/mandos/trunk : revision 654

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

72

81

73

import dbus

82

74

import dbus.service

83

from gi.repository import GLib

75

import gobject

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

86

79

import ctypes.util

87

80

import xml.dom.minidom

88

81

import inspect

89

82

90

# Try to find the value of SO_BINDTODEVICE:

91

83

try:

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

93

# newer, and it is also the most natural place for it:

94

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

95

85

except AttributeError:

96

86

try:

97

# This is where SO_BINDTODEVICE was up to and including Python

98

# 2.6, and also 3.2:

99

87

from IN import SO_BINDTODEVICE

100

88

except ImportError:

101

# In Python 2.7 it seems to have been removed entirely.

102

# Try running the C preprocessor:

103

try:

104

cc = subprocess.Popen(["cc", "--language=c", "-E",

105

"/dev/stdin"],

106

stdin=subprocess.PIPE,

107

stdout=subprocess.PIPE)

108

stdout = cc.communicate(

109

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

110

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

111

except (OSError, ValueError, IndexError):

112

# No value found

113

SO_BINDTODEVICE = None

114

115

if sys.version_info.major == 2:

116

str = unicode

117

118

version = "1.8.4"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.3"

119

92

stored_state_file = "clients.pickle"

120

93

121

94

logger = logging.getLogger()

122

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

123

98

124

99

try:

125

if_nametoindex = ctypes.cdll.LoadLibrary(

126

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

127

103

except (OSError, AttributeError):

128

129

104

def if_nametoindex(interface):

130

105

"Get an interface index the hard way, i.e. using fcntl()"

131

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

132

107

with contextlib.closing(socket.socket()) as s:

133

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

134

struct.pack(b"16s16x", interface))

135

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

136

113

return interface_index

137

114

138

115

139

def copy_function(func):

140

"""Make a copy of a function"""

141

if sys.version_info.major == 2:

142

return types.FunctionType(func.func_code,

143

func.func_globals,

144

func.func_name,

145

func.func_defaults,

146

func.func_closure)

147

else:

148

return types.FunctionType(func.__code__,

149

func.__globals__,

150

func.__name__,

151

func.__defaults__,

152

func.__closure__)

153

154

155

116

def initlogger(debug, level=logging.WARNING):

156

117

"""init logger and add loglevel"""

157

158

global syslogger

159

syslogger = (logging.handlers.SysLogHandler(

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

161

address="/dev/log"))

118

162

119

syslogger.setFormatter(logging.Formatter

163

120

('Mandos [%(process)d]: %(levelname)s:'

164

121

' %(message)s'))

165

122

logger.addHandler(syslogger)

166

123

167

124

if debug:

168

125

console = logging.StreamHandler()

169

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

181

138

182

139

class PGPEngine(object):

183

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

184

185

141

def __init__(self):

186

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

187

self.gpg = "gpg"

188

try:

189

output = subprocess.check_output(["gpgconf"])

190

for line in output.splitlines():

191

name, text, path = line.split(b":")

192

if name == "gpg":

193

self.gpg = path

194

break

195

except OSError as e:

196

if e.errno != errno.ENOENT:

197

raise

198

143

self.gnupgargs = ['--batch',

199

'--homedir', self.tempdir,

144

'--home', self.tempdir,

200

145

'--force-mdc',

201

'--quiet']

202

# Only GPG version 1 has the --no-use-agent option.

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

204

self.gnupgargs.append("--no-use-agent")

205

146

'--quiet',

147

'--no-use-agent']

148

206

149

def __enter__(self):

207

150

return self

208

151

209

152

def __exit__(self, exc_type, exc_value, traceback):

210

153

self._cleanup()

211

154

return False

212

155

213

156

def __del__(self):

214

157

self._cleanup()

215

158

216

159

def _cleanup(self):

217

160

if self.tempdir is not None:

218

161

# Delete contents of tempdir

219

162

for root, dirs, files in os.walk(self.tempdir,

220

topdown=False):

163

topdown = False):

221

164

for filename in files:

222

165

os.remove(os.path.join(root, filename))

223

166

for dirname in dirs:

225

168

# Remove tempdir

226

169

os.rmdir(self.tempdir)

227

170

self.tempdir = None

228

171

229

172

def password_encode(self, password):

230

173

# Passphrase can not be empty and can not contain newlines or

231

174

# NUL bytes. So we prefix it and hex encode it.

236

179

.replace(b"\n", b"\\n")

237

180

.replace(b"\0", b"\\x00"))

238

181

return encoded

239

182

240

183

def encrypt(self, data, password):

241

184

passphrase = self.password_encode(password)

242

with tempfile.NamedTemporaryFile(

243

dir=self.tempdir) as passfile:

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

244

187

passfile.write(passphrase)

245

188

passfile.flush()

246

proc = subprocess.Popen([self.gpg, '--symmetric',

189

proc = subprocess.Popen(['gpg', '--symmetric',

247

190

'--passphrase-file',

248

191

passfile.name]

249

192

+ self.gnupgargs,

250

stdin=subprocess.PIPE,

251

stdout=subprocess.PIPE,

252

stderr=subprocess.PIPE)

253

ciphertext, err = proc.communicate(input=data)

193

stdin = subprocess.PIPE,

194

stdout = subprocess.PIPE,

195

stderr = subprocess.PIPE)

196

ciphertext, err = proc.communicate(input = data)

254

197

if proc.returncode != 0:

255

198

raise PGPError(err)

256

199

return ciphertext

257

200

258

201

def decrypt(self, data, password):

259

202

passphrase = self.password_encode(password)

260

with tempfile.NamedTemporaryFile(

261

dir=self.tempdir) as passfile:

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

262

205

passfile.write(passphrase)

263

206

passfile.flush()

264

proc = subprocess.Popen([self.gpg, '--decrypt',

207

proc = subprocess.Popen(['gpg', '--decrypt',

265

208

'--passphrase-file',

266

209

passfile.name]

267

210

+ self.gnupgargs,

268

stdin=subprocess.PIPE,

269

stdout=subprocess.PIPE,

270

stderr=subprocess.PIPE)

271

decrypted_plaintext, err = proc.communicate(input=data)

211

stdin = subprocess.PIPE,

212

stdout = subprocess.PIPE,

213

stderr = subprocess.PIPE)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

272

216

if proc.returncode != 0:

273

217

raise PGPError(err)

274

218

return decrypted_plaintext

275

219

276

220

277

# Pretend that we have an Avahi module

278

class avahi(object):

279

"""This isn't so much a class as it is a module-like namespace."""

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

284

DBUS_NAME = "org.freedesktop.Avahi"

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

287

DBUS_PATH_SERVER = "/"

288

289

@staticmethod

290

def string_array_to_txt_array(t):

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

292

for s in t), signature="ay")

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

294

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

295

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

296

SERVER_INVALID = 0 # avahi-common/defs.h

297

SERVER_REGISTERING = 1 # avahi-common/defs.h

298

SERVER_RUNNING = 2 # avahi-common/defs.h

299

SERVER_COLLISION = 3 # avahi-common/defs.h

300

SERVER_FAILURE = 4 # avahi-common/defs.h

301

302

303

221

class AvahiError(Exception):

304

222

def __init__(self, value, *args, **kwargs):

305

223

self.value = value

306

return super(AvahiError, self).__init__(value, *args,

307

**kwargs)

308

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

309

227

310

228

class AvahiServiceError(AvahiError):

311

229

pass

312

230

313

314

231

class AvahiGroupError(AvahiError):

315

232

pass

316

233

317

234

318

235

class AvahiService(object):

319

236

"""An Avahi (Zeroconf) service.

320

237

321

238

Attributes:

322

239

interface: integer; avahi.IF_UNSPEC or an interface index.

323

240

Used to optionally bind to the specified interface.

335

252

server: D-Bus Server

336

253

bus: dbus.SystemBus()

337

254

"""

338

339

def __init__(self,

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

255

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

350

260

self.interface = interface

351

261

self.name = name

352

262

self.type = servicetype

361

271

self.server = None

362

272

self.bus = bus

363

273

self.entry_group_state_changed_match = None

364

365

def rename(self, remove=True):

274

275

def rename(self):

366

276

"""Derived from the Avahi example code"""

367

277

if self.rename_count >= self.max_renames:

368

278

logger.critical("No suitable Zeroconf service name found"

369

279

" after %i retries, exiting.",

370

280

self.rename_count)

371

281

raise AvahiServiceError("Too many renames")

372

self.name = str(

373

self.server.GetAlternativeServiceName(self.name))

374

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

375

284

logger.info("Changing Zeroconf service name to %r ...",

376

285

self.name)

377

if remove:

378

self.remove()

286

self.remove()

379

287

try:

380

288

self.add()

381

289

except dbus.exceptions.DBusException as error:

382

if (error.get_dbus_name()

383

== "org.freedesktop.Avahi.CollisionError"):

384

logger.info("Local Zeroconf service name collision.")

385

return self.rename(remove=False)

386

else:

387

logger.critical("D-Bus Exception", exc_info=error)

388

self.cleanup()

389

os._exit(1)

390

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

294

391

295

def remove(self):

392

296

"""Derived from the Avahi example code"""

393

297

if self.entry_group_state_changed_match is not None:

395

299

self.entry_group_state_changed_match = None

396

300

if self.group is not None:

397

301

self.group.Reset()

398

302

399

303

def add(self):

400

304

"""Derived from the Avahi example code"""

401

305

self.remove()

418

322

dbus.UInt16(self.port),

419

323

avahi.string_array_to_txt_array(self.TXT))

420

324

self.group.Commit()

421

325

422

326

def entry_group_state_changed(self, state, error):

423

327

"""Derived from the Avahi example code"""

424

328

logger.debug("Avahi entry group state change: %i", state)

425

329

426

330

if state == avahi.ENTRY_GROUP_ESTABLISHED:

427

331

logger.debug("Zeroconf service established.")

428

332

elif state == avahi.ENTRY_GROUP_COLLISION:

430

334

self.rename()

431

335

elif state == avahi.ENTRY_GROUP_FAILURE:

432

336

logger.critical("Avahi: Error in group state changed %s",

433

str(error))

434

raise AvahiGroupError("State changed: {!s}".format(error))

435

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

340

436

341

def cleanup(self):

437

342

"""Derived from the Avahi example code"""

438

343

if self.group is not None:

443

348

pass

444

349

self.group = None

445

350

self.remove()

446

351

447

352

def server_state_changed(self, state, error=None):

448

353

"""Derived from the Avahi example code"""

449

354

logger.debug("Avahi server state change: %i", state)

450

bad_states = {

451

avahi.SERVER_INVALID: "Zeroconf server invalid",

452

avahi.SERVER_REGISTERING: None,

453

avahi.SERVER_COLLISION: "Zeroconf server name collision",

454

avahi.SERVER_FAILURE: "Zeroconf server failure",

455

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

456

362

if state in bad_states:

457

363

if bad_states[state] is not None:

458

364

if error is None:

461

367

logger.error(bad_states[state] + ": %r", error)

462

368

self.cleanup()

463

369

elif state == avahi.SERVER_RUNNING:

464

try:

465

self.add()

466

except dbus.exceptions.DBusException as error:

467

if (error.get_dbus_name()

468

== "org.freedesktop.Avahi.CollisionError"):

469

logger.info("Local Zeroconf service name"

470

" collision.")

471

return self.rename(remove=False)

472

else:

473

logger.critical("D-Bus Exception", exc_info=error)

474

self.cleanup()

475

os._exit(1)

370

self.add()

476

371

else:

477

372

if error is None:

478

373

logger.debug("Unknown state: %r", state)

479

374

else:

480

375

logger.debug("Unknown state: %r: %r", state, error)

481

376

482

377

def activate(self):

483

378

"""Derived from the Avahi example code"""

484

379

if self.server is None:

488

383

follow_name_owner_changes=True),

489

384

avahi.DBUS_INTERFACE_SERVER)

490

385

self.server.connect_to_signal("StateChanged",

491

self.server_state_changed)

386

self.server_state_changed)

492

387

self.server_state_changed(self.server.GetState())

493

388

494

389

495

390

class AvahiServiceToSyslog(AvahiService):

496

def rename(self, *args, **kwargs):

391

def rename(self):

497

392

"""Add the new name to the syslog messages"""

498

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

499

syslogger.setFormatter(logging.Formatter(

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

501

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

502

398

return ret

503

399

504

400

505

# Pretend that we have a GnuTLS module

506

class gnutls(object):

507

"""This isn't so much a class as it is a module-like namespace."""

508

509

library = ctypes.util.find_library("gnutls")

510

if library is None:

511

library = ctypes.util.find_library("gnutls-deb0")

512

_library = ctypes.cdll.LoadLibrary(library)

513

del library

514

515

# Unless otherwise indicated, the constants and types below are

516

# all from the gnutls/gnutls.h C header file.

517

518

# Constants

519

E_SUCCESS = 0

520

E_INTERRUPTED = -52

521

E_AGAIN = -28

522

CRT_OPENPGP = 2

523

CRT_RAWPK = 3

524

CLIENT = 2

525

SHUT_RDWR = 0

526

CRD_CERTIFICATE = 1

527

E_NO_CERTIFICATE_FOUND = -49

528

X509_FMT_DER = 0

529

NO_TICKETS = 1<<10

530

ENABLE_RAWPK = 1<<18

531

CTYPE_PEERS = 3

532

KEYID_USE_SHA256 = 1 # gnutls/x509.h

533

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

534

535

# Types

536

class session_int(ctypes.Structure):

537

_fields_ = []

538

session_t = ctypes.POINTER(session_int)

539

540

class certificate_credentials_st(ctypes.Structure):

541

_fields_ = []

542

certificate_credentials_t = ctypes.POINTER(

543

certificate_credentials_st)

544

certificate_type_t = ctypes.c_int

545

546

class datum_t(ctypes.Structure):

547

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

548

('size', ctypes.c_uint)]

549

550

class openpgp_crt_int(ctypes.Structure):

551

_fields_ = []

552

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

553

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

554

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

555

credentials_type_t = ctypes.c_int

556

transport_ptr_t = ctypes.c_void_p

557

close_request_t = ctypes.c_int

558

559

# Exceptions

560

class Error(Exception):

561

def __init__(self, message=None, code=None, args=()):

562

# Default usage is by a message string, but if a return

563

# code is passed, convert it to a string with

564

# gnutls.strerror()

565

self.code = code

566

if message is None and code is not None:

567

message = gnutls.strerror(code)

568

return super(gnutls.Error, self).__init__(

569

message, *args)

570

571

class CertificateSecurityError(Error):

572

pass

573

574

# Classes

575

class Credentials(object):

576

def __init__(self):

577

self._c_object = gnutls.certificate_credentials_t()

578

gnutls.certificate_allocate_credentials(

579

ctypes.byref(self._c_object))

580

self.type = gnutls.CRD_CERTIFICATE

581

582

def __del__(self):

583

gnutls.certificate_free_credentials(self._c_object)

584

585

class ClientSession(object):

586

def __init__(self, socket, credentials=None):

587

self._c_object = gnutls.session_t()

588

gnutls_flags = gnutls.CLIENT

589

if gnutls.check_version("3.5.6"):

590

gnutls_flags |= gnutls.NO_TICKETS

591

if gnutls.has_rawpk:

592

gnutls_flags |= gnutls.ENABLE_RAWPK

593

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

594

del gnutls_flags

595

gnutls.set_default_priority(self._c_object)

596

gnutls.transport_set_ptr(self._c_object, socket.fileno())

597

gnutls.handshake_set_private_extensions(self._c_object,

598

True)

599

self.socket = socket

600

if credentials is None:

601

credentials = gnutls.Credentials()

602

gnutls.credentials_set(self._c_object, credentials.type,

603

ctypes.cast(credentials._c_object,

604

ctypes.c_void_p))

605

self.credentials = credentials

606

607

def __del__(self):

608

gnutls.deinit(self._c_object)

609

610

def handshake(self):

611

return gnutls.handshake(self._c_object)

612

613

def send(self, data):

614

data = bytes(data)

615

data_len = len(data)

616

while data_len > 0:

617

data_len -= gnutls.record_send(self._c_object,

618

data[-data_len:],

619

data_len)

620

621

def bye(self):

622

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

623

624

# Error handling functions

625

def _error_code(result):

626

"""A function to raise exceptions on errors, suitable

627

for the 'restype' attribute on ctypes functions"""

628

if result >= 0:

629

return result

630

if result == gnutls.E_NO_CERTIFICATE_FOUND:

631

raise gnutls.CertificateSecurityError(code=result)

632

raise gnutls.Error(code=result)

633

634

def _retry_on_error(result, func, arguments):

635

"""A function to retry on some errors, suitable

636

for the 'errcheck' attribute on ctypes functions"""

637

while result < 0:

638

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

639

return _error_code(result)

640

result = func(*arguments)

641

return result

642

643

# Unless otherwise indicated, the function declarations below are

644

# all from the gnutls/gnutls.h C header file.

645

646

# Functions

647

priority_set_direct = _library.gnutls_priority_set_direct

648

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

649

ctypes.POINTER(ctypes.c_char_p)]

650

priority_set_direct.restype = _error_code

651

652

init = _library.gnutls_init

653

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

654

init.restype = _error_code

655

656

set_default_priority = _library.gnutls_set_default_priority

657

set_default_priority.argtypes = [session_t]

658

set_default_priority.restype = _error_code

659

660

record_send = _library.gnutls_record_send

661

record_send.argtypes = [session_t, ctypes.c_void_p,

662

ctypes.c_size_t]

663

record_send.restype = ctypes.c_ssize_t

664

record_send.errcheck = _retry_on_error

665

666

certificate_allocate_credentials = (

667

_library.gnutls_certificate_allocate_credentials)

668

certificate_allocate_credentials.argtypes = [

669

ctypes.POINTER(certificate_credentials_t)]

