To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 659
- compare with another revision
- download diff
- download tarball
- view history from revision 659
- Committer: Teddy Hogeborn
- Date: 2014-03-01 09:39:25 UTC
- Revision ID: teddy@recompile.se-20140301093925-0x6nwf21f0zljk6e
* debian/copyright: Change year to "2014".
* mandos-ctl: - '' -
* mandos-monitor: - '' -
* plugins.d/mandos-client.xml: - '' -
* mandos-ctl: - '' -
* mandos-monitor: - '' -
* plugins.d/mandos-client.xml: - '' -
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- debian/upstream
- dracut-module
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
try:
44
import SocketServer as socketserver
45
except ImportError:
46
import socketserver
39
import SocketServer as socketserver
47
40
import socket
48
41
import argparse
49
42
import datetime
50
43
import errno
51
try:
52
import ConfigParser as configparser
53
except ImportError:
54
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
55
51
import sys
56
52
import re
57
53
import os
66
62
import struct
67
63
import fcntl
68
64
import functools
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
65
import cPickle as pickle
73
66
import multiprocessing
74
67
import types
75
68
import binascii
76
69
import tempfile
77
70
import itertools
78
71
import collections
79
import codecs
80
72
81
73
import dbus
82
74
import dbus.service
83
import gi
84
from gi.repository import GLib
75
import gobject
76
import avahi
85
77
from dbus.mainloop.glib import DBusGMainLoop
86
78
import ctypes
87
79
import ctypes.util
88
80
import xml.dom.minidom
89
81
import inspect
90
82
91
if sys.version_info.major == 2:
92
__metaclass__ = type
93
94
# Try to find the value of SO_BINDTODEVICE:
95
83
try:
96
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
97
# newer, and it is also the most natural place for it:
98
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
99
85
except AttributeError:
100
86
try:
101
# This is where SO_BINDTODEVICE was up to and including Python
102
# 2.6, and also 3.2:
103
87
from IN import SO_BINDTODEVICE
104
88
except ImportError:
105
# In Python 2.7 it seems to have been removed entirely.
106
# Try running the C preprocessor:
107
try:
108
cc = subprocess.Popen(["cc", "--language=c", "-E",
109
"/dev/stdin"],
110
stdin=subprocess.PIPE,
111
stdout=subprocess.PIPE)
112
stdout = cc.communicate(
113
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
114
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
115
except (OSError, ValueError, IndexError):
116
# No value found
117
SO_BINDTODEVICE = None
118
119
if sys.version_info.major == 2:
120
str = unicode
121
122
if sys.version_info < (3, 2):
123
configparser.Configparser = configparser.SafeConfigParser
124
125
version = "1.8.8"
89
SO_BINDTODEVICE = None
90
91
version = "1.6.4"
126
92
stored_state_file = "clients.pickle"
127
93
128
94
logger = logging.getLogger()
129
95
syslogger = None
130
96
131
97
try:
132
if_nametoindex = ctypes.cdll.LoadLibrary(
133
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
134
101
except (OSError, AttributeError):
135
136
102
def if_nametoindex(interface):
137
103
"Get an interface index the hard way, i.e. using fcntl()"
138
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
139
105
with contextlib.closing(socket.socket()) as s:
140
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
141
struct.pack(b"16s16x", interface))
142
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
143
111
return interface_index
144
112
145
113
146
def copy_function(func):
147
"""Make a copy of a function"""
148
if sys.version_info.major == 2:
149
return types.FunctionType(func.func_code,
150
func.func_globals,
151
func.func_name,
152
func.func_defaults,
153
func.func_closure)
154
else:
155
return types.FunctionType(func.__code__,
156
func.__globals__,
157
func.__name__,
158
func.__defaults__,
159
func.__closure__)
160
161
162
114
def initlogger(debug, level=logging.WARNING):
163
115
"""init logger and add loglevel"""
164
165
global syslogger
166
syslogger = (logging.handlers.SysLogHandler(
167
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
168
address="/dev/log"))
116
117
syslogger = (logging.handlers.SysLogHandler
118
(facility =
119
logging.handlers.SysLogHandler.LOG_DAEMON,
120
address = str("/dev/log")))
169
121
syslogger.setFormatter(logging.Formatter
170
122
('Mandos [%(process)d]: %(levelname)s:'
171
123
' %(message)s'))
172
124
logger.addHandler(syslogger)
173
125
174
126
if debug:
175
127
console = logging.StreamHandler()
176
128
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
186
138
pass
187
139
188
140
189
class PGPEngine:
141
class PGPEngine(object):
190
142
"""A simple class for OpenPGP symmetric encryption & decryption"""
191
192
143
def __init__(self):
193
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
194
self.gpg = "gpg"
195
try:
196
output = subprocess.check_output(["gpgconf"])
197
for line in output.splitlines():
198
name, text, path = line.split(b":")
199
if name == "gpg":
200
self.gpg = path
201
break
202
except OSError as e:
203
if e.errno != errno.ENOENT:
204
raise
205
145
self.gnupgargs = ['--batch',
206
'--homedir', self.tempdir,
146
'--home', self.tempdir,
207
147
'--force-mdc',
208
'--quiet']
209
# Only GPG version 1 has the --no-use-agent option.
210
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
211
self.gnupgargs.append("--no-use-agent")
212
148
'--quiet',
149
'--no-use-agent']
150
213
151
def __enter__(self):
214
152
return self
215
153
216
154
def __exit__(self, exc_type, exc_value, traceback):
217
155
self._cleanup()
218
156
return False
219
157
220
158
def __del__(self):
221
159
self._cleanup()
222
160
223
161
def _cleanup(self):
224
162
if self.tempdir is not None:
225
163
# Delete contents of tempdir
226
164
for root, dirs, files in os.walk(self.tempdir,
227
topdown=False):
165
topdown = False):
228
166
for filename in files:
229
167
os.remove(os.path.join(root, filename))
230
168
for dirname in dirs:
232
170
# Remove tempdir
233
171
os.rmdir(self.tempdir)
234
172
self.tempdir = None
235
173
236
174
def password_encode(self, password):
237
175
# Passphrase can not be empty and can not contain newlines or
238
176
# NUL bytes. So we prefix it and hex encode it.
243
181
.replace(b"\n", b"\\n")
244
182
.replace(b"\0", b"\\x00"))
245
183
return encoded
246
184
247
185
def encrypt(self, data, password):
248
186
passphrase = self.password_encode(password)
249
with tempfile.NamedTemporaryFile(
250
dir=self.tempdir) as passfile:
187
with tempfile.NamedTemporaryFile(dir=self.tempdir
188
) as passfile:
251
189
passfile.write(passphrase)
252
190
passfile.flush()
253
proc = subprocess.Popen([self.gpg, '--symmetric',
191
proc = subprocess.Popen(['gpg', '--symmetric',
254
192
'--passphrase-file',
255
193
passfile.name]
256
194
+ self.gnupgargs,
257
stdin=subprocess.PIPE,
258
stdout=subprocess.PIPE,
259
stderr=subprocess.PIPE)
260
ciphertext, err = proc.communicate(input=data)
195
stdin = subprocess.PIPE,
196
stdout = subprocess.PIPE,
197
stderr = subprocess.PIPE)
198
ciphertext, err = proc.communicate(input = data)
261
199
if proc.returncode != 0:
262
200
raise PGPError(err)
263
201
return ciphertext
264
202
265
203
def decrypt(self, data, password):
266
204
passphrase = self.password_encode(password)
267
with tempfile.NamedTemporaryFile(
268
dir=self.tempdir) as passfile:
205
with tempfile.NamedTemporaryFile(dir = self.tempdir
206
) as passfile:
269
207
passfile.write(passphrase)
270
208
passfile.flush()
271
proc = subprocess.Popen([self.gpg, '--decrypt',
209
proc = subprocess.Popen(['gpg', '--decrypt',
272
210
'--passphrase-file',
273
211
passfile.name]
274
212
+ self.gnupgargs,
275
stdin=subprocess.PIPE,
276
stdout=subprocess.PIPE,
277
stderr=subprocess.PIPE)
278
decrypted_plaintext, err = proc.communicate(input=data)
213
stdin = subprocess.PIPE,
214
stdout = subprocess.PIPE,
215
stderr = subprocess.PIPE)
216
decrypted_plaintext, err = proc.communicate(input
217
= data)
279
218
if proc.returncode != 0:
280
219
raise PGPError(err)
281
220
return decrypted_plaintext
282
221
283
222
284
# Pretend that we have an Avahi module
285
class avahi:
286
"""This isn't so much a class as it is a module-like namespace."""
287
IF_UNSPEC = -1 # avahi-common/address.h
288
PROTO_UNSPEC = -1 # avahi-common/address.h
289
PROTO_INET = 0 # avahi-common/address.h
290
PROTO_INET6 = 1 # avahi-common/address.h
291
DBUS_NAME = "org.freedesktop.Avahi"
292
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
293
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
294
DBUS_PATH_SERVER = "/"
295
296
@staticmethod
297
def string_array_to_txt_array(t):
298
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
299
for s in t), signature="ay")
300
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
301
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
302
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
303
SERVER_INVALID = 0 # avahi-common/defs.h
304
SERVER_REGISTERING = 1 # avahi-common/defs.h
305
SERVER_RUNNING = 2 # avahi-common/defs.h
306
SERVER_COLLISION = 3 # avahi-common/defs.h
307
SERVER_FAILURE = 4 # avahi-common/defs.h
308
309
310
223
class AvahiError(Exception):
311
224
def __init__(self, value, *args, **kwargs):
312
225
self.value = value
313
return super(AvahiError, self).__init__(value, *args,
314
**kwargs)
315
226
super(AvahiError, self).__init__(value, *args, **kwargs)
227
def __unicode__(self):
228
return unicode(repr(self.value))
316
229
317
230
class AvahiServiceError(AvahiError):
318
231
pass
319
232
320
321
233
class AvahiGroupError(AvahiError):
322
234
pass
323
235
324
236
325
class AvahiService:
237
class AvahiService(object):
326
238
"""An Avahi (Zeroconf) service.
327
239
328
240
Attributes:
329
241
interface: integer; avahi.IF_UNSPEC or an interface index.
330
242
Used to optionally bind to the specified interface.
342
254
server: D-Bus Server
343
255
bus: dbus.SystemBus()
344
256
"""
345
346
def __init__(self,
347
interface=avahi.IF_UNSPEC,
348
name=None,
349
servicetype=None,
350
port=None,
351
TXT=None,
352
domain="",
353
host="",
354
max_renames=32768,
355
protocol=avahi.PROTO_UNSPEC,
356
bus=None):
257
258
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
259
servicetype = None, port = None, TXT = None,
260
domain = "", host = "", max_renames = 32768,
261
protocol = avahi.PROTO_UNSPEC, bus = None):
357
262
self.interface = interface
358
263
self.name = name
359
264
self.type = servicetype
368
273
self.server = None
369
274
self.bus = bus
370
275
self.entry_group_state_changed_match = None
371
372
def rename(self, remove=True):
276
277
def rename(self):
373
278
"""Derived from the Avahi example code"""
374
279
if self.rename_count >= self.max_renames:
375
280
logger.critical("No suitable Zeroconf service name found"
376
281
" after %i retries, exiting.",
377
282
self.rename_count)
378
283
raise AvahiServiceError("Too many renames")
379
self.name = str(
380
self.server.GetAlternativeServiceName(self.name))
381
self.rename_count += 1
284
self.name = unicode(self.server
285
.GetAlternativeServiceName(self.name))
382
286
logger.info("Changing Zeroconf service name to %r ...",
383
287
self.name)
384
if remove:
385
self.remove()
288
self.remove()
386
289
try:
387
290
self.add()
388
291
except dbus.exceptions.DBusException as error:
389
if (error.get_dbus_name()
390
== "org.freedesktop.Avahi.CollisionError"):
391
logger.info("Local Zeroconf service name collision.")
392
return self.rename(remove=False)
393
else:
394
logger.critical("D-Bus Exception", exc_info=error)
395
self.cleanup()
396
os._exit(1)
397
292
logger.critical("D-Bus Exception", exc_info=error)
293
self.cleanup()
294
os._exit(1)
295
self.rename_count += 1
296
398
297
def remove(self):
399
298
"""Derived from the Avahi example code"""
400
299
if self.entry_group_state_changed_match is not None:
402
301
self.entry_group_state_changed_match = None
403
302
if self.group is not None:
404
303
self.group.Reset()
405
304
406
305
def add(self):
407
306
"""Derived from the Avahi example code"""
408
307
self.remove()
425
324
dbus.UInt16(self.port),
426
325
avahi.string_array_to_txt_array(self.TXT))
427
326
self.group.Commit()
428
327
429
328
def entry_group_state_changed(self, state, error):
430
329
"""Derived from the Avahi example code"""
431
330
logger.debug("Avahi entry group state change: %i", state)
432
331
433
332
if state == avahi.ENTRY_GROUP_ESTABLISHED:
434
333
logger.debug("Zeroconf service established.")
435
334
elif state == avahi.ENTRY_GROUP_COLLISION:
437
336
self.rename()
438
337
elif state == avahi.ENTRY_GROUP_FAILURE:
439
338
logger.critical("Avahi: Error in group state changed %s",
440
str(error))
441
raise AvahiGroupError("State changed: {!s}".format(error))
442
339
unicode(error))
340
raise AvahiGroupError("State changed: {0!s}"
341
.format(error))
342
443
343
def cleanup(self):
444
344
"""Derived from the Avahi example code"""
445
345
if self.group is not None:
450
350
pass
451
351
self.group = None
452
352
self.remove()
453
353
454
354
def server_state_changed(self, state, error=None):
455
355
"""Derived from the Avahi example code"""
456
356
logger.debug("Avahi server state change: %i", state)
457
bad_states = {
458
avahi.SERVER_INVALID: "Zeroconf server invalid",
459
avahi.SERVER_REGISTERING: None,
460
avahi.SERVER_COLLISION: "Zeroconf server name collision",
461
avahi.SERVER_FAILURE: "Zeroconf server failure",
462
}
357
bad_states = { avahi.SERVER_INVALID:
358
"Zeroconf server invalid",
359
avahi.SERVER_REGISTERING: None,
360
avahi.SERVER_COLLISION:
361
"Zeroconf server name collision",
362
avahi.SERVER_FAILURE:
363
"Zeroconf server failure" }
463
364
if state in bad_states:
464
365
if bad_states[state] is not None:
465
366
if error is None:
468
369
logger.error(bad_states[state] + ": %r", error)
469
370
self.cleanup()
470
371
elif state == avahi.SERVER_RUNNING:
471
try:
472
self.add()
473
except dbus.exceptions.DBusException as error:
474
if (error.get_dbus_name()
475
== "org.freedesktop.Avahi.CollisionError"):
476
logger.info("Local Zeroconf service name"
477
" collision.")
478
return self.rename(remove=False)
479
else:
480
logger.critical("D-Bus Exception", exc_info=error)
481
self.cleanup()
482
os._exit(1)
372
self.add()
483
373
else:
484
374
if error is None:
485
375
logger.debug("Unknown state: %r", state)
486
376
else:
487
377
logger.debug("Unknown state: %r: %r", state, error)
488
378
489
379
def activate(self):
490
380
"""Derived from the Avahi example code"""
491
381
if self.server is None:
495
385
follow_name_owner_changes=True),
496
386
avahi.DBUS_INTERFACE_SERVER)
497
387
self.server.connect_to_signal("StateChanged",
498
self.server_state_changed)
388
self.server_state_changed)
499
389
self.server_state_changed(self.server.GetState())
500
390
501
391
502
392
class AvahiServiceToSyslog(AvahiService):
503
def rename(self, *args, **kwargs):
393
def rename(self):
504
394
"""Add the new name to the syslog messages"""
505
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
506
syslogger.setFormatter(logging.Formatter(
507
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
508
.format(self.name)))
395
ret = AvahiService.rename(self)
396
syslogger.setFormatter(logging.Formatter
397
('Mandos ({0}) [%(process)d]:'
398
' %(levelname)s: %(message)s'
399
.format(self.name)))
509
400
return ret
510
401
511
402
512
# Pretend that we have a GnuTLS module
513
class gnutls:
514
"""This isn't so much a class as it is a module-like namespace."""
