To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 729
- compare with another revision
- download diff
- download tarball
- view history from revision 729
- Committer: Teddy Hogeborn
- Date: 2014-08-09 13:12:55 UTC
- Revision ID: teddy@recompile.se-20140809131255-lp31j98u2pl0xpe6
mandos: Stop using str() and remove unnecessary unicode() calls.
* mandos (if_nametoindex): Use "bytes" literal instead of str().
(initlogger): Use a unicode string for log device.
(AvahiError.__unicode__): Removed.
(DBusPropertyException.__unicode__): - '' -
(ClientDBus.Secret_dbus_property): Use bytes() instead of str().
(IPv6_TCPServer.server_bind): Use .encode() instead of str().
(string_to_delta): Removed unnecessary unicode() call.
(main): Use "isinstance(x, bytes)" instead of "type(x) is str", use
.decode() instead of unicode(), and use .encode() instead of
str().
* mandos (if_nametoindex): Use "bytes" literal instead of str().
(initlogger): Use a unicode string for log device.
(AvahiError.__unicode__): Removed.
(DBusPropertyException.__unicode__): - '' -
(ClientDBus.Secret_dbus_property): Use bytes() instead of str().
(IPv6_TCPServer.server_bind): Use .encode() instead of str().
(string_to_delta): Removed unnecessary unicode() call.
(main): Use "isinstance(x, bytes)" instead of "type(x) is str", use
.decode() instead of unicode(), and use .encode() instead of
str().
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
import sys
43
import unittest
39
import SocketServer as socketserver
40
import socket
44
41
import argparse
45
import logging
46
import os
47
try:
48
import SocketServer as socketserver
49
except ImportError:
50
import socketserver
51
import socket
52
42
import datetime
53
43
import errno
54
try:
55
import ConfigParser as configparser
56
except ImportError:
57
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
import sys
58
52
import re
53
import os
59
54
import signal
60
55
import subprocess
61
56
import atexit
62
57
import stat
58
import logging
63
59
import logging.handlers
64
60
import pwd
65
61
import contextlib
66
62
import struct
67
63
import fcntl
68
64
import functools
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
65
import cPickle as pickle
73
66
import multiprocessing
74
67
import types
75
68
import binascii
76
69
import tempfile
77
70
import itertools
78
71
import collections
79
import codecs
80
import random
81
import shlex
82
72
83
73
import dbus
84
74
import dbus.service
85
import gi
86
from gi.repository import GLib
75
import gobject
76
import avahi
87
77
from dbus.mainloop.glib import DBusGMainLoop
88
78
import ctypes
89
79
import ctypes.util
90
80
import xml.dom.minidom
91
81
import inspect
92
82
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
83
try:
122
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
85
except AttributeError:
124
86
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
127
87
from IN import SO_BINDTODEVICE
128
88
except ImportError:
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.16"
89
SO_BINDTODEVICE = None
90
91
version = "1.6.8"
147
92
stored_state_file = "clients.pickle"
148
93
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
94
logger = logging.getLogger()
151
95
syslogger = None
152
96
153
97
try:
154
if_nametoindex = ctypes.cdll.LoadLibrary(
155
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
156
101
except (OSError, AttributeError):
157
158
102
def if_nametoindex(interface):
159
103
"Get an interface index the hard way, i.e. using fcntl()"
160
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
165
109
return interface_index
166
110
167
111
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
184
112
def initlogger(debug, level=logging.WARNING):
185
113
"""init logger and add loglevel"""
186
114
187
115
global syslogger
188
syslogger = (logging.handlers.SysLogHandler(
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
116
syslogger = (logging.handlers.SysLogHandler
117
(facility =
118
logging.handlers.SysLogHandler.LOG_DAEMON,
119
address = "/dev/log"))
191
120
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
195
121
('Mandos [%(process)d]: %(levelname)s:'
122
' %(message)s'))
123
logger.addHandler(syslogger)
124
196
125
if debug:
197
126
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
128
' [%(process)d]:'
129
' %(levelname)s:'
130
' %(message)s'))
131
logger.addHandler(console)
132
logger.setLevel(level)
204
133
205
134
206
135
class PGPError(Exception):
208
137
pass
209
138
210
139
211
class PGPEngine:
140
class PGPEngine(object):
212
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
214
142
def __init__(self):
215
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
216
self.gpg = "gpg"
217
try:
218
output = subprocess.check_output(["gpgconf"])
219
for line in output.splitlines():
220
name, text, path = line.split(b":")
221
if name == b"gpg":
222
self.gpg = path
223
break
224
except OSError as e:
225
if e.errno != errno.ENOENT:
226
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
144
self.gnupgargs = ['--batch',
145
'--home', self.tempdir,
146
'--force-mdc',
147
'--quiet',
148
'--no-use-agent']
149
235
150
def __enter__(self):
236
151
return self
237
152
238
153
def __exit__(self, exc_type, exc_value, traceback):
239
154
self._cleanup()
240
155
return False
241
156
242
157
def __del__(self):
243
158
self._cleanup()
244
159
245
160
def _cleanup(self):
246
161
if self.tempdir is not None:
247
162
# Delete contents of tempdir
248
163
for root, dirs, files in os.walk(self.tempdir,
249
topdown=False):
164
topdown = False):
250
165
for filename in files:
251
166
os.remove(os.path.join(root, filename))
252
167
for dirname in dirs:
254
169
# Remove tempdir
255
170
os.rmdir(self.tempdir)
256
171
self.tempdir = None
257
172
258
173
def password_encode(self, password):
259
174
# Passphrase can not be empty and can not contain newlines or
260
175
# NUL bytes. So we prefix it and hex encode it.
265
180
.replace(b"\n", b"\\n")
266
181
.replace(b"\0", b"\\x00"))
267
182
return encoded
268
183
269
184
def encrypt(self, data, password):
270
185
passphrase = self.password_encode(password)
271
with tempfile.NamedTemporaryFile(
272
dir=self.tempdir) as passfile:
186
with tempfile.NamedTemporaryFile(dir=self.tempdir
187
) as passfile:
273
188
passfile.write(passphrase)
274
189
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
190
proc = subprocess.Popen(['gpg', '--symmetric',
191
'--passphrase-file',
277
192
passfile.name]
278
193
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
194
stdin = subprocess.PIPE,
195
stdout = subprocess.PIPE,
196
stderr = subprocess.PIPE)
197
ciphertext, err = proc.communicate(input = data)
283
198
if proc.returncode != 0:
284
199
raise PGPError(err)
285
200
return ciphertext
286
201
287
202
def decrypt(self, data, password):
288
203
passphrase = self.password_encode(password)
289
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
204
with tempfile.NamedTemporaryFile(dir = self.tempdir
205
) as passfile:
291
206
passfile.write(passphrase)
292
207
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
208
proc = subprocess.Popen(['gpg', '--decrypt',
209
'--passphrase-file',
295
210
passfile.name]
296
211
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
212
stdin = subprocess.PIPE,
213
stdout = subprocess.PIPE,
214
stderr = subprocess.PIPE)
215
decrypted_plaintext, err = proc.communicate(input
216
= data)
301
217
if proc.returncode != 0:
302
218
raise PGPError(err)
303
219
return decrypted_plaintext
304
220
305
221
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
332
222
class AvahiError(Exception):
333
223
def __init__(self, value, *args, **kwargs):
334
224
self.value = value
335
225
return super(AvahiError, self).__init__(value, *args,
336
226
**kwargs)
337
227
338
339
228
class AvahiServiceError(AvahiError):
340
229
pass
341
230
342
343
231
class AvahiGroupError(AvahiError):
344
232
pass
345
233
346
234
347
class AvahiService:
235
class AvahiService(object):
348
236
"""An Avahi (Zeroconf) service.
349
237
350
238
Attributes:
351
239
interface: integer; avahi.IF_UNSPEC or an interface index.
352
240
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
241
name: string; Example: 'Mandos'
242
type: string; Example: '_mandos._tcp'.
355
243
See <https://www.iana.org/assignments/service-names-port-numbers>
356
244
port: integer; what port to announce
357
245
TXT: list of strings; TXT record for the service
364
252
server: D-Bus Server
365
253
bus: dbus.SystemBus()
366
254
"""
367
368
def __init__(self,
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
255
256
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
257
servicetype = None, port = None, TXT = None,
258
domain = "", host = "", max_renames = 32768,
259
protocol = avahi.PROTO_UNSPEC, bus = None):
379
260
self.interface = interface
380
261
self.name = name
381
262
self.type = servicetype
390
271
self.server = None
391
272
self.bus = bus
392
273
self.entry_group_state_changed_match = None
393
394
def rename(self, remove=True):
274
275
def rename(self):
395
276
"""Derived from the Avahi example code"""
396
277
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
278
logger.critical("No suitable Zeroconf service name found"
279
" after %i retries, exiting.",
280
self.rename_count)
400
281
raise AvahiServiceError("Too many renames")
401
self.name = str(
402
self.server.GetAlternativeServiceName(self.name))
282
self.name = unicode(self.server
283
.GetAlternativeServiceName(self.name))
284
logger.info("Changing Zeroconf service name to %r ...",
285
self.name)
286
self.remove()
287
try:
288
self.add()
289
except dbus.exceptions.DBusException as error:
290
logger.critical("D-Bus Exception", exc_info=error)
291
self.cleanup()
292
os._exit(1)
403
293
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
406
if remove:
407
self.remove()
408
try:
409
self.add()
410
except dbus.exceptions.DBusException as error:
411
if (error.get_dbus_name()
412
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
414
return self.rename(remove=False)
415
else:
416
log.critical("D-Bus Exception", exc_info=error)
417
self.cleanup()
418
os._exit(1)
419
294
420
295
def remove(self):
421
296
"""Derived from the Avahi example code"""
422
297
if self.entry_group_state_changed_match is not None:
424
299
self.entry_group_state_changed_match = None
425
300
if self.group is not None:
426
301
self.group.Reset()
427
302
428
303
def add(self):
429
304
"""Derived from the Avahi example code"""
430
305
self.remove()
435
310
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
311
self.entry_group_state_changed_match = (
437
312
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
313
'StateChanged', self.entry_group_state_changed))
314
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
315
self.name, self.type)
441
316
self.group.AddService(
442
317
self.interface,
443
318
self.protocol,
447
322
dbus.UInt16(self.port),
448
323
avahi.string_array_to_txt_array(self.TXT))
449
324
self.group.Commit()
450
325
451
326
def entry_group_state_changed(self, state, error):
452
327
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
454
328
logger.debug("Avahi entry group state change: %i", state)
329
455
330
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
331
logger.debug("Zeroconf service established.")
457
332
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
333
logger.info("Zeroconf service name collision.")
459
334
self.rename()
460
335
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
463
raise AvahiGroupError("State changed: {!s}".format(error))
464
336
logger.critical("Avahi: Error in group state changed %s",
337
unicode(error))
338
raise AvahiGroupError("State changed: {!s}"
339
.format(error))
340
465
341
def cleanup(self):
466
342
"""Derived from the Avahi example code"""
467
343
if self.group is not None:
472
348
pass
473
349
self.group = None
474
350
self.remove()
475
351
476
352
def server_state_changed(self, state, error=None):
477
353
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
479
bad_states = {
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
avahi.SERVER_REGISTERING: None,
482
avahi.SERVER_COLLISION: "Zeroconf server name collision",
483
avahi.SERVER_FAILURE: "Zeroconf server failure",
484
}
354
logger.debug("Avahi server state change: %i", state)
355
bad_states = { avahi.SERVER_INVALID:
356
"Zeroconf server invalid",
357
avahi.SERVER_REGISTERING: None,
358
avahi.SERVER_COLLISION:
359
"Zeroconf server name collision",
360
avahi.SERVER_FAILURE:
361
"Zeroconf server failure" }
485
362
if state in bad_states:
486
363
if bad_states[state] is not None:
487
364
if error is None:
488
log.error(bad_states[state])
365
logger.error(bad_states[state])
489
366
else:
490
log.error(bad_states[state] + ": %r", error)
367
logger.error(bad_states[state] + ": %r", error)
491
368
self.cleanup()
492
369
elif state == avahi.SERVER_RUNNING:
493
try:
494
self.add()
495
except dbus.exceptions.DBusException as error:
496
if (error.get_dbus_name()
497
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
499
return self.rename(remove=False)
500
else:
501
log.critical("D-Bus Exception", exc_info=error)
502
self.cleanup()
503
os._exit(1)
370
self.add()
504
371
else:
505
372
if error is None:
506
log.debug("Unknown state: %r", state)
373
logger.debug("Unknown state: %r", state)
507
374
else:
508
log.debug("Unknown state: %r: %r", state, error)
509
375
logger.debug("Unknown state: %r: %r", state, error)
376
510
377
def activate(self):
511
378
"""Derived from the Avahi example code"""
512
379
if self.server is None:
516
383
follow_name_owner_changes=True),
517
384
avahi.DBUS_INTERFACE_SERVER)
518
385
self.server.connect_to_signal("StateChanged",
519
self.server_state_changed)
386
self.server_state_changed)
520
387
self.server_state_changed(self.server.GetState())
521
388
522
389
523
390
class AvahiServiceToSyslog(AvahiService):
524
def rename(self, *args, **kwargs):
391
def rename(self):
525
392
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
528
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
530
.format(self.name)))
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
397
.format(self.name)))
531
398
return ret
532
399
533
400
534
# Pretend that we have a GnuTLS module
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
537
538
library = ctypes.util.find_library("gnutls")
539
if library is None:
540
library = ctypes.util.find_library("gnutls-deb0")
541
_library = ctypes.cdll.LoadLibrary(library)
542
del library
543
544
# Unless otherwise indicated, the constants and types below are
545
# all from the gnutls/gnutls.h C header file.
546
547
# Constants
548
E_SUCCESS = 0
549
E_INTERRUPTED = -52
550
E_AGAIN = -28
551
CRT_OPENPGP = 2
552
CRT_RAWPK = 3
553
CLIENT = 2
554
SHUT_RDWR = 0
555
CRD_CERTIFICATE = 1
556
E_NO_CERTIFICATE_FOUND = -49
557
X509_FMT_DER = 0
558
NO_TICKETS = 1<<10
559
ENABLE_RAWPK = 1<<18
560
CTYPE_PEERS = 3
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
564
# Types
565
class _session_int(ctypes.Structure):
566
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
568
569
class certificate_credentials_st(ctypes.Structure):
570
_fields_ = []
571
certificate_credentials_t = ctypes.POINTER(
572
certificate_credentials_st)
573
certificate_type_t = ctypes.c_int
574
575
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
578
579
class _openpgp_crt_int(ctypes.Structure):
580
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
credentials_type_t = ctypes.c_int
585
transport_ptr_t = ctypes.c_void_p
586
close_request_t = ctypes.c_int
587
588
# Exceptions
589
class Error(Exception):
590
def __init__(self, message=None, code=None, args=()):
591
# Default usage is by a message string, but if a return
592
# code is passed, convert it to a string with
593
# gnutls.strerror()
594
self.code = code
595
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
599
message, *args)
600
601
class CertificateSecurityError(Error):
602
pass
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
# Classes
630
class Credentials(With_from_param):
631
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
634
self.type = gnutls.CRD_CERTIFICATE
635
636
def __del__(self):
637
gnutls.certificate_free_credentials(self)
638
639
class ClientSession(With_from_param):
640
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
645
if gnutls.has_rawpk:
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
648
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
652
self.socket = socket
653
if credentials is None:
654
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
657
self.credentials = credentials
658
659
def __del__(self):
660
gnutls.deinit(self)
661
662
def handshake(self):
663
return gnutls.handshake(self)
664
665
def send(self, data):
666
data = bytes(data)
667
data_len = len(data)
668
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
670
data_len)
671
672
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
674
675
# Error handling functions
676
def _error_code(result):
677
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
680
return result
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
raise gnutls.CertificateSecurityError(code=result)
683
raise gnutls.Error(code=result)
684
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
687
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
return _error_code(result)
692
result = func(*arguments)
693
return result
694
695
# Unless otherwise indicated, the function declarations below are
696
# all from the gnutls/gnutls.h C header file.
697
698
# Functions
699
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
701
ctypes.POINTER(ctypes.c_char_p)]
702
priority_set_direct.restype = _error_code
703
704
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
706
init.restype = _error_code
707
708
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
710
set_default_priority.restype = _error_code
711
712
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
714
ctypes.c_size_t]
715
record_send.restype = ctypes.c_ssize_t
716
record_send.errcheck = _retry_on_error
717
718
certificate_allocate_credentials = (
719
_library.gnutls_certificate_allocate_credentials)
720
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
722
certificate_allocate_credentials.restype = _error_code
723
724
certificate_free_credentials = (
725
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
727
certificate_free_credentials.restype = None
728
729
handshake_set_private_extensions = (
730
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
732
ctypes.c_int]
733
handshake_set_private_extensions.restype = None
734
735
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
738
credentials_set.restype = _error_code
739
740
strerror = _library.gnutls_strerror
741
strerror.argtypes = [ctypes.c_int]
742
strerror.restype = ctypes.c_char_p
743
744
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
746
certificate_type_get.restype = _error_code
747
748
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
750
ctypes.POINTER(ctypes.c_uint)]
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
753
global_set_log_level = _library.gnutls_global_set_log_level
754
global_set_log_level.argtypes = [ctypes.c_int]
755
global_set_log_level.restype = None
756
757
global_set_log_function = _library.gnutls_global_set_log_function
758
global_set_log_function.argtypes = [log_func]
759
global_set_log_function.restype = None
760
761
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
763
deinit.restype = None
764
765
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
768
handshake.errcheck = _retry_on_error
769
770
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
772
transport_set_ptr.restype = None
773
774
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
777
bye.errcheck = _retry_on_error
778
779
check_version = _library.gnutls_check_version
780
check_version.argtypes = [ctypes.c_char_p]
781
check_version.restype = ctypes.c_char_p
782
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
787
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
790
791
if has_rawpk:
792
# Types
793
class pubkey_st(ctypes.Structure):
794
_fields = []
795
pubkey_t = ctypes.POINTER(pubkey_st)
796
797
x509_crt_fmt_t = ctypes.c_int
798
799
# All the function declarations below are from
800
# gnutls/abstract.h
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
804
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
807
x509_crt_fmt_t]
808
pubkey_import.restype = _error_code
809
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
815
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
819
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
822
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
826
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
830
openpgp_crt_fmt_t]
831
openpgp_crt_import.restype = _error_code
832
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
840
openpgp_crt_verify_self.restype = _error_code
841
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
845
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
849
ctypes.c_void_p,
850
ctypes.POINTER(
851
ctypes.c_size_t)]
852
openpgp_crt_get_fingerprint.restype = _error_code
853
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
858
859
# Remove non-public functions
860
del _error_code, _retry_on_error
861
862
863
def call_pipe(connection, # : multiprocessing.Connection
864
func, *args, **kwargs):
865
"""This function is meant to be called by multiprocessing.Process
866
867
This function runs func(*args, **kwargs), and writes the resulting
868
return value on the provided multiprocessing.Connection.
