1329
old_checker = self.checker
1330
if self.checker is not None:
1331
old_checker_pid = self.checker.pid
1332
else:
1333
old_checker_pid = None
1898
1334
r = Client.start_checker(self, *args, **kwargs)
1899
1335
# Only if new checker process was started
1900
1336
if (self.checker is not None
1902
1338
# Emit D-Bus signal
1903
1339
self.CheckerStarted(self.current_checker_command)
1904
1340
return r
1905
1341
1906
1342
def _reset_approved(self):
1907
1343
self.approved = None
1908
1344
return False
1909
1345
1910
1346
def approve(self, value=True):
1911
1347
self.approved = value
1912
GLib.timeout_add(int(self.approval_duration.total_seconds()
1913
* 1000), self._reset_approved)
1348
gobject.timeout_add(timedelta_to_milliseconds
1349
(self.approval_duration),
1350
self._reset_approved)
1914
1351
self.send_changedstate()
1915
1916
# D-Bus methods, signals & properties
1917
1918
# Interfaces
1919
1920
# Signals
1921
1352
1353
## D-Bus methods, signals & properties
1354
_interface = "se.recompile.Mandos.Client"
1355
1356
## Interfaces
1357
1358
@dbus_interface_annotations(_interface)
1359
def _foo(self):
1360
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1361
"false"}
1362
1363
## Signals
1364
1922
1365
# CheckerCompleted - signal
1923
1366
@dbus.service.signal(_interface, signature="nxs")
1924
1367
def CheckerCompleted(self, exitcode, waitstatus, command):
1925
1368
"D-Bus signal"
1926
1369
pass
1927
1370
1928
1371
# CheckerStarted - signal
1929
1372
@dbus.service.signal(_interface, signature="s")
1930
1373
def CheckerStarted(self, command):
1931
1374
"D-Bus signal"
1932
1375
pass
1933
1376
1934
1377
# PropertyChanged - signal
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1936
1378
@dbus.service.signal(_interface, signature="sv")
1937
1379
def PropertyChanged(self, property, value):
1938
1380
"D-Bus signal"
1939
1381
pass
1940
1382
1941
1383
# GotSecret - signal
1942
1384
@dbus.service.signal(_interface)
1943
1385
def GotSecret(self):
1946
1388
server to mandos-client
1947
1389
"""
1948
1390
pass
1949
1391
1950
1392
# Rejected - signal
1951
1393
@dbus.service.signal(_interface, signature="s")
1952
1394
def Rejected(self, reason):
1953
1395
"D-Bus signal"
1954
1396
pass
1955
1397
1956
1398
# NeedApproval - signal
1957
1399
@dbus.service.signal(_interface, signature="tb")
1958
1400
def NeedApproval(self, timeout, default):
1959
1401
"D-Bus signal"
1960
1402
return self.need_approval()
1961
1962
# Methods
1963
1403
1404
## Methods
1405
1964
1406
# Approve - method
1965
1407
@dbus.service.method(_interface, in_signature="b")
1966
1408
def Approve(self, value):
1967
1409
self.approve(value)
1968
1410
1969
1411
# CheckedOK - method
1970
1412
@dbus.service.method(_interface)
1971
1413
def CheckedOK(self):
1972
1414
self.checked_ok()
1973
1415
1974
1416
# Enable - method
1975
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1976
1417
@dbus.service.method(_interface)
1977
1418
def Enable(self):
1978
1419
"D-Bus method"
1979
1420
self.enable()
1980
1421
1981
1422
# StartChecker - method
1982
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1983
1423
@dbus.service.method(_interface)
1984
1424
def StartChecker(self):
1985
1425
"D-Bus method"
1986
1426
self.start_checker()
1987
1427
1988
1428
# Disable - method
1989
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1990
1429
@dbus.service.method(_interface)
1991
1430
def Disable(self):
1992
1431
"D-Bus method"
1993
1432
self.disable()
1994
1433
1995
1434
# StopChecker - method
1996
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1997
1435
@dbus.service.method(_interface)
1998
1436
def StopChecker(self):
1999
1437
self.stop_checker()
2000
2001
# Properties
2002
1438
1439
## Properties
1440
2003
1441
# ApprovalPending - property
2004
1442
@dbus_service_property(_interface, signature="b", access="read")
2005
1443
def ApprovalPending_dbus_property(self):
2006
1444
return dbus.Boolean(bool(self.approvals_pending))
2007
1445
2008
1446
# ApprovedByDefault - property
2009
@dbus_service_property(_interface,
2010
signature="b",
1447
@dbus_service_property(_interface, signature="b",
2011
1448
access="readwrite")
2012
1449
def ApprovedByDefault_dbus_property(self, value=None):
2013
1450
if value is None: # get
2014
1451
return dbus.Boolean(self.approved_by_default)
2015
1452
self.approved_by_default = bool(value)
2016
1453
2017
1454
# ApprovalDelay - property
2018
@dbus_service_property(_interface,
2019
signature="t",
1455
@dbus_service_property(_interface, signature="t",
2020
1456
access="readwrite")
2021
1457
def ApprovalDelay_dbus_property(self, value=None):
2022
1458
if value is None: # get
2023
return dbus.UInt64(self.approval_delay.total_seconds()
2024
* 1000)
1459
return dbus.UInt64(self.approval_delay_milliseconds())
2025
1460
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2026
1461
2027
1462
# ApprovalDuration - property
2028
@dbus_service_property(_interface,
2029
signature="t",
1463
@dbus_service_property(_interface, signature="t",
2030
1464
access="readwrite")
2031
1465
def ApprovalDuration_dbus_property(self, value=None):
2032
1466
if value is None: # get
2033
return dbus.UInt64(self.approval_duration.total_seconds()
2034
* 1000)
1467
return dbus.UInt64(timedelta_to_milliseconds(
1468
self.approval_duration))
2035
1469
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2036
1470
2037
1471
# Name - property
2038
@dbus_annotations(
2039
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2040
1472
@dbus_service_property(_interface, signature="s", access="read")
2041
1473
def Name_dbus_property(self):
2042
1474
return dbus.String(self.name)
2043
2044
# KeyID - property
2045
@dbus_annotations(
2046
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2047
@dbus_service_property(_interface, signature="s", access="read")
2048
def KeyID_dbus_property(self):
2049
return dbus.String(self.key_id)
2050
1475
2051
1476
# Fingerprint - property
2052
@dbus_annotations(
2053
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2054
1477
@dbus_service_property(_interface, signature="s", access="read")
2055
1478
def Fingerprint_dbus_property(self):
2056
1479
return dbus.String(self.fingerprint)
2057
1480
2058
1481
# Host - property
2059
@dbus_service_property(_interface,
2060
signature="s",
1482
@dbus_service_property(_interface, signature="s",
2061
1483
access="readwrite")
2062
1484
def Host_dbus_property(self, value=None):
2063
1485
if value is None: # get
2064
1486
return dbus.String(self.host)
2065
self.host = str(value)
2066
1487
self.host = unicode(value)
1488
2067
1489
# Created - property
2068
@dbus_annotations(
2069
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2070
1490
@dbus_service_property(_interface, signature="s", access="read")
2071
1491
def Created_dbus_property(self):
2072
1492
return datetime_to_dbus(self.created)
2073
1493
2074
1494
# LastEnabled - property
2075
1495
@dbus_service_property(_interface, signature="s", access="read")
2076
1496
def LastEnabled_dbus_property(self):
2077
1497
return datetime_to_dbus(self.last_enabled)
2078
1498
2079
1499
# Enabled - property
2080
@dbus_service_property(_interface,
2081
signature="b",
1500
@dbus_service_property(_interface, signature="b",
2082
1501
access="readwrite")
2083
1502
def Enabled_dbus_property(self, value=None):
2084
1503
if value is None: # get
2087
1506
self.enable()
2088
1507
else:
2089
1508
self.disable()
2090
1509
2091
1510
# LastCheckedOK - property
2092
@dbus_service_property(_interface,
2093
signature="s",
1511
@dbus_service_property(_interface, signature="s",
2094
1512
access="readwrite")
2095
1513
def LastCheckedOK_dbus_property(self, value=None):
2096
1514
if value is not None:
2097
1515
self.checked_ok()
2098
1516
return
2099
1517
return datetime_to_dbus(self.last_checked_ok)
2100
1518
2101
1519
# LastCheckerStatus - property
2102
@dbus_service_property(_interface, signature="n", access="read")
1520
@dbus_service_property(_interface, signature="n",
1521
access="read")
2103
1522