670

certificate_allocate_credentials.restype = _error_code

671

672

certificate_free_credentials = (

673

_library.gnutls_certificate_free_credentials)

674

certificate_free_credentials.argtypes = [

675

certificate_credentials_t]

676

certificate_free_credentials.restype = None

677

678

handshake_set_private_extensions = (

679

_library.gnutls_handshake_set_private_extensions)

680

handshake_set_private_extensions.argtypes = [session_t,

681

ctypes.c_int]

682

handshake_set_private_extensions.restype = None

683

684

credentials_set = _library.gnutls_credentials_set

685

credentials_set.argtypes = [session_t, credentials_type_t,

686

ctypes.c_void_p]

687

credentials_set.restype = _error_code

688

689

strerror = _library.gnutls_strerror

690

strerror.argtypes = [ctypes.c_int]

691

strerror.restype = ctypes.c_char_p

692

693

certificate_type_get = _library.gnutls_certificate_type_get

694

certificate_type_get.argtypes = [session_t]

695

certificate_type_get.restype = _error_code

696

697

certificate_get_peers = _library.gnutls_certificate_get_peers

698

certificate_get_peers.argtypes = [session_t,

699

ctypes.POINTER(ctypes.c_uint)]

700

certificate_get_peers.restype = ctypes.POINTER(datum_t)

701

702

global_set_log_level = _library.gnutls_global_set_log_level

703

global_set_log_level.argtypes = [ctypes.c_int]

704

global_set_log_level.restype = None

705

706

global_set_log_function = _library.gnutls_global_set_log_function

707

global_set_log_function.argtypes = [log_func]

708

global_set_log_function.restype = None

709

710

deinit = _library.gnutls_deinit

711

deinit.argtypes = [session_t]

712

deinit.restype = None

713

714

handshake = _library.gnutls_handshake

715

handshake.argtypes = [session_t]

716

handshake.restype = _error_code

717

handshake.errcheck = _retry_on_error

718

719

transport_set_ptr = _library.gnutls_transport_set_ptr

720

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

721

transport_set_ptr.restype = None

722

723

bye = _library.gnutls_bye

724

bye.argtypes = [session_t, close_request_t]

725

bye.restype = _error_code

726

bye.errcheck = _retry_on_error

727

728

check_version = _library.gnutls_check_version

729

check_version.argtypes = [ctypes.c_char_p]

730

check_version.restype = ctypes.c_char_p

731

732

_need_version = b"3.3.0"

733

if check_version(_need_version) is None:

734

raise self.Error("Needs GnuTLS {} or later"

735

.format(_need_version))

736

737

_tls_rawpk_version = b"3.6.6"

738

has_rawpk = bool(check_version(_tls_rawpk_version))

739

740

if has_rawpk:

741

# Types

742

class pubkey_st(ctypes.Structure):

743

_fields = []

744

pubkey_t = ctypes.POINTER(pubkey_st)

745

746

x509_crt_fmt_t = ctypes.c_int

747

748

# All the function declarations below are from gnutls/abstract.h

749

pubkey_init = _library.gnutls_pubkey_init

750

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

751

pubkey_init.restype = _error_code

752

753

pubkey_import = _library.gnutls_pubkey_import

754

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

755

x509_crt_fmt_t]

756

pubkey_import.restype = _error_code

757

758

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

759

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

760

ctypes.POINTER(ctypes.c_ubyte),

761

ctypes.POINTER(ctypes.c_size_t)]

762

pubkey_get_key_id.restype = _error_code

763

764

pubkey_deinit = _library.gnutls_pubkey_deinit

765

pubkey_deinit.argtypes = [pubkey_t]

766

pubkey_deinit.restype = None

767

else:

768

# All the function declarations below are from gnutls/openpgp.h

769

770

openpgp_crt_init = _library.gnutls_openpgp_crt_init

771

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

772

openpgp_crt_init.restype = _error_code

773

774

openpgp_crt_import = _library.gnutls_openpgp_crt_import

775

openpgp_crt_import.argtypes = [openpgp_crt_t,

776

ctypes.POINTER(datum_t),

777

openpgp_crt_fmt_t]

778

openpgp_crt_import.restype = _error_code

779

780

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

781

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

782

ctypes.POINTER(ctypes.c_uint)]

783

openpgp_crt_verify_self.restype = _error_code

784

785

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

786

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

787

openpgp_crt_deinit.restype = None

788

789

openpgp_crt_get_fingerprint = (

790

_library.gnutls_openpgp_crt_get_fingerprint)

791

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

792

ctypes.c_void_p,

793

ctypes.POINTER(

794

ctypes.c_size_t)]

795

openpgp_crt_get_fingerprint.restype = _error_code

796

797

if check_version("3.6.4"):

798

certificate_type_get2 = _library.gnutls_certificate_type_get2

799

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

800

certificate_type_get2.restype = _error_code

801

802

# Remove non-public functions

803

del _error_code, _retry_on_error

804

805

806

def call_pipe(connection, # : multiprocessing.Connection

807

func, *args, **kwargs):

808

"""This function is meant to be called by multiprocessing.Process

809

810

This function runs func(*args, **kwargs), and writes the resulting

811

return value on the provided multiprocessing.Connection.

812

"""

813

connection.send(func(*args, **kwargs))

814

connection.close()

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

815

406

816

407

817

408

class Client(object):

818

409

"""A representation of a client host served by this server.

819

410

820

411

Attributes:

821

412

approved: bool(); 'None' if not yet approved/disapproved

822

413

approval_delay: datetime.timedelta(); Time to wait for approval

824

415

checker: subprocess.Popen(); a running checker process used

825

416

to see if the client lives.

826

417

'None' if no process is running.

827

checker_callback_tag: a GLib event source tag, or None

418

checker_callback_tag: a gobject event source tag, or None

828

419

checker_command: string; External command which is run to check

829

420

if client lives. %() expansions are done at

830

421

runtime with vars(self) as dict, so that for

831

422

instance %(name)s can be used in the command.

832

checker_initiator_tag: a GLib event source tag, or None

423

checker_initiator_tag: a gobject event source tag, or None

833

424

created: datetime.datetime(); (UTC) object creation

834

425

client_structure: Object describing what attributes a client has

835

426

and is used for storing the client at exit

836

427

current_checker_command: string; current running checker_command

837

disable_initiator_tag: a GLib event source tag, or None

428

disable_initiator_tag: a gobject event source tag, or None

838

429

enabled: bool()

839

430

fingerprint: string (40 or 32 hexadecimal digits); used to

840

uniquely identify an OpenPGP client

841

key_id: string (64 hexadecimal digits); used to uniquely identify

842

a client using raw public keys

431

uniquely identify the client

843

432

host: string; available for use by the checker command

844

433

interval: datetime.timedelta(); How often to start a new checker

845

434

last_approval_request: datetime.datetime(); (UTC) or None

847

436

last_checker_status: integer between 0 and 255 reflecting exit

848

437

status of last checker. -1 reflects crashed

849

438

checker, -2 means no checker completed yet.

850

last_checker_signal: The signal which killed the last checker, if

851

last_checker_status is -1

852

439

last_enabled: datetime.datetime(); (UTC) or None

853

440

name: string; from the config file, used in log messages and

854

441

D-Bus identifiers

861

448

disabled, or None

862

449

server_settings: The server_settings dict from main()

863

450

"""

864

451

865

452

runtime_expansions = ("approval_delay", "approval_duration",

866

"created", "enabled", "expires", "key_id",

453

"created", "enabled", "expires",

867

454

"fingerprint", "host", "interval",

868

455

"last_approval_request", "last_checked_ok",

869

456

"last_enabled", "name", "timeout")

870

client_defaults = {

871

"timeout": "PT5M",

872

"extended_timeout": "PT15M",

873

"interval": "PT2M",

874

"checker": "fping -q -- %%(host)s",

875

"host": "",

876

"approval_delay": "PT0S",

877

"approval_duration": "PT1S",

878

"approved_by_default": "True",

879

"enabled": "True",

880

}

881

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

482

882

483

@staticmethod

883

484

def config_parser(config):

884

485

"""Construct a new dict of client settings of this form:

891

492

for client_name in config.sections():

892

493

section = dict(config.items(client_name))

893

494

client = settings[client_name] = {}

894

495

895

496

client["host"] = section["host"]

896

497

# Reformat values from string types to Python types

897

498

client["approved_by_default"] = config.getboolean(

898

499

client_name, "approved_by_default")

899

500

client["enabled"] = config.getboolean(client_name,

900

501

"enabled")

901

902

# Uppercase and remove spaces from key_id and fingerprint

903

# for later comparison purposes with return value from the

904

# key_id() and fingerprint() functions

905

client["key_id"] = (section.get("key_id", "").upper()

906

.replace(" ", ""))

502

907

503

client["fingerprint"] = (section["fingerprint"].upper()

908

504

.replace(" ", ""))

909

505

if "secret" in section:

910

client["secret"] = codecs.decode(section["secret"]

911

.encode("utf-8"),

912

"base64")

506

client["secret"] = section["secret"].decode("base64")

913

507

elif "secfile" in section:

914

508

with open(os.path.expanduser(os.path.expandvars

915

509

(section["secfile"])),

916

510

"rb") as secfile:

917

511

client["secret"] = secfile.read()

918

512

else:

919

raise TypeError("No secret or secfile for section {}"

513

raise TypeError("No secret or secfile for section {0}"

920

514

.format(section))

921

515

client["timeout"] = string_to_delta(section["timeout"])

922

516

client["extended_timeout"] = string_to_delta(

930

524

client["last_approval_request"] = None

931

525

client["last_checked_ok"] = None

932

526

client["last_checker_status"] = -2

933

527

934

528

return settings

935

936

def __init__(self, settings, name=None, server_settings=None):

529

530

def __init__(self, settings, name = None, server_settings=None):

937

531

self.name = name

938

532

if server_settings is None:

939

533

server_settings = {}

940

534

self.server_settings = server_settings

941

535

# adding all client settings

942

for setting, value in settings.items():

536

for setting, value in settings.iteritems():

943

537

setattr(self, setting, value)

944

538

945

539

if self.enabled:

946

540

if not hasattr(self, "last_enabled"):

947

541

self.last_enabled = datetime.datetime.utcnow()

951

545

else:

952

546

self.last_enabled = None

953

547

self.expires = None

954

548

955

549

logger.debug("Creating client %r", self.name)

956

logger.debug(" Key ID: %s", self.key_id)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

957

553

logger.debug(" Fingerprint: %s", self.fingerprint)

958

554

self.created = settings.get("created",

959

555

datetime.datetime.utcnow())

960

556

961

557

# attributes specific for this server instance

962

558

self.checker = None

963

559

self.checker_initiator_tag = None

966

562

self.current_checker_command = None

967

563

self.approved = None

968

564

self.approvals_pending = 0

969

self.changedstate = multiprocessing_manager.Condition(

970

multiprocessing_manager.Lock())

971

self.client_structure = [attr

972

for attr in self.__dict__.keys()

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

973

570

if not attr.startswith("_")]

974

571

self.client_structure.append("client_structure")

975

976

for name, t in inspect.getmembers(

977

type(self), lambda obj: isinstance(obj, property)):

572

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

978

577

if not name.startswith("_"):

979

578

self.client_structure.append(name)

980

579

981

580

# Send notice to process children that client state has changed

982

581

def send_changedstate(self):

983

582

with self.changedstate:

984

583

self.changedstate.notify_all()

985

584

986

585

def enable(self):

987

586

"""Start this client's checker and timeout hooks"""

988

587

if getattr(self, "enabled", False):

993

592

self.last_enabled = datetime.datetime.utcnow()

994

593

self.init_checker()

995

594

self.send_changedstate()

996

595

997

596

def disable(self, quiet=True):

998

597

"""Disable this client."""

999

598

if not getattr(self, "enabled", False):

1001

600

if not quiet:

1002

601

logger.info("Disabling client %s", self.name)

1003

602

if getattr(self, "disable_initiator_tag", None) is not None:

1004

GLib.source_remove(self.disable_initiator_tag)

603

gobject.source_remove(self.disable_initiator_tag)

1005

604

self.disable_initiator_tag = None

1006

605

self.expires = None

1007

606

if getattr(self, "checker_initiator_tag", None) is not None:

1008

GLib.source_remove(self.checker_initiator_tag)

607

gobject.source_remove(self.checker_initiator_tag)

1009

608

self.checker_initiator_tag = None

1010

609

self.stop_checker()

1011

610

self.enabled = False

1012

611

if not quiet:

1013

612

self.send_changedstate()

1014

# Do not run this again if called by a GLib.timeout_add

613

# Do not run this again if called by a gobject.timeout_add

1015

614

return False

1016

615

1017

616

def __del__(self):

1018

617

self.disable()

1019

618

1020

619

def init_checker(self):

1021

620

# Schedule a new checker to be started an 'interval' from now,

1022

621

# and every interval from then on.

1023

622

if self.checker_initiator_tag is not None:

1024

GLib.source_remove(self.checker_initiator_tag)

1025

self.checker_initiator_tag = GLib.timeout_add(

1026

int(self.interval.total_seconds() * 1000),

1027

self.start_checker)

623

gobject.source_remove(self.checker_initiator_tag)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

1028

627

# Schedule a disable() when 'timeout' has passed

1029

628

if self.disable_initiator_tag is not None:

1030

GLib.source_remove(self.disable_initiator_tag)

1031

self.disable_initiator_tag = GLib.timeout_add(

1032

int(self.timeout.total_seconds() * 1000), self.disable)

629

gobject.source_remove(self.disable_initiator_tag)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

1033

633

# Also start a new checker *right now*.

1034

634

self.start_checker()

1035

1036

def checker_callback(self, source, condition, connection,

1037

command):

635

636

def checker_callback(self, pid, condition, command):

1038

637

"""The checker has completed, so take appropriate actions."""

1039

638

self.checker_callback_tag = None

1040

639

self.checker = None

1041

# Read return code from connection (see call_pipe)

1042

returncode = connection.recv()

1043

connection.close()

1044

1045

if returncode >= 0:

1046

self.last_checker_status = returncode

1047

self.last_checker_signal = None

640

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

1048

642

if self.last_checker_status == 0:

1049

643

logger.info("Checker for %(name)s succeeded",

1050

644

vars(self))

1051

645

self.checked_ok()

1052

646

else:

1053

logger.info("Checker for %(name)s failed", vars(self))

647

logger.info("Checker for %(name)s failed",

648

vars(self))

1054

649

else:

1055

650

self.last_checker_status = -1

1056

self.last_checker_signal = -returncode

1057

651

logger.warning("Checker for %(name)s crashed?",

1058

652

vars(self))

1059

return False

1060

653

1061

654

def checked_ok(self):

1062

655

"""Assert that the client has been seen, alive and well."""

1063

656

self.last_checked_ok = datetime.datetime.utcnow()

1064

657

self.last_checker_status = 0

1065

self.last_checker_signal = None

1066

658

self.bump_timeout()

1067

659

1068

660

def bump_timeout(self, timeout=None):

1069

661

"""Bump up the timeout for this client."""

1070

662

if timeout is None:

1071

663

timeout = self.timeout

1072

664

if self.disable_initiator_tag is not None:

1073

GLib.source_remove(self.disable_initiator_tag)

665

gobject.source_remove(self.disable_initiator_tag)

1074

666

self.disable_initiator_tag = None

1075

667

if getattr(self, "enabled", False):

1076

self.disable_initiator_tag = GLib.timeout_add(

1077

int(timeout.total_seconds() * 1000), self.disable)

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

1078

671

self.expires = datetime.datetime.utcnow() + timeout

1079

672

1080

673

def need_approval(self):

1081

674

self.last_approval_request = datetime.datetime.utcnow()

1082

675

1083

676

def start_checker(self):

1084

677

"""Start a new checker subprocess if one is not running.

1085

678

1086

679

If a checker already exists, leave it running and do

1087

680

nothing."""

1088

681

# The reason for not killing a running checker is that if we

1093

686

# checkers alone, the checker would have to take more time

1094

687

# than 'timeout' for the client to be disabled, which is as it

1095

688

# should be.

1096

1097

if self.checker is not None and not self.checker.is_alive():

1098

logger.warning("Checker was not alive; joining")

1099

self.checker.join()

1100

self.checker = None

689

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

1101

704

# Start a new checker if needed

1102

705

if self.checker is None:

1103

706

# Escape attributes for the shell

1104

escaped_attrs = {

1105

attr: re.escape(str(getattr(self, attr)))

1106

for attr in self.runtime_expansions}

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

1107

711

try:

1108

712

command = self.checker_command % escaped_attrs

1109

713

except TypeError as error:

1110

714

logger.error('Could not format string "%s"',

1111

self.checker_command,

715

self.checker_command, exc_info=error)

716

return True # Try again later

717

self.current_checker_command = command

718

try:

719

logger.info("Starting checker %r for %s",

720

command, self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True, cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

1112

739

exc_info=error)

1113

return True # Try again later

1114

self.current_checker_command = command

1115

logger.info("Starting checker %r for %s", command,

1116

self.name)

1117

# We don't need to redirect stdout and stderr, since

1118

# in normal mode, that is already done by daemon(),

1119

# and in debug mode we don't want to. (Stdin is

1120

# always replaced by /dev/null.)

1121

# The exception is when not debugging but nevertheless

1122

# running in the foreground; use the previously

1123

# created wnull.

1124

popen_args = {"close_fds": True,

1125

"shell": True,

1126

"cwd": "/"}

1127

if (not self.server_settings["debug"]

1128

and self.server_settings["foreground"]):

1129

popen_args.update({"stdout": wnull,

1130

"stderr": wnull})

1131

pipe = multiprocessing.Pipe(duplex=False)

1132

self.checker = multiprocessing.Process(

1133

target=call_pipe,

1134

args=(pipe[1], subprocess.call, command),

1135

kwargs=popen_args)

1136

self.checker.start()

1137

self.checker_callback_tag = GLib.io_add_watch(

1138

pipe[0].fileno(), GLib.IO_IN,

1139

self.checker_callback, pipe[0], command)

1140

# Re-run this periodically if run by GLib.timeout_add

740

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

745

# The checker may have completed before the gobject

746

# watch was added. Check for this.

747

try:

748

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

749

except OSError as error:

750

if error.errno == errno.ECHILD:

751

# This should never happen

752

logger.error("Child process vanished",

753

exc_info=error)

754

return True

755

raise

756

if pid:

757

gobject.source_remove(self.checker_callback_tag)

758

self.checker_callback(pid, status, command)

759

# Re-run this periodically if run by gobject.timeout_add

1141

760

return True

1142

761

1143

762

def stop_checker(self):

1144

763

"""Force the checker process, if any, to stop."""