515
516
library = ctypes.util.find_library("gnutls")
517
if library is None:
518
library = ctypes.util.find_library("gnutls-deb0")
519
_library = ctypes.cdll.LoadLibrary(library)
520
del library
521
522
# Unless otherwise indicated, the constants and types below are
523
# all from the gnutls/gnutls.h C header file.
524
525
# Constants
526
E_SUCCESS = 0
527
E_INTERRUPTED = -52
528
E_AGAIN = -28
529
CRT_OPENPGP = 2
530
CRT_RAWPK = 3
531
CLIENT = 2
532
SHUT_RDWR = 0
533
CRD_CERTIFICATE = 1
534
E_NO_CERTIFICATE_FOUND = -49
535
X509_FMT_DER = 0
536
NO_TICKETS = 1<<10
537
ENABLE_RAWPK = 1<<18
538
CTYPE_PEERS = 3
539
KEYID_USE_SHA256 = 1 # gnutls/x509.h
540
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
541
542
# Types
543
class session_int(ctypes.Structure):
544
_fields_ = []
545
session_t = ctypes.POINTER(session_int)
546
547
class certificate_credentials_st(ctypes.Structure):
548
_fields_ = []
549
certificate_credentials_t = ctypes.POINTER(
550
certificate_credentials_st)
551
certificate_type_t = ctypes.c_int
552
553
class datum_t(ctypes.Structure):
554
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
555
('size', ctypes.c_uint)]
556
557
class openpgp_crt_int(ctypes.Structure):
558
_fields_ = []
559
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
560
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
561
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
562
credentials_type_t = ctypes.c_int
563
transport_ptr_t = ctypes.c_void_p
564
close_request_t = ctypes.c_int
565
566
# Exceptions
567
class Error(Exception):
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
571
# gnutls.strerror()
572
self.code = code
573
if message is None and code is not None:
574
message = gnutls.strerror(code)
575
return super(gnutls.Error, self).__init__(
576
message, *args)
577
578
class CertificateSecurityError(Error):
579
pass
580
581
# Classes
582
class Credentials:
583
def __init__(self):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
588
589
def __del__(self):
590
gnutls.certificate_free_credentials(self._c_object)
591
592
class ClientSession:
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls_flags = gnutls.CLIENT
596
if gnutls.check_version(b"3.5.6"):
597
gnutls_flags |= gnutls.NO_TICKETS
598
if gnutls.has_rawpk:
599
gnutls_flags |= gnutls.ENABLE_RAWPK
600
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
601
del gnutls_flags
602
gnutls.set_default_priority(self._c_object)
603
gnutls.transport_set_ptr(self._c_object, socket.fileno())
604
gnutls.handshake_set_private_extensions(self._c_object,
605
True)
606
self.socket = socket
607
if credentials is None:
608
credentials = gnutls.Credentials()
609
gnutls.credentials_set(self._c_object, credentials.type,
610
ctypes.cast(credentials._c_object,
611
ctypes.c_void_p))
612
self.credentials = credentials
613
614
def __del__(self):
615
gnutls.deinit(self._c_object)
616
617
def handshake(self):
618
return gnutls.handshake(self._c_object)
619
620
def send(self, data):
621
data = bytes(data)
622
data_len = len(data)
623
while data_len > 0:
624
data_len -= gnutls.record_send(self._c_object,
625
data[-data_len:],
626
data_len)
627
628
def bye(self):
629
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
630
631
# Error handling functions
632
def _error_code(result):
633
"""A function to raise exceptions on errors, suitable
634
for the 'restype' attribute on ctypes functions"""
635
if result >= 0:
636
return result
637
if result == gnutls.E_NO_CERTIFICATE_FOUND:
638
raise gnutls.CertificateSecurityError(code=result)
639
raise gnutls.Error(code=result)
640
641
def _retry_on_error(result, func, arguments):
642
"""A function to retry on some errors, suitable
643
for the 'errcheck' attribute on ctypes functions"""
644
while result < 0:
645
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
646
return _error_code(result)
647
result = func(*arguments)
648
return result
649
650
# Unless otherwise indicated, the function declarations below are
651
# all from the gnutls/gnutls.h C header file.
652
653
# Functions
654
priority_set_direct = _library.gnutls_priority_set_direct
655
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
656
ctypes.POINTER(ctypes.c_char_p)]
657
priority_set_direct.restype = _error_code
658
659
init = _library.gnutls_init
660
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
661
init.restype = _error_code
662
663
set_default_priority = _library.gnutls_set_default_priority
664
set_default_priority.argtypes = [session_t]
665
set_default_priority.restype = _error_code
666
667
record_send = _library.gnutls_record_send
668
record_send.argtypes = [session_t, ctypes.c_void_p,
669
ctypes.c_size_t]
670
record_send.restype = ctypes.c_ssize_t
671
record_send.errcheck = _retry_on_error
672
673
certificate_allocate_credentials = (
674
_library.gnutls_certificate_allocate_credentials)
675
certificate_allocate_credentials.argtypes = [
676
ctypes.POINTER(certificate_credentials_t)]
677
certificate_allocate_credentials.restype = _error_code
678
679
certificate_free_credentials = (
680
_library.gnutls_certificate_free_credentials)
681
certificate_free_credentials.argtypes = [
682
certificate_credentials_t]
683
certificate_free_credentials.restype = None
684
685
handshake_set_private_extensions = (
686
_library.gnutls_handshake_set_private_extensions)
687
handshake_set_private_extensions.argtypes = [session_t,
688
ctypes.c_int]
689
handshake_set_private_extensions.restype = None
690
691
credentials_set = _library.gnutls_credentials_set
692
credentials_set.argtypes = [session_t, credentials_type_t,
693
ctypes.c_void_p]
694
credentials_set.restype = _error_code
695
696
strerror = _library.gnutls_strerror
697
strerror.argtypes = [ctypes.c_int]
698
strerror.restype = ctypes.c_char_p
699
700
certificate_type_get = _library.gnutls_certificate_type_get
701
certificate_type_get.argtypes = [session_t]
702
certificate_type_get.restype = _error_code
703
704
certificate_get_peers = _library.gnutls_certificate_get_peers
705
certificate_get_peers.argtypes = [session_t,
706
ctypes.POINTER(ctypes.c_uint)]
707
certificate_get_peers.restype = ctypes.POINTER(datum_t)
708
709
global_set_log_level = _library.gnutls_global_set_log_level
710
global_set_log_level.argtypes = [ctypes.c_int]
711
global_set_log_level.restype = None
712
713
global_set_log_function = _library.gnutls_global_set_log_function
714
global_set_log_function.argtypes = [log_func]
715
global_set_log_function.restype = None
716
717
deinit = _library.gnutls_deinit
718
deinit.argtypes = [session_t]
719
deinit.restype = None
720
721
handshake = _library.gnutls_handshake
722
handshake.argtypes = [session_t]
723
handshake.restype = _error_code
724
handshake.errcheck = _retry_on_error
725
726
transport_set_ptr = _library.gnutls_transport_set_ptr
727
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
728
transport_set_ptr.restype = None
729
730
bye = _library.gnutls_bye
731
bye.argtypes = [session_t, close_request_t]
732
bye.restype = _error_code
733
bye.errcheck = _retry_on_error
734
735
check_version = _library.gnutls_check_version
736
check_version.argtypes = [ctypes.c_char_p]
737
check_version.restype = ctypes.c_char_p
738
739
_need_version = b"3.3.0"
740
if check_version(_need_version) is None:
741
raise self.Error("Needs GnuTLS {} or later"
742
.format(_need_version))
743
744
_tls_rawpk_version = b"3.6.6"
745
has_rawpk = bool(check_version(_tls_rawpk_version))
746
747
if has_rawpk:
748
# Types
749
class pubkey_st(ctypes.Structure):
750
_fields = []
751
pubkey_t = ctypes.POINTER(pubkey_st)
752
753
x509_crt_fmt_t = ctypes.c_int
754
755
# All the function declarations below are from gnutls/abstract.h
756
pubkey_init = _library.gnutls_pubkey_init
757
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
758
pubkey_init.restype = _error_code
759
760
pubkey_import = _library.gnutls_pubkey_import
761
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
762
x509_crt_fmt_t]
763
pubkey_import.restype = _error_code
764
765
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
766
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
767
ctypes.POINTER(ctypes.c_ubyte),
768
ctypes.POINTER(ctypes.c_size_t)]
769
pubkey_get_key_id.restype = _error_code
770
771
pubkey_deinit = _library.gnutls_pubkey_deinit
772
pubkey_deinit.argtypes = [pubkey_t]
773
pubkey_deinit.restype = None
774
else:
775
# All the function declarations below are from gnutls/openpgp.h
776
777
openpgp_crt_init = _library.gnutls_openpgp_crt_init
778
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
779
openpgp_crt_init.restype = _error_code
780
781
openpgp_crt_import = _library.gnutls_openpgp_crt_import
782
openpgp_crt_import.argtypes = [openpgp_crt_t,
783
ctypes.POINTER(datum_t),
784
openpgp_crt_fmt_t]
785
openpgp_crt_import.restype = _error_code
786
787
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
788
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
789
ctypes.POINTER(ctypes.c_uint)]
790
openpgp_crt_verify_self.restype = _error_code
791
792
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
793
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
794
openpgp_crt_deinit.restype = None
795
796
openpgp_crt_get_fingerprint = (
797
_library.gnutls_openpgp_crt_get_fingerprint)
798
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
ctypes.c_void_p,
800
ctypes.POINTER(
801
ctypes.c_size_t)]
802
openpgp_crt_get_fingerprint.restype = _error_code
803
804
if check_version(b"3.6.4"):
805
certificate_type_get2 = _library.gnutls_certificate_type_get2
806
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
807
certificate_type_get2.restype = _error_code
808
809
# Remove non-public functions
810
del _error_code, _retry_on_error
811
812
813
def call_pipe(connection, # : multiprocessing.Connection
814
func, *args, **kwargs):
815
"""This function is meant to be called by multiprocessing.Process
816
817
This function runs func(*args, **kwargs), and writes the resulting
818
return value on the provided multiprocessing.Connection.
819
"""
820
connection.send(func(*args, **kwargs))
821
connection.close()
822
823
824
class Client:
403
def timedelta_to_milliseconds(td):
404
"Convert a datetime.timedelta() to milliseconds"
405
return ((td.days * 24 * 60 * 60 * 1000)
406
+ (td.seconds * 1000)
407
+ (td.microseconds // 1000))
408
409
410
class Client(object):
825
411
"""A representation of a client host served by this server.
826
412
827
413
Attributes:
828
414
approved: bool(); 'None' if not yet approved/disapproved
829
415
approval_delay: datetime.timedelta(); Time to wait for approval
830
416
approval_duration: datetime.timedelta(); Duration of one approval
831
checker: multiprocessing.Process(); a running checker process used
832
to see if the client lives. 'None' if no process is
833
running.
834
checker_callback_tag: a GLib event source tag, or None
417
checker: subprocess.Popen(); a running checker process used
418
to see if the client lives.
419
'None' if no process is running.
420
checker_callback_tag: a gobject event source tag, or None
835
421
checker_command: string; External command which is run to check
836
422
if client lives. %() expansions are done at
837
423
runtime with vars(self) as dict, so that for
838
424
instance %(name)s can be used in the command.
839
checker_initiator_tag: a GLib event source tag, or None
425
checker_initiator_tag: a gobject event source tag, or None
840
426
created: datetime.datetime(); (UTC) object creation
841
427
client_structure: Object describing what attributes a client has
842
428
and is used for storing the client at exit
843
429
current_checker_command: string; current running checker_command
844
disable_initiator_tag: a GLib event source tag, or None
430
disable_initiator_tag: a gobject event source tag, or None
845
431
enabled: bool()
846
432
fingerprint: string (40 or 32 hexadecimal digits); used to
847
uniquely identify an OpenPGP client
848
key_id: string (64 hexadecimal digits); used to uniquely identify
849
a client using raw public keys
433
uniquely identify the client
850
434
host: string; available for use by the checker command
851
435
interval: datetime.timedelta(); How often to start a new checker
852
436
last_approval_request: datetime.datetime(); (UTC) or None
854
438
last_checker_status: integer between 0 and 255 reflecting exit
855
439
status of last checker. -1 reflects crashed
856
440
checker, -2 means no checker completed yet.
857
last_checker_signal: The signal which killed the last checker, if
858
last_checker_status is -1
859
441
last_enabled: datetime.datetime(); (UTC) or None
860
442
name: string; from the config file, used in log messages and
861
443
D-Bus identifiers
868
450
disabled, or None
869
451
server_settings: The server_settings dict from main()
870
452
"""
871
453
872
454
runtime_expansions = ("approval_delay", "approval_duration",
873
"created", "enabled", "expires", "key_id",
455
"created", "enabled", "expires",
874
456
"fingerprint", "host", "interval",
875
457
"last_approval_request", "last_checked_ok",
876
458
"last_enabled", "name", "timeout")
877
client_defaults = {
878
"timeout": "PT5M",
879
"extended_timeout": "PT15M",
880
"interval": "PT2M",
881
"checker": "fping -q -- %%(host)s",
882
"host": "",
883
"approval_delay": "PT0S",
884
"approval_duration": "PT1S",
885
"approved_by_default": "True",
886
"enabled": "True",
887
}
888
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
469
470
def timeout_milliseconds(self):
471
"Return the 'timeout' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.timeout)
473
474
def extended_timeout_milliseconds(self):
475
"Return the 'extended_timeout' attribute in milliseconds"
476
return timedelta_to_milliseconds(self.extended_timeout)
477
478
def interval_milliseconds(self):
479
"Return the 'interval' attribute in milliseconds"
480
return timedelta_to_milliseconds(self.interval)
481
482
def approval_delay_milliseconds(self):
483
return timedelta_to_milliseconds(self.approval_delay)
484
889
485
@staticmethod
890
486
def config_parser(config):
891
487
"""Construct a new dict of client settings of this form:
898
494
for client_name in config.sections():
899
495
section = dict(config.items(client_name))
900
496
client = settings[client_name] = {}
901
497
902
498
client["host"] = section["host"]
903
499
# Reformat values from string types to Python types
904
500
client["approved_by_default"] = config.getboolean(
905
501
client_name, "approved_by_default")
906
502
client["enabled"] = config.getboolean(client_name,
907
503
"enabled")
908
909
# Uppercase and remove spaces from key_id and fingerprint
910
# for later comparison purposes with return value from the
911
# key_id() and fingerprint() functions
912
client["key_id"] = (section.get("key_id", "").upper()
913
.replace(" ", ""))
504
914
505
client["fingerprint"] = (section["fingerprint"].upper()
915
506
.replace(" ", ""))
916
507
if "secret" in section:
917
client["secret"] = codecs.decode(section["secret"]
918
.encode("utf-8"),
919
"base64")
508
client["secret"] = section["secret"].decode("base64")
920
509
elif "secfile" in section:
921
510
with open(os.path.expanduser(os.path.expandvars
922
511
(section["secfile"])),
923
512
"rb") as secfile:
924
513
client["secret"] = secfile.read()
925
514
else:
926
raise TypeError("No secret or secfile for section {}"
515
raise TypeError("No secret or secfile for section {0}"
927
516
.format(section))
928
517
client["timeout"] = string_to_delta(section["timeout"])
929
518
client["extended_timeout"] = string_to_delta(
937
526
client["last_approval_request"] = None
938
527
client["last_checked_ok"] = None
939
528
client["last_checker_status"] = -2
940
529
941
530
return settings
942
943
def __init__(self, settings, name=None, server_settings=None):
531
532
def __init__(self, settings, name = None, server_settings=None):
944
533
self.name = name
945
534
if server_settings is None:
946
535
server_settings = {}
947
536
self.server_settings = server_settings
948
537
# adding all client settings
949
for setting, value in settings.items():
538
for setting, value in settings.iteritems():
950
539
setattr(self, setting, value)
951
540
952
541
if self.enabled:
953
542
if not hasattr(self, "last_enabled"):
954
543
self.last_enabled = datetime.datetime.utcnow()
958
547
else:
959
548
self.last_enabled = None
960
549
self.expires = None
961
550
962
551
logger.debug("Creating client %r", self.name)
963
logger.debug(" Key ID: %s", self.key_id)
552
# Uppercase and remove spaces from fingerprint for later
553
# comparison purposes with return value from the fingerprint()
554
# function
964
555
logger.debug(" Fingerprint: %s", self.fingerprint)
965
556
self.created = settings.get("created",
966
557
datetime.datetime.utcnow())
967
558
968
559
# attributes specific for this server instance
969
560
self.checker = None
970
561
self.checker_initiator_tag = None
973
564
self.current_checker_command = None
974
565
self.approved = None
975
566
self.approvals_pending = 0
976
self.changedstate = multiprocessing_manager.Condition(
977
multiprocessing_manager.Lock())
978
self.client_structure = [attr
979
for attr in self.__dict__.keys()
567
self.changedstate = (multiprocessing_manager
568
.Condition(multiprocessing_manager
569
.Lock()))
570
self.client_structure = [attr for attr in
571
self.__dict__.iterkeys()
980
572
if not attr.startswith("_")]
981
573
self.client_structure.append("client_structure")
982
983
for name, t in inspect.getmembers(
984
type(self), lambda obj: isinstance(obj, property)):
574
575
for name, t in inspect.getmembers(type(self),
576
lambda obj:
577
isinstance(obj,
578
property)):
985
579
if not name.startswith("_"):
986
580
self.client_structure.append(name)
987
581
988
582
# Send notice to process children that client state has changed
989
583
def send_changedstate(self):
990
584
with self.changedstate:
991
585
self.changedstate.notify_all()
992
586
993
587
def enable(self):
994
588
"""Start this client's checker and timeout hooks"""
995
589
if getattr(self, "enabled", False):
1000
594
self.last_enabled = datetime.datetime.utcnow()
1001
595
self.init_checker()
1002
596
self.send_changedstate()
1003
597
1004
598
def disable(self, quiet=True):
1005
599
"""Disable this client."""
1006
600
if not getattr(self, "enabled", False):
1008
602
if not quiet:
1009
603
logger.info("Disabling client %s", self.name)
1010
604
if getattr(self, "disable_initiator_tag", None) is not None:
1011
GLib.source_remove(self.disable_initiator_tag)
605
gobject.source_remove(self.disable_initiator_tag)
1012
606
self.disable_initiator_tag = None
1013
607
self.expires = None
1014
608
if getattr(self, "checker_initiator_tag", None) is not None:
1015
GLib.source_remove(self.checker_initiator_tag)
609
gobject.source_remove(self.checker_initiator_tag)
1016
610
self.checker_initiator_tag = None
1017
611
self.stop_checker()
1018
612
self.enabled = False
1019
613
if not quiet:
1020
614
self.send_changedstate()
1021
# Do not run this again if called by a GLib.timeout_add
615
# Do not run this again if called by a gobject.timeout_add
1022
616
return False
1023
617
1024
618
def __del__(self):
1025
619
self.disable()
1026
620
1027
621
def init_checker(self):
1028
622
# Schedule a new checker to be started an 'interval' from now,
1029
623
# and every interval from then on.
1030
624
if self.checker_initiator_tag is not None:
1031
GLib.source_remove(self.checker_initiator_tag)
1032
self.checker_initiator_tag = GLib.timeout_add(
1033
int(self.interval.total_seconds() * 1000),
1034
self.start_checker)
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = (gobject.timeout_add
627
(self.interval_milliseconds(),
628
self.start_checker))
1035
629
# Schedule a disable() when 'timeout' has passed
1036
630
if self.disable_initiator_tag is not None:
1037
GLib.source_remove(self.disable_initiator_tag)
1038
self.disable_initiator_tag = GLib.timeout_add(
1039
int(self.timeout.total_seconds() * 1000), self.disable)
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = (gobject.timeout_add
633
(self.timeout_milliseconds(),
634
self.disable))
1040
635
# Also start a new checker *right now*.
1041
636
self.start_checker()
1042
1043
def checker_callback(self, source, condition, connection,
1044
command):
637
638
def checker_callback(self, pid, condition, command):
1045
639
"""The checker has completed, so take appropriate actions."""
1046
# Read return code from connection (see call_pipe)
1047
returncode = connection.recv()
1048
connection.close()
1049
self.checker.join()
1050
640
self.checker_callback_tag = None
1051
641
self.checker = None
1052
1053
if returncode >= 0:
1054
self.last_checker_status = returncode
1055
self.last_checker_signal = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
1056
644
if self.last_checker_status == 0:
1057
645
logger.info("Checker for %(name)s succeeded",
1058
646
vars(self))
1059
647
self.checked_ok()
1060
648
else:
1061
logger.info("Checker for %(name)s failed", vars(self))
649
logger.info("Checker for %(name)s failed",
650
vars(self))
1062
651
else:
1063
652
self.last_checker_status = -1
1064
self.last_checker_signal = -returncode
1065
653
logger.warning("Checker for %(name)s crashed?",
1066
654
vars(self))
1067
return False
1068
655
1069
656
def checked_ok(self):
1070
657
"""Assert that the client has been seen, alive and well."""