def LastCheckerStatus_dbus_property(self):
2104
1523
return dbus.Int16(self.last_checker_status)
2105
1524
2106
1525
# Expires - property
2107
1526
@dbus_service_property(_interface, signature="s", access="read")
2108
1527
def Expires_dbus_property(self):
2109
1528
return datetime_to_dbus(self.expires)
2110
1529
2111
1530
# LastApprovalRequest - property
2112
1531
@dbus_service_property(_interface, signature="s", access="read")
2113
1532
def LastApprovalRequest_dbus_property(self):
2114
1533
return datetime_to_dbus(self.last_approval_request)
2115
1534
2116
1535
# Timeout - property
2117
@dbus_service_property(_interface,
2118
signature="t",
1536
@dbus_service_property(_interface, signature="t",
2119
1537
access="readwrite")
2120
1538
def Timeout_dbus_property(self, value=None):
2121
1539
if value is None: # get
2122
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1540
return dbus.UInt64(self.timeout_milliseconds())
2123
1541
old_timeout = self.timeout
2124
1542
self.timeout = datetime.timedelta(0, 0, 0, value)
2125
1543
# Reschedule disabling
2133
1551
if (getattr(self, "disable_initiator_tag", None)
2134
1552
is None):
2135
1553
return
2136
GLib.source_remove(self.disable_initiator_tag)
2137
self.disable_initiator_tag = GLib.timeout_add(
2138
int((self.expires - now).total_seconds() * 1000),
2139
self.disable)
2140
1554
gobject.source_remove(self.disable_initiator_tag)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
timedelta_to_milliseconds(self.expires - now),
1558
self.disable))
1559
2141
1560
# ExtendedTimeout - property
2142
@dbus_service_property(_interface,
2143
signature="t",
1561
@dbus_service_property(_interface, signature="t",
2144
1562
access="readwrite")
2145
1563
def ExtendedTimeout_dbus_property(self, value=None):
2146
1564
if value is None: # get
2147
return dbus.UInt64(self.extended_timeout.total_seconds()
2148
* 1000)
1565
return dbus.UInt64(self.extended_timeout_milliseconds())
2149
1566
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2150
1567
2151
1568
# Interval - property
2152
@dbus_service_property(_interface,
2153
signature="t",
1569
@dbus_service_property(_interface, signature="t",
2154
1570
access="readwrite")
2155
1571
def Interval_dbus_property(self, value=None):
2156
1572
if value is None: # get
2157
return dbus.UInt64(self.interval.total_seconds() * 1000)
1573
return dbus.UInt64(self.interval_milliseconds())
2158
1574
self.interval = datetime.timedelta(0, 0, 0, value)
2159
1575
if getattr(self, "checker_initiator_tag", None) is None:
2160
1576
return
2161
1577
if self.enabled:
2162
1578
# Reschedule checker run
2163
GLib.source_remove(self.checker_initiator_tag)
2164
self.checker_initiator_tag = GLib.timeout_add(
2165
value, self.start_checker)
2166
self.start_checker() # Start one now, too
2167
1579
gobject.source_remove(self.checker_initiator_tag)
1580
self.checker_initiator_tag = (gobject.timeout_add
1581
(value, self.start_checker))
1582
self.start_checker() # Start one now, too
1583
2168
1584
# Checker - property
2169
@dbus_service_property(_interface,
2170
signature="s",
1585
@dbus_service_property(_interface, signature="s",
2171
1586
access="readwrite")
2172
1587
def Checker_dbus_property(self, value=None):
2173
1588
if value is None: # get
2174
1589
return dbus.String(self.checker_command)
2175
self.checker_command = str(value)
2176
1590
self.checker_command = unicode(value)
1591
2177
1592
# CheckerRunning - property
2178
@dbus_service_property(_interface,
2179
signature="b",
1593
@dbus_service_property(_interface, signature="b",
2180
1594
access="readwrite")
2181
1595
def CheckerRunning_dbus_property(self, value=None):
2182
1596
if value is None: # get
2185
1599
self.start_checker()
2186
1600
else:
2187
1601
self.stop_checker()
2188
1602
2189
1603
# ObjectPath - property
2190
@dbus_annotations(
2191
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2192
"org.freedesktop.DBus.Deprecated": "true"})
2193
1604
@dbus_service_property(_interface, signature="o", access="read")
2194
1605
def ObjectPath_dbus_property(self):
2195
return self.dbus_object_path # is already a dbus.ObjectPath
2196
1606
return self.dbus_object_path # is already a dbus.ObjectPath
1607
2197
1608
# Secret = property
2198
@dbus_annotations(
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2200
"invalidates"})
2201
@dbus_service_property(_interface,
2202
signature="ay",
2203
access="write",
2204
byte_arrays=True)
1609
@dbus_service_property(_interface, signature="ay",
1610
access="write", byte_arrays=True)
2205
1611
def Secret_dbus_property(self, value):
2206
self.secret = bytes(value)
2207
1612
self.secret = str(value)
1613
2208
1614
del _interface
2209
1615
2210
1616
2211
1617
class ProxyClient(object):
2212
def __init__(self, child_pipe, key_id, fpr, address):
1618
def __init__(self, child_pipe, fpr, address):
2213
1619
self._pipe = child_pipe
2214
self._pipe.send(('init', key_id, fpr, address))
1620
self._pipe.send(('init', fpr, address))
2215
1621
if not self._pipe.recv():
2216
raise KeyError(key_id or fpr)
2217
1622
raise KeyError()
1623
2218
1624
def __getattribute__(self, name):
2219
1625
if name == '_pipe':
2220
1626
return super(ProxyClient, self).__getattribute__(name)
2223
1629
if data[0] == 'data':
2224
1630
return data[1]
2225
1631
if data[0] == 'function':
2226
2227
1632
def func(*args, **kwargs):
2228
1633
self._pipe.send(('funcall', name, args, kwargs))
2229
1634
return self._pipe.recv()[1]
2230
2231
1635
return func
2232
1636
2233
1637
def __setattr__(self, name, value):
2234
1638
if name == '_pipe':
2235
1639
return super(ProxyClient, self).__setattr__(name, value)
2238
1642
2239
1643
class ClientHandler(socketserver.BaseRequestHandler, object):
2240
1644
"""A class to handle client connections.
2241
1645
2242
1646
Instantiated once for each connection to handle it.
2243
1647
Note: This will run in its own forked process."""
2244
1648
2245
1649
def handle(self):
2246
1650
with contextlib.closing(self.server.child_pipe) as child_pipe:
2247
1651
logger.info("TCP connection from: %s",
2248
str(self.client_address))
1652
unicode(self.client_address))
2249
1653
logger.debug("Pipe FD: %d",
2250
1654
self.server.child_pipe.fileno())
2251
2252
session = gnutls.ClientSession(self.request)
2253
2254
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2255
# "+AES-256-CBC", "+SHA1",
2256
# "+COMP-NULL", "+CTYPE-OPENPGP",
2257
# "+DHE-DSS"))
1655
1656
session = (gnutls.connection
1657
.ClientSession(self.request,
1658
gnutls.connection
1659
.X509Credentials()))
1660
1661
# Note: gnutls.connection.X509Credentials is really a
1662
# generic GnuTLS certificate credentials object so long as
1663
# no X.509 keys are added to it. Therefore, we can use it
1664
# here despite using OpenPGP certificates.
1665
1666
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1667
# "+AES-256-CBC", "+SHA1",
1668
# "+COMP-NULL", "+CTYPE-OPENPGP",
1669
# "+DHE-DSS"))
2258
1670
# Use a fallback default, since this MUST be set.
2259
1671
priority = self.server.gnutls_priority
2260
1672
if priority is None:
2261
1673
priority = "NORMAL"
2262
gnutls.priority_set_direct(session._c_object,
2263
priority.encode("utf-8"),
2264
None)
2265
1674
(gnutls.library.functions
1675
.gnutls_priority_set_direct(session._c_object,
1676
priority, None))
1677
2266
1678
# Start communication using the Mandos protocol
2267
1679
# Get protocol number
2268
1680
line = self.request.makefile().readline()
2269
1681
logger.debug("Protocol version: %r", line)
2270
1682
try:
2271
1683
if int(line.strip().split()[0]) > 1:
2272
raise RuntimeError(line)
1684
raise RuntimeError
2273
1685
except (ValueError, IndexError, RuntimeError) as error:
2274
1686
logger.error("Unknown protocol version: %s", error)
2275
1687
return
2276
1688
2277
1689
# Start GnuTLS connection
2278
1690
try:
2279
1691
session.handshake()
2280
except gnutls.Error as error:
1692
except gnutls.errors.GNUTLSError as error:
2281
1693
logger.warning("Handshake failed: %s", error)