869
"""
870
connection.send(func(*args, **kwargs))
871
connection.close()
872
873
874
class Client:
401
class Client(object):
875
402
"""A representation of a client host served by this server.
876
403
877
404
Attributes:
878
approved: bool(); None if not yet approved/disapproved
405
approved: bool(); 'None' if not yet approved/disapproved
879
406
approval_delay: datetime.timedelta(); Time to wait for approval
880
407
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
884
checker_callback_tag: a GLib event source tag, or None
408
checker: subprocess.Popen(); a running checker process used
409
to see if the client lives.
410
'None' if no process is running.
411
checker_callback_tag: a gobject event source tag, or None
885
412
checker_command: string; External command which is run to check
886
413
if client lives. %() expansions are done at
887
414
runtime with vars(self) as dict, so that for
888
415
instance %(name)s can be used in the command.
889
checker_initiator_tag: a GLib event source tag, or None
416
checker_initiator_tag: a gobject event source tag, or None
890
417
created: datetime.datetime(); (UTC) object creation
891
418
client_structure: Object describing what attributes a client has
892
419
and is used for storing the client at exit
893
420
current_checker_command: string; current running checker_command
894
disable_initiator_tag: a GLib event source tag, or None
421
disable_initiator_tag: a gobject event source tag, or None
895
422
enabled: bool()
896
423
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
424
uniquely identify the client
900
425
host: string; available for use by the checker command
901
426
interval: datetime.timedelta(); How often to start a new checker
902
427
last_approval_request: datetime.datetime(); (UTC) or None
904
429
last_checker_status: integer between 0 and 255 reflecting exit
905
430
status of last checker. -1 reflects crashed
906
431
checker, -2 means no checker completed yet.
907
last_checker_signal: The signal which killed the last checker, if
908
last_checker_status is -1
909
432
last_enabled: datetime.datetime(); (UTC) or None
910
433
name: string; from the config file, used in log messages and
911
434
D-Bus identifiers
918
441
disabled, or None
919
442
server_settings: The server_settings dict from main()
920
443
"""
921
444
922
445
runtime_expansions = ("approval_delay", "approval_duration",
923
"created", "enabled", "expires", "key_id",
446
"created", "enabled", "expires",
924
447
"fingerprint", "host", "interval",
925
448
"last_approval_request", "last_checked_ok",
926
449
"last_enabled", "name", "timeout")
927
client_defaults = {
928
"timeout": "PT5M",
929
"extended_timeout": "PT15M",
930
"interval": "PT2M",
931
"checker": "fping -q -- %%(host)s",
932
"host": "",
933
"approval_delay": "PT0S",
934
"approval_duration": "PT1S",
935
"approved_by_default": "True",
936
"enabled": "True",
937
}
938
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
460
939
461
@staticmethod
940
462
def config_parser(config):
941
463
"""Construct a new dict of client settings of this form:
948
470
for client_name in config.sections():
949
471
section = dict(config.items(client_name))
950
472
client = settings[client_name] = {}
951
473
952
474
client["host"] = section["host"]
953
475
# Reformat values from string types to Python types
954
476
client["approved_by_default"] = config.getboolean(
955
477
client_name, "approved_by_default")
956
478
client["enabled"] = config.getboolean(client_name,
957
479
"enabled")
958
959
# Uppercase and remove spaces from key_id and fingerprint
960
# for later comparison purposes with return value from the
961
# key_id() and fingerprint() functions
962
client["key_id"] = (section.get("key_id", "").upper()
963
.replace(" ", ""))
480
964
481
client["fingerprint"] = (section["fingerprint"].upper()
965
482
.replace(" ", ""))
966
483
if "secret" in section:
967
client["secret"] = codecs.decode(section["secret"]
968
.encode("utf-8"),
969
"base64")
484
client["secret"] = section["secret"].decode("base64")
970
485
elif "secfile" in section:
971
486
with open(os.path.expanduser(os.path.expandvars
972
487
(section["secfile"])),
987
502
client["last_approval_request"] = None
988
503
client["last_checked_ok"] = None
989
504
client["last_checker_status"] = -2
990
505
991
506
return settings
992
993
def __init__(self, settings, name=None, server_settings=None):
507
508
def __init__(self, settings, name = None, server_settings=None):
994
509
self.name = name
995
510
if server_settings is None:
996
511
server_settings = {}
998
513
# adding all client settings
999
514
for setting, value in settings.items():
1000
515
setattr(self, setting, value)
1001
516
1002
517
if self.enabled:
1003
518
if not hasattr(self, "last_enabled"):
1004
519
self.last_enabled = datetime.datetime.utcnow()
1008
523
else:
1009
524
self.last_enabled = None
1010
525
self.expires = None
1011
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
526
527
logger.debug("Creating client %r", self.name)
528
# Uppercase and remove spaces from fingerprint for later
529
# comparison purposes with return value from the fingerprint()
530
# function
531
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
532
self.created = settings.get("created",
1016
533
datetime.datetime.utcnow())
1017
534
1018
535
# attributes specific for this server instance
1019
536
self.checker = None
1020
537
self.checker_initiator_tag = None
1023
540
self.current_checker_command = None
1024
541
self.approved = None
1025
542
self.approvals_pending = 0
1026
self.changedstate = multiprocessing_manager.Condition(
1027
multiprocessing_manager.Lock())
1028
self.client_structure = [attr
1029
for attr in self.__dict__.keys()
543
self.changedstate = (multiprocessing_manager
544
.Condition(multiprocessing_manager
545
.Lock()))
546
self.client_structure = [attr for attr in
547
self.__dict__.iterkeys()
1030
548
if not attr.startswith("_")]
1031
549
self.client_structure.append("client_structure")
1032
1033
for name, t in inspect.getmembers(
1034
type(self), lambda obj: isinstance(obj, property)):
550
551
for name, t in inspect.getmembers(type(self),
552
lambda obj:
553
isinstance(obj,
554
property)):
1035
555
if not name.startswith("_"):
1036
556
self.client_structure.append(name)
1037
557
1038
558
# Send notice to process children that client state has changed
1039
559
def send_changedstate(self):
1040
560
with self.changedstate:
1041
561
self.changedstate.notify_all()
1042
562
1043
563
def enable(self):
1044
564
"""Start this client's checker and timeout hooks"""
1045
565
if getattr(self, "enabled", False):
1046
566
# Already enabled
1047
567
return
568
self.expires = datetime.datetime.utcnow() + self.timeout
1048
569
self.enabled = True
1049
570
self.last_enabled = datetime.datetime.utcnow()
1050
571
self.init_checker()
1051
572
self.send_changedstate()
1052
573
1053
574
def disable(self, quiet=True):
1054
575
"""Disable this client."""
1055
576
if not getattr(self, "enabled", False):
1056
577
return False
1057
578
if not quiet:
1058
log.info("Disabling client %s", self.name)
579
logger.info("Disabling client %s", self.name)
1059
580
if getattr(self, "disable_initiator_tag", None) is not None:
1060
GLib.source_remove(self.disable_initiator_tag)
581
gobject.source_remove(self.disable_initiator_tag)
1061
582
self.disable_initiator_tag = None
1062
583
self.expires = None
1063
584
if getattr(self, "checker_initiator_tag", None) is not None:
1064
GLib.source_remove(self.checker_initiator_tag)
585
gobject.source_remove(self.checker_initiator_tag)
1065
586
self.checker_initiator_tag = None
1066
587
self.stop_checker()
1067
588
self.enabled = False
1068
589
if not quiet:
1069
590
self.send_changedstate()
1070
# Do not run this again if called by a GLib.timeout_add
591
# Do not run this again if called by a gobject.timeout_add
1071
592
return False
1072
593
1073
594
def __del__(self):
1074
595
self.disable()
1075
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
596
597
def init_checker(self):
598
# Schedule a new checker to be started an 'interval' from now,
599
# and every interval from then on.
1081
600
if self.checker_initiator_tag is not None:
1082
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
601
gobject.source_remove(self.checker_initiator_tag)
602
self.checker_initiator_tag = (gobject.timeout_add
603
(int(self.interval
604
.total_seconds() * 1000),
605
self.start_checker))
606
# Schedule a disable() when 'timeout' has passed
1100
607
if self.disable_initiator_tag is not None:
1101
GLib.source_remove(self.disable_initiator_tag)
1102
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1105
1106
def checker_callback(self, source, condition, connection,
1107
command):
608
gobject.source_remove(self.disable_initiator_tag)
609
self.disable_initiator_tag = (gobject.timeout_add
610
(int(self.timeout
611
.total_seconds() * 1000),
612
self.disable))
613
# Also start a new checker *right now*.
614
self.start_checker()
615
616
def checker_callback(self, pid, condition, command):
1108
617
"""The checker has completed, so take appropriate actions."""
1109
# Read return code from connection (see call_pipe)
1110
returncode = connection.recv()
1111
connection.close()
1112
if self.checker is not None:
1113
self.checker.join()
1114
618
self.checker_callback_tag = None
1115
619
self.checker = None
1116
1117
if returncode >= 0:
1118
self.last_checker_status = returncode
1119
self.last_checker_signal = None
620
if os.WIFEXITED(condition):
621
self.last_checker_status = os.WEXITSTATUS(condition)
1120
622
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
623
logger.info("Checker for %(name)s succeeded",
624
vars(self))
1122
625
self.checked_ok()
1123
626
else:
1124
log.info("Checker for %(name)s failed", vars(self))
627
logger.info("Checker for %(name)s failed",
628
vars(self))
1125
629
else:
1126
630
self.last_checker_status = -1
1127
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1129
return False
1130
631
logger.warning("Checker for %(name)s crashed?",
632
vars(self))
633
1131
634
def checked_ok(self):
1132
635
"""Assert that the client has been seen, alive and well."""
1133
636
self.last_checked_ok = datetime.datetime.utcnow()
1134
637
self.last_checker_status = 0
1135
self.last_checker_signal = None
1136
638
self.bump_timeout()
1137
639
1138
640
def bump_timeout(self, timeout=None):
1139
641
"""Bump up the timeout for this client."""
1140
642
if timeout is None:
1141
643
timeout = self.timeout
1142
644
if self.disable_initiator_tag is not None:
1143
GLib.source_remove(self.disable_initiator_tag)
645
gobject.source_remove(self.disable_initiator_tag)
1144
646
self.disable_initiator_tag = None
1145
647
if getattr(self, "enabled", False):
1146
self.disable_initiator_tag = GLib.timeout_add(
1147
int(timeout.total_seconds() * 1000), self.disable)
648
self.disable_initiator_tag = (gobject.timeout_add
649
(int(timeout.total_seconds()
650
* 1000), self.disable))
1148
651
self.expires = datetime.datetime.utcnow() + timeout
1149
652
1150
653
def need_approval(self):
1151
654
self.last_approval_request = datetime.datetime.utcnow()
1152
1153
def start_checker(self, start_was_randomized=False):
655
656
def start_checker(self):
1154
657
"""Start a new checker subprocess if one is not running.
1155
658
1156
659
If a checker already exists, leave it running and do
1157
660
nothing."""
1158
661
# The reason for not killing a running checker is that if we
1163
666
# checkers alone, the checker would have to take more time
1164
667
# than 'timeout' for the client to be disabled, which is as it
1165
668
# should be.
1166
1167
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1169
self.checker.join()
1170
self.checker = None
669
670
# If a checker exists, make sure it is not a zombie
671
try:
672
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
673
except AttributeError:
674
pass
675
except OSError as error:
676
if error.errno != errno.ECHILD:
677
raise
678
else:
679
if pid:
680
logger.warning("Checker was a zombie")
681
gobject.source_remove(self.checker_callback_tag)
682
self.checker_callback(pid, status,
683
self.current_checker_command)
1171
684
# Start a new checker if needed
1172
685
if self.checker is None:
1173
686
# Escape attributes for the shell
1174
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1176
for attr in self.runtime_expansions}
687
escaped_attrs = { attr:
688
re.escape(unicode(getattr(self,
689
attr)))
690
for attr in self.runtime_expansions }
1177
691
try:
1178
692
command = self.checker_command % escaped_attrs
1179
693
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1182
return True # Try again later
694
logger.error('Could not format string "%s"',
695
self.checker_command, exc_info=error)
696
return True # Try again later
1183
697
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1185
# We don't need to redirect stdout and stderr, since
1186
# in normal mode, that is already done by daemon(),
1187
# and in debug mode we don't want to. (Stdin is
1188
# always replaced by /dev/null.)
1189
# The exception is when not debugging but nevertheless
1190
# running in the foreground; use the previously
1191
# created wnull.
1192
popen_args = {"close_fds": True,
1193
"shell": True,
1194
"cwd": "/"}
1195
if (not self.server_settings["debug"]
1196
and self.server_settings["foreground"]):
1197
popen_args.update({"stdout": wnull,
1198
"stderr": wnull})
1199
pipe = multiprocessing.Pipe(duplex=False)
1200
self.checker = multiprocessing.Process(
1201
target=call_pipe,
1202
args=(pipe[1], subprocess.call, command),
1203
kwargs=popen_args)
1204
self.checker.start()
1205
self.checker_callback_tag = GLib.io_add_watch(
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1208
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
# Re-run this periodically if run by GLib.timeout_add
698
try:
699
logger.info("Starting checker %r for %s",
700
command, self.name)
701
# We don't need to redirect stdout and stderr, since
702
# in normal mode, that is already done by daemon(),
703
# and in debug mode we don't want to. (Stdin is
704
# always replaced by /dev/null.)
705
# The exception is when not debugging but nevertheless
706
# running in the foreground; use the previously
707
# created wnull.
708
popen_args = {}
709
if (not self.server_settings["debug"]
710
and self.server_settings["foreground"]):
711
popen_args.update({"stdout": wnull,
712
"stderr": wnull })
713
self.checker = subprocess.Popen(command,
714
close_fds=True,
715
shell=True, cwd="/",
716
**popen_args)
717
except OSError as error:
718
logger.error("Failed to start subprocess",
719
exc_info=error)
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
728
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
729
except OSError as error:
730
if error.errno == errno.ECHILD:
731
# This should never happen
732
logger.error("Child process vanished",
733
exc_info=error)
734
return True
735
raise
736
if pid:
737
gobject.source_remove(self.checker_callback_tag)
738
self.checker_callback(pid, status, command)
739
# Re-run this periodically if run by gobject.timeout_add
1221
740
return True
1222
741
1223
742
def stop_checker(self):
1224
743
"""Force the checker process, if any, to stop."""