1071
658
self.last_checked_ok = datetime.datetime.utcnow()
1072
659
self.last_checker_status = 0
1073
self.last_checker_signal = None
1074
660
self.bump_timeout()
1075
661
1076
662
def bump_timeout(self, timeout=None):
1077
663
"""Bump up the timeout for this client."""
1078
664
if timeout is None:
1079
665
timeout = self.timeout
1080
666
if self.disable_initiator_tag is not None:
1081
GLib.source_remove(self.disable_initiator_tag)
667
gobject.source_remove(self.disable_initiator_tag)
1082
668
self.disable_initiator_tag = None
1083
669
if getattr(self, "enabled", False):
1084
self.disable_initiator_tag = GLib.timeout_add(
1085
int(timeout.total_seconds() * 1000), self.disable)
670
self.disable_initiator_tag = (gobject.timeout_add
671
(timedelta_to_milliseconds
672
(timeout), self.disable))
1086
673
self.expires = datetime.datetime.utcnow() + timeout
1087
674
1088
675
def need_approval(self):
1089
676
self.last_approval_request = datetime.datetime.utcnow()
1090
677
1091
678
def start_checker(self):
1092
679
"""Start a new checker subprocess if one is not running.
1093
680
1094
681
If a checker already exists, leave it running and do
1095
682
nothing."""
1096
683
# The reason for not killing a running checker is that if we
1101
688
# checkers alone, the checker would have to take more time
1102
689
# than 'timeout' for the client to be disabled, which is as it
1103
690
# should be.
1104
1105
if self.checker is not None and not self.checker.is_alive():
1106
logger.warning("Checker was not alive; joining")
1107
self.checker.join()
1108
self.checker = None
691
692
# If a checker exists, make sure it is not a zombie
693
try:
694
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
695
except AttributeError:
696
pass
697
except OSError as error:
698
if error.errno != errno.ECHILD:
699
raise
700
else:
701
if pid:
702
logger.warning("Checker was a zombie")
703
gobject.source_remove(self.checker_callback_tag)
704
self.checker_callback(pid, status,
705
self.current_checker_command)
1109
706
# Start a new checker if needed
1110
707
if self.checker is None:
1111
708
# Escape attributes for the shell
1112
escaped_attrs = {
1113
attr: re.escape(str(getattr(self, attr)))
1114
for attr in self.runtime_expansions}
709
escaped_attrs = dict(
710
(attr, re.escape(unicode(getattr(self, attr))))
711
for attr in
712
self.runtime_expansions)
1115
713
try:
1116
714
command = self.checker_command % escaped_attrs
1117
715
except TypeError as error:
1118
716
logger.error('Could not format string "%s"',
1119
self.checker_command,
717
self.checker_command, exc_info=error)
718
return True # Try again later
719
self.current_checker_command = command
720
try:
721
logger.info("Starting checker %r for %s",
722
command, self.name)
723
# We don't need to redirect stdout and stderr, since
724
# in normal mode, that is already done by daemon(),
725
# and in debug mode we don't want to. (Stdin is
726
# always replaced by /dev/null.)
727
# The exception is when not debugging but nevertheless
728
# running in the foreground; use the previously
729
# created wnull.
730
popen_args = {}
731
if (not self.server_settings["debug"]
732
and self.server_settings["foreground"]):
733
popen_args.update({"stdout": wnull,
734
"stderr": wnull })
735
self.checker = subprocess.Popen(command,
736
close_fds=True,
737
shell=True, cwd="/",
738
**popen_args)
739
except OSError as error:
740
logger.error("Failed to start subprocess",
1120
741
exc_info=error)
1121
return True # Try again later
1122
self.current_checker_command = command
1123
logger.info("Starting checker %r for %s", command,
1124
self.name)
1125
# We don't need to redirect stdout and stderr, since
1126
# in normal mode, that is already done by daemon(),
1127
# and in debug mode we don't want to. (Stdin is
1128
# always replaced by /dev/null.)
1129
# The exception is when not debugging but nevertheless
1130
# running in the foreground; use the previously
1131
# created wnull.
1132
popen_args = {"close_fds": True,
1133
"shell": True,
1134
"cwd": "/"}
1135
if (not self.server_settings["debug"]
1136
and self.server_settings["foreground"]):
1137
popen_args.update({"stdout": wnull,
1138
"stderr": wnull})
1139
pipe = multiprocessing.Pipe(duplex=False)
1140
self.checker = multiprocessing.Process(
1141
target=call_pipe,
1142
args=(pipe[1], subprocess.call, command),
1143
kwargs=popen_args)
1144
self.checker.start()
1145
self.checker_callback_tag = GLib.io_add_watch(
1146
pipe[0].fileno(), GLib.IO_IN,
1147
self.checker_callback, pipe[0], command)
1148
# Re-run this periodically if run by GLib.timeout_add
742
return True
743
self.checker_callback_tag = (gobject.child_watch_add
744
(self.checker.pid,
745
self.checker_callback,
746
data=command))
747
# The checker may have completed before the gobject
748
# watch was added. Check for this.
749
try:
750
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
751
except OSError as error:
752
if error.errno == errno.ECHILD:
753
# This should never happen
754
logger.error("Child process vanished",
755
exc_info=error)
756
return True
757
raise
758
if pid:
759
gobject.source_remove(self.checker_callback_tag)
760
self.checker_callback(pid, status, command)
761
# Re-run this periodically if run by gobject.timeout_add
1149
762
return True
1150
763
1151
764
def stop_checker(self):
1152
765
"""Force the checker process, if any, to stop."""
1153
766
if self.checker_callback_tag:
1154
GLib.source_remove(self.checker_callback_tag)
767
gobject.source_remove(self.checker_callback_tag)
1155
768
self.checker_callback_tag = None
1156
769
if getattr(self, "checker", None) is None:
1157
770
return
1158
771
logger.debug("Stopping checker for %(name)s", vars(self))
1159
self.checker.terminate()
772
try:
773
self.checker.terminate()
774
#time.sleep(0.5)
775
#if self.checker.poll() is None:
776
# self.checker.kill()
777
except OSError as error:
778
if error.errno != errno.ESRCH: # No such process
779
raise
1160
780
self.checker = None
1161
781
1162
782
1163
def dbus_service_property(dbus_interface,
1164
signature="v",
1165
access="readwrite",
1166
byte_arrays=False):
783
def dbus_service_property(dbus_interface, signature="v",
784
access="readwrite", byte_arrays=False):
1167
785
"""Decorators for marking methods of a DBusObjectWithProperties to
1168
786
become properties on the D-Bus.
1169
787
1170
788
The decorated method will be called with no arguments by "Get"
1171
789
and with one argument by "Set".
1172
790
1173
791
The parameters, where they are supported, are the same as
1174
792
dbus.service.method, except there is only "signature", since the
1175
793
type from Get() and the type sent to Set() is the same.
1178
796
# "Set" method, so we fail early here:
1179
797
if byte_arrays and signature != "ay":
1180
798
raise ValueError("Byte arrays not supported for non-'ay'"
1181
" signature {!r}".format(signature))
1182
799
" signature {0!r}".format(signature))
1183
800
def decorator(func):
1184
801
func._dbus_is_property = True
1185
802
func._dbus_interface = dbus_interface
1188
805
func._dbus_name = func.__name__
1189
806
if func._dbus_name.endswith("_dbus_property"):
1190
807
func._dbus_name = func._dbus_name[:-14]
1191
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1192
809
return func
1193
1194
810
return decorator
1195
811
1196
812
1197
813
def dbus_interface_annotations(dbus_interface):
1198
814
"""Decorator for marking functions returning interface annotations
1199
815
1200
816
Usage:
1201
817
1202
818
@dbus_interface_annotations("org.example.Interface")
1203
819
def _foo(self): # Function name does not matter
1204
820
return {"org.freedesktop.DBus.Deprecated": "true",
1205
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1206
822
"false"}
1207
823
"""
1208
1209
824
def decorator(func):
1210
825
func._dbus_is_interface = True
1211
826
func._dbus_interface = dbus_interface
1212
827
func._dbus_name = dbus_interface
1213
828
return func
1214
1215
829
return decorator
1216
830
1217
831
1218
832
def dbus_annotations(annotations):
1219
833
"""Decorator to annotate D-Bus methods, signals or properties
1220
834
Usage:
1221
1222
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1223
"org.freedesktop.DBus.Property."
1224
"EmitsChangedSignal": "false"})
835
1225
836
@dbus_service_property("org.example.Interface", signature="b",
1226
837
access="r")
838
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
1227
841
def Property_dbus_property(self):
1228
842
return dbus.Boolean(False)
1229
1230
See also the DBusObjectWithAnnotations class.
1231
843
"""
1232
1233
844
def decorator(func):
1234
845
func._dbus_annotations = annotations
1235
846
return func
1236
1237
847
return decorator
1238
848
1239
849
1240
850
class DBusPropertyException(dbus.exceptions.DBusException):
1241
851
"""A base class for D-Bus property-related exceptions
1242
852
"""
1243
pass
853
def __unicode__(self):
854
return unicode(str(self))
1244
855
1245
856
1246
857
class DBusPropertyAccessException(DBusPropertyException):
1255
866
pass
1256
867
1257
868
1258
class DBusObjectWithAnnotations(dbus.service.Object):
1259
"""A D-Bus object with annotations.
1260
1261
Classes inheriting from this can use the dbus_annotations
1262
decorator to add annotations to methods or signals.
869
class DBusObjectWithProperties(dbus.service.Object):
870
"""A D-Bus object with properties.
871
872
Classes inheriting from this can use the dbus_service_property
873
decorator to expose methods as D-Bus properties. It exposes the
874
standard Get(), Set(), and GetAll() methods on the D-Bus.
1263
875
"""
1264
876
1265
877
@staticmethod
1266
878
def _is_dbus_thing(thing):
1267
879
"""Returns a function testing if an attribute is a D-Bus thing
1268
880
1269
881
If called like _is_dbus_thing("method") it returns a function
1270
882
suitable for use as predicate to inspect.getmembers().
1271
883
"""
1272
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
884
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1273
885
False)
1274
886
1275
887
def _get_all_dbus_things(self, thing):
1276
888
"""Returns a generator of (name, attribute) pairs
1277
889
"""
1278
return ((getattr(athing.__get__(self), "_dbus_name", name),
890
return ((getattr(athing.__get__(self), "_dbus_name",
891
name),
1279
892
athing.__get__(self))
1280
893
for cls in self.__class__.__mro__
1281
894
for name, athing in
1282
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1283
1284
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1285
out_signature="s",
1286
path_keyword='object_path',
1287
connection_keyword='connection')
1288
def Introspect(self, object_path, connection):
1289
"""Overloading of standard D-Bus method.
1290
1291
Inserts annotation tags on methods and signals.
1292
"""
1293
xmlstring = dbus.service.Object.Introspect(self, object_path,
1294
connection)
1295
try:
1296
document = xml.dom.minidom.parseString(xmlstring)
1297
1298
for if_tag in document.getElementsByTagName("interface"):
1299
# Add annotation tags
1300
for typ in ("method", "signal"):
1301
for tag in if_tag.getElementsByTagName(typ):
1302
annots = dict()
1303
for name, prop in (self.
1304
_get_all_dbus_things(typ)):
1305
if (name == tag.getAttribute("name")
1306
and prop._dbus_interface
1307
== if_tag.getAttribute("name")):
1308
annots.update(getattr(
1309
prop, "_dbus_annotations", {}))
1310
for name, value in annots.items():
1311
ann_tag = document.createElement(
1312
"annotation")
1313
ann_tag.setAttribute("name", name)
1314
ann_tag.setAttribute("value", value)
1315
tag.appendChild(ann_tag)
1316
# Add interface annotation tags
1317
for annotation, value in dict(
1318
itertools.chain.from_iterable(
1319
annotations().items()
1320
for name, annotations
1321
in self._get_all_dbus_things("interface")
1322
if name == if_tag.getAttribute("name")
1323
)).items():
1324
ann_tag = document.createElement("annotation")
1325
ann_tag.setAttribute("name", annotation)
1326
ann_tag.setAttribute("value", value)
1327
if_tag.appendChild(ann_tag)
1328
# Fix argument name for the Introspect method itself
1329
if (if_tag.getAttribute("name")
1330
== dbus.INTROSPECTABLE_IFACE):
1331
for cn in if_tag.getElementsByTagName("method"):
1332
if cn.getAttribute("name") == "Introspect":
1333
for arg in cn.getElementsByTagName("arg"):
1334
if (arg.getAttribute("direction")
1335
== "out"):
1336
arg.setAttribute("name",
1337
"xml_data")
1338
xmlstring = document.toxml("utf-8")
1339
document.unlink()
1340
except (AttributeError, xml.dom.DOMException,
1341
xml.parsers.expat.ExpatError) as error:
1342
logger.error("Failed to override Introspection method",
1343
exc_info=error)
1344
return xmlstring
1345
1346
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1348
"""A D-Bus object with properties.
1349
1350
Classes inheriting from this can use the dbus_service_property
1351
decorator to expose methods as D-Bus properties. It exposes the
1352
standard Get(), Set(), and GetAll() methods on the D-Bus.
1353
"""
1354
895
inspect.getmembers(cls,
896
self._is_dbus_thing(thing)))
897
1355
898
def _get_dbus_property(self, interface_name, property_name):
1356
899
"""Returns a bound method if one exists which is a D-Bus
1357
900
property with the specified name and interface.
1358
901
"""
1359
for cls in self.__class__.__mro__:
1360
for name, value in inspect.getmembers(
1361
cls, self._is_dbus_thing("property")):
902
for cls in self.__class__.__mro__:
903
for name, value in (inspect.getmembers
904
(cls,
905
self._is_dbus_thing("property"))):
1362
906
if (value._dbus_name == property_name
1363
907
and value._dbus_interface == interface_name):
1364
908
return value.__get__(self)
1365
909
1366
910
# No such property
1367
raise DBusPropertyNotFound("{}:{}.{}".format(
1368
self.dbus_object_path, interface_name, property_name))
1369
1370
@classmethod
1371
def _get_all_interface_names(cls):
1372
"""Get a sequence of all interfaces supported by an object"""
1373
return (name for name in set(getattr(getattr(x, attr),
1374
"_dbus_interface", None)
1375
for x in (inspect.getmro(cls))
1376
for attr in dir(x))
1377
if name is not None)
1378
1379
@dbus.service.method(dbus.PROPERTIES_IFACE,
1380
in_signature="ss",
911
raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
+ interface_name + "."
913
+ property_name)
914
915
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1381
916
out_signature="v")
1382
917
def Get(self, interface_name, property_name):
1383
918
"""Standard D-Bus property Get() method, see D-Bus standard.
1389
924
if not hasattr(value, "variant_level"):
1390
925
return value
1391
926
return type(value)(value, variant_level=value.variant_level+1)
1392
927
1393
928
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1394
929
def Set(self, interface_name, property_name, value):
1395
930
"""Standard D-Bus property Set() method, see D-Bus standard.
1402
937
# signatures other than "ay".
1403
938
if prop._dbus_signature != "ay":
1404
939
raise ValueError("Byte arrays not supported for non-"
1405
"'ay' signature {!r}"
940
"'ay' signature {0!r}"
1406
941
.format(prop._dbus_signature))
1407
942
value = dbus.ByteArray(b''.join(chr(byte)
1408
943
for byte in value))
1409
944
prop(value)
1410
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1412
in_signature="s",
945
946
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1413
947
out_signature="a{sv}")
1414
948
def GetAll(self, interface_name):
1415
949
"""Standard D-Bus property GetAll() method, see D-Bus
1416
950
standard.
1417
951
1418
952
Note: Will not include properties with access="write".
1419
953
"""
1420
954
properties = {}
1430
964
if not hasattr(value, "variant_level"):
1431
965
properties[name] = value
1432
966
continue
1433
properties[name] = type(value)(
1434
value, variant_level=value.variant_level + 1)
967
properties[name] = type(value)(value, variant_level=
968
value.variant_level+1)
1435
969
return dbus.Dictionary(properties, signature="sv")
1436
1437
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1438
def PropertiesChanged(self, interface_name, changed_properties,
1439
invalidated_properties):
1440
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1441
standard.
1442
"""
1443
pass
1444
970
1445
971
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1446
972
out_signature="s",
1447
973
path_keyword='object_path',
1448
974
connection_keyword='connection')
1449
975
def Introspect(self, object_path, connection):
1450
976
"""Overloading of standard D-Bus method.
1451
977
1452
978
Inserts property tags and interface annotation tags.
1453
979
"""
1454
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1455
object_path,
1456
connection)
980
xmlstring = dbus.service.Object.Introspect(self, object_path,
981
connection)
1457
982
try:
1458
983
document = xml.dom.minidom.parseString(xmlstring)
1459
1460
984
def make_tag(document, name, prop):
1461
985
e = document.createElement("property")
1462
986
e.setAttribute("name", name)
1463
987
e.setAttribute("type", prop._dbus_signature)
1464
988
e.setAttribute("access", prop._dbus_access)
1465
989
return e
1466
1467
990
for if_tag in document.getElementsByTagName("interface"):
1468
991
# Add property tags
1469
992
for tag in (make_tag(document, name, prop)
1472
995
if prop._dbus_interface
1473
996
== if_tag.getAttribute("name")):
1474
997
if_tag.appendChild(tag)
1475
# Add annotation tags for properties
1476
for tag in if_tag.getElementsByTagName("property"):
1477
annots = dict()
1478
for name, prop in self._get_all_dbus_things(
1479
"property"):
1480
if (name == tag.getAttribute("name")
1481
and prop._dbus_interface
1482
== if_tag.getAttribute("name")):
1483
annots.update(getattr(
1484
prop, "_dbus_annotations", {}))
1485
for name, value in annots.items():
1486
ann_tag = document.createElement(
1487
"annotation")
1488
ann_tag.setAttribute("name", name)
1489
ann_tag.setAttribute("value", value)
1490
tag.appendChild(ann_tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr
1008
(prop,
1009
"_dbus_annotations",
1010
{}))
1011
for name, value in annots.iteritems():
1012
ann_tag = document.createElement(
1013
"annotation")
1014
ann_tag.setAttribute("name", name)
1015
ann_tag.setAttribute("value", value)
1016
tag.appendChild(ann_tag)
1017
# Add interface annotation tags
1018
for annotation, value in dict(
1019
itertools.chain.from_iterable(
1020
annotations().iteritems()
1021
for name, annotations in
1022
self._get_all_dbus_things("interface")
1023
if name == if_tag.getAttribute("name")
1024
)).iteritems():
1025
ann_tag = document.createElement("annotation")
1026
ann_tag.setAttribute("name", annotation)
1027
ann_tag.setAttribute("value", value)
1028
if_tag.appendChild(ann_tag)
1491
1029
# Add the names to the return values for the
1492
1030
# "org.freedesktop.DBus.Properties" methods
1493
1031
if (if_tag.getAttribute("name")
1512
1050
return xmlstring
1513
1051
1514
1052
1515
try:
1516
dbus.OBJECT_MANAGER_IFACE
1517
except AttributeError:
1518
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1519
1520
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1522
"""A D-Bus object with an ObjectManager.