2282
1694
# Do not run session.bye() here: the session is not
2283
1695
# established. Just abandon the request.
2284
1696
return
2285
1697
logger.debug("Handshake succeeded")
2286
1698
2287
1699
approval_required = False
2288
1700
try:
2289
if gnutls.has_rawpk:
2290
fpr = ""
2291
try:
2292
key_id = self.key_id(
2293
self.peer_certificate(session))
2294
except (TypeError, gnutls.Error) as error:
2295
logger.warning("Bad certificate: %s", error)
2296
return
2297
logger.debug("Key ID: %s", key_id)
2298
2299
else:
2300
key_id = ""
2301
try:
2302
fpr = self.fingerprint(
2303
self.peer_certificate(session))
2304
except (TypeError, gnutls.Error) as error:
2305
logger.warning("Bad certificate: %s", error)
2306
return
2307
logger.debug("Fingerprint: %s", fpr)
2308
2309
try:
2310
client = ProxyClient(child_pipe, key_id, fpr,
1701
try:
1702
fpr = self.fingerprint(self.peer_certificate
1703
(session))
1704
except (TypeError,
1705
gnutls.errors.GNUTLSError) as error:
1706
logger.warning("Bad certificate: %s", error)
1707
return
1708
logger.debug("Fingerprint: %s", fpr)
1709
1710
try:
1711
client = ProxyClient(child_pipe, fpr,
2311
1712
self.client_address)
2312
1713
except KeyError:
2313
1714
return
2314
1715
2315
1716
if client.approval_delay:
2316
1717
delay = client.approval_delay
2317
1718
client.approvals_pending += 1
2318
1719
approval_required = True
2319
1720
2320
1721
while True:
2321
1722
if not client.enabled:
2322
1723
logger.info("Client %s is disabled",
2323
client.name)
1724
client.name)
2324
1725
if self.server.use_dbus:
2325
1726
# Emit D-Bus signal
2326
1727
client.Rejected("Disabled")
2327
1728
return
2328
1729
2329
1730
if client.approved or not client.approval_delay:
2330
# We are approved or approval is disabled
1731
#We are approved or approval is disabled
2331
1732
break
2332
1733
elif client.approved is None:
2333
1734
logger.info("Client %s needs approval",
2335
1736
if self.server.use_dbus:
2336
1737
# Emit D-Bus signal
2337
1738
client.NeedApproval(
2338
client.approval_delay.total_seconds()
2339
* 1000, client.approved_by_default)
1739
client.approval_delay_milliseconds(),
1740
client.approved_by_default)
2340
1741
else:
2341
1742
logger.warning("Client %s was not approved",
2342
1743
client.name)
2344
1745
# Emit D-Bus signal
2345
1746
client.Rejected("Denied")
2346
1747
return
2347
2348
# wait until timeout or approved
1748
1749
#wait until timeout or approved
2349
1750
time = datetime.datetime.now()
2350
1751
client.changedstate.acquire()
2351
client.changedstate.wait(delay.total_seconds())
1752
client.changedstate.wait(
1753
float(timedelta_to_milliseconds(delay)
1754
/ 1000))
2352
1755
client.changedstate.release()
2353
1756
time2 = datetime.datetime.now()
2354
1757
if (time2 - time) >= delay:
2364
1767
break
2365
1768
else:
2366
1769
delay -= time2 - time
2367
2368
try:
2369
session.send(client.secret)
2370
except gnutls.Error as error:
2371
logger.warning("gnutls send failed",
2372
exc_info=error)
2373
return
2374
1770
1771
sent_size = 0
1772
while sent_size < len(client.secret):
1773
try:
1774
sent = session.send(client.secret[sent_size:])
1775
except gnutls.errors.GNUTLSError as error:
1776
logger.warning("gnutls send failed",
1777
exc_info=error)
1778
return
1779
logger.debug("Sent: %d, remaining: %d",
1780
sent, len(client.secret)
1781
- (sent_size + sent))
1782
sent_size += sent
1783
2375
1784
logger.info("Sending secret to %s", client.name)
2376
1785
# bump the timeout using extended_timeout
2377
1786
client.bump_timeout(client.extended_timeout)
2378
1787
if self.server.use_dbus:
2379
1788
# Emit D-Bus signal
2380
1789
client.GotSecret()
2381
1790
2382
1791
finally:
2383
1792
if approval_required:
2384
1793
client.approvals_pending -= 1
2385
1794
try:
2386
1795
session.bye()
2387
except gnutls.Error as error:
1796
except gnutls.errors.GNUTLSError as error:
2388
1797
logger.warning("GnuTLS bye failed",
2389
1798
exc_info=error)
2390
1799
2391
1800
@staticmethod
2392
1801
def peer_certificate(session):
2393
"Return the peer's certificate as a bytestring"
2394
try:
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2396
gnutls.CTYPE_PEERS)
2397
except AttributeError:
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2399
if gnutls.has_rawpk:
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2401
else:
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
# If not a valid certificate type...
2404
if cert_type not in valid_cert_types:
2405
logger.info("Cert type %r not in %r", cert_type,
2406
valid_cert_types)
2407
# ...return invalid data
2408
return b""
1802
"Return the peer's OpenPGP certificate as a bytestring"
1803
# If not an OpenPGP certificate...
1804
if (gnutls.library.functions
1805
.gnutls_certificate_type_get(session._c_object)
1806
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1807
# ...do the normal thing
1808
return session.peer_certificate
2409
1809
list_size = ctypes.c_uint(1)
2410
cert_list = (gnutls.certificate_get_peers
1810
cert_list = (gnutls.library.functions
1811
.gnutls_certificate_get_peers
2411
1812
(session._c_object, ctypes.byref(list_size)))
2412
1813
if not bool(cert_list) and list_size.value != 0:
2413
raise gnutls.Error("error getting peer certificate")
1814
raise gnutls.errors.GNUTLSError("error getting peer"
1815
" certificate")
2414
1816
if list_size.value == 0:
2415
1817
return None
2416
1818
cert = cert_list[0]
2417
1819
return ctypes.string_at(cert.data, cert.size)
2418
2419
@staticmethod
2420
def key_id(certificate):
2421
"Convert a certificate bytestring to a hexdigit key ID"
2422
# New GnuTLS "datum" with the public key
2423
datum = gnutls.datum_t(
2424
ctypes.cast(ctypes.c_char_p(certificate),
2425
ctypes.POINTER(ctypes.c_ubyte)),
2426
ctypes.c_uint(len(certificate)))
2427
# XXX all these need to be created in the gnutls "module"
2428
# New empty GnuTLS certificate
2429
pubkey = gnutls.pubkey_t()
2430
gnutls.pubkey_init(ctypes.byref(pubkey))
2431
# Import the raw public key into the certificate
2432
gnutls.pubkey_import(pubkey,
2433
ctypes.byref(datum),
2434
gnutls.X509_FMT_DER)
2435
# New buffer for the key ID
2436
buf = ctypes.create_string_buffer(32)
2437
buf_len = ctypes.c_size_t(len(buf))
2438
# Get the key ID from the raw public key into the buffer
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2444
# Deinit the certificate
2445
gnutls.pubkey_deinit(pubkey)
2446
2447
# Convert the buffer to a Python bytestring
2448
key_id = ctypes.string_at(buf, buf_len.value)
2449
# Convert the bytestring to hexadecimal notation
2450
hex_key_id = binascii.hexlify(key_id).upper()
2451
return hex_key_id
2452
1820
2453
1821
@staticmethod
2454
1822
def fingerprint(openpgp):
2455
1823
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2456
1824
# New GnuTLS "datum" with the OpenPGP public key
2457
datum = gnutls.datum_t(
2458
ctypes.cast(ctypes.c_char_p(openpgp),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.c_uint(len(openpgp)))
1825
datum = (gnutls.library.types
1826
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1827
ctypes.POINTER
1828
(ctypes.c_ubyte)),
1829
ctypes.c_uint(len(openpgp))))
2461
1830
# New empty GnuTLS certificate
2462
crt = gnutls.openpgp_crt_t()
2463
gnutls.openpgp_crt_init(ctypes.byref(crt))
1831
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1832
(gnutls.library.functions
1833
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2464
1834
# Import the OpenPGP public key into the certificate
2465
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2466
gnutls.OPENPGP_FMT_RAW)
1835
(gnutls.library.functions
1836
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1837
gnutls.library.constants
1838
.GNUTLS_OPENPGP_FMT_RAW))
2467
1839
# Verify the self signature in the key
2468
1840
crtverify = ctypes.c_uint()
2469
gnutls.openpgp_crt_verify_self(crt, 0,
2470
ctypes.byref(crtverify))
1841
(gnutls.library.functions
1842
.gnutls_openpgp_crt_verify_self(crt, 0,
1843
ctypes.byref(crtverify)))
2471
1844
if crtverify.value != 0:
2472
gnutls.openpgp_crt_deinit(crt)
2473
raise gnutls.CertificateSecurityError(code
2474
=crtverify.value)
1845
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1846
raise (gnutls.errors.CertificateSecurityError
1847
("Verify failed"))
2475
1848
# New buffer for the fingerprint
2476
1849
buf = ctypes.create_string_buffer(20)
2477
1850
buf_len = ctypes.c_size_t()
2478
1851
# Get the fingerprint from the certificate into the buffer
2479
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2480
ctypes.byref(buf_len))
1852
(gnutls.library.functions
1853
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1854
ctypes.byref(buf_len)))
2481
1855
# Deinit the certificate
2482
gnutls.openpgp_crt_deinit(crt)
1856
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2483
1857
# Convert the buffer to a Python bytestring
2484
1858
fpr = ctypes.string_at(buf, buf_len.value)
2485
1859
# Convert the bytestring to hexadecimal notation
2489
1863
2490
1864
class MultiprocessingMixIn(object):
2491
1865
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2492
2493
1866
def sub_process_main(self, request, address):
2494
1867
try:
2495
1868
self.finish_request(request, address)
2496
1869
except Exception:
2497
1870
self.handle_error(request, address)
2498
1871
self.close_request(request)
2499
1872
2500
1873
def process_request(self, request, address):
2501
1874
"""Start a new process to process the request."""
2502
proc = multiprocessing.Process(target=self.sub_process_main,
2503
args=(request, address))
1875
proc = multiprocessing.Process(target = self.sub_process_main,
1876
args = (request, address))
2504
1877
proc.start()
2505
1878
return proc
2506
1879
2507
1880
2508
1881
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2509
1882
""" adds a pipe to the MixIn """
2510
2511
1883
def process_request(self, request, client_address):
2512
1884
"""Overrides and wraps the original process_request().
