/mandos/trunk : revision 738.1.1

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

39

import SocketServer as socketserver

47

40

import socket

48

41

import argparse

49

42

import datetime

50

43

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

55

51

import sys

56

52

import re

57

53

import os

66

62

import struct

67

63

import fcntl

68

64

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

65

import cPickle as pickle

73

66

import multiprocessing

74

67

import types

75

68

import binascii

76

69

import tempfile

77

70

import itertools

78

71

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

72

84

73

import dbus

85

74

import dbus.service

86

import gi

87

from gi.repository import GLib

75

import gobject

76

import avahi

88

77

from dbus.mainloop.glib import DBusGMainLoop

89

78

import ctypes

90

79

import ctypes.util

91

80

import xml.dom.minidom

92

81

import inspect

93

82

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

# Try to find the value of SO_BINDTODEVICE:

119

try:

120

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

121

# newer, and it is also the most natural place for it:

83

try:

122

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

123

85

except AttributeError:

124

86

try:

125

# This is where SO_BINDTODEVICE was up to and including Python

126

# 2.6, and also 3.2:

127

87

from IN import SO_BINDTODEVICE

128

88

except ImportError:

129

# In Python 2.7 it seems to have been removed entirely.

130

# Try running the C preprocessor:

131

try:

132

cc = subprocess.Popen(["cc", "--language=c", "-E",

133

"/dev/stdin"],

134

stdin=subprocess.PIPE,

135

stdout=subprocess.PIPE)

136

stdout = cc.communicate(

137

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

138

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

139

except (OSError, ValueError, IndexError):

140

# No value found

141

SO_BINDTODEVICE = None

142

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.14"

89

SO_BINDTODEVICE = None

90

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

147

95

stored_state_file = "clients.pickle"

148

96

149

97

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

98

syslogger = None

152

99

153

100

try:

154

if_nametoindex = ctypes.cdll.LoadLibrary(

155

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

156

104

except (OSError, AttributeError):

157

158

105

def if_nametoindex(interface):

159

106

"Get an interface index the hard way, i.e. using fcntl()"

160

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

165

112

return interface_index

166

113

167

114

168

def copy_function(func):

169

"""Make a copy of a function"""

170

if sys.version_info.major == 2:

171

return types.FunctionType(func.func_code,

172

func.func_globals,

173

func.func_name,

174

func.func_defaults,

175

func.func_closure)

176

else:

177

return types.FunctionType(func.__code__,

178

func.__globals__,

179

func.__name__,

180

func.__defaults__,

181

func.__closure__)

182

183

184

115

def initlogger(debug, level=logging.WARNING):

185

116

"""init logger and add loglevel"""

186

117

187

118

global syslogger

188

syslogger = (logging.handlers.SysLogHandler(

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

191

123

syslogger.setFormatter(logging.Formatter

192

124

('Mandos [%(process)d]: %(levelname)s:'

193

125

' %(message)s'))

194

126

logger.addHandler(syslogger)

195

127

196

128

if debug:

197

129

console = logging.StreamHandler()

198

130

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

208

140

pass

209

141

210

142

211

class PGPEngine:

143

class PGPEngine(object):

212

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

214

145

def __init__(self):

215

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

216

self.gpg = "gpg"

217

try:

218

output = subprocess.check_output(["gpgconf"])

219

for line in output.splitlines():

220

name, text, path = line.split(b":")

221

if name == b"gpg":

222

self.gpg = path

223

break

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

147

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

148

'--home', self.tempdir,

229

149

'--force-mdc',

230

'--quiet']

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

234

150

'--quiet',

151

'--no-use-agent']

152

235

153

def __enter__(self):

236

154

return self

237

155

238

156

def __exit__(self, exc_type, exc_value, traceback):

239

157

self._cleanup()

240

158

return False

241

159

242

160

def __del__(self):

243

161

self._cleanup()

244

162

245

163

def _cleanup(self):

246

164

if self.tempdir is not None:

247

165

# Delete contents of tempdir

248

166

for root, dirs, files in os.walk(self.tempdir,

249

topdown=False):

167

topdown = False):

250

168

for filename in files:

251

169

os.remove(os.path.join(root, filename))

252

170

for dirname in dirs:

254

172

# Remove tempdir

255

173

os.rmdir(self.tempdir)

256

174

self.tempdir = None

257

175

258

176

def password_encode(self, password):

259

177

# Passphrase can not be empty and can not contain newlines or

260

178

# NUL bytes. So we prefix it and hex encode it.

265

183

.replace(b"\n", b"\\n")

266

184

.replace(b"\0", b"\\x00"))

267

185

return encoded

268

186

269

187

def encrypt(self, data, password):

270

188

passphrase = self.password_encode(password)

271

with tempfile.NamedTemporaryFile(

272

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

273

191

passfile.write(passphrase)

274

192

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

193

proc = subprocess.Popen(['gpg', '--symmetric',

276

194

'--passphrase-file',

277

195

passfile.name]

278

196

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

280

stdout=subprocess.PIPE,

281

stderr=subprocess.PIPE)

282

ciphertext, err = proc.communicate(input=data)

197

stdin = subprocess.PIPE,

198

stdout = subprocess.PIPE,

199

stderr = subprocess.PIPE)

200

ciphertext, err = proc.communicate(input = data)

283

201

if proc.returncode != 0:

284

202

raise PGPError(err)

285

203

return ciphertext

286

204

287

205

def decrypt(self, data, password):

288

206

passphrase = self.password_encode(password)

289

with tempfile.NamedTemporaryFile(

290

dir=self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

291

209

passfile.write(passphrase)

292

210

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

211

proc = subprocess.Popen(['gpg', '--decrypt',

294

212

'--passphrase-file',

295

213

passfile.name]

296

214

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

298

stdout=subprocess.PIPE,

299

stderr=subprocess.PIPE)

300

decrypted_plaintext, err = proc.communicate(input=data)

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

301

220

if proc.returncode != 0:

302

221

raise PGPError(err)

303

222

return decrypted_plaintext

304

223

305

224

306

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

309

IF_UNSPEC = -1 # avahi-common/address.h

310

PROTO_UNSPEC = -1 # avahi-common/address.h

311

PROTO_INET = 0 # avahi-common/address.h

312

PROTO_INET6 = 1 # avahi-common/address.h

313

DBUS_NAME = "org.freedesktop.Avahi"

314

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

315

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

DBUS_PATH_SERVER = "/"

317

318

@staticmethod

319

def string_array_to_txt_array(t):

320

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

for s in t), signature="ay")

322

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

323

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

324

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

325

SERVER_INVALID = 0 # avahi-common/defs.h

326

SERVER_REGISTERING = 1 # avahi-common/defs.h

327

SERVER_RUNNING = 2 # avahi-common/defs.h

328

SERVER_COLLISION = 3 # avahi-common/defs.h

329

SERVER_FAILURE = 4 # avahi-common/defs.h

330

331

332

225

class AvahiError(Exception):

333

226

def __init__(self, value, *args, **kwargs):

334

227

self.value = value

335

228

return super(AvahiError, self).__init__(value, *args,

336

229

**kwargs)

337

230

338

339

231

class AvahiServiceError(AvahiError):

340

232

pass

341

233

342

343

234

class AvahiGroupError(AvahiError):

344

235

pass

345

236

346

237

347

class AvahiService:

238

class AvahiService(object):

348

239

"""An Avahi (Zeroconf) service.

349

240

350

241

Attributes:

351

242

interface: integer; avahi.IF_UNSPEC or an interface index.

352

243

Used to optionally bind to the specified interface.

364

255

server: D-Bus Server

365

256

bus: dbus.SystemBus()

366

257

"""

367

368

def __init__(self,

369

interface=avahi.IF_UNSPEC,

370

name=None,

371

servicetype=None,

372

port=None,

373

TXT=None,

374

domain="",

375

host="",

376

max_renames=32768,

377

protocol=avahi.PROTO_UNSPEC,

378

bus=None):

258

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

379

263

self.interface = interface

380

264

self.name = name

381

265

self.type = servicetype

390

274

self.server = None

391

275

self.bus = bus

392

276

self.entry_group_state_changed_match = None

393

277

394

278

def rename(self, remove=True):

395

279

"""Derived from the Avahi example code"""

396

280

if self.rename_count >= self.max_renames:

398

282

" after %i retries, exiting.",

399

283

self.rename_count)

400

284

raise AvahiServiceError("Too many renames")

401

self.name = str(

402

self.server.GetAlternativeServiceName(self.name))

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

403

287

self.rename_count += 1

404

288

logger.info("Changing Zeroconf service name to %r ...",

405

289

self.name)

416

300

logger.critical("D-Bus Exception", exc_info=error)

417

301

self.cleanup()

418

302

os._exit(1)

419

303

420

304

def remove(self):

421

305

"""Derived from the Avahi example code"""

422

306

if self.entry_group_state_changed_match is not None:

424

308

self.entry_group_state_changed_match = None

425

309

if self.group is not None:

426

310

self.group.Reset()

427

311

428

312

def add(self):

429

313

"""Derived from the Avahi example code"""

430

314

self.remove()

447

331

dbus.UInt16(self.port),

448

332

avahi.string_array_to_txt_array(self.TXT))

449

333

self.group.Commit()

450

334

451

335

def entry_group_state_changed(self, state, error):

452

336

"""Derived from the Avahi example code"""

453

337

logger.debug("Avahi entry group state change: %i", state)

454

338

455

339

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

340

logger.debug("Zeroconf service established.")

457

341

elif state == avahi.ENTRY_GROUP_COLLISION:

460

344

elif state == avahi.ENTRY_GROUP_FAILURE:

461

345

logger.critical("Avahi: Error in group state changed %s",

462

346

str(error))

463

raise AvahiGroupError("State changed: {!s}".format(error))

464

347

raise AvahiGroupError("State changed: {!s}"

348

.format(error))

349

465

350

def cleanup(self):

466

351

"""Derived from the Avahi example code"""

467

352

if self.group is not None:

472

357

pass

473

358

self.group = None

474

359

self.remove()

475

360

476

361

def server_state_changed(self, state, error=None):

477

362

"""Derived from the Avahi example code"""

478

363

logger.debug("Avahi server state change: %i", state)

479

bad_states = {

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

avahi.SERVER_REGISTERING: None,

482

avahi.SERVER_COLLISION: "Zeroconf server name collision",

483

avahi.SERVER_FAILURE: "Zeroconf server failure",

484

}

364

bad_states = { avahi.SERVER_INVALID:

365

"Zeroconf server invalid",

366

avahi.SERVER_REGISTERING: None,

367

avahi.SERVER_COLLISION:

368

"Zeroconf server name collision",

369

avahi.SERVER_FAILURE:

370

"Zeroconf server failure" }

485

371

if state in bad_states:

486

372

if bad_states[state] is not None:

487

373

if error is None:

490

376

logger.error(bad_states[state] + ": %r", error)

491

377

self.cleanup()

492

378

elif state == avahi.SERVER_RUNNING:

493

try:

494

self.add()

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

logger.info("Local Zeroconf service name"

499

" collision.")

500

return self.rename(remove=False)

501

else:

502

logger.critical("D-Bus Exception", exc_info=error)

503

self.cleanup()

504

os._exit(1)

379

self.add()

505

380

else:

506

381

if error is None:

507

382

logger.debug("Unknown state: %r", state)

508

383

else:

509

384

logger.debug("Unknown state: %r: %r", state, error)

510

385

511

386

def activate(self):

512

387

"""Derived from the Avahi example code"""

513

388

if self.server is None:

517

392

follow_name_owner_changes=True),

518

393

avahi.DBUS_INTERFACE_SERVER)

519

394

self.server.connect_to_signal("StateChanged",

520

self.server_state_changed)

395

self.server_state_changed)

521

396

self.server_state_changed(self.server.GetState())

522

397

523

398

524

399

class AvahiServiceToSyslog(AvahiService):

525

400

def rename(self, *args, **kwargs):

526

401

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

529

syslogger.setFormatter(logging.Formatter(

530

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

.format(self.name)))

402

ret = AvahiService.rename(self, *args, **kwargs)

403

syslogger.setFormatter(logging.Formatter

404

('Mandos ({}) [%(process)d]:'

405

' %(levelname)s: %(message)s'

406

.format(self.name)))

532

407

return ret

533

408

534

409

535

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

538

539

library = ctypes.util.find_library("gnutls")

540

if library is None:

541

library = ctypes.util.find_library("gnutls-deb0")

542

_library = ctypes.cdll.LoadLibrary(library)

543

del library

544

545

# Unless otherwise indicated, the constants and types below are

546

# all from the gnutls/gnutls.h C header file.

547

548

# Constants

549

E_SUCCESS = 0

550

E_INTERRUPTED = -52

551

E_AGAIN = -28

552

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

CLIENT = 2

555

SHUT_RDWR = 0

556

CRD_CERTIFICATE = 1

557

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

565

# Types

566

class session_int(ctypes.Structure):

567

_fields_ = []

568

session_t = ctypes.POINTER(session_int)

569

570

class certificate_credentials_st(ctypes.Structure):

571

_fields_ = []

572

certificate_credentials_t = ctypes.POINTER(

573

certificate_credentials_st)

574

certificate_type_t = ctypes.c_int

575

576

class datum_t(ctypes.Structure):

577

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

578

('size', ctypes.c_uint)]

579

580

class openpgp_crt_int(ctypes.Structure):

581

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

credentials_type_t = ctypes.c_int

586

transport_ptr_t = ctypes.c_void_p

587

close_request_t = ctypes.c_int

588

589

# Exceptions

590

class Error(Exception):

591

def __init__(self, message=None, code=None, args=()):

592

# Default usage is by a message string, but if a return

593

# code is passed, convert it to a string with

594

# gnutls.strerror()

595

self.code = code

596

if message is None and code is not None:

597

message = gnutls.strerror(code)

598

return super(gnutls.Error, self).__init__(

599

message, *args)

600

601

class CertificateSecurityError(Error):

602

pass

603

604

# Classes

605

class Credentials:

606

def __init__(self):

607

self._c_object = gnutls.certificate_credentials_t()

608

gnutls.certificate_allocate_credentials(

609

ctypes.byref(self._c_object))

610

self.type = gnutls.CRD_CERTIFICATE

611

612

def __del__(self):

613

gnutls.certificate_free_credentials(self._c_object)

614

615

class ClientSession:

616

def __init__(self, socket, credentials=None):

617

self._c_object = gnutls.session_t()

618

gnutls_flags = gnutls.CLIENT

619

if gnutls.check_version(b"3.5.6"):

620

gnutls_flags |= gnutls.NO_TICKETS

621

if gnutls.has_rawpk:

622

gnutls_flags |= gnutls.ENABLE_RAWPK

623

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

624

del gnutls_flags

625

gnutls.set_default_priority(self._c_object)

626

gnutls.transport_set_ptr(self._c_object, socket.fileno())

627

gnutls.handshake_set_private_extensions(self._c_object,

628

True)

629

self.socket = socket

630

if credentials is None:

631

credentials = gnutls.Credentials()

632

gnutls.credentials_set(self._c_object, credentials.type,

633

ctypes.cast(credentials._c_object,

634

ctypes.c_void_p))

635

self.credentials = credentials

636

637

def __del__(self):

638

gnutls.deinit(self._c_object)

639

640

def handshake(self):

641

return gnutls.handshake(self._c_object)

642

643

def send(self, data):

644

data = bytes(data)

645

data_len = len(data)

646

while data_len > 0:

647

data_len -= gnutls.record_send(self._c_object,

648

data[-data_len:],

649

data_len)

650

651

def bye(self):

652

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

653

654

# Error handling functions

655

def _error_code(result):

656

"""A function to raise exceptions on errors, suitable

657

for the 'restype' attribute on ctypes functions"""

658

if result >= 0:

659

return result

660

if result == gnutls.E_NO_CERTIFICATE_FOUND:

661

raise gnutls.CertificateSecurityError(code=result)

662

raise gnutls.Error(code=result)

663

664

def _retry_on_error(result, func, arguments):

665

"""A function to retry on some errors, suitable

666

for the 'errcheck' attribute on ctypes functions"""

667

while result < 0:

668

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

669

return _error_code(result)

670

result = func(*arguments)

671

return result

672

673

# Unless otherwise indicated, the function declarations below are

674

# all from the gnutls/gnutls.h C header file.

675

676

# Functions

677

priority_set_direct = _library.gnutls_priority_set_direct

678

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

679

ctypes.POINTER(ctypes.c_char_p)]

680

priority_set_direct.restype = _error_code

681

682

init = _library.gnutls_init

683

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

684

init.restype = _error_code

685

686

set_default_priority = _library.gnutls_set_default_priority

687

set_default_priority.argtypes = [session_t]

688

set_default_priority.restype = _error_code

689

690

record_send = _library.gnutls_record_send

691

record_send.argtypes = [session_t, ctypes.c_void_p,

692

ctypes.c_size_t]

693

record_send.restype = ctypes.c_ssize_t

694

record_send.errcheck = _retry_on_error

695

696

certificate_allocate_credentials = (

697

_library.gnutls_certificate_allocate_credentials)

698

certificate_allocate_credentials.argtypes = [

699

ctypes.POINTER(certificate_credentials_t)]

700

certificate_allocate_credentials.restype = _error_code

701

702

certificate_free_credentials = (

703

_library.gnutls_certificate_free_credentials)

704

certificate_free_credentials.argtypes = [

705

certificate_credentials_t]

706

certificate_free_credentials.restype = None

707

708

handshake_set_private_extensions = (

709

_library.gnutls_handshake_set_private_extensions)