1523
1524
Classes inheriting from this exposes the standard
1525
GetManagedObjects call and the InterfacesAdded and
1526
InterfacesRemoved signals on the standard
1527
"org.freedesktop.DBus.ObjectManager" interface.
1528
1529
Note: No signals are sent automatically; they must be sent
1530
manually.
1531
"""
1532
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1533
out_signature="a{oa{sa{sv}}}")
1534
def GetManagedObjects(self):
1535
"""This function must be overridden"""
1536
raise NotImplementedError()
1537
1538
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1539
signature="oa{sa{sv}}")
1540
def InterfacesAdded(self, object_path, interfaces_and_properties):
1541
pass
1542
1543
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1544
def InterfacesRemoved(self, object_path, interfaces):
1545
pass
1546
1547
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1548
out_signature="s",
1549
path_keyword='object_path',
1550
connection_keyword='connection')
1551
def Introspect(self, object_path, connection):
1552
"""Overloading of standard D-Bus method.
1553
1554
Override return argument name of GetManagedObjects to be
1555
"objpath_interfaces_and_properties"
1556
"""
1557
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1558
object_path,
1559
connection)
1560
try:
1561
document = xml.dom.minidom.parseString(xmlstring)
1562
1563
for if_tag in document.getElementsByTagName("interface"):
1564
# Fix argument name for the GetManagedObjects method
1565
if (if_tag.getAttribute("name")
1566
== dbus.OBJECT_MANAGER_IFACE):
1567
for cn in if_tag.getElementsByTagName("method"):
1568
if (cn.getAttribute("name")
1569
== "GetManagedObjects"):
1570
for arg in cn.getElementsByTagName("arg"):
1571
if (arg.getAttribute("direction")
1572
== "out"):
1573
arg.setAttribute(
1574
"name",
1575
"objpath_interfaces"
1576
"_and_properties")
1577
xmlstring = document.toxml("utf-8")
1578
document.unlink()
1579
except (AttributeError, xml.dom.DOMException,
1580
xml.parsers.expat.ExpatError) as error:
1581
logger.error("Failed to override Introspection method",
1582
exc_info=error)
1583
return xmlstring
1584
1585
1586
1053
def datetime_to_dbus(dt, variant_level=0):
1587
1054
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1588
1055
if dt is None:
1589
return dbus.String("", variant_level=variant_level)
1590
return dbus.String(dt.isoformat(), variant_level=variant_level)
1056
return dbus.String("", variant_level = variant_level)
1057
return dbus.String(dt.isoformat(),
1058
variant_level=variant_level)
1591
1059
1592
1060
1593
1061
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1595
1063
dbus.service.Object, it will add alternate D-Bus attributes with
1596
1064
interface names according to the "alt_interface_names" mapping.
1597
1065
Usage:
1598
1066
1599
1067
@alternate_dbus_interfaces({"org.example.Interface":
1600
1068
"net.example.AlternateInterface"})
1601
1069
class SampleDBusObject(dbus.service.Object):
1602
1070
@dbus.service.method("org.example.Interface")
1603
1071
def SampleDBusMethod():
1604
1072
pass
1605
1073
1606
1074
The above "SampleDBusMethod" on "SampleDBusObject" will be
1607
1075
reachable via two interfaces: "org.example.Interface" and
1608
1076
"net.example.AlternateInterface", the latter of which will have
1609
1077
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1610
1078
"true", unless "deprecate" is passed with a False value.
1611
1079
1612
1080
This works for methods and signals, and also for D-Bus properties
1613
1081
(from DBusObjectWithProperties) and interfaces (from the
1614
1082
dbus_interface_annotations decorator).
1615
1083
"""
1616
1617
1084
def wrapper(cls):
1618
1085
for orig_interface_name, alt_interface_name in (
1619
alt_interface_names.items()):
1086
alt_interface_names.iteritems()):
1620
1087
attr = {}
1621
1088
interface_names = set()
1622
1089
# Go though all attributes of the class
1624
1091
# Ignore non-D-Bus attributes, and D-Bus attributes
1625
1092
# with the wrong interface name
1626
1093
if (not hasattr(attribute, "_dbus_interface")
1627
or not attribute._dbus_interface.startswith(
1628
orig_interface_name)):
1094
or not attribute._dbus_interface
1095
.startswith(orig_interface_name)):
1629
1096
continue
1630
1097
# Create an alternate D-Bus interface name based on
1631
1098
# the current name
1632
alt_interface = attribute._dbus_interface.replace(
1633
orig_interface_name, alt_interface_name)
1099
alt_interface = (attribute._dbus_interface
1100
.replace(orig_interface_name,
1101
alt_interface_name))
1634
1102
interface_names.add(alt_interface)
1635
1103
# Is this a D-Bus signal?
1636
1104
if getattr(attribute, "_dbus_is_signal", False):
1637
1105
# Extract the original non-method undecorated
1638
1106
# function by black magic
1639
if sys.version_info.major == 2:
1640
nonmethod_func = (dict(
1107
nonmethod_func = (dict(
1641
1108
zip(attribute.func_code.co_freevars,
1642
attribute.__closure__))
1643
["func"].cell_contents)
1644
else:
1645
nonmethod_func = (dict(
1646
zip(attribute.__code__.co_freevars,
1647
attribute.__closure__))
1648
["func"].cell_contents)
1109
attribute.__closure__))["func"]
1110
.cell_contents)
1649
1111
# Create a new, but exactly alike, function
1650
1112
# object, and decorate it to be a new D-Bus signal
1651
1113
# with the alternate D-Bus interface name
1652
new_function = copy_function(nonmethod_func)
1653
new_function = (dbus.service.signal(
1654
alt_interface,
1655
attribute._dbus_signature)(new_function))
1114
new_function = (dbus.service.signal
1115
(alt_interface,
1116
attribute._dbus_signature)
1117
(types.FunctionType(
1118
nonmethod_func.func_code,
1119
nonmethod_func.func_globals,
1120
nonmethod_func.func_name,
1121
nonmethod_func.func_defaults,
1122
nonmethod_func.func_closure)))
1656
1123
# Copy annotations, if any
1657
1124
try:
1658
new_function._dbus_annotations = dict(
1659
attribute._dbus_annotations)
1125
new_function._dbus_annotations = (
1126
dict(attribute._dbus_annotations))
1660
1127
except AttributeError:
1661
1128
pass
1662
1663
1129
# Define a creator of a function to call both the
1664
1130
# original and alternate functions, so both the
1665
1131
# original and alternate signals gets sent when
1668
1134
"""This function is a scope container to pass
1669
1135
func1 and func2 to the "call_both" function
1670
1136
outside of its arguments"""
1671
1672
@functools.wraps(func2)
1673
1137
def call_both(*args, **kwargs):
1674
1138
"""This function will emit two D-Bus
1675
1139
signals by calling func1 and func2"""
1676
1140
func1(*args, **kwargs)
1677
1141
func2(*args, **kwargs)
1678
# Make wrapper function look like a D-Bus
1679
# signal
1680
for name, attr in inspect.getmembers(func2):
1681
if name.startswith("_dbus_"):
1682
setattr(call_both, name, attr)
1683
1684
1142
return call_both
1685
1143
# Create the "call_both" function and add it to
1686
1144
# the class
1691
1149
# object. Decorate it to be a new D-Bus method
1692
1150
# with the alternate D-Bus interface name. Add it
1693
1151
# to the class.
1694
attr[attrname] = (
1695
dbus.service.method(
1696
alt_interface,
1697
attribute._dbus_in_signature,
1698
attribute._dbus_out_signature)
1699
(copy_function(attribute)))
1152
attr[attrname] = (dbus.service.method
1153
(alt_interface,
1154
attribute._dbus_in_signature,
1155
attribute._dbus_out_signature)
1156
(types.FunctionType
1157
(attribute.func_code,
1158
attribute.func_globals,
1159
attribute.func_name,
1160
attribute.func_defaults,
1161
attribute.func_closure)))
1700
1162
# Copy annotations, if any
1701
1163
try:
1702
attr[attrname]._dbus_annotations = dict(
1703
attribute._dbus_annotations)
1164
attr[attrname]._dbus_annotations = (
1165
dict(attribute._dbus_annotations))
1704
1166
except AttributeError:
1705
1167
pass
1706
1168
# Is this a D-Bus property?
1709
1171
# object, and decorate it to be a new D-Bus
1710
1172
# property with the alternate D-Bus interface
1711
1173
# name. Add it to the class.
1712
attr[attrname] = (dbus_service_property(
1713
alt_interface, attribute._dbus_signature,
1714
attribute._dbus_access,
1715
attribute._dbus_get_args_options
1716
["byte_arrays"])
1717
(copy_function(attribute)))
1174
attr[attrname] = (dbus_service_property
1175
(alt_interface,
1176
attribute._dbus_signature,
1177
attribute._dbus_access,
1178
attribute
1179
._dbus_get_args_options
1180
["byte_arrays"])
1181
(types.FunctionType
1182
(attribute.func_code,
1183
attribute.func_globals,
1184
attribute.func_name,
1185
attribute.func_defaults,
1186
attribute.func_closure)))
1718
1187
# Copy annotations, if any
1719
1188
try:
1720
attr[attrname]._dbus_annotations = dict(
1721
attribute._dbus_annotations)
1189
attr[attrname]._dbus_annotations = (
1190
dict(attribute._dbus_annotations))
1722
1191
except AttributeError:
1723
1192
pass
1724
1193
# Is this a D-Bus interface?
1727
1196
# object. Decorate it to be a new D-Bus interface
1728
1197
# with the alternate D-Bus interface name. Add it
1729
1198
# to the class.
1730
attr[attrname] = (
1731
dbus_interface_annotations(alt_interface)
1732
(copy_function(attribute)))
1199
attr[attrname] = (dbus_interface_annotations
1200
(alt_interface)
1201
(types.FunctionType
1202
(attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1733
1207
if deprecate:
1734
1208
# Deprecate all alternate interfaces
1735
iname = "_AlternateDBusNames_interface_annotation{}"
1209
iname="_AlternateDBusNames_interface_annotation{0}"
1736
1210
for interface_name in interface_names:
1737
1738
1211
@dbus_interface_annotations(interface_name)
1739
1212
def func(self):
1740
return {"org.freedesktop.DBus.Deprecated":
1741
"true"}
1213
return { "org.freedesktop.DBus.Deprecated":
1214
"true" }
1742
1215
# Find an unused name
1743
1216
for aname in (iname.format(i)
1744
1217
for i in itertools.count()):
1748
1221
if interface_names:
1749
1222
# Replace the class with a new subclass of it with
1750
1223
# methods, signals, etc. as created above.
1751
if sys.version_info.major == 2:
1752
cls = type(b"{}Alternate".format(cls.__name__),
1753
(cls, ), attr)
1754
else:
1755
cls = type("{}Alternate".format(cls.__name__),
1756
(cls, ), attr)
1224
cls = type(b"{0}Alternate".format(cls.__name__),
1225
(cls,), attr)
1757
1226
return cls
1758
1759
1227
return wrapper
1760
1228
1761
1229
1762
1230
@alternate_dbus_interfaces({"se.recompile.Mandos":
1763
"se.bsnet.fukt.Mandos"})
1231
"se.bsnet.fukt.Mandos"})
1764
1232
class ClientDBus(Client, DBusObjectWithProperties):
1765
1233
"""A Client class using D-Bus
1766
1234
1767
1235
Attributes:
1768
1236
dbus_object_path: dbus.ObjectPath
1769
1237
bus: dbus.SystemBus()
1770
1238
"""
1771
1239
1772
1240
runtime_expansions = (Client.runtime_expansions
1773
+ ("dbus_object_path", ))
1774
1775
_interface = "se.recompile.Mandos.Client"
1776
1241
+ ("dbus_object_path",))
1242
1777
1243
# dbus.service.Object doesn't use super(), so we can't either.
1778
1779
def __init__(self, bus=None, *args, **kwargs):
1244
1245
def __init__(self, bus = None, *args, **kwargs):
1780
1246
self.bus = bus
1781
1247
Client.__init__(self, *args, **kwargs)
1782
1248
# Only now, when this client is initialized, can it show up on
1783
1249
# the D-Bus
1784
client_object_name = str(self.name).translate(
1250
client_object_name = unicode(self.name).translate(
1785
1251
{ord("."): ord("_"),
1786
1252
ord("-"): ord("_")})
1787
self.dbus_object_path = dbus.ObjectPath(
1788
"/clients/" + client_object_name)
1253
self.dbus_object_path = (dbus.ObjectPath
1254
("/clients/" + client_object_name))
1789
1255
DBusObjectWithProperties.__init__(self, self.bus,
1790
1256
self.dbus_object_path)
1791
1792
def notifychangeproperty(transform_func, dbus_name,
1793
type_func=lambda x: x,
1794
variant_level=1,
1795
invalidate_only=False,
1796
_interface=_interface):
1257
1258
def notifychangeproperty(transform_func,
1259
dbus_name, type_func=lambda x: x,
1260
variant_level=1):
1797
1261
""" Modify a variable so that it's a property which announces
1798
1262
its changes to DBus.
1799
1263
1800
1264
transform_fun: Function that takes a value and a variant_level
1801
1265
and transforms it to a D-Bus type.