2513
1885
2514
1886
This function creates a new pipe in self.pipe
2515
1887
"""
2516
1888
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2517
1889
2518
1890
proc = MultiprocessingMixIn.process_request(self, request,
2519
1891
client_address)
2520
1892
self.child_pipe.close()
2521
1893
self.add_pipe(parent_pipe, proc)
2522
1894
2523
1895
def add_pipe(self, parent_pipe, proc):
2524
1896
"""Dummy function; override as necessary"""
2525
raise NotImplementedError()
1897
raise NotImplementedError
2526
1898
2527
1899
2528
1900
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2529
1901
socketserver.TCPServer, object):
2530
1902
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2531
1903
2532
1904
Attributes:
2533
1905
enabled: Boolean; whether this server is activated yet
2534
1906
interface: None or a network interface name (string)
2535
1907
use_ipv6: Boolean; to use IPv6 or not
2536
1908
"""
2537
2538
1909
def __init__(self, server_address, RequestHandlerClass,
2539
interface=None,
2540
use_ipv6=True,
2541
socketfd=None):
1910
interface=None, use_ipv6=True, socketfd=None):
2542
1911
"""If socketfd is set, use that file descriptor instead of
2543
1912
creating a new one with socket.socket().
2544
1913
"""
2550
1919
self.socketfd = socketfd
2551
1920
# Save the original socket.socket() function
2552
1921
self.socket_socket = socket.socket
2553
2554
1922
# To implement --socket, we monkey patch socket.socket.
2555
#
1923
#
2556
1924
# (When socketserver.TCPServer is a new-style class, we
2557
1925
# could make self.socket into a property instead of monkey
2558
1926
# patching socket.socket.)
2559
#
1927
#
2560
1928
# Create a one-time-only replacement for socket.socket()
2561
1929
@functools.wraps(socket.socket)
2562
1930
def socket_wrapper(*args, **kwargs):
2574
1942
# socket_wrapper(), if socketfd was set.
2575
1943
socketserver.TCPServer.__init__(self, server_address,
2576
1944
RequestHandlerClass)
2577
1945
2578
1946
def server_bind(self):
2579
1947
"""This overrides the normal server_bind() function
2580
1948
to bind to an interface if one was specified, and also NOT to
2581
1949
bind to an address or port if they were not specified."""
2582
global SO_BINDTODEVICE
2583
1950
if self.interface is not None:
2584
1951
if SO_BINDTODEVICE is None:
2585
# Fall back to a hard-coded value which seems to be
2586
# common enough.
2587
logger.warning("SO_BINDTODEVICE not found, trying 25")
2588
SO_BINDTODEVICE = 25
2589
try:
2590
self.socket.setsockopt(
2591
socket.SOL_SOCKET, SO_BINDTODEVICE,
2592
(self.interface + "\0").encode("utf-8"))
2593
except socket.error as error:
2594
if error.errno == errno.EPERM:
2595
logger.error("No permission to bind to"
2596
" interface %s", self.interface)
2597
elif error.errno == errno.ENOPROTOOPT:
2598
logger.error("SO_BINDTODEVICE not available;"
2599
" cannot bind to interface %s",
2600
self.interface)
2601
elif error.errno == errno.ENODEV:
2602
logger.error("Interface %s does not exist,"
2603
" cannot bind", self.interface)
2604
else:
2605
raise
1952
logger.error("SO_BINDTODEVICE does not exist;"
1953
" cannot bind to interface %s",
1954
self.interface)
1955
else:
1956
try:
1957
self.socket.setsockopt(socket.SOL_SOCKET,
1958
SO_BINDTODEVICE,
1959
str(self.interface + '\0'))
1960
except socket.error as error:
1961
if error.errno == errno.EPERM:
1962
logger.error("No permission to bind to"
1963
" interface %s", self.interface)
1964
elif error.errno == errno.ENOPROTOOPT:
1965
logger.error("SO_BINDTODEVICE not available;"
1966
" cannot bind to interface %s",
1967
self.interface)
1968
elif error.errno == errno.ENODEV:
1969
logger.error("Interface %s does not exist,"
1970
" cannot bind", self.interface)
1971
else:
1972
raise
2606
1973
# Only bind(2) the socket if we really need to.
2607
1974
if self.server_address[0] or self.server_address[1]:
2608
1975
if not self.server_address[0]:
2609
1976
if self.address_family == socket.AF_INET6:
2610
any_address = "::" # in6addr_any
1977
any_address = "::" # in6addr_any
2611
1978
else:
2612
any_address = "0.0.0.0" # INADDR_ANY
1979
any_address = socket.INADDR_ANY
2613
1980
self.server_address = (any_address,
2614
1981
self.server_address[1])
2615
1982
elif not self.server_address[1]:
2616
self.server_address = (self.server_address[0], 0)
1983
self.server_address = (self.server_address[0],
1984
0)
2617
1985
# if self.interface:
2618
1986
# self.server_address = (self.server_address[0],
2619
1987
# 0, # port
2625
1993
2626
1994
class MandosServer(IPv6_TCPServer):
2627
1995
"""Mandos server.
2628
1996
2629
1997
Attributes:
2630
1998
clients: set of Client objects
2631
1999
gnutls_priority GnuTLS priority string
2632
2000
use_dbus: Boolean; to emit D-Bus signals or not
2633
2634
Assumes a GLib.MainLoop event loop.
2001
2002
Assumes a gobject.MainLoop event loop.
2635
2003
"""
2636
2637
2004
def __init__(self, server_address, RequestHandlerClass,
2638
interface=None,
2639
use_ipv6=True,
2640
clients=None,
2641
gnutls_priority=None,
2642
use_dbus=True,
2643
socketfd=None):
2005
interface=None, use_ipv6=True, clients=None,
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
2644
2007
self.enabled = False
2645
2008
self.clients = clients
2646
2009
if self.clients is None:
2649
2012
self.gnutls_priority = gnutls_priority
2650
2013
IPv6_TCPServer.__init__(self, server_address,
2651
2014
RequestHandlerClass,
2652
interface=interface,
2653
use_ipv6=use_ipv6,
2654
socketfd=socketfd)
2655
2015
interface = interface,
2016
use_ipv6 = use_ipv6,
2017
socketfd = socketfd)
2656
2018
def server_activate(self):
2657
2019
if self.enabled:
2658
2020
return socketserver.TCPServer.server_activate(self)
2659
2021
2660
2022
def enable(self):
2661
2023
self.enabled = True
2662
2024
2663
2025
def add_pipe(self, parent_pipe, proc):
2664
2026
# Call "handle_ipc" for both data and EOF events
2665
GLib.io_add_watch(
2666
parent_pipe.fileno(),
2667
GLib.IO_IN | GLib.IO_HUP,
2668
functools.partial(self.handle_ipc,
2669
parent_pipe=parent_pipe,
2670
proc=proc))
2671
2672
def handle_ipc(self, source, condition,
2673
parent_pipe=None,
2674
proc=None,
2675
client_object=None):
2027
gobject.io_add_watch(parent_pipe.fileno(),
2028
gobject.IO_IN | gobject.IO_HUP,
2029
functools.partial(self.handle_ipc,
2030
parent_pipe =
2031
parent_pipe,
2032
proc = proc))
2033
2034
def handle_ipc(self, source, condition, parent_pipe=None,
2035
proc = None, client_object=None):
2676
2036
# error, or the other end of multiprocessing.Pipe has closed
2677
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2678
2038
# Wait for other process to exit
2679
2039
proc.join()
2680
2040
return False
2681
2041
2682
2042
# Read a request from the child
2683
2043
request = parent_pipe.recv()
2684
2044
command = request[0]
2685
2045
2686
2046
if command == 'init':
2687
key_id = request[1].decode("ascii")
2688
fpr = request[2].decode("ascii")
2689
address = request[3]
2690
2691
for c in self.clients.values():
2692
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2693
continue
2694
if key_id and c.key_id == key_id:
2695
client = c
2696
break
2697
if fpr and c.fingerprint == fpr:
2047
fpr = request[1]
2048
address = request[2]
2049
2050
for c in self.clients.itervalues():
2051
if c.fingerprint == fpr:
2698
2052
client = c
2699
2053
break
2700
2054
else:
2701
logger.info("Client not found for key ID: %s, address"
2702
": %s", key_id or fpr, address)
2055
logger.info("Client not found for fingerprint: %s, ad"
2056
"dress: %s", fpr, address)
2703
2057
if self.use_dbus:
2704
2058
# Emit D-Bus signal
2705
mandos_dbus_service.ClientNotFound(key_id or fpr,
2059
mandos_dbus_service.ClientNotFound(fpr,
2706
2060
address[0])
2707
2061
parent_pipe.send(False)
2708
2062
return False
2709
2710
GLib.io_add_watch(
2711
parent_pipe.fileno(),
2712
GLib.IO_IN | GLib.IO_HUP,
2713
functools.partial(self.handle_ipc,
2714
parent_pipe=parent_pipe,
2715
proc=proc,
2716
client_object=client))
2063
2064
gobject.io_add_watch(parent_pipe.fileno(),
2065
gobject.IO_IN | gobject.IO_HUP,
2066
functools.partial(self.handle_ipc,
2067
parent_pipe =
2068
parent_pipe,
2069
proc = proc,
2070
client_object =
2071
client))
2717
2072
parent_pipe.send(True)
2718
2073
# remove the old hook in favor of the new above hook on
2719
2074
# same fileno
2722
2077
funcname = request[1]
2723
2078
args = request[2]
2724
2079
kwargs = request[3]
2725
2080
2726
2081
parent_pipe.send(('data', getattr(client_object,
2727
2082
funcname)(*args,
2728
**kwargs)))
2729
2083
**kwargs)))
2084
2730
2085
if command == 'getattr':
2731
2086
attrname = request[1]
2732
if isinstance(client_object.__getattribute__(attrname),
2733
collections.Callable):
2734
parent_pipe.send(('function', ))
2087
if callable(client_object.__getattribute__(attrname)):
2088
parent_pipe.send(('function',))
2735
2089
else:
2736
parent_pipe.send((
2737
'data', client_object.__getattribute__(attrname)))
2738
2090
parent_pipe.send(('data', client_object
2091
.__getattribute__(attrname)))
2092
2739
2093
if command == 'setattr':
2740
2094
attrname = request[1]
2741
2095
value = request[2]
2742
2096
setattr(client_object, attrname, value)
2743
2097
2744
2098
return True
2745
2099
2746
2100
2747
2101
def rfc3339_duration_to_delta(duration):
2748
2102
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2749
2103
2750
2104
>>> rfc3339_duration_to_delta("P7D")
2751
2105
datetime.timedelta(7)
2752
2106
>>> rfc3339_duration_to_delta("PT60S")
2762
2116
>>> rfc3339_duration_to_delta("P1DT3M20S")
2763
2117
datetime.timedelta(1, 200)
2764
2118
"""