1225
744
if self.checker_callback_tag:
1226
GLib.source_remove(self.checker_callback_tag)
745
gobject.source_remove(self.checker_callback_tag)
1227
746
self.checker_callback_tag = None
1228
747
if getattr(self, "checker", None) is None:
1229
748
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1231
self.checker.terminate()
749
logger.debug("Stopping checker for %(name)s", vars(self))
750
try:
751
self.checker.terminate()
752
#time.sleep(0.5)
753
#if self.checker.poll() is None:
754
# self.checker.kill()
755
except OSError as error:
756
if error.errno != errno.ESRCH: # No such process
757
raise
1232
758
self.checker = None
1233
759
1234
760
1235
def dbus_service_property(dbus_interface,
1236
signature="v",
1237
access="readwrite",
1238
byte_arrays=False):
761
def dbus_service_property(dbus_interface, signature="v",
762
access="readwrite", byte_arrays=False):
1239
763
"""Decorators for marking methods of a DBusObjectWithProperties to
1240
764
become properties on the D-Bus.
1241
765
1242
766
The decorated method will be called with no arguments by "Get"
1243
767
and with one argument by "Set".
1244
768
1245
769
The parameters, where they are supported, are the same as
1246
770
dbus.service.method, except there is only "signature", since the
1247
771
type from Get() and the type sent to Set() is the same.
1251
775
if byte_arrays and signature != "ay":
1252
776
raise ValueError("Byte arrays not supported for non-'ay'"
1253
777
" signature {!r}".format(signature))
1254
1255
778
def decorator(func):
1256
779
func._dbus_is_property = True
1257
780
func._dbus_interface = dbus_interface
1260
783
func._dbus_name = func.__name__
1261
784
if func._dbus_name.endswith("_dbus_property"):
1262
785
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
786
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1264
787
return func
1265
1266
788
return decorator
1267
789
1268
790
1269
791
def dbus_interface_annotations(dbus_interface):
1270
792
"""Decorator for marking functions returning interface annotations
1271
793
1272
794
Usage:
1273
795
1274
796
@dbus_interface_annotations("org.example.Interface")
1275
797
def _foo(self): # Function name does not matter
1276
798
return {"org.freedesktop.DBus.Deprecated": "true",
1277
799
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1278
800
"false"}
1279
801
"""
1280
1281
802
def decorator(func):
1282
803
func._dbus_is_interface = True
1283
804
func._dbus_interface = dbus_interface
1284
805
func._dbus_name = dbus_interface
1285
806
return func
1286
1287
807
return decorator
1288
808
1289
809
1290
810
def dbus_annotations(annotations):
1291
811
"""Decorator to annotate D-Bus methods, signals or properties
1292
812
Usage:
1293
1294
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1295
"org.freedesktop.DBus.Property."
1296
"EmitsChangedSignal": "false"})
813
1297
814
@dbus_service_property("org.example.Interface", signature="b",
1298
815
access="r")
816
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
"org.freedesktop.DBus.Property."
818
"EmitsChangedSignal": "false"})
1299
819
def Property_dbus_property(self):
1300
820
return dbus.Boolean(False)
1301
1302
See also the DBusObjectWithAnnotations class.
1303
821
"""
1304
1305
822
def decorator(func):
1306
823
func._dbus_annotations = annotations
1307
824
return func
1308
1309
825
return decorator
1310
826
1311
827
1314
830
"""
1315
831
pass
1316
832
1317
1318
833
class DBusPropertyAccessException(DBusPropertyException):
1319
834
"""A property's access permissions disallows an operation.
1320
835
"""
1327
842
pass
1328
843
1329
844
1330
class DBusObjectWithAnnotations(dbus.service.Object):
1331
"""A D-Bus object with annotations.
1332
1333
Classes inheriting from this can use the dbus_annotations
1334
decorator to add annotations to methods or signals.
845
class DBusObjectWithProperties(dbus.service.Object):
846
"""A D-Bus object with properties.
847
848
Classes inheriting from this can use the dbus_service_property
849
decorator to expose methods as D-Bus properties. It exposes the
850
standard Get(), Set(), and GetAll() methods on the D-Bus.
1335
851
"""
1336
852
1337
853
@staticmethod
1338
854
def _is_dbus_thing(thing):
1339
855
"""Returns a function testing if an attribute is a D-Bus thing
1340
856
1341
857
If called like _is_dbus_thing("method") it returns a function
1342
858
suitable for use as predicate to inspect.getmembers().
1343
859
"""
1344
860
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1345
861
False)
1346
862
1347
863
def _get_all_dbus_things(self, thing):
1348
864
"""Returns a generator of (name, attribute) pairs
1349
865
"""
1350
return ((getattr(athing.__get__(self), "_dbus_name", name),
866
return ((getattr(athing.__get__(self), "_dbus_name",
867
name),
1351
868
athing.__get__(self))
1352
869
for cls in self.__class__.__mro__
1353
870
for name, athing in
1354
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1355
1356
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1360
def Introspect(self, object_path, connection):
1361
"""Overloading of standard D-Bus method.
1362
1363
Inserts annotation tags on methods and signals.
1364
"""
1365
xmlstring = dbus.service.Object.Introspect(self, object_path,
1366
connection)
1367
try:
1368
document = xml.dom.minidom.parseString(xmlstring)
1369
1370
for if_tag in document.getElementsByTagName("interface"):
1371
# Add annotation tags
1372
for typ in ("method", "signal"):
1373
for tag in if_tag.getElementsByTagName(typ):
1374
annots = dict()
1375
for name, prop in (self.
1376
_get_all_dbus_things(typ)):
1377
if (name == tag.getAttribute("name")
1378
and prop._dbus_interface
1379
== if_tag.getAttribute("name")):
1380
annots.update(getattr(
1381
prop, "_dbus_annotations", {}))
1382
for name, value in annots.items():
1383
ann_tag = document.createElement(
1384
"annotation")
1385
ann_tag.setAttribute("name", name)
1386
ann_tag.setAttribute("value", value)
1387
tag.appendChild(ann_tag)
1388
# Add interface annotation tags
1389
for annotation, value in dict(
1390
itertools.chain.from_iterable(
1391
annotations().items()
1392
for name, annotations
1393
in self._get_all_dbus_things("interface")
1394
if name == if_tag.getAttribute("name")
1395
)).items():
1396
ann_tag = document.createElement("annotation")
1397
ann_tag.setAttribute("name", annotation)
1398
ann_tag.setAttribute("value", value)
1399
if_tag.appendChild(ann_tag)
1400
# Fix argument name for the Introspect method itself
1401
if (if_tag.getAttribute("name")
1402
== dbus.INTROSPECTABLE_IFACE):
1403
for cn in if_tag.getElementsByTagName("method"):
1404
if cn.getAttribute("name") == "Introspect":
1405
for arg in cn.getElementsByTagName("arg"):
1406
if (arg.getAttribute("direction")
1407
== "out"):
1408
arg.setAttribute("name",
1409
"xml_data")
1410
xmlstring = document.toxml("utf-8")
1411
document.unlink()
1412
except (AttributeError, xml.dom.DOMException,
1413
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1416
return xmlstring
1417
1418
1419
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1420
"""A D-Bus object with properties.
1421
1422
Classes inheriting from this can use the dbus_service_property
1423
decorator to expose methods as D-Bus properties. It exposes the
1424
standard Get(), Set(), and GetAll() methods on the D-Bus.
1425
"""
1426
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
873
1427
874
def _get_dbus_property(self, interface_name, property_name):
1428
875
"""Returns a bound method if one exists which is a D-Bus
1429
876
property with the specified name and interface.
1430
877
"""
1431
for cls in self.__class__.__mro__:
1432
for name, value in inspect.getmembers(
1433
cls, self._is_dbus_thing("property")):
878
for cls in self.__class__.__mro__:
879
for name, value in (inspect.getmembers
880
(cls,
881
self._is_dbus_thing("property"))):
1434
882
if (value._dbus_name == property_name
1435
883
and value._dbus_interface == interface_name):
1436
884
return value.__get__(self)
1437
885
1438
886
# No such property
1439
raise DBusPropertyNotFound("{}:{}.{}".format(
1440
self.dbus_object_path, interface_name, property_name))
1441
1442
@classmethod
1443
def _get_all_interface_names(cls):
1444
"""Get a sequence of all interfaces supported by an object"""
1445
return (name for name in set(getattr(getattr(x, attr),
1446
"_dbus_interface", None)
1447
for x in (inspect.getmro(cls))
1448
for attr in dir(x))
1449
if name is not None)
1450
1451
@dbus.service.method(dbus.PROPERTIES_IFACE,
1452
in_signature="ss",
887
raise DBusPropertyNotFound(self.dbus_object_path + ":"
888
+ interface_name + "."
889
+ property_name)
890
891
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1453
892
out_signature="v")
1454
893
def Get(self, interface_name, property_name):
1455
894
"""Standard D-Bus property Get() method, see D-Bus standard.
1461
900
if not hasattr(value, "variant_level"):
1462
901
return value
1463
902
return type(value)(value, variant_level=value.variant_level+1)
1464
903
1465
904
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1466
905
def Set(self, interface_name, property_name, value):
1467
906
"""Standard D-Bus property Set() method, see D-Bus standard.
1476
915
raise ValueError("Byte arrays not supported for non-"
1477
916
"'ay' signature {!r}"
1478
917
.format(prop._dbus_signature))
1479
value = dbus.ByteArray(bytes(value))
918
value = dbus.ByteArray(b''.join(chr(byte)
919
for byte in value))
1480
920
prop(value)
1481
1482
@dbus.service.method(dbus.PROPERTIES_IFACE,
1483
in_signature="s",
921
922
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1484
923
out_signature="a{sv}")
1485
924
def GetAll(self, interface_name):
1486
925
"""Standard D-Bus property GetAll() method, see D-Bus
1487
926
standard.
1488
927
1489
928
Note: Will not include properties with access="write".
1490
929
"""
1491
930
properties = {}
1501
940
if not hasattr(value, "variant_level"):
1502
941
properties[name] = value
1503
942
continue
1504
properties[name] = type(value)(
1505
value, variant_level=value.variant_level + 1)
943
properties[name] = type(value)(value, variant_level=
944
value.variant_level+1)
1506
945
return dbus.Dictionary(properties, signature="sv")
1507
1508
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1509
def PropertiesChanged(self, interface_name, changed_properties,
1510
invalidated_properties):
1511
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1512
standard.
1513
"""
1514
pass
1515
946
1516
947
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
948
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
949
path_keyword='object_path',
950
connection_keyword='connection')
1520
951
def Introspect(self, object_path, connection):
1521
952
"""Overloading of standard D-Bus method.
1522
953
1523
954
Inserts property tags and interface annotation tags.
1524
955
"""
1525
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1526
object_path,
1527
connection)
956
xmlstring = dbus.service.Object.Introspect(self, object_path,
957
connection)
1528
958
try:
1529
959
document = xml.dom.minidom.parseString(xmlstring)
1530
1531
960
def make_tag(document, name, prop):
1532
961
e = document.createElement("property")
1533
962
e.setAttribute("name", name)
1534
963
e.setAttribute("type", prop._dbus_signature)
1535
964
e.setAttribute("access", prop._dbus_access)
1536
965
return e
1537
1538
966
for if_tag in document.getElementsByTagName("interface"):
1539
967
# Add property tags
1540
968
for tag in (make_tag(document, name, prop)
1543
971
if prop._dbus_interface
1544
972
== if_tag.getAttribute("name")):
1545
973
if_tag.appendChild(tag)
1546
# Add annotation tags for properties
1547
for tag in if_tag.getElementsByTagName("property"):
1548
annots = dict()
1549
for name, prop in self._get_all_dbus_things(
1550
"property"):
1551
if (name == tag.getAttribute("name")
1552
and prop._dbus_interface
1553
== if_tag.getAttribute("name")):
1554
annots.update(getattr(
1555
prop, "_dbus_annotations", {}))
1556
for name, value in annots.items():
1557
ann_tag = document.createElement(
1558
"annotation")
1559
ann_tag.setAttribute("name", name)
1560
ann_tag.setAttribute("value", value)
1561
tag.appendChild(ann_tag)
974
# Add annotation tags
975
for typ in ("method", "signal", "property"):
976
for tag in if_tag.getElementsByTagName(typ):
977
annots = dict()
978
for name, prop in (self.
979
_get_all_dbus_things(typ)):
980
if (name == tag.getAttribute("name")
981
and prop._dbus_interface
982
== if_tag.getAttribute("name")):
983
annots.update(getattr
984
(prop,
985
"_dbus_annotations",
986
{}))
987
for name, value in annots.items():
988
ann_tag = document.createElement(
989
"annotation")
990
ann_tag.setAttribute("name", name)
991
ann_tag.setAttribute("value", value)
992
tag.appendChild(ann_tag)
993
# Add interface annotation tags
994
for annotation, value in dict(
995
itertools.chain.from_iterable(
996
annotations().items()
997
for name, annotations in
998
self._get_all_dbus_things("interface")
999
if name == if_tag.getAttribute("name")
1000
)).items():
1001
ann_tag = document.createElement("annotation")
1002
ann_tag.setAttribute("name", annotation)
1003
ann_tag.setAttribute("value", value)
1004
if_tag.appendChild(ann_tag)
1562
1005
# Add the names to the return values for the
1563
1006
# "org.freedesktop.DBus.Properties" methods
1564
1007
if (if_tag.getAttribute("name")
1578
1021
document.unlink()
1579
1022
except (AttributeError, xml.dom.DOMException,
1580
1023
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1583
return xmlstring
1584
1585
1586
try:
1587
dbus.OBJECT_MANAGER_IFACE
1588
except AttributeError:
1589
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1590
1591
1592
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1593
"""A D-Bus object with an ObjectManager.
1594
1595
Classes inheriting from this exposes the standard
1596
GetManagedObjects call and the InterfacesAdded and
1597
InterfacesRemoved signals on the standard
1598
"org.freedesktop.DBus.ObjectManager" interface.
1599
1600
Note: No signals are sent automatically; they must be sent
1601
manually.
1602
"""
1603
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1604
out_signature="a{oa{sa{sv}}}")
1605
def GetManagedObjects(self):
1606
"""This function must be overridden"""
1607
raise NotImplementedError()
1608
1609
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1610
signature="oa{sa{sv}}")
1611
def InterfacesAdded(self, object_path, interfaces_and_properties):
1612
pass
1613
1614
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1615
def InterfacesRemoved(self, object_path, interfaces):
1616
pass
1617
1618
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1622
def Introspect(self, object_path, connection):
1623
"""Overloading of standard D-Bus method.
1624
1625
Override return argument name of GetManagedObjects to be
1626
"objpath_interfaces_and_properties"
1627
"""
1628
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1629
object_path,
1630
connection)
1631
try:
1632
document = xml.dom.minidom.parseString(xmlstring)
1633
1634
for if_tag in document.getElementsByTagName("interface"):
1635
# Fix argument name for the GetManagedObjects method
1636
if (if_tag.getAttribute("name")
1637
== dbus.OBJECT_MANAGER_IFACE):
1638
for cn in if_tag.getElementsByTagName("method"):
1639
if (cn.getAttribute("name")
1640
== "GetManagedObjects"):
1641
for arg in cn.getElementsByTagName("arg"):
1642
if (arg.getAttribute("direction")
1643
== "out"):
1644
arg.setAttribute(
1645
"name",
1646
"objpath_interfaces"
1647
"_and_properties")
1648
xmlstring = document.toxml("utf-8")
1649
document.unlink()
1650
except (AttributeError, xml.dom.DOMException,
1651
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1024
logger.error("Failed to override Introspection method",
1025
exc_info=error)
1654
1026
return xmlstring
1655
1027
1656
1028
1657
1029
def datetime_to_dbus(dt, variant_level=0):
1658
1030
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1659
1031
if dt is None:
1660
return dbus.String("", variant_level=variant_level)
1661
return dbus.String(dt.isoformat(), variant_level=variant_level)
1032
return dbus.String("", variant_level = variant_level)
1033
return dbus.String(dt.isoformat(),
1034
variant_level=variant_level)
1662
1035
1663
1036
1664
1037
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1666
1039
dbus.service.Object, it will add alternate D-Bus attributes with
1667
1040
interface names according to the "alt_interface_names" mapping.
1668
1041
Usage:
1669
1042
1670
1043
@alternate_dbus_interfaces({"org.example.Interface":
1671
1044
"net.example.AlternateInterface"})
1672
1045
class SampleDBusObject(dbus.service.Object):
1673
1046
@dbus.service.method("org.example.Interface")
1674
1047
def SampleDBusMethod():
1675
1048
pass
1676
1049
1677
1050
The above "SampleDBusMethod" on "SampleDBusObject" will be
1678
1051
reachable via two interfaces: "org.example.Interface" and
1679
1052
"net.example.AlternateInterface", the latter of which will have
1680
1053
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1681
1054
"true", unless "deprecate" is passed with a False value.