710

handshake_set_private_extensions.argtypes = [session_t,

711

ctypes.c_int]

712

handshake_set_private_extensions.restype = None

713

714

credentials_set = _library.gnutls_credentials_set

715

credentials_set.argtypes = [session_t, credentials_type_t,

716

ctypes.c_void_p]

717

credentials_set.restype = _error_code

718

719

strerror = _library.gnutls_strerror

720

strerror.argtypes = [ctypes.c_int]

721

strerror.restype = ctypes.c_char_p

722

723

certificate_type_get = _library.gnutls_certificate_type_get

724

certificate_type_get.argtypes = [session_t]

725

certificate_type_get.restype = _error_code

726

727

certificate_get_peers = _library.gnutls_certificate_get_peers

728

certificate_get_peers.argtypes = [session_t,

729

ctypes.POINTER(ctypes.c_uint)]

730

certificate_get_peers.restype = ctypes.POINTER(datum_t)

731

732

global_set_log_level = _library.gnutls_global_set_log_level

733

global_set_log_level.argtypes = [ctypes.c_int]

734

global_set_log_level.restype = None

735

736

global_set_log_function = _library.gnutls_global_set_log_function

737

global_set_log_function.argtypes = [log_func]

738

global_set_log_function.restype = None

739

740

deinit = _library.gnutls_deinit

741

deinit.argtypes = [session_t]

742

deinit.restype = None

743

744

handshake = _library.gnutls_handshake

745

handshake.argtypes = [session_t]

746

handshake.restype = _error_code

747

handshake.errcheck = _retry_on_error

748

749

transport_set_ptr = _library.gnutls_transport_set_ptr

750

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

751

transport_set_ptr.restype = None

752

753

bye = _library.gnutls_bye

754

bye.argtypes = [session_t, close_request_t]

755

bye.restype = _error_code

756

bye.errcheck = _retry_on_error

757

758

check_version = _library.gnutls_check_version

759

check_version.argtypes = [ctypes.c_char_p]

760

check_version.restype = ctypes.c_char_p

761

762

_need_version = b"3.3.0"

763

if check_version(_need_version) is None:

764

raise self.Error("Needs GnuTLS {} or later"

765

.format(_need_version))

766

767

_tls_rawpk_version = b"3.6.6"

768

has_rawpk = bool(check_version(_tls_rawpk_version))

769

770

if has_rawpk:

771

# Types

772

class pubkey_st(ctypes.Structure):

773

_fields = []

774

pubkey_t = ctypes.POINTER(pubkey_st)

775

776

x509_crt_fmt_t = ctypes.c_int

777

778

# All the function declarations below are from

779

# gnutls/abstract.h

780

pubkey_init = _library.gnutls_pubkey_init

781

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

782

pubkey_init.restype = _error_code

783

784

pubkey_import = _library.gnutls_pubkey_import

785

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

786

x509_crt_fmt_t]

787

pubkey_import.restype = _error_code

788

789

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

790

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

791

ctypes.POINTER(ctypes.c_ubyte),

792

ctypes.POINTER(ctypes.c_size_t)]

793

pubkey_get_key_id.restype = _error_code

794

795

pubkey_deinit = _library.gnutls_pubkey_deinit

796

pubkey_deinit.argtypes = [pubkey_t]

797

pubkey_deinit.restype = None

798

else:

799

# All the function declarations below are from

800

# gnutls/openpgp.h

801

802

openpgp_crt_init = _library.gnutls_openpgp_crt_init

803

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

804

openpgp_crt_init.restype = _error_code

805

806

openpgp_crt_import = _library.gnutls_openpgp_crt_import

807

openpgp_crt_import.argtypes = [openpgp_crt_t,

808

ctypes.POINTER(datum_t),

809

openpgp_crt_fmt_t]

810

openpgp_crt_import.restype = _error_code

811

812

openpgp_crt_verify_self = \

813

_library.gnutls_openpgp_crt_verify_self

814

openpgp_crt_verify_self.argtypes = [

815

openpgp_crt_t,

816

ctypes.c_uint,

817

ctypes.POINTER(ctypes.c_uint),

818

]

819

openpgp_crt_verify_self.restype = _error_code

820

821

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

822

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

823

openpgp_crt_deinit.restype = None

824

825

openpgp_crt_get_fingerprint = (

826

_library.gnutls_openpgp_crt_get_fingerprint)

827

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

828

ctypes.c_void_p,

829

ctypes.POINTER(

830

ctypes.c_size_t)]

831

openpgp_crt_get_fingerprint.restype = _error_code

832

833

if check_version(b"3.6.4"):

834

certificate_type_get2 = _library.gnutls_certificate_type_get2

835

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

836

certificate_type_get2.restype = _error_code

837

838

# Remove non-public functions

839

del _error_code, _retry_on_error

840

841

842

def call_pipe(connection, # : multiprocessing.Connection

843

func, *args, **kwargs):

844

"""This function is meant to be called by multiprocessing.Process

845

846

This function runs func(*args, **kwargs), and writes the resulting

847

return value on the provided multiprocessing.Connection.

848

"""

849

connection.send(func(*args, **kwargs))

850

connection.close()

851

852

853

class Client:

410

class Client(object):

854

411

"""A representation of a client host served by this server.

855

412

856

413

Attributes:

857

414

approved: bool(); 'None' if not yet approved/disapproved

858

415

approval_delay: datetime.timedelta(); Time to wait for approval

859

416

approval_duration: datetime.timedelta(); Duration of one approval

860

checker: multiprocessing.Process(); a running checker process used

861

to see if the client lives. 'None' if no process is

862

running.

863

checker_callback_tag: a GLib event source tag, or None

417

checker: subprocess.Popen(); a running checker process used

418

to see if the client lives.

419

'None' if no process is running.

420

checker_callback_tag: a gobject event source tag, or None

864

421

checker_command: string; External command which is run to check

865

422

if client lives. %() expansions are done at

866

423

runtime with vars(self) as dict, so that for

867

424

instance %(name)s can be used in the command.

868

checker_initiator_tag: a GLib event source tag, or None

425

checker_initiator_tag: a gobject event source tag, or None

869

426

created: datetime.datetime(); (UTC) object creation

870

427

client_structure: Object describing what attributes a client has

871

428

and is used for storing the client at exit

872

429

current_checker_command: string; current running checker_command

873

disable_initiator_tag: a GLib event source tag, or None

430

disable_initiator_tag: a gobject event source tag, or None

874

431

enabled: bool()

875

432

fingerprint: string (40 or 32 hexadecimal digits); used to

876

uniquely identify an OpenPGP client

877

key_id: string (64 hexadecimal digits); used to uniquely identify

878

a client using raw public keys

433

uniquely identify the client

879

434

host: string; available for use by the checker command

880

435

interval: datetime.timedelta(); How often to start a new checker

881

436

last_approval_request: datetime.datetime(); (UTC) or None

883

438

last_checker_status: integer between 0 and 255 reflecting exit

884

439

status of last checker. -1 reflects crashed

885

440

checker, -2 means no checker completed yet.

886

last_checker_signal: The signal which killed the last checker, if

887

last_checker_status is -1

888

441

last_enabled: datetime.datetime(); (UTC) or None

889

442

name: string; from the config file, used in log messages and

890

443

D-Bus identifiers

897

450

disabled, or None

898

451

server_settings: The server_settings dict from main()

899

452

"""

900

453

901

454

runtime_expansions = ("approval_delay", "approval_duration",

902

"created", "enabled", "expires", "key_id",

455

"created", "enabled", "expires",

903

456

"fingerprint", "host", "interval",

904

457

"last_approval_request", "last_checked_ok",

905

458

"last_enabled", "name", "timeout")

906

client_defaults = {

907

"timeout": "PT5M",

908

"extended_timeout": "PT15M",

909

"interval": "PT2M",

910

"checker": "fping -q -- %%(host)s",

911

"host": "",

912

"approval_delay": "PT0S",

913

"approval_duration": "PT1S",

914

"approved_by_default": "True",

915

"enabled": "True",

916

}

917

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

469

918

470

@staticmethod

919

471

def config_parser(config):

920

472

"""Construct a new dict of client settings of this form:

927

479

for client_name in config.sections():

928

480

section = dict(config.items(client_name))

929

481

client = settings[client_name] = {}

930

482

931

483

client["host"] = section["host"]

932

484

# Reformat values from string types to Python types

933

485

client["approved_by_default"] = config.getboolean(

934

486

client_name, "approved_by_default")

935

487

client["enabled"] = config.getboolean(client_name,

936

488

"enabled")

937

938

# Uppercase and remove spaces from key_id and fingerprint

939

# for later comparison purposes with return value from the

940

# key_id() and fingerprint() functions

941

client["key_id"] = (section.get("key_id", "").upper()

942

.replace(" ", ""))

489

943

490

client["fingerprint"] = (section["fingerprint"].upper()

944

491

.replace(" ", ""))

945

492

if "secret" in section:

946

client["secret"] = codecs.decode(section["secret"]

947

.encode("utf-8"),

948

"base64")

493

client["secret"] = section["secret"].decode("base64")

949

494

elif "secfile" in section:

950

495

with open(os.path.expanduser(os.path.expandvars

951

496

(section["secfile"])),

966

511

client["last_approval_request"] = None

967

512

client["last_checked_ok"] = None

968

513

client["last_checker_status"] = -2

969

514

970

515

return settings

971

972

def __init__(self, settings, name=None, server_settings=None):

516

517

def __init__(self, settings, name = None, server_settings=None):

973

518

self.name = name

974

519

if server_settings is None:

975

520

server_settings = {}

977

522

# adding all client settings

978

523

for setting, value in settings.items():

979

524

setattr(self, setting, value)

980

525

981

526

if self.enabled:

982

527

if not hasattr(self, "last_enabled"):

983

528

self.last_enabled = datetime.datetime.utcnow()

987

532

else:

988

533

self.last_enabled = None

989

534

self.expires = None

990

535

991

536

logger.debug("Creating client %r", self.name)

992

logger.debug(" Key ID: %s", self.key_id)

537

# Uppercase and remove spaces from fingerprint for later

538

# comparison purposes with return value from the fingerprint()

539

# function

993

540

logger.debug(" Fingerprint: %s", self.fingerprint)

994

541

self.created = settings.get("created",

995

542

datetime.datetime.utcnow())

996

543

997

544

# attributes specific for this server instance

998

545

self.checker = None

999

546

self.checker_initiator_tag = None

1002

549

self.current_checker_command = None

1003

550

self.approved = None

1004

551

self.approvals_pending = 0

1005

self.changedstate = multiprocessing_manager.Condition(

1006

multiprocessing_manager.Lock())

1007

self.client_structure = [attr

1008

for attr in self.__dict__.keys()

552

self.changedstate = (multiprocessing_manager

553

.Condition(multiprocessing_manager

554

.Lock()))

555

self.client_structure = [attr for attr in

556

self.__dict__.iterkeys()

1009

557

if not attr.startswith("_")]

1010

558

self.client_structure.append("client_structure")

1011

1012

for name, t in inspect.getmembers(

1013

type(self), lambda obj: isinstance(obj, property)):

559

560

for name, t in inspect.getmembers(type(self),

561

lambda obj:

562

isinstance(obj,

563

property)):

1014

564

if not name.startswith("_"):

1015

565

self.client_structure.append(name)

1016

566

1017

567

# Send notice to process children that client state has changed

1018

568

def send_changedstate(self):

1019

569

with self.changedstate:

1020

570

self.changedstate.notify_all()

1021

571

1022

572

def enable(self):

1023

573

"""Start this client's checker and timeout hooks"""

1024

574

if getattr(self, "enabled", False):

1029

579

self.last_enabled = datetime.datetime.utcnow()

1030

580

self.init_checker()

1031

581

self.send_changedstate()

1032

582

1033

583

def disable(self, quiet=True):

1034

584

"""Disable this client."""

1035

585

if not getattr(self, "enabled", False):

1037

587

if not quiet:

1038

588

logger.info("Disabling client %s", self.name)

1039

589

if getattr(self, "disable_initiator_tag", None) is not None:

1040

GLib.source_remove(self.disable_initiator_tag)

590

gobject.source_remove(self.disable_initiator_tag)

1041

591

self.disable_initiator_tag = None

1042

592

self.expires = None

1043

593

if getattr(self, "checker_initiator_tag", None) is not None:

1044

GLib.source_remove(self.checker_initiator_tag)

594

gobject.source_remove(self.checker_initiator_tag)

1045

595

self.checker_initiator_tag = None

1046

596

self.stop_checker()

1047

597

self.enabled = False

1048

598

if not quiet:

1049

599

self.send_changedstate()

1050

# Do not run this again if called by a GLib.timeout_add

600

# Do not run this again if called by a gobject.timeout_add

1051

601

return False

1052

602

1053

603

def __del__(self):

1054

604

self.disable()

1055

605

1056

606

def init_checker(self):

1057

607

# Schedule a new checker to be started an 'interval' from now,

1058

608

# and every interval from then on.

1059

609

if self.checker_initiator_tag is not None:

1060

GLib.source_remove(self.checker_initiator_tag)

1061

self.checker_initiator_tag = GLib.timeout_add(

1062

random.randrange(int(self.interval.total_seconds() * 1000

1063

+ 1)),

1064

self.start_checker)

610

gobject.source_remove(self.checker_initiator_tag)

611

self.checker_initiator_tag = (gobject.timeout_add

612

(int(self.interval

613

.total_seconds() * 1000),

614

self.start_checker))

1065

615

# Schedule a disable() when 'timeout' has passed

1066

616

if self.disable_initiator_tag is not None:

1067

GLib.source_remove(self.disable_initiator_tag)

1068

self.disable_initiator_tag = GLib.timeout_add(

1069

int(self.timeout.total_seconds() * 1000), self.disable)

617

gobject.source_remove(self.disable_initiator_tag)

618

self.disable_initiator_tag = (gobject.timeout_add

619

(int(self.timeout

620

.total_seconds() * 1000),

621

self.disable))

1070

622

# Also start a new checker *right now*.

1071

623

self.start_checker()

1072

1073

def checker_callback(self, source, condition, connection,

1074

command):

624

625

def checker_callback(self, pid, condition, command):

1075

626

"""The checker has completed, so take appropriate actions."""

1076

# Read return code from connection (see call_pipe)

1077

returncode = connection.recv()

1078

connection.close()

1079

if self.checker is not None:

1080

self.checker.join()

1081

627

self.checker_callback_tag = None

1082

628

self.checker = None

1083

1084

if returncode >= 0:

1085

self.last_checker_status = returncode

1086

self.last_checker_signal = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

1087

631

if self.last_checker_status == 0:

1088

632

logger.info("Checker for %(name)s succeeded",

1089

633

vars(self))

1090

634

self.checked_ok()

1091

635

else:

1092

logger.info("Checker for %(name)s failed", vars(self))

636

logger.info("Checker for %(name)s failed",

637

vars(self))

1093

638

else:

1094

639

self.last_checker_status = -1

1095

self.last_checker_signal = -returncode

1096

640

logger.warning("Checker for %(name)s crashed?",

1097

641

vars(self))

1098

return False

1099

642

1100

643

def checked_ok(self):

1101

644

"""Assert that the client has been seen, alive and well."""

1102

645

self.last_checked_ok = datetime.datetime.utcnow()

1103

646

self.last_checker_status = 0

1104

self.last_checker_signal = None

1105

647

self.bump_timeout()

1106

648

1107

649

def bump_timeout(self, timeout=None):

1108

650

"""Bump up the timeout for this client."""

1109

651

if timeout is None:

1110

652

timeout = self.timeout

1111

653

if self.disable_initiator_tag is not None:

1112

GLib.source_remove(self.disable_initiator_tag)

654

gobject.source_remove(self.disable_initiator_tag)

1113

655

self.disable_initiator_tag = None

1114

656

if getattr(self, "enabled", False):

1115

self.disable_initiator_tag = GLib.timeout_add(

1116

int(timeout.total_seconds() * 1000), self.disable)

657

self.disable_initiator_tag = (gobject.timeout_add

658

(int(timeout.total_seconds()

659

* 1000), self.disable))

1117

660

self.expires = datetime.datetime.utcnow() + timeout

1118

661

1119

662

def need_approval(self):

1120

663

self.last_approval_request = datetime.datetime.utcnow()

1121

664

1122

665

def start_checker(self):

1123

666

"""Start a new checker subprocess if one is not running.

1124

667

1125

668

If a checker already exists, leave it running and do

1126

669

nothing."""