1802
1266
dbus_name: D-Bus name of the variable
1804
1268
to the D-Bus. Default: no transform
1805
1269
variant_level: D-Bus variant level. Default: 1
1806
1270
"""
1807
attrname = "_{}".format(dbus_name)
1808
1271
attrname = "_{0}".format(dbus_name)
1809
1272
def setter(self, value):
1810
1273
if hasattr(self, "dbus_object_path"):
1811
1274
if (not hasattr(self, attrname) or
1812
1275
type_func(getattr(self, attrname, None))
1813
1276
!= type_func(value)):
1814
if invalidate_only:
1815
self.PropertiesChanged(
1816
_interface, dbus.Dictionary(),
1817
dbus.Array((dbus_name, )))
1818
else:
1819
dbus_value = transform_func(
1820
type_func(value),
1821
variant_level=variant_level)
1822
self.PropertyChanged(dbus.String(dbus_name),
1823
dbus_value)
1824
self.PropertiesChanged(
1825
_interface,
1826
dbus.Dictionary({dbus.String(dbus_name):
1827
dbus_value}),
1828
dbus.Array())
1277
dbus_value = transform_func(type_func(value),
1278
variant_level
1279
=variant_level)
1280
self.PropertyChanged(dbus.String(dbus_name),
1281
dbus_value)
1829
1282
setattr(self, attrname, value)
1830
1283
1831
1284
return property(lambda self: getattr(self, attrname), setter)
1832
1285
1833
1286
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1834
1287
approvals_pending = notifychangeproperty(dbus.Boolean,
1835
1288
"ApprovalPending",
1836
type_func=bool)
1289
type_func = bool)
1837
1290
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1838
1291
last_enabled = notifychangeproperty(datetime_to_dbus,
1839
1292
"LastEnabled")
1840
checker = notifychangeproperty(
1841
dbus.Boolean, "CheckerRunning",
1842
type_func=lambda checker: checker is not None)
1293
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1294
type_func = lambda checker:
1295
checker is not None)
1843
1296
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1844
1297
"LastCheckedOK")
1845
1298
last_checker_status = notifychangeproperty(dbus.Int16,
1848
1301
datetime_to_dbus, "LastApprovalRequest")
1849
1302
approved_by_default = notifychangeproperty(dbus.Boolean,
1850
1303
"ApprovedByDefault")
1851
approval_delay = notifychangeproperty(
1852
dbus.UInt64, "ApprovalDelay",
1853
type_func=lambda td: td.total_seconds() * 1000)
1304
approval_delay = notifychangeproperty(dbus.UInt64,
1305
"ApprovalDelay",
1306
type_func =
1307
timedelta_to_milliseconds)
1854
1308
approval_duration = notifychangeproperty(
1855
1309
dbus.UInt64, "ApprovalDuration",
1856
type_func=lambda td: td.total_seconds() * 1000)
1310
type_func = timedelta_to_milliseconds)
1857
1311
host = notifychangeproperty(dbus.String, "Host")
1858
timeout = notifychangeproperty(
1859
dbus.UInt64, "Timeout",
1860
type_func=lambda td: td.total_seconds() * 1000)
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func =
1314
timedelta_to_milliseconds)
1861
1315
extended_timeout = notifychangeproperty(
1862
1316
dbus.UInt64, "ExtendedTimeout",
1863
type_func=lambda td: td.total_seconds() * 1000)
1864
interval = notifychangeproperty(
1865
dbus.UInt64, "Interval",
1866
type_func=lambda td: td.total_seconds() * 1000)
1317
type_func = timedelta_to_milliseconds)
1318
interval = notifychangeproperty(dbus.UInt64,
1319
"Interval",
1320
type_func =
1321
timedelta_to_milliseconds)
1867
1322
checker_command = notifychangeproperty(dbus.String, "Checker")
1868
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1869
invalidate_only=True)
1870
1323
1871
1324
del notifychangeproperty
1872
1325
1873
1326
def __del__(self, *args, **kwargs):
1874
1327
try:
1875
1328
self.remove_from_connection()
1878
1331
if hasattr(DBusObjectWithProperties, "__del__"):
1879
1332
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1880
1333
Client.__del__(self, *args, **kwargs)
1881
1882
def checker_callback(self, source, condition,
1883
connection, command, *args, **kwargs):
1884
ret = Client.checker_callback(self, source, condition,
1885
connection, command, *args,
1886
**kwargs)
1887
exitstatus = self.last_checker_status
1888
if exitstatus >= 0:
1334
1335
def checker_callback(self, pid, condition, command,
1336
*args, **kwargs):
1337
self.checker_callback_tag = None
1338
self.checker = None
1339
if os.WIFEXITED(condition):
1340
exitstatus = os.WEXITSTATUS(condition)
1889
1341
# Emit D-Bus signal
1890
1342
self.CheckerCompleted(dbus.Int16(exitstatus),
1891
# This is specific to GNU libC
1892
dbus.Int64(exitstatus << 8),
1343
dbus.Int64(condition),
1893
1344
dbus.String(command))
1894
1345
else:
1895
1346
# Emit D-Bus signal
1896
1347
self.CheckerCompleted(dbus.Int16(-1),
1897
dbus.Int64(
1898
# This is specific to GNU libC
1899
(exitstatus << 8)
1900
| self.last_checker_signal),
1348
dbus.Int64(condition),
1901
1349
dbus.String(command))
1902
return ret
1903
1350
1351
return Client.checker_callback(self, pid, condition, command,
1352
*args, **kwargs)
1353
1904
1354
def start_checker(self, *args, **kwargs):
1905
1355
old_checker_pid = getattr(self.checker, "pid", None)
1906
1356
r = Client.start_checker(self, *args, **kwargs)
1910
1360
# Emit D-Bus signal
1911
1361
self.CheckerStarted(self.current_checker_command)
1912
1362
return r
1913
1363
1914
1364
def _reset_approved(self):
1915
1365
self.approved = None
1916
1366
return False
1917
1367
1918
1368
def approve(self, value=True):
1919
1369
self.approved = value
1920
GLib.timeout_add(int(self.approval_duration.total_seconds()
1921
* 1000), self._reset_approved)
1370
gobject.timeout_add(timedelta_to_milliseconds
1371
(self.approval_duration),
1372
self._reset_approved)
1922
1373
self.send_changedstate()
1923
1924
# D-Bus methods, signals & properties
1925
1926
# Interfaces
1927
1928
# Signals
1929
1374
1375
## D-Bus methods, signals & properties
1376
_interface = "se.recompile.Mandos.Client"
1377
1378
## Interfaces
1379
1380
@dbus_interface_annotations(_interface)
1381
def _foo(self):
1382
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1383
"false"}
1384
1385
## Signals
1386
1930
1387
# CheckerCompleted - signal
1931
1388
@dbus.service.signal(_interface, signature="nxs")
1932
1389
def CheckerCompleted(self, exitcode, waitstatus, command):
1933
1390
"D-Bus signal"
1934
1391
pass
1935
1392
1936
1393
# CheckerStarted - signal
1937
1394
@dbus.service.signal(_interface, signature="s")
1938
1395
def CheckerStarted(self, command):
1939
1396
"D-Bus signal"
1940
1397
pass
1941
1398
1942
1399
# PropertyChanged - signal
1943
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1944
1400
@dbus.service.signal(_interface, signature="sv")
1945
1401
def PropertyChanged(self, property, value):
1946
1402
"D-Bus signal"
1947
1403
pass
1948
1404
1949
1405
# GotSecret - signal
1950
1406
@dbus.service.signal(_interface)
1951
1407
def GotSecret(self):
1954
1410
server to mandos-client
1955
1411
"""
1956
1412
pass
1957
1413
1958
1414
# Rejected - signal
1959
1415
@dbus.service.signal(_interface, signature="s")
1960
1416
def Rejected(self, reason):
1961
1417
"D-Bus signal"
1962
1418
pass
1963
1419
1964
1420
# NeedApproval - signal
1965
1421
@dbus.service.signal(_interface, signature="tb")
1966
1422
def NeedApproval(self, timeout, default):
1967
1423
"D-Bus signal"
1968
1424
return self.need_approval()
1969
1970
# Methods
1971
1425
1426
## Methods
1427
1972
1428
# Approve - method
1973
1429
@dbus.service.method(_interface, in_signature="b")
1974
1430
def Approve(self, value):
1975
1431
self.approve(value)
1976
1432
1977
1433
# CheckedOK - method
1978
1434
@dbus.service.method(_interface)
1979
1435
def CheckedOK(self):
1980
1436
self.checked_ok()
1981
1437
1982
1438
# Enable - method
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1984
1439
@dbus.service.method(_interface)
1985
1440
def Enable(self):
1986
1441
"D-Bus method"
1987
1442
self.enable()
1988
1443
1989
1444
# StartChecker - method
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1991
1445
@dbus.service.method(_interface)
1992
1446
def StartChecker(self):
1993
1447
"D-Bus method"
1994
1448
self.start_checker()
1995
1449
1996
1450
# Disable - method
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1998
1451
@dbus.service.method(_interface)
1999
1452
def Disable(self):
2000
1453
"D-Bus method"
2001
1454
self.disable()
2002
1455
2003
1456
# StopChecker - method
2004
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2005
1457
@dbus.service.method(_interface)
2006
1458
def StopChecker(self):
2007
1459
self.stop_checker()
2008
2009
# Properties
2010
1460
1461
## Properties
1462
2011
1463
# ApprovalPending - property
2012
1464
@dbus_service_property(_interface, signature="b", access="read")
2013
1465
def ApprovalPending_dbus_property(self):
2014
1466
return dbus.Boolean(bool(self.approvals_pending))
2015
1467
2016
1468
# ApprovedByDefault - property
2017
@dbus_service_property(_interface,
2018
signature="b",
1469
@dbus_service_property(_interface, signature="b",
2019
1470
access="readwrite")
2020
1471
def ApprovedByDefault_dbus_property(self, value=None):
2021
1472
if value is None: # get
2022
1473
return dbus.Boolean(self.approved_by_default)
2023
1474
self.approved_by_default = bool(value)
2024
1475
2025
1476
# ApprovalDelay - property
2026
@dbus_service_property(_interface,
2027
signature="t",
1477
@dbus_service_property(_interface, signature="t",
2028
1478
access="readwrite")
2029
1479
def ApprovalDelay_dbus_property(self, value=None):
2030
1480
if value is None: # get
2031
return dbus.UInt64(self.approval_delay.total_seconds()
2032
* 1000)
1481
return dbus.UInt64(self.approval_delay_milliseconds())
2033
1482
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2034
1483
2035
1484
# ApprovalDuration - property
2036
@dbus_service_property(_interface,
2037
signature="t",
1485
@dbus_service_property(_interface, signature="t",
2038
1486
access="readwrite")
2039
1487
def ApprovalDuration_dbus_property(self, value=None):
2040
1488
if value is None: # get
2041
return dbus.UInt64(self.approval_duration.total_seconds()
2042
* 1000)
1489
return dbus.UInt64(timedelta_to_milliseconds(
1490
self.approval_duration))
2043
1491
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2044
1492
2045
1493
# Name - property
2046
@dbus_annotations(
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2048
1494
@dbus_service_property(_interface, signature="s", access="read")
2049
1495
def Name_dbus_property(self):
2050
1496
return dbus.String(self.name)
2051
2052
# KeyID - property
2053
@dbus_annotations(
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2055
@dbus_service_property(_interface, signature="s", access="read")
2056
def KeyID_dbus_property(self):
2057
return dbus.String(self.key_id)
2058
1497
2059
1498
# Fingerprint - property
2060
@dbus_annotations(
2061
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2062
1499
@dbus_service_property(_interface, signature="s", access="read")
2063
1500
def Fingerprint_dbus_property(self):
2064
1501
return dbus.String(self.fingerprint)
2065
1502
2066
1503
# Host - property
2067
@dbus_service_property(_interface,
2068
signature="s",
1504
@dbus_service_property(_interface, signature="s",
2069
1505
access="readwrite")
2070
1506
def Host_dbus_property(self, value=None):
2071
1507
if value is None: # get
2072
1508
return dbus.String(self.host)
2073
self.host = str(value)
2074
1509
self.host = unicode(value)
1510
2075
1511
# Created - property
2076
@dbus_annotations(
2077
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2078
1512
@dbus_service_property(_interface, signature="s", access="read")
2079
1513
def Created_dbus_property(self):
2080
1514
return datetime_to_dbus(self.created)
2081
1515
2082
1516
# LastEnabled - property
2083
1517
@dbus_service_property(_interface, signature="s", access="read")
2084
1518
def LastEnabled_dbus_property(self):
2085
1519
return datetime_to_dbus(self.last_enabled)
2086
1520
2087
1521
# Enabled - property
2088
@dbus_service_property(_interface,
2089
signature="b",
1522
@dbus_service_property(_interface, signature="b",
2090
1523
access="readwrite")
2091
1524
def Enabled_dbus_property(self, value=None):
2092
1525
if value is None: # get
2095
1528
self.enable()
2096
1529
else:
2097
1530
self.disable()
2098
1531
2099
1532
# LastCheckedOK - property
2100
@dbus_service_property(_interface,
2101
signature="s",
1533
@dbus_service_property(_interface, signature="s",
2102
1534
access="readwrite")
2103
1535
def LastCheckedOK_dbus_property(self, value=None):
2104
1536
if value is not None:
2105
1537
self.checked_ok()
2106
1538
return
2107
1539
return datetime_to_dbus(self.last_checked_ok)
2108
1540
2109
1541
# LastCheckerStatus - property
2110
@dbus_service_property(_interface, signature="n", access="read")
1542
@dbus_service_property(_interface, signature="n",
1543
access="read")
2111
1544
def LastCheckerStatus_dbus_property(self):
2112
1545
return dbus.Int16(self.last_checker_status)
2113
1546
2114
1547
# Expires - property
2115
1548
@dbus_service_property(_interface, signature="s", access="read")
2116
1549
def Expires_dbus_property(self):
2117
1550
return datetime_to_dbus(self.expires)
2118
1551
2119
1552
# LastApprovalRequest - property
2120
1553
@dbus_service_property(_interface, signature="s", access="read")
2121
1554
def LastApprovalRequest_dbus_property(self):
2122
1555
return datetime_to_dbus(self.last_approval_request)
2123
1556
2124
1557
# Timeout - property
2125
@dbus_service_property(_interface,
2126
signature="t",
1558
@dbus_service_property(_interface, signature="t",
2127
1559
access="readwrite")
2128
1560
def Timeout_dbus_property(self, value=None):
2129
1561
if value is None: # get
2130
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1562
return dbus.UInt64(self.timeout_milliseconds())
2131
1563
old_timeout = self.timeout
2132
1564
self.timeout = datetime.timedelta(0, 0, 0, value)
2133
1565
# Reschedule disabling
2141
1573
if (getattr(self, "disable_initiator_tag", None)
2142
1574
is None):
2143
1575
return
2144
GLib.source_remove(self.disable_initiator_tag)
2145
self.disable_initiator_tag = GLib.timeout_add(
2146
int((self.expires - now).total_seconds() * 1000),
2147
self.disable)
2148
1576
gobject.source_remove(self.disable_initiator_tag)
1577
self.disable_initiator_tag = (
1578
gobject.timeout_add(
1579
timedelta_to_milliseconds(self.expires - now),
1580
self.disable))
1581
2149
1582
# ExtendedTimeout - property
2150
@dbus_service_property(_interface,
2151
signature="t",
1583
@dbus_service_property(_interface, signature="t",
2152
1584
access="readwrite")
2153
1585
def ExtendedTimeout_dbus_property(self, value=None):
2154
1586
if value is None: # get
2155
return dbus.UInt64(self.extended_timeout.total_seconds()
2156
* 1000)
1587
return dbus.UInt64(self.extended_timeout_milliseconds())
2157
1588
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2158
1589
2159
1590
# Interval - property
2160
@dbus_service_property(_interface,
2161
signature="t",
1591
@dbus_service_property(_interface, signature="t",
2162
1592
access="readwrite")
2163
1593
def Interval_dbus_property(self, value=None):
2164
1594
if value is None: # get
2165
return dbus.UInt64(self.interval.total_seconds() * 1000)
1595
return dbus.UInt64(self.interval_milliseconds())
2166
1596
self.interval = datetime.timedelta(0, 0, 0, value)
2167
1597
if getattr(self, "checker_initiator_tag", None) is None:
2168
1598
return
2169
1599
if self.enabled:
2170
1600
# Reschedule checker run
2171
GLib.source_remove(self.checker_initiator_tag)
2172
self.checker_initiator_tag = GLib.timeout_add(
2173
value, self.start_checker)
2174
self.start_checker() # Start one now, too
2175
1601
gobject.source_remove(self.checker_initiator_tag)
1602
self.checker_initiator_tag = (gobject.timeout_add
1603
(value, self.start_checker))
1604
self.start_checker() # Start one now, too
1605
2176
1606
# Checker - property
2177
@dbus_service_property(_interface,
2178
signature="s",
1607
@dbus_service_property(_interface, signature="s",
2179
1608
access="readwrite")
2180
1609
def Checker_dbus_property(self, value=None):
2181
1610
if value is None: # get
2182
1611
return dbus.String(self.checker_command)
2183
self.checker_command = str(value)
2184
1612
self.checker_command = unicode(value)
1613
2185
1614
# CheckerRunning - property
2186
@dbus_service_property(_interface,
2187
signature="b",
1615
@dbus_service_property(_interface, signature="b",
2188
1616
access="readwrite")
2189
1617
def CheckerRunning_dbus_property(self, value=None):
2190
1618
if value is None: # get
2193
1621
self.start_checker()
2194
1622
else:
2195
1623
self.stop_checker()
2196
1624
2197
1625
# ObjectPath - property
2198
@dbus_annotations(
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2200
"org.freedesktop.DBus.Deprecated": "true"})
2201
1626
@dbus_service_property(_interface, signature="o", access="read")
2202
1627
def ObjectPath_dbus_property(self):
2203
return self.dbus_object_path # is already a dbus.ObjectPath
2204
1628
return self.dbus_object_path # is already a dbus.ObjectPath
1629
2205
1630
# Secret = property
2206
@dbus_annotations(
2207
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2208
"invalidates"})
2209
@dbus_service_property(_interface,
2210
signature="ay",
2211
access="write",
2212
byte_arrays=True)
1631
@dbus_service_property(_interface, signature="ay",
1632
access="write", byte_arrays=True)
2213
1633
def Secret_dbus_property(self, value):
2214
self.secret = bytes(value)
2215
1634
self.secret = str(value)
1635
2216
1636
del _interface
2217
1637
2218
1638
2219
class ProxyClient:
2220
def __init__(self, child_pipe, key_id, fpr, address):
1639
class ProxyClient(object):
1640
def __init__(self, child_pipe, fpr, address):
2221
1641
self._pipe = child_pipe
2222
self._pipe.send(('init', key_id, fpr, address))
1642
self._pipe.send(('init', fpr, address))
2223
1643
if not self._pipe.recv():
2224
raise KeyError(key_id or fpr)
2225
1644
raise KeyError()
1645
2226
1646
def __getattribute__(self, name):
2227
1647
if name == '_pipe':
2228
1648
return super(ProxyClient, self).__getattribute__(name)
2231
1651
if data[0] == 'data':
2232
1652
return data[1]
2233
1653
if data[0] == 'function':
2234
2235
1654
def func(*args, **kwargs):
2236
1655
self._pipe.send(('funcall', name, args, kwargs))
2237
1656
return self._pipe.recv()[1]
2238
2239
1657
return func
2240
1658
2241
1659
def __setattr__(self, name, value):
2242
1660
if name == '_pipe':
2243
1661
return super(ProxyClient, self).__setattr__(name, value)
2246
1664
2247
1665
class ClientHandler(socketserver.BaseRequestHandler, object):
2248
1666
"""A class to handle client connections.
2249
1667
2250
1668
Instantiated once for each connection to handle it.
2251
1669
Note: This will run in its own forked process."""
2252
1670
2253
1671
def handle(self):
2254
1672
with contextlib.closing(self.server.child_pipe) as child_pipe:
2255
1673
logger.info("TCP connection from: %s",
2256
str(self.client_address))
1674
unicode(self.client_address))
2257
1675
logger.debug("Pipe FD: %d",
2258
1676
self.server.child_pipe.fileno())
2259
2260
session = gnutls.ClientSession(self.request)
2261
2262
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2263
# "+AES-256-CBC", "+SHA1",
2264
# "+COMP-NULL", "+CTYPE-OPENPGP",
2265
# "+DHE-DSS"))
1677
1678
session = (gnutls.connection
1679
.ClientSession(self.request,
1680
gnutls.connection
1681
.X509Credentials()))
1682
1683
# Note: gnutls.connection.X509Credentials is really a
1684
# generic GnuTLS certificate credentials object so long as
1685
# no X.509 keys are added to it. Therefore, we can use it
1686
# here despite using OpenPGP certificates.
1687
1688
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1689
# "+AES-256-CBC", "+SHA1",
1690
# "+COMP-NULL", "+CTYPE-OPENPGP",
1691
# "+DHE-DSS"))
2266
1692
# Use a fallback default, since this MUST be set.
2267
1693
priority = self.server.gnutls_priority
2268
1694
if priority is None:
2269
1695
priority = "NORMAL"
2270
gnutls.priority_set_direct(session._c_object,
2271
priority.encode("utf-8"),
2272
None)
2273
1696
(gnutls.library.functions
1697
.gnutls_priority_set_direct(session._c_object,
1698
priority, None))
1699
2274
1700
# Start communication using the Mandos protocol
2275
1701
# Get protocol number
2276
1702
line = self.request.makefile().readline()
2281
1707
except (ValueError, IndexError, RuntimeError) as error:
2282
1708
logger.error("Unknown protocol version: %s", error)
2283
1709
return
2284
1710
2285
1711
# Start GnuTLS connection
2286
1712
try:
2287
1713
session.handshake()
2288
except gnutls.Error as error:
1714
except gnutls.errors.GNUTLSError as error:
2289
1715
logger.warning("Handshake failed: %s", error)