1682
1055
1683
1056
This works for methods and signals, and also for D-Bus properties
1684
1057
(from DBusObjectWithProperties) and interfaces (from the
1685
1058
dbus_interface_annotations decorator).
1686
1059
"""
1687
1688
1060
def wrapper(cls):
1689
1061
for orig_interface_name, alt_interface_name in (
1690
alt_interface_names.items()):
1062
alt_interface_names.items()):
1691
1063
attr = {}
1692
1064
interface_names = set()
1693
1065
# Go though all attributes of the class
1695
1067
# Ignore non-D-Bus attributes, and D-Bus attributes
1696
1068
# with the wrong interface name
1697
1069
if (not hasattr(attribute, "_dbus_interface")
1698
or not attribute._dbus_interface.startswith(
1699
orig_interface_name)):
1070
or not attribute._dbus_interface
1071
.startswith(orig_interface_name)):
1700
1072
continue
1701
1073
# Create an alternate D-Bus interface name based on
1702
1074
# the current name
1703
alt_interface = attribute._dbus_interface.replace(
1704
orig_interface_name, alt_interface_name)
1075
alt_interface = (attribute._dbus_interface
1076
.replace(orig_interface_name,
1077
alt_interface_name))
1705
1078
interface_names.add(alt_interface)
1706
1079
# Is this a D-Bus signal?
1707
1080
if getattr(attribute, "_dbus_is_signal", False):
1708
1081
# Extract the original non-method undecorated
1709
1082
# function by black magic
1710
if sys.version_info.major == 2:
1711
nonmethod_func = (dict(
1083
nonmethod_func = (dict(
1712
1084
zip(attribute.func_code.co_freevars,
1713
attribute.__closure__))
1714
["func"].cell_contents)
1715
else:
1716
nonmethod_func = (dict(
1717
zip(attribute.__code__.co_freevars,
1718
attribute.__closure__))
1719
["func"].cell_contents)
1085
attribute.__closure__))["func"]
1086
.cell_contents)
1720
1087
# Create a new, but exactly alike, function
1721
1088
# object, and decorate it to be a new D-Bus signal
1722
1089
# with the alternate D-Bus interface name
1723
new_function = copy_function(nonmethod_func)
1724
new_function = (dbus.service.signal(
1725
alt_interface,
1726
attribute._dbus_signature)(new_function))
1090
new_function = (dbus.service.signal
1091
(alt_interface,
1092
attribute._dbus_signature)
1093
(types.FunctionType(
1094
nonmethod_func.func_code,
1095
nonmethod_func.func_globals,
1096
nonmethod_func.func_name,
1097
nonmethod_func.func_defaults,
1098
nonmethod_func.func_closure)))
1727
1099
# Copy annotations, if any
1728
1100
try:
1729
new_function._dbus_annotations = dict(
1730
attribute._dbus_annotations)
1101
new_function._dbus_annotations = (
1102
dict(attribute._dbus_annotations))
1731
1103
except AttributeError:
1732
1104
pass
1733
1734
1105
# Define a creator of a function to call both the
1735
1106
# original and alternate functions, so both the
1736
1107
# original and alternate signals gets sent when
1739
1110
"""This function is a scope container to pass
1740
1111
func1 and func2 to the "call_both" function
1741
1112
outside of its arguments"""
1742
1743
@functools.wraps(func2)
1744
1113
def call_both(*args, **kwargs):
1745
1114
"""This function will emit two D-Bus
1746
1115
signals by calling func1 and func2"""
1747
1116
func1(*args, **kwargs)
1748
1117
func2(*args, **kwargs)
1749
# Make wrapper function look like a D-Bus
1750
# signal
1751
for name, attr in inspect.getmembers(func2):
1752
if name.startswith("_dbus_"):
1753
setattr(call_both, name, attr)
1754
1755
1118
return call_both
1756
1119
# Create the "call_both" function and add it to
1757
1120
# the class
1762
1125
# object. Decorate it to be a new D-Bus method
1763
1126
# with the alternate D-Bus interface name. Add it
1764
1127
# to the class.
1765
attr[attrname] = (
1766
dbus.service.method(
1767
alt_interface,
1768
attribute._dbus_in_signature,
1769
attribute._dbus_out_signature)
1770
(copy_function(attribute)))
1128
attr[attrname] = (dbus.service.method
1129
(alt_interface,
1130
attribute._dbus_in_signature,
1131
attribute._dbus_out_signature)
1132
(types.FunctionType
1133
(attribute.func_code,
1134
attribute.func_globals,
1135
attribute.func_name,
1136
attribute.func_defaults,
1137
attribute.func_closure)))
1771
1138
# Copy annotations, if any
1772
1139
try:
1773
attr[attrname]._dbus_annotations = dict(
1774
attribute._dbus_annotations)
1140
attr[attrname]._dbus_annotations = (
1141
dict(attribute._dbus_annotations))
1775
1142
except AttributeError:
1776
1143
pass
1777
1144
# Is this a D-Bus property?
1780
1147
# object, and decorate it to be a new D-Bus
1781
1148
# property with the alternate D-Bus interface
1782
1149
# name. Add it to the class.
1783
attr[attrname] = (dbus_service_property(
1784
alt_interface, attribute._dbus_signature,
1785
attribute._dbus_access,
1786
attribute._dbus_get_args_options
1787
["byte_arrays"])
1788
(copy_function(attribute)))
1150
attr[attrname] = (dbus_service_property
1151
(alt_interface,
1152
attribute._dbus_signature,
1153
attribute._dbus_access,
1154
attribute
1155
._dbus_get_args_options
1156
["byte_arrays"])
1157
(types.FunctionType
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1789
1163
# Copy annotations, if any
1790
1164
try:
1791
attr[attrname]._dbus_annotations = dict(
1792
attribute._dbus_annotations)
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1793
1167
except AttributeError:
1794
1168
pass
1795
1169
# Is this a D-Bus interface?
1798
1172
# object. Decorate it to be a new D-Bus interface
1799
1173
# with the alternate D-Bus interface name. Add it
1800
1174
# to the class.
1801
attr[attrname] = (
1802
dbus_interface_annotations(alt_interface)
1803
(copy_function(attribute)))
1175
attr[attrname] = (dbus_interface_annotations
1176
(alt_interface)
1177
(types.FunctionType
1178
(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1804
1183
if deprecate:
1805
1184
# Deprecate all alternate interfaces
1806
iname = "_AlternateDBusNames_interface_annotation{}"
1185
iname="_AlternateDBusNames_interface_annotation{}"
1807
1186
for interface_name in interface_names:
1808
1809
1187
@dbus_interface_annotations(interface_name)
1810
1188
def func(self):
1811
return {"org.freedesktop.DBus.Deprecated":
1812
"true"}
1189
return { "org.freedesktop.DBus.Deprecated":
1190
"true" }
1813
1191
# Find an unused name
1814
1192
for aname in (iname.format(i)
1815
1193
for i in itertools.count()):
1819
1197
if interface_names:
1820
1198
# Replace the class with a new subclass of it with
1821
1199
# methods, signals, etc. as created above.
1822
if sys.version_info.major == 2:
1823
cls = type(b"{}Alternate".format(cls.__name__),
1824
(cls, ), attr)
1825
else:
1826
cls = type("{}Alternate".format(cls.__name__),
1827
(cls, ), attr)
1200
cls = type(b"{}Alternate".format(cls.__name__),
1201
(cls,), attr)
1828
1202
return cls
1829
1830
1203
return wrapper
1831
1204
1832
1205
1833
1206
@alternate_dbus_interfaces({"se.recompile.Mandos":
1834
"se.bsnet.fukt.Mandos"})
1207
"se.bsnet.fukt.Mandos"})
1835
1208
class ClientDBus(Client, DBusObjectWithProperties):
1836
1209
"""A Client class using D-Bus
1837
1210
1838
1211
Attributes:
1839
1212
dbus_object_path: dbus.ObjectPath
1840
1213
bus: dbus.SystemBus()
1841
1214
"""
1842
1215
1843
1216
runtime_expansions = (Client.runtime_expansions
1844
+ ("dbus_object_path", ))
1845
1846
_interface = "se.recompile.Mandos.Client"
1847
1217
+ ("dbus_object_path",))
1218
1848
1219
# dbus.service.Object doesn't use super(), so we can't either.
1849
1850
def __init__(self, bus=None, *args, **kwargs):
1220
1221
def __init__(self, bus = None, *args, **kwargs):
1851
1222
self.bus = bus
1852
1223
Client.__init__(self, *args, **kwargs)
1853
1224
# Only now, when this client is initialized, can it show up on
1854
1225
# the D-Bus
1855
client_object_name = str(self.name).translate(
1226
client_object_name = unicode(self.name).translate(
1856
1227
{ord("."): ord("_"),
1857
1228
ord("-"): ord("_")})
1858
self.dbus_object_path = dbus.ObjectPath(
1859
"/clients/" + client_object_name)
1229
self.dbus_object_path = (dbus.ObjectPath
1230
("/clients/" + client_object_name))
1860
1231
DBusObjectWithProperties.__init__(self, self.bus,
1861
1232
self.dbus_object_path)
1862
1863
def notifychangeproperty(transform_func, dbus_name,
1864
type_func=lambda x: x,
1865
variant_level=1,
1866
invalidate_only=False,
1867
_interface=_interface):
1233
1234
def notifychangeproperty(transform_func,
1235
dbus_name, type_func=lambda x: x,
1236
variant_level=1):
1868
1237
""" Modify a variable so that it's a property which announces
1869
1238
its changes to DBus.
1870
1239
1871
1240
transform_fun: Function that takes a value and a variant_level
1872
1241
and transforms it to a D-Bus type.
1873
1242
dbus_name: D-Bus name of the variable
1876
1245
variant_level: D-Bus variant level. Default: 1
1877
1246
"""
1878
1247
attrname = "_{}".format(dbus_name)
1879
1880
1248
def setter(self, value):
1881
1249
if hasattr(self, "dbus_object_path"):
1882
1250
if (not hasattr(self, attrname) or
1883
1251
type_func(getattr(self, attrname, None))
1884
1252
!= type_func(value)):
1885
if invalidate_only:
1886
self.PropertiesChanged(
1887
_interface, dbus.Dictionary(),
1888
dbus.Array((dbus_name, )))
1889
else:
1890
dbus_value = transform_func(
1891
type_func(value),
1892
variant_level=variant_level)
1893
self.PropertyChanged(dbus.String(dbus_name),
1894
dbus_value)
1895
self.PropertiesChanged(
1896
_interface,
1897
dbus.Dictionary({dbus.String(dbus_name):
1898
dbus_value}),
1899
dbus.Array())
1253
dbus_value = transform_func(type_func(value),
1254
variant_level
1255
=variant_level)
1256
self.PropertyChanged(dbus.String(dbus_name),
1257
dbus_value)
1900
1258
setattr(self, attrname, value)
1901
1259
1902
1260
return property(lambda self: getattr(self, attrname), setter)
1903
1261
1904
1262
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1905
1263
approvals_pending = notifychangeproperty(dbus.Boolean,
1906
1264
"ApprovalPending",
1907
type_func=bool)
1265
type_func = bool)
1908
1266
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1909
1267
last_enabled = notifychangeproperty(datetime_to_dbus,
1910
1268
"LastEnabled")
1911
checker = notifychangeproperty(
1912
dbus.Boolean, "CheckerRunning",
1913
type_func=lambda checker: checker is not None)
1269
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1270
type_func = lambda checker:
1271
checker is not None)
1914
1272
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1915
1273
"LastCheckedOK")
1916
1274
last_checker_status = notifychangeproperty(dbus.Int16,
1919
1277
datetime_to_dbus, "LastApprovalRequest")
1920
1278
approved_by_default = notifychangeproperty(dbus.Boolean,
1921
1279
"ApprovedByDefault")
1922
approval_delay = notifychangeproperty(
1923
dbus.UInt64, "ApprovalDelay",
1924
type_func=lambda td: td.total_seconds() * 1000)
1280
approval_delay = notifychangeproperty(dbus.UInt64,
1281
"ApprovalDelay",
1282
type_func =
1283
lambda td: td.total_seconds()
1284
* 1000)
1925
1285
approval_duration = notifychangeproperty(
1926
1286
dbus.UInt64, "ApprovalDuration",
1927
type_func=lambda td: td.total_seconds() * 1000)
1287
type_func = lambda td: td.total_seconds() * 1000)
1928
1288
host = notifychangeproperty(dbus.String, "Host")
1929
timeout = notifychangeproperty(
1930
dbus.UInt64, "Timeout",
1931
type_func=lambda td: td.total_seconds() * 1000)
1289
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1290
type_func = lambda td:
1291
td.total_seconds() * 1000)
1932
1292
extended_timeout = notifychangeproperty(
1933
1293
dbus.UInt64, "ExtendedTimeout",
1934
type_func=lambda td: td.total_seconds() * 1000)
1935
interval = notifychangeproperty(
1936
dbus.UInt64, "Interval",
1937
type_func=lambda td: td.total_seconds() * 1000)
1294
type_func = lambda td: td.total_seconds() * 1000)
1295
interval = notifychangeproperty(dbus.UInt64,
1296
"Interval",
1297
type_func =
1298
lambda td: td.total_seconds()
1299
* 1000)
1938
1300
checker_command = notifychangeproperty(dbus.String, "Checker")
1939
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1940
invalidate_only=True)
1941
1301
1942
1302
del notifychangeproperty
1943
1303
1944
1304
def __del__(self, *args, **kwargs):
1945
1305
try:
1946
1306
self.remove_from_connection()
1949
1309
if hasattr(DBusObjectWithProperties, "__del__"):
1950
1310
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1951
1311
Client.__del__(self, *args, **kwargs)
1952
1953
def checker_callback(self, source, condition,
1954
connection, command, *args, **kwargs):
1955
ret = Client.checker_callback(self, source, condition,
1956
connection, command, *args,
1957
**kwargs)
1958
exitstatus = self.last_checker_status
1959
if exitstatus >= 0:
1312
1313
def checker_callback(self, pid, condition, command,
1314
*args, **kwargs):
1315
self.checker_callback_tag = None
1316
self.checker = None
1317
if os.WIFEXITED(condition):
1318
exitstatus = os.WEXITSTATUS(condition)
1960
1319
# Emit D-Bus signal
1961
1320
self.CheckerCompleted(dbus.Int16(exitstatus),
1962
# This is specific to GNU libC
1963
dbus.Int64(exitstatus << 8),
1321
dbus.Int64(condition),
1964
1322
dbus.String(command))
1965
1323
else:
1966
1324
# Emit D-Bus signal
1967
1325
self.CheckerCompleted(dbus.Int16(-1),
1968
dbus.Int64(
1969
# This is specific to GNU libC
1970
(exitstatus << 8)
1971
| self.last_checker_signal),
1326
dbus.Int64(condition),
1972
1327
dbus.String(command))
1973
return ret
1974
1328
1329
return Client.checker_callback(self, pid, condition, command,
1330
*args, **kwargs)
1331
1975
1332
def start_checker(self, *args, **kwargs):
1976
1333
old_checker_pid = getattr(self.checker, "pid", None)
1977
1334
r = Client.start_checker(self, *args, **kwargs)
1981
1338
# Emit D-Bus signal
1982
1339
self.CheckerStarted(self.current_checker_command)
1983
1340
return r
1984
1341
1985
1342
def _reset_approved(self):
1986
1343
self.approved = None
1987
1344
return False
1988
1345
1989
1346
def approve(self, value=True):
1990
1347
self.approved = value
1991
GLib.timeout_add(int(self.approval_duration.total_seconds()
1992
* 1000), self._reset_approved)
1348
gobject.timeout_add(int(self.approval_duration.total_seconds()
1349
* 1000), self._reset_approved)
1993
1350
self.send_changedstate()
1994
1995
# D-Bus methods, signals & properties
1996
1997
# Interfaces
1998
1999
# Signals
2000
1351
1352
## D-Bus methods, signals & properties
1353
_interface = "se.recompile.Mandos.Client"
1354
1355
## Interfaces
1356
1357
@dbus_interface_annotations(_interface)
1358
def _foo(self):
1359
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1360
"false"}
1361
1362
## Signals
1363
2001
1364
# CheckerCompleted - signal
2002
1365
@dbus.service.signal(_interface, signature="nxs")
2003
1366
def CheckerCompleted(self, exitcode, waitstatus, command):
2004
1367
"D-Bus signal"
2005
1368
pass
2006
1369
2007
1370
# CheckerStarted - signal
2008
1371
@dbus.service.signal(_interface, signature="s")
2009
1372
def CheckerStarted(self, command):
2010
1373
"D-Bus signal"
2011
1374
pass
2012
1375
2013
1376
# PropertyChanged - signal
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2015
1377
@dbus.service.signal(_interface, signature="sv")
2016
1378
def PropertyChanged(self, property, value):
2017
1379
"D-Bus signal"
2018
1380
pass
2019
1381
2020
1382
# GotSecret - signal
2021
1383
@dbus.service.signal(_interface)
2022
1384
def GotSecret(self):
2025
1387
server to mandos-client
2026
1388
"""
2027
1389
pass
2028
1390
2029
1391
# Rejected - signal
2030
1392
@dbus.service.signal(_interface, signature="s")
2031
1393
def Rejected(self, reason):
2032
1394
"D-Bus signal"
2033
1395
pass
2034
1396
2035
1397
# NeedApproval - signal
2036
1398
@dbus.service.signal(_interface, signature="tb")
2037
1399
def NeedApproval(self, timeout, default):
2038
1400
"D-Bus signal"
2039
1401
return self.need_approval()
2040
2041
# Methods
2042
1402
1403
## Methods
1404
2043
1405
# Approve - method
2044
1406
@dbus.service.method(_interface, in_signature="b")
2045
1407
def Approve(self, value):
2046
1408
self.approve(value)
2047
1409
2048
1410
# CheckedOK - method
2049
1411
@dbus.service.method(_interface)
2050
1412
def CheckedOK(self):
2051
1413
self.checked_ok()
2052
1414
2053
1415
# Enable - method
2054
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2055
1416
@dbus.service.method(_interface)
2056
1417
def Enable(self):
2057
1418
"D-Bus method"
2058
1419
self.enable()
2059
1420
2060
1421
# StartChecker - method
2061
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2062
1422
@dbus.service.method(_interface)
2063
1423
def StartChecker(self):
2064
1424
"D-Bus method"
2065
1425
self.start_checker()
2066
1426
2067
1427
# Disable - method
2068