1145

764

if self.checker_callback_tag:

1146

GLib.source_remove(self.checker_callback_tag)

765

gobject.source_remove(self.checker_callback_tag)

1147

766

self.checker_callback_tag = None

1148

767

if getattr(self, "checker", None) is None:

1149

768

return

1150

769

logger.debug("Stopping checker for %(name)s", vars(self))

1151

self.checker.terminate()

770

try:

771

self.checker.terminate()

772

#time.sleep(0.5)

773

#if self.checker.poll() is None:

774

# self.checker.kill()

775

except OSError as error:

776

if error.errno != errno.ESRCH: # No such process

777

raise

1152

778

self.checker = None

1153

779

1154

780

1155

def dbus_service_property(dbus_interface,

1156

signature="v",

1157

access="readwrite",

1158

byte_arrays=False):

781

def dbus_service_property(dbus_interface, signature="v",

782

access="readwrite", byte_arrays=False):

1159

783

"""Decorators for marking methods of a DBusObjectWithProperties to

1160

784

become properties on the D-Bus.

1161

785

1162

786

The decorated method will be called with no arguments by "Get"

1163

787

and with one argument by "Set".

1164

788

1165

789

The parameters, where they are supported, are the same as

1166

790

dbus.service.method, except there is only "signature", since the

1167

791

type from Get() and the type sent to Set() is the same.

1170

794

# "Set" method, so we fail early here:

1171

795

if byte_arrays and signature != "ay":

1172

796

raise ValueError("Byte arrays not supported for non-'ay'"

1173

" signature {!r}".format(signature))

1174

797

" signature {0!r}".format(signature))

1175

798

def decorator(func):

1176

799

func._dbus_is_property = True

1177

800

func._dbus_interface = dbus_interface

1180

803

func._dbus_name = func.__name__

1181

804

if func._dbus_name.endswith("_dbus_property"):

1182

805

func._dbus_name = func._dbus_name[:-14]

1183

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

806

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1184

807

return func

1185

1186

808

return decorator

1187

809

1188

810

1189

811

def dbus_interface_annotations(dbus_interface):

1190

812

"""Decorator for marking functions returning interface annotations

1191

813

1192

814

Usage:

1193

815

1194

816

@dbus_interface_annotations("org.example.Interface")

1195

817

def _foo(self): # Function name does not matter

1196

818

return {"org.freedesktop.DBus.Deprecated": "true",

1197

819

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1198

820

"false"}

1199

821

"""

1200

1201

822

def decorator(func):

1202

823

func._dbus_is_interface = True

1203

824

func._dbus_interface = dbus_interface

1204

825

func._dbus_name = dbus_interface

1205

826

return func

1206

1207

827

return decorator

1208

828

1209

829

1210

830

def dbus_annotations(annotations):

1211

831

"""Decorator to annotate D-Bus methods, signals or properties

1212

832

Usage:

1213

1214

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1215

"org.freedesktop.DBus.Property."

1216

"EmitsChangedSignal": "false"})

833

1217

834

@dbus_service_property("org.example.Interface", signature="b",

1218

835

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

1219

839

def Property_dbus_property(self):

1220

840

return dbus.Boolean(False)

1221

1222

See also the DBusObjectWithAnnotations class.

1223

841

"""

1224

1225

842

def decorator(func):

1226

843

func._dbus_annotations = annotations

1227

844

return func

1228

1229

845

return decorator

1230

846

1231

847

1232

848

class DBusPropertyException(dbus.exceptions.DBusException):

1233

849

"""A base class for D-Bus property-related exceptions

1234

850

"""

1235

pass

851

def __unicode__(self):

852

return unicode(str(self))

1236

853

1237

854

1238

855

class DBusPropertyAccessException(DBusPropertyException):

1247

864

pass

1248

865

1249

866

1250

class DBusObjectWithAnnotations(dbus.service.Object):

1251

"""A D-Bus object with annotations.

1252

1253

Classes inheriting from this can use the dbus_annotations

1254

decorator to add annotations to methods or signals.

867

class DBusObjectWithProperties(dbus.service.Object):

868

"""A D-Bus object with properties.

869

870

Classes inheriting from this can use the dbus_service_property

871

decorator to expose methods as D-Bus properties. It exposes the

872

standard Get(), Set(), and GetAll() methods on the D-Bus.

1255

873

"""

1256

874

1257

875

@staticmethod

1258

876

def _is_dbus_thing(thing):

1259

877

"""Returns a function testing if an attribute is a D-Bus thing

1260

878

1261

879

If called like _is_dbus_thing("method") it returns a function

1262

880

suitable for use as predicate to inspect.getmembers().

1263

881

"""

1264

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1265

883

False)

1266

884

1267

885

def _get_all_dbus_things(self, thing):

1268

886

"""Returns a generator of (name, attribute) pairs

1269

887

"""

1270

return ((getattr(athing.__get__(self), "_dbus_name", name),

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

1271

890

athing.__get__(self))

1272

891

for cls in self.__class__.__mro__

1273

892

for name, athing in

1274

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1275

1276

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1277

out_signature="s",

1278

path_keyword='object_path',

1279

connection_keyword='connection')

1280

def Introspect(self, object_path, connection):

1281

"""Overloading of standard D-Bus method.

1282

1283

Inserts annotation tags on methods and signals.

1284

"""

1285

xmlstring = dbus.service.Object.Introspect(self, object_path,

1286

connection)

1287

try:

1288

document = xml.dom.minidom.parseString(xmlstring)

1289

1290

for if_tag in document.getElementsByTagName("interface"):

1291

# Add annotation tags

1292

for typ in ("method", "signal"):

1293

for tag in if_tag.getElementsByTagName(typ):

1294

annots = dict()

1295

for name, prop in (self.

1296

_get_all_dbus_things(typ)):

1297

if (name == tag.getAttribute("name")

1298

and prop._dbus_interface

1299

== if_tag.getAttribute("name")):

1300

annots.update(getattr(

1301

prop, "_dbus_annotations", {}))

1302

for name, value in annots.items():

1303

ann_tag = document.createElement(

1304

"annotation")

1305

ann_tag.setAttribute("name", name)

1306

ann_tag.setAttribute("value", value)

1307

tag.appendChild(ann_tag)

1308

# Add interface annotation tags

1309

for annotation, value in dict(

1310

itertools.chain.from_iterable(

1311

annotations().items()

1312

for name, annotations

1313

in self._get_all_dbus_things("interface")

1314

if name == if_tag.getAttribute("name")

1315

)).items():

1316

ann_tag = document.createElement("annotation")

1317

ann_tag.setAttribute("name", annotation)

1318

ann_tag.setAttribute("value", value)

1319

if_tag.appendChild(ann_tag)

1320

# Fix argument name for the Introspect method itself

1321

if (if_tag.getAttribute("name")

1322

== dbus.INTROSPECTABLE_IFACE):

1323

for cn in if_tag.getElementsByTagName("method"):

1324

if cn.getAttribute("name") == "Introspect":

1325

for arg in cn.getElementsByTagName("arg"):

1326

if (arg.getAttribute("direction")

1327

== "out"):

1328

arg.setAttribute("name",

1329

"xml_data")

1330

xmlstring = document.toxml("utf-8")

1331

document.unlink()

1332

except (AttributeError, xml.dom.DOMException,

1333

xml.parsers.expat.ExpatError) as error:

1334

logger.error("Failed to override Introspection method",

1335

exc_info=error)

1336

return xmlstring

1337

1338

1339

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1340

"""A D-Bus object with properties.

1341

1342

Classes inheriting from this can use the dbus_service_property

1343

decorator to expose methods as D-Bus properties. It exposes the

1344

standard Get(), Set(), and GetAll() methods on the D-Bus.

1345

"""

1346

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

895

1347

896

def _get_dbus_property(self, interface_name, property_name):

1348

897

"""Returns a bound method if one exists which is a D-Bus

1349

898

property with the specified name and interface.

1350

899

"""

1351

for cls in self.__class__.__mro__:

1352

for name, value in inspect.getmembers(

1353

cls, self._is_dbus_thing("property")):

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

1354

904

if (value._dbus_name == property_name

1355

905

and value._dbus_interface == interface_name):

1356

906

return value.__get__(self)

1357

907

1358

908

# No such property

1359

raise DBusPropertyNotFound("{}:{}.{}".format(

1360

self.dbus_object_path, interface_name, property_name))

1361

1362

@classmethod

1363

def _get_all_interface_names(cls):

1364

"""Get a sequence of all interfaces supported by an object"""

1365

return (name for name in set(getattr(getattr(x, attr),

1366

"_dbus_interface", None)

1367

for x in (inspect.getmro(cls))

1368

for attr in dir(x))

1369

if name is not None)

1370

1371

@dbus.service.method(dbus.PROPERTIES_IFACE,

1372

in_signature="ss",

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

+ interface_name + "."

911

+ property_name)

912

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1373

914

out_signature="v")

1374

915

def Get(self, interface_name, property_name):

1375

916

"""Standard D-Bus property Get() method, see D-Bus standard.

1381

922

if not hasattr(value, "variant_level"):

1382

923

return value

1383

924

return type(value)(value, variant_level=value.variant_level+1)

1384

925

1385

926

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1386

927

def Set(self, interface_name, property_name, value):

1387

928

"""Standard D-Bus property Set() method, see D-Bus standard.

1394

935

# signatures other than "ay".

1395

936

if prop._dbus_signature != "ay":

1396

937

raise ValueError("Byte arrays not supported for non-"

1397

"'ay' signature {!r}"

938

"'ay' signature {0!r}"

1398

939

.format(prop._dbus_signature))

1399

940

value = dbus.ByteArray(b''.join(chr(byte)

1400

941

for byte in value))

1401

942

prop(value)

1402

1403

@dbus.service.method(dbus.PROPERTIES_IFACE,

1404

in_signature="s",

943

944

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1405

945

out_signature="a{sv}")

1406

946

def GetAll(self, interface_name):

1407

947

"""Standard D-Bus property GetAll() method, see D-Bus

1408

948

standard.

1409

949

1410

950

Note: Will not include properties with access="write".

1411

951

"""

1412

952

properties = {}

1422

962

if not hasattr(value, "variant_level"):

1423

963

properties[name] = value

1424

964

continue

1425

properties[name] = type(value)(

1426

value, variant_level=value.variant_level + 1)

965

properties[name] = type(value)(value, variant_level=

966

value.variant_level+1)

1427

967

return dbus.Dictionary(properties, signature="sv")

1428

1429

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1430

def PropertiesChanged(self, interface_name, changed_properties,

1431

invalidated_properties):

1432

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1433

standard.

1434

"""

1435

pass

1436

968

1437

969

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1438

970

out_signature="s",

1439

971

path_keyword='object_path',

1440

972

connection_keyword='connection')

1441

973

def Introspect(self, object_path, connection):

1442

974

"""Overloading of standard D-Bus method.

1443

975

1444

976

Inserts property tags and interface annotation tags.

1445

977

"""

1446

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1447

object_path,

1448

connection)

978

xmlstring = dbus.service.Object.Introspect(self, object_path,

979

connection)

1449

980

try:

1450

981

document = xml.dom.minidom.parseString(xmlstring)

1451

1452

982

def make_tag(document, name, prop):

1453

983

e = document.createElement("property")

1454

984

e.setAttribute("name", name)

1455

985

e.setAttribute("type", prop._dbus_signature)

1456

986

e.setAttribute("access", prop._dbus_access)

1457

987

return e

1458

1459

988

for if_tag in document.getElementsByTagName("interface"):

1460

989

# Add property tags

1461

990

for tag in (make_tag(document, name, prop)

1464

993

if prop._dbus_interface

1465

994

== if_tag.getAttribute("name")):

1466

995

if_tag.appendChild(tag)

1467

# Add annotation tags for properties

1468

for tag in if_tag.getElementsByTagName("property"):

1469

annots = dict()

1470

for name, prop in self._get_all_dbus_things(

1471

"property"):

1472

if (name == tag.getAttribute("name")

1473

and prop._dbus_interface

1474

== if_tag.getAttribute("name")):

1475

annots.update(getattr(

1476

prop, "_dbus_annotations", {}))

1477

for name, value in annots.items():

1478

ann_tag = document.createElement(

1479

"annotation")

1480

ann_tag.setAttribute("name", name)

1481

ann_tag.setAttribute("value", value)

1482

tag.appendChild(ann_tag)

996

# Add annotation tags

997

for typ in ("method", "signal", "property"):

998

for tag in if_tag.getElementsByTagName(typ):

999

annots = dict()

1000

for name, prop in (self.

1001

_get_all_dbus_things(typ)):

1002

if (name == tag.getAttribute("name")

1003

and prop._dbus_interface

1004

== if_tag.getAttribute("name")):

1005

annots.update(getattr

1006

(prop,

1007

"_dbus_annotations",

1008

{}))

1009

for name, value in annots.iteritems():

1010

ann_tag = document.createElement(

1011

"annotation")

1012

ann_tag.setAttribute("name", name)

1013

ann_tag.setAttribute("value", value)

1014

tag.appendChild(ann_tag)

1015

# Add interface annotation tags

1016

for annotation, value in dict(

1017

itertools.chain.from_iterable(

1018

annotations().iteritems()

1019

for name, annotations in

1020

self._get_all_dbus_things("interface")

1021

if name == if_tag.getAttribute("name")

1022

)).iteritems():

1023

ann_tag = document.createElement("annotation")

1024

ann_tag.setAttribute("name", annotation)

1025

ann_tag.setAttribute("value", value)

1026

if_tag.appendChild(ann_tag)

1483

1027

# Add the names to the return values for the

1484

1028

# "org.freedesktop.DBus.Properties" methods

1485

1029

if (if_tag.getAttribute("name")

1504

1048

return xmlstring

1505

1049

1506

1050

1507

try:

1508

dbus.OBJECT_MANAGER_IFACE

1509

except AttributeError:

1510

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1511

1512

1513

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1514

"""A D-Bus object with an ObjectManager.

1515

1516

Classes inheriting from this exposes the standard

1517

GetManagedObjects call and the InterfacesAdded and

1518

InterfacesRemoved signals on the standard

1519

"org.freedesktop.DBus.ObjectManager" interface.

1520

1521

Note: No signals are sent automatically; they must be sent

1522

manually.

1523

"""

1524

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1525

out_signature="a{oa{sa{sv}}}")

1526

def GetManagedObjects(self):

1527

"""This function must be overridden"""

1528

raise NotImplementedError()

1529

1530

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1531

signature="oa{sa{sv}}")

1532

def InterfacesAdded(self, object_path, interfaces_and_properties):

1533

pass

1534

1535

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1536

def InterfacesRemoved(self, object_path, interfaces):

1537

pass

1538

1539

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1540

out_signature="s",

1541

path_keyword='object_path',

1542

connection_keyword='connection')

1543

def Introspect(self, object_path, connection):

1544

"""Overloading of standard D-Bus method.

1545

1546

Override return argument name of GetManagedObjects to be

1547

"objpath_interfaces_and_properties"

1548

"""

1549

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1550

object_path,

1551

connection)

1552

try:

1553

document = xml.dom.minidom.parseString(xmlstring)

1554

1555

for if_tag in document.getElementsByTagName("interface"):

1556

# Fix argument name for the GetManagedObjects method

1557

if (if_tag.getAttribute("name")

1558

== dbus.OBJECT_MANAGER_IFACE):

1559

for cn in if_tag.getElementsByTagName("method"):

1560

if (cn.getAttribute("name")

1561

== "GetManagedObjects"):

1562

for arg in cn.getElementsByTagName("arg"):

1563

if (arg.getAttribute("direction")

1564

== "out"):

1565

arg.setAttribute(

1566

"name",

1567

"objpath_interfaces"

1568

"_and_properties")

1569

xmlstring = document.toxml("utf-8")

1570

document.unlink()

1571

except (AttributeError, xml.dom.DOMException,

1572

xml.parsers.expat.ExpatError) as error:

1573

logger.error("Failed to override Introspection method",

1574

exc_info=error)

1575

return xmlstring

1576

1577

1578

1051

def datetime_to_dbus(dt, variant_level=0):

1579

1052

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1580

1053

if dt is None:

1581

return dbus.String("", variant_level=variant_level)

1582

return dbus.String(dt.isoformat(), variant_level=variant_level)

1054

return dbus.String("", variant_level = variant_level)

1055

return dbus.String(dt.isoformat(),

1056

variant_level=variant_level)

1583

1057

1584

1058

1585

1059

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1587

1061

dbus.service.Object, it will add alternate D-Bus attributes with

1588

1062

interface names according to the "alt_interface_names" mapping.