2290
1716
# Do not run session.bye() here: the session is not
2291
1717
# established. Just abandon the request.
2292
1718
return
2293
1719
logger.debug("Handshake succeeded")
2294
1720
2295
1721
approval_required = False
2296
1722
try:
2297
if gnutls.has_rawpk:
2298
fpr = b""
2299
try:
2300
key_id = self.key_id(
2301
self.peer_certificate(session))
2302
except (TypeError, gnutls.Error) as error:
2303
logger.warning("Bad certificate: %s", error)
2304
return
2305
logger.debug("Key ID: %s", key_id)
2306
2307
else:
2308
key_id = b""
2309
try:
2310
fpr = self.fingerprint(
2311
self.peer_certificate(session))
2312
except (TypeError, gnutls.Error) as error:
2313
logger.warning("Bad certificate: %s", error)
2314
return
2315
logger.debug("Fingerprint: %s", fpr)
2316
2317
try:
2318
client = ProxyClient(child_pipe, key_id, fpr,
1723
try:
1724
fpr = self.fingerprint(self.peer_certificate
1725
(session))
1726
except (TypeError,
1727
gnutls.errors.GNUTLSError) as error:
1728
logger.warning("Bad certificate: %s", error)
1729
return
1730
logger.debug("Fingerprint: %s", fpr)
1731
1732
try:
1733
client = ProxyClient(child_pipe, fpr,
2319
1734
self.client_address)
2320
1735
except KeyError:
2321
1736
return
2322
1737
2323
1738
if client.approval_delay:
2324
1739
delay = client.approval_delay
2325
1740
client.approvals_pending += 1
2326
1741
approval_required = True
2327
1742
2328
1743
while True:
2329
1744
if not client.enabled:
2330
1745
logger.info("Client %s is disabled",
2331
client.name)
1746
client.name)
2332
1747
if self.server.use_dbus:
2333
1748
# Emit D-Bus signal
2334
1749
client.Rejected("Disabled")
2335
1750
return
2336
1751
2337
1752
if client.approved or not client.approval_delay:
2338
# We are approved or approval is disabled
1753
#We are approved or approval is disabled
2339
1754
break
2340
1755
elif client.approved is None:
2341
1756
logger.info("Client %s needs approval",
2343
1758
if self.server.use_dbus:
2344
1759
# Emit D-Bus signal
2345
1760
client.NeedApproval(
2346
client.approval_delay.total_seconds()
2347
* 1000, client.approved_by_default)
1761
client.approval_delay_milliseconds(),
1762
client.approved_by_default)
2348
1763
else:
2349
1764
logger.warning("Client %s was not approved",
2350
1765
client.name)
2352
1767
# Emit D-Bus signal
2353
1768
client.Rejected("Denied")
2354
1769
return
2355
2356
# wait until timeout or approved
1770
1771
#wait until timeout or approved
2357
1772
time = datetime.datetime.now()
2358
1773
client.changedstate.acquire()
2359
client.changedstate.wait(delay.total_seconds())
1774
client.changedstate.wait(
1775
float(timedelta_to_milliseconds(delay)
1776
/ 1000))
2360
1777
client.changedstate.release()
2361
1778
time2 = datetime.datetime.now()
2362
1779
if (time2 - time) >= delay:
2372
1789
break
2373
1790
else:
2374
1791
delay -= time2 - time
2375
2376
try:
2377
session.send(client.secret)
2378
except gnutls.Error as error:
2379
logger.warning("gnutls send failed",
2380
exc_info=error)
2381
return
2382
1792
1793
sent_size = 0
1794
while sent_size < len(client.secret):
1795
try:
1796
sent = session.send(client.secret[sent_size:])
1797
except gnutls.errors.GNUTLSError as error:
1798
logger.warning("gnutls send failed",
1799
exc_info=error)
1800
return
1801
logger.debug("Sent: %d, remaining: %d",
1802
sent, len(client.secret)
1803
- (sent_size + sent))
1804
sent_size += sent
1805
2383
1806
logger.info("Sending secret to %s", client.name)
2384
1807
# bump the timeout using extended_timeout
2385
1808
client.bump_timeout(client.extended_timeout)
2386
1809
if self.server.use_dbus:
2387
1810
# Emit D-Bus signal
2388
1811
client.GotSecret()
2389
1812
2390
1813
finally:
2391
1814
if approval_required:
2392
1815
client.approvals_pending -= 1
2393
1816
try:
2394
1817
session.bye()
2395
except gnutls.Error as error:
1818
except gnutls.errors.GNUTLSError as error:
2396
1819
logger.warning("GnuTLS bye failed",
2397
1820
exc_info=error)
2398
1821
2399
1822
@staticmethod
2400
1823
def peer_certificate(session):
2401
"Return the peer's certificate as a bytestring"
2402
try:
2403
cert_type = gnutls.certificate_type_get2(session._c_object,
2404
gnutls.CTYPE_PEERS)
2405
except AttributeError:
2406
cert_type = gnutls.certificate_type_get(session._c_object)
2407
if gnutls.has_rawpk:
2408
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2409
else:
2410
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2411
# If not a valid certificate type...
2412
if cert_type not in valid_cert_types:
2413
logger.info("Cert type %r not in %r", cert_type,
2414
valid_cert_types)
2415
# ...return invalid data
2416
return b""
1824
"Return the peer's OpenPGP certificate as a bytestring"
1825
# If not an OpenPGP certificate...
1826
if (gnutls.library.functions
1827
.gnutls_certificate_type_get(session._c_object)
1828
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1829
# ...do the normal thing
1830
return session.peer_certificate
2417
1831
list_size = ctypes.c_uint(1)
2418
cert_list = (gnutls.certificate_get_peers
1832
cert_list = (gnutls.library.functions
1833
.gnutls_certificate_get_peers
2419
1834
(session._c_object, ctypes.byref(list_size)))
2420
1835
if not bool(cert_list) and list_size.value != 0:
2421
raise gnutls.Error("error getting peer certificate")
1836
raise gnutls.errors.GNUTLSError("error getting peer"
1837
" certificate")
2422
1838
if list_size.value == 0:
2423
1839
return None
2424
1840
cert = cert_list[0]
2425
1841
return ctypes.string_at(cert.data, cert.size)
2426
2427
@staticmethod
2428
def key_id(certificate):
2429
"Convert a certificate bytestring to a hexdigit key ID"
2430
# New GnuTLS "datum" with the public key
2431
datum = gnutls.datum_t(
2432
ctypes.cast(ctypes.c_char_p(certificate),
2433
ctypes.POINTER(ctypes.c_ubyte)),
2434
ctypes.c_uint(len(certificate)))
2435
# XXX all these need to be created in the gnutls "module"
2436
# New empty GnuTLS certificate
2437
pubkey = gnutls.pubkey_t()
2438
gnutls.pubkey_init(ctypes.byref(pubkey))
2439
# Import the raw public key into the certificate
2440
gnutls.pubkey_import(pubkey,
2441
ctypes.byref(datum),
2442
gnutls.X509_FMT_DER)
2443
# New buffer for the key ID
2444
buf = ctypes.create_string_buffer(32)
2445
buf_len = ctypes.c_size_t(len(buf))
2446
# Get the key ID from the raw public key into the buffer
2447
gnutls.pubkey_get_key_id(pubkey,
2448
gnutls.KEYID_USE_SHA256,
2449
ctypes.cast(ctypes.byref(buf),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.byref(buf_len))
2452
# Deinit the certificate
2453
gnutls.pubkey_deinit(pubkey)
2454
2455
# Convert the buffer to a Python bytestring
2456
key_id = ctypes.string_at(buf, buf_len.value)
2457
# Convert the bytestring to hexadecimal notation
2458
hex_key_id = binascii.hexlify(key_id).upper()
2459
return hex_key_id
2460
1842
2461
1843
@staticmethod
2462
1844
def fingerprint(openpgp):
2463
1845
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2464
1846
# New GnuTLS "datum" with the OpenPGP public key
2465
datum = gnutls.datum_t(
2466
ctypes.cast(ctypes.c_char_p(openpgp),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.c_uint(len(openpgp)))
1847
datum = (gnutls.library.types
1848
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1849
ctypes.POINTER
1850
(ctypes.c_ubyte)),
1851
ctypes.c_uint(len(openpgp))))
2469
1852
# New empty GnuTLS certificate
2470
crt = gnutls.openpgp_crt_t()
2471
gnutls.openpgp_crt_init(ctypes.byref(crt))
1853
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1854
(gnutls.library.functions
1855
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2472
1856
# Import the OpenPGP public key into the certificate
2473
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2474
gnutls.OPENPGP_FMT_RAW)
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1859
gnutls.library.constants
1860
.GNUTLS_OPENPGP_FMT_RAW))
2475
1861
# Verify the self signature in the key
2476
1862
crtverify = ctypes.c_uint()
2477
gnutls.openpgp_crt_verify_self(crt, 0,
2478
ctypes.byref(crtverify))
1863
(gnutls.library.functions
1864
.gnutls_openpgp_crt_verify_self(crt, 0,
1865
ctypes.byref(crtverify)))
2479
1866
if crtverify.value != 0:
2480
gnutls.openpgp_crt_deinit(crt)
2481
raise gnutls.CertificateSecurityError(code
2482
=crtverify.value)
1867
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1868
raise (gnutls.errors.CertificateSecurityError
1869
("Verify failed"))
2483
1870
# New buffer for the fingerprint
2484
1871
buf = ctypes.create_string_buffer(20)
2485
1872
buf_len = ctypes.c_size_t()
2486
1873
# Get the fingerprint from the certificate into the buffer
2487
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2488
ctypes.byref(buf_len))
1874
(gnutls.library.functions
1875
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1876
ctypes.byref(buf_len)))
2489
1877
# Deinit the certificate
2490
gnutls.openpgp_crt_deinit(crt)
1878
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2491
1879
# Convert the buffer to a Python bytestring
2492
1880
fpr = ctypes.string_at(buf, buf_len.value)
2493
1881
# Convert the bytestring to hexadecimal notation
2495
1883
return hex_fpr
2496
1884
2497
1885
2498
class MultiprocessingMixIn:
1886
class MultiprocessingMixIn(object):
2499
1887
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2500
2501
1888
def sub_process_main(self, request, address):
2502
1889
try:
2503
1890
self.finish_request(request, address)
2504
1891
except Exception:
2505
1892
self.handle_error(request, address)
2506
1893
self.close_request(request)
2507
1894
2508
1895
def process_request(self, request, address):
2509
1896
"""Start a new process to process the request."""
2510
proc = multiprocessing.Process(target=self.sub_process_main,
2511
args=(request, address))
1897
proc = multiprocessing.Process(target = self.sub_process_main,
1898
args = (request, address))
2512
1899
proc.start()
2513
1900
return proc
2514
1901
2515
1902
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1903
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2517
1904
""" adds a pipe to the MixIn """
2518
2519
1905
def process_request(self, request, client_address):
2520
1906
"""Overrides and wraps the original process_request().
2521
1907
2522
1908
This function creates a new pipe in self.pipe
2523
1909
"""
2524
1910
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2525
1911
2526
1912
proc = MultiprocessingMixIn.process_request(self, request,
2527
1913
client_address)
2528
1914
self.child_pipe.close()
2529
1915
self.add_pipe(parent_pipe, proc)
2530
1916
2531
1917
def add_pipe(self, parent_pipe, proc):
2532
1918
"""Dummy function; override as necessary"""
2533
1919
raise NotImplementedError()
2534
1920
2535
1921
2536
1922
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2537
socketserver.TCPServer):
1923
socketserver.TCPServer, object):
2538
1924
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2539
1925
2540
1926
Attributes:
2541
1927
enabled: Boolean; whether this server is activated yet
2542
1928
interface: None or a network interface name (string)
2543
1929
use_ipv6: Boolean; to use IPv6 or not
2544
1930
"""
2545
2546
1931
def __init__(self, server_address, RequestHandlerClass,
2547
interface=None,
2548
use_ipv6=True,
2549
socketfd=None):
1932
interface=None, use_ipv6=True, socketfd=None):
2550
1933
"""If socketfd is set, use that file descriptor instead of
2551
1934
creating a new one with socket.socket().
2552
1935
"""
2558
1941
self.socketfd = socketfd
2559
1942
# Save the original socket.socket() function
2560
1943
self.socket_socket = socket.socket
2561
2562
1944
# To implement --socket, we monkey patch socket.socket.
2563
#
1945
#
2564
1946
# (When socketserver.TCPServer is a new-style class, we
2565
1947
# could make self.socket into a property instead of monkey
2566
1948
# patching socket.socket.)
2567
#
1949
#
2568
1950
# Create a one-time-only replacement for socket.socket()
2569
1951
@functools.wraps(socket.socket)
2570
1952
def socket_wrapper(*args, **kwargs):
2582
1964
# socket_wrapper(), if socketfd was set.
2583
1965
socketserver.TCPServer.__init__(self, server_address,
2584
1966
RequestHandlerClass)
2585
1967
2586
1968
def server_bind(self):
2587
1969
"""This overrides the normal server_bind() function
2588
1970
to bind to an interface if one was specified, and also NOT to
2589
1971
bind to an address or port if they were not specified."""
2590
global SO_BINDTODEVICE
2591
1972
if self.interface is not None:
2592
1973
if SO_BINDTODEVICE is None:
2593
# Fall back to a hard-coded value which seems to be
2594
# common enough.
2595
logger.warning("SO_BINDTODEVICE not found, trying 25")
2596
SO_BINDTODEVICE = 25
2597
try:
2598
self.socket.setsockopt(
2599
socket.SOL_SOCKET, SO_BINDTODEVICE,
2600
(self.interface + "\0").encode("utf-8"))
2601
except socket.error as error:
2602
if error.errno == errno.EPERM:
2603
logger.error("No permission to bind to"
2604
" interface %s", self.interface)
2605
elif error.errno == errno.ENOPROTOOPT:
2606
logger.error("SO_BINDTODEVICE not available;"
2607
" cannot bind to interface %s",
2608
self.interface)
2609
elif error.errno == errno.ENODEV:
2610
logger.error("Interface %s does not exist,"
2611
" cannot bind", self.interface)
2612
else:
2613
raise
1974
logger.error("SO_BINDTODEVICE does not exist;"
1975
" cannot bind to interface %s",
1976
self.interface)
1977
else:
1978
try:
1979
self.socket.setsockopt(socket.SOL_SOCKET,
1980
SO_BINDTODEVICE,
1981
str(self.interface + '\0'))
1982
except socket.error as error:
1983
if error.errno == errno.EPERM:
1984
logger.error("No permission to bind to"
1985
" interface %s", self.interface)
1986
elif error.errno == errno.ENOPROTOOPT:
1987
logger.error("SO_BINDTODEVICE not available;"
1988
" cannot bind to interface %s",
1989
self.interface)
1990
elif error.errno == errno.ENODEV:
1991
logger.error("Interface %s does not exist,"
1992
" cannot bind", self.interface)
1993
else:
1994
raise
2614
1995
# Only bind(2) the socket if we really need to.
2615
1996
if self.server_address[0] or self.server_address[1]:
2616
if self.server_address[1]:
2617
self.allow_reuse_address = True
2618
1997
if not self.server_address[0]:
2619
1998
if self.address_family == socket.AF_INET6:
2620
any_address = "::" # in6addr_any
1999
any_address = "::" # in6addr_any
2621
2000
else:
2622
any_address = "0.0.0.0" # INADDR_ANY
2001
any_address = "0.0.0.0" # INADDR_ANY
2623
2002
self.server_address = (any_address,
2624
2003
self.server_address[1])
2625
2004
elif not self.server_address[1]:
2626
self.server_address = (self.server_address[0], 0)
2005
self.server_address = (self.server_address[0],
2006
0)
2627
2007
# if self.interface:
2628
2008
# self.server_address = (self.server_address[0],
2629
2009
# 0, # port
2635
2015
2636
2016
class MandosServer(IPv6_TCPServer):
2637
2017
"""Mandos server.
2638
2018
2639
2019
Attributes:
2640
2020
clients: set of Client objects
2641
2021
gnutls_priority GnuTLS priority string
2642
2022
use_dbus: Boolean; to emit D-Bus signals or not
2643
2644
Assumes a GLib.MainLoop event loop.
2023
2024
Assumes a gobject.MainLoop event loop.
2645
2025
"""
2646
2647
2026
def __init__(self, server_address, RequestHandlerClass,
2648
interface=None,
2649
use_ipv6=True,
2650
clients=None,
2651
gnutls_priority=None,
2652
use_dbus=True,
2653
socketfd=None):
2027
interface=None, use_ipv6=True, clients=None,
2028
gnutls_priority=None, use_dbus=True, socketfd=None):
2654
2029
self.enabled = False
2655
2030
self.clients = clients
2656
2031
if self.clients is None:
2659
2034
self.gnutls_priority = gnutls_priority
2660
2035
IPv6_TCPServer.__init__(self, server_address,
2661
2036
RequestHandlerClass,
2662
interface=interface,
2663
use_ipv6=use_ipv6,
2664
socketfd=socketfd)
2665
2037
interface = interface,
2038
use_ipv6 = use_ipv6,
2039
socketfd = socketfd)
2666
2040
def server_activate(self):
2667
2041
if self.enabled:
2668
2042
return socketserver.TCPServer.server_activate(self)
2669
2043
2670
2044
def enable(self):
2671
2045
self.enabled = True
2672
2046
2673
2047
def add_pipe(self, parent_pipe, proc):
2674
2048
# Call "handle_ipc" for both data and EOF events
2675
GLib.io_add_watch(
2676
parent_pipe.fileno(),
2677
GLib.IO_IN | GLib.IO_HUP,
2678
functools.partial(self.handle_ipc,
2679
parent_pipe=parent_pipe,
2680
proc=proc))
2681
2682
def handle_ipc(self, source, condition,
2683
parent_pipe=None,
2684
proc=None,
2685
client_object=None):
2049
gobject.io_add_watch(parent_pipe.fileno(),
2050
gobject.IO_IN | gobject.IO_HUP,
2051
functools.partial(self.handle_ipc,
2052
parent_pipe =
2053
parent_pipe,
2054
proc = proc))
2055
2056
def handle_ipc(self, source, condition, parent_pipe=None,
2057
proc = None, client_object=None):
2686
2058
# error, or the other end of multiprocessing.Pipe has closed
2687
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2059
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2688
2060
# Wait for other process to exit
2689
2061
proc.join()
2690
2062
return False
2691
2063
2692
2064
# Read a request from the child
2693
2065
request = parent_pipe.recv()
2694
2066
command = request[0]
2695
2067
2696
2068
if command == 'init':
2697
key_id = request[1].decode("ascii")
2698
fpr = request[2].decode("ascii")
2699
address = request[3]
2700
2701
for c in self.clients.values():
2702
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2703
continue
2704
if key_id and c.key_id == key_id:
2705
client = c
2706
break
2707
if fpr and c.fingerprint == fpr:
2069
fpr = request[1]
2070
address = request[2]
2071
2072
for c in self.clients.itervalues():
2073
if c.fingerprint == fpr:
2708
2074
client = c
2709
2075
break
2710
2076
else:
2711
logger.info("Client not found for key ID: %s, address"
2712
": %s", key_id or fpr, address)
2077
logger.info("Client not found for fingerprint: %s, ad"
2078
"dress: %s", fpr, address)
2713
2079
if self.use_dbus:
2714
2080
# Emit D-Bus signal
2715
mandos_dbus_service.ClientNotFound(key_id or fpr,
2081
mandos_dbus_service.ClientNotFound(fpr,
2716
2082
address[0])
2717
2083
parent_pipe.send(False)
2718
2084
return False
2719
2720
GLib.io_add_watch(
2721
parent_pipe.fileno(),
2722
GLib.IO_IN | GLib.IO_HUP,
2723
functools.partial(self.handle_ipc,
2724
parent_pipe=parent_pipe,
2725
proc=proc,
2726
client_object=client))
2085
2086
gobject.io_add_watch(parent_pipe.fileno(),
2087
gobject.IO_IN | gobject.IO_HUP,
2088
functools.partial(self.handle_ipc,
2089
parent_pipe =
2090
parent_pipe,
2091
proc = proc,
2092
client_object =
2093
client))
2727
2094
parent_pipe.send(True)
2728
2095
# remove the old hook in favor of the new above hook on
2729
2096
# same fileno
2732
2099
funcname = request[1]
2733
2100
args = request[2]
2734
2101
kwargs = request[3]
2735
2102
2736
2103
parent_pipe.send(('data', getattr(client_object,
2737
2104
funcname)(*args,
2738
**kwargs)))
2739
2105
**kwargs)))
2106
2740
2107
if command == 'getattr':
2741
2108
attrname = request[1]
2742
if isinstance(client_object.__getattribute__(attrname),
2743
collections.Callable):
2744
parent_pipe.send(('function', ))
2109
if callable(client_object.__getattribute__(attrname)):
2110
parent_pipe.send(('function',))
2745
2111
else:
2746
parent_pipe.send((
2747
'data', client_object.__getattribute__(attrname)))
2748
2112
parent_pipe.send(('data', client_object
2113
.__getattribute__(attrname)))
2114
2749
2115
if command == 'setattr':
2750
2116
attrname = request[1]
2751
2117
value = request[2]
2752
2118
setattr(client_object, attrname, value)
2753
2119
2754
2120
return True
2755
2121
2756
2122
2757
2123
def rfc3339_duration_to_delta(duration):
2758
2124
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2759
2125
2760
2126
>>> rfc3339_duration_to_delta("P7D")
2761
2127
datetime.timedelta(7)
2762
2128
>>> rfc3339_duration_to_delta("PT60S")
2772
2138
>>> rfc3339_duration_to_delta("P1DT3M20S")
2773
2139
datetime.timedelta(1, 200)
2774
2140
"""