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2069
1428
@dbus.service.method(_interface)
2070
1429
def Disable(self):
2071
1430
"D-Bus method"
2072
1431
self.disable()
2073
1432
2074
1433
# StopChecker - method
2075
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2076
1434
@dbus.service.method(_interface)
2077
1435
def StopChecker(self):
2078
1436
self.stop_checker()
2079
2080
# Properties
2081
1437
1438
## Properties
1439
2082
1440
# ApprovalPending - property
2083
1441
@dbus_service_property(_interface, signature="b", access="read")
2084
1442
def ApprovalPending_dbus_property(self):
2085
1443
return dbus.Boolean(bool(self.approvals_pending))
2086
1444
2087
1445
# ApprovedByDefault - property
2088
@dbus_service_property(_interface,
2089
signature="b",
1446
@dbus_service_property(_interface, signature="b",
2090
1447
access="readwrite")
2091
1448
def ApprovedByDefault_dbus_property(self, value=None):
2092
1449
if value is None: # get
2093
1450
return dbus.Boolean(self.approved_by_default)
2094
1451
self.approved_by_default = bool(value)
2095
1452
2096
1453
# ApprovalDelay - property
2097
@dbus_service_property(_interface,
2098
signature="t",
1454
@dbus_service_property(_interface, signature="t",
2099
1455
access="readwrite")
2100
1456
def ApprovalDelay_dbus_property(self, value=None):
2101
1457
if value is None: # get
2102
1458
return dbus.UInt64(self.approval_delay.total_seconds()
2103
1459
* 1000)
2104
1460
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2105
1461
2106
1462
# ApprovalDuration - property
2107
@dbus_service_property(_interface,
2108
signature="t",
1463
@dbus_service_property(_interface, signature="t",
2109
1464
access="readwrite")
2110
1465
def ApprovalDuration_dbus_property(self, value=None):
2111
1466
if value is None: # get
2112
1467
return dbus.UInt64(self.approval_duration.total_seconds()
2113
1468
* 1000)
2114
1469
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2115
1470
2116
1471
# Name - property
2117
@dbus_annotations(
2118
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2119
1472
@dbus_service_property(_interface, signature="s", access="read")
2120
1473
def Name_dbus_property(self):
2121
1474
return dbus.String(self.name)
2122
2123
# KeyID - property
2124
@dbus_annotations(
2125
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2126
@dbus_service_property(_interface, signature="s", access="read")
2127
def KeyID_dbus_property(self):
2128
return dbus.String(self.key_id)
2129
1475
2130
1476
# Fingerprint - property
2131
@dbus_annotations(
2132
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2133
1477
@dbus_service_property(_interface, signature="s", access="read")
2134
1478
def Fingerprint_dbus_property(self):
2135
1479
return dbus.String(self.fingerprint)
2136
1480
2137
1481
# Host - property
2138
@dbus_service_property(_interface,
2139
signature="s",
1482
@dbus_service_property(_interface, signature="s",
2140
1483
access="readwrite")
2141
1484
def Host_dbus_property(self, value=None):
2142
1485
if value is None: # get
2143
1486
return dbus.String(self.host)
2144
self.host = str(value)
2145
1487
self.host = unicode(value)
1488
2146
1489
# Created - property
2147
@dbus_annotations(
2148
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2149
1490
@dbus_service_property(_interface, signature="s", access="read")
2150
1491
def Created_dbus_property(self):
2151
1492
return datetime_to_dbus(self.created)
2152
1493
2153
1494
# LastEnabled - property
2154
1495
@dbus_service_property(_interface, signature="s", access="read")
2155
1496
def LastEnabled_dbus_property(self):
2156
1497
return datetime_to_dbus(self.last_enabled)
2157
1498
2158
1499
# Enabled - property
2159
@dbus_service_property(_interface,
2160
signature="b",
1500
@dbus_service_property(_interface, signature="b",
2161
1501
access="readwrite")
2162
1502
def Enabled_dbus_property(self, value=None):
2163
1503
if value is None: # get
2166
1506
self.enable()
2167
1507
else:
2168
1508
self.disable()
2169
1509
2170
1510
# LastCheckedOK - property
2171
@dbus_service_property(_interface,
2172
signature="s",
1511
@dbus_service_property(_interface, signature="s",
2173
1512
access="readwrite")
2174
1513
def LastCheckedOK_dbus_property(self, value=None):
2175
1514
if value is not None:
2176
1515
self.checked_ok()
2177
1516
return
2178
1517
return datetime_to_dbus(self.last_checked_ok)
2179
1518
2180
1519
# LastCheckerStatus - property
2181
@dbus_service_property(_interface, signature="n", access="read")
1520
@dbus_service_property(_interface, signature="n",
1521
access="read")
2182
1522
def LastCheckerStatus_dbus_property(self):
2183
1523
return dbus.Int16(self.last_checker_status)
2184
1524
2185
1525
# Expires - property
2186
1526
@dbus_service_property(_interface, signature="s", access="read")
2187
1527
def Expires_dbus_property(self):
2188
1528
return datetime_to_dbus(self.expires)
2189
1529
2190
1530
# LastApprovalRequest - property
2191
1531
@dbus_service_property(_interface, signature="s", access="read")
2192
1532
def LastApprovalRequest_dbus_property(self):
2193
1533
return datetime_to_dbus(self.last_approval_request)
2194
1534
2195
1535
# Timeout - property
2196
@dbus_service_property(_interface,
2197
signature="t",
1536
@dbus_service_property(_interface, signature="t",
2198
1537
access="readwrite")
2199
1538
def Timeout_dbus_property(self, value=None):
2200
1539
if value is None: # get
2212
1551
if (getattr(self, "disable_initiator_tag", None)
2213
1552
is None):
2214
1553
return
2215
GLib.source_remove(self.disable_initiator_tag)
2216
self.disable_initiator_tag = GLib.timeout_add(
2217
int((self.expires - now).total_seconds() * 1000),
2218
self.disable)
2219
1554
gobject.source_remove(self.disable_initiator_tag)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
int((self.expires - now).total_seconds()
1558
* 1000), self.disable))
1559
2220
1560
# ExtendedTimeout - property
2221
@dbus_service_property(_interface,
2222
signature="t",
1561
@dbus_service_property(_interface, signature="t",
2223
1562
access="readwrite")
2224
1563
def ExtendedTimeout_dbus_property(self, value=None):
2225
1564
if value is None: # get
2226
1565
return dbus.UInt64(self.extended_timeout.total_seconds()
2227
1566
* 1000)
2228
1567
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2229
1568
2230
1569
# Interval - property
2231
@dbus_service_property(_interface,
2232
signature="t",
1570
@dbus_service_property(_interface, signature="t",
2233
1571
access="readwrite")
2234
1572
def Interval_dbus_property(self, value=None):
2235
1573
if value is None: # get
2239
1577
return
2240
1578
if self.enabled:
2241
1579
# Reschedule checker run
2242
GLib.source_remove(self.checker_initiator_tag)
2243
self.checker_initiator_tag = GLib.timeout_add(
2244
value, self.start_checker)
2245
self.start_checker() # Start one now, too
2246
1580
gobject.source_remove(self.checker_initiator_tag)
1581
self.checker_initiator_tag = (gobject.timeout_add
1582
(value, self.start_checker))
1583
self.start_checker() # Start one now, too
1584
2247
1585
# Checker - property
2248
@dbus_service_property(_interface,
2249
signature="s",
1586
@dbus_service_property(_interface, signature="s",
2250
1587
access="readwrite")
2251
1588
def Checker_dbus_property(self, value=None):
2252
1589
if value is None: # get
2253
1590
return dbus.String(self.checker_command)
2254
self.checker_command = str(value)
2255
1591
self.checker_command = unicode(value)
1592
2256
1593
# CheckerRunning - property
2257
@dbus_service_property(_interface,
2258
signature="b",
1594
@dbus_service_property(_interface, signature="b",
2259
1595
access="readwrite")
2260
1596
def CheckerRunning_dbus_property(self, value=None):
2261
1597
if value is None: # get
2264
1600
self.start_checker()
2265
1601
else:
2266
1602
self.stop_checker()
2267
1603
2268
1604
# ObjectPath - property
2269
@dbus_annotations(
2270
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2271
"org.freedesktop.DBus.Deprecated": "true"})
2272
1605
@dbus_service_property(_interface, signature="o", access="read")
2273
1606
def ObjectPath_dbus_property(self):
2274
return self.dbus_object_path # is already a dbus.ObjectPath
2275
1607
return self.dbus_object_path # is already a dbus.ObjectPath
1608
2276
1609
# Secret = property
2277
@dbus_annotations(
2278
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2279
"invalidates"})
2280
@dbus_service_property(_interface,
2281
signature="ay",
2282
access="write",
2283
byte_arrays=True)
1610
@dbus_service_property(_interface, signature="ay",
1611
access="write", byte_arrays=True)
2284
1612
def Secret_dbus_property(self, value):
2285
1613
self.secret = bytes(value)
2286
1614
2287
1615
del _interface
2288
1616
2289
1617
2290
class ProxyClient:
2291
def __init__(self, child_pipe, key_id, fpr, address):
1618
class ProxyClient(object):
1619
def __init__(self, child_pipe, fpr, address):
2292
1620
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
1621
self._pipe.send(('init', fpr, address))
2294
1622
if not self._pipe.recv():
2295
raise KeyError(key_id or fpr)
2296
1623
raise KeyError()
1624
2297
1625
def __getattribute__(self, name):
2298
if name == "_pipe":
1626
if name == '_pipe':
2299
1627
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
1628
self._pipe.send(('getattr', name))
2301
1629
data = self._pipe.recv()
2302
if data[0] == "data":
1630
if data[0] == 'data':
2303
1631
return data[1]
2304
if data[0] == "function":
2305
1632
if data[0] == 'function':
2306
1633
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
1634
self._pipe.send(('funcall', name, args, kwargs))
2308
1635
return self._pipe.recv()[1]
2309
2310
1636
return func
2311
1637
2312
1638
def __setattr__(self, name, value):
2313
if name == "_pipe":
1639
if name == '_pipe':
2314
1640
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
1641
self._pipe.send(('setattr', name, value))
2316
1642
2317
1643
2318
1644
class ClientHandler(socketserver.BaseRequestHandler, object):
2319
1645
"""A class to handle client connections.
2320
1646
2321
1647
Instantiated once for each connection to handle it.
2322
1648
Note: This will run in its own forked process."""
2323
1649
2324
1650
def handle(self):
2325
1651
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2329
2330
session = gnutls.ClientSession(self.request)
2331
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2333
# "+AES-256-CBC", "+SHA1",
2334
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
# "+DHE-DSS"))
1652
logger.info("TCP connection from: %s",
1653
unicode(self.client_address))
1654
logger.debug("Pipe FD: %d",
1655
self.server.child_pipe.fileno())
1656
1657
session = (gnutls.connection
1658
.ClientSession(self.request,
1659
gnutls.connection
1660
.X509Credentials()))
1661
1662
# Note: gnutls.connection.X509Credentials is really a
1663
# generic GnuTLS certificate credentials object so long as
1664
# no X.509 keys are added to it. Therefore, we can use it
1665
# here despite using OpenPGP certificates.
1666
1667
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1668
# "+AES-256-CBC", "+SHA1",
1669
# "+COMP-NULL", "+CTYPE-OPENPGP",
1670
# "+DHE-DSS"))
2336
1671
# Use a fallback default, since this MUST be set.
2337
1672
priority = self.server.gnutls_priority
2338
1673
if priority is None:
2339
1674
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2342
1675
(gnutls.library.functions
1676
.gnutls_priority_set_direct(session._c_object,
1677
priority, None))
1678
2343
1679
# Start communication using the Mandos protocol
2344
1680
# Get protocol number
2345
1681
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
1682
logger.debug("Protocol version: %r", line)
2347
1683
try:
2348
1684
if int(line.strip().split()[0]) > 1:
2349
1685
raise RuntimeError(line)
2350
1686
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
1687
logger.error("Unknown protocol version: %s", error)
2352
1688
return
2353
1689
2354
1690
# Start GnuTLS connection
2355
1691
try:
2356
1692
session.handshake()
2357
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
1693
except gnutls.errors.GNUTLSError as error:
1694
logger.warning("Handshake failed: %s", error)
2359
1695
# Do not run session.bye() here: the session is not
2360
1696
# established. Just abandon the request.
2361
1697
return
2362
log.debug("Handshake succeeded")
2363
1698
logger.debug("Handshake succeeded")
1699
2364
1700
approval_required = False
2365
1701
try:
2366
if gnutls.has_rawpk:
2367
fpr = b""
2368
try:
2369
key_id = self.key_id(
2370
self.peer_certificate(session))
2371
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2373
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2377
2378
else:
2379
key_id = b""
2380
try:
2381
fpr = self.fingerprint(
2382
self.peer_certificate(session))
2383
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2385
return
2386
log.debug("Fingerprint: %s", fpr)
2387
2388
try:
2389
client = ProxyClient(child_pipe, key_id, fpr,
1702
try:
1703
fpr = self.fingerprint(self.peer_certificate
1704
(session))
1705
except (TypeError,
1706
gnutls.errors.GNUTLSError) as error:
1707
logger.warning("Bad certificate: %s", error)
1708
return
1709
logger.debug("Fingerprint: %s", fpr)
1710
1711
try:
1712
client = ProxyClient(child_pipe, fpr,
2390
1713
self.client_address)
2391
1714
except KeyError:
2392
1715
return
2393
1716
2394
1717
if client.approval_delay:
2395
1718
delay = client.approval_delay
2396
1719
client.approvals_pending += 1
2397
1720
approval_required = True
2398
1721
2399
1722
while True:
2400
1723
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
1724
logger.info("Client %s is disabled",
1725
client.name)
2402
1726
if self.server.use_dbus:
2403
1727
# Emit D-Bus signal
2404
1728
client.Rejected("Disabled")
2405
1729
return
2406
1730
2407
1731
if client.approved or not client.approval_delay:
2408
# We are approved or approval is disabled
1732
#We are approved or approval is disabled
2409
1733
break
2410
1734
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
1735
logger.info("Client %s needs approval",
1736
client.name)
2413
1737
if self.server.use_dbus:
2414
1738
# Emit D-Bus signal
2415
1739
client.NeedApproval(
2416
1740
client.approval_delay.total_seconds()
2417
1741
* 1000, client.approved_by_default)
2418
1742
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
1743
logger.warning("Client %s was not approved",
1744
client.name)
2421
1745
if self.server.use_dbus:
2422
1746
# Emit D-Bus signal
2423
1747
client.Rejected("Denied")
2424
1748
return
2425
2426
# wait until timeout or approved
1749
1750
#wait until timeout or approved
2427
1751
time = datetime.datetime.now()
2428
1752
client.changedstate.acquire()
2429
1753
client.changedstate.wait(delay.total_seconds())
2431
1755
time2 = datetime.datetime.now()
2432
1756
if (time2 - time) >= delay:
2433
1757
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
1758
logger.warning("Client %s timed out while"
1759
" waiting for approval",
1760
client.name)
2437
1761
if self.server.use_dbus:
2438
1762
# Emit D-Bus signal
2439
1763
client.Rejected("Approval timed out")
2442
1766
break
2443
1767
else:
2444
1768
delay -= time2 - time
2445
2446
try:
2447
session.send(client.secret)
2448
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2450
return
2451
2452
log.info("Sending secret to %s", client.name)
1769
1770
sent_size = 0
1771
while sent_size < len(client.secret):
1772
try:
1773
sent = session.send(client.secret[sent_size:])
1774
except gnutls.errors.GNUTLSError as error:
1775
logger.warning("gnutls send failed",
1776
exc_info=error)
1777
return
1778
logger.debug("Sent: %d, remaining: %d",
1779
sent, len(client.secret)
1780
- (sent_size + sent))
1781
sent_size += sent
1782
1783
logger.info("Sending secret to %s", client.name)
2453
1784
# bump the timeout using extended_timeout
2454
1785
client.bump_timeout(client.extended_timeout)
2455
1786
if self.server.use_dbus:
2456
1787
# Emit D-Bus signal
2457
1788
client.GotSecret()
2458
1789
2459
1790
finally:
2460
1791
if approval_required:
2461
1792
client.approvals_pending -= 1
2462
1793
try:
2463
1794
session.bye()
2464
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2466
1795
except gnutls.errors.GNUTLSError as error:
1796
logger.warning("GnuTLS bye failed",
1797
exc_info=error)
1798
2467
1799
@staticmethod
2468
1800
def peer_certificate(session):
2469
"Return the peer's certificate as a bytestring"
2470
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2473
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2475
if gnutls.has_rawpk:
2476
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
else:
2478
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
# If not a valid certificate type...
2480
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2483
# ...return invalid data
2484
return b""
1801
"Return the peer's OpenPGP certificate as a bytestring"
1802
# If not an OpenPGP certificate...
1803
if (gnutls.library.functions
1804
.gnutls_certificate_type_get(session._c_object)
1805
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1806
# ...do the normal thing
1807
return session.peer_certificate
2485
1808
list_size = ctypes.c_uint(1)
2486
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
1809
cert_list = (gnutls.library.functions
1810
.gnutls_certificate_get_peers
1811
(session._c_object, ctypes.byref(list_size)))
2488
1812
if not bool(cert_list) and list_size.value != 0:
2489
raise gnutls.Error("error getting peer certificate")
1813
raise gnutls.errors.GNUTLSError("error getting peer"
1814
" certificate")
2490
1815
if list_size.value == 0:
2491
1816
return None
2492
1817
cert = cert_list[0]
2493
1818
return ctypes.string_at(cert.data, cert.size)
2494
2495
@staticmethod
2496
def key_id(certificate):
2497
"Convert a certificate bytestring to a hexdigit key ID"
2498
# New GnuTLS "datum" with the public key
2499
datum = gnutls.datum_t(
2500
ctypes.cast(ctypes.c_char_p(certificate),
2501
ctypes.POINTER(ctypes.c_ubyte)),
2502
ctypes.c_uint(len(certificate)))
2503
# XXX all these need to be created in the gnutls "module"
2504
# New empty GnuTLS certificate
2505
pubkey = gnutls.pubkey_t()
2506
gnutls.pubkey_init(ctypes.byref(pubkey))
2507
# Import the raw public key into the certificate
2508
gnutls.pubkey_import(pubkey,
2509
ctypes.byref(datum),
2510
gnutls.X509_FMT_DER)
2511
# New buffer for the key ID
2512
buf = ctypes.create_string_buffer(32)
2513
buf_len = ctypes.c_size_t(len(buf))
2514
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2521
# Deinit the certificate
2522
gnutls.pubkey_deinit(pubkey)
2523
2524
# Convert the buffer to a Python bytestring
2525
key_id = ctypes.string_at(buf, buf_len.value)
2526
# Convert the bytestring to hexadecimal notation
2527
hex_key_id = binascii.hexlify(key_id).upper()
2528
return hex_key_id
2529
1819
2530
1820
@staticmethod
2531
1821
def fingerprint(openpgp):
2532
1822
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2533
1823
# New GnuTLS "datum" with the OpenPGP public key
2534
datum = gnutls.datum_t(
2535
ctypes.cast(ctypes.c_char_p(openpgp),
2536
ctypes.POINTER(ctypes.c_ubyte)),
2537
ctypes.c_uint(len(openpgp)))
1824
datum = (gnutls.library.types
1825
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1826
ctypes.POINTER
1827
(ctypes.c_ubyte)),
1828
ctypes.c_uint(len(openpgp))))
2538
1829
# New empty GnuTLS certificate
2539
crt = gnutls.openpgp_crt_t()
2540
gnutls.openpgp_crt_init(ctypes.byref(crt))
1830
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1831
(gnutls.library.functions
1832
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2541
1833
# Import the OpenPGP public key into the certificate
2542
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2543
gnutls.OPENPGP_FMT_RAW)
1834
(gnutls.library.functions
1835
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1836
gnutls.library.constants
1837
.GNUTLS_OPENPGP_FMT_RAW))
2544
1838
# Verify the self signature in the key
2545
1839
crtverify = ctypes.c_uint()
2546
gnutls.openpgp_crt_verify_self(crt, 0,
2547
ctypes.byref(crtverify))
1840
(gnutls.library.functions
1841
.gnutls_openpgp_crt_verify_self(crt, 0,
1842
ctypes.byref(crtverify)))
2548
1843
if crtverify.value != 0:
2549
gnutls.openpgp_crt_deinit(crt)
2550
raise gnutls.CertificateSecurityError(code
2551
=crtverify.value)
1844
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1845
raise (gnutls.errors.CertificateSecurityError
1846
("Verify failed"))
2552
1847
# New buffer for the fingerprint
2553
1848
buf = ctypes.create_string_buffer(20)
2554
1849
buf_len = ctypes.c_size_t()
2555
1850
# Get the fingerprint from the certificate into the buffer
2556
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2557
ctypes.byref(buf_len))
1851
(gnutls.library.functions
1852
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1853
ctypes.byref(buf_len)))
2558
1854
# Deinit the certificate
2559
gnutls.openpgp_crt_deinit(crt)
1855
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2560
1856
# Convert the buffer to a Python bytestring
2561
1857
fpr = ctypes.string_at(buf, buf_len.value)
2562
1858
# Convert the bytestring to hexadecimal notation
2564
1860
return hex_fpr
2565
1861
2566
1862
2567
class MultiprocessingMixIn:
1863
class MultiprocessingMixIn(object):
2568
1864
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2569
2570
1865
def sub_process_main(self, request, address):
2571
1866
try:
2572
1867
self.finish_request(request, address)
2573
1868
except Exception:
2574
1869
self.handle_error(request, address)
2575
1870
self.close_request(request)
2576
1871
2577
1872
def process_request(self, request, address):
2578
1873
"""Start a new process to process the request."""
2579
proc = multiprocessing.Process(target=self.sub_process_main,
2580
args=(request, address))
1874
proc = multiprocessing.Process(target = self.sub_process_main,
1875
args = (request, address))
2581
1876
proc.start()
2582
1877
return proc
2583
1878
2584
1879
2585
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1880
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2586
1881
""" adds a pipe to the MixIn """
2587
2588
1882
def process_request(self, request, client_address):
2589
1883
"""Overrides and wraps the original process_request().
2590
1884
2591
1885
This function creates a new pipe in self.pipe
2592
1886
"""
2593
1887
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2594
1888
2595
1889
proc = MultiprocessingMixIn.process_request(self, request,
2596
1890
client_address)
2597
1891
self.child_pipe.close()
2598
1892
self.add_pipe(parent_pipe, proc)
2599
1893
2600
1894
def add_pipe(self, parent_pipe, proc):
2601
1895
"""Dummy function; override as necessary"""
2602
1896
raise NotImplementedError()
2603
1897
2604
1898
2605
1899
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2608
1900
socketserver.TCPServer, object):
1901
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1902
2609
1903
Attributes:
2610
1904
enabled: Boolean; whether this server is activated yet
2611
1905
interface: None or a network interface name (string)
2612
1906
use_ipv6: Boolean; to use IPv6 or not
2613
1907
"""
2614
2615
1908
def __init__(self, server_address, RequestHandlerClass,
2616
interface=None,
2617
use_ipv6=True,
2618
socketfd=None):
1909
interface=None, use_ipv6=True, socketfd=None):
2619
1910
"""If socketfd is set, use that file descriptor instead of
2620
1911
creating a new one with socket.socket().
2621
1912
"""
2627
1918
self.socketfd = socketfd
2628
1919
# Save the original socket.socket() function
2629
1920
self.socket_socket = socket.socket
2630
2631
1921
# To implement --socket, we monkey patch socket.socket.
2632
#
1922
#
2633
1923
# (When socketserver.TCPServer is a new-style class, we
2634
1924
# could make self.socket into a property instead of monkey
2635
1925
# patching socket.socket.)
2636
#
1926
#
2637
1927
# Create a one-time-only replacement for socket.socket()
2638
1928
@functools.wraps(socket.socket)
2639
1929
def socket_wrapper(*args, **kwargs):
2651
1941
# socket_wrapper(), if socketfd was set.
2652
1942
socketserver.TCPServer.__init__(self, server_address,
2653
1943
RequestHandlerClass)
2654
1944
2655
1945
def server_bind(self):
2656
1946
"""This overrides the normal server_bind() function
2657
1947
to bind to an interface if one was specified, and also NOT to
2658
1948
bind to an address or port if they were not specified."""
2659
global SO_BINDTODEVICE
2660
1949
if self.interface is not None:
2661
1950
if SO_BINDTODEVICE is None:
2662
# Fall back to a hard-coded value which seems to be
2663
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2665
SO_BINDTODEVICE = 25
2666
try:
2667
self.socket.setsockopt(
2668
socket.SOL_SOCKET, SO_BINDTODEVICE,
2669
(self.interface + "\0").encode("utf-8"))
2670
except socket.error as error:
2671
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2674
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2677
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2680
else:
2681
raise
1951
logger.error("SO_BINDTODEVICE does not exist;"
1952
" cannot bind to interface %s",
1953
self.interface)
1954
else:
1955
try:
1956
self.socket.setsockopt(socket.SOL_SOCKET,
1957
SO_BINDTODEVICE,
1958
(self.interface + "\0")
1959
.encode("utf-8"))
1960
except socket.error as error:
1961
if error.errno == errno.EPERM:
1962
logger.error("No permission to bind to"
1963
" interface %s", self.interface)
1964
elif error.errno == errno.ENOPROTOOPT:
1965
logger.error("SO_BINDTODEVICE not available;"
1966
" cannot bind to interface %s",
1967
self.interface)
1968
elif error.errno == errno.ENODEV:
1969
logger.error("Interface %s does not exist,"
1970
" cannot bind", self.interface)
1971
else:
1972
raise
2682
1973
# Only bind(2) the socket if we really need to.
2683
1974
if self.server_address[0] or self.server_address[1]:
2684
if self.server_address[1]:
2685
self.allow_reuse_address = True
2686
1975
if not self.server_address[0]:
2687
1976
if self.address_family == socket.AF_INET6:
2688
any_address = "::" # in6addr_any
1977
any_address = "::" # in6addr_any
2689
1978
else:
2690
any_address = "0.0.0.0" # INADDR_ANY
1979
any_address = "0.0.0.0" # INADDR_ANY
2691
1980
self.server_address = (any_address,
2692
1981
self.server_address[1])
2693
1982
elif not self.server_address[1]:
2694
self.server_address = (self.server_address[0], 0)
1983
self.server_address = (self.server_address[0],
1984
0)
2695
1985
# if self.interface:
2696
1986
# self.server_address = (self.server_address[0],
2697
1987
# 0, # port
2703
1993
2704
1994
class MandosServer(IPv6_TCPServer):
2705
1995
"""Mandos server.
2706
1996
2707
1997
Attributes:
2708
1998
clients: set of Client objects
2709
1999
gnutls_priority GnuTLS priority string
2710
2000
use_dbus: Boolean; to emit D-Bus signals or not
2711
2712
Assumes a GLib.MainLoop event loop.
2001
2002
Assumes a gobject.MainLoop event loop.
2713
2003
"""
2714
2715
2004
def __init__(self, server_address, RequestHandlerClass,
2716
interface=None,
2717
use_ipv6=True,
2718
clients=None,
2719
gnutls_priority=None,
2720
use_dbus=True,
2721
socketfd=None):
2005
interface=None, use_ipv6=True, clients=None,
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
2722
2007
self.enabled = False
2723
2008
self.clients = clients
2724
2009
if self.clients is None:
2727
2012
self.gnutls_priority = gnutls_priority
2728
2013
IPv6_TCPServer.__init__(self, server_address,
2729
2014
RequestHandlerClass,
2730
interface=interface,
2731
use_ipv6=use_ipv6,
2732
socketfd=socketfd)
2733
2015
interface = interface,
2016
use_ipv6 = use_ipv6,
2017
socketfd = socketfd)
2734
2018
def server_activate(self):
2735
2019
if self.enabled:
2736
2020
return socketserver.TCPServer.server_activate(self)
2737
2021
2738
2022
def enable(self):
2739
2023
self.enabled = True
2740
2024
2741
2025
def add_pipe(self, parent_pipe, proc):
2742
2026
# Call "handle_ipc" for both data and EOF events
2743
GLib.io_add_watch(
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2746
functools.partial(self.handle_ipc,
2747
parent_pipe=parent_pipe,
2748
proc=proc))
2749
2750
def handle_ipc(self, source, condition,
2751
parent_pipe=None,
2752
proc=None,
2753
client_object=None):
2027
gobject.io_add_watch(parent_pipe.fileno(),
2028
gobject.IO_IN | gobject.IO_HUP,
2029
functools.partial(self.handle_ipc,
2030
parent_pipe =
2031
parent_pipe,
2032
proc = proc))
2033
2034
def handle_ipc(self, source, condition, parent_pipe=None,
2035
proc = None, client_object=None):
2754
2036
# error, or the other end of multiprocessing.Pipe has closed
2755
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2756
2038
# Wait for other process to exit
2757
2039
proc.join()
2758
2040
return False
2759
2041
2760
2042
# Read a request from the child
2761
2043
request = parent_pipe.recv()
2762
2044
command = request[0]
2763
2764
if command == "init":
2765
key_id = request[1].decode("ascii")
2766
fpr = request[2].decode("ascii")
2767
address = request[3]
2768
2769
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2772
continue
2773
if key_id and c.key_id == key_id:
2774
client = c
2775
break
2776
if fpr and c.fingerprint == fpr:
2045
2046
if command == 'init':
2047
fpr = request[1]
2048
address = request[2]
2049
2050
for c in self.clients.itervalues():
2051
if c.fingerprint == fpr:
2777
2052
client = c
2778
2053
break
2779
2054
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2055
logger.info("Client not found for fingerprint: %s, ad"
2056
"dress: %s", fpr, address)
2782
2057
if self.use_dbus:
2783
2058
# Emit D-Bus signal
2784
mandos_dbus_service.ClientNotFound(key_id or fpr,
2059
mandos_dbus_service.ClientNotFound(fpr,
2785
2060
address[0])
2786
2061
parent_pipe.send(False)
2787
2062
return False
2788
2789
GLib.io_add_watch(
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2792
functools.partial(self.handle_ipc,
2793
parent_pipe=parent_pipe,
2794
proc=proc,
2795
client_object=client))
2063
2064
gobject.io_add_watch(parent_pipe.fileno(),
2065
gobject.IO_IN | gobject.IO_HUP,
2066
functools.partial(self.handle_ipc,
2067
parent_pipe =
2068
parent_pipe,
2069
proc = proc,
2070
client_object =
2071
client))
2796
2072
parent_pipe.send(True)
2797
2073
# remove the old hook in favor of the new above hook on
2798
2074
# same fileno
2799
2075
return False
2800
if command == "funcall":
2076
if command == 'funcall':
2801
2077
funcname = request[1]
2802
2078
args = request[2]
2803
2079
kwargs = request[3]
2804
2805
parent_pipe.send(("data", getattr(client_object,
2080
2081
parent_pipe.send(('data', getattr(client_object,
2806
2082
funcname)(*args,
2807
**kwargs)))
2808
2809
if command == "getattr":
2083
**kwargs)))
2084
2085
if command == 'getattr':
2810
2086
attrname = request[1]
2811
if isinstance(client_object.__getattribute__(attrname),
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2087
if callable(client_object.__getattribute__(attrname)):
2088
parent_pipe.send(('function',))
2814
2089
else:
2815
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2817
2818
if command == "setattr":
2090
parent_pipe.send(('data', client_object
2091
.__getattribute__(attrname)))
2092
2093
if command == 'setattr':
2819
2094
attrname = request[1]
2820
2095
value = request[2]
2821
2096
setattr(client_object, attrname, value)
2822
2097
2823
2098
return True
2824
2099
2825
2100
2826
2101
def rfc3339_duration_to_delta(duration):
2827
2102
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2103
2104
>>> rfc3339_duration_to_delta("P7D")
2105
datetime.timedelta(7)
2106
>>> rfc3339_duration_to_delta("PT60S")
2107
datetime.timedelta(0, 60)
2108
>>> rfc3339_duration_to_delta("PT60M")
2109
datetime.timedelta(0, 3600)
2110
>>> rfc3339_duration_to_delta("PT24H")
2111
datetime.timedelta(1)
2112
>>> rfc3339_duration_to_delta("P1W")
2113
datetime.timedelta(7)
2114
>>> rfc3339_duration_to_delta("PT5M30S")
2115
datetime.timedelta(0, 330)
2116
>>> rfc3339_duration_to_delta("P1DT3M20S")
2117
datetime.timedelta(1, 200)
2845
2118
"""