1589

1063

Usage:

1590

1064

1591

1065

@alternate_dbus_interfaces({"org.example.Interface":

1592

1066

"net.example.AlternateInterface"})

1593

1067

class SampleDBusObject(dbus.service.Object):

1594

1068

@dbus.service.method("org.example.Interface")

1595

1069

def SampleDBusMethod():

1596

1070

pass

1597

1071

1598

1072

The above "SampleDBusMethod" on "SampleDBusObject" will be

1599

1073

reachable via two interfaces: "org.example.Interface" and

1600

1074

"net.example.AlternateInterface", the latter of which will have

1601

1075

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1602

1076

"true", unless "deprecate" is passed with a False value.

1603

1077

1604

1078

This works for methods and signals, and also for D-Bus properties

1605

1079

(from DBusObjectWithProperties) and interfaces (from the

1606

1080

dbus_interface_annotations decorator).

1607

1081

"""

1608

1609

1082

def wrapper(cls):

1610

1083

for orig_interface_name, alt_interface_name in (

1611

alt_interface_names.items()):

1084

alt_interface_names.iteritems()):

1612

1085

attr = {}

1613

1086

interface_names = set()

1614

1087

# Go though all attributes of the class

1616

1089

# Ignore non-D-Bus attributes, and D-Bus attributes

1617

1090

# with the wrong interface name

1618

1091

if (not hasattr(attribute, "_dbus_interface")

1619

or not attribute._dbus_interface.startswith(

1620

orig_interface_name)):

1092

or not attribute._dbus_interface

1093

.startswith(orig_interface_name)):

1621

1094

continue

1622

1095

# Create an alternate D-Bus interface name based on

1623

1096

# the current name

1624

alt_interface = attribute._dbus_interface.replace(

1625

orig_interface_name, alt_interface_name)

1097

alt_interface = (attribute._dbus_interface

1098

.replace(orig_interface_name,

1099

alt_interface_name))

1626

1100

interface_names.add(alt_interface)

1627

1101

# Is this a D-Bus signal?

1628

1102

if getattr(attribute, "_dbus_is_signal", False):

1629

1103

# Extract the original non-method undecorated

1630

1104

# function by black magic

1631

if sys.version_info.major == 2:

1632

nonmethod_func = (dict(

1105

nonmethod_func = (dict(

1633

1106

zip(attribute.func_code.co_freevars,

1634

attribute.__closure__))

1635

["func"].cell_contents)

1636

else:

1637

nonmethod_func = (dict(

1638

zip(attribute.__code__.co_freevars,

1639

attribute.__closure__))

1640

["func"].cell_contents)

1107

attribute.__closure__))["func"]

1108

.cell_contents)

1641

1109

# Create a new, but exactly alike, function

1642

1110

# object, and decorate it to be a new D-Bus signal

1643

1111

# with the alternate D-Bus interface name

1644

new_function = copy_function(nonmethod_func)

1645

new_function = (dbus.service.signal(

1646

alt_interface,

1647

attribute._dbus_signature)(new_function))

1112

new_function = (dbus.service.signal

1113

(alt_interface,

1114

attribute._dbus_signature)

1115

(types.FunctionType(

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)))

1648

1121

# Copy annotations, if any

1649

1122

try:

1650

new_function._dbus_annotations = dict(

1651

attribute._dbus_annotations)

1123

new_function._dbus_annotations = (

1124

dict(attribute._dbus_annotations))

1652

1125

except AttributeError:

1653

1126

pass

1654

1655

1127

# Define a creator of a function to call both the

1656

1128

# original and alternate functions, so both the

1657

1129

# original and alternate signals gets sent when

1660

1132

"""This function is a scope container to pass

1661

1133

func1 and func2 to the "call_both" function

1662

1134

outside of its arguments"""

1663

1664

@functools.wraps(func2)

1665

1135

def call_both(*args, **kwargs):

1666

1136

"""This function will emit two D-Bus

1667

1137

signals by calling func1 and func2"""

1668

1138

func1(*args, **kwargs)

1669

1139

func2(*args, **kwargs)

1670

# Make wrapper function look like a D-Bus

1671

# signal

1672

for name, attr in inspect.getmembers(func2):

1673

if name.startswith("_dbus_"):

1674

setattr(call_both, name, attr)

1675

1676

1140

return call_both

1677

1141

# Create the "call_both" function and add it to

1678

1142

# the class

1683

1147

# object. Decorate it to be a new D-Bus method

1684

1148

# with the alternate D-Bus interface name. Add it

1685

1149

# to the class.

1686

attr[attrname] = (

1687

dbus.service.method(

1688

alt_interface,

1689

attribute._dbus_in_signature,

1690

attribute._dbus_out_signature)

1691

(copy_function(attribute)))

1150

attr[attrname] = (dbus.service.method

1151

(alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType

1155

(attribute.func_code,

1156

attribute.func_globals,

1157

attribute.func_name,

1158

attribute.func_defaults,

1159

attribute.func_closure)))

1692

1160

# Copy annotations, if any

1693

1161

try:

1694

attr[attrname]._dbus_annotations = dict(

1695

attribute._dbus_annotations)

1162

attr[attrname]._dbus_annotations = (

1163

dict(attribute._dbus_annotations))

1696

1164

except AttributeError:

1697

1165

pass

1698

1166

# Is this a D-Bus property?

1701

1169

# object, and decorate it to be a new D-Bus

1702

1170

# property with the alternate D-Bus interface

1703

1171

# name. Add it to the class.

1704

attr[attrname] = (dbus_service_property(

1705

alt_interface, attribute._dbus_signature,

1706

attribute._dbus_access,

1707

attribute._dbus_get_args_options

1708

["byte_arrays"])

1709

(copy_function(attribute)))

1172

attr[attrname] = (dbus_service_property

1173

(alt_interface,

1174

attribute._dbus_signature,

1175

attribute._dbus_access,

1176

attribute

1177

._dbus_get_args_options

1178

["byte_arrays"])

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1710

1185

# Copy annotations, if any

1711

1186

try:

1712

attr[attrname]._dbus_annotations = dict(

1713

attribute._dbus_annotations)

1187

attr[attrname]._dbus_annotations = (

1188

dict(attribute._dbus_annotations))

1714

1189

except AttributeError:

1715

1190

pass

1716

1191

# Is this a D-Bus interface?

1719

1194

# object. Decorate it to be a new D-Bus interface

1720

1195

# with the alternate D-Bus interface name. Add it

1721

1196

# to the class.

1722

attr[attrname] = (

1723

dbus_interface_annotations(alt_interface)

1724

(copy_function(attribute)))

1197

attr[attrname] = (dbus_interface_annotations

1198

(alt_interface)

1199

(types.FunctionType

1200

(attribute.func_code,

1201

attribute.func_globals,

1202

attribute.func_name,

1203

attribute.func_defaults,

1204

attribute.func_closure)))

1725

1205

if deprecate:

1726

1206

# Deprecate all alternate interfaces

1727

iname = "_AlternateDBusNames_interface_annotation{}"

1207

iname="_AlternateDBusNames_interface_annotation{0}"

1728

1208

for interface_name in interface_names:

1729

1730

1209

@dbus_interface_annotations(interface_name)

1731

1210

def func(self):

1732

return {"org.freedesktop.DBus.Deprecated":

1733

"true"}

1211

return { "org.freedesktop.DBus.Deprecated":

1212

"true" }

1734

1213

# Find an unused name

1735

1214

for aname in (iname.format(i)

1736

1215

for i in itertools.count()):

1740

1219

if interface_names:

1741

1220

# Replace the class with a new subclass of it with

1742

1221

# methods, signals, etc. as created above.

1743

if sys.version_info.major == 2:

1744

cls = type(b"{}Alternate".format(cls.__name__),

1745

(cls, ), attr)

1746

else:

1747

cls = type("{}Alternate".format(cls.__name__),

1748

(cls, ), attr)

1222

cls = type(b"{0}Alternate".format(cls.__name__),

1223

(cls,), attr)

1749

1224

return cls

1750

1751

1225

return wrapper

1752

1226

1753

1227

1754

1228

@alternate_dbus_interfaces({"se.recompile.Mandos":

1755

"se.bsnet.fukt.Mandos"})

1229

"se.bsnet.fukt.Mandos"})

1756

1230

class ClientDBus(Client, DBusObjectWithProperties):

1757

1231

"""A Client class using D-Bus

1758

1232

1759

1233

Attributes:

1760

1234

dbus_object_path: dbus.ObjectPath

1761

1235

bus: dbus.SystemBus()

1762

1236

"""

1763

1237

1764

1238

runtime_expansions = (Client.runtime_expansions

1765

+ ("dbus_object_path", ))

1766

1767

_interface = "se.recompile.Mandos.Client"

1768

1239

+ ("dbus_object_path",))

1240

1769

1241

# dbus.service.Object doesn't use super(), so we can't either.

1770

1771

def __init__(self, bus=None, *args, **kwargs):

1242

1243

def __init__(self, bus = None, *args, **kwargs):

1772

1244

self.bus = bus

1773

1245

Client.__init__(self, *args, **kwargs)

1774

1246

# Only now, when this client is initialized, can it show up on

1775

1247

# the D-Bus

1776

client_object_name = str(self.name).translate(

1248

client_object_name = unicode(self.name).translate(

1777

1249

{ord("."): ord("_"),

1778

1250

ord("-"): ord("_")})

1779

self.dbus_object_path = dbus.ObjectPath(

1780

"/clients/" + client_object_name)

1251

self.dbus_object_path = (dbus.ObjectPath

1252

("/clients/" + client_object_name))

1781

1253

DBusObjectWithProperties.__init__(self, self.bus,

1782

1254

self.dbus_object_path)

1783

1784

def notifychangeproperty(transform_func, dbus_name,

1785

type_func=lambda x: x,

1786

variant_level=1,

1787

invalidate_only=False,

1788

_interface=_interface):

1255

1256

def notifychangeproperty(transform_func,

1257

dbus_name, type_func=lambda x: x,

1258

variant_level=1):

1789

1259

""" Modify a variable so that it's a property which announces

1790

1260

its changes to DBus.

1791

1261

1792

1262

transform_fun: Function that takes a value and a variant_level

1793

1263

and transforms it to a D-Bus type.

1794

1264

dbus_name: D-Bus name of the variable

1796

1266

to the D-Bus. Default: no transform

1797

1267

variant_level: D-Bus variant level. Default: 1

1798

1268

"""

1799

attrname = "_{}".format(dbus_name)

1800

1269

attrname = "_{0}".format(dbus_name)

1801

1270

def setter(self, value):

1802

1271

if hasattr(self, "dbus_object_path"):

1803

1272

if (not hasattr(self, attrname) or

1804

1273

type_func(getattr(self, attrname, None))

1805

1274

!= type_func(value)):

1806

if invalidate_only:

1807

self.PropertiesChanged(

1808

_interface, dbus.Dictionary(),

1809

dbus.Array((dbus_name, )))

1810

else:

1811

dbus_value = transform_func(

1812

type_func(value),

1813

variant_level=variant_level)

1814

self.PropertyChanged(dbus.String(dbus_name),

1815

dbus_value)

1816

self.PropertiesChanged(

1817

_interface,

1818

dbus.Dictionary({dbus.String(dbus_name):

1819

dbus_value}),

1820

dbus.Array())

1275

dbus_value = transform_func(type_func(value),

1276

variant_level

1277

=variant_level)

1278

self.PropertyChanged(dbus.String(dbus_name),

1279

dbus_value)

1821

1280

setattr(self, attrname, value)

1822

1281

1823

1282

return property(lambda self: getattr(self, attrname), setter)

1824

1283

1825

1284

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1826

1285

approvals_pending = notifychangeproperty(dbus.Boolean,

1827

1286

"ApprovalPending",

1828

type_func=bool)

1287

type_func = bool)

1829

1288

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1830

1289

last_enabled = notifychangeproperty(datetime_to_dbus,

1831

1290

"LastEnabled")

1832

checker = notifychangeproperty(

1833

dbus.Boolean, "CheckerRunning",

1834

type_func=lambda checker: checker is not None)

1291

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1292

type_func = lambda checker:

1293

checker is not None)

1835

1294

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1836

1295

"LastCheckedOK")

1837

1296

last_checker_status = notifychangeproperty(dbus.Int16,

1840

1299

datetime_to_dbus, "LastApprovalRequest")

1841

1300

approved_by_default = notifychangeproperty(dbus.Boolean,

1842

1301

"ApprovedByDefault")

1843

approval_delay = notifychangeproperty(

1844

dbus.UInt64, "ApprovalDelay",

1845

type_func=lambda td: td.total_seconds() * 1000)

1302

approval_delay = notifychangeproperty(dbus.UInt64,

1303

"ApprovalDelay",

1304

type_func =

1305

timedelta_to_milliseconds)

1846

1306

approval_duration = notifychangeproperty(

1847

1307

dbus.UInt64, "ApprovalDuration",

1848

type_func=lambda td: td.total_seconds() * 1000)

1308

type_func = timedelta_to_milliseconds)

1849

1309

host = notifychangeproperty(dbus.String, "Host")

1850

timeout = notifychangeproperty(

1851

dbus.UInt64, "Timeout",

1852

type_func=lambda td: td.total_seconds() * 1000)

1310

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1311

type_func =

1312

timedelta_to_milliseconds)

1853

1313

extended_timeout = notifychangeproperty(

1854

1314

dbus.UInt64, "ExtendedTimeout",

1855

type_func=lambda td: td.total_seconds() * 1000)

1856

interval = notifychangeproperty(

1857

dbus.UInt64, "Interval",

1858

type_func=lambda td: td.total_seconds() * 1000)

1315

type_func = timedelta_to_milliseconds)

1316

interval = notifychangeproperty(dbus.UInt64,

1317

"Interval",

1318

type_func =

1319

timedelta_to_milliseconds)

1859

1320

checker_command = notifychangeproperty(dbus.String, "Checker")

1860

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1861

invalidate_only=True)

1862

1321

1863

1322

del notifychangeproperty

1864

1323

1865

1324

def __del__(self, *args, **kwargs):

1866

1325

try:

1867

1326

self.remove_from_connection()

1870

1329

if hasattr(DBusObjectWithProperties, "__del__"):

1871

1330

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1872

1331

Client.__del__(self, *args, **kwargs)

1873

1874

def checker_callback(self, source, condition,

1875

connection, command, *args, **kwargs):

1876

ret = Client.checker_callback(self, source, condition,

1877

connection, command, *args,

1878

**kwargs)

1879

exitstatus = self.last_checker_status

1880

if exitstatus >= 0:

1332

1333

def checker_callback(self, pid, condition, command,

1334

*args, **kwargs):

1335

self.checker_callback_tag = None

1336

self.checker = None

1337

if os.WIFEXITED(condition):

1338

exitstatus = os.WEXITSTATUS(condition)

1881

1339

# Emit D-Bus signal

1882

1340

self.CheckerCompleted(dbus.Int16(exitstatus),

1883

# This is specific to GNU libC

1884

dbus.Int64(exitstatus << 8),

1341

dbus.Int64(condition),

1885

1342

dbus.String(command))

1886

1343

else:

1887

1344

# Emit D-Bus signal

1888

1345

self.CheckerCompleted(dbus.Int16(-1),

1889

dbus.Int64(

1890

# This is specific to GNU libC

1891

(exitstatus << 8)

1892

| self.last_checker_signal),

1346

dbus.Int64(condition),

1893

1347

dbus.String(command))

1894

return ret

1895

1348

1349

return Client.checker_callback(self, pid, condition, command,

1350

*args, **kwargs)

1351

1896

1352

def start_checker(self, *args, **kwargs):

1897

old_checker_pid = getattr(self.checker, "pid", None)

1353

old_checker = self.checker

1354

if self.checker is not None:

1355

old_checker_pid = self.checker.pid

1356

else:

1357

old_checker_pid = None

1898

1358

r = Client.start_checker(self, *args, **kwargs)

1899

1359

# Only if new checker process was started

1900

1360

if (self.checker is not None

1902

1362

# Emit D-Bus signal

1903

1363

self.CheckerStarted(self.current_checker_command)

1904

1364

return r

1905

1365

1906

1366

def _reset_approved(self):

1907

1367

self.approved = None

1908

1368

return False

1909

1369

1910

1370

def approve(self, value=True):

1911

1371

self.approved = value

1912

GLib.timeout_add(int(self.approval_duration.total_seconds()

1913

* 1000), self._reset_approved)

1372

gobject.timeout_add(timedelta_to_milliseconds

1373

(self.approval_duration),

1374

self._reset_approved)

1914

1375

self.send_changedstate()

1915

1916

# D-Bus methods, signals & properties

1917

1918

# Interfaces

1919

1920

# Signals

1921

1376

1377

## D-Bus methods, signals & properties

1378

_interface = "se.recompile.Mandos.Client"

1379

1380

## Interfaces

1381

1382

@dbus_interface_annotations(_interface)

1383

def _foo(self):

1384

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1385

"false"}

1386

1387

## Signals

1388

1922

1389

# CheckerCompleted - signal

1923

1390

@dbus.service.signal(_interface, signature="nxs")

1924

1391

def CheckerCompleted(self, exitcode, waitstatus, command):

1925

1392

"D-Bus signal"

1926

1393

pass

1927

1394

1928

1395

# CheckerStarted - signal

1929

1396

@dbus.service.signal(_interface, signature="s")

1930

1397

def CheckerStarted(self, command):

1931

1398

"D-Bus signal"

1932

1399

pass

1933

1400

1934

1401

# PropertyChanged - signal

1935

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1936

1402

@dbus.service.signal(_interface, signature="sv")

1937

1403

def PropertyChanged(self, property, value):

1938

1404

"D-Bus signal"

1939

1405

pass

1940

1406

1941

1407

# GotSecret - signal

1942

1408

@dbus.service.signal(_interface)

1943

1409

def GotSecret(self):

1946

1412

server to mandos-client

1947

1413

"""

1948

1414

pass

1949

1415

1950

1416

# Rejected - signal

1951

1417

@dbus.service.signal(_interface, signature="s")

1952

1418

def Rejected(self, reason):