2765
2119
2766
2120
# Parsing an RFC 3339 duration with regular expressions is not
2767
2121
# possible - there would have to be multiple places for the same
2768
2122
# values, like seconds. The current code, while more esoteric, is
2769
2123
# cleaner without depending on a parsing library. If Python had a
2770
2124
# built-in library for parsing we would use it, but we'd like to
2771
2125
# avoid excessive use of external libraries.
2772
2126
2773
2127
# New type for defining tokens, syntax, and semantics all-in-one
2774
Token = collections.namedtuple("Token", (
2775
"regexp", # To match token; if "value" is not None, must have
2776
# a "group" containing digits
2777
"value", # datetime.timedelta or None
2778
"followers")) # Tokens valid after this token
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2132
# containing digits
2133
"value", # datetime.timedelta or
2134
# None
2135
"followers")) # Tokens valid after
2136
# this token
2779
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2780
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2781
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2782
2140
token_second = Token(re.compile(r"(\d+)S"),
2783
2141
datetime.timedelta(seconds=1),
2784
frozenset((token_end, )))
2142
frozenset((token_end,)))
2785
2143
token_minute = Token(re.compile(r"(\d+)M"),
2786
2144
datetime.timedelta(minutes=1),
2787
2145
frozenset((token_second, token_end)))
2803
2161
frozenset((token_month, token_end)))
2804
2162
token_week = Token(re.compile(r"(\d+)W"),
2805
2163
datetime.timedelta(weeks=1),
2806
frozenset((token_end, )))
2164
frozenset((token_end,)))
2807
2165
token_duration = Token(re.compile(r"P"), None,
2808
2166
frozenset((token_year, token_month,
2809
2167
token_day, token_time,
2810
token_week)))
2811
# Define starting values:
2812
# Value so far
2813
value = datetime.timedelta()
2168
token_week))),
2169
# Define starting values
2170
value = datetime.timedelta() # Value so far
2814
2171
found_token = None
2815
# Following valid tokens
2816
followers = frozenset((token_duration, ))
2817
# String left to parse
2818
s = duration
2172
followers = frozenset(token_duration,) # Following valid tokens
2173
s = duration # String left to parse
2819
2174
# Loop until end token is found
2820
2175
while found_token is not token_end:
2821
2176
# Search for any currently valid tokens
2837
2192
break
2838
2193
else:
2839
2194
# No currently valid tokens were found
2840
raise ValueError("Invalid RFC 3339 duration: {!r}"
2841
.format(duration))
2195
raise ValueError("Invalid RFC 3339 duration")
2842
2196
# End token found
2843
2197
return value
2844
2198
2845
2199
2846
2200
def string_to_delta(interval):
2847
2201
"""Parse a string and return a datetime.timedelta
2848
2202
2849
2203
>>> string_to_delta('7d')
2850
2204
datetime.timedelta(7)
2851
2205
>>> string_to_delta('60s')
2859
2213
>>> string_to_delta('5m 30s')
2860
2214
datetime.timedelta(0, 330)
2861
2215
"""
2862
2216
2863
2217
try:
2864
2218
return rfc3339_duration_to_delta(interval)
2865
2219
except ValueError:
2866
2220
pass
2867
2221
2868
2222
timevalue = datetime.timedelta(0)
2869
2223
for s in interval.split():
2870
2224
try:
2871
suffix = s[-1]
2225
suffix = unicode(s[-1])
2872
2226
value = int(s[:-1])
2873
2227
if suffix == "d":
2874
2228
delta = datetime.timedelta(value)
2881
2235
elif suffix == "w":
2882
2236
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2883
2237
else:
2884
raise ValueError("Unknown suffix {!r}".format(suffix))
2885
except IndexError as e:
2238
raise ValueError("Unknown suffix {0!r}"
2239
.format(suffix))
2240
except (ValueError, IndexError) as e:
2886
2241
raise ValueError(*(e.args))
2887
2242
timevalue += delta
2888
2243
return timevalue
2889
2244
2890
2245
2891
def daemon(nochdir=False, noclose=False):
2246
def daemon(nochdir = False, noclose = False):
2892
2247
"""See daemon(3). Standard BSD Unix function.
2893
2248
2894
2249
This should really exist as os.daemon, but it doesn't (yet)."""
2895
2250
if os.fork():
2896
2251
sys.exit()
2904
2259
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2905
2260
if not stat.S_ISCHR(os.fstat(null).st_mode):
2906
2261
raise OSError(errno.ENODEV,
2907
"{} not a character device"
2262
"{0} not a character device"
2908
2263
.format(os.devnull))
2909
2264
os.dup2(null, sys.stdin.fileno())
2910
2265
os.dup2(null, sys.stdout.fileno())
2914
2269
2915
2270
2916
2271
def main():
2917
2272
2918
2273
##################################################################
2919
2274
# Parsing of options, both command line and config file
2920
2275
2921
2276
parser = argparse.ArgumentParser()
2922
2277
parser.add_argument("-v", "--version", action="version",
2923
version="%(prog)s {}".format(version),
2278
version = "%(prog)s {0}".format(version),
2924
2279
help="show version number and exit")
2925
2280
parser.add_argument("-i", "--interface", metavar="IF",
2926
2281
help="Bind to interface IF")
2932
2287
help="Run self-test")
2933
2288
parser.add_argument("--debug", action="store_true",
2934
2289
help="Debug mode; run in foreground and log"
2935
" to terminal", default=None)
2290
" to terminal")
2936
2291
parser.add_argument("--debuglevel", metavar="LEVEL",
2937
2292
help="Debug level for stdout output")
2938
2293
parser.add_argument("--priority", help="GnuTLS"
2945
2300
" files")
2946
2301
parser.add_argument("--no-dbus", action="store_false",
2947
2302
dest="use_dbus", help="Do not provide D-Bus"
2948
" system bus interface", default=None)
2303
" system bus interface")
2949
2304
parser.add_argument("--no-ipv6", action="store_false",
2950
dest="use_ipv6", help="Do not use IPv6",
2951
default=None)
2305
dest="use_ipv6", help="Do not use IPv6")
2952
2306
parser.add_argument("--no-restore", action="store_false",
2953
2307
dest="restore", help="Do not restore stored"
2954
" state", default=None)
2308
" state")
2955
2309
parser.add_argument("--socket", type=int,
2956
2310
help="Specify a file descriptor to a network"
2957
2311
" socket to use instead of creating one")
2958
2312
parser.add_argument("--statedir", metavar="DIR",
2959
2313
help="Directory to save/restore state in")
2960
2314
parser.add_argument("--foreground", action="store_true",
2961
help="Run in foreground", default=None)
2962
parser.add_argument("--no-zeroconf", action="store_false",
2963
dest="zeroconf", help="Do not use Zeroconf",
2964
default=None)
2965
2315
help="Run in foreground")
2316
2966
2317
options = parser.parse_args()
2967
2318
2968
2319
if options.check:
2969
2320
import doctest
2970
fail_count, test_count = doctest.testmod()
2971
sys.exit(os.EX_OK if fail_count == 0 else 1)
2972
2321
doctest.testmod()
2322
sys.exit()
2323
2973
2324
# Default values for config file for server-global settings
2974
if gnutls.has_rawpk:
2975
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2976
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2977
else:
2978
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2979
":+SIGN-DSA-SHA256")
2980
server_defaults = {"interface": "",
2981
"address": "",
2982
"port": "",
2983
"debug": "False",
2984
"priority": priority,
2985
"servicename": "Mandos",
2986
"use_dbus": "True",
2987
"use_ipv6": "True",
2988
"debuglevel": "",
2989
"restore": "True",
2990
"socket": "",
2991
"statedir": "/var/lib/mandos",
2992
"foreground": "False",
2993
"zeroconf": "True",
2994
}
2995
del priority
2996
2325
server_defaults = { "interface": "",
2326
"address": "",
2327
"port": "",
2328
"debug": "False",
2329
"priority":
2330
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2331
"servicename": "Mandos",
2332
"use_dbus": "True",
2333
"use_ipv6": "True",
2334
"debuglevel": "",
2335
"restore": "True",
2336
"socket": "",
2337
"statedir": "/var/lib/mandos",
2338
"foreground": "False",
2339
}
2340
2997
2341
# Parse config file for server-global settings
2998
2342
server_config = configparser.SafeConfigParser(server_defaults)
2999
2343
del server_defaults
3000
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2344
server_config.read(os.path.join(options.configdir,
2345
"mandos.conf"))
3001
2346
# Convert the SafeConfigParser object to a dict
3002
2347
server_settings = server_config.defaults()
3003
2348
# Use the appropriate methods on the non-string config options
3004
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3005
"foreground", "zeroconf"):
2349
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3006
2350
server_settings[option] = server_config.getboolean("DEFAULT",
3007
2351
option)
3008
2352
if server_settings["port"]:
3018
2362
server_settings["socket"] = os.dup(server_settings
3019
2363
["socket"])