2846
2119
2847
2120
# Parsing an RFC 3339 duration with regular expressions is not
2848
2121
# possible - there would have to be multiple places for the same
2849
2122
# values, like seconds. The current code, while more esoteric, is
2850
2123
# cleaner without depending on a parsing library. If Python had a
2851
2124
# built-in library for parsing we would use it, but we'd like to
2852
2125
# avoid excessive use of external libraries.
2853
2126
2854
2127
# New type for defining tokens, syntax, and semantics all-in-one
2855
Token = collections.namedtuple("Token", (
2856
"regexp", # To match token; if "value" is not None, must have
2857
# a "group" containing digits
2858
"value", # datetime.timedelta or None
2859
"followers")) # Tokens valid after this token
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2132
# containing digits
2133
"value", # datetime.timedelta or
2134
# None
2135
"followers")) # Tokens valid after
2136
# this token
2860
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2861
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2862
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2863
2140
token_second = Token(re.compile(r"(\d+)S"),
2864
2141
datetime.timedelta(seconds=1),
2865
frozenset((token_end, )))
2142
frozenset((token_end,)))
2866
2143
token_minute = Token(re.compile(r"(\d+)M"),
2867
2144
datetime.timedelta(minutes=1),
2868
2145
frozenset((token_second, token_end)))
2884
2161
frozenset((token_month, token_end)))
2885
2162
token_week = Token(re.compile(r"(\d+)W"),
2886
2163
datetime.timedelta(weeks=1),
2887
frozenset((token_end, )))
2164
frozenset((token_end,)))
2888
2165
token_duration = Token(re.compile(r"P"), None,
2889
2166
frozenset((token_year, token_month,
2890
2167
token_day, token_time,
2891
2168
token_week)))
2892
# Define starting values:
2893
# Value so far
2894
value = datetime.timedelta()
2169
# Define starting values
2170
value = datetime.timedelta() # Value so far
2895
2171
found_token = None
2896
# Following valid tokens
2897
followers = frozenset((token_duration, ))
2898
# String left to parse
2899
s = duration
2172
followers = frozenset((token_duration,)) # Following valid tokens
2173
s = duration # String left to parse
2900
2174
# Loop until end token is found
2901
2175
while found_token is not token_end:
2902
2176
# Search for any currently valid tokens
2918
2192
break
2919
2193
else:
2920
2194
# No currently valid tokens were found
2921
raise ValueError("Invalid RFC 3339 duration: {!r}"
2922
.format(duration))
2195
raise ValueError("Invalid RFC 3339 duration")
2923
2196
# End token found
2924
2197
return value
2925
2198
2926
2199
2927
2200
def string_to_delta(interval):
2928
2201
"""Parse a string and return a datetime.timedelta
2929
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2941
True
2202
2203
>>> string_to_delta('7d')
2204
datetime.timedelta(7)
2205
>>> string_to_delta('60s')
2206
datetime.timedelta(0, 60)
2207
>>> string_to_delta('60m')
2208
datetime.timedelta(0, 3600)
2209
>>> string_to_delta('24h')
2210
datetime.timedelta(1)
2211
>>> string_to_delta('1w')
2212
datetime.timedelta(7)
2213
>>> string_to_delta('5m 30s')
2214
datetime.timedelta(0, 330)
2942
2215
"""
2943
2216
2944
2217
try:
2945
2218
return rfc3339_duration_to_delta(interval)
2946
2219
except ValueError:
2947
2220
pass
2948
2221
2949
2222
timevalue = datetime.timedelta(0)
2950
2223
for s in interval.split():
2951
2224
try:
2962
2235
elif suffix == "w":
2963
2236
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2964
2237
else:
2965
raise ValueError("Unknown suffix {!r}".format(suffix))
2238
raise ValueError("Unknown suffix {!r}"
2239
.format(suffix))
2966
2240
except IndexError as e:
2967
2241
raise ValueError(*(e.args))
2968
2242
timevalue += delta
2969
2243
return timevalue
2970
2244
2971
2245
2972
def daemon(nochdir=False, noclose=False):
2246
def daemon(nochdir = False, noclose = False):
2973
2247
"""See daemon(3). Standard BSD Unix function.
2974
2248
2975
2249
This should really exist as os.daemon, but it doesn't (yet)."""
2976
2250
if os.fork():
2977
2251
sys.exit()
2984
2258
# Close all standard open file descriptors
2985
2259
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2986
2260
if not stat.S_ISCHR(os.fstat(null).st_mode):
2987
raise OSError(errno.ENODEV,
2988
"{} not a character device"
2261
raise OSError(errno.ENODEV, "{} not a character device"
2989
2262
.format(os.devnull))
2990
2263
os.dup2(null, sys.stdin.fileno())
2991
2264
os.dup2(null, sys.stdout.fileno())
2995
2268
2996
2269
2997
2270
def main():
2998
2271
2999
2272
##################################################################
3000
2273
# Parsing of options, both command line and config file
3001
2274
3002
2275
parser = argparse.ArgumentParser()
3003
2276
parser.add_argument("-v", "--version", action="version",
3004
version="%(prog)s {}".format(version),
2277
version = "%(prog)s {}".format(version),
3005
2278
help="show version number and exit")
3006
2279
parser.add_argument("-i", "--interface", metavar="IF",
3007
2280
help="Bind to interface IF")
3043
2316
parser.add_argument("--no-zeroconf", action="store_false",
3044
2317
dest="zeroconf", help="Do not use Zeroconf",
3045
2318
default=None)
3046
2319
3047
2320
options = parser.parse_args()
3048
2321
2322
if options.check:
2323
import doctest
2324
fail_count, test_count = doctest.testmod()
2325
sys.exit(os.EX_OK if fail_count == 0 else 1)
2326
3049
2327
# Default values for config file for server-global settings
3050
if gnutls.has_rawpk:
3051
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3052
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3053
else:
3054
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3055
":+SIGN-DSA-SHA256")
3056
server_defaults = {"interface": "",
3057
"address": "",
3058
"port": "",
3059
"debug": "False",
3060
"priority": priority,
3061
"servicename": "Mandos",
3062
"use_dbus": "True",
3063
"use_ipv6": "True",
3064
"debuglevel": "",
3065
"restore": "True",
3066
"socket": "",
3067
"statedir": "/var/lib/mandos",
3068
"foreground": "False",
3069
"zeroconf": "True",
3070
}
3071
del priority
3072
2328
server_defaults = { "interface": "",
2329
"address": "",
2330
"port": "",
2331
"debug": "False",
2332
"priority":
2333
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2334
"servicename": "Mandos",
2335
"use_dbus": "True",
2336
"use_ipv6": "True",
2337
"debuglevel": "",
2338
"restore": "True",
2339
"socket": "",
2340
"statedir": "/var/lib/mandos",
2341
"foreground": "False",
2342
"zeroconf": "True",
2343
}
2344
3073
2345
# Parse config file for server-global settings
3074
server_config = configparser.ConfigParser(server_defaults)
2346
server_config = configparser.SafeConfigParser(server_defaults)
3075
2347
del server_defaults
3076
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3077
# Convert the ConfigParser object to a dict
2348
server_config.read(os.path.join(options.configdir,
2349
"mandos.conf"))
2350
# Convert the SafeConfigParser object to a dict
3078
2351
server_settings = server_config.defaults()
3079
2352
# Use the appropriate methods on the non-string config options
3080
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3081
"foreground", "zeroconf"):
2353
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3082
2354
server_settings[option] = server_config.getboolean("DEFAULT",
3083
2355
option)
3084
2356
if server_settings["port"]:
3094
2366
server_settings["socket"] = os.dup(server_settings
3095
2367
["socket"])
3096
2368
del server_config
3097
2369
3098
2370
# Override the settings from the config file with command line
3099
2371
# options, if set.
3100
2372
for option in ("interface", "address", "port", "debug",
3101
"priority", "servicename", "configdir", "use_dbus",
3102
"use_ipv6", "debuglevel", "restore", "statedir",
3103
"socket", "foreground", "zeroconf"):
2373
"priority", "servicename", "configdir",
2374
"use_dbus", "use_ipv6", "debuglevel", "restore",
2375
"statedir", "socket", "foreground", "zeroconf"):
3104
2376
value = getattr(options, option)
3105
2377
if value is not None:
3106
2378
server_settings[option] = value
3118
2390
if server_settings["debug"]:
3119
2391
server_settings["foreground"] = True
3120
2392
# Now we have our good server settings in "server_settings"
3121
2393
3122
2394
##################################################################
3123
3124
if (not server_settings["zeroconf"]
3125
and not (server_settings["port"]
3126
or server_settings["socket"] != "")):
3127
parser.error("Needs port or socket to work without Zeroconf")
3128
2395
2396
if (not server_settings["zeroconf"] and
2397
not (server_settings["port"]
2398
or server_settings["socket"] != "")):
2399
parser.error("Needs port or socket to work without"
2400
" Zeroconf")
2401
3129
2402
# For convenience
3130
2403
debug = server_settings["debug"]
3131
2404
debuglevel = server_settings["debuglevel"]
3135
2408
stored_state_file)
3136
2409
foreground = server_settings["foreground"]
3137
2410
zeroconf = server_settings["zeroconf"]
3138
2411
3139
2412
if debug:
3140
2413
initlogger(debug, logging.DEBUG)
3141
2414
else:
3144
2417
else:
3145
2418
level = getattr(logging, debuglevel.upper())
3146
2419
initlogger(debug, level)
3147
2420
3148
2421
if server_settings["servicename"] != "Mandos":
3149
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3152
server_settings["servicename"])))
3153
2422
syslogger.setFormatter(logging.Formatter
2423
('Mandos ({}) [%(process)d]:'
2424
' %(levelname)s: %(message)s'
2425
.format(server_settings
2426
["servicename"])))
2427
3154
2428
# Parse config file with clients
3155
client_config = configparser.ConfigParser(Client.client_defaults)
2429
client_config = configparser.SafeConfigParser(Client
2430
.client_defaults)
3156
2431
client_config.read(os.path.join(server_settings["configdir"],
3157
2432
"clients.conf"))
3158
2433
3159
2434
global mandos_dbus_service
3160
2435
mandos_dbus_service = None
3161
2436
3162
2437
socketfd = None
3163
2438
if server_settings["socket"] != "":
3164
2439
socketfd = server_settings["socket"]
3165
tcp_server = MandosServer(
3166
(server_settings["address"], server_settings["port"]),
3167
ClientHandler,
3168
interface=(server_settings["interface"] or None),
3169
use_ipv6=use_ipv6,
3170
gnutls_priority=server_settings["priority"],
3171
use_dbus=use_dbus,
3172
socketfd=socketfd)
2440
tcp_server = MandosServer((server_settings["address"],
2441
server_settings["port"]),
2442
ClientHandler,
2443
interface=(server_settings["interface"]
2444
or None),
2445
use_ipv6=use_ipv6,
2446
gnutls_priority=
2447
server_settings["priority"],
2448
use_dbus=use_dbus,
2449
socketfd=socketfd)
3173
2450
if not foreground:
3174
2451
pidfilename = "/run/mandos.pid"
3175
2452
if not os.path.isdir("/run/."):
3176
2453
pidfilename = "/var/run/mandos.pid"
3177
2454
pidfile = None
3178
2455
try:
3179
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2456
pidfile = open(pidfilename, "w")
3180
2457
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3183
3184
for name, group in (("_mandos", "_mandos"),
3185
("mandos", "mandos"),
3186
("nobody", "nogroup")):
2458
logger.error("Could not open file %r", pidfilename,
2459
exc_info=e)
2460
2461
for name in ("_mandos", "mandos", "nobody"):
3187
2462
try:
3188
2463
uid = pwd.getpwnam(name).pw_uid
3189
gid = pwd.getpwnam(group).pw_gid
2464
gid = pwd.getpwnam(name).pw_gid
3190
2465
break
3191
2466
except KeyError:
3192
2467
continue
3196
2471
try:
3197
2472
os.setgid(gid)
3198
2473
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3200
2474
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3203
2475
if error.errno != errno.EPERM:
3204
2476
raise
3205
2477
3206
2478
if debug:
3207
2479
# Enable all possible GnuTLS debugging
3208
2480
3209
2481
# "Use a log level over 10 to enable all debugging options."
3210
2482
# - GnuTLS manual
3211
gnutls.global_set_log_level(11)
3212
3213
@gnutls.log_func
2483
gnutls.library.functions.gnutls_global_set_log_level(11)
2484
2485
@gnutls.library.types.gnutls_log_func
3214
2486
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3217
3218
gnutls.global_set_log_function(debug_gnutls)
3219
2487
logger.debug("GnuTLS: %s", string[:-1])
2488
2489
(gnutls.library.functions
2490
.gnutls_global_set_log_function(debug_gnutls))
2491
3220
2492
# Redirect stdin so all checkers get /dev/null
3221
2493
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3222
2494
os.dup2(null, sys.stdin.fileno())
3223
2495
if null > 2:
3224
2496
os.close(null)
3225
2497
3226
2498
# Need to fork before connecting to D-Bus
3227
2499
if not foreground:
3228
2500
# Close all input and output, do double fork, etc.
3229
2501
daemon()
3230
3231
if gi.version_info < (3, 10, 2):
3232
# multiprocessing will use threads, so before we use GLib we
3233
# need to inform GLib that threads will be used.
3234
GLib.threads_init()
3235
2502
2503
# multiprocessing will use threads, so before we use gobject we
2504
# need to inform gobject that threads will be used.
2505
gobject.threads_init()
2506
3236
2507
global main_loop
3237
2508
# From the Avahi example code
3238
2509
DBusGMainLoop(set_as_default=True)
3239
main_loop = GLib.MainLoop()
2510
main_loop = gobject.MainLoop()
3240
2511
bus = dbus.SystemBus()
3241
2512
# End of Avahi example code
3242
2513
if use_dbus:
3243
2514
try:
3244
2515
bus_name = dbus.service.BusName("se.recompile.Mandos",
3245
bus,
3246
do_not_queue=True)
3247
old_bus_name = dbus.service.BusName(
3248
"se.bsnet.fukt.Mandos", bus,
3249
do_not_queue=True)
3250
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
2516
bus, do_not_queue=True)
2517
old_bus_name = (dbus.service.BusName
2518
("se.bsnet.fukt.Mandos", bus,
2519
do_not_queue=True))
2520
except dbus.exceptions.NameExistsException as e:
2521
logger.error("Disabling D-Bus:", exc_info=e)
3252
2522
use_dbus = False
3253
2523
server_settings["use_dbus"] = False
3254
2524
tcp_server.use_dbus = False
3255
2525
if zeroconf:
3256
2526
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3257
service = AvahiServiceToSyslog(
3258
name=server_settings["servicename"],
3259
servicetype="_mandos._tcp",
3260
protocol=protocol,
3261
bus=bus)
2527
service = AvahiServiceToSyslog(name =
2528
server_settings["servicename"],
2529
servicetype = "_mandos._tcp",
2530
protocol = protocol, bus = bus)
3262
2531
if server_settings["interface"]:
3263
service.interface = if_nametoindex(
3264
server_settings["interface"].encode("utf-8"))
3265
2532
service.interface = (if_nametoindex
2533
(server_settings["interface"]
2534
.encode("utf-8")))
2535
3266
2536
global multiprocessing_manager
3267
2537
multiprocessing_manager = multiprocessing.Manager()
3268
2538
3269
2539
client_class = Client
3270
2540
if use_dbus:
3271
client_class = functools.partial(ClientDBus, bus=bus)
3272
2541
client_class = functools.partial(ClientDBus, bus = bus)
2542
3273
2543
client_settings = Client.config_parser(client_config)
3274
2544
old_client_settings = {}
3275
2545
clients_data = {}
3276
2546
3277
2547
# This is used to redirect stdout and stderr for checker processes
3278
2548
global wnull
3279
wnull = open(os.devnull, "w") # A writable /dev/null
2549
wnull = open(os.devnull, "w") # A writable /dev/null
3280
2550
# Only used if server is running in foreground but not in debug
3281
2551
# mode
3282
2552
if debug or not foreground:
3283
2553
wnull.close()