2775
2141
2776
2142
# Parsing an RFC 3339 duration with regular expressions is not
2777
2143
# possible - there would have to be multiple places for the same
2778
2144
# values, like seconds. The current code, while more esoteric, is
2779
2145
# cleaner without depending on a parsing library. If Python had a
2780
2146
# built-in library for parsing we would use it, but we'd like to
2781
2147
# avoid excessive use of external libraries.
2782
2148
2783
2149
# New type for defining tokens, syntax, and semantics all-in-one
2784
Token = collections.namedtuple("Token", (
2785
"regexp", # To match token; if "value" is not None, must have
2786
# a "group" containing digits
2787
"value", # datetime.timedelta or None
2788
"followers")) # Tokens valid after this token
2150
Token = collections.namedtuple("Token",
2151
("regexp", # To match token; if
2152
# "value" is not None,
2153
# must have a "group"
2154
# containing digits
2155
"value", # datetime.timedelta or
2156
# None
2157
"followers")) # Tokens valid after
2158
# this token
2789
2159
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2790
2160
# the "duration" ABNF definition in RFC 3339, Appendix A.
2791
2161
token_end = Token(re.compile(r"$"), None, frozenset())
2792
2162
token_second = Token(re.compile(r"(\d+)S"),
2793
2163
datetime.timedelta(seconds=1),
2794
frozenset((token_end, )))
2164
frozenset((token_end,)))
2795
2165
token_minute = Token(re.compile(r"(\d+)M"),
2796
2166
datetime.timedelta(minutes=1),
2797
2167
frozenset((token_second, token_end)))
2813
2183
frozenset((token_month, token_end)))
2814
2184
token_week = Token(re.compile(r"(\d+)W"),
2815
2185
datetime.timedelta(weeks=1),
2816
frozenset((token_end, )))
2186
frozenset((token_end,)))
2817
2187
token_duration = Token(re.compile(r"P"), None,
2818
2188
frozenset((token_year, token_month,
2819
2189
token_day, token_time,
2820
token_week)))
2821
# Define starting values:
2822
# Value so far
2823
value = datetime.timedelta()
2190
token_week))),
2191
# Define starting values
2192
value = datetime.timedelta() # Value so far
2824
2193
found_token = None
2825
# Following valid tokens
2826
followers = frozenset((token_duration, ))
2827
# String left to parse
2828
s = duration
2194
followers = frozenset(token_duration,) # Following valid tokens
2195
s = duration # String left to parse
2829
2196
# Loop until end token is found
2830
2197
while found_token is not token_end:
2831
2198
# Search for any currently valid tokens
2847
2214
break
2848
2215
else:
2849
2216
# No currently valid tokens were found
2850
raise ValueError("Invalid RFC 3339 duration: {!r}"
2851
.format(duration))
2217
raise ValueError("Invalid RFC 3339 duration")
2852
2218
# End token found
2853
2219
return value
2854
2220
2855
2221
2856
2222
def string_to_delta(interval):
2857
2223
"""Parse a string and return a datetime.timedelta
2858
2224
2859
2225
>>> string_to_delta('7d')
2860
2226
datetime.timedelta(7)
2861
2227
>>> string_to_delta('60s')
2869
2235
>>> string_to_delta('5m 30s')
2870
2236
datetime.timedelta(0, 330)
2871
2237
"""
2872
2238
2873
2239
try:
2874
2240
return rfc3339_duration_to_delta(interval)
2875
2241
except ValueError:
2876
2242
pass
2877
2243
2878
2244
timevalue = datetime.timedelta(0)
2879
2245
for s in interval.split():
2880
2246
try:
2881
suffix = s[-1]
2247
suffix = unicode(s[-1])
2882
2248
value = int(s[:-1])
2883
2249
if suffix == "d":
2884
2250
delta = datetime.timedelta(value)
2891
2257
elif suffix == "w":
2892
2258
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2893
2259
else:
2894
raise ValueError("Unknown suffix {!r}".format(suffix))
2260
raise ValueError("Unknown suffix {0!r}"
2261
.format(suffix))
2895
2262
except IndexError as e:
2896
2263
raise ValueError(*(e.args))
2897
2264
timevalue += delta
2898
2265
return timevalue
2899
2266
2900
2267
2901
def daemon(nochdir=False, noclose=False):
2268
def daemon(nochdir = False, noclose = False):
2902
2269
"""See daemon(3). Standard BSD Unix function.
2903
2270
2904
2271
This should really exist as os.daemon, but it doesn't (yet)."""
2905
2272
if os.fork():
2906
2273
sys.exit()
2914
2281
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2915
2282
if not stat.S_ISCHR(os.fstat(null).st_mode):
2916
2283
raise OSError(errno.ENODEV,
2917
"{} not a character device"
2284
"{0} not a character device"
2918
2285
.format(os.devnull))
2919
2286
os.dup2(null, sys.stdin.fileno())
2920
2287
os.dup2(null, sys.stdout.fileno())
2924
2291
2925
2292
2926
2293
def main():
2927
2294
2928
2295
##################################################################
2929
2296
# Parsing of options, both command line and config file
2930
2297
2931
2298
parser = argparse.ArgumentParser()
2932
2299
parser.add_argument("-v", "--version", action="version",
2933
version="%(prog)s {}".format(version),
2300
version = "%(prog)s {0}".format(version),
2934
2301
help="show version number and exit")
2935
2302
parser.add_argument("-i", "--interface", metavar="IF",
2936
2303
help="Bind to interface IF")
2969
2336
help="Directory to save/restore state in")
2970
2337
parser.add_argument("--foreground", action="store_true",
2971
2338
help="Run in foreground", default=None)
2972
parser.add_argument("--no-zeroconf", action="store_false",
2973
dest="zeroconf", help="Do not use Zeroconf",
2974
default=None)
2975
2339
2976
2340
options = parser.parse_args()
2977
2341
2978
2342
if options.check:
2979
2343
import doctest
2980
2344
fail_count, test_count = doctest.testmod()
2981
2345
sys.exit(os.EX_OK if fail_count == 0 else 1)
2982
2346
2983
2347
# Default values for config file for server-global settings
2984
if gnutls.has_rawpk:
2985
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2986
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2987
else:
2988
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2989
":+SIGN-DSA-SHA256")
2990
server_defaults = {"interface": "",
2991
"address": "",
2992
"port": "",
2993
"debug": "False",
2994
"priority": priority,
2995
"servicename": "Mandos",
2996
"use_dbus": "True",
2997
"use_ipv6": "True",
2998
"debuglevel": "",
2999
"restore": "True",
3000
"socket": "",
3001
"statedir": "/var/lib/mandos",
3002
"foreground": "False",
3003
"zeroconf": "True",
3004
}
3005
del priority
3006
2348
server_defaults = { "interface": "",
2349
"address": "",
2350
"port": "",
2351
"debug": "False",
2352
"priority":
2353
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2354
"servicename": "Mandos",
2355
"use_dbus": "True",
2356
"use_ipv6": "True",
2357
"debuglevel": "",
2358
"restore": "True",
2359
"socket": "",
2360
"statedir": "/var/lib/mandos",
2361
"foreground": "False",
2362
}
2363
3007
2364
# Parse config file for server-global settings
3008
server_config = configparser.ConfigParser(server_defaults)
2365
server_config = configparser.SafeConfigParser(server_defaults)
3009
2366
del server_defaults
3010
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3011
# Convert the ConfigParser object to a dict
2367
server_config.read(os.path.join(options.configdir,
2368
"mandos.conf"))
2369
# Convert the SafeConfigParser object to a dict
3012
2370
server_settings = server_config.defaults()
3013
2371
# Use the appropriate methods on the non-string config options
3014
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3015
"foreground", "zeroconf"):
2372
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3016
2373
server_settings[option] = server_config.getboolean("DEFAULT",
3017
2374
option)
3018
2375
if server_settings["port"]:
3028
2385
server_settings["socket"] = os.dup(server_settings
3029
2386
["socket"])
3030
2387
del server_config
3031
2388
3032
2389
# Override the settings from the config file with command line
3033
2390
# options, if set.
3034
2391
for option in ("interface", "address", "port", "debug",
3035
"priority", "servicename", "configdir", "use_dbus",
3036
"use_ipv6", "debuglevel", "restore", "statedir",
3037
"socket", "foreground", "zeroconf"):
2392
"priority", "servicename", "configdir",
2393
"use_dbus", "use_ipv6", "debuglevel", "restore",
2394
"statedir", "socket", "foreground"):
3038
2395
value = getattr(options, option)
3039
2396
if value is not None:
3040
2397
server_settings[option] = value
3041
2398
del options
3042
2399
# Force all strings to be unicode
3043
2400
for option in server_settings.keys():
3044
if isinstance(server_settings[option], bytes):
3045
server_settings[option] = (server_settings[option]
3046
.decode("utf-8"))
2401
if type(server_settings[option]) is str:
2402
server_settings[option] = unicode(server_settings[option])
3047
2403
# Force all boolean options to be boolean
3048
2404
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3049
"foreground", "zeroconf"):
2405
"foreground"):
3050
2406
server_settings[option] = bool(server_settings[option])
3051
2407
# Debug implies foreground
3052
2408
if server_settings["debug"]:
3053
2409
server_settings["foreground"] = True
3054
2410
# Now we have our good server settings in "server_settings"
3055
2411
3056
2412
##################################################################
3057
3058
if (not server_settings["zeroconf"]
3059
and not (server_settings["port"]
3060
or server_settings["socket"] != "")):
3061
parser.error("Needs port or socket to work without Zeroconf")
3062
2413
3063
2414
# For convenience
3064
2415
debug = server_settings["debug"]
3065
2416
debuglevel = server_settings["debuglevel"]
3068
2419
stored_state_path = os.path.join(server_settings["statedir"],
3069
2420
stored_state_file)
3070
2421
foreground = server_settings["foreground"]
3071
zeroconf = server_settings["zeroconf"]
3072
2422
3073
2423
if debug:
3074
2424
initlogger(debug, logging.DEBUG)
3075
2425
else:
3078
2428
else:
3079
2429
level = getattr(logging, debuglevel.upper())
3080
2430
initlogger(debug, level)
3081
2431
3082
2432
if server_settings["servicename"] != "Mandos":
3083
syslogger.setFormatter(
3084
logging.Formatter('Mandos ({}) [%(process)d]:'
3085
' %(levelname)s: %(message)s'.format(
3086
server_settings["servicename"])))
3087
2433
syslogger.setFormatter(logging.Formatter
2434
('Mandos ({0}) [%(process)d]:'
2435
' %(levelname)s: %(message)s'
2436
.format(server_settings
2437
["servicename"])))
2438
3088
2439
# Parse config file with clients
3089
client_config = configparser.ConfigParser(Client.client_defaults)
2440
client_config = configparser.SafeConfigParser(Client
2441
.client_defaults)
3090
2442
client_config.read(os.path.join(server_settings["configdir"],
3091
2443
"clients.conf"))
3092
2444
3093
2445
global mandos_dbus_service
3094
2446
mandos_dbus_service = None
3095
3096
socketfd = None
3097
if server_settings["socket"] != "":
3098
socketfd = server_settings["socket"]
3099
tcp_server = MandosServer(
3100
(server_settings["address"], server_settings["port"]),
3101
ClientHandler,
3102
interface=(server_settings["interface"] or None),
3103
use_ipv6=use_ipv6,
3104
gnutls_priority=server_settings["priority"],
3105
use_dbus=use_dbus,
3106
socketfd=socketfd)
2447
2448
tcp_server = MandosServer((server_settings["address"],
2449
server_settings["port"]),
2450
ClientHandler,
2451
interface=(server_settings["interface"]
2452
or None),
2453
use_ipv6=use_ipv6,
2454
gnutls_priority=
2455
server_settings["priority"],
2456
use_dbus=use_dbus,
2457
socketfd=(server_settings["socket"]
2458
or None))
3107
2459
if not foreground:
3108
2460
pidfilename = "/run/mandos.pid"
3109
2461
if not os.path.isdir("/run/."):
3110
2462
pidfilename = "/var/run/mandos.pid"
3111
2463
pidfile = None
3112
2464
try:
3113
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2465
pidfile = open(pidfilename, "w")
3114
2466
except IOError as e:
3115
2467
logger.error("Could not open file %r", pidfilename,
3116
2468
exc_info=e)
3117
3118
for name, group in (("_mandos", "_mandos"),
3119
("mandos", "mandos"),
3120
("nobody", "nogroup")):
2469
2470
for name in ("_mandos", "mandos", "nobody"):
3121
2471
try:
3122
2472
uid = pwd.getpwnam(name).pw_uid
3123
gid = pwd.getpwnam(group).pw_gid
2473
gid = pwd.getpwnam(name).pw_gid
3124
2474
break
3125
2475
except KeyError:
3126
2476
continue
3130
2480
try:
3131
2481
os.setgid(gid)
3132
2482
os.setuid(uid)
3133
if debug:
3134
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3135
gid))
3136
2483
except OSError as error:
3137
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3138
.format(uid, gid, os.strerror(error.errno)))
3139
2484
if error.errno != errno.EPERM:
3140
2485
raise
3141
2486
3142
2487
if debug:
3143
2488
# Enable all possible GnuTLS debugging
3144
2489
3145
2490
# "Use a log level over 10 to enable all debugging options."
3146
2491
# - GnuTLS manual
3147
gnutls.global_set_log_level(11)
3148
3149
@gnutls.log_func
2492
gnutls.library.functions.gnutls_global_set_log_level(11)
2493
2494
@gnutls.library.types.gnutls_log_func
3150
2495
def debug_gnutls(level, string):
3151
2496
logger.debug("GnuTLS: %s", string[:-1])
3152
3153
gnutls.global_set_log_function(debug_gnutls)
3154
2497
2498
(gnutls.library.functions
2499
.gnutls_global_set_log_function(debug_gnutls))
2500
3155
2501
# Redirect stdin so all checkers get /dev/null
3156
2502
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3157
2503
os.dup2(null, sys.stdin.fileno())
3158
2504
if null > 2:
3159
2505
os.close(null)
3160
2506
3161
2507
# Need to fork before connecting to D-Bus
3162
2508
if not foreground:
3163
2509
# Close all input and output, do double fork, etc.
3164
2510
daemon()
3165
3166
if gi.version_info < (3, 10, 2):
3167
# multiprocessing will use threads, so before we use GLib we
3168
# need to inform GLib that threads will be used.
3169
GLib.threads_init()
3170
2511
2512
# multiprocessing will use threads, so before we use gobject we
2513
# need to inform gobject that threads will be used.
2514
gobject.threads_init()
2515
3171
2516
global main_loop
3172
2517
# From the Avahi example code
3173
2518
DBusGMainLoop(set_as_default=True)
3174
main_loop = GLib.MainLoop()
2519
main_loop = gobject.MainLoop()
3175
2520
bus = dbus.SystemBus()
3176
2521
# End of Avahi example code
3177
2522
if use_dbus:
3178
2523
try:
3179
2524
bus_name = dbus.service.BusName("se.recompile.Mandos",
3180
bus,
3181
do_not_queue=True)
3182
old_bus_name = dbus.service.BusName(
3183
"se.bsnet.fukt.Mandos", bus,
3184
do_not_queue=True)
3185
except dbus.exceptions.DBusException as e:
2525
bus, do_not_queue=True)
2526
old_bus_name = (dbus.service.BusName
2527
("se.bsnet.fukt.Mandos", bus,
2528
do_not_queue=True))
2529
except dbus.exceptions.NameExistsException as e:
3186
2530
logger.error("Disabling D-Bus:", exc_info=e)
3187
2531
use_dbus = False
3188
2532
server_settings["use_dbus"] = False
3189
2533
tcp_server.use_dbus = False
3190
if zeroconf:
3191
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3192
service = AvahiServiceToSyslog(
3193
name=server_settings["servicename"],
3194
servicetype="_mandos._tcp",
3195
protocol=protocol,
3196
bus=bus)
3197
if server_settings["interface"]:
3198
service.interface = if_nametoindex(
3199
server_settings["interface"].encode("utf-8"))
3200
2534
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2535
service = AvahiServiceToSyslog(name =
2536
server_settings["servicename"],
2537
servicetype = "_mandos._tcp",
2538
protocol = protocol, bus = bus)
2539
if server_settings["interface"]:
2540
service.interface = (if_nametoindex
2541
(str(server_settings["interface"])))
2542
3201
2543
global multiprocessing_manager
3202
2544
multiprocessing_manager = multiprocessing.Manager()
3203
2545
3204
2546
client_class = Client
3205
2547
if use_dbus:
3206
client_class = functools.partial(ClientDBus, bus=bus)
3207
2548
client_class = functools.partial(ClientDBus, bus = bus)
2549
3208
2550
client_settings = Client.config_parser(client_config)
3209
2551
old_client_settings = {}
3210
2552
clients_data = {}
3211
2553
3212
2554
# This is used to redirect stdout and stderr for checker processes
3213
2555
global wnull
3214
wnull = open(os.devnull, "w") # A writable /dev/null
2556
wnull = open(os.devnull, "w") # A writable /dev/null
3215
2557
# Only used if server is running in foreground but not in debug
3216
2558
# mode
3217
2559
if debug or not foreground:
3218
2560
wnull.close()