3020
2364
del server_config
3021
2365
3022
2366
# Override the settings from the config file with command line
3023
2367
# options, if set.
3024
2368
for option in ("interface", "address", "port", "debug",
3025
"priority", "servicename", "configdir", "use_dbus",
3026
"use_ipv6", "debuglevel", "restore", "statedir",
3027
"socket", "foreground", "zeroconf"):
2369
"priority", "servicename", "configdir",
2370
"use_dbus", "use_ipv6", "debuglevel", "restore",
2371
"statedir", "socket", "foreground"):
3028
2372
value = getattr(options, option)
3029
2373
if value is not None:
3030
2374
server_settings[option] = value
3031
2375
del options
3032
2376
# Force all strings to be unicode
3033
2377
for option in server_settings.keys():
3034
if isinstance(server_settings[option], bytes):
3035
server_settings[option] = (server_settings[option]
3036
.decode("utf-8"))
3037
# Force all boolean options to be boolean
3038
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3039
"foreground", "zeroconf"):
3040
server_settings[option] = bool(server_settings[option])
2378
if type(server_settings[option]) is str:
2379
server_settings[option] = unicode(server_settings[option])
3041
2380
# Debug implies foreground
3042
2381
if server_settings["debug"]:
3043
2382
server_settings["foreground"] = True
3044
2383
# Now we have our good server settings in "server_settings"
3045
2384
3046
2385
##################################################################
3047
3048
if (not server_settings["zeroconf"]
3049
and not (server_settings["port"]
3050
or server_settings["socket"] != "")):
3051
parser.error("Needs port or socket to work without Zeroconf")
3052
2386
3053
2387
# For convenience
3054
2388
debug = server_settings["debug"]
3055
2389
debuglevel = server_settings["debuglevel"]
3058
2392
stored_state_path = os.path.join(server_settings["statedir"],
3059
2393
stored_state_file)
3060
2394
foreground = server_settings["foreground"]
3061
zeroconf = server_settings["zeroconf"]
3062
2395
3063
2396
if debug:
3064
2397
initlogger(debug, logging.DEBUG)
3065
2398
else:
3068
2401
else:
3069
2402
level = getattr(logging, debuglevel.upper())
3070
2403
initlogger(debug, level)
3071
2404
3072
2405
if server_settings["servicename"] != "Mandos":
3073
syslogger.setFormatter(
3074
logging.Formatter('Mandos ({}) [%(process)d]:'
3075
' %(levelname)s: %(message)s'.format(
3076
server_settings["servicename"])))
3077
2406
syslogger.setFormatter(logging.Formatter
2407
('Mandos ({0}) [%(process)d]:'
2408
' %(levelname)s: %(message)s'
2409
.format(server_settings
2410
["servicename"])))
2411
3078
2412
# Parse config file with clients
3079
2413
client_config = configparser.SafeConfigParser(Client
3080
2414
.client_defaults)
3081
2415
client_config.read(os.path.join(server_settings["configdir"],
3082
2416
"clients.conf"))
3083
2417
3084
2418
global mandos_dbus_service
3085
2419
mandos_dbus_service = None
3086
3087
socketfd = None
3088
if server_settings["socket"] != "":
3089
socketfd = server_settings["socket"]
3090
tcp_server = MandosServer(
3091
(server_settings["address"], server_settings["port"]),
3092
ClientHandler,
3093
interface=(server_settings["interface"] or None),
3094
use_ipv6=use_ipv6,
3095
gnutls_priority=server_settings["priority"],
3096
use_dbus=use_dbus,
3097
socketfd=socketfd)
2420
2421
tcp_server = MandosServer((server_settings["address"],
2422
server_settings["port"]),
2423
ClientHandler,
2424
interface=(server_settings["interface"]
2425
or None),
2426
use_ipv6=use_ipv6,
2427
gnutls_priority=
2428
server_settings["priority"],
2429
use_dbus=use_dbus,
2430
socketfd=(server_settings["socket"]
2431
or None))
3098
2432
if not foreground:
3099
pidfilename = "/run/mandos.pid"
3100
if not os.path.isdir("/run/."):
3101
pidfilename = "/var/run/mandos.pid"
2433
pidfilename = "/var/run/mandos.pid"
3102
2434
pidfile = None
3103
2435
try:
3104
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2436
pidfile = open(pidfilename, "w")
3105
2437
except IOError as e:
3106
2438
logger.error("Could not open file %r", pidfilename,
3107
2439
exc_info=e)
3108
3109
for name, group in (("_mandos", "_mandos"),
3110
("mandos", "mandos"),
3111
("nobody", "nogroup")):
2440
2441
for name in ("_mandos", "mandos", "nobody"):
3112
2442
try:
3113
2443
uid = pwd.getpwnam(name).pw_uid
3114
gid = pwd.getpwnam(group).pw_gid
2444
gid = pwd.getpwnam(name).pw_gid
3115
2445
break
3116
2446
except KeyError:
3117
2447
continue
3121
2451
try:
3122
2452
os.setgid(gid)
3123
2453
os.setuid(uid)
3124
if debug:
3125
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3126
gid))
3127
2454
except OSError as error:
3128
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3129
.format(uid, gid, os.strerror(error.errno)))
3130
2455
if error.errno != errno.EPERM:
3131
raise
3132
2456
raise error
2457
3133
2458
if debug:
3134
2459
# Enable all possible GnuTLS debugging
3135
2460
3136
2461
# "Use a log level over 10 to enable all debugging options."
3137
2462
# - GnuTLS manual
3138
gnutls.global_set_log_level(11)
3139
3140
@gnutls.log_func
2463
gnutls.library.functions.gnutls_global_set_log_level(11)
2464
2465
@gnutls.library.types.gnutls_log_func
3141
2466
def debug_gnutls(level, string):
3142
2467
logger.debug("GnuTLS: %s", string[:-1])
3143
3144
gnutls.global_set_log_function(debug_gnutls)
3145
2468
2469
(gnutls.library.functions
2470
.gnutls_global_set_log_function(debug_gnutls))
2471
3146
2472
# Redirect stdin so all checkers get /dev/null
3147
2473
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3148
2474
os.dup2(null, sys.stdin.fileno())
3149
2475
if null > 2:
3150
2476
os.close(null)
3151
2477
3152
2478
# Need to fork before connecting to D-Bus
3153
2479
if not foreground:
3154
2480
# Close all input and output, do double fork, etc.
3155
2481
daemon()
3156
3157
# multiprocessing will use threads, so before we use GLib we need
3158
# to inform GLib that threads will be used.
3159
GLib.threads_init()
3160
2482
2483
# multiprocessing will use threads, so before we use gobject we
2484
# need to inform gobject that threads will be used.
2485
gobject.threads_init()
2486
3161
2487
global main_loop
3162
2488
# From the Avahi example code
3163
2489
DBusGMainLoop(set_as_default=True)
3164
main_loop = GLib.MainLoop()
2490
main_loop = gobject.MainLoop()
3165
2491
bus = dbus.SystemBus()
3166
2492
# End of Avahi example code
3167
2493
if use_dbus:
3168
2494
try:
3169
2495
bus_name = dbus.service.BusName("se.recompile.Mandos",
3170
bus,
3171
do_not_queue=True)
3172
old_bus_name = dbus.service.BusName(
3173
"se.bsnet.fukt.Mandos", bus,
3174
do_not_queue=True)
3175
except dbus.exceptions.DBusException as e:
2496
bus, do_not_queue=True)
2497
old_bus_name = (dbus.service.BusName
2498
("se.bsnet.fukt.Mandos", bus,
2499
do_not_queue=True))
2500
except dbus.exceptions.NameExistsException as e:
3176
2501
logger.error("Disabling D-Bus:", exc_info=e)
3177
2502
use_dbus = False
3178
2503
server_settings["use_dbus"] = False
3179
2504
tcp_server.use_dbus = False
3180
if zeroconf:
3181
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3182
service = AvahiServiceToSyslog(
3183
name=server_settings["servicename"],
3184
servicetype="_mandos._tcp",
3185
protocol=protocol,
3186
bus=bus)
3187
if server_settings["interface"]:
3188
service.interface = if_nametoindex(
3189
server_settings["interface"].encode("utf-8"))
3190
2505
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2506
service = AvahiServiceToSyslog(name =
2507
server_settings["servicename"],
2508
servicetype = "_mandos._tcp",
2509
protocol = protocol, bus = bus)
2510
if server_settings["interface"]:
2511
service.interface = (if_nametoindex
2512
(str(server_settings["interface"])))
2513
3191
2514
global multiprocessing_manager
3192
2515
multiprocessing_manager = multiprocessing.Manager()
3193
2516
3194
2517
client_class = Client
3195
2518
if use_dbus:
3196
client_class = functools.partial(ClientDBus, bus=bus)
3197
2519
client_class = functools.partial(ClientDBus, bus = bus)
2520
3198
2521
client_settings = Client.config_parser(client_config)
3199
2522
old_client_settings = {}
3200
2523
clients_data = {}
3201
3202
# This is used to redirect stdout and stderr for checker processes
3203
global wnull
3204
wnull = open(os.devnull, "w") # A writable /dev/null
3205
# Only used if server is running in foreground but not in debug
3206
# mode
3207
if debug or not foreground:
3208
wnull.close()