1127

670

# The reason for not killing a running checker is that if we

1132

675

# checkers alone, the checker would have to take more time

1133

676

# than 'timeout' for the client to be disabled, which is as it

1134

677

# should be.

1135

1136

if self.checker is not None and not self.checker.is_alive():

1137

logger.warning("Checker was not alive; joining")

1138

self.checker.join()

1139

self.checker = None

678

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except AttributeError:

683

pass

684

except OSError as error:

685

if error.errno != errno.ECHILD:

686

raise

687

else:

688

if pid:

689

logger.warning("Checker was a zombie")

690

gobject.source_remove(self.checker_callback_tag)

691

self.checker_callback(pid, status,

692

self.current_checker_command)

1140

693

# Start a new checker if needed

1141

694

if self.checker is None:

1142

695

# Escape attributes for the shell

1143

escaped_attrs = {

1144

attr: shlex.quote(str(getattr(self, attr)))

1145

for attr in self.runtime_expansions}

696

escaped_attrs = { attr:

697

re.escape(str(getattr(self, attr)))

698

for attr in self.runtime_expansions }

1146

699

try:

1147

700

command = self.checker_command % escaped_attrs

1148

701

except TypeError as error:

1149

702

logger.error('Could not format string "%s"',

1150

self.checker_command,

703

self.checker_command, exc_info=error)

704

return True # Try again later

705

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

# The exception is when not debugging but nevertheless

714

# running in the foreground; use the previously

715

# created wnull.

716

popen_args = {}

717

if (not self.server_settings["debug"]

718

and self.server_settings["foreground"]):

719

popen_args.update({"stdout": wnull,

720

"stderr": wnull })

721

self.checker = subprocess.Popen(command,

722

close_fds=True,

723

shell=True, cwd="/",

724

**popen_args)

725

except OSError as error:

726

logger.error("Failed to start subprocess",

1151

727

exc_info=error)

1152

return True # Try again later

1153

self.current_checker_command = command

1154

logger.info("Starting checker %r for %s", command,

1155

self.name)

1156

# We don't need to redirect stdout and stderr, since

1157

# in normal mode, that is already done by daemon(),

1158

# and in debug mode we don't want to. (Stdin is

1159

# always replaced by /dev/null.)

1160

# The exception is when not debugging but nevertheless

1161

# running in the foreground; use the previously

1162

# created wnull.

1163

popen_args = {"close_fds": True,

1164

"shell": True,

1165

"cwd": "/"}

1166

if (not self.server_settings["debug"]

1167

and self.server_settings["foreground"]):

1168

popen_args.update({"stdout": wnull,

1169

"stderr": wnull})

1170

pipe = multiprocessing.Pipe(duplex=False)

1171

self.checker = multiprocessing.Process(

1172

target=call_pipe,

1173

args=(pipe[1], subprocess.call, command),

1174

kwargs=popen_args)

1175

self.checker.start()

1176

self.checker_callback_tag = GLib.io_add_watch(

1177

GLib.IOChannel.unix_new(pipe[0].fileno()),

1178

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1179

self.checker_callback, pipe[0], command)

1180

# Re-run this periodically if run by GLib.timeout_add

728

return True

729

self.checker_callback_tag = (gobject.child_watch_add

730

(self.checker.pid,

731

self.checker_callback,

732

data=command))

733

# The checker may have completed before the gobject

734

# watch was added. Check for this.

735

try:

736

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

737

except OSError as error:

738

if error.errno == errno.ECHILD:

739

# This should never happen

740

logger.error("Child process vanished",

741

exc_info=error)

742

return True

743

raise

744

if pid:

745

gobject.source_remove(self.checker_callback_tag)

746

self.checker_callback(pid, status, command)

747

# Re-run this periodically if run by gobject.timeout_add

1181

748

return True

1182

749

1183

750

def stop_checker(self):

1184

751

"""Force the checker process, if any, to stop."""

1185

752

if self.checker_callback_tag:

1186

GLib.source_remove(self.checker_callback_tag)

753

gobject.source_remove(self.checker_callback_tag)

1187

754

self.checker_callback_tag = None

1188

755

if getattr(self, "checker", None) is None:

1189

756

return

1190

757

logger.debug("Stopping checker for %(name)s", vars(self))

1191

self.checker.terminate()

758

try:

759

self.checker.terminate()

760

#time.sleep(0.5)

761

#if self.checker.poll() is None:

762

# self.checker.kill()

763

except OSError as error:

764

if error.errno != errno.ESRCH: # No such process

765

raise

1192

766

self.checker = None

1193

767

1194

768

1195

def dbus_service_property(dbus_interface,

1196

signature="v",

1197

access="readwrite",

1198

byte_arrays=False):

769

def dbus_service_property(dbus_interface, signature="v",

770

access="readwrite", byte_arrays=False):

1199

771

"""Decorators for marking methods of a DBusObjectWithProperties to

1200

772

become properties on the D-Bus.

1201

773

1202

774

The decorated method will be called with no arguments by "Get"

1203

775

and with one argument by "Set".

1204

776

1205

777

The parameters, where they are supported, are the same as

1206

778

dbus.service.method, except there is only "signature", since the

1207

779

type from Get() and the type sent to Set() is the same.

1211

783

if byte_arrays and signature != "ay":

1212

784

raise ValueError("Byte arrays not supported for non-'ay'"

1213

785

" signature {!r}".format(signature))

1214

1215

786

def decorator(func):

1216

787

func._dbus_is_property = True

1217

788

func._dbus_interface = dbus_interface

1220

791

func._dbus_name = func.__name__

1221

792

if func._dbus_name.endswith("_dbus_property"):

1222

793

func._dbus_name = func._dbus_name[:-14]

1223

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

794

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1224

795

return func

1225

1226

796

return decorator

1227

797

1228

798

1229

799

def dbus_interface_annotations(dbus_interface):

1230

800

"""Decorator for marking functions returning interface annotations

1231

801

1232

802

Usage:

1233

803

1234

804

@dbus_interface_annotations("org.example.Interface")

1235

805

def _foo(self): # Function name does not matter

1236

806

return {"org.freedesktop.DBus.Deprecated": "true",

1237

807

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1238

808

"false"}

1239

809

"""

1240

1241

810

def decorator(func):

1242

811

func._dbus_is_interface = True

1243

812

func._dbus_interface = dbus_interface

1244

813

func._dbus_name = dbus_interface

1245

814

return func

1246

1247

815

return decorator

1248

816

1249

817

1250

818

def dbus_annotations(annotations):

1251

819

"""Decorator to annotate D-Bus methods, signals or properties

1252

820

Usage:

1253

821

1254

822

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1255

823

"org.freedesktop.DBus.Property."

1256

824

"EmitsChangedSignal": "false"})

1258

826

access="r")

1259

827

def Property_dbus_property(self):

1260

828

return dbus.Boolean(False)

1261

1262

See also the DBusObjectWithAnnotations class.

1263

829

"""

1264

1265

830

def decorator(func):

1266

831

func._dbus_annotations = annotations

1267

832

return func

1268

1269

833

return decorator

1270

834

1271

835

1274

838

"""

1275

839

pass

1276

840

1277

1278

841

class DBusPropertyAccessException(DBusPropertyException):

1279

842

"""A property's access permissions disallows an operation.

1280

843

"""

1287

850

pass

1288

851

1289

852

1290

class DBusObjectWithAnnotations(dbus.service.Object):

1291

"""A D-Bus object with annotations.

1292

1293

Classes inheriting from this can use the dbus_annotations

1294

decorator to add annotations to methods or signals.

853

class DBusObjectWithProperties(dbus.service.Object):

854

"""A D-Bus object with properties.

855

856

Classes inheriting from this can use the dbus_service_property

857

decorator to expose methods as D-Bus properties. It exposes the

858

standard Get(), Set(), and GetAll() methods on the D-Bus.

1295

859

"""

1296

860

1297

861

@staticmethod

1298

862

def _is_dbus_thing(thing):

1299

863

"""Returns a function testing if an attribute is a D-Bus thing

1300

864

1301

865

If called like _is_dbus_thing("method") it returns a function

1302

866

suitable for use as predicate to inspect.getmembers().

1303

867

"""

1304

868

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1305

869

False)

1306

870

1307

871

def _get_all_dbus_things(self, thing):

1308

872

"""Returns a generator of (name, attribute) pairs

1309

873

"""

1310

return ((getattr(athing.__get__(self), "_dbus_name", name),

874

return ((getattr(athing.__get__(self), "_dbus_name",

875

name),

1311

876

athing.__get__(self))

1312

877

for cls in self.__class__.__mro__

1313

878

for name, athing in

1314

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1315

1316

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1317

out_signature="s",

1318

path_keyword='object_path',

1319

connection_keyword='connection')

1320

def Introspect(self, object_path, connection):

1321

"""Overloading of standard D-Bus method.

1322

1323

Inserts annotation tags on methods and signals.

1324

"""

1325

xmlstring = dbus.service.Object.Introspect(self, object_path,

1326

connection)

1327

try:

1328

document = xml.dom.minidom.parseString(xmlstring)

1329

1330

for if_tag in document.getElementsByTagName("interface"):

1331

# Add annotation tags

1332

for typ in ("method", "signal"):

1333

for tag in if_tag.getElementsByTagName(typ):

1334

annots = dict()

1335

for name, prop in (self.

1336

_get_all_dbus_things(typ)):

1337

if (name == tag.getAttribute("name")

1338

and prop._dbus_interface

1339

== if_tag.getAttribute("name")):

1340

annots.update(getattr(

1341

prop, "_dbus_annotations", {}))

1342

for name, value in annots.items():

1343

ann_tag = document.createElement(

1344

"annotation")

1345

ann_tag.setAttribute("name", name)

1346

ann_tag.setAttribute("value", value)

1347

tag.appendChild(ann_tag)

1348

# Add interface annotation tags

1349

for annotation, value in dict(

1350

itertools.chain.from_iterable(

1351

annotations().items()

1352

for name, annotations

1353

in self._get_all_dbus_things("interface")

1354

if name == if_tag.getAttribute("name")

1355

)).items():

1356

ann_tag = document.createElement("annotation")

1357

ann_tag.setAttribute("name", annotation)

1358

ann_tag.setAttribute("value", value)

1359

if_tag.appendChild(ann_tag)

1360

# Fix argument name for the Introspect method itself

1361

if (if_tag.getAttribute("name")

1362

== dbus.INTROSPECTABLE_IFACE):

1363

for cn in if_tag.getElementsByTagName("method"):

1364

if cn.getAttribute("name") == "Introspect":

1365

for arg in cn.getElementsByTagName("arg"):

1366

if (arg.getAttribute("direction")

1367

== "out"):

1368

arg.setAttribute("name",

1369

"xml_data")

1370

xmlstring = document.toxml("utf-8")

1371

document.unlink()

1372

except (AttributeError, xml.dom.DOMException,

1373

xml.parsers.expat.ExpatError) as error:

1374

logger.error("Failed to override Introspection method",

1375

exc_info=error)

1376

return xmlstring

1377

1378

1379

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1380

"""A D-Bus object with properties.

1381

1382

Classes inheriting from this can use the dbus_service_property

1383

decorator to expose methods as D-Bus properties. It exposes the

1384

standard Get(), Set(), and GetAll() methods on the D-Bus.

1385

"""

1386

879

inspect.getmembers(cls,

880

self._is_dbus_thing(thing)))

881

1387

882

def _get_dbus_property(self, interface_name, property_name):

1388

883

"""Returns a bound method if one exists which is a D-Bus

1389

884

property with the specified name and interface.

1390

885

"""

1391

for cls in self.__class__.__mro__:

1392

for name, value in inspect.getmembers(

1393

cls, self._is_dbus_thing("property")):

886

for cls in self.__class__.__mro__:

887

for name, value in (inspect.getmembers

888

(cls,

889

self._is_dbus_thing("property"))):

1394

890

if (value._dbus_name == property_name

1395

891

and value._dbus_interface == interface_name):

1396

892

return value.__get__(self)

1397

893

1398

894

# No such property

1399

raise DBusPropertyNotFound("{}:{}.{}".format(

1400

self.dbus_object_path, interface_name, property_name))

1401

1402

@classmethod

1403

def _get_all_interface_names(cls):

1404

"""Get a sequence of all interfaces supported by an object"""

1405

return (name for name in set(getattr(getattr(x, attr),

1406

"_dbus_interface", None)

1407

for x in (inspect.getmro(cls))

1408

for attr in dir(x))

1409

if name is not None)

1410

1411

@dbus.service.method(dbus.PROPERTIES_IFACE,

1412

in_signature="ss",

895

raise DBusPropertyNotFound(self.dbus_object_path + ":"

896

+ interface_name + "."

897

+ property_name)

898

899

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1413

900

out_signature="v")

1414

901

def Get(self, interface_name, property_name):

1415

902

"""Standard D-Bus property Get() method, see D-Bus standard.

1421

908

if not hasattr(value, "variant_level"):

1422

909

return value

1423

910

return type(value)(value, variant_level=value.variant_level+1)

1424

911

1425

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1426

913

def Set(self, interface_name, property_name, value):

1427

914

"""Standard D-Bus property Set() method, see D-Bus standard.

1436

923

raise ValueError("Byte arrays not supported for non-"

1437

924

"'ay' signature {!r}"

1438

925

.format(prop._dbus_signature))

1439

value = dbus.ByteArray(bytes(value))

926

value = dbus.ByteArray(b''.join(chr(byte)

927

for byte in value))

1440

928

prop(value)

1441

1442

@dbus.service.method(dbus.PROPERTIES_IFACE,

1443

in_signature="s",

929

930

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1444

931

out_signature="a{sv}")

1445

932

def GetAll(self, interface_name):

1446

933

"""Standard D-Bus property GetAll() method, see D-Bus

1447

934

standard.

1448

935

1449

936

Note: Will not include properties with access="write".

1450

937

"""

1451

938

properties = {}

1461

948

if not hasattr(value, "variant_level"):

1462

949

properties[name] = value

1463

950

continue

1464

properties[name] = type(value)(

1465

value, variant_level=value.variant_level + 1)

951

properties[name] = type(value)(value, variant_level=

952

value.variant_level+1)

1466

953

return dbus.Dictionary(properties, signature="sv")

1467

954

1468

955

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1469

956

def PropertiesChanged(self, interface_name, changed_properties,

1470

957

invalidated_properties):

1472

959

standard.

1473

960

"""

1474

961

pass

1475

962

1476

963

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1477

964

out_signature="s",

1478

965

path_keyword='object_path',

1479

966

connection_keyword='connection')

1480

967

def Introspect(self, object_path, connection):

1481

968

"""Overloading of standard D-Bus method.

1482

969

1483

970

Inserts property tags and interface annotation tags.

1484

971

"""

1485

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1486

object_path,

1487

connection)

972

xmlstring = dbus.service.Object.Introspect(self, object_path,

973

connection)

1488

974

try:

1489

975

document = xml.dom.minidom.parseString(xmlstring)

1490

1491

976

def make_tag(document, name, prop):

1492

977

e = document.createElement("property")

1493

978

e.setAttribute("name", name)

1494

979

e.setAttribute("type", prop._dbus_signature)

1495

980

e.setAttribute("access", prop._dbus_access)

1496

981

return e

1497

1498

982

for if_tag in document.getElementsByTagName("interface"):

1499

983

# Add property tags

1500

984

for tag in (make_tag(document, name, prop)

1503

987

if prop._dbus_interface

1504

988

== if_tag.getAttribute("name")):

1505

989

if_tag.appendChild(tag)

1506

# Add annotation tags for properties

1507

for tag in if_tag.getElementsByTagName("property"):

1508

annots = dict()

1509

for name, prop in self._get_all_dbus_things(

1510

"property"):

1511

if (name == tag.getAttribute("name")

1512

and prop._dbus_interface

1513

== if_tag.getAttribute("name")):

1514

annots.update(getattr(

1515

prop, "_dbus_annotations", {}))

1516

for name, value in annots.items():

1517

ann_tag = document.createElement(

1518

"annotation")

1519

ann_tag.setAttribute("name", name)

1520

ann_tag.setAttribute("value", value)

1521

tag.appendChild(ann_tag)

990

# Add annotation tags

991

for typ in ("method", "signal", "property"):

992

for tag in if_tag.getElementsByTagName(typ):

993

annots = dict()

994

for name, prop in (self.

995

_get_all_dbus_things(typ)):

996

if (name == tag.getAttribute("name")

997

and prop._dbus_interface

998

== if_tag.getAttribute("name")):

999

annots.update(getattr

1000

(prop,

1001

"_dbus_annotations",

1002

{}))

1003

for name, value in annots.items():

1004

ann_tag = document.createElement(

1005

"annotation")

1006

ann_tag.setAttribute("name", name)

1007

ann_tag.setAttribute("value", value)

1008

tag.appendChild(ann_tag)

1009

# Add interface annotation tags

1010

for annotation, value in dict(

1011

itertools.chain.from_iterable(

1012

annotations().items()

1013

for name, annotations in

1014

self._get_all_dbus_things("interface")

1015

if name == if_tag.getAttribute("name")

1016

)).items():

1017

ann_tag = document.createElement("annotation")

1018

ann_tag.setAttribute("name", annotation)

1019

ann_tag.setAttribute("value", value)

1020

if_tag.appendChild(ann_tag)

1522

1021

# Add the names to the return values for the

1523

1022

# "org.freedesktop.DBus.Properties" methods

1524

1023

if (if_tag.getAttribute("name")

1543

1042

return xmlstring

1544

1043

1545

1044

1546

try:

1547

dbus.OBJECT_MANAGER_IFACE

1548

except AttributeError:

1549

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1550

1551

1552

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1553

"""A D-Bus object with an ObjectManager.

1554

1555

Classes inheriting from this exposes the standard

1556

GetManagedObjects call and the InterfacesAdded and

1557

InterfacesRemoved signals on the standard

1558

"org.freedesktop.DBus.ObjectManager" interface.

1559

1560

Note: No signals are sent automatically; they must be sent

1561

manually.

1562

"""

1563

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1564

out_signature="a{oa{sa{sv}}}")

1565

def GetManagedObjects(self):

1566

"""This function must be overridden"""

1567

raise NotImplementedError()

1568

1569

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1570

signature="oa{sa{sv}}")

1571

def InterfacesAdded(self, object_path, interfaces_and_properties):

1572

pass

1573

1574

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1575

def InterfacesRemoved(self, object_path, interfaces):

1576

pass

1577

1578

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1579

out_signature="s",

1580

path_keyword='object_path',

1581

connection_keyword='connection')

1582

def Introspect(self, object_path, connection):

1583

"""Overloading of standard D-Bus method.