1953

1419

"D-Bus signal"

1954

1420

pass

1955

1421

1956

1422

# NeedApproval - signal

1957

1423

@dbus.service.signal(_interface, signature="tb")

1958

1424

def NeedApproval(self, timeout, default):

1959

1425

"D-Bus signal"

1960

1426

return self.need_approval()

1961

1962

# Methods

1963

1427

1428

## Methods

1429

1964

1430

# Approve - method

1965

1431

@dbus.service.method(_interface, in_signature="b")

1966

1432

def Approve(self, value):

1967

1433

self.approve(value)

1968

1434

1969

1435

# CheckedOK - method

1970

1436

@dbus.service.method(_interface)

1971

1437

def CheckedOK(self):

1972

1438

self.checked_ok()

1973

1439

1974

1440

# Enable - method

1975

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1976

1441

@dbus.service.method(_interface)

1977

1442

def Enable(self):

1978

1443

"D-Bus method"

1979

1444

self.enable()

1980

1445

1981

1446

# StartChecker - method

1982

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1983

1447

@dbus.service.method(_interface)

1984

1448

def StartChecker(self):

1985

1449

"D-Bus method"

1986

1450

self.start_checker()

1987

1451

1988

1452

# Disable - method

1989

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1990

1453

@dbus.service.method(_interface)

1991

1454

def Disable(self):

1992

1455

"D-Bus method"

1993

1456

self.disable()

1994

1457

1995

1458

# StopChecker - method

1996

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1997

1459

@dbus.service.method(_interface)

1998

1460

def StopChecker(self):

1999

1461

self.stop_checker()

2000

2001

# Properties

2002

1462

1463

## Properties

1464

2003

1465

# ApprovalPending - property

2004

1466

@dbus_service_property(_interface, signature="b", access="read")

2005

1467

def ApprovalPending_dbus_property(self):

2006

1468

return dbus.Boolean(bool(self.approvals_pending))

2007

1469

2008

1470

# ApprovedByDefault - property

2009

@dbus_service_property(_interface,

2010

signature="b",

1471

@dbus_service_property(_interface, signature="b",

2011

1472

access="readwrite")

2012

1473

def ApprovedByDefault_dbus_property(self, value=None):

2013

1474

if value is None: # get

2014

1475

return dbus.Boolean(self.approved_by_default)

2015

1476

self.approved_by_default = bool(value)

2016

1477

2017

1478

# ApprovalDelay - property

2018

@dbus_service_property(_interface,

2019

signature="t",

1479

@dbus_service_property(_interface, signature="t",

2020

1480

access="readwrite")

2021

1481

def ApprovalDelay_dbus_property(self, value=None):

2022

1482

if value is None: # get

2023

return dbus.UInt64(self.approval_delay.total_seconds()

2024

* 1000)

1483

return dbus.UInt64(self.approval_delay_milliseconds())

2025

1484

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2026

1485

2027

1486

# ApprovalDuration - property

2028

@dbus_service_property(_interface,

2029

signature="t",

1487

@dbus_service_property(_interface, signature="t",

2030

1488

access="readwrite")

2031

1489

def ApprovalDuration_dbus_property(self, value=None):

2032

1490

if value is None: # get

2033

return dbus.UInt64(self.approval_duration.total_seconds()

2034

* 1000)

1491

return dbus.UInt64(timedelta_to_milliseconds(

1492

self.approval_duration))

2035

1493

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2036

1494

2037

1495

# Name - property

2038

@dbus_annotations(

2039

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2040

1496

@dbus_service_property(_interface, signature="s", access="read")

2041

1497

def Name_dbus_property(self):

2042

1498

return dbus.String(self.name)

2043

2044

# KeyID - property

2045

@dbus_annotations(

2046

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2047

@dbus_service_property(_interface, signature="s", access="read")

2048

def KeyID_dbus_property(self):

2049

return dbus.String(self.key_id)

2050

1499

2051

1500

# Fingerprint - property

2052

@dbus_annotations(

2053

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2054

1501

@dbus_service_property(_interface, signature="s", access="read")

2055

1502

def Fingerprint_dbus_property(self):

2056

1503

return dbus.String(self.fingerprint)

2057

1504

2058

1505

# Host - property

2059

@dbus_service_property(_interface,

2060

signature="s",

1506

@dbus_service_property(_interface, signature="s",

2061

1507

access="readwrite")

2062

1508

def Host_dbus_property(self, value=None):

2063

1509

if value is None: # get

2064

1510

return dbus.String(self.host)

2065

self.host = str(value)

2066

1511

self.host = unicode(value)

1512

2067

1513

# Created - property

2068

@dbus_annotations(

2069

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2070

1514

@dbus_service_property(_interface, signature="s", access="read")

2071

1515

def Created_dbus_property(self):

2072

1516

return datetime_to_dbus(self.created)

2073

1517

2074

1518

# LastEnabled - property

2075

1519

@dbus_service_property(_interface, signature="s", access="read")

2076

1520

def LastEnabled_dbus_property(self):

2077

1521

return datetime_to_dbus(self.last_enabled)

2078

1522

2079

1523

# Enabled - property

2080

@dbus_service_property(_interface,

2081

signature="b",

1524

@dbus_service_property(_interface, signature="b",

2082

1525

access="readwrite")

2083

1526

def Enabled_dbus_property(self, value=None):

2084

1527

if value is None: # get

2087

1530

self.enable()

2088

1531

else:

2089

1532

self.disable()

2090

1533

2091

1534

# LastCheckedOK - property

2092

@dbus_service_property(_interface,

2093

signature="s",

1535

@dbus_service_property(_interface, signature="s",

2094

1536

access="readwrite")

2095

1537

def LastCheckedOK_dbus_property(self, value=None):

2096

1538

if value is not None:

2097

1539

self.checked_ok()

2098

1540

return

2099

1541

return datetime_to_dbus(self.last_checked_ok)

2100

1542

2101

1543

# LastCheckerStatus - property

2102

@dbus_service_property(_interface, signature="n", access="read")

1544

@dbus_service_property(_interface, signature="n",

1545

access="read")

2103

1546

def LastCheckerStatus_dbus_property(self):

2104

1547

return dbus.Int16(self.last_checker_status)

2105

1548

2106

1549

# Expires - property

2107

1550

@dbus_service_property(_interface, signature="s", access="read")

2108

1551

def Expires_dbus_property(self):

2109

1552

return datetime_to_dbus(self.expires)

2110

1553

2111

1554

# LastApprovalRequest - property

2112

1555

@dbus_service_property(_interface, signature="s", access="read")

2113

1556

def LastApprovalRequest_dbus_property(self):

2114

1557

return datetime_to_dbus(self.last_approval_request)

2115

1558

2116

1559

# Timeout - property

2117

@dbus_service_property(_interface,

2118

signature="t",

1560

@dbus_service_property(_interface, signature="t",

2119

1561

access="readwrite")

2120

1562

def Timeout_dbus_property(self, value=None):

2121

1563

if value is None: # get

2122

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1564

return dbus.UInt64(self.timeout_milliseconds())

2123

1565

old_timeout = self.timeout

2124

1566

self.timeout = datetime.timedelta(0, 0, 0, value)

2125

1567

# Reschedule disabling

2133

1575

if (getattr(self, "disable_initiator_tag", None)

2134

1576

is None):

2135

1577

return

2136

GLib.source_remove(self.disable_initiator_tag)

2137

self.disable_initiator_tag = GLib.timeout_add(

2138

int((self.expires - now).total_seconds() * 1000),

2139

self.disable)

2140

1578

gobject.source_remove(self.disable_initiator_tag)

1579

self.disable_initiator_tag = (

1580

gobject.timeout_add(

1581

timedelta_to_milliseconds(self.expires - now),

1582

self.disable))

1583

2141

1584

# ExtendedTimeout - property

2142

@dbus_service_property(_interface,

2143

signature="t",

1585

@dbus_service_property(_interface, signature="t",

2144

1586

access="readwrite")

2145

1587

def ExtendedTimeout_dbus_property(self, value=None):

2146

1588

if value is None: # get

2147

return dbus.UInt64(self.extended_timeout.total_seconds()

2148

* 1000)

1589

return dbus.UInt64(self.extended_timeout_milliseconds())

2149

1590

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2150

1591

2151

1592

# Interval - property

2152

@dbus_service_property(_interface,

2153

signature="t",

1593

@dbus_service_property(_interface, signature="t",

2154

1594

access="readwrite")

2155

1595

def Interval_dbus_property(self, value=None):

2156

1596

if value is None: # get

2157

return dbus.UInt64(self.interval.total_seconds() * 1000)

1597

return dbus.UInt64(self.interval_milliseconds())

2158

1598

self.interval = datetime.timedelta(0, 0, 0, value)

2159

1599

if getattr(self, "checker_initiator_tag", None) is None:

2160

1600

return

2161

1601

if self.enabled:

2162

1602

# Reschedule checker run

2163

GLib.source_remove(self.checker_initiator_tag)

2164

self.checker_initiator_tag = GLib.timeout_add(

2165

value, self.start_checker)

2166

self.start_checker() # Start one now, too

2167

1603

gobject.source_remove(self.checker_initiator_tag)

1604

self.checker_initiator_tag = (gobject.timeout_add

1605

(value, self.start_checker))

1606

self.start_checker() # Start one now, too

1607

2168

1608

# Checker - property

2169

@dbus_service_property(_interface,

2170

signature="s",

1609

@dbus_service_property(_interface, signature="s",

2171

1610

access="readwrite")

2172

1611

def Checker_dbus_property(self, value=None):

2173

1612

if value is None: # get

2174

1613

return dbus.String(self.checker_command)

2175

self.checker_command = str(value)

2176

1614

self.checker_command = unicode(value)

1615

2177

1616

# CheckerRunning - property

2178

@dbus_service_property(_interface,

2179

signature="b",

1617

@dbus_service_property(_interface, signature="b",

2180

1618

access="readwrite")

2181

1619

def CheckerRunning_dbus_property(self, value=None):

2182

1620

if value is None: # get

2185

1623

self.start_checker()

2186

1624

else:

2187

1625

self.stop_checker()

2188

1626

2189

1627

# ObjectPath - property

2190

@dbus_annotations(

2191

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2192

"org.freedesktop.DBus.Deprecated": "true"})

2193

1628

@dbus_service_property(_interface, signature="o", access="read")

2194

1629

def ObjectPath_dbus_property(self):

2195

return self.dbus_object_path # is already a dbus.ObjectPath

2196

1630

return self.dbus_object_path # is already a dbus.ObjectPath

1631

2197

1632

# Secret = property

2198

@dbus_annotations(

2199

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2200

"invalidates"})

2201

@dbus_service_property(_interface,

2202

signature="ay",

2203

access="write",

2204

byte_arrays=True)

1633

@dbus_service_property(_interface, signature="ay",

1634

access="write", byte_arrays=True)

2205

1635

def Secret_dbus_property(self, value):

2206

self.secret = bytes(value)

2207

1636

self.secret = str(value)

1637

2208

1638

del _interface

2209

1639

2210

1640

2211

1641

class ProxyClient(object):

2212

def __init__(self, child_pipe, key_id, fpr, address):

1642

def __init__(self, child_pipe, fpr, address):

2213

1643

self._pipe = child_pipe

2214

self._pipe.send(('init', key_id, fpr, address))

1644

self._pipe.send(('init', fpr, address))

2215

1645

if not self._pipe.recv():

2216

raise KeyError(key_id or fpr)

2217

1646

raise KeyError()

1647

2218

1648

def __getattribute__(self, name):

2219

1649

if name == '_pipe':

2220

1650

return super(ProxyClient, self).__getattribute__(name)

2223

1653

if data[0] == 'data':

2224

1654

return data[1]

2225

1655

if data[0] == 'function':

2226

2227

1656

def func(*args, **kwargs):

2228

1657

self._pipe.send(('funcall', name, args, kwargs))

2229

1658

return self._pipe.recv()[1]

2230

2231

1659

return func

2232

1660

2233

1661

def __setattr__(self, name, value):

2234

1662

if name == '_pipe':

2235

1663

return super(ProxyClient, self).__setattr__(name, value)

2238

1666

2239

1667

class ClientHandler(socketserver.BaseRequestHandler, object):

2240

1668

"""A class to handle client connections.

2241

1669

2242

1670

Instantiated once for each connection to handle it.

2243

1671

Note: This will run in its own forked process."""

2244

1672

2245

1673

def handle(self):

2246

1674

with contextlib.closing(self.server.child_pipe) as child_pipe:

2247

1675

logger.info("TCP connection from: %s",

2248

str(self.client_address))

1676

unicode(self.client_address))

2249

1677

logger.debug("Pipe FD: %d",

2250

1678

self.server.child_pipe.fileno())

2251

2252

session = gnutls.ClientSession(self.request)

2253

2254

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2255

# "+AES-256-CBC", "+SHA1",

2256

# "+COMP-NULL", "+CTYPE-OPENPGP",

2257

# "+DHE-DSS"))

1679

1680

session = (gnutls.connection

1681

.ClientSession(self.request,

1682

gnutls.connection

1683

.X509Credentials()))

1684

1685

# Note: gnutls.connection.X509Credentials is really a

1686

# generic GnuTLS certificate credentials object so long as

1687

# no X.509 keys are added to it. Therefore, we can use it

1688

# here despite using OpenPGP certificates.

1689

1690

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1691

# "+AES-256-CBC", "+SHA1",

1692

# "+COMP-NULL", "+CTYPE-OPENPGP",

1693

# "+DHE-DSS"))

2258

1694

# Use a fallback default, since this MUST be set.

2259

1695

priority = self.server.gnutls_priority

2260

1696

if priority is None:

2261

1697

priority = "NORMAL"

2262

gnutls.priority_set_direct(session._c_object,

2263

priority.encode("utf-8"),

2264

None)

2265

1698

(gnutls.library.functions

1699

.gnutls_priority_set_direct(session._c_object,

1700

priority, None))

1701

2266

1702

# Start communication using the Mandos protocol

2267

1703

# Get protocol number

2268

1704

line = self.request.makefile().readline()

2273

1709

except (ValueError, IndexError, RuntimeError) as error:

2274

1710

logger.error("Unknown protocol version: %s", error)

2275

1711

return

2276

1712

2277

1713

# Start GnuTLS connection

2278

1714

try:

2279

1715

session.handshake()

2280

except gnutls.Error as error:

1716

except gnutls.errors.GNUTLSError as error:

2281

1717

logger.warning("Handshake failed: %s", error)

2282

1718

# Do not run session.bye() here: the session is not

2283

1719

# established. Just abandon the request.

2284

1720

return

2285

1721

logger.debug("Handshake succeeded")

2286

1722

2287

1723

approval_required = False

2288

1724

try:

2289

if gnutls.has_rawpk:

2290

fpr = ""

2291

try:

2292

key_id = self.key_id(

2293

self.peer_certificate(session))

2294

except (TypeError, gnutls.Error) as error:

2295

logger.warning("Bad certificate: %s", error)

2296

return

2297

logger.debug("Key ID: %s", key_id)

2298

2299

else:

2300

key_id = ""

2301

try:

2302

fpr = self.fingerprint(

2303

self.peer_certificate(session))

2304

except (TypeError, gnutls.Error) as error:

2305

logger.warning("Bad certificate: %s", error)

2306

return

2307

logger.debug("Fingerprint: %s", fpr)

2308

2309

try:

2310

client = ProxyClient(child_pipe, key_id, fpr,

1725

try:

1726

fpr = self.fingerprint(self.peer_certificate

1727

(session))

1728

except (TypeError,

1729

gnutls.errors.GNUTLSError) as error:

1730

logger.warning("Bad certificate: %s", error)

1731

return

1732

logger.debug("Fingerprint: %s", fpr)

1733

1734

try:

1735

client = ProxyClient(child_pipe, fpr,

2311

1736

self.client_address)

2312

1737

except KeyError:

2313

1738

return

2314

1739

2315

1740

if client.approval_delay:

2316

1741

delay = client.approval_delay

2317

1742

client.approvals_pending += 1

2318

1743

approval_required = True

2319

1744

2320

1745

while True:

2321

1746

if not client.enabled:

2322

1747

logger.info("Client %s is disabled",

2323

client.name)

1748

client.name)

2324

1749

if self.server.use_dbus:

2325

1750

# Emit D-Bus signal

2326

1751

client.Rejected("Disabled")

2327

1752

return

2328

1753

2329

1754

if client.approved or not client.approval_delay:

2330

# We are approved or approval is disabled

1755

#We are approved or approval is disabled

2331

1756

break

2332

1757

elif client.approved is None:

2333

1758

logger.info("Client %s needs approval",

2335

1760

if self.server.use_dbus:

2336

1761

# Emit D-Bus signal

2337

1762

client.NeedApproval(

2338

client.approval_delay.total_seconds()

2339

* 1000, client.approved_by_default)

1763

client.approval_delay_milliseconds(),

1764

client.approved_by_default)

2340

1765

else:

2341

1766

logger.warning("Client %s was not approved",

2342

1767

client.name)

2344

1769

# Emit D-Bus signal

2345

1770

client.Rejected("Denied")

2346

1771

return

2347

2348

# wait until timeout or approved

1772

1773

#wait until timeout or approved

2349

1774

time = datetime.datetime.now()

2350

1775

client.changedstate.acquire()

2351

client.changedstate.wait(delay.total_seconds())

1776

client.changedstate.wait(

1777

float(timedelta_to_milliseconds(delay)

1778

/ 1000))

2352

1779

client.changedstate.release()

2353

1780

time2 = datetime.datetime.now()

2354

1781

if (time2 - time) >= delay:

2364

1791

break

2365

1792

else:

2366

1793

delay -= time2 - time

2367

2368

try:

2369

session.send(client.secret)

2370

except gnutls.Error as error:

2371

logger.warning("gnutls send failed",

2372

exc_info=error)

2373

return

2374

1794

1795

sent_size = 0

1796

while sent_size < len(client.secret):

1797

try:

1798

sent = session.send(client.secret[sent_size:])

1799

except gnutls.errors.GNUTLSError as error:

1800

logger.warning("gnutls send failed",

1801

exc_info=error)

1802

return

1803

logger.debug("Sent: %d, remaining: %d",

1804

sent, len(client.secret)

1805

- (sent_size + sent))

1806

sent_size += sent

1807

2375

1808

logger.info("Sending secret to %s", client.name)

2376

1809

# bump the timeout using extended_timeout

2377

1810

client.bump_timeout(client.extended_timeout)

2378

1811

if self.server.use_dbus:

2379

1812

# Emit D-Bus signal

2380

1813

client.GotSecret()

2381

1814

2382

1815

finally:

2383

1816

if approval_required:

2384

1817

client.approvals_pending -= 1

2385

1818

try:

2386

1819

session.bye()

2387

except gnutls.Error as error:

1820

except gnutls.errors.GNUTLSError as error:

2388

1821

logger.warning("GnuTLS bye failed",

2389

1822

exc_info=error)

2390

1823

2391

1824

@staticmethod

2392

1825

def peer_certificate(session):

2393

"Return the peer's certificate as a bytestring"

2394

try:

2395

cert_type = gnutls.certificate_type_get2(session._c_object,

2396

gnutls.CTYPE_PEERS)

2397

except AttributeError:

2398

cert_type = gnutls.certificate_type_get(session._c_object)

2399

if gnutls.has_rawpk:

2400

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2401

else:

2402

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2403

# If not a valid certificate type...

2404

if cert_type not in valid_cert_types:

2405

logger.info("Cert type %r not in %r", cert_type,

2406

valid_cert_types)

2407

# ...return invalid data

2408

return b""

1826

"Return the peer's OpenPGP certificate as a bytestring"

1827

# If not an OpenPGP certificate...

1828

if (gnutls.library.functions

1829

.gnutls_certificate_type_get(session._c_object)

1830

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1831

# ...do the normal thing

1832

return session.peer_certificate

2409

1833

list_size = ctypes.c_uint(1)

2410

cert_list = (gnutls.certificate_get_peers

1834

cert_list = (gnutls.library.functions

1835

.gnutls_certificate_get_peers

2411

1836

(session._c_object, ctypes.byref(list_size)))

2412

1837

if not bool(cert_list) and list_size.value != 0:

2413

raise gnutls.Error("error getting peer certificate")

1838

raise gnutls.errors.GNUTLSError("error getting peer"

1839

" certificate")

2414

1840

if list_size.value == 0:

2415

1841

return None

2416

1842

cert = cert_list[0]

2417

1843

return ctypes.string_at(cert.data, cert.size)

2418

2419

@staticmethod

2420

def key_id(certificate):

2421

"Convert a certificate bytestring to a hexdigit key ID"

2422

# New GnuTLS "datum" with the public key

2423

datum = gnutls.datum_t(

2424

ctypes.cast(ctypes.c_char_p(certificate),

2425

ctypes.POINTER(ctypes.c_ubyte)),

2426

ctypes.c_uint(len(certificate)))

2427

# XXX all these need to be created in the gnutls "module"

2428

# New empty GnuTLS certificate

2429

pubkey = gnutls.pubkey_t()

2430

gnutls.pubkey_init(ctypes.byref(pubkey))

2431

# Import the raw public key into the certificate

2432

gnutls.pubkey_import(pubkey,

2433

ctypes.byref(datum),

2434

gnutls.X509_FMT_DER)

2435

# New buffer for the key ID

2436

buf = ctypes.create_string_buffer(32)

2437

buf_len = ctypes.c_size_t(len(buf))

2438

# Get the key ID from the raw public key into the buffer

2439

gnutls.pubkey_get_key_id(pubkey,

2440

gnutls.KEYID_USE_SHA256,

2441

ctypes.cast(ctypes.byref(buf),

2442

ctypes.POINTER(ctypes.c_ubyte)),

2443

ctypes.byref(buf_len))

2444

# Deinit the certificate

2445

gnutls.pubkey_deinit(pubkey)

2446

2447

# Convert the buffer to a Python bytestring

2448

key_id = ctypes.string_at(buf, buf_len.value)

2449

# Convert the bytestring to hexadecimal notation

2450

hex_key_id = binascii.hexlify(key_id).upper()

2451

return hex_key_id

2452

1844

2453

1845

@staticmethod

2454

1846

def fingerprint(openpgp):

2455

1847

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2456

1848

# New GnuTLS "datum" with the OpenPGP public key

2457

datum = gnutls.datum_t(

2458

ctypes.cast(ctypes.c_char_p(openpgp),

2459

ctypes.POINTER(ctypes.c_ubyte)),

2460

ctypes.c_uint(len(openpgp)))

1849

datum = (gnutls.library.types

1850

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1851

ctypes.POINTER

1852

(ctypes.c_ubyte)),

1853

ctypes.c_uint(len(openpgp))))

2461

1854

# New empty GnuTLS certificate

2462

crt = gnutls.openpgp_crt_t()

2463

gnutls.openpgp_crt_init(ctypes.byref(crt))

1855

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2464

1858

# Import the OpenPGP public key into the certificate

2465

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2466

gnutls.OPENPGP_FMT_RAW)

1859

(gnutls.library.functions

1860

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1861

gnutls.library.constants

1862

.GNUTLS_OPENPGP_FMT_RAW))

2467

1863

# Verify the self signature in the key

2468

1864

crtverify = ctypes.c_uint()

2469

gnutls.openpgp_crt_verify_self(crt, 0,

2470

ctypes.byref(crtverify))

1865

(gnutls.library.functions

1866

.gnutls_openpgp_crt_verify_self(crt, 0,

1867

ctypes.byref(crtverify)))

2471

1868

if crtverify.value != 0:

2472

gnutls.openpgp_crt_deinit(crt)

2473

raise gnutls.CertificateSecurityError(code

2474

=crtverify.value)

1869

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1870

raise (gnutls.errors.CertificateSecurityError

1871

("Verify failed"))

2475

1872

# New buffer for the fingerprint

2476

1873

buf = ctypes.create_string_buffer(20)

2477

1874

buf_len = ctypes.c_size_t()

2478

1875

# Get the fingerprint from the certificate into the buffer

2479

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2480

ctypes.byref(buf_len))

1876

(gnutls.library.functions

1877

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1878

ctypes.byref(buf_len)))

2481

1879

# Deinit the certificate

2482

gnutls.openpgp_crt_deinit(crt)

1880

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2483

1881

# Convert the buffer to a Python bytestring

2484

1882

fpr = ctypes.string_at(buf, buf_len.value)

2485

1883

# Convert the bytestring to hexadecimal notation

2489

1887

2490

1888

class MultiprocessingMixIn(object):

2491

1889

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2492

2493

1890

def sub_process_main(self, request, address):

2494

1891

try:

2495

1892

self.finish_request(request, address)

2496

1893

except Exception:

2497

1894

self.handle_error(request, address)

2498

1895

self.close_request(request)

2499

1896

2500

1897

def process_request(self, request, address):

2501

1898

"""Start a new process to process the request."""

2502

proc = multiprocessing.Process(target=self.sub_process_main,

2503

args=(request, address))

1899

proc = multiprocessing.Process(target = self.sub_process_main,

1900

args = (request, address))

2504

1901

proc.start()

2505

1902

return proc

2506

1903

2507

1904

2508

1905

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2509

1906

""" adds a pipe to the MixIn """

2510

2511

1907

def process_request(self, request, client_address):

2512

1908

"""Overrides and wraps the original process_request().

2513

1909

2514

1910

This function creates a new pipe in self.pipe

2515

1911

"""

2516

1912

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2517

1913

2518

1914

proc = MultiprocessingMixIn.process_request(self, request,

2519

1915

client_address)

2520

1916

self.child_pipe.close()

2521

1917

self.add_pipe(parent_pipe, proc)

2522

1918

2523

1919

def add_pipe(self, parent_pipe, proc):

2524

1920

"""Dummy function; override as necessary"""

2525

1921

raise NotImplementedError()

2528

1924

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2529

1925

socketserver.TCPServer, object):

2530

1926

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2531

1927

2532

1928

Attributes:

2533

1929

enabled: Boolean; whether this server is activated yet

2534

1930

interface: None or a network interface name (string)

2535

1931

use_ipv6: Boolean; to use IPv6 or not

2536

1932

"""

2537

2538

1933

def __init__(self, server_address, RequestHandlerClass,

2539

interface=None,

2540

use_ipv6=True,

2541

socketfd=None):

1934

interface=None, use_ipv6=True, socketfd=None):

2542

1935

"""If socketfd is set, use that file descriptor instead of

2543

1936

creating a new one with socket.socket().

2544

1937

"""

2550

1943

self.socketfd = socketfd

2551

1944

# Save the original socket.socket() function

2552

1945

self.socket_socket = socket.socket

2553

2554

1946

# To implement --socket, we monkey patch socket.socket.

2555

#

1947

#

2556

1948

# (When socketserver.TCPServer is a new-style class, we

2557

1949

# could make self.socket into a property instead of monkey

2558

1950

# patching socket.socket.)

2559

#

1951

#

2560

1952

# Create a one-time-only replacement for socket.socket()

2561

1953

@functools.wraps(socket.socket)

2562

1954

def socket_wrapper(*args, **kwargs):

2574

1966

# socket_wrapper(), if socketfd was set.

2575

1967

socketserver.TCPServer.__init__(self, server_address,

2576

1968

RequestHandlerClass)

2577

1969

2578

1970

def server_bind(self):

2579

1971

"""This overrides the normal server_bind() function

2580

1972

to bind to an interface if one was specified, and also NOT to

2581

1973

bind to an address or port if they were not specified."""

2582

global SO_BINDTODEVICE

2583

1974

if self.interface is not None:

2584

1975

if SO_BINDTODEVICE is None:

2585

# Fall back to a hard-coded value which seems to be

2586

# common enough.

2587

logger.warning("SO_BINDTODEVICE not found, trying 25")

2588

SO_BINDTODEVICE = 25

2589

try:

2590

self.socket.setsockopt(

2591

socket.SOL_SOCKET, SO_BINDTODEVICE,

2592

(self.interface + "\0").encode("utf-8"))

2593

except socket.error as error:

2594

if error.errno == errno.EPERM:

2595

logger.error("No permission to bind to"

2596

" interface %s", self.interface)

2597

elif error.errno == errno.ENOPROTOOPT:

2598

logger.error("SO_BINDTODEVICE not available;"

2599

" cannot bind to interface %s",

2600

self.interface)

2601

elif error.errno == errno.ENODEV:

2602

logger.error("Interface %s does not exist,"

2603

" cannot bind", self.interface)

2604

else:

2605

raise

1976

logger.error("SO_BINDTODEVICE does not exist;"

1977

" cannot bind to interface %s",

1978

self.interface)

1979

else:

1980

try:

1981

self.socket.setsockopt(socket.SOL_SOCKET,

1982

SO_BINDTODEVICE,

1983

str(self.interface + '\0'))

1984

except socket.error as error:

1985

if error.errno == errno.EPERM:

1986

logger.error("No permission to bind to"

1987

" interface %s", self.interface)

1988

elif error.errno == errno.ENOPROTOOPT:

1989

logger.error("SO_BINDTODEVICE not available;"

1990

" cannot bind to interface %s",

1991

self.interface)

1992

elif error.errno == errno.ENODEV:

1993

logger.error("Interface %s does not exist,"

1994

" cannot bind", self.interface)

1995

else:

1996

raise

2606

1997

# Only bind(2) the socket if we really need to.

2607

1998

if self.server_address[0] or self.server_address[1]:

2608

1999

if not self.server_address[0]:

2609

2000

if self.address_family == socket.AF_INET6:

2610

any_address = "::" # in6addr_any

2001

any_address = "::" # in6addr_any

2611

2002

else:

2612

any_address = "0.0.0.0" # INADDR_ANY

2003

any_address = "0.0.0.0" # INADDR_ANY

2613

2004

self.server_address = (any_address,

2614

2005

self.server_address[1])

2615

2006

elif not self.server_address[1]:

2616

self.server_address = (self.server_address[0], 0)

2007

self.server_address = (self.server_address[0],

2008

0)

2617

2009

# if self.interface:

2618

2010

# self.server_address = (self.server_address[0],

2619

2011

# 0, # port

2625

2017

2626

2018

class MandosServer(IPv6_TCPServer):

2627

2019

"""Mandos server.

2628

2020

2629

2021

Attributes:

2630

2022

clients: set of Client objects

2631

2023

gnutls_priority GnuTLS priority string

2632

2024

use_dbus: Boolean; to emit D-Bus signals or not

2633

2634

Assumes a GLib.MainLoop event loop.

2025

2026

Assumes a gobject.MainLoop event loop.

2635

2027

"""

2636

2637

2028

def __init__(self, server_address, RequestHandlerClass,

2638

interface=None,

2639

use_ipv6=True,

2640

clients=None,

2641

gnutls_priority=None,

2642

use_dbus=True,

2643

socketfd=None):

2029

interface=None, use_ipv6=True, clients=None,

2030

gnutls_priority=None, use_dbus=True, socketfd=None):

2644

2031

self.enabled = False

2645

2032

self.clients = clients

2646

2033

if self.clients is None:

2649

2036

self.gnutls_priority = gnutls_priority

2650

2037

IPv6_TCPServer.__init__(self, server_address,

2651

2038

RequestHandlerClass,

2652

interface=interface,

2653

use_ipv6=use_ipv6,

2654

socketfd=socketfd)

2655

2039

interface = interface,

2040

use_ipv6 = use_ipv6,

2041

socketfd = socketfd)

2656

2042

def server_activate(self):

2657

2043

if self.enabled:

2658

2044

return socketserver.TCPServer.server_activate(self)

2659

2045

2660

2046

def enable(self):

2661

2047

self.enabled = True

2662

2048

2663

2049

def add_pipe(self, parent_pipe, proc):

2664

2050

# Call "handle_ipc" for both data and EOF events

2665

GLib.io_add_watch(

2666

parent_pipe.fileno(),

2667

GLib.IO_IN | GLib.IO_HUP,

2668

functools.partial(self.handle_ipc,

2669

parent_pipe=parent_pipe,

2670

proc=proc))

2671

2672

def handle_ipc(self, source, condition,

2673

parent_pipe=None,

2674

proc=None,

2675

client_object=None):

2051

gobject.io_add_watch(parent_pipe.fileno(),

2052

gobject.IO_IN | gobject.IO_HUP,

2053

functools.partial(self.handle_ipc,

2054

parent_pipe =

2055

parent_pipe,

2056

proc = proc))

2057

2058

def handle_ipc(self, source, condition, parent_pipe=None,

2059

proc = None, client_object=None):

2676

2060

# error, or the other end of multiprocessing.Pipe has closed

2677

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2061

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2678

2062

# Wait for other process to exit

2679

2063

proc.join()

2680

2064

return False

2681

2065

2682

2066

# Read a request from the child

2683

2067

request = parent_pipe.recv()

2684

2068

command = request[0]

2685

2069

2686

2070

if command == 'init':

2687

key_id = request[1].decode("ascii")

2688

fpr = request[2].decode("ascii")

2689

address = request[3]

2690

2691

for c in self.clients.values():

2692

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2693

continue

2694

if key_id and c.key_id == key_id:

2695

client = c

2696

break

2697

if fpr and c.fingerprint == fpr:

2071

fpr = request[1]

2072

address = request[2]

2073

2074

for c in self.clients.itervalues():

2075

if c.fingerprint == fpr:

2698

2076

client = c

2699

2077

break

2700

2078

else:

2701

logger.info("Client not found for key ID: %s, address"

2702

": %s", key_id or fpr, address)

2079

logger.info("Client not found for fingerprint: %s, ad"

2080

"dress: %s", fpr, address)

2703

2081

if self.use_dbus:

2704

2082

# Emit D-Bus signal

2705

mandos_dbus_service.ClientNotFound(key_id or fpr,

2083

mandos_dbus_service.ClientNotFound(fpr,

2706

2084

address[0])

2707

2085

parent_pipe.send(False)

2708

2086

return False

2709

2710

GLib.io_add_watch(

2711

parent_pipe.fileno(),

2712

GLib.IO_IN | GLib.IO_HUP,

2713

functools.partial(self.handle_ipc,

2714

parent_pipe=parent_pipe,

2715

proc=proc,

2716

client_object=client))

2087

2088

gobject.io_add_watch(parent_pipe.fileno(),

2089

gobject.IO_IN | gobject.IO_HUP,

2090

functools.partial(self.handle_ipc,

2091

parent_pipe =

2092

parent_pipe,

2093

proc = proc,

2094

client_object =

2095

client))

2717

2096

parent_pipe.send(True)

2718

2097

# remove the old hook in favor of the new above hook on

2719

2098

# same fileno

2722

2101

funcname = request[1]

2723

2102

args = request[2]

2724

2103

kwargs = request[3]

2725

2104

2726

2105

parent_pipe.send(('data', getattr(client_object,

2727

2106

funcname)(*args,

2728

**kwargs)))

2729

2107

**kwargs)))

2108

2730

2109

if command == 'getattr':

2731

2110

attrname = request[1]

2732

if isinstance(client_object.__getattribute__(attrname),

2733

collections.Callable):

2734

parent_pipe.send(('function', ))

2111

if callable(client_object.__getattribute__(attrname)):

2112

parent_pipe.send(('function',))

2735

2113

else:

2736

parent_pipe.send((

2737

'data', client_object.__getattribute__(attrname)))

2738

2114

parent_pipe.send(('data', client_object

2115

.__getattribute__(attrname)))