3209
2524
3210
2525
# Get client data and settings from last running state.
3211
2526
if server_settings["restore"]:
3212
2527
try:
3213
2528
with open(stored_state_path, "rb") as stored_state:
3214
if sys.version_info.major == 2:
3215
clients_data, old_client_settings = pickle.load(
3216
stored_state)
3217
else:
3218
bytes_clients_data, bytes_old_client_settings = (
3219
pickle.load(stored_state, encoding="bytes"))
3220
# Fix bytes to strings
3221
# clients_data
3222
# .keys()
3223
clients_data = {(key.decode("utf-8")
3224
if isinstance(key, bytes)
3225
else key): value
3226
for key, value in
3227
bytes_clients_data.items()}
3228
del bytes_clients_data
3229
for key in clients_data:
3230
value = {(k.decode("utf-8")
3231
if isinstance(k, bytes) else k): v
3232
for k, v in
3233
clients_data[key].items()}
3234
clients_data[key] = value
3235
# .client_structure
3236
value["client_structure"] = [
3237
(s.decode("utf-8")
3238
if isinstance(s, bytes)
3239
else s) for s in
3240
value["client_structure"]]
3241
# .name & .host
3242
for k in ("name", "host"):
3243
if isinstance(value[k], bytes):
3244
value[k] = value[k].decode("utf-8")
3245
if not value.has_key("key_id"):
3246
value["key_id"] = ""
3247
elif not value.has_key("fingerprint"):
3248
value["fingerprint"] = ""
3249
# old_client_settings
3250
# .keys()
3251
old_client_settings = {
3252
(key.decode("utf-8")
3253
if isinstance(key, bytes)
3254
else key): value
3255
for key, value in
3256
bytes_old_client_settings.items()}
3257
del bytes_old_client_settings
3258
# .host
3259
for value in old_client_settings.values():
3260
if isinstance(value["host"], bytes):
3261
value["host"] = (value["host"]
3262
.decode("utf-8"))
2529
clients_data, old_client_settings = (pickle.load
2530
(stored_state))
3263
2531
os.remove(stored_state_path)
3264
2532
except IOError as e:
3265
2533
if e.errno == errno.ENOENT:
3266
logger.warning("Could not load persistent state:"
3267
" {}".format(os.strerror(e.errno)))
2534
logger.warning("Could not load persistent state: {0}"
2535
.format(os.strerror(e.errno)))
3268
2536
else:
3269
2537
logger.critical("Could not load persistent state:",
3270
2538
exc_info=e)
3271
2539
raise
3272
2540
except EOFError as e:
3273
2541
logger.warning("Could not load persistent state: "
3274
"EOFError:",
3275
exc_info=e)
3276
2542
"EOFError:", exc_info=e)
2543
3277
2544
with PGPEngine() as pgp:
3278
for client_name, client in clients_data.items():
3279
# Skip removed clients
3280
if client_name not in client_settings:
3281
continue
3282
2545
for client_name, client in clients_data.iteritems():
3283
2546
# Decide which value to use after restoring saved state.
3284
2547
# We have three different values: Old config file,
3285
2548
# new config file, and saved state.
3290
2553
# For each value in new config, check if it
3291
2554
# differs from the old config value (Except for
3292
2555
# the "secret" attribute)
3293
if (name != "secret"
3294
and (value !=
3295
old_client_settings[client_name][name])):
2556
if (name != "secret" and
2557
value != old_client_settings[client_name]
2558
[name]):
3296
2559
client[name] = value
3297
2560
except KeyError:
3298
2561
pass
3299
2562
3300
2563
# Clients who has passed its expire date can still be
3301
# enabled if its last checker was successful. A Client
2564
# enabled if its last checker was successful. Clients
3302
2565
# whose checker succeeded before we stored its state is
3303
2566
# assumed to have successfully run all checkers during
3304
2567
# downtime.
3306
2569
if datetime.datetime.utcnow() >= client["expires"]:
3307
2570
if not client["last_checked_ok"]:
3308
2571
logger.warning(
3309
"disabling client {} - Client never "
3310
"performed a successful checker".format(
3311
client_name))
2572
"disabling client {0} - Client never "
2573
"performed a successful checker"
2574
.format(client_name))
3312
2575
client["enabled"] = False
3313
2576
elif client["last_checker_status"] != 0:
3314
2577
logger.warning(
3315
"disabling client {} - Client last"
3316
" checker failed with error code"
3317
" {}".format(
3318
client_name,
3319
client["last_checker_status"]))
2578
"disabling client {0} - Client "
2579
"last checker failed with error code {1}"
2580
.format(client_name,
2581
client["last_checker_status"]))
3320
2582
client["enabled"] = False
3321
2583
else:
3322
client["expires"] = (
3323
datetime.datetime.utcnow()
3324
+ client["timeout"])
2584
client["expires"] = (datetime.datetime
2585
.utcnow()
2586
+ client["timeout"])
3325
2587
logger.debug("Last checker succeeded,"
3326
" keeping {} enabled".format(
3327
client_name))
2588
" keeping {0} enabled"
2589
.format(client_name))
3328
2590
try:
3329
client["secret"] = pgp.decrypt(
3330
client["encrypted_secret"],
3331
client_settings[client_name]["secret"])
2591
client["secret"] = (
2592
pgp.decrypt(client["encrypted_secret"],
2593
client_settings[client_name]
2594
["secret"]))
3332
2595
except PGPError:
3333
2596
# If decryption fails, we use secret from new settings
3334
logger.debug("Failed to decrypt {} old secret".format(
3335
client_name))
3336
client["secret"] = (client_settings[client_name]
3337
["secret"])
3338
2597
logger.debug("Failed to decrypt {0} old secret"
2598
.format(client_name))
2599
client["secret"] = (
2600
client_settings[client_name]["secret"])
2601
3339
2602
# Add/remove clients based on new changes made to config
3340
2603
for client_name in (set(old_client_settings)
3341
2604
- set(client_settings)):
3343
2606
for client_name in (set(client_settings)
3344
2607
- set(old_client_settings)):
3345
2608
clients_data[client_name] = client_settings[client_name]
3346
2609
3347
2610
# Create all client objects
3348
for client_name, client in clients_data.items():
2611
for client_name, client in clients_data.iteritems():
3349
2612
tcp_server.clients[client_name] = client_class(
3350
name=client_name,
3351
settings=client,
3352
server_settings=server_settings)
3353
2613
name = client_name, settings = client)
2614
3354
2615
if not tcp_server.clients:
3355
2616
logger.warning("No clients defined")
3356
2617
3357
2618
if not foreground:
3358
2619
if pidfile is not None:
3359
pid = os.getpid()
3360
2620
try:
3361
2621
with pidfile:
3362
print(pid, file=pidfile)
2622
pid = os.getpid()
2623
pidfile.write(str(pid) + "\n".encode("utf-8"))
3363
2624
except IOError:
3364
2625
logger.error("Could not write to file %r with PID %d",
3365
2626
pidfilename, pid)
3366
2627
del pidfile
3367
2628
del pidfilename
3368
3369
for termsig in (signal.SIGHUP, signal.SIGTERM):
3370
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3371
lambda: main_loop.quit() and False)
3372
2629
2630
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2631
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2632
3373
2633
if use_dbus:
3374
3375
@alternate_dbus_interfaces(
3376
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3377
class MandosDBusService(DBusObjectWithObjectManager):
2634
@alternate_dbus_interfaces({"se.recompile.Mandos":
2635
"se.bsnet.fukt.Mandos"})
2636
class MandosDBusService(DBusObjectWithProperties):
3378
2637
"""A D-Bus proxy object"""
3379
3380
2638
def __init__(self):
3381
2639
dbus.service.Object.__init__(self, bus, "/")
3382
3383
2640
_interface = "se.recompile.Mandos"
3384
2641
2642
@dbus_interface_annotations(_interface)
2643
def _foo(self):
2644
return { "org.freedesktop.DBus.Property"
2645
".EmitsChangedSignal":
2646
"false"}
2647
3385
2648
@dbus.service.signal(_interface, signature="o")
3386
2649
def ClientAdded(self, objpath):
3387
2650
"D-Bus signal"
3388
2651
pass
3389
2652
3390
2653
@dbus.service.signal(_interface, signature="ss")
3391
def ClientNotFound(self, key_id, address):
2654
def ClientNotFound(self, fingerprint, address):
3392
2655
"D-Bus signal"
3393
2656
pass
3394
3395
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3396
"true"})
2657
3397
2658
@dbus.service.signal(_interface, signature="os")
3398
2659
def ClientRemoved(self, objpath, name):
3399
2660
"D-Bus signal"
3400
2661
pass
3401
3402
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3403
"true"})
2662
3404
2663
@dbus.service.method(_interface, out_signature="ao")
3405
2664
def GetAllClients(self):
3406
2665
"D-Bus method"
3407
return dbus.Array(c.dbus_object_path for c in