1584

1585

Override return argument name of GetManagedObjects to be

1586

"objpath_interfaces_and_properties"

1587

"""

1588

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1589

object_path,

1590

connection)

1591

try:

1592

document = xml.dom.minidom.parseString(xmlstring)

1593

1594

for if_tag in document.getElementsByTagName("interface"):

1595

# Fix argument name for the GetManagedObjects method

1596

if (if_tag.getAttribute("name")

1597

== dbus.OBJECT_MANAGER_IFACE):

1598

for cn in if_tag.getElementsByTagName("method"):

1599

if (cn.getAttribute("name")

1600

== "GetManagedObjects"):

1601

for arg in cn.getElementsByTagName("arg"):

1602

if (arg.getAttribute("direction")

1603

== "out"):

1604

arg.setAttribute(

1605

"name",

1606

"objpath_interfaces"

1607

"_and_properties")

1608

xmlstring = document.toxml("utf-8")

1609

document.unlink()

1610

except (AttributeError, xml.dom.DOMException,

1611

xml.parsers.expat.ExpatError) as error:

1612

logger.error("Failed to override Introspection method",

1613

exc_info=error)

1614

return xmlstring

1615

1616

1617

1045

def datetime_to_dbus(dt, variant_level=0):

1618

1046

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1619

1047

if dt is None:

1620

return dbus.String("", variant_level=variant_level)

1621

return dbus.String(dt.isoformat(), variant_level=variant_level)

1048

return dbus.String("", variant_level = variant_level)

1049

return dbus.String(dt.isoformat(),

1050

variant_level=variant_level)

1622

1051

1623

1052

1624

1053

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1626

1055

dbus.service.Object, it will add alternate D-Bus attributes with

1627

1056

interface names according to the "alt_interface_names" mapping.

1628

1057

Usage:

1629

1058

1630

1059

@alternate_dbus_interfaces({"org.example.Interface":

1631

1060

"net.example.AlternateInterface"})

1632

1061

class SampleDBusObject(dbus.service.Object):

1633

1062

@dbus.service.method("org.example.Interface")

1634

1063

def SampleDBusMethod():

1635

1064

pass

1636

1065

1637

1066

The above "SampleDBusMethod" on "SampleDBusObject" will be

1638

1067

reachable via two interfaces: "org.example.Interface" and

1639

1068

"net.example.AlternateInterface", the latter of which will have

1640

1069

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1641

1070

"true", unless "deprecate" is passed with a False value.

1642

1071

1643

1072

This works for methods and signals, and also for D-Bus properties

1644

1073

(from DBusObjectWithProperties) and interfaces (from the

1645

1074

dbus_interface_annotations decorator).

1646

1075

"""

1647

1648

1076

def wrapper(cls):

1649

1077

for orig_interface_name, alt_interface_name in (

1650

alt_interface_names.items()):

1078

alt_interface_names.items()):

1651

1079

attr = {}

1652

1080

interface_names = set()

1653

1081

# Go though all attributes of the class

1655

1083

# Ignore non-D-Bus attributes, and D-Bus attributes

1656

1084

# with the wrong interface name

1657

1085

if (not hasattr(attribute, "_dbus_interface")

1658

or not attribute._dbus_interface.startswith(

1659

orig_interface_name)):

1086

or not attribute._dbus_interface

1087

.startswith(orig_interface_name)):

1660

1088

continue

1661

1089

# Create an alternate D-Bus interface name based on

1662

1090

# the current name

1663

alt_interface = attribute._dbus_interface.replace(

1664

orig_interface_name, alt_interface_name)

1091

alt_interface = (attribute._dbus_interface

1092

.replace(orig_interface_name,

1093

alt_interface_name))

1665

1094

interface_names.add(alt_interface)

1666

1095

# Is this a D-Bus signal?

1667

1096

if getattr(attribute, "_dbus_is_signal", False):

1668

1097

# Extract the original non-method undecorated

1669

1098

# function by black magic

1670

if sys.version_info.major == 2:

1671

nonmethod_func = (dict(

1099

nonmethod_func = (dict(

1672

1100

zip(attribute.func_code.co_freevars,

1673

attribute.__closure__))

1674

["func"].cell_contents)

1675

else:

1676

nonmethod_func = (dict(

1677

zip(attribute.__code__.co_freevars,

1678

attribute.__closure__))

1679

["func"].cell_contents)

1101

attribute.__closure__))["func"]

1102

.cell_contents)

1680

1103

# Create a new, but exactly alike, function

1681

1104

# object, and decorate it to be a new D-Bus signal

1682

1105

# with the alternate D-Bus interface name

1683

new_function = copy_function(nonmethod_func)

1684

new_function = (dbus.service.signal(

1685

alt_interface,

1686

attribute._dbus_signature)(new_function))

1106

new_function = (dbus.service.signal

1107

(alt_interface,

1108

attribute._dbus_signature)

1109

(types.FunctionType(

1110

nonmethod_func.func_code,

1111

nonmethod_func.func_globals,

1112

nonmethod_func.func_name,

1113

nonmethod_func.func_defaults,

1114

nonmethod_func.func_closure)))

1687

1115

# Copy annotations, if any

1688

1116

try:

1689

new_function._dbus_annotations = dict(

1690

attribute._dbus_annotations)

1117

new_function._dbus_annotations = (

1118

dict(attribute._dbus_annotations))

1691

1119

except AttributeError:

1692

1120

pass

1693

1694

1121

# Define a creator of a function to call both the

1695

1122

# original and alternate functions, so both the

1696

1123

# original and alternate signals gets sent when

1699

1126

"""This function is a scope container to pass

1700

1127

func1 and func2 to the "call_both" function

1701

1128

outside of its arguments"""

1702

1703

@functools.wraps(func2)

1704

1129

def call_both(*args, **kwargs):

1705

1130

"""This function will emit two D-Bus

1706

1131

signals by calling func1 and func2"""

1707

1132

func1(*args, **kwargs)

1708

1133

func2(*args, **kwargs)

1709

# Make wrapper function look like a D-Bus

1710

# signal

1711

for name, attr in inspect.getmembers(func2):

1712

if name.startswith("_dbus_"):

1713

setattr(call_both, name, attr)

1714

1715

1134

return call_both

1716

1135

# Create the "call_both" function and add it to

1717

1136

# the class

1722

1141

# object. Decorate it to be a new D-Bus method

1723

1142

# with the alternate D-Bus interface name. Add it

1724

1143

# to the class.

1725

attr[attrname] = (

1726

dbus.service.method(

1727

alt_interface,

1728

attribute._dbus_in_signature,

1729

attribute._dbus_out_signature)

1730

(copy_function(attribute)))

1144

attr[attrname] = (dbus.service.method

1145

(alt_interface,

1146

attribute._dbus_in_signature,

1147

attribute._dbus_out_signature)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1731

1154

# Copy annotations, if any

1732

1155

try:

1733

attr[attrname]._dbus_annotations = dict(

1734

attribute._dbus_annotations)

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1735

1158

except AttributeError:

1736

1159

pass

1737

1160

# Is this a D-Bus property?

1740

1163

# object, and decorate it to be a new D-Bus

1741

1164

# property with the alternate D-Bus interface

1742

1165

# name. Add it to the class.

1743

attr[attrname] = (dbus_service_property(

1744

alt_interface, attribute._dbus_signature,

1745

attribute._dbus_access,

1746

attribute._dbus_get_args_options

1747

["byte_arrays"])

1748

(copy_function(attribute)))

1166

attr[attrname] = (dbus_service_property

1167

(alt_interface,

1168

attribute._dbus_signature,

1169

attribute._dbus_access,

1170

attribute

1171

._dbus_get_args_options

1172

["byte_arrays"])

1173

(types.FunctionType

1174

(attribute.func_code,

1175

attribute.func_globals,

1176

attribute.func_name,

1177

attribute.func_defaults,

1178

attribute.func_closure)))

1749

1179

# Copy annotations, if any

1750

1180

try:

1751

attr[attrname]._dbus_annotations = dict(

1752

attribute._dbus_annotations)

1181

attr[attrname]._dbus_annotations = (

1182

dict(attribute._dbus_annotations))

1753

1183

except AttributeError:

1754

1184

pass

1755

1185

# Is this a D-Bus interface?

1758

1188

# object. Decorate it to be a new D-Bus interface

1759

1189

# with the alternate D-Bus interface name. Add it

1760

1190

# to the class.

1761

attr[attrname] = (

1762

dbus_interface_annotations(alt_interface)

1763

(copy_function(attribute)))

1191

attr[attrname] = (dbus_interface_annotations

1192

(alt_interface)

1193

(types.FunctionType

1194

(attribute.func_code,

1195

attribute.func_globals,

1196

attribute.func_name,

1197

attribute.func_defaults,

1198

attribute.func_closure)))

1764

1199

if deprecate:

1765

1200

# Deprecate all alternate interfaces

1766

iname = "_AlternateDBusNames_interface_annotation{}"

1201

iname="_AlternateDBusNames_interface_annotation{}"

1767

1202

for interface_name in interface_names:

1768

1769

1203

@dbus_interface_annotations(interface_name)

1770

1204

def func(self):

1771

return {"org.freedesktop.DBus.Deprecated":

1772

"true"}

1205

return { "org.freedesktop.DBus.Deprecated":

1206

"true" }

1773

1207

# Find an unused name

1774

1208

for aname in (iname.format(i)

1775

1209

for i in itertools.count()):

1779

1213

if interface_names:

1780

1214

# Replace the class with a new subclass of it with

1781

1215

# methods, signals, etc. as created above.

1782

if sys.version_info.major == 2:

1783

cls = type(b"{}Alternate".format(cls.__name__),

1784

(cls, ), attr)

1785

else:

1786

cls = type("{}Alternate".format(cls.__name__),

1787

(cls, ), attr)

1216

cls = type(b"{}Alternate".format(cls.__name__),

1217

(cls,), attr)

1788

1218

return cls

1789

1790

1219

return wrapper

1791

1220

1792

1221

1793

1222

@alternate_dbus_interfaces({"se.recompile.Mandos":

1794

"se.bsnet.fukt.Mandos"})

1223

"se.bsnet.fukt.Mandos"})

1795

1224

class ClientDBus(Client, DBusObjectWithProperties):

1796

1225

"""A Client class using D-Bus

1797

1226

1798

1227

Attributes:

1799

1228

dbus_object_path: dbus.ObjectPath

1800

1229

bus: dbus.SystemBus()

1801

1230

"""

1802

1231

1803

1232

runtime_expansions = (Client.runtime_expansions

1804

+ ("dbus_object_path", ))

1805

1233

+ ("dbus_object_path",))

1234

1806

1235

_interface = "se.recompile.Mandos.Client"

1807

1236

1808

1237

# dbus.service.Object doesn't use super(), so we can't either.

1809

1810

def __init__(self, bus=None, *args, **kwargs):

1238

1239

def __init__(self, bus = None, *args, **kwargs):

1811

1240

self.bus = bus

1812

1241

Client.__init__(self, *args, **kwargs)

1813

1242

# Only now, when this client is initialized, can it show up on

1815

1244

client_object_name = str(self.name).translate(

1816

1245

{ord("."): ord("_"),

1817

1246

ord("-"): ord("_")})

1818

self.dbus_object_path = dbus.ObjectPath(

1819

"/clients/" + client_object_name)

1247

self.dbus_object_path = (dbus.ObjectPath

1248

("/clients/" + client_object_name))

1820

1249

DBusObjectWithProperties.__init__(self, self.bus,

1821

1250

self.dbus_object_path)

1822

1823

def notifychangeproperty(transform_func, dbus_name,

1824

type_func=lambda x: x,

1825

variant_level=1,

1826

invalidate_only=False,

1251

1252

def notifychangeproperty(transform_func,

1253

dbus_name, type_func=lambda x: x,

1254

variant_level=1, invalidate_only=False,

1827

1255

_interface=_interface):

1828

1256

""" Modify a variable so that it's a property which announces

1829

1257

its changes to DBus.

1830

1258

1831

1259

transform_fun: Function that takes a value and a variant_level

1832

1260

and transforms it to a D-Bus type.

1833

1261

dbus_name: D-Bus name of the variable

1836

1264

variant_level: D-Bus variant level. Default: 1

1837

1265

"""

1838

1266

attrname = "_{}".format(dbus_name)

1839

1840

1267

def setter(self, value):

1841

1268

if hasattr(self, "dbus_object_path"):

1842

1269

if (not hasattr(self, attrname) or

1843

1270

type_func(getattr(self, attrname, None))

1844

1271

!= type_func(value)):

1845

1272

if invalidate_only:

1846

self.PropertiesChanged(

1847

_interface, dbus.Dictionary(),

1848

dbus.Array((dbus_name, )))

1273

self.PropertiesChanged(_interface,

1274

dbus.Dictionary(),

1275

dbus.Array

1276

((dbus_name,)))

1849

1277

else:

1850

dbus_value = transform_func(

1851

type_func(value),

1852

variant_level=variant_level)

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1853

1281

self.PropertyChanged(dbus.String(dbus_name),

1854

1282

dbus_value)

1855

self.PropertiesChanged(

1856

_interface,

1857

dbus.Dictionary({dbus.String(dbus_name):

1858

dbus_value}),

1859

dbus.Array())

1283

self.PropertiesChanged(_interface,

1284

dbus.Dictionary({

1285

dbus.String(dbus_name):

1286

dbus_value }), dbus.Array())

1860

1287

setattr(self, attrname, value)

1861

1288

1862

1289

return property(lambda self: getattr(self, attrname), setter)

1863

1290

1864

1291

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1865

1292

approvals_pending = notifychangeproperty(dbus.Boolean,

1866

1293

"ApprovalPending",

1867

type_func=bool)

1294

type_func = bool)

1868

1295

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1869

1296

last_enabled = notifychangeproperty(datetime_to_dbus,

1870

1297

"LastEnabled")

1871

checker = notifychangeproperty(

1872

dbus.Boolean, "CheckerRunning",

1873

type_func=lambda checker: checker is not None)

1298

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1299

type_func = lambda checker:

1300

checker is not None)

1874

1301

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1875

1302

"LastCheckedOK")

1876

1303

last_checker_status = notifychangeproperty(dbus.Int16,

1879

1306

datetime_to_dbus, "LastApprovalRequest")

1880

1307

approved_by_default = notifychangeproperty(dbus.Boolean,

1881

1308

"ApprovedByDefault")

1882

approval_delay = notifychangeproperty(

1883

dbus.UInt64, "ApprovalDelay",

1884

type_func=lambda td: td.total_seconds() * 1000)

1309

approval_delay = notifychangeproperty(dbus.UInt64,

1310

"ApprovalDelay",

1311

type_func =

1312

lambda td: td.total_seconds()

1313

* 1000)

1885

1314

approval_duration = notifychangeproperty(

1886

1315

dbus.UInt64, "ApprovalDuration",

1887

type_func=lambda td: td.total_seconds() * 1000)

1316

type_func = lambda td: td.total_seconds() * 1000)

1888

1317

host = notifychangeproperty(dbus.String, "Host")

1889

timeout = notifychangeproperty(

1890

dbus.UInt64, "Timeout",

1891

type_func=lambda td: td.total_seconds() * 1000)

1318

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1319

type_func = lambda td:

1320

td.total_seconds() * 1000)

1892

1321

extended_timeout = notifychangeproperty(

1893

1322

dbus.UInt64, "ExtendedTimeout",

1894

type_func=lambda td: td.total_seconds() * 1000)

1895

interval = notifychangeproperty(

1896

dbus.UInt64, "Interval",

1897

type_func=lambda td: td.total_seconds() * 1000)

1323

type_func = lambda td: td.total_seconds() * 1000)

1324

interval = notifychangeproperty(dbus.UInt64,

1325

"Interval",

1326

type_func =

1327

lambda td: td.total_seconds()

1328

* 1000)

1898

1329

checker_command = notifychangeproperty(dbus.String, "Checker")

1899

1330

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1900

1331

invalidate_only=True)

1901

1332

1902

1333

del notifychangeproperty

1903

1334

1904

1335

def __del__(self, *args, **kwargs):

1905

1336

try:

1906

1337

self.remove_from_connection()

1909

1340

if hasattr(DBusObjectWithProperties, "__del__"):

1910

1341

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1911

1342

Client.__del__(self, *args, **kwargs)

1912

1913

def checker_callback(self, source, condition,

1914

connection, command, *args, **kwargs):

1915

ret = Client.checker_callback(self, source, condition,

1916

connection, command, *args,

1917

**kwargs)

1918

exitstatus = self.last_checker_status

1919

if exitstatus >= 0:

1343

1344

def checker_callback(self, pid, condition, command,

1345

*args, **kwargs):

1346

self.checker_callback_tag = None

1347

self.checker = None

1348

if os.WIFEXITED(condition):

1349

exitstatus = os.WEXITSTATUS(condition)

1920

1350

# Emit D-Bus signal

1921

1351

self.CheckerCompleted(dbus.Int16(exitstatus),

1922

# This is specific to GNU libC

1923

dbus.Int64(exitstatus << 8),

1352

dbus.Int64(condition),

1924

1353

dbus.String(command))

1925

1354

else:

1926

1355

# Emit D-Bus signal

1927

1356

self.CheckerCompleted(dbus.Int16(-1),

1928

dbus.Int64(

1929

# This is specific to GNU libC

1930

(exitstatus << 8)

1931

| self.last_checker_signal),

1357

dbus.Int64(condition),

1932

1358

dbus.String(command))