3219
2561
3220
2562
# Get client data and settings from last running state.
3221
2563
if server_settings["restore"]:
3222
2564
try:
3223
2565
with open(stored_state_path, "rb") as stored_state:
3224
if sys.version_info.major == 2:
3225
clients_data, old_client_settings = pickle.load(
3226
stored_state)
3227
else:
3228
bytes_clients_data, bytes_old_client_settings = (
3229
pickle.load(stored_state, encoding="bytes"))
3230
# Fix bytes to strings
3231
# clients_data
3232
# .keys()
3233
clients_data = {(key.decode("utf-8")
3234
if isinstance(key, bytes)
3235
else key): value
3236
for key, value in
3237
bytes_clients_data.items()}
3238
del bytes_clients_data
3239
for key in clients_data:
3240
value = {(k.decode("utf-8")
3241
if isinstance(k, bytes) else k): v
3242
for k, v in
3243
clients_data[key].items()}
3244
clients_data[key] = value
3245
# .client_structure
3246
value["client_structure"] = [
3247
(s.decode("utf-8")
3248
if isinstance(s, bytes)
3249
else s) for s in
3250
value["client_structure"]]
3251
# .name & .host
3252
for k in ("name", "host"):
3253
if isinstance(value[k], bytes):
3254
value[k] = value[k].decode("utf-8")
3255
if "key_id" not in value:
3256
value["key_id"] = ""
3257
elif "fingerprint" not in value:
3258
value["fingerprint"] = ""
3259
# old_client_settings
3260
# .keys()
3261
old_client_settings = {
3262
(key.decode("utf-8")
3263
if isinstance(key, bytes)
3264
else key): value
3265
for key, value in
3266
bytes_old_client_settings.items()}
3267
del bytes_old_client_settings
3268
# .host
3269
for value in old_client_settings.values():
3270
if isinstance(value["host"], bytes):
3271
value["host"] = (value["host"]
3272
.decode("utf-8"))
2566
clients_data, old_client_settings = (pickle.load
2567
(stored_state))
3273
2568
os.remove(stored_state_path)
3274
2569
except IOError as e:
3275
2570
if e.errno == errno.ENOENT:
3276
logger.warning("Could not load persistent state:"
3277
" {}".format(os.strerror(e.errno)))
2571
logger.warning("Could not load persistent state: {0}"
2572
.format(os.strerror(e.errno)))
3278
2573
else:
3279
2574
logger.critical("Could not load persistent state:",
3280
2575
exc_info=e)
3281
2576
raise
3282
2577
except EOFError as e:
3283
2578
logger.warning("Could not load persistent state: "
3284
"EOFError:",
3285
exc_info=e)
3286
2579
"EOFError:", exc_info=e)
2580
3287
2581
with PGPEngine() as pgp:
3288
for client_name, client in clients_data.items():
2582
for client_name, client in clients_data.iteritems():
3289
2583
# Skip removed clients
3290
2584
if client_name not in client_settings:
3291
2585
continue
3292
2586
3293
2587
# Decide which value to use after restoring saved state.
3294
2588
# We have three different values: Old config file,
3295
2589
# new config file, and saved state.
3300
2594
# For each value in new config, check if it
3301
2595
# differs from the old config value (Except for
3302
2596
# the "secret" attribute)
3303
if (name != "secret"
3304
and (value !=
3305
old_client_settings[client_name][name])):
2597
if (name != "secret" and
2598
value != old_client_settings[client_name]
2599
[name]):
3306
2600
client[name] = value
3307
2601
except KeyError:
3308
2602
pass
3309
2603
3310
2604
# Clients who has passed its expire date can still be
3311
# enabled if its last checker was successful. A Client
2605
# enabled if its last checker was successful. Clients
3312
2606
# whose checker succeeded before we stored its state is
3313
2607
# assumed to have successfully run all checkers during
3314
2608
# downtime.
3316
2610
if datetime.datetime.utcnow() >= client["expires"]:
3317
2611
if not client["last_checked_ok"]:
3318
2612
logger.warning(
3319
"disabling client {} - Client never "
3320
"performed a successful checker".format(
3321
client_name))
2613
"disabling client {0} - Client never "
2614
"performed a successful checker"
2615
.format(client_name))
3322
2616
client["enabled"] = False
3323
2617
elif client["last_checker_status"] != 0:
3324
2618
logger.warning(
3325
"disabling client {} - Client last"
3326
" checker failed with error code"
3327
" {}".format(
3328
client_name,
3329
client["last_checker_status"]))
2619
"disabling client {0} - Client "
2620
"last checker failed with error code {1}"
2621
.format(client_name,
2622
client["last_checker_status"]))
3330
2623
client["enabled"] = False
3331
2624
else:
3332
client["expires"] = (
3333
datetime.datetime.utcnow()
3334
+ client["timeout"])
2625
client["expires"] = (datetime.datetime
2626
.utcnow()
2627
+ client["timeout"])
3335
2628
logger.debug("Last checker succeeded,"
3336
" keeping {} enabled".format(
3337
client_name))
2629
" keeping {0} enabled"
2630
.format(client_name))
3338
2631
try:
3339
client["secret"] = pgp.decrypt(
3340
client["encrypted_secret"],
3341
client_settings[client_name]["secret"])
2632
client["secret"] = (
2633
pgp.decrypt(client["encrypted_secret"],
2634
client_settings[client_name]
2635
["secret"]))
3342
2636
except PGPError:
3343
2637
# If decryption fails, we use secret from new settings
3344
logger.debug("Failed to decrypt {} old secret".format(
3345
client_name))
3346
client["secret"] = (client_settings[client_name]
3347
["secret"])
3348
2638
logger.debug("Failed to decrypt {0} old secret"
2639
.format(client_name))
2640
client["secret"] = (
2641
client_settings[client_name]["secret"])
2642
3349
2643
# Add/remove clients based on new changes made to config
3350
2644
for client_name in (set(old_client_settings)
3351
2645
- set(client_settings)):
3353
2647
for client_name in (set(client_settings)
3354
2648
- set(old_client_settings)):
3355
2649
clients_data[client_name] = client_settings[client_name]
3356
2650
3357
2651
# Create all client objects
3358
for client_name, client in clients_data.items():
2652
for client_name, client in clients_data.iteritems():
3359
2653
tcp_server.clients[client_name] = client_class(
3360
name=client_name,
3361
settings=client,
3362
server_settings=server_settings)
3363
2654
name = client_name, settings = client,
2655
server_settings = server_settings)
2656
3364
2657
if not tcp_server.clients:
3365
2658
logger.warning("No clients defined")
3366
2659
3367
2660
if not foreground:
3368
2661
if pidfile is not None:
3369
pid = os.getpid()
3370
2662
try:
3371
2663
with pidfile:
3372
print(pid, file=pidfile)
2664
pid = os.getpid()
2665
pidfile.write(str(pid) + "\n".encode("utf-8"))
3373
2666
except IOError:
3374
2667
logger.error("Could not write to file %r with PID %d",
3375
2668
pidfilename, pid)
3376
2669
del pidfile
3377
2670
del pidfilename
3378
3379
for termsig in (signal.SIGHUP, signal.SIGTERM):
3380
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3381
lambda: main_loop.quit() and False)
3382
2671
2672
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2673
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2674
3383
2675
if use_dbus:
3384
3385
@alternate_dbus_interfaces(
3386
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3387
class MandosDBusService(DBusObjectWithObjectManager):
2676
@alternate_dbus_interfaces({"se.recompile.Mandos":
2677
"se.bsnet.fukt.Mandos"})
2678
class MandosDBusService(DBusObjectWithProperties):
3388
2679
"""A D-Bus proxy object"""
3389
3390
2680
def __init__(self):
3391
2681
dbus.service.Object.__init__(self, bus, "/")
3392
3393
2682
_interface = "se.recompile.Mandos"
3394
2683
2684
@dbus_interface_annotations(_interface)
2685
def _foo(self):
2686
return { "org.freedesktop.DBus.Property"
2687
".EmitsChangedSignal":
2688
"false"}
2689
3395
2690
@dbus.service.signal(_interface, signature="o")
3396
2691
def ClientAdded(self, objpath):
3397
2692
"D-Bus signal"
3398
2693
pass
3399
2694
3400
2695
@dbus.service.signal(_interface, signature="ss")
3401
def ClientNotFound(self, key_id, address):
2696
def ClientNotFound(self, fingerprint, address):
3402
2697
"D-Bus signal"
3403
2698
pass
3404
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3406
"true"})
2699
3407
2700
@dbus.service.signal(_interface, signature="os")
3408
2701
def ClientRemoved(self, objpath, name):
3409
2702
"D-Bus signal"
3410
2703
pass
3411
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3413
"true"})
2704
3414
2705
@dbus.service.method(_interface, out_signature="ao")
3415
2706
def GetAllClients(self):
3416
2707
"D-Bus method"
3417
return dbus.Array(c.dbus_object_path for c in
3418
tcp_server.clients.values())
3419
3420
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3421
"true"})
2708
return dbus.Array(c.dbus_object_path
2709
for c in
2710
tcp_server.clients.itervalues())
2711
3422
2712
@dbus.service.method(_interface,
3423
2713
out_signature="a{oa{sv}}")
3424
2714
def GetAllClientsWithProperties(self):
3425
2715
"D-Bus method"
3426
2716
return dbus.Dictionary(
3427
{c.dbus_object_path: c.GetAll(
3428
"se.recompile.Mandos.Client")
3429
for c in tcp_server.clients.values()},
2717
((c.dbus_object_path, c.GetAll(""))
2718
for c in tcp_server.clients.itervalues()),
3430
2719
signature="oa{sv}")
3431
2720
3432
2721
@dbus.service.method(_interface, in_signature="o")
3433
2722
def RemoveClient(self, object_path):
3434
2723
"D-Bus method"
3435
for c in tcp_server.clients.values():
2724
for c in tcp_server.clients.itervalues():
3436
2725
if c.dbus_object_path == object_path:
3437
2726
del tcp_server.clients[c.name]
3438
2727
c.remove_from_connection()
3439
# Don't signal the disabling
2728
# Don't signal anything except ClientRemoved
3440
2729
c.disable(quiet=True)
3441
# Emit D-Bus signal for removal
3442
self.client_removed_signal(c)
2730
# Emit D-Bus signal
2731
self.ClientRemoved(object_path, c.name)
3443
2732
return
3444
2733
raise KeyError(object_path)
3445
2734
3446
2735
del _interface
3447
3448
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3449
out_signature="a{oa{sa{sv}}}")
3450
def GetManagedObjects(self):
3451
"""D-Bus method"""
3452
return dbus.Dictionary(
3453
{client.dbus_object_path:
3454
dbus.Dictionary(
3455
{interface: client.GetAll(interface)
3456
for interface in
3457
client._get_all_interface_names()})
3458
for client in tcp_server.clients.values()})
3459
3460
def client_added_signal(self, client):
3461
"""Send the new standard signal and the old signal"""
3462
if use_dbus:
3463
# New standard signal
3464
self.InterfacesAdded(
3465
client.dbus_object_path,
3466
dbus.Dictionary(
3467
{interface: client.GetAll(interface)
3468
for interface in
3469
client._get_all_interface_names()}))
3470
# Old signal
3471
self.ClientAdded(client.dbus_object_path)
3472
3473
def client_removed_signal(self, client):
3474
"""Send the new standard signal and the old signal"""
3475
if use_dbus:
3476
# New standard signal
3477
self.InterfacesRemoved(
3478
client.dbus_object_path,
3479
client._get_all_interface_names())
3480
# Old signal
3481
self.ClientRemoved(client.dbus_object_path,
3482
client.name)
3483
2736
3484
2737
mandos_dbus_service = MandosDBusService()
3485
3486
# Save modules to variables to exempt the modules from being
3487
# unloaded before the function registered with atexit() is run.
3488
mp = multiprocessing
3489
wn = wnull
3490
2738
3491
2739
def cleanup():
3492
2740
"Cleanup function; run on exit"
3493
if zeroconf:
3494
service.cleanup()
3495
3496
mp.active_children()
3497
wn.close()
2741
service.cleanup()
2742
2743
multiprocessing.active_children()
2744
wnull.close()
3498
2745
if not (tcp_server.clients or client_settings):
3499
2746
return
3500
2747
3501
2748
# Store client before exiting. Secrets are encrypted with key
3502
2749
# based on what config file has. If config file is
3503
2750
# removed/edited, old secret will thus be unrecovable.
3504
2751
clients = {}
3505
2752
with PGPEngine() as pgp:
3506
for client in tcp_server.clients.values():
2753
for client in tcp_server.clients.itervalues():
3507
2754
key = client_settings[client.name]["secret"]
3508
2755
client.encrypted_secret = pgp.encrypt(client.secret,
3509
2756
key)
3510
2757
client_dict = {}
3511
2758
3512
2759
# A list of attributes that can not be pickled
3513
2760
# + secret.
3514
exclude = {"bus", "changedstate", "secret",
3515
"checker", "server_settings"}
3516
for name, typ in inspect.getmembers(dbus.service
3517
.Object):
2761
exclude = set(("bus", "changedstate", "secret",
2762
"checker", "server_settings"))
2763
for name, typ in (inspect.getmembers
2764
(dbus.service.Object)):
3518
2765
exclude.add(name)
3519
2766
3520
2767
client_dict["encrypted_secret"] = (client
3521
2768
.encrypted_secret)
3522
2769
for attr in client.client_structure:
3523
2770
if attr not in exclude:
3524
2771
client_dict[attr] = getattr(client, attr)
3525
2772
3526
2773
clients[client.name] = client_dict
3527
2774
del client_settings[client.name]["secret"]
3528
2775
3529
2776
try:
3530
with tempfile.NamedTemporaryFile(
3531
mode='wb',
3532
suffix=".pickle",
3533
prefix='clients-',
3534
dir=os.path.dirname(stored_state_path),
3535
delete=False) as stored_state:
3536
pickle.dump((clients, client_settings), stored_state,
3537
protocol=2)
3538
tempname = stored_state.name
2777
with (tempfile.NamedTemporaryFile
2778
(mode='wb', suffix=".pickle", prefix='clients-',
2779
dir=os.path.dirname(stored_state_path),
2780
delete=False)) as stored_state:
2781
pickle.dump((clients, client_settings), stored_state)
2782
tempname=stored_state.name
3539
2783
os.rename(tempname, stored_state_path)
3540
2784
except (IOError, OSError) as e:
3541
2785
if not debug:
3544
2788
except NameError:
3545
2789
pass
3546
2790
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3547
logger.warning("Could not save persistent state: {}"
2791
logger.warning("Could not save persistent state: {0}"
3548
2792
.format(os.strerror(e.errno)))
3549
2793
else:
3550
2794
logger.warning("Could not save persistent state:",
3551
2795
exc_info=e)
3552
2796
raise
3553
2797
3554
2798
# Delete all clients, and settings from config
3555
2799
while tcp_server.clients:
3556
2800
name, client = tcp_server.clients.popitem()
3557
2801
if use_dbus:
3558
2802
client.remove_from_connection()
3559
# Don't signal the disabling
2803
# Don't signal anything except ClientRemoved
3560
2804
client.disable(quiet=True)
3561
# Emit D-Bus signal for removal
3562
2805
if use_dbus:
3563
mandos_dbus_service.client_removed_signal(client)
2806
# Emit D-Bus signal
2807
mandos_dbus_service.ClientRemoved(client
2808
.dbus_object_path,
2809
client.name)
3564
2810
client_settings.clear()
3565
2811
3566
2812
atexit.register(cleanup)
3567
3568
for client in tcp_server.clients.values():
2813
2814
for client in tcp_server.clients.itervalues():
3569
2815
if use_dbus:
3570
# Emit D-Bus signal for adding
3571
mandos_dbus_service.client_added_signal(client)
2816
# Emit D-Bus signal
2817
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3572
2818
# Need to initiate checking of clients
3573
2819
if client.enabled:
3574
2820
client.init_checker()
3575
2821
3576
2822
tcp_server.enable()
3577
2823
tcp_server.server_activate()
3578
2824
3579
2825
# Find out what port we got
3580
if zeroconf:
3581
service.port = tcp_server.socket.getsockname()[1]
2826
service.port = tcp_server.socket.getsockname()[1]
3582
2827
if use_ipv6:
3583
2828
logger.info("Now listening on address %r, port %d,"
3584
2829
" flowinfo %d, scope_id %d",
3586
2831
else: # IPv4
3587
2832
logger.info("Now listening on address %r, port %d",
3588
2833
*tcp_server.socket.getsockname())
3589
3590
# service.interface = tcp_server.socket.getsockname()[3]
3591
2834
2835
#service.interface = tcp_server.socket.getsockname()[3]
2836
3592
2837
try:
3593
if zeroconf:
3594
# From the Avahi example code
3595
try:
3596
service.activate()
3597
except dbus.exceptions.DBusException as error:
3598
logger.critical("D-Bus Exception", exc_info=error)
3599
cleanup()
3600
sys.exit(1)
3601
# End of Avahi example code
3602
3603
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3604
lambda *args, **kwargs:
3605
(tcp_server.handle_request
3606
(*args[2:], **kwargs) or True))
3607
2838
# From the Avahi example code
2839
try:
2840
service.activate()
2841
except dbus.exceptions.DBusException as error:
2842
logger.critical("D-Bus Exception", exc_info=error)
2843
cleanup()
2844
sys.exit(1)
2845
# End of Avahi example code
2846
2847
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2848
lambda *args, **kwargs:
2849
(tcp_server.handle_request
2850
(*args[2:], **kwargs) or True))
2851
3608
2852
logger.debug("Starting main loop")
3609
2853
main_loop.run()
3610
2854
except AvahiError as error:
3619
2863
# Must run before the D-Bus bus name gets deregistered
3620
2864
cleanup()
3621
2865
3622
3623
2866
if __name__ == '__main__':
3624
2867
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0