3408
tcp_server.clients.values())
3409
3410
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3411
"true"})
2666
return dbus.Array(c.dbus_object_path
2667
for c in
2668
tcp_server.clients.itervalues())
2669
3412
2670
@dbus.service.method(_interface,
3413
2671
out_signature="a{oa{sv}}")
3414
2672
def GetAllClientsWithProperties(self):
3415
2673
"D-Bus method"
3416
2674
return dbus.Dictionary(
3417
{c.dbus_object_path: c.GetAll(
3418
"se.recompile.Mandos.Client")
3419
for c in tcp_server.clients.values()},
2675
((c.dbus_object_path, c.GetAll(""))
2676
for c in tcp_server.clients.itervalues()),
3420
2677
signature="oa{sv}")
3421
2678
3422
2679
@dbus.service.method(_interface, in_signature="o")
3423
2680
def RemoveClient(self, object_path):
3424
2681
"D-Bus method"
3425
for c in tcp_server.clients.values():
2682
for c in tcp_server.clients.itervalues():
3426
2683
if c.dbus_object_path == object_path:
3427
2684
del tcp_server.clients[c.name]
3428
2685
c.remove_from_connection()
3429
# Don't signal the disabling
2686
# Don't signal anything except ClientRemoved
3430
2687
c.disable(quiet=True)
3431
# Emit D-Bus signal for removal
3432
self.client_removed_signal(c)
2688
# Emit D-Bus signal
2689
self.ClientRemoved(object_path, c.name)
3433
2690
return
3434
2691
raise KeyError(object_path)
3435
2692
3436
2693
del _interface
3437
3438
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3439
out_signature="a{oa{sa{sv}}}")
3440
def GetManagedObjects(self):
3441
"""D-Bus method"""
3442
return dbus.Dictionary(
3443
{client.dbus_object_path:
3444
dbus.Dictionary(
3445
{interface: client.GetAll(interface)
3446
for interface in
3447
client._get_all_interface_names()})
3448
for client in tcp_server.clients.values()})
3449
3450
def client_added_signal(self, client):
3451
"""Send the new standard signal and the old signal"""
3452
if use_dbus:
3453
# New standard signal
3454
self.InterfacesAdded(
3455
client.dbus_object_path,
3456
dbus.Dictionary(
3457
{interface: client.GetAll(interface)
3458
for interface in
3459
client._get_all_interface_names()}))
3460
# Old signal
3461
self.ClientAdded(client.dbus_object_path)
3462
3463
def client_removed_signal(self, client):
3464
"""Send the new standard signal and the old signal"""
3465
if use_dbus:
3466
# New standard signal
3467
self.InterfacesRemoved(
3468
client.dbus_object_path,
3469
client._get_all_interface_names())
3470
# Old signal
3471
self.ClientRemoved(client.dbus_object_path,
3472
client.name)
3473
2694
3474
2695
mandos_dbus_service = MandosDBusService()
3475
3476
# Save modules to variables to exempt the modules from being
3477
# unloaded before the function registered with atexit() is run.
3478
mp = multiprocessing
3479
wn = wnull
3480
2696
3481
2697
def cleanup():
3482
2698
"Cleanup function; run on exit"
3483
if zeroconf:
3484
service.cleanup()
3485
3486
mp.active_children()
3487
wn.close()
2699
service.cleanup()
2700
2701
multiprocessing.active_children()
3488
2702
if not (tcp_server.clients or client_settings):
3489
2703
return
3490
2704
3491
2705
# Store client before exiting. Secrets are encrypted with key
3492
2706
# based on what config file has. If config file is
3493
2707
# removed/edited, old secret will thus be unrecovable.
3494
2708
clients = {}
3495
2709
with PGPEngine() as pgp:
3496
for client in tcp_server.clients.values():
2710
for client in tcp_server.clients.itervalues():
3497
2711
key = client_settings[client.name]["secret"]
3498
2712
client.encrypted_secret = pgp.encrypt(client.secret,
3499
2713
key)
3500
2714
client_dict = {}
3501
2715
3502
2716
# A list of attributes that can not be pickled
3503
2717
# + secret.
3504
exclude = {"bus", "changedstate", "secret",
3505
"checker", "server_settings"}
3506
for name, typ in inspect.getmembers(dbus.service
3507
.Object):
2718
exclude = set(("bus", "changedstate", "secret",
2719
"checker"))
2720
for name, typ in (inspect.getmembers
2721
(dbus.service.Object)):
3508
2722
exclude.add(name)
3509
2723
3510
2724
client_dict["encrypted_secret"] = (client
3511
2725
.encrypted_secret)
3512
2726
for attr in client.client_structure:
3513
2727
if attr not in exclude:
3514
2728
client_dict[attr] = getattr(client, attr)
3515
2729
3516
2730
clients[client.name] = client_dict
3517
2731
del client_settings[client.name]["secret"]
3518
2732
3519
2733
try:
3520
with tempfile.NamedTemporaryFile(
3521
mode='wb',
3522
suffix=".pickle",
3523
prefix='clients-',
3524
dir=os.path.dirname(stored_state_path),
3525
delete=False) as stored_state:
3526
pickle.dump((clients, client_settings), stored_state,
3527
protocol=2)
3528
tempname = stored_state.name
2734
with (tempfile.NamedTemporaryFile
2735
(mode='wb', suffix=".pickle", prefix='clients-',
2736
dir=os.path.dirname(stored_state_path),
2737
delete=False)) as stored_state:
2738
pickle.dump((clients, client_settings), stored_state)
2739
tempname=stored_state.name
3529
2740
os.rename(tempname, stored_state_path)
3530
2741
except (IOError, OSError) as e:
3531
2742
if not debug:
3534
2745
except NameError:
3535
2746
pass
3536
2747
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3537
logger.warning("Could not save persistent state: {}"
2748
logger.warning("Could not save persistent state: {0}"
3538
2749
.format(os.strerror(e.errno)))
3539
2750
else:
3540
2751
logger.warning("Could not save persistent state:",
3541
2752
exc_info=e)
3542
raise
3543
2753
raise e
2754
3544
2755
# Delete all clients, and settings from config
3545
2756
while tcp_server.clients:
3546
2757
name, client = tcp_server.clients.popitem()
3547
2758
if use_dbus:
3548
2759
client.remove_from_connection()
3549
# Don't signal the disabling
2760
# Don't signal anything except ClientRemoved
3550
2761
client.disable(quiet=True)
3551
# Emit D-Bus signal for removal
3552
2762
if use_dbus:
3553
mandos_dbus_service.client_removed_signal(client)
2763
# Emit D-Bus signal
2764
mandos_dbus_service.ClientRemoved(client
2765
.dbus_object_path,
2766
client.name)
3554
2767
client_settings.clear()
3555
2768
3556
2769
atexit.register(cleanup)
3557
3558
for client in tcp_server.clients.values():
2770
2771
for client in tcp_server.clients.itervalues():
3559
2772
if use_dbus:
3560
# Emit D-Bus signal for adding
3561
mandos_dbus_service.client_added_signal(client)
2773
# Emit D-Bus signal
2774
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3562
2775
# Need to initiate checking of clients
3563
2776
if client.enabled:
3564
2777
client.init_checker()
3565
2778
3566
2779
tcp_server.enable()
3567
2780
tcp_server.server_activate()
3568
2781
3569
2782
# Find out what port we got
3570
if zeroconf:
3571
service.port = tcp_server.socket.getsockname()[1]
2783
service.port = tcp_server.socket.getsockname()[1]
3572
2784
if use_ipv6:
3573
2785
logger.info("Now listening on address %r, port %d,"
3574
2786
" flowinfo %d, scope_id %d",
3576
2788
else: # IPv4
3577
2789
logger.info("Now listening on address %r, port %d",
3578
2790
*tcp_server.socket.getsockname())
3579
3580
# service.interface = tcp_server.socket.getsockname()[3]
3581
2791
2792
#service.interface = tcp_server.socket.getsockname()[3]
2793
3582
2794
try:
3583
if zeroconf:
3584
# From the Avahi example code
3585
try:
3586
service.activate()
3587
except dbus.exceptions.DBusException as error:
3588
logger.critical("D-Bus Exception", exc_info=error)
3589
cleanup()
3590
sys.exit(1)
3591
# End of Avahi example code
3592
3593
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3594
lambda *args, **kwargs:
3595
(tcp_server.handle_request
3596
(*args[2:], **kwargs) or True))
3597
2795
# From the Avahi example code
2796
try:
2797
service.activate()
2798
except dbus.exceptions.DBusException as error:
2799
logger.critical("D-Bus Exception", exc_info=error)
2800
cleanup()
2801
sys.exit(1)
2802
# End of Avahi example code
2803
2804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2805
lambda *args, **kwargs:
2806
(tcp_server.handle_request
2807
(*args[2:], **kwargs) or True))
2808
3598
2809
logger.debug("Starting main loop")
3599
2810
main_loop.run()
3600
2811
except AvahiError as error:
3609
2820
# Must run before the D-Bus bus name gets deregistered
3610
2821
cleanup()
3611
2822
3612
3613
2823
if __name__ == '__main__':
3614
2824
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0