1933

return ret

1934

1359

1360

return Client.checker_callback(self, pid, condition, command,

1361

*args, **kwargs)

1362

1935

1363

def start_checker(self, *args, **kwargs):

1936

1364

old_checker_pid = getattr(self.checker, "pid", None)

1937

1365

r = Client.start_checker(self, *args, **kwargs)

1941

1369

# Emit D-Bus signal

1942

1370

self.CheckerStarted(self.current_checker_command)

1943

1371

return r

1944

1372

1945

1373

def _reset_approved(self):

1946

1374

self.approved = None

1947

1375

return False

1948

1376

1949

1377

def approve(self, value=True):

1950

1378

self.approved = value

1951

GLib.timeout_add(int(self.approval_duration.total_seconds()

1952

* 1000), self._reset_approved)

1379

gobject.timeout_add(int(self.approval_duration.total_seconds()

1380

* 1000), self._reset_approved)

1953

1381

self.send_changedstate()

1954

1955

# D-Bus methods, signals & properties

1956

1957

# Interfaces

1958

1959

# Signals

1960

1382

1383

## D-Bus methods, signals & properties

1384

1385

## Interfaces

1386

1387

## Signals

1388

1961

1389

# CheckerCompleted - signal

1962

1390

@dbus.service.signal(_interface, signature="nxs")

1963

1391

def CheckerCompleted(self, exitcode, waitstatus, command):

1964

1392

"D-Bus signal"

1965

1393

pass

1966

1394

1967

1395

# CheckerStarted - signal

1968

1396

@dbus.service.signal(_interface, signature="s")

1969

1397

def CheckerStarted(self, command):

1970

1398

"D-Bus signal"

1971

1399

pass

1972

1400

1973

1401

# PropertyChanged - signal

1974

1402

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1975

1403

@dbus.service.signal(_interface, signature="sv")

1976

1404

def PropertyChanged(self, property, value):

1977

1405

"D-Bus signal"

1978

1406

pass

1979

1407

1980

1408

# GotSecret - signal

1981

1409

@dbus.service.signal(_interface)

1982

1410

def GotSecret(self):

1985

1413

server to mandos-client

1986

1414

"""

1987

1415

pass

1988

1416

1989

1417

# Rejected - signal

1990

1418

@dbus.service.signal(_interface, signature="s")

1991

1419

def Rejected(self, reason):

1992

1420

"D-Bus signal"

1993

1421

pass

1994

1422

1995

1423

# NeedApproval - signal

1996

1424

@dbus.service.signal(_interface, signature="tb")

1997

1425

def NeedApproval(self, timeout, default):

1998

1426

"D-Bus signal"

1999

1427

return self.need_approval()

2000

2001

# Methods

2002

1428

1429

## Methods

1430

2003

1431

# Approve - method

2004

1432

@dbus.service.method(_interface, in_signature="b")

2005

1433

def Approve(self, value):

2006

1434

self.approve(value)

2007

1435

2008

1436

# CheckedOK - method

2009

1437

@dbus.service.method(_interface)

2010

1438

def CheckedOK(self):

2011

1439

self.checked_ok()

2012

1440

2013

1441

# Enable - method

2014

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2015

1442

@dbus.service.method(_interface)

2016

1443

def Enable(self):

2017

1444

"D-Bus method"

2018

1445

self.enable()

2019

1446

2020

1447

# StartChecker - method

2021

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2022

1448

@dbus.service.method(_interface)

2023

1449

def StartChecker(self):

2024

1450

"D-Bus method"

2025

1451

self.start_checker()

2026

1452

2027

1453

# Disable - method

2028

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2029

1454

@dbus.service.method(_interface)

2030

1455

def Disable(self):

2031

1456

"D-Bus method"

2032

1457

self.disable()

2033

1458

2034

1459

# StopChecker - method

2035

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2036

1460

@dbus.service.method(_interface)

2037

1461

def StopChecker(self):

2038

1462

self.stop_checker()

2039

2040

# Properties

2041

1463

1464

## Properties

1465

2042

1466

# ApprovalPending - property

2043

1467

@dbus_service_property(_interface, signature="b", access="read")

2044

1468

def ApprovalPending_dbus_property(self):

2045

1469

return dbus.Boolean(bool(self.approvals_pending))

2046

1470

2047

1471

# ApprovedByDefault - property

2048

@dbus_service_property(_interface,

2049

signature="b",

1472

@dbus_service_property(_interface, signature="b",

2050

1473

access="readwrite")

2051

1474

def ApprovedByDefault_dbus_property(self, value=None):

2052

1475

if value is None: # get

2053

1476

return dbus.Boolean(self.approved_by_default)

2054

1477

self.approved_by_default = bool(value)

2055

1478

2056

1479

# ApprovalDelay - property

2057

@dbus_service_property(_interface,

2058

signature="t",

1480

@dbus_service_property(_interface, signature="t",

2059

1481

access="readwrite")

2060

1482

def ApprovalDelay_dbus_property(self, value=None):

2061

1483

if value is None: # get

2062

1484

return dbus.UInt64(self.approval_delay.total_seconds()

2063

1485

* 1000)

2064

1486

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2065

1487

2066

1488

# ApprovalDuration - property

2067

@dbus_service_property(_interface,

2068

signature="t",

1489

@dbus_service_property(_interface, signature="t",

2069

1490

access="readwrite")

2070

1491

def ApprovalDuration_dbus_property(self, value=None):

2071

1492

if value is None: # get

2072

1493

return dbus.UInt64(self.approval_duration.total_seconds()

2073

1494

* 1000)

2074

1495

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2075

1496

2076

1497

# Name - property

2077

@dbus_annotations(

2078

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2079

1498

@dbus_service_property(_interface, signature="s", access="read")

2080

1499

def Name_dbus_property(self):

2081

1500

return dbus.String(self.name)

2082

2083

# KeyID - property

2084

@dbus_annotations(

2085

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2086

@dbus_service_property(_interface, signature="s", access="read")

2087

def KeyID_dbus_property(self):

2088

return dbus.String(self.key_id)

2089

1501

2090

1502

# Fingerprint - property

2091

@dbus_annotations(

2092

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2093

1503

@dbus_service_property(_interface, signature="s", access="read")

2094

1504

def Fingerprint_dbus_property(self):

2095

1505

return dbus.String(self.fingerprint)

2096

1506

2097

1507

# Host - property

2098

@dbus_service_property(_interface,

2099

signature="s",

1508

@dbus_service_property(_interface, signature="s",

2100

1509

access="readwrite")

2101

1510

def Host_dbus_property(self, value=None):

2102

1511

if value is None: # get

2103

1512

return dbus.String(self.host)

2104

1513

self.host = str(value)

2105

1514

2106

1515

# Created - property

2107

@dbus_annotations(

2108

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2109

1516

@dbus_service_property(_interface, signature="s", access="read")

2110

1517

def Created_dbus_property(self):

2111

1518

return datetime_to_dbus(self.created)

2112

1519

2113

1520

# LastEnabled - property

2114

1521

@dbus_service_property(_interface, signature="s", access="read")

2115

1522

def LastEnabled_dbus_property(self):

2116

1523

return datetime_to_dbus(self.last_enabled)

2117

1524

2118

1525

# Enabled - property

2119

@dbus_service_property(_interface,

2120

signature="b",

1526

@dbus_service_property(_interface, signature="b",

2121

1527

access="readwrite")

2122

1528

def Enabled_dbus_property(self, value=None):

2123

1529

if value is None: # get

2126

1532

self.enable()

2127

1533

else:

2128

1534

self.disable()

2129

1535

2130

1536

# LastCheckedOK - property

2131

@dbus_service_property(_interface,

2132

signature="s",

1537

@dbus_service_property(_interface, signature="s",

2133

1538

access="readwrite")

2134

1539

def LastCheckedOK_dbus_property(self, value=None):

2135

1540

if value is not None:

2136

1541

self.checked_ok()

2137

1542

return

2138

1543

return datetime_to_dbus(self.last_checked_ok)

2139

1544

2140

1545

# LastCheckerStatus - property

2141

@dbus_service_property(_interface, signature="n", access="read")

1546

@dbus_service_property(_interface, signature="n",

1547

access="read")

2142

1548

def LastCheckerStatus_dbus_property(self):

2143

1549

return dbus.Int16(self.last_checker_status)

2144

1550

2145

1551

# Expires - property

2146

1552

@dbus_service_property(_interface, signature="s", access="read")

2147

1553

def Expires_dbus_property(self):

2148

1554

return datetime_to_dbus(self.expires)

2149

1555

2150

1556

# LastApprovalRequest - property

2151

1557

@dbus_service_property(_interface, signature="s", access="read")

2152

1558

def LastApprovalRequest_dbus_property(self):

2153

1559

return datetime_to_dbus(self.last_approval_request)

2154

1560

2155

1561

# Timeout - property

2156

@dbus_service_property(_interface,

2157

signature="t",

1562

@dbus_service_property(_interface, signature="t",

2158

1563

access="readwrite")

2159

1564

def Timeout_dbus_property(self, value=None):

2160

1565

if value is None: # get

2172

1577

if (getattr(self, "disable_initiator_tag", None)

2173

1578

is None):

2174

1579

return

2175

GLib.source_remove(self.disable_initiator_tag)

2176

self.disable_initiator_tag = GLib.timeout_add(

2177

int((self.expires - now).total_seconds() * 1000),

2178

self.disable)

2179

1580

gobject.source_remove(self.disable_initiator_tag)

1581

self.disable_initiator_tag = (

1582

gobject.timeout_add(

1583

int((self.expires - now).total_seconds()

1584

* 1000), self.disable))

1585

2180

1586

# ExtendedTimeout - property

2181

@dbus_service_property(_interface,

2182

signature="t",

1587

@dbus_service_property(_interface, signature="t",

2183

1588

access="readwrite")

2184

1589

def ExtendedTimeout_dbus_property(self, value=None):

2185

1590

if value is None: # get

2186

1591

return dbus.UInt64(self.extended_timeout.total_seconds()

2187

1592

* 1000)

2188

1593

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2189

1594

2190

1595

# Interval - property

2191

@dbus_service_property(_interface,

2192

signature="t",

1596

@dbus_service_property(_interface, signature="t",

2193

1597

access="readwrite")

2194

1598

def Interval_dbus_property(self, value=None):

2195

1599

if value is None: # get

2199

1603

return

2200

1604

if self.enabled:

2201

1605

# Reschedule checker run

2202

GLib.source_remove(self.checker_initiator_tag)

2203

self.checker_initiator_tag = GLib.timeout_add(

2204

value, self.start_checker)

2205

self.start_checker() # Start one now, too

2206

1606

gobject.source_remove(self.checker_initiator_tag)

1607

self.checker_initiator_tag = (gobject.timeout_add

1608

(value, self.start_checker))

1609

self.start_checker() # Start one now, too

1610

2207

1611

# Checker - property

2208

@dbus_service_property(_interface,

2209

signature="s",

1612

@dbus_service_property(_interface, signature="s",

2210

1613

access="readwrite")

2211

1614

def Checker_dbus_property(self, value=None):

2212

1615

if value is None: # get

2213

1616

return dbus.String(self.checker_command)

2214

1617

self.checker_command = str(value)

2215

1618

2216

1619

# CheckerRunning - property

2217

@dbus_service_property(_interface,

2218

signature="b",

1620

@dbus_service_property(_interface, signature="b",

2219

1621

access="readwrite")

2220

1622

def CheckerRunning_dbus_property(self, value=None):

2221

1623

if value is None: # get

2224

1626

self.start_checker()

2225

1627

else:

2226

1628

self.stop_checker()

2227

1629

2228

1630

# ObjectPath - property

2229

@dbus_annotations(

2230

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2231

"org.freedesktop.DBus.Deprecated": "true"})

2232

1631

@dbus_service_property(_interface, signature="o", access="read")

2233

1632

def ObjectPath_dbus_property(self):

2234

return self.dbus_object_path # is already a dbus.ObjectPath

2235

1633

return self.dbus_object_path # is already a dbus.ObjectPath

1634

2236

1635

# Secret = property

2237

@dbus_annotations(

2238

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2239

"invalidates"})

2240

@dbus_service_property(_interface,

2241

signature="ay",

2242

access="write",

2243

byte_arrays=True)

1636

@dbus_service_property(_interface, signature="ay",

1637

access="write", byte_arrays=True)

2244

1638

def Secret_dbus_property(self, value):

2245

1639

self.secret = bytes(value)

2246

1640

2247

1641

del _interface

2248

1642

2249

1643

2250

class ProxyClient:

2251

def __init__(self, child_pipe, key_id, fpr, address):

1644

class ProxyClient(object):

1645

def __init__(self, child_pipe, fpr, address):

2252

1646

self._pipe = child_pipe

2253

self._pipe.send(('init', key_id, fpr, address))

1647

self._pipe.send(('init', fpr, address))

2254

1648

if not self._pipe.recv():

2255

raise KeyError(key_id or fpr)

2256

1649

raise KeyError()

1650

2257

1651

def __getattribute__(self, name):

2258

1652

if name == '_pipe':

2259

1653

return super(ProxyClient, self).__getattribute__(name)

2262

1656

if data[0] == 'data':

2263

1657

return data[1]

2264

1658

if data[0] == 'function':

2265

2266

1659

def func(*args, **kwargs):

2267

1660

self._pipe.send(('funcall', name, args, kwargs))

2268

1661

return self._pipe.recv()[1]

2269

2270

1662

return func

2271

1663

2272

1664

def __setattr__(self, name, value):

2273

1665

if name == '_pipe':

2274

1666

return super(ProxyClient, self).__setattr__(name, value)

2277

1669

2278

1670

class ClientHandler(socketserver.BaseRequestHandler, object):

2279

1671

"""A class to handle client connections.

2280

1672

2281

1673

Instantiated once for each connection to handle it.

2282

1674

Note: This will run in its own forked process."""

2283

1675

2284

1676

def handle(self):

2285

1677

with contextlib.closing(self.server.child_pipe) as child_pipe:

2286

1678

logger.info("TCP connection from: %s",

2287

1679

str(self.client_address))

2288

1680

logger.debug("Pipe FD: %d",

2289

1681

self.server.child_pipe.fileno())

2290

2291

session = gnutls.ClientSession(self.request)

2292

2293

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2294

# "+AES-256-CBC", "+SHA1",

2295

# "+COMP-NULL", "+CTYPE-OPENPGP",

2296

# "+DHE-DSS"))

1682

1683

session = (gnutls.connection

1684

.ClientSession(self.request,

1685

gnutls.connection

1686

.X509Credentials()))

1687

1688

# Note: gnutls.connection.X509Credentials is really a

1689

# generic GnuTLS certificate credentials object so long as

1690

# no X.509 keys are added to it. Therefore, we can use it

1691

# here despite using OpenPGP certificates.

1692

1693

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1694

# "+AES-256-CBC", "+SHA1",

1695

# "+COMP-NULL", "+CTYPE-OPENPGP",

1696

# "+DHE-DSS"))

2297

1697

# Use a fallback default, since this MUST be set.

2298

1698

priority = self.server.gnutls_priority

2299

1699

if priority is None:

2300

1700

priority = "NORMAL"

2301

gnutls.priority_set_direct(session._c_object,

2302

priority.encode("utf-8"),

2303

None)

2304

1701

(gnutls.library.functions

1702

.gnutls_priority_set_direct(session._c_object,

1703

priority, None))

1704

2305

1705

# Start communication using the Mandos protocol

2306

1706

# Get protocol number

2307

1707

line = self.request.makefile().readline()

2312

1712

except (ValueError, IndexError, RuntimeError) as error:

2313

1713

logger.error("Unknown protocol version: %s", error)

2314

1714

return

2315

1715

2316

1716

# Start GnuTLS connection

2317

1717

try:

2318

1718

session.handshake()

2319

except gnutls.Error as error:

1719

except gnutls.errors.GNUTLSError as error:

2320

1720

logger.warning("Handshake failed: %s", error)

2321

1721

# Do not run session.bye() here: the session is not

2322

1722

# established. Just abandon the request.

2323

1723

return

2324

1724

logger.debug("Handshake succeeded")

2325

1725

2326

1726

approval_required = False

2327

1727

try:

2328

if gnutls.has_rawpk:

2329

fpr = b""

2330

try:

2331

key_id = self.key_id(

2332

self.peer_certificate(session))

2333

except (TypeError, gnutls.Error) as error:

2334

logger.warning("Bad certificate: %s", error)

2335

return

2336

logger.debug("Key ID: %s", key_id)

2337

2338

else:

2339

key_id = b""

2340

try:

2341

fpr = self.fingerprint(

2342

self.peer_certificate(session))

2343

except (TypeError, gnutls.Error) as error:

2344

logger.warning("Bad certificate: %s", error)

2345

return

2346

logger.debug("Fingerprint: %s", fpr)

2347

2348

try:

2349

client = ProxyClient(child_pipe, key_id, fpr,

1728

try:

1729

fpr = self.fingerprint(self.peer_certificate

1730

(session))

1731

except (TypeError,

1732

gnutls.errors.GNUTLSError) as error:

1733

logger.warning("Bad certificate: %s", error)

1734

return

1735

logger.debug("Fingerprint: %s", fpr)

1736

1737

try:

1738

client = ProxyClient(child_pipe, fpr,

2350

1739

self.client_address)

2351

1740

except KeyError:

2352

1741

return

2353

1742

2354

1743

if client.approval_delay:

2355

1744

delay = client.approval_delay

2356

1745

client.approvals_pending += 1

2357

1746

approval_required = True

2358

1747

2359

1748

while True:

2360

1749

if not client.enabled:

2361

1750

logger.info("Client %s is disabled",

2362

client.name)

1751

client.name)

2363

1752

if self.server.use_dbus:

2364

1753

# Emit D-Bus signal

2365

1754

client.Rejected("Disabled")

2366

1755

return

2367

1756

2368

1757

if client.approved or not client.approval_delay:

2369

# We are approved or approval is disabled

1758

#We are approved or approval is disabled

2370

1759

break

2371

1760

elif client.approved is None:

2372

1761

logger.info("Client %s needs approval",

2383

1772

# Emit D-Bus signal

2384

1773

client.Rejected("Denied")

2385

1774

return

2386

2387

# wait until timeout or approved

1775

1776

#wait until timeout or approved

2388

1777

time = datetime.datetime.now()

2389

1778

client.changedstate.acquire()

2390

1779

client.changedstate.wait(delay.total_seconds())

2403

1792

break

2404

1793

else:

2405

1794

delay -= time2 - time

2406

2407

try:

2408

session.send(client.secret)

2409

except gnutls.Error as error:

2410

logger.warning("gnutls send failed",

2411

exc_info=error)

2412

return

2413

1795

1796

sent_size = 0

1797

while sent_size < len(client.secret):

1798

try:

1799

sent = session.send(client.secret[sent_size:])

1800

except gnutls.errors.GNUTLSError as error:

1801

logger.warning("gnutls send failed",

1802

exc_info=error)

1803

return

1804

logger.debug("Sent: %d, remaining: %d",

1805

sent, len(client.secret)

1806

- (sent_size + sent))

1807

sent_size += sent

1808

2414

1809

logger.info("Sending secret to %s", client.name)

2415

1810

# bump the timeout using extended_timeout

2416

1811

client.bump_timeout(client.extended_timeout)

2417

1812

if self.server.use_dbus:

2418

1813

# Emit D-Bus signal

2419

1814

client.GotSecret()

2420

1815

2421

1816

finally:

2422

1817

if approval_required:

2423

1818

client.approvals_pending -= 1

2424

1819

try:

2425

1820

session.bye()

2426

except gnutls.Error as error:

1821

except gnutls.errors.GNUTLSError as error:

2427

1822

logger.warning("GnuTLS bye failed",

2428

1823

exc_info=error)

2429

1824

2430

1825

@staticmethod

2431

1826

def peer_certificate(session):

2432

"Return the peer's certificate as a bytestring"

2433

try:

2434

cert_type = gnutls.certificate_type_get2(session._c_object,

2435

gnutls.CTYPE_PEERS)

2436

except AttributeError:

2437

cert_type = gnutls.certificate_type_get(session._c_object)

2438

if gnutls.has_rawpk:

2439

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2440

else:

2441

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2442

# If not a valid certificate type...

2443

if cert_type not in valid_cert_types:

2444

logger.info("Cert type %r not in %r", cert_type,

2445

valid_cert_types)

2446

# ...return invalid data

2447

return b""

1827

"Return the peer's OpenPGP certificate as a bytestring"

1828

# If not an OpenPGP certificate...

1829

if (gnutls.library.functions

1830

.gnutls_certificate_type_get(session._c_object)

1831

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1832

# ...do the normal thing

1833

return session.peer_certificate

2448

1834

list_size = ctypes.c_uint(1)

2449

cert_list = (gnutls.certificate_get_peers

1835

cert_list = (gnutls.library.functions

1836

.gnutls_certificate_get_peers

2450

1837

(session._c_object, ctypes.byref(list_size)))

2451

1838

if not bool(cert_list) and list_size.value != 0:

2452

raise gnutls.Error("error getting peer certificate")

1839

raise gnutls.errors.GNUTLSError("error getting peer"

1840

" certificate")

2453

1841

if list_size.value == 0:

2454

1842

return None

2455

1843

cert = cert_list[0]

2456

1844

return ctypes.string_at(cert.data, cert.size)

2457

2458

@staticmethod

2459

def key_id(certificate):

2460

"Convert a certificate bytestring to a hexdigit key ID"

2461

# New GnuTLS "datum" with the public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(certificate),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(certificate)))

2466

# XXX all these need to be created in the gnutls "module"

2467

# New empty GnuTLS certificate

2468

pubkey = gnutls.pubkey_t()

2469

gnutls.pubkey_init(ctypes.byref(pubkey))

2470

# Import the raw public key into the certificate

2471

gnutls.pubkey_import(pubkey,

2472

ctypes.byref(datum),

2473

gnutls.X509_FMT_DER)

2474

# New buffer for the key ID

2475

buf = ctypes.create_string_buffer(32)

2476

buf_len = ctypes.c_size_t(len(buf))

2477

# Get the key ID from the raw public key into the buffer

2478

gnutls.pubkey_get_key_id(

2479

pubkey,

2480

gnutls.KEYID_USE_SHA256,

2481

ctypes.cast(ctypes.byref(buf),

2482

ctypes.POINTER(ctypes.c_ubyte)),

2483

ctypes.byref(buf_len))

2484

# Deinit the certificate

2485

gnutls.pubkey_deinit(pubkey)

2486

2487

# Convert the buffer to a Python bytestring

2488

key_id = ctypes.string_at(buf, buf_len.value)

2489

# Convert the bytestring to hexadecimal notation

2490

hex_key_id = binascii.hexlify(key_id).upper()

2491

return hex_key_id

2492

1845

2493

1846

@staticmethod

2494

1847

def fingerprint(openpgp):

2495

1848

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2496

1849

# New GnuTLS "datum" with the OpenPGP public key

2497

datum = gnutls.datum_t(

2498

ctypes.cast(ctypes.c_char_p(openpgp),

2499

ctypes.POINTER(ctypes.c_ubyte)),

2500

ctypes.c_uint(len(openpgp)))

1850

datum = (gnutls.library.types

1851

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1852

ctypes.POINTER

1853

(ctypes.c_ubyte)),

1854

ctypes.c_uint(len(openpgp))))

2501

1855

# New empty GnuTLS certificate

2502

crt = gnutls.openpgp_crt_t()

2503

gnutls.openpgp_crt_init(ctypes.byref(crt))

1856

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2504

1859

# Import the OpenPGP public key into the certificate

2505

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2506

gnutls.OPENPGP_FMT_RAW)

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1862

gnutls.library.constants

1863

.GNUTLS_OPENPGP_FMT_RAW))

2507

1864

# Verify the self signature in the key

2508

1865

crtverify = ctypes.c_uint()

2509

gnutls.openpgp_crt_verify_self(crt, 0,

2510

ctypes.byref(crtverify))

1866

(gnutls.library.functions

1867

.gnutls_openpgp_crt_verify_self(crt, 0,

1868

ctypes.byref(crtverify)))

2511

1869

if crtverify.value != 0:

2512

gnutls.openpgp_crt_deinit(crt)

2513

raise gnutls.CertificateSecurityError(code

2514

=crtverify.value)

1870

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1871

raise (gnutls.errors.CertificateSecurityError

1872

("Verify failed"))

2515

1873

# New buffer for the fingerprint

2516

1874

buf = ctypes.create_string_buffer(20)

2517

1875

buf_len = ctypes.c_size_t()

2518

1876

# Get the fingerprint from the certificate into the buffer

2519

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2520

ctypes.byref(buf_len))

1877

(gnutls.library.functions

1878

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1879

ctypes.byref(buf_len)))

2521

1880

# Deinit the certificate

2522

gnutls.openpgp_crt_deinit(crt)

1881

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2523

1882

# Convert the buffer to a Python bytestring

2524

1883

fpr = ctypes.string_at(buf, buf_len.value)

2525

1884

# Convert the bytestring to hexadecimal notation

2527

1886

return hex_fpr

2528

1887

2529

1888

2530

class MultiprocessingMixIn:

1889

class MultiprocessingMixIn(object):

2531

1890

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2532

2533

1891

def sub_process_main(self, request, address):

2534

1892

try:

2535

1893

self.finish_request(request, address)

2536

1894

except Exception:

2537

1895

self.handle_error(request, address)

2538

1896

self.close_request(request)

2539

1897

2540

1898

def process_request(self, request, address):

2541

1899

"""Start a new process to process the request."""

2542

proc = multiprocessing.Process(target=self.sub_process_main,

2543

args=(request, address))

1900

proc = multiprocessing.Process(target = self.sub_process_main,

1901

args = (request, address))

2544

1902

proc.start()

2545

1903

return proc

2546

1904

2547

1905

2548

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

1906

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2549

1907

""" adds a pipe to the MixIn """

2550

2551

1908

def process_request(self, request, client_address):

2552

1909

"""Overrides and wraps the original process_request().

2553

1910

2554

1911

This function creates a new pipe in self.pipe

2555

1912

"""

2556

1913

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2557

1914

2558

1915

proc = MultiprocessingMixIn.process_request(self, request,

2559

1916

client_address)

2560

1917

self.child_pipe.close()

2561

1918

self.add_pipe(parent_pipe, proc)

2562

1919

2563

1920

def add_pipe(self, parent_pipe, proc):

2564

1921

"""Dummy function; override as necessary"""

2565

1922

raise NotImplementedError()

2566

1923

2567

1924

2568

1925

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2569

socketserver.TCPServer):

1926

socketserver.TCPServer, object):

2570

1927

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2571

1928

2572

1929

Attributes:

2573

1930

enabled: Boolean; whether this server is activated yet

2574

1931

interface: None or a network interface name (string)

2575

1932

use_ipv6: Boolean; to use IPv6 or not

2576

1933

"""

2577

2578

1934

def __init__(self, server_address, RequestHandlerClass,

2579

interface=None,

2580

use_ipv6=True,

2581

socketfd=None):

1935

interface=None, use_ipv6=True, socketfd=None):

2582

1936

"""If socketfd is set, use that file descriptor instead of

2583

1937

creating a new one with socket.socket().

2584

1938

"""

2590

1944

self.socketfd = socketfd

2591

1945

# Save the original socket.socket() function

2592

1946

self.socket_socket = socket.socket

2593

2594

1947

# To implement --socket, we monkey patch socket.socket.

2595

#

1948

#

2596

1949

# (When socketserver.TCPServer is a new-style class, we

2597

1950

# could make self.socket into a property instead of monkey

2598

1951

# patching socket.socket.)

2599

#

1952

#

2600

1953

# Create a one-time-only replacement for socket.socket()

2601

1954

@functools.wraps(socket.socket)

2602

1955

def socket_wrapper(*args, **kwargs):

2614

1967

# socket_wrapper(), if socketfd was set.

2615

1968

socketserver.TCPServer.__init__(self, server_address,

2616

1969

RequestHandlerClass)

2617

1970

2618

1971

def server_bind(self):

2619

1972

"""This overrides the normal server_bind() function

2620

1973

to bind to an interface if one was specified, and also NOT to

2621

1974

bind to an address or port if they were not specified."""

2622

global SO_BINDTODEVICE

2623

1975

if self.interface is not None:

2624

1976

if SO_BINDTODEVICE is None:

2625

# Fall back to a hard-coded value which seems to be

2626

# common enough.

2627

logger.warning("SO_BINDTODEVICE not found, trying 25")

2628

SO_BINDTODEVICE = 25

2629

try:

2630

self.socket.setsockopt(

2631

socket.SOL_SOCKET, SO_BINDTODEVICE,

2632

(self.interface + "\0").encode("utf-8"))

2633

except socket.error as error:

2634

if error.errno == errno.EPERM:

2635

logger.error("No permission to bind to"

2636

" interface %s", self.interface)

2637

elif error.errno == errno.ENOPROTOOPT:

2638

logger.error("SO_BINDTODEVICE not available;"

2639

" cannot bind to interface %s",

2640

self.interface)

2641

elif error.errno == errno.ENODEV:

2642

logger.error("Interface %s does not exist,"

2643

" cannot bind", self.interface)

2644

else:

2645

raise

1977

logger.error("SO_BINDTODEVICE does not exist;"

1978

" cannot bind to interface %s",

1979

self.interface)

1980

else:

1981

try:

1982

self.socket.setsockopt(socket.SOL_SOCKET,

1983

SO_BINDTODEVICE,

1984

(self.interface + "\0")

1985

.encode("utf-8"))

1986

except socket.error as error:

1987

if error.errno == errno.EPERM:

1988

logger.error("No permission to bind to"

1989

" interface %s", self.interface)

1990

elif error.errno == errno.ENOPROTOOPT:

1991

logger.error("SO_BINDTODEVICE not available;"

1992

" cannot bind to interface %s",

1993

self.interface)

1994

elif error.errno == errno.ENODEV:

1995

logger.error("Interface %s does not exist,"

1996

" cannot bind", self.interface)

1997

else:

1998

raise

2646

1999

# Only bind(2) the socket if we really need to.

2647

2000

if self.server_address[0] or self.server_address[1]:

2648

if self.server_address[1]:

2649

self.allow_reuse_address = True

2650

2001

if not self.server_address[0]:

2651

2002

if self.address_family == socket.AF_INET6:

2652

any_address = "::" # in6addr_any

2003

any_address = "::" # in6addr_any

2653

2004

else:

2654

any_address = "0.0.0.0" # INADDR_ANY

2005

any_address = "0.0.0.0" # INADDR_ANY

2655

2006

self.server_address = (any_address,

2656

2007

self.server_address[1])

2657

2008

elif not self.server_address[1]:

2658

self.server_address = (self.server_address[0], 0)

2009

self.server_address = (self.server_address[0],

2010

0)

2659

2011

# if self.interface:

2660

2012

# self.server_address = (self.server_address[0],

2661

2013

# 0, # port

2667

2019

2668

2020

class MandosServer(IPv6_TCPServer):

2669

2021

"""Mandos server.

2670

2022

2671

2023

Attributes:

2672

2024

clients: set of Client objects

2673

2025

gnutls_priority GnuTLS priority string

2674

2026

use_dbus: Boolean; to emit D-Bus signals or not

2675

2676

Assumes a GLib.MainLoop event loop.

2027

2028

Assumes a gobject.MainLoop event loop.

2677

2029

"""

2678

2679

2030

def __init__(self, server_address, RequestHandlerClass,

2680

interface=None,

2681

use_ipv6=True,

2682

clients=None,

2683

gnutls_priority=None,

2684

use_dbus=True,

2685

socketfd=None):

2031

interface=None, use_ipv6=True, clients=None,

2032

gnutls_priority=None, use_dbus=True, socketfd=None):

2686

2033

self.enabled = False

2687

2034

self.clients = clients

2688

2035

if self.clients is None:

2691

2038

self.gnutls_priority = gnutls_priority

2692

2039

IPv6_TCPServer.__init__(self, server_address,

2693

2040

RequestHandlerClass,

2694

interface=interface,

2695

use_ipv6=use_ipv6,

2696

socketfd=socketfd)

2697

2041

interface = interface,

2042

use_ipv6 = use_ipv6,

2043

socketfd = socketfd)

2698

2044

def server_activate(self):

2699

2045

if self.enabled:

2700

2046

return socketserver.TCPServer.server_activate(self)

2701

2047

2702

2048

def enable(self):

2703

2049

self.enabled = True

2704

2050

2705

2051

def add_pipe(self, parent_pipe, proc):

2706

2052

# Call "handle_ipc" for both data and EOF events

2707

GLib.io_add_watch(

2708

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2709

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2710

functools.partial(self.handle_ipc,

2711

parent_pipe=parent_pipe,

2712

proc=proc))

2713

2714

def handle_ipc(self, source, condition,

2715

parent_pipe=None,

2716

proc=None,

2717

client_object=None):

2053

gobject.io_add_watch(parent_pipe.fileno(),

2054

gobject.IO_IN | gobject.IO_HUP,

2055

functools.partial(self.handle_ipc,

2056

parent_pipe =

2057

parent_pipe,

2058

proc = proc))

2059

2060

def handle_ipc(self, source, condition, parent_pipe=None,

2061

proc = None, client_object=None):

2718

2062

# error, or the other end of multiprocessing.Pipe has closed

2719

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2063

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2720

2064

# Wait for other process to exit

2721

2065

proc.join()

2722

2066

return False

2723

2067

2724

2068

# Read a request from the child

2725

2069

request = parent_pipe.recv()

2726

2070

command = request[0]

2727

2071

2728

2072

if command == 'init':

2729

key_id = request[1].decode("ascii")

2730

fpr = request[2].decode("ascii")

2731

address = request[3]

2732

2733

for c in self.clients.values():

2734

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2735

"27AE41E4649B934CA495991B7852B855"):

2736

continue

2737

if key_id and c.key_id == key_id:

2738

client = c

2739

break

2740

if fpr and c.fingerprint == fpr:

2073

fpr = request[1]

2074

address = request[2]

2075

2076

for c in self.clients.itervalues():

2077

if c.fingerprint == fpr:

2741

2078

client = c

2742

2079

break

2743

2080

else:

2744

logger.info("Client not found for key ID: %s, address"

2745

": %s", key_id or fpr, address)

2081

logger.info("Client not found for fingerprint: %s, ad"

2082

"dress: %s", fpr, address)

2746

2083

if self.use_dbus:

2747

2084

# Emit D-Bus signal

2748

mandos_dbus_service.ClientNotFound(key_id or fpr,

2085

mandos_dbus_service.ClientNotFound(fpr,

2749

2086

address[0])

2750

2087

parent_pipe.send(False)