3284
2554
3285
2555
# Get client data and settings from last running state.
3286
2556
if server_settings["restore"]:
3287
2557
try:
3288
2558
with open(stored_state_path, "rb") as stored_state:
3289
if sys.version_info.major == 2:
3290
clients_data, old_client_settings = pickle.load(
3291
stored_state)
3292
else:
3293
bytes_clients_data, bytes_old_client_settings = (
3294
pickle.load(stored_state, encoding="bytes"))
3295
# Fix bytes to strings
3296
# clients_data
3297
# .keys()
3298
clients_data = {(key.decode("utf-8")
3299
if isinstance(key, bytes)
3300
else key): value
3301
for key, value in
3302
bytes_clients_data.items()}
3303
del bytes_clients_data
3304
for key in clients_data:
3305
value = {(k.decode("utf-8")
3306
if isinstance(k, bytes) else k): v
3307
for k, v in
3308
clients_data[key].items()}
3309
clients_data[key] = value
3310
# .client_structure
3311
value["client_structure"] = [
3312
(s.decode("utf-8")
3313
if isinstance(s, bytes)
3314
else s) for s in
3315
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3318
if isinstance(value[k], bytes):
3319
value[k] = value[k].decode("utf-8")
3320
if "key_id" not in value:
3321
value["key_id"] = ""
3322
elif "fingerprint" not in value:
3323
value["fingerprint"] = ""
3324
# old_client_settings
3325
# .keys()
3326
old_client_settings = {
3327
(key.decode("utf-8")
3328
if isinstance(key, bytes)
3329
else key): value
3330
for key, value in
3331
bytes_old_client_settings.items()}
3332
del bytes_old_client_settings
3333
# .host and .checker_command
3334
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3338
.decode("utf-8"))
2559
clients_data, old_client_settings = (pickle.load
2560
(stored_state))
3339
2561
os.remove(stored_state_path)
3340
2562
except IOError as e:
3341
2563
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
2564
logger.warning("Could not load persistent state: {}"
2565
.format(os.strerror(e.errno)))
3344
2566
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
2567
logger.critical("Could not load persistent state:",
2568
exc_info=e)
3347
2569
raise
3348
2570
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3351
2571
logger.warning("Could not load persistent state: "
2572
"EOFError:", exc_info=e)
2573
3352
2574
with PGPEngine() as pgp:
3353
2575
for client_name, client in clients_data.items():
3354
2576
# Skip removed clients
3355
2577
if client_name not in client_settings:
3356
2578
continue
3357
2579
3358
2580
# Decide which value to use after restoring saved state.
3359
2581
# We have three different values: Old config file,
3360
2582
# new config file, and saved state.
3365
2587
# For each value in new config, check if it
3366
2588
# differs from the old config value (Except for
3367
2589
# the "secret" attribute)
3368
if (name != "secret"
3369
and (value !=
3370
old_client_settings[client_name][name])):
2590
if (name != "secret" and
2591
value != old_client_settings[client_name]
2592
[name]):
3371
2593
client[name] = value
3372
2594
except KeyError:
3373
2595
pass
3374
2596
3375
2597
# Clients who has passed its expire date can still be
3376
# enabled if its last checker was successful. A Client
2598
# enabled if its last checker was successful. Clients
3377
2599
# whose checker succeeded before we stored its state is
3378
2600
# assumed to have successfully run all checkers during
3379
2601
# downtime.
3380
2602
if client["enabled"]:
3381
2603
if datetime.datetime.utcnow() >= client["expires"]:
3382
2604
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
2605
logger.warning(
2606
"disabling client {} - Client never "
2607
"performed a successful checker"
2608
.format(client_name))
3386
2609
client["enabled"] = False
3387
2610
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
2611
logger.warning(
2612
"disabling client {} - Client last"
2613
" checker failed with error code {}"
2614
.format(client_name,
2615
client["last_checker_status"]))
3392
2616
client["enabled"] = False
3393
2617
else:
3394
client["expires"] = (
3395
datetime.datetime.utcnow()
3396
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
2618
client["expires"] = (datetime.datetime
2619
.utcnow()
2620
+ client["timeout"])
2621
logger.debug("Last checker succeeded,"
2622
" keeping {} enabled"
2623
.format(client_name))
3399
2624
try:
3400
client["secret"] = pgp.decrypt(
3401
client["encrypted_secret"],
3402
client_settings[client_name]["secret"])
2625
client["secret"] = (
2626
pgp.decrypt(client["encrypted_secret"],
2627
client_settings[client_name]
2628
["secret"]))
3403
2629
except PGPError:
3404
2630
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3407
client["secret"] = (client_settings[client_name]
3408
["secret"])
3409
2631
logger.debug("Failed to decrypt {} old secret"
2632
.format(client_name))
2633
client["secret"] = (
2634
client_settings[client_name]["secret"])
2635
3410
2636
# Add/remove clients based on new changes made to config
3411
2637
for client_name in (set(old_client_settings)
3412
2638
- set(client_settings)):
3414
2640
for client_name in (set(client_settings)
3415
2641
- set(old_client_settings)):
3416
2642
clients_data[client_name] = client_settings[client_name]
3417
2643
3418
2644
# Create all client objects
3419
2645
for client_name, client in clients_data.items():
3420
2646
tcp_server.clients[client_name] = client_class(
3421
name=client_name,
3422
settings=client,
3423
server_settings=server_settings)
3424
2647
name = client_name, settings = client,
2648
server_settings = server_settings)
2649
3425
2650
if not tcp_server.clients:
3426
log.warning("No clients defined")
3427
2651
logger.warning("No clients defined")
2652
3428
2653
if not foreground:
3429
2654
if pidfile is not None:
3430
pid = os.getpid()
3431
2655
try:
3432
2656
with pidfile:
3433
print(pid, file=pidfile)
2657
pid = os.getpid()
2658
pidfile.write("{}\n".format(pid).encode("utf-8"))
3434
2659
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
2660
logger.error("Could not write to file %r with PID %d",
2661
pidfilename, pid)
3437
2662
del pidfile
3438
2663
del pidfilename
3439
3440
for termsig in (signal.SIGHUP, signal.SIGTERM):
3441
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3442
lambda: main_loop.quit() and False)
3443
2664
2665
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2666
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2667
3444
2668
if use_dbus:
3445
3446
@alternate_dbus_interfaces(
3447
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3448
class MandosDBusService(DBusObjectWithObjectManager):
2669
@alternate_dbus_interfaces({"se.recompile.Mandos":
2670
"se.bsnet.fukt.Mandos"})
2671
class MandosDBusService(DBusObjectWithProperties):
3449
2672
"""A D-Bus proxy object"""
3450
3451
2673
def __init__(self):
3452
2674
dbus.service.Object.__init__(self, bus, "/")
3453
3454
2675
_interface = "se.recompile.Mandos"
3455
2676
2677
@dbus_interface_annotations(_interface)
2678
def _foo(self):
2679
return { "org.freedesktop.DBus.Property"
2680
".EmitsChangedSignal":
2681
"false"}
2682
3456
2683
@dbus.service.signal(_interface, signature="o")
3457
2684
def ClientAdded(self, objpath):
3458
2685
"D-Bus signal"
3459
2686
pass
3460
2687
3461
2688
@dbus.service.signal(_interface, signature="ss")
3462
def ClientNotFound(self, key_id, address):
2689
def ClientNotFound(self, fingerprint, address):
3463
2690
"D-Bus signal"
3464
2691
pass
3465
3466
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3467
"true"})
2692
3468
2693
@dbus.service.signal(_interface, signature="os")
3469
2694
def ClientRemoved(self, objpath, name):
3470
2695
"D-Bus signal"
3471
2696
pass
3472
3473
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3474
"true"})
2697
3475
2698
@dbus.service.method(_interface, out_signature="ao")
3476
2699
def GetAllClients(self):
3477
2700
"D-Bus method"
3478
return dbus.Array(c.dbus_object_path for c in
3479
tcp_server.clients.values())
3480
3481
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3482
"true"})
2701
return dbus.Array(c.dbus_object_path
2702
for c in
2703
tcp_server.clients.itervalues())
2704
3483
2705
@dbus.service.method(_interface,
3484
2706
out_signature="a{oa{sv}}")
3485
2707
def GetAllClientsWithProperties(self):
3486
2708
"D-Bus method"
3487
2709
return dbus.Dictionary(
3488
{c.dbus_object_path: c.GetAll(
3489
"se.recompile.Mandos.Client")
3490
for c in tcp_server.clients.values()},
2710
((c.dbus_object_path, c.GetAll(""))
2711
for c in tcp_server.clients.itervalues()),
3491
2712
signature="oa{sv}")
3492
2713
3493
2714
@dbus.service.method(_interface, in_signature="o")
3494
2715
def RemoveClient(self, object_path):
3495
2716
"D-Bus method"
3496
for c in tcp_server.clients.values():
2717
for c in tcp_server.clients.itervalues():
3497
2718
if c.dbus_object_path == object_path:
3498
2719
del tcp_server.clients[c.name]
3499
2720
c.remove_from_connection()
3500
# Don't signal the disabling
2721
# Don't signal anything except ClientRemoved
3501
2722
c.disable(quiet=True)
3502
# Emit D-Bus signal for removal
3503
self.client_removed_signal(c)
2723
# Emit D-Bus signal
2724
self.ClientRemoved(object_path, c.name)
3504
2725
return
3505
2726
raise KeyError(object_path)
3506
2727
3507
2728
del _interface
3508
3509
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3510
out_signature="a{oa{sa{sv}}}")
3511
def GetManagedObjects(self):
3512
"""D-Bus method"""
3513
return dbus.Dictionary(
3514
{client.dbus_object_path:
3515
dbus.Dictionary(
3516
{interface: client.GetAll(interface)
3517
for interface in
3518
client._get_all_interface_names()})
3519
for client in tcp_server.clients.values()})
3520
3521
def client_added_signal(self, client):
3522
"""Send the new standard signal and the old signal"""
3523
if use_dbus:
3524
# New standard signal
3525
self.InterfacesAdded(
3526
client.dbus_object_path,
3527
dbus.Dictionary(
3528
{interface: client.GetAll(interface)
3529
for interface in
3530
client._get_all_interface_names()}))
3531
# Old signal
3532
self.ClientAdded(client.dbus_object_path)
3533
3534
def client_removed_signal(self, client):
3535
"""Send the new standard signal and the old signal"""
3536
if use_dbus:
3537
# New standard signal
3538
self.InterfacesRemoved(
3539
client.dbus_object_path,
3540
client._get_all_interface_names())
3541
# Old signal
3542
self.ClientRemoved(client.dbus_object_path,
3543
client.name)
3544
2729
3545
2730
mandos_dbus_service = MandosDBusService()
3546
3547
# Save modules to variables to exempt the modules from being
3548
# unloaded before the function registered with atexit() is run.
3549
mp = multiprocessing
3550
wn = wnull
3551
2731
3552
2732
def cleanup():
3553
2733
"Cleanup function; run on exit"
3554
2734
if zeroconf:
3555
2735
service.cleanup()
3556
3557
mp.active_children()
3558
wn.close()
2736
2737
multiprocessing.active_children()
2738
wnull.close()
3559
2739
if not (tcp_server.clients or client_settings):
3560
2740
return
3561
2741
3562
2742
# Store client before exiting. Secrets are encrypted with key
3563
2743
# based on what config file has. If config file is
3564
2744
# removed/edited, old secret will thus be unrecovable.
3565
2745
clients = {}
3566
2746
with PGPEngine() as pgp:
3567
for client in tcp_server.clients.values():
2747
for client in tcp_server.clients.itervalues():
3568
2748
key = client_settings[client.name]["secret"]
3569
2749
client.encrypted_secret = pgp.encrypt(client.secret,
3570
2750
key)
3571
2751
client_dict = {}
3572
2752
3573
2753
# A list of attributes that can not be pickled
3574
2754
# + secret.
3575
exclude = {"bus", "changedstate", "secret",
3576
"checker", "server_settings"}
3577
for name, typ in inspect.getmembers(dbus.service
3578
.Object):
2755
exclude = { "bus", "changedstate", "secret",
2756
"checker", "server_settings" }
2757
for name, typ in (inspect.getmembers
2758
(dbus.service.Object)):
3579
2759
exclude.add(name)
3580
2760
3581
2761
client_dict["encrypted_secret"] = (client
3582
2762
.encrypted_secret)
3583
2763
for attr in client.client_structure:
3584
2764
if attr not in exclude:
3585
2765
client_dict[attr] = getattr(client, attr)
3586
2766
3587
2767
clients[client.name] = client_dict
3588
2768
del client_settings[client.name]["secret"]
3589
2769
3590
2770
try:
3591
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3593
suffix=".pickle",
3594
prefix="clients-",
3595
dir=os.path.dirname(stored_state_path),
3596
delete=False) as stored_state:
3597
pickle.dump((clients, client_settings), stored_state,
3598
protocol=2)
3599
tempname = stored_state.name
2771
with (tempfile.NamedTemporaryFile
2772
(mode='wb', suffix=".pickle", prefix='clients-',
2773
dir=os.path.dirname(stored_state_path),
2774
delete=False)) as stored_state:
2775
pickle.dump((clients, client_settings), stored_state)
2776
tempname=stored_state.name
3600
2777
os.rename(tempname, stored_state_path)
3601
2778
except (IOError, OSError) as e:
3602
2779
if not debug:
3605
2782
except NameError:
3606
2783
pass
3607
2784
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
2785
logger.warning("Could not save persistent state: {}"
2786
.format(os.strerror(e.errno)))
3610
2787
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
2788
logger.warning("Could not save persistent state:",
2789
exc_info=e)
3613
2790
raise
3614
2791
3615
2792
# Delete all clients, and settings from config
3616
2793
while tcp_server.clients:
3617
2794
name, client = tcp_server.clients.popitem()
3618
2795
if use_dbus:
3619
2796
client.remove_from_connection()
3620
# Don't signal the disabling
2797
# Don't signal anything except ClientRemoved
3621
2798
client.disable(quiet=True)
3622
# Emit D-Bus signal for removal
3623
2799
if use_dbus:
3624
mandos_dbus_service.client_removed_signal(client)
2800
# Emit D-Bus signal
2801
mandos_dbus_service.ClientRemoved(client
2802
.dbus_object_path,
2803
client.name)
3625
2804
client_settings.clear()
3626
2805
3627
2806
atexit.register(cleanup)
3628
3629
for client in tcp_server.clients.values():
2807
2808
for client in tcp_server.clients.itervalues():
3630
2809
if use_dbus:
3631
# Emit D-Bus signal for adding
3632
mandos_dbus_service.client_added_signal(client)
2810
# Emit D-Bus signal
2811
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3633
2812
# Need to initiate checking of clients
3634
2813
if client.enabled:
3635
client.init_checker(randomize_start=True)
3636
2814
client.init_checker()
2815
3637
2816
tcp_server.enable()
3638
2817
tcp_server.server_activate()
3639
2818
3640
2819
# Find out what port we got
3641
2820
if zeroconf:
3642
2821
service.port = tcp_server.socket.getsockname()[1]
3643
2822
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
2823
logger.info("Now listening on address %r, port %d,"
2824
" flowinfo %d, scope_id %d",
2825
*tcp_server.socket.getsockname())
3646
2826
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3649
3650
# service.interface = tcp_server.socket.getsockname()[3]
3651
2827
logger.info("Now listening on address %r, port %d",
2828
*tcp_server.socket.getsockname())
2829
2830
#service.interface = tcp_server.socket.getsockname()[3]
2831
3652
2832
try:
3653
2833
if zeroconf:
3654
2834
# From the Avahi example code
3655
2835
try:
3656
2836
service.activate()
3657
2837
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
2838
logger.critical("D-Bus Exception", exc_info=error)
3659
2839
cleanup()
3660
2840
sys.exit(1)
3661
2841
# End of Avahi example code
3662
3663
GLib.io_add_watch(
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3668
3669
log.debug("Starting main loop")
2842
2843
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2844
lambda *args, **kwargs:
2845
(tcp_server.handle_request
2846
(*args[2:], **kwargs) or True))
2847
2848
logger.debug("Starting main loop")
3670
2849
main_loop.run()
3671
2850
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
2851
logger.critical("Avahi Error", exc_info=error)
3673
2852
cleanup()
3674
2853
sys.exit(1)
3675
2854
except KeyboardInterrupt:
3676
2855
if debug:
3677
2856
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
2857
logger.debug("Server received KeyboardInterrupt")
2858
logger.debug("Server exiting")
3680
2859
# Must run before the D-Bus bus name gets deregistered
3681
2860
cleanup()
3682
2861
3683
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3693
return args
3694
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3697
import doctest
3698
tests.addTests(doctest.DocTestSuite())
3699
return tests
3700
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3703
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3716
else:
3717
main()
3718
finally:
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
2862
if __name__ == '__main__':
2863
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0