2116

2739

2117

if command == 'setattr':

2740

2118

attrname = request[1]

2741

2119

value = request[2]

2742

2120

setattr(client_object, attrname, value)

2743

2121

2744

2122

return True

2745

2123

2746

2124

2747

2125

def rfc3339_duration_to_delta(duration):

2748

2126

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2749

2127

2750

2128

>>> rfc3339_duration_to_delta("P7D")

2751

2129

datetime.timedelta(7)

2752

2130

>>> rfc3339_duration_to_delta("PT60S")

2762

2140

>>> rfc3339_duration_to_delta("P1DT3M20S")

2763

2141

datetime.timedelta(1, 200)

2764

2142

"""

2765

2143

2766

2144

# Parsing an RFC 3339 duration with regular expressions is not

2767

2145

# possible - there would have to be multiple places for the same

2768

2146

# values, like seconds. The current code, while more esoteric, is

2769

2147

# cleaner without depending on a parsing library. If Python had a

2770

2148

# built-in library for parsing we would use it, but we'd like to

2771

2149

# avoid excessive use of external libraries.

2772

2150

2773

2151

# New type for defining tokens, syntax, and semantics all-in-one

2774

Token = collections.namedtuple("Token", (

2775

"regexp", # To match token; if "value" is not None, must have

2776

# a "group" containing digits

2777

"value", # datetime.timedelta or None

2778

"followers")) # Tokens valid after this token

2152

Token = collections.namedtuple("Token",

2153

("regexp", # To match token; if

2154

# "value" is not None,

2155

# must have a "group"

2156

# containing digits

2157

"value", # datetime.timedelta or

2158

# None

2159

"followers")) # Tokens valid after

2160

# this token

2779

2161

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2780

2162

# the "duration" ABNF definition in RFC 3339, Appendix A.

2781

2163

token_end = Token(re.compile(r"$"), None, frozenset())

2782

2164

token_second = Token(re.compile(r"(\d+)S"),

2783

2165

datetime.timedelta(seconds=1),

2784

frozenset((token_end, )))

2166

frozenset((token_end,)))

2785

2167

token_minute = Token(re.compile(r"(\d+)M"),

2786

2168

datetime.timedelta(minutes=1),

2787

2169

frozenset((token_second, token_end)))

2803

2185

frozenset((token_month, token_end)))

2804

2186

token_week = Token(re.compile(r"(\d+)W"),

2805

2187

datetime.timedelta(weeks=1),

2806

frozenset((token_end, )))

2188

frozenset((token_end,)))

2807

2189

token_duration = Token(re.compile(r"P"), None,

2808

2190

frozenset((token_year, token_month,

2809

2191

token_day, token_time,

2810

token_week)))

2811

# Define starting values:

2812

# Value so far

2813

value = datetime.timedelta()

2192

token_week))),

2193

# Define starting values

2194

value = datetime.timedelta() # Value so far

2814

2195

found_token = None

2815

# Following valid tokens

2816

followers = frozenset((token_duration, ))

2817

# String left to parse

2818

s = duration

2196

followers = frozenset(token_duration,) # Following valid tokens

2197

s = duration # String left to parse

2819

2198

# Loop until end token is found

2820

2199

while found_token is not token_end:

2821

2200

# Search for any currently valid tokens

2837

2216

break

2838

2217

else:

2839

2218

# No currently valid tokens were found

2840

raise ValueError("Invalid RFC 3339 duration: {!r}"

2841

.format(duration))

2219

raise ValueError("Invalid RFC 3339 duration")

2842

2220

# End token found

2843

2221

return value

2844

2222

2845

2223

2846

2224

def string_to_delta(interval):

2847

2225

"""Parse a string and return a datetime.timedelta

2848

2226

2849

2227

>>> string_to_delta('7d')

2850

2228

datetime.timedelta(7)

2851

2229

>>> string_to_delta('60s')

2859

2237

>>> string_to_delta('5m 30s')

2860

2238

datetime.timedelta(0, 330)

2861

2239

"""

2862

2240

2863

2241

try:

2864

2242

return rfc3339_duration_to_delta(interval)

2865

2243

except ValueError:

2866

2244

pass

2867

2245

2868

2246

timevalue = datetime.timedelta(0)

2869

2247

for s in interval.split():

2870

2248

try:

2871

suffix = s[-1]

2249

suffix = unicode(s[-1])

2872

2250

value = int(s[:-1])

2873

2251

if suffix == "d":

2874

2252

delta = datetime.timedelta(value)

2881

2259

elif suffix == "w":

2882

2260

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2883

2261

else:

2884

raise ValueError("Unknown suffix {!r}".format(suffix))

2262

raise ValueError("Unknown suffix {0!r}"

2263

.format(suffix))

2885

2264

except IndexError as e:

2886

2265

raise ValueError(*(e.args))

2887

2266

timevalue += delta

2888

2267

return timevalue

2889

2268

2890

2269

2891

def daemon(nochdir=False, noclose=False):

2270

def daemon(nochdir = False, noclose = False):

2892

2271

"""See daemon(3). Standard BSD Unix function.

2893

2272

2894

2273

This should really exist as os.daemon, but it doesn't (yet)."""

2895

2274

if os.fork():

2896

2275

sys.exit()

2904

2283

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2905

2284

if not stat.S_ISCHR(os.fstat(null).st_mode):

2906

2285

raise OSError(errno.ENODEV,

2907

"{} not a character device"

2286

"{0} not a character device"

2908

2287

.format(os.devnull))

2909

2288

os.dup2(null, sys.stdin.fileno())

2910

2289

os.dup2(null, sys.stdout.fileno())

2914

2293

2915

2294

2916

2295

def main():

2917

2296

2918

2297

##################################################################

2919

2298

# Parsing of options, both command line and config file

2920

2299

2921

2300

parser = argparse.ArgumentParser()

2922

2301

parser.add_argument("-v", "--version", action="version",

2923

version="%(prog)s {}".format(version),

2302

version = "%(prog)s {0}".format(version),

2924

2303

help="show version number and exit")

2925

2304

parser.add_argument("-i", "--interface", metavar="IF",

2926

2305

help="Bind to interface IF")

2959

2338

help="Directory to save/restore state in")

2960

2339

parser.add_argument("--foreground", action="store_true",

2961

2340

help="Run in foreground", default=None)

2962

parser.add_argument("--no-zeroconf", action="store_false",

2963

dest="zeroconf", help="Do not use Zeroconf",

2964

default=None)

2965

2341

2966

2342

options = parser.parse_args()

2967

2343

2968

2344

if options.check:

2969

2345

import doctest

2970

2346

fail_count, test_count = doctest.testmod()

2971

2347

sys.exit(os.EX_OK if fail_count == 0 else 1)

2972

2348

2973

2349

# Default values for config file for server-global settings

2974

if gnutls.has_rawpk:

2975

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2976

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2977

else:

2978

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2979

":+SIGN-DSA-SHA256")

2980

server_defaults = {"interface": "",

2981

"address": "",

2982

"port": "",

2983

"debug": "False",

2984

"priority": priority,

2985

"servicename": "Mandos",

2986

"use_dbus": "True",

2987

"use_ipv6": "True",

2988

"debuglevel": "",

2989

"restore": "True",

2990

"socket": "",

2991

"statedir": "/var/lib/mandos",

2992

"foreground": "False",

2993

"zeroconf": "True",

2994

}

2995

del priority

2996

2350

server_defaults = { "interface": "",

2351

"address": "",

2352

"port": "",

2353

"debug": "False",

2354

"priority":

2355

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2356

"servicename": "Mandos",

2357

"use_dbus": "True",

2358

"use_ipv6": "True",

2359

"debuglevel": "",

2360

"restore": "True",

2361

"socket": "",

2362

"statedir": "/var/lib/mandos",

2363

"foreground": "False",

2364

}

2365

2997

2366

# Parse config file for server-global settings

2998

2367

server_config = configparser.SafeConfigParser(server_defaults)

2999

2368

del server_defaults

3000

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2369

server_config.read(os.path.join(options.configdir,

2370

"mandos.conf"))

3001

2371

# Convert the SafeConfigParser object to a dict

3002

2372

server_settings = server_config.defaults()

3003

2373

# Use the appropriate methods on the non-string config options

3004

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3005

"foreground", "zeroconf"):

2374

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3006

2375

server_settings[option] = server_config.getboolean("DEFAULT",

3007

2376

option)

3008

2377

if server_settings["port"]:

3018

2387

server_settings["socket"] = os.dup(server_settings

3019

2388

["socket"])

3020

2389

del server_config

3021

2390

3022

2391

# Override the settings from the config file with command line

3023

2392

# options, if set.

3024

2393

for option in ("interface", "address", "port", "debug",

3025

"priority", "servicename", "configdir", "use_dbus",

3026

"use_ipv6", "debuglevel", "restore", "statedir",

3027

"socket", "foreground", "zeroconf"):

2394

"priority", "servicename", "configdir",

2395

"use_dbus", "use_ipv6", "debuglevel", "restore",

2396

"statedir", "socket", "foreground"):

3028

2397

value = getattr(options, option)

3029

2398

if value is not None:

3030

2399

server_settings[option] = value

3031

2400

del options

3032

2401

# Force all strings to be unicode

3033

2402

for option in server_settings.keys():

3034

if isinstance(server_settings[option], bytes):

3035

server_settings[option] = (server_settings[option]

3036

.decode("utf-8"))

2403

if type(server_settings[option]) is str:

2404

server_settings[option] = unicode(server_settings[option])

3037

2405

# Force all boolean options to be boolean

3038

2406

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3039

"foreground", "zeroconf"):

2407

"foreground"):

3040

2408

server_settings[option] = bool(server_settings[option])

3041

2409

# Debug implies foreground

3042

2410

if server_settings["debug"]:

3043

2411

server_settings["foreground"] = True

3044

2412

# Now we have our good server settings in "server_settings"

3045

2413

3046

2414

##################################################################

3047

3048

if (not server_settings["zeroconf"]

3049

and not (server_settings["port"]

3050

or server_settings["socket"] != "")):

3051

parser.error("Needs port or socket to work without Zeroconf")

3052

2415

3053

2416

# For convenience

3054

2417

debug = server_settings["debug"]

3055

2418

debuglevel = server_settings["debuglevel"]

3058

2421

stored_state_path = os.path.join(server_settings["statedir"],

3059

2422

stored_state_file)

3060

2423

foreground = server_settings["foreground"]

3061

zeroconf = server_settings["zeroconf"]

3062

2424

3063

2425

if debug:

3064

2426

initlogger(debug, logging.DEBUG)

3065

2427

else:

3068

2430

else:

3069

2431

level = getattr(logging, debuglevel.upper())

3070

2432

initlogger(debug, level)

3071

2433

3072

2434

if server_settings["servicename"] != "Mandos":

3073

syslogger.setFormatter(

3074

logging.Formatter('Mandos ({}) [%(process)d]:'

3075

' %(levelname)s: %(message)s'.format(

3076

server_settings["servicename"])))

3077

2435

syslogger.setFormatter(logging.Formatter

2436

('Mandos ({0}) [%(process)d]:'

2437

' %(levelname)s: %(message)s'

2438

.format(server_settings

2439

["servicename"])))

2440

3078

2441

# Parse config file with clients

3079

2442

client_config = configparser.SafeConfigParser(Client

3080

2443

.client_defaults)

3081

2444

client_config.read(os.path.join(server_settings["configdir"],

3082

2445

"clients.conf"))

3083

2446

3084

2447

global mandos_dbus_service

3085

2448

mandos_dbus_service = None

3086

3087

socketfd = None

3088

if server_settings["socket"] != "":

3089

socketfd = server_settings["socket"]

3090

tcp_server = MandosServer(

3091

(server_settings["address"], server_settings["port"]),

3092

ClientHandler,

3093

interface=(server_settings["interface"] or None),

3094

use_ipv6=use_ipv6,

3095

gnutls_priority=server_settings["priority"],

3096

use_dbus=use_dbus,

3097

socketfd=socketfd)

2449

2450

tcp_server = MandosServer((server_settings["address"],

2451

server_settings["port"]),

2452

ClientHandler,

2453

interface=(server_settings["interface"]

2454

or None),

2455

use_ipv6=use_ipv6,

2456

gnutls_priority=

2457

server_settings["priority"],

2458

use_dbus=use_dbus,

2459

socketfd=(server_settings["socket"]

2460

or None))

3098

2461

if not foreground:

3099

2462

pidfilename = "/run/mandos.pid"

3100

2463

if not os.path.isdir("/run/."):

3101

2464

pidfilename = "/var/run/mandos.pid"

3102

2465

pidfile = None

3103

2466

try:

3104

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2467

pidfile = open(pidfilename, "w")

3105

2468

except IOError as e:

3106

2469

logger.error("Could not open file %r", pidfilename,

3107

2470

exc_info=e)

3108

3109

for name, group in (("_mandos", "_mandos"),

3110

("mandos", "mandos"),

3111

("nobody", "nogroup")):

2471

2472

for name in ("_mandos", "mandos", "nobody"):

3112

2473

try:

3113

2474

uid = pwd.getpwnam(name).pw_uid

3114

gid = pwd.getpwnam(group).pw_gid

2475

gid = pwd.getpwnam(name).pw_gid

3115

2476

break

3116

2477

except KeyError:

3117

2478

continue

3121

2482

try:

3122

2483

os.setgid(gid)

3123

2484

os.setuid(uid)

3124

if debug:

3125

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3126

gid))

3127

2485

except OSError as error:

3128

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3129

.format(uid, gid, os.strerror(error.errno)))

3130

2486

if error.errno != errno.EPERM:

3131

2487

raise

3132

2488

3133

2489

if debug:

3134

2490

# Enable all possible GnuTLS debugging

3135

2491

3136

2492

# "Use a log level over 10 to enable all debugging options."

3137

2493

# - GnuTLS manual

3138

gnutls.global_set_log_level(11)

3139

3140

@gnutls.log_func

2494

gnutls.library.functions.gnutls_global_set_log_level(11)

2495

2496

@gnutls.library.types.gnutls_log_func

3141

2497

def debug_gnutls(level, string):

3142

2498

logger.debug("GnuTLS: %s", string[:-1])

3143

3144

gnutls.global_set_log_function(debug_gnutls)

3145

2499

2500

(gnutls.library.functions

2501

.gnutls_global_set_log_function(debug_gnutls))

2502

3146

2503

# Redirect stdin so all checkers get /dev/null

3147

2504

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3148

2505

os.dup2(null, sys.stdin.fileno())

3149

2506

if null > 2:

3150

2507

os.close(null)

3151

2508

3152

2509

# Need to fork before connecting to D-Bus

3153

2510

if not foreground:

3154

2511

# Close all input and output, do double fork, etc.

3155

2512

daemon()

3156

3157

# multiprocessing will use threads, so before we use GLib we need

3158

# to inform GLib that threads will be used.

3159

GLib.threads_init()

3160

2513

2514

# multiprocessing will use threads, so before we use gobject we

2515

# need to inform gobject that threads will be used.

2516

gobject.threads_init()

2517

3161

2518

global main_loop

3162

2519

# From the Avahi example code

3163

2520

DBusGMainLoop(set_as_default=True)

3164

main_loop = GLib.MainLoop()

2521

main_loop = gobject.MainLoop()

3165

2522

bus = dbus.SystemBus()

3166

2523

# End of Avahi example code

3167

2524

if use_dbus:

3168

2525

try:

3169

2526

bus_name = dbus.service.BusName("se.recompile.Mandos",

3170

bus,

3171

do_not_queue=True)

3172

old_bus_name = dbus.service.BusName(

3173

"se.bsnet.fukt.Mandos", bus,

3174

do_not_queue=True)

3175

except dbus.exceptions.DBusException as e:

2527

bus, do_not_queue=True)

2528

old_bus_name = (dbus.service.BusName

2529

("se.bsnet.fukt.Mandos", bus,

2530

do_not_queue=True))

2531

except dbus.exceptions.NameExistsException as e:

3176

2532

logger.error("Disabling D-Bus:", exc_info=e)

3177

2533

use_dbus = False

3178

2534

server_settings["use_dbus"] = False

3179

2535

tcp_server.use_dbus = False

3180

if zeroconf:

3181

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3182

service = AvahiServiceToSyslog(

3183

name=server_settings["servicename"],

3184

servicetype="_mandos._tcp",

3185

protocol=protocol,

3186

bus=bus)

3187

if server_settings["interface"]:

3188

service.interface = if_nametoindex(

3189

server_settings["interface"].encode("utf-8"))

3190

2536

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2537

service = AvahiServiceToSyslog(name =

2538

server_settings["servicename"],

2539

servicetype = "_mandos._tcp",

2540

protocol = protocol, bus = bus)

2541

if server_settings["interface"]:

2542

service.interface = (if_nametoindex

2543

(str(server_settings["interface"])))

2544

3191

2545

global multiprocessing_manager

3192

2546

multiprocessing_manager = multiprocessing.Manager()

3193

2547

3194

2548

client_class = Client

3195

2549

if use_dbus:

3196

client_class = functools.partial(ClientDBus, bus=bus)

3197

2550

client_class = functools.partial(ClientDBus, bus = bus)

2551

3198

2552

client_settings = Client.config_parser(client_config)

3199

2553

old_client_settings = {}

3200

2554

clients_data = {}

3201

2555

3202

2556

# This is used to redirect stdout and stderr for checker processes

3203

2557

global wnull

3204

wnull = open(os.devnull, "w") # A writable /dev/null

2558

wnull = open(os.devnull, "w") # A writable /dev/null

3205

2559

# Only used if server is running in foreground but not in debug

3206

2560

# mode

3207

2561

if debug or not foreground:

3208

2562

wnull.close()

3209

2563

3210

2564

# Get client data and settings from last running state.

3211

2565

if server_settings["restore"]:

3212

2566

try:

3213

2567

with open(stored_state_path, "rb") as stored_state:

3214

if sys.version_info.major == 2:

3215

clients_data, old_client_settings = pickle.load(

3216

stored_state)

3217

else:

3218

bytes_clients_data, bytes_old_client_settings = (

3219

pickle.load(stored_state, encoding="bytes"))

3220

# Fix bytes to strings

3221

# clients_data

3222

# .keys()

3223

clients_data = {(key.decode("utf-8")

3224

if isinstance(key, bytes)

3225

else key): value

3226

for key, value in

3227

bytes_clients_data.items()}

3228

del bytes_clients_data

3229

for key in clients_data:

3230

value = {(k.decode("utf-8")

3231

if isinstance(k, bytes) else k): v

3232

for k, v in

3233

clients_data[key].items()}

3234

clients_data[key] = value

3235

# .client_structure

3236

value["client_structure"] = [

3237

(s.decode("utf-8")

3238

if isinstance(s, bytes)

3239

else s) for s in

3240

value["client_structure"]]

3241

# .name & .host

3242

for k in ("name", "host"):

3243

if isinstance(value[k], bytes):

3244

value[k] = value[k].decode("utf-8")

3245

if not value.has_key("key_id"):

3246

value["key_id"] = ""

3247

elif not value.has_key("fingerprint"):

3248

value["fingerprint"] = ""

3249

# old_client_settings

3250

# .keys()

3251

old_client_settings = {

3252

(key.decode("utf-8")

3253

if isinstance(key, bytes)

3254

else key): value

3255

for key, value in

3256

bytes_old_client_settings.items()}

3257

del bytes_old_client_settings

3258

# .host

3259

for value in old_client_settings.values():

3260

if isinstance(value["host"], bytes):

3261

value["host"] = (value["host"]

3262

.decode("utf-8"))

2568

clients_data, old_client_settings = (pickle.load

2569

(stored_state))

3263

2570

os.remove(stored_state_path)

3264

2571

except IOError as e:

3265

2572

if e.errno == errno.ENOENT:

3266

logger.warning("Could not load persistent state:"

3267

" {}".format(os.strerror(e.errno)))

2573

logger.warning("Could not load persistent state: {0}"

2574

.format(os.strerror(e.errno)))

3268

2575

else:

3269

2576

logger.critical("Could not load persistent state:",

3270

2577

exc_info=e)

3271

2578

raise

3272

2579

except EOFError as e:

3273

2580

logger.warning("Could not load persistent state: "

3274

"EOFError:",

3275

exc_info=e)

3276

2581

"EOFError:", exc_info=e)

2582

3277

2583

with PGPEngine() as pgp:

3278

for client_name, client in clients_data.items():

2584

for client_name, client in clients_data.iteritems():

3279

2585

# Skip removed clients

3280

2586

if client_name not in client_settings:

3281

2587

continue

3282

2588

3283

2589

# Decide which value to use after restoring saved state.

3284

2590

# We have three different values: Old config file,

3285

2591

# new config file, and saved state.

3290

2596

# For each value in new config, check if it

3291

2597

# differs from the old config value (Except for

3292

2598

# the "secret" attribute)

3293

if (name != "secret"

3294

and (value !=

3295

old_client_settings[client_name][name])):

2599

if (name != "secret" and

2600

value != old_client_settings[client_name]

2601

[name]):

3296

2602

client[name] = value

3297

2603

except KeyError:

3298

2604

pass

3299

2605

3300

2606

# Clients who has passed its expire date can still be

3301

# enabled if its last checker was successful. A Client

2607

# enabled if its last checker was successful. Clients

3302

2608

# whose checker succeeded before we stored its state is

3303

2609

# assumed to have successfully run all checkers during

3304

2610

# downtime.

3306

2612

if datetime.datetime.utcnow() >= client["expires"]:

3307

2613

if not client["last_checked_ok"]:

3308

2614

logger.warning(

3309

"disabling client {} - Client never "

3310

"performed a successful checker".format(

3311

client_name))

2615

"disabling client {0} - Client never "

2616

"performed a successful checker"

2617

.format(client_name))

3312

2618

client["enabled"] = False

3313

2619

elif client["last_checker_status"] != 0:

3314

2620

logger.warning(

3315

"disabling client {} - Client last"

3316

" checker failed with error code"

3317

" {}".format(

3318

client_name,

3319

client["last_checker_status"]))

2621

"disabling client {0} - Client "

2622

"last checker failed with error code {1}"

2623

.format(client_name,

2624

client["last_checker_status"]))

3320

2625

client["enabled"] = False

3321

2626

else:

3322

client["expires"] = (

3323

datetime.datetime.utcnow()

3324

+ client["timeout"])

2627

client["expires"] = (datetime.datetime

2628

.utcnow()

2629

+ client["timeout"])

3325

2630

logger.debug("Last checker succeeded,"

3326

" keeping {} enabled".format(

3327

client_name))

2631

" keeping {0} enabled"

2632

.format(client_name))

3328

2633

try:

3329

client["secret"] = pgp.decrypt(

3330

client["encrypted_secret"],

3331

client_settings[client_name]["secret"])

2634

client["secret"] = (

2635

pgp.decrypt(client["encrypted_secret"],

2636

client_settings[client_name]

2637

["secret"]))

3332

2638

except PGPError:

3333

2639

# If decryption fails, we use secret from new settings

3334

logger.debug("Failed to decrypt {} old secret".format(

3335

client_name))

3336

client["secret"] = (client_settings[client_name]

3337

["secret"])

3338

2640

logger.debug("Failed to decrypt {0} old secret"

2641

.format(client_name))

2642

client["secret"] = (

2643

client_settings[client_name]["secret"])

2644

3339

2645

# Add/remove clients based on new changes made to config

3340

2646

for client_name in (set(old_client_settings)

3341

2647

- set(client_settings)):

3343

2649

for client_name in (set(client_settings)

3344

2650

- set(old_client_settings)):

3345

2651

clients_data[client_name] = client_settings[client_name]

3346

2652

3347

2653

# Create all client objects

3348

for client_name, client in clients_data.items():

2654

for client_name, client in clients_data.iteritems():

3349

2655

tcp_server.clients[client_name] = client_class(

3350

name=client_name,

3351

settings=client,

3352

server_settings=server_settings)

3353

2656

name = client_name, settings = client,

2657

server_settings = server_settings)

2658

3354

2659

if not tcp_server.clients:

3355

2660

logger.warning("No clients defined")

3356

2661

3357

2662

if not foreground:

3358

2663

if pidfile is not None:

3359

pid = os.getpid()

3360

2664

try:

3361

2665

with pidfile:

3362

print(pid, file=pidfile)

2666

pid = os.getpid()

2667

pidfile.write(str(pid) + "\n".encode("utf-8"))

3363

2668

except IOError:

3364

2669

logger.error("Could not write to file %r with PID %d",

3365

2670

pidfilename, pid)

3366

2671

del pidfile

3367

2672

del pidfilename

3368

3369

for termsig in (signal.SIGHUP, signal.SIGTERM):

3370

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3371

lambda: main_loop.quit() and False)

3372

2673

2674

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2675

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2676

3373

2677

if use_dbus:

3374

3375

@alternate_dbus_interfaces(

3376

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3377

class MandosDBusService(DBusObjectWithObjectManager):

2678

@alternate_dbus_interfaces({"se.recompile.Mandos":

2679

"se.bsnet.fukt.Mandos"})

2680

class MandosDBusService(DBusObjectWithProperties):

3378

2681

"""A D-Bus proxy object"""

3379

3380

2682

def __init__(self):

3381

2683

dbus.service.Object.__init__(self, bus, "/")

3382

3383

2684

_interface = "se.recompile.Mandos"

3384

2685

2686

@dbus_interface_annotations(_interface)

2687

def _foo(self):

2688

return { "org.freedesktop.DBus.Property"

2689

".EmitsChangedSignal":

2690

"false"}

2691

3385

2692

@dbus.service.signal(_interface, signature="o")

3386

2693

def ClientAdded(self, objpath):

3387

2694

"D-Bus signal"

3388

2695

pass

3389

2696

3390

2697

@dbus.service.signal(_interface, signature="ss")

3391

def ClientNotFound(self, key_id, address):

2698

def ClientNotFound(self, fingerprint, address):

3392

2699

"D-Bus signal"

3393

2700

pass

3394

3395

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3396

"true"})

2701

3397

2702

@dbus.service.signal(_interface, signature="os")

3398

2703

def ClientRemoved(self, objpath, name):

3399

2704

"D-Bus signal"

3400

2705

pass

3401

3402

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3403

"true"})

2706

3404

2707

@dbus.service.method(_interface, out_signature="ao")

3405

2708

def GetAllClients(self):

3406

2709

"D-Bus method"

3407

return dbus.Array(c.dbus_object_path for c in

3408

tcp_server.clients.values())

3409

3410

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3411

"true"})

2710

return dbus.Array(c.dbus_object_path

2711

for c in

2712

tcp_server.clients.itervalues())

2713

3412

2714

@dbus.service.method(_interface,

3413

2715

out_signature="a{oa{sv}}")

3414

2716

def GetAllClientsWithProperties(self):

3415

2717

"D-Bus method"

3416

2718

return dbus.Dictionary(

3417

{c.dbus_object_path: c.GetAll(

3418

"se.recompile.Mandos.Client")

3419

for c in tcp_server.clients.values()},

2719

((c.dbus_object_path, c.GetAll(""))

2720

for c in tcp_server.clients.itervalues()),

3420

2721

signature="oa{sv}")

3421

2722

3422

2723

@dbus.service.method(_interface, in_signature="o")

3423

2724

def RemoveClient(self, object_path):

3424

2725

"D-Bus method"

3425

for c in tcp_server.clients.values():

2726

for c in tcp_server.clients.itervalues():

3426

2727

if c.dbus_object_path == object_path:

3427

2728

del tcp_server.clients[c.name]

3428

2729

c.remove_from_connection()

3429

# Don't signal the disabling

2730

# Don't signal anything except ClientRemoved

3430

2731

c.disable(quiet=True)

3431

# Emit D-Bus signal for removal

3432

self.client_removed_signal(c)

2732

# Emit D-Bus signal

2733

self.ClientRemoved(object_path, c.name)

3433

2734

return

3434

2735

raise KeyError(object_path)

3435

2736

3436

2737

del _interface

3437

3438

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3439

out_signature="a{oa{sa{sv}}}")

3440

def GetManagedObjects(self):

3441

"""D-Bus method"""

3442

return dbus.Dictionary(

3443

{client.dbus_object_path:

3444

dbus.Dictionary(

3445

{interface: client.GetAll(interface)

3446

for interface in

3447

client._get_all_interface_names()})

3448

for client in tcp_server.clients.values()})

3449

3450

def client_added_signal(self, client):

3451

"""Send the new standard signal and the old signal"""

3452

if use_dbus:

3453

# New standard signal

3454

self.InterfacesAdded(

3455

client.dbus_object_path,

3456

dbus.Dictionary(

3457

{interface: client.GetAll(interface)

3458

for interface in

3459

client._get_all_interface_names()}))

3460

# Old signal

3461

self.ClientAdded(client.dbus_object_path)

3462

3463

def client_removed_signal(self, client):

3464

"""Send the new standard signal and the old signal"""

3465

if use_dbus:

3466

# New standard signal

3467

self.InterfacesRemoved(

3468

client.dbus_object_path,

3469

client._get_all_interface_names())

3470

# Old signal

3471

self.ClientRemoved(client.dbus_object_path,

3472

client.name)

3473

2738

3474

2739

mandos_dbus_service = MandosDBusService()

3475

3476

# Save modules to variables to exempt the modules from being

3477

# unloaded before the function registered with atexit() is run.

3478

mp = multiprocessing

3479

wn = wnull

3480

2740

3481

2741

def cleanup():

3482

2742

"Cleanup function; run on exit"

3483

if zeroconf:

3484

service.cleanup()

3485

3486

mp.active_children()

3487

wn.close()

2743

service.cleanup()

2744

2745

multiprocessing.active_children()

2746

wnull.close()

3488

2747

if not (tcp_server.clients or client_settings):

3489

2748

return

3490

2749

3491

2750

# Store client before exiting. Secrets are encrypted with key

3492

2751

# based on what config file has. If config file is

3493

2752

# removed/edited, old secret will thus be unrecovable.

3494

2753

clients = {}

3495

2754

with PGPEngine() as pgp:

3496

for client in tcp_server.clients.values():

2755

for client in tcp_server.clients.itervalues():

3497

2756

key = client_settings[client.name]["secret"]

3498

2757

client.encrypted_secret = pgp.encrypt(client.secret,

3499

2758

key)

3500

2759

client_dict = {}

3501

2760

3502

2761

# A list of attributes that can not be pickled

3503

2762

# + secret.

3504

exclude = {"bus", "changedstate", "secret",

3505

"checker", "server_settings"}

3506

for name, typ in inspect.getmembers(dbus.service

3507

.Object):

2763

exclude = set(("bus", "changedstate", "secret",

2764

"checker", "server_settings"))

2765

for name, typ in (inspect.getmembers

2766

(dbus.service.Object)):

3508

2767

exclude.add(name)

3509

2768

3510

2769

client_dict["encrypted_secret"] = (client

3511

2770

.encrypted_secret)

3512

2771

for attr in client.client_structure:

3513

2772

if attr not in exclude:

3514

2773

client_dict[attr] = getattr(client, attr)

3515

2774

3516

2775

clients[client.name] = client_dict

3517

2776

del client_settings[client.name]["secret"]

3518

2777

3519

2778

try:

3520

with tempfile.NamedTemporaryFile(

3521

mode='wb',

3522

suffix=".pickle",

3523

prefix='clients-',

3524

dir=os.path.dirname(stored_state_path),

3525

delete=False) as stored_state:

3526

pickle.dump((clients, client_settings), stored_state,

3527

protocol=2)

3528

tempname = stored_state.name

2779

with (tempfile.NamedTemporaryFile

2780

(mode='wb', suffix=".pickle", prefix='clients-',

2781

dir=os.path.dirname(stored_state_path),

2782

delete=False)) as stored_state:

2783

pickle.dump((clients, client_settings), stored_state)

2784

tempname=stored_state.name

3529

2785

os.rename(tempname, stored_state_path)

3530

2786

except (IOError, OSError) as e:

3531

2787

if not debug:

3534

2790

except NameError:

3535

2791

pass

3536

2792

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3537

logger.warning("Could not save persistent state: {}"

2793

logger.warning("Could not save persistent state: {0}"

3538

2794

.format(os.strerror(e.errno)))

3539

2795

else:

3540

2796

logger.warning("Could not save persistent state:",

3541

2797

exc_info=e)

3542

2798

raise

3543

2799

3544

2800

# Delete all clients, and settings from config

3545

2801

while tcp_server.clients:

3546

2802

name, client = tcp_server.clients.popitem()

3547

2803

if use_dbus:

3548

2804

client.remove_from_connection()

3549

# Don't signal the disabling

2805

# Don't signal anything except ClientRemoved

3550

2806

client.disable(quiet=True)

3551

# Emit D-Bus signal for removal

3552

2807

if use_dbus:

3553

mandos_dbus_service.client_removed_signal(client)

2808

# Emit D-Bus signal

2809

mandos_dbus_service.ClientRemoved(client

2810

.dbus_object_path,

2811

client.name)

3554

2812

client_settings.clear()

3555

2813

3556

2814

atexit.register(cleanup)

3557

3558

for client in tcp_server.clients.values():

2815

2816

for client in tcp_server.clients.itervalues():

3559

2817

if use_dbus:

3560

# Emit D-Bus signal for adding

3561

mandos_dbus_service.client_added_signal(client)

2818

# Emit D-Bus signal

2819

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3562

2820

# Need to initiate checking of clients

3563

2821

if client.enabled:

3564

2822

client.init_checker()

3565

2823

3566

2824

tcp_server.enable()

3567

2825

tcp_server.server_activate()

3568

2826

3569

2827

# Find out what port we got

3570

if zeroconf:

3571

service.port = tcp_server.socket.getsockname()[1]

2828

service.port = tcp_server.socket.getsockname()[1]

3572

2829

if use_ipv6:

3573

2830

logger.info("Now listening on address %r, port %d,"

3574

2831

" flowinfo %d, scope_id %d",

3576

2833

else: # IPv4

3577

2834

logger.info("Now listening on address %r, port %d",

3578

2835

*tcp_server.socket.getsockname())

3579

3580

# service.interface = tcp_server.socket.getsockname()[3]

3581

2836

2837

#service.interface = tcp_server.socket.getsockname()[3]

2838

3582

2839

try:

3583

if zeroconf:

3584

# From the Avahi example code

3585

try:

3586

service.activate()

3587

except dbus.exceptions.DBusException as error:

3588

logger.critical("D-Bus Exception", exc_info=error)

3589

cleanup()

3590

sys.exit(1)

3591

# End of Avahi example code

3592

3593

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3594

lambda *args, **kwargs:

3595

(tcp_server.handle_request

3596

(*args[2:], **kwargs) or True))

3597

2840

# From the Avahi example code

2841

try:

2842

service.activate()

2843

except dbus.exceptions.DBusException as error:

2844

logger.critical("D-Bus Exception", exc_info=error)

2845

cleanup()

2846

sys.exit(1)

2847

# End of Avahi example code

2848

2849

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2850

lambda *args, **kwargs:

2851

(tcp_server.handle_request

2852

(*args[2:], **kwargs) or True))

2853

3598

2854

logger.debug("Starting main loop")

3599

2855

main_loop.run()

3600

2856

except AvahiError as error:

3609

2865

# Must run before the D-Bus bus name gets deregistered

3610

2866

cleanup()

3611

2867

3612

3613

2868

if __name__ == '__main__':

3614

2869

main()