2751

2088

return False

2752

2753

GLib.io_add_watch(

2754

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2755

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2756

functools.partial(self.handle_ipc,

2757

parent_pipe=parent_pipe,

2758

proc=proc,

2759

client_object=client))

2089

2090

gobject.io_add_watch(parent_pipe.fileno(),

2091

gobject.IO_IN | gobject.IO_HUP,

2092

functools.partial(self.handle_ipc,

2093

parent_pipe =

2094

parent_pipe,

2095

proc = proc,

2096

client_object =

2097

client))

2760

2098

parent_pipe.send(True)

2761

2099

# remove the old hook in favor of the new above hook on

2762

2100

# same fileno

2765

2103

funcname = request[1]

2766

2104

args = request[2]

2767

2105

kwargs = request[3]

2768

2106

2769

2107

parent_pipe.send(('data', getattr(client_object,

2770

2108

funcname)(*args,

2771

**kwargs)))

2772

2109

**kwargs)))

2110

2773

2111

if command == 'getattr':

2774

2112

attrname = request[1]

2775

if isinstance(client_object.__getattribute__(attrname),

2776

collections.abc.Callable):

2777

parent_pipe.send(('function', ))

2113

if callable(client_object.__getattribute__(attrname)):

2114

parent_pipe.send(('function',))

2778

2115

else:

2779

parent_pipe.send((

2780

'data', client_object.__getattribute__(attrname)))

2781

2116

parent_pipe.send(('data', client_object

2117

.__getattribute__(attrname)))

2118

2782

2119

if command == 'setattr':

2783

2120

attrname = request[1]

2784

2121

value = request[2]

2785

2122

setattr(client_object, attrname, value)

2786

2123

2787

2124

return True

2788

2125

2789

2126

2790

2127

def rfc3339_duration_to_delta(duration):

2791

2128

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2792

2793

>>> timedelta = datetime.timedelta

2794

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2795

True

2796

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2797

True

2798

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2799

True

2800

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2801

True

2802

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2803

True

2804

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2805

True

2806

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2807

True

2808

>>> del timedelta

2129

2130

>>> rfc3339_duration_to_delta("P7D")

2131

datetime.timedelta(7)

2132

>>> rfc3339_duration_to_delta("PT60S")

2133

datetime.timedelta(0, 60)

2134

>>> rfc3339_duration_to_delta("PT60M")

2135

datetime.timedelta(0, 3600)

2136

>>> rfc3339_duration_to_delta("PT24H")

2137

datetime.timedelta(1)

2138

>>> rfc3339_duration_to_delta("P1W")

2139

datetime.timedelta(7)

2140

>>> rfc3339_duration_to_delta("PT5M30S")

2141

datetime.timedelta(0, 330)

2142

>>> rfc3339_duration_to_delta("P1DT3M20S")

2143

datetime.timedelta(1, 200)

2809

2144

"""

2810

2145

2811

2146

# Parsing an RFC 3339 duration with regular expressions is not

2812

2147

# possible - there would have to be multiple places for the same

2813

2148

# values, like seconds. The current code, while more esoteric, is

2814

2149

# cleaner without depending on a parsing library. If Python had a

2815

2150

# built-in library for parsing we would use it, but we'd like to

2816

2151

# avoid excessive use of external libraries.

2817

2152

2818

2153

# New type for defining tokens, syntax, and semantics all-in-one

2819

Token = collections.namedtuple("Token", (

2820

"regexp", # To match token; if "value" is not None, must have

2821

# a "group" containing digits

2822

"value", # datetime.timedelta or None

2823

"followers")) # Tokens valid after this token

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2824

2163

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2825

2164

# the "duration" ABNF definition in RFC 3339, Appendix A.

2826

2165

token_end = Token(re.compile(r"$"), None, frozenset())

2827

2166

token_second = Token(re.compile(r"(\d+)S"),

2828

2167

datetime.timedelta(seconds=1),

2829

frozenset((token_end, )))

2168

frozenset((token_end,)))

2830

2169

token_minute = Token(re.compile(r"(\d+)M"),

2831

2170

datetime.timedelta(minutes=1),

2832

2171

frozenset((token_second, token_end)))

2848

2187

frozenset((token_month, token_end)))

2849

2188

token_week = Token(re.compile(r"(\d+)W"),

2850

2189

datetime.timedelta(weeks=1),

2851

frozenset((token_end, )))

2190

frozenset((token_end,)))

2852

2191

token_duration = Token(re.compile(r"P"), None,

2853

2192

frozenset((token_year, token_month,

2854

2193

token_day, token_time,

2855

2194

token_week)))

2856

# Define starting values:

2857

# Value so far

2858

value = datetime.timedelta()

2195

# Define starting values

2196

value = datetime.timedelta() # Value so far

2859

2197

found_token = None

2860

# Following valid tokens

2861

followers = frozenset((token_duration, ))

2862

# String left to parse

2863

s = duration

2198

followers = frozenset((token_duration,)) # Following valid tokens

2199

s = duration # String left to parse

2864

2200

# Loop until end token is found

2865

2201

while found_token is not token_end:

2866

2202

# Search for any currently valid tokens

2882

2218

break

2883

2219

else:

2884

2220

# No currently valid tokens were found

2885

raise ValueError("Invalid RFC 3339 duration: {!r}"

2886

.format(duration))

2221

raise ValueError("Invalid RFC 3339 duration")

2887

2222

# End token found

2888

2223

return value

2889

2224

2890

2225

2891

2226

def string_to_delta(interval):

2892

2227

"""Parse a string and return a datetime.timedelta

2893

2894

>>> string_to_delta('7d') == datetime.timedelta(7)

2895

True

2896

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2897

True

2898

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2899

True

2900

>>> string_to_delta('24h') == datetime.timedelta(1)

2901

True

2902

>>> string_to_delta('1w') == datetime.timedelta(7)

2903

True

2904

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2905

True

2228

2229

>>> string_to_delta('7d')

2230

datetime.timedelta(7)

2231

>>> string_to_delta('60s')

2232

datetime.timedelta(0, 60)

2233

>>> string_to_delta('60m')

2234

datetime.timedelta(0, 3600)

2235

>>> string_to_delta('24h')

2236

datetime.timedelta(1)

2237

>>> string_to_delta('1w')

2238

datetime.timedelta(7)

2239

>>> string_to_delta('5m 30s')

2240

datetime.timedelta(0, 330)

2906

2241

"""

2907

2242

2908

2243

try:

2909

2244

return rfc3339_duration_to_delta(interval)

2910

2245

except ValueError:

2911

2246

pass

2912

2247

2913

2248

timevalue = datetime.timedelta(0)

2914

2249

for s in interval.split():

2915

2250

try:

2926

2261

elif suffix == "w":

2927

2262

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2928

2263

else:

2929

raise ValueError("Unknown suffix {!r}".format(suffix))

2264

raise ValueError("Unknown suffix {!r}"

2265

.format(suffix))

2930

2266

except IndexError as e:

2931

2267

raise ValueError(*(e.args))

2932

2268

timevalue += delta

2933

2269

return timevalue

2934

2270

2935

2271

2936

def daemon(nochdir=False, noclose=False):

2272

def daemon(nochdir = False, noclose = False):

2937

2273

"""See daemon(3). Standard BSD Unix function.

2938

2274

2939

2275

This should really exist as os.daemon, but it doesn't (yet)."""

2940

2276

if os.fork():

2941

2277

sys.exit()

2948

2284

# Close all standard open file descriptors

2949

2285

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2950

2286

if not stat.S_ISCHR(os.fstat(null).st_mode):

2951

raise OSError(errno.ENODEV,

2952

"{} not a character device"

2287

raise OSError(errno.ENODEV, "{} not a character device"

2953

2288

.format(os.devnull))

2954

2289

os.dup2(null, sys.stdin.fileno())

2955

2290

os.dup2(null, sys.stdout.fileno())

2959

2294

2960

2295

2961

2296

def main():

2962

2297

2963

2298

##################################################################

2964

2299

# Parsing of options, both command line and config file

2965

2300

2966

2301

parser = argparse.ArgumentParser()

2967

2302

parser.add_argument("-v", "--version", action="version",

2968

version="%(prog)s {}".format(version),

2303

version = "%(prog)s {}".format(version),

2969

2304

help="show version number and exit")

2970

2305

parser.add_argument("-i", "--interface", metavar="IF",

2971

2306

help="Bind to interface IF")

3007

2342

parser.add_argument("--no-zeroconf", action="store_false",

3008

2343

dest="zeroconf", help="Do not use Zeroconf",

3009

2344

default=None)

3010

2345

3011

2346

options = parser.parse_args()

3012

2347

2348

if options.check:

2349

import doctest

2350

fail_count, test_count = doctest.testmod()

2351

sys.exit(os.EX_OK if fail_count == 0 else 1)

2352

3013

2353

# Default values for config file for server-global settings

3014

if gnutls.has_rawpk:

3015

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3016

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3017

else:

3018

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3019

":+SIGN-DSA-SHA256")

3020

server_defaults = {"interface": "",

3021

"address": "",

3022

"port": "",

3023

"debug": "False",

3024

"priority": priority,

3025

"servicename": "Mandos",

3026

"use_dbus": "True",

3027

"use_ipv6": "True",

3028

"debuglevel": "",

3029

"restore": "True",

3030

"socket": "",

3031

"statedir": "/var/lib/mandos",

3032

"foreground": "False",

3033

"zeroconf": "True",

3034

}

3035

del priority

3036

2354

server_defaults = { "interface": "",

2355

"address": "",

2356

"port": "",

2357

"debug": "False",

2358

"priority":

2359

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2360

"servicename": "Mandos",

2361

"use_dbus": "True",

2362

"use_ipv6": "True",

2363

"debuglevel": "",

2364

"restore": "True",

2365

"socket": "",

2366

"statedir": "/var/lib/mandos",

2367

"foreground": "False",

2368

"zeroconf": "True",

2369

}

2370

3037

2371

# Parse config file for server-global settings

3038

server_config = configparser.ConfigParser(server_defaults)

2372

server_config = configparser.SafeConfigParser(server_defaults)

3039

2373

del server_defaults

3040

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3041

# Convert the ConfigParser object to a dict

2374

server_config.read(os.path.join(options.configdir,

2375

"mandos.conf"))

2376

# Convert the SafeConfigParser object to a dict

3042

2377

server_settings = server_config.defaults()

3043

2378

# Use the appropriate methods on the non-string config options

3044

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3045

"foreground", "zeroconf"):

2379

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3046

2380

server_settings[option] = server_config.getboolean("DEFAULT",

3047

2381

option)

3048

2382

if server_settings["port"]:

3058

2392

server_settings["socket"] = os.dup(server_settings

3059

2393

["socket"])

3060

2394

del server_config

3061

2395

3062

2396

# Override the settings from the config file with command line

3063

2397

# options, if set.

3064

2398

for option in ("interface", "address", "port", "debug",

3065

"priority", "servicename", "configdir", "use_dbus",

3066

"use_ipv6", "debuglevel", "restore", "statedir",

3067

"socket", "foreground", "zeroconf"):

2399

"priority", "servicename", "configdir",

2400

"use_dbus", "use_ipv6", "debuglevel", "restore",

2401

"statedir", "socket", "foreground", "zeroconf"):

3068

2402

value = getattr(options, option)

3069

2403

if value is not None:

3070

2404

server_settings[option] = value

3082

2416

if server_settings["debug"]:

3083

2417

server_settings["foreground"] = True

3084

2418

# Now we have our good server settings in "server_settings"

3085

2419

3086

2420

##################################################################

3087

3088

if (not server_settings["zeroconf"]

3089

and not (server_settings["port"]

3090

or server_settings["socket"] != "")):

3091

parser.error("Needs port or socket to work without Zeroconf")

3092

2421

2422

if (not server_settings["zeroconf"] and

2423

not (server_settings["port"]

2424

or server_settings["socket"] != "")):

2425

parser.error("Needs port or socket to work without"

2426

" Zeroconf")

2427

3093

2428

# For convenience

3094

2429

debug = server_settings["debug"]

3095

2430

debuglevel = server_settings["debuglevel"]

3099

2434

stored_state_file)

3100

2435

foreground = server_settings["foreground"]

3101

2436

zeroconf = server_settings["zeroconf"]

3102

2437

3103

2438

if debug:

3104

2439

initlogger(debug, logging.DEBUG)

3105

2440

else:

3108

2443

else:

3109

2444

level = getattr(logging, debuglevel.upper())

3110

2445

initlogger(debug, level)

3111

2446

3112

2447

if server_settings["servicename"] != "Mandos":

3113

syslogger.setFormatter(

3114

logging.Formatter('Mandos ({}) [%(process)d]:'

3115

' %(levelname)s: %(message)s'.format(

3116

server_settings["servicename"])))

3117

2448

syslogger.setFormatter(logging.Formatter

2449

('Mandos ({}) [%(process)d]:'

2450

' %(levelname)s: %(message)s'

2451

.format(server_settings

2452

["servicename"])))

2453

3118

2454

# Parse config file with clients

3119

client_config = configparser.ConfigParser(Client.client_defaults)

2455

client_config = configparser.SafeConfigParser(Client

2456

.client_defaults)

3120

2457

client_config.read(os.path.join(server_settings["configdir"],

3121

2458

"clients.conf"))

3122

2459

3123

2460

global mandos_dbus_service

3124

2461

mandos_dbus_service = None

3125

2462

3126

2463

socketfd = None

3127

2464

if server_settings["socket"] != "":

3128

2465

socketfd = server_settings["socket"]

3129

tcp_server = MandosServer(

3130

(server_settings["address"], server_settings["port"]),

3131

ClientHandler,

3132

interface=(server_settings["interface"] or None),

3133

use_ipv6=use_ipv6,

3134

gnutls_priority=server_settings["priority"],

3135

use_dbus=use_dbus,

3136

socketfd=socketfd)

2466

tcp_server = MandosServer((server_settings["address"],

2467

server_settings["port"]),

2468

ClientHandler,

2469

interface=(server_settings["interface"]

2470

or None),

2471

use_ipv6=use_ipv6,

2472

gnutls_priority=

2473

server_settings["priority"],

2474

use_dbus=use_dbus,

2475

socketfd=socketfd)

3137

2476

if not foreground:

3138

2477

pidfilename = "/run/mandos.pid"

3139

2478

if not os.path.isdir("/run/."):

3140

2479

pidfilename = "/var/run/mandos.pid"

3141

2480

pidfile = None

3142

2481

try:

3143

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2482

pidfile = open(pidfilename, "w")

3144

2483

except IOError as e:

3145

2484

logger.error("Could not open file %r", pidfilename,

3146

2485

exc_info=e)

3147

3148

for name, group in (("_mandos", "_mandos"),

3149

("mandos", "mandos"),

3150

("nobody", "nogroup")):

2486

2487

for name in ("_mandos", "mandos", "nobody"):

3151

2488

try:

3152

2489

uid = pwd.getpwnam(name).pw_uid

3153

gid = pwd.getpwnam(group).pw_gid

2490

gid = pwd.getpwnam(name).pw_gid

3154

2491

break

3155

2492

except KeyError:

3156

2493

continue

3160

2497

try:

3161

2498

os.setgid(gid)

3162

2499

os.setuid(uid)

3163

if debug:

3164

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3165

gid))

3166

2500

except OSError as error:

3167

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3168

.format(uid, gid, os.strerror(error.errno)))

3169

2501

if error.errno != errno.EPERM:

3170

2502

raise

3171

2503

3172

2504

if debug:

3173

2505

# Enable all possible GnuTLS debugging

3174

2506

3175

2507

# "Use a log level over 10 to enable all debugging options."

3176

2508

# - GnuTLS manual

3177

gnutls.global_set_log_level(11)

3178

3179

@gnutls.log_func

2509

gnutls.library.functions.gnutls_global_set_log_level(11)

2510

2511

@gnutls.library.types.gnutls_log_func

3180

2512

def debug_gnutls(level, string):

3181

2513

logger.debug("GnuTLS: %s", string[:-1])

3182

3183

gnutls.global_set_log_function(debug_gnutls)

3184

2514

2515

(gnutls.library.functions

2516

.gnutls_global_set_log_function(debug_gnutls))

2517

3185

2518

# Redirect stdin so all checkers get /dev/null

3186

2519

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3187

2520

os.dup2(null, sys.stdin.fileno())

3188

2521

if null > 2:

3189

2522

os.close(null)

3190

2523

3191

2524

# Need to fork before connecting to D-Bus

3192

2525

if not foreground:

3193

2526

# Close all input and output, do double fork, etc.

3194

2527

daemon()

3195

3196

if gi.version_info < (3, 10, 2):

3197

# multiprocessing will use threads, so before we use GLib we

3198

# need to inform GLib that threads will be used.

3199

GLib.threads_init()

3200

2528

2529

# multiprocessing will use threads, so before we use gobject we

2530

# need to inform gobject that threads will be used.

2531

gobject.threads_init()

2532

3201

2533

global main_loop

3202

2534

# From the Avahi example code

3203

2535

DBusGMainLoop(set_as_default=True)

3204

main_loop = GLib.MainLoop()

2536

main_loop = gobject.MainLoop()

3205

2537

bus = dbus.SystemBus()

3206

2538

# End of Avahi example code

3207

2539

if use_dbus:

3208

2540

try:

3209

2541

bus_name = dbus.service.BusName("se.recompile.Mandos",

3210

bus,

3211

do_not_queue=True)

3212

old_bus_name = dbus.service.BusName(

3213

"se.bsnet.fukt.Mandos", bus,

3214

do_not_queue=True)

3215

except dbus.exceptions.DBusException as e:

2542

bus, do_not_queue=True)

2543

old_bus_name = (dbus.service.BusName

2544

("se.bsnet.fukt.Mandos", bus,

2545

do_not_queue=True))

2546

except dbus.exceptions.NameExistsException as e:

3216

2547

logger.error("Disabling D-Bus:", exc_info=e)

3217

2548

use_dbus = False

3218

2549

server_settings["use_dbus"] = False

3219

2550

tcp_server.use_dbus = False

3220

2551

if zeroconf:

3221

2552

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3222

service = AvahiServiceToSyslog(

3223

name=server_settings["servicename"],

3224

servicetype="_mandos._tcp",

3225

protocol=protocol,

3226

bus=bus)

2553

service = AvahiServiceToSyslog(name =

2554

server_settings["servicename"],

2555

servicetype = "_mandos._tcp",

2556

protocol = protocol, bus = bus)

3227

2557

if server_settings["interface"]:

3228

service.interface = if_nametoindex(

3229

server_settings["interface"].encode("utf-8"))

3230

2558

service.interface = (if_nametoindex

2559

(server_settings["interface"]

2560

.encode("utf-8")))

2561

3231

2562

global multiprocessing_manager

3232

2563

multiprocessing_manager = multiprocessing.Manager()

3233

2564

3234

2565

client_class = Client

3235

2566

if use_dbus:

3236

client_class = functools.partial(ClientDBus, bus=bus)

3237

2567

client_class = functools.partial(ClientDBus, bus = bus)

2568

3238

2569

client_settings = Client.config_parser(client_config)

3239

2570

old_client_settings = {}

3240

2571

clients_data = {}

3241

2572

3242

2573

# This is used to redirect stdout and stderr for checker processes

3243

2574

global wnull

3244

wnull = open(os.devnull, "w") # A writable /dev/null

2575

wnull = open(os.devnull, "w") # A writable /dev/null

3245

2576

# Only used if server is running in foreground but not in debug

3246

2577

# mode

3247

2578

if debug or not foreground:

3248

2579

wnull.close()

3249

2580

3250

2581

# Get client data and settings from last running state.

3251

2582

if server_settings["restore"]:

3252

2583

try:

3253

2584

with open(stored_state_path, "rb") as stored_state:

3254

if sys.version_info.major == 2:

3255

clients_data, old_client_settings = pickle.load(

3256

stored_state)

3257

else:

3258

bytes_clients_data, bytes_old_client_settings = (

3259

pickle.load(stored_state, encoding="bytes"))

3260

# Fix bytes to strings

3261

# clients_data

3262

# .keys()

3263

clients_data = {(key.decode("utf-8")

3264

if isinstance(key, bytes)

3265

else key): value

3266

for key, value in

3267

bytes_clients_data.items()}

3268

del bytes_clients_data

3269

for key in clients_data:

3270

value = {(k.decode("utf-8")

3271

if isinstance(k, bytes) else k): v

3272

for k, v in

3273

clients_data[key].items()}

3274

clients_data[key] = value

3275

# .client_structure

3276

value["client_structure"] = [

3277

(s.decode("utf-8")

3278

if isinstance(s, bytes)

3279

else s) for s in

3280

value["client_structure"]]

3281

# .name, .host, and .checker_command

3282

for k in ("name", "host", "checker_command"):

3283

if isinstance(value[k], bytes):

3284

value[k] = value[k].decode("utf-8")

3285

if "key_id" not in value:

3286

value["key_id"] = ""

3287

elif "fingerprint" not in value:

3288

value["fingerprint"] = ""

3289

# old_client_settings

3290

# .keys()

3291

old_client_settings = {

3292

(key.decode("utf-8")

3293

if isinstance(key, bytes)

3294

else key): value

3295

for key, value in

3296

bytes_old_client_settings.items()}

3297

del bytes_old_client_settings

3298

# .host and .checker_command

3299

for value in old_client_settings.values():

3300

for attribute in ("host", "checker_command"):

3301

if isinstance(value[attribute], bytes):

3302

value[attribute] = (value[attribute]

3303

.decode("utf-8"))

2585

clients_data, old_client_settings = (pickle.load

2586

(stored_state))

3304

2587

os.remove(stored_state_path)

3305

2588

except IOError as e:

3306

2589

if e.errno == errno.ENOENT:

3307

logger.warning("Could not load persistent state:"

3308

" {}".format(os.strerror(e.errno)))

2590

logger.warning("Could not load persistent state: {}"

2591

.format(os.strerror(e.errno)))

3309

2592

else:

3310

2593

logger.critical("Could not load persistent state:",

3311

2594

exc_info=e)

3312

2595

raise

3313

2596

except EOFError as e:

3314

2597

logger.warning("Could not load persistent state: "

3315

"EOFError:",

3316

exc_info=e)

3317

2598

"EOFError:", exc_info=e)

2599

3318

2600

with PGPEngine() as pgp:

3319

2601

for client_name, client in clients_data.items():

3320

2602

# Skip removed clients

3321

2603

if client_name not in client_settings:

3322

2604

continue

3323

2605

3324

2606

# Decide which value to use after restoring saved state.

3325

2607

# We have three different values: Old config file,

3326

2608

# new config file, and saved state.

3331

2613

# For each value in new config, check if it

3332

2614

# differs from the old config value (Except for

3333

2615

# the "secret" attribute)

3334

if (name != "secret"

3335

and (value !=

3336

old_client_settings[client_name][name])):

2616

if (name != "secret" and

2617

value != old_client_settings[client_name]

2618

[name]):

3337

2619

client[name] = value

3338

2620

except KeyError:

3339

2621

pass

3340

2622

3341

2623

# Clients who has passed its expire date can still be

3342

# enabled if its last checker was successful. A Client

2624

# enabled if its last checker was successful. Clients

3343

2625

# whose checker succeeded before we stored its state is

3344

2626

# assumed to have successfully run all checkers during

3345

2627

# downtime.

3348

2630

if not client["last_checked_ok"]:

3349

2631

logger.warning(

3350

2632

"disabling client {} - Client never "

3351

"performed a successful checker".format(

3352

client_name))

2633

"performed a successful checker"

2634

.format(client_name))

3353

2635

client["enabled"] = False

3354

2636

elif client["last_checker_status"] != 0:

3355

2637

logger.warning(

3356

2638

"disabling client {} - Client last"

3357

" checker failed with error code"

3358

" {}".format(

3359

client_name,

3360

client["last_checker_status"]))

2639

" checker failed with error code {}"

2640

.format(client_name,

2641

client["last_checker_status"]))

3361

2642

client["enabled"] = False

3362

2643

else:

3363

client["expires"] = (

3364

datetime.datetime.utcnow()

3365

+ client["timeout"])

2644

client["expires"] = (datetime.datetime

2645

.utcnow()

2646

+ client["timeout"])

3366

2647

logger.debug("Last checker succeeded,"

3367

" keeping {} enabled".format(

3368

client_name))

2648

" keeping {} enabled"

2649

.format(client_name))

3369

2650

try:

3370

client["secret"] = pgp.decrypt(

3371

client["encrypted_secret"],

3372

client_settings[client_name]["secret"])

2651

client["secret"] = (

2652

pgp.decrypt(client["encrypted_secret"],

2653

client_settings[client_name]

2654

["secret"]))

3373

2655

except PGPError:

3374

2656

# If decryption fails, we use secret from new settings

3375

logger.debug("Failed to decrypt {} old secret".format(

3376

client_name))

3377

client["secret"] = (client_settings[client_name]

3378

["secret"])

3379

2657

logger.debug("Failed to decrypt {} old secret"

2658

.format(client_name))

2659

client["secret"] = (

2660

client_settings[client_name]["secret"])

2661

3380

2662

# Add/remove clients based on new changes made to config

3381

2663

for client_name in (set(old_client_settings)

3382

2664

- set(client_settings)):

3384

2666

for client_name in (set(client_settings)

3385

2667

- set(old_client_settings)):

3386

2668

clients_data[client_name] = client_settings[client_name]

3387

2669

3388

2670

# Create all client objects

3389

2671

for client_name, client in clients_data.items():

3390

2672

tcp_server.clients[client_name] = client_class(

3391

name=client_name,

3392

settings=client,

3393

server_settings=server_settings)

3394

2673

name = client_name, settings = client,

2674

server_settings = server_settings)

2675

3395

2676

if not tcp_server.clients:

3396

2677

logger.warning("No clients defined")

3397

2678

3398

2679

if not foreground:

3399

2680

if pidfile is not None:

3400

pid = os.getpid()

3401

2681

try:

3402

2682

with pidfile:

3403

print(pid, file=pidfile)

2683

pid = os.getpid()

2684

pidfile.write("{}\n".format(pid).encode("utf-8"))

3404

2685

except IOError:

3405

2686

logger.error("Could not write to file %r with PID %d",

3406

2687

pidfilename, pid)

3407

2688

del pidfile

3408

2689

del pidfilename

3409

3410

for termsig in (signal.SIGHUP, signal.SIGTERM):

3411

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3412

lambda: main_loop.quit() and False)

3413

2690

2691

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2692

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2693

3414

2694

if use_dbus:

3415

3416

@alternate_dbus_interfaces(

3417

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3418

class MandosDBusService(DBusObjectWithObjectManager):

2695

@alternate_dbus_interfaces({"se.recompile.Mandos":

2696

"se.bsnet.fukt.Mandos"})

2697

class MandosDBusService(DBusObjectWithProperties):

3419

2698

"""A D-Bus proxy object"""

3420

3421

2699

def __init__(self):

3422

2700

dbus.service.Object.__init__(self, bus, "/")

3423

3424

2701

_interface = "se.recompile.Mandos"

3425

2702

2703

@dbus_interface_annotations(_interface)

2704

def _foo(self):

2705

return { "org.freedesktop.DBus.Property"

2706

".EmitsChangedSignal":

2707

"false"}

2708

3426

2709

@dbus.service.signal(_interface, signature="o")

3427

2710

def ClientAdded(self, objpath):

3428

2711

"D-Bus signal"

3429

2712

pass

3430

2713

3431

2714

@dbus.service.signal(_interface, signature="ss")

3432

def ClientNotFound(self, key_id, address):

2715

def ClientNotFound(self, fingerprint, address):

3433

2716

"D-Bus signal"

3434

2717

pass

3435

3436

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3437

"true"})

2718

3438

2719

@dbus.service.signal(_interface, signature="os")

3439

2720

def ClientRemoved(self, objpath, name):

3440

2721

"D-Bus signal"

3441

2722

pass

3442

3443

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3444

"true"})

2723

3445

2724

@dbus.service.method(_interface, out_signature="ao")

3446

2725

def GetAllClients(self):

3447

2726

"D-Bus method"

3448

return dbus.Array(c.dbus_object_path for c in

3449

tcp_server.clients.values())

3450

3451

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3452

"true"})

2727

return dbus.Array(c.dbus_object_path

2728

for c in

2729

tcp_server.clients.itervalues())

2730

3453

2731

@dbus.service.method(_interface,

3454

2732

out_signature="a{oa{sv}}")

3455

2733

def GetAllClientsWithProperties(self):

3456

2734

"D-Bus method"

3457

2735

return dbus.Dictionary(

3458

{c.dbus_object_path: c.GetAll(

3459

"se.recompile.Mandos.Client")

3460

for c in tcp_server.clients.values()},

2736

{ c.dbus_object_path: c.GetAll("")

2737

for c in tcp_server.clients.itervalues() },

3461

2738

signature="oa{sv}")

3462

2739

3463

2740

@dbus.service.method(_interface, in_signature="o")

3464

2741

def RemoveClient(self, object_path):

3465

2742

"D-Bus method"

3466

for c in tcp_server.clients.values():

2743

for c in tcp_server.clients.itervalues():

3467

2744

if c.dbus_object_path == object_path:

3468

2745

del tcp_server.clients[c.name]

3469

2746

c.remove_from_connection()

3470

# Don't signal the disabling

2747

# Don't signal anything except ClientRemoved

3471

2748

c.disable(quiet=True)

3472

# Emit D-Bus signal for removal

3473

self.client_removed_signal(c)

2749

# Emit D-Bus signal

2750

self.ClientRemoved(object_path, c.name)

3474

2751

return

3475

2752

raise KeyError(object_path)

3476

2753

3477

2754

del _interface

3478

3479

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3480

out_signature="a{oa{sa{sv}}}")

3481

def GetManagedObjects(self):

3482

"""D-Bus method"""

3483

return dbus.Dictionary(

3484

{client.dbus_object_path:

3485

dbus.Dictionary(

3486

{interface: client.GetAll(interface)

3487

for interface in

3488

client._get_all_interface_names()})

3489

for client in tcp_server.clients.values()})

3490

3491

def client_added_signal(self, client):

3492

"""Send the new standard signal and the old signal"""

3493

if use_dbus:

3494

# New standard signal

3495

self.InterfacesAdded(

3496

client.dbus_object_path,

3497

dbus.Dictionary(

3498

{interface: client.GetAll(interface)

3499

for interface in

3500

client._get_all_interface_names()}))

3501

# Old signal

3502

self.ClientAdded(client.dbus_object_path)

3503

3504

def client_removed_signal(self, client):

3505

"""Send the new standard signal and the old signal"""

3506

if use_dbus:

3507

# New standard signal

3508

self.InterfacesRemoved(

3509

client.dbus_object_path,

3510

client._get_all_interface_names())

3511

# Old signal

3512

self.ClientRemoved(client.dbus_object_path,

3513

client.name)

3514

2755

3515

2756

mandos_dbus_service = MandosDBusService()

3516

3517

# Save modules to variables to exempt the modules from being

3518

# unloaded before the function registered with atexit() is run.

3519

mp = multiprocessing

3520

wn = wnull

3521

2757

3522

2758

def cleanup():

3523

2759

"Cleanup function; run on exit"

3524

2760

if zeroconf:

3525

2761

service.cleanup()

3526

3527

mp.active_children()

3528

wn.close()

2762

2763

multiprocessing.active_children()

2764

wnull.close()

3529

2765

if not (tcp_server.clients or client_settings):

3530

2766

return

3531

2767

3532

2768

# Store client before exiting. Secrets are encrypted with key

3533

2769

# based on what config file has. If config file is

3534

2770

# removed/edited, old secret will thus be unrecovable.

3535

2771

clients = {}

3536

2772

with PGPEngine() as pgp:

3537

for client in tcp_server.clients.values():

2773

for client in tcp_server.clients.itervalues():

3538

2774

key = client_settings[client.name]["secret"]

3539

2775

client.encrypted_secret = pgp.encrypt(client.secret,

3540

2776

key)

3541

2777

client_dict = {}

3542

2778

3543

2779

# A list of attributes that can not be pickled

3544

2780

# + secret.

3545

exclude = {"bus", "changedstate", "secret",

3546

"checker", "server_settings"}

3547

for name, typ in inspect.getmembers(dbus.service

3548

.Object):

2781

exclude = { "bus", "changedstate", "secret",

2782

"checker", "server_settings" }

2783

for name, typ in (inspect.getmembers

2784

(dbus.service.Object)):

3549

2785

exclude.add(name)

3550

2786

3551

2787

client_dict["encrypted_secret"] = (client

3552

2788

.encrypted_secret)

3553

2789

for attr in client.client_structure:

3554

2790

if attr not in exclude:

3555

2791

client_dict[attr] = getattr(client, attr)

3556

2792

3557

2793

clients[client.name] = client_dict

3558

2794

del client_settings[client.name]["secret"]

3559

2795

3560

2796

try:

3561

with tempfile.NamedTemporaryFile(

3562

mode='wb',

3563

suffix=".pickle",

3564

prefix='clients-',

3565

dir=os.path.dirname(stored_state_path),

3566

delete=False) as stored_state:

3567

pickle.dump((clients, client_settings), stored_state,

3568

protocol=2)

3569

tempname = stored_state.name

2797

with (tempfile.NamedTemporaryFile

2798

(mode='wb', suffix=".pickle", prefix='clients-',

2799

dir=os.path.dirname(stored_state_path),

2800

delete=False)) as stored_state:

2801

pickle.dump((clients, client_settings), stored_state)

2802

tempname=stored_state.name

3570

2803

os.rename(tempname, stored_state_path)

3571

2804

except (IOError, OSError) as e:

3572

2805

if not debug:

3581

2814

logger.warning("Could not save persistent state:",

3582

2815

exc_info=e)

3583

2816

raise

3584

2817

3585

2818

# Delete all clients, and settings from config

3586

2819

while tcp_server.clients:

3587

2820

name, client = tcp_server.clients.popitem()

3588

2821

if use_dbus:

3589

2822

client.remove_from_connection()

3590

# Don't signal the disabling

2823

# Don't signal anything except ClientRemoved

3591

2824

client.disable(quiet=True)

3592

# Emit D-Bus signal for removal

3593

2825

if use_dbus:

3594

mandos_dbus_service.client_removed_signal(client)

2826

# Emit D-Bus signal

2827

mandos_dbus_service.ClientRemoved(client

2828

.dbus_object_path,

2829

client.name)

3595

2830

client_settings.clear()

3596

2831

3597

2832

atexit.register(cleanup)

3598

3599

for client in tcp_server.clients.values():

2833

2834

for client in tcp_server.clients.itervalues():

3600

2835

if use_dbus:

3601

# Emit D-Bus signal for adding

3602

mandos_dbus_service.client_added_signal(client)

2836

# Emit D-Bus signal

2837

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3603

2838

# Need to initiate checking of clients

3604

2839

if client.enabled:

3605

2840

client.init_checker()

3606

2841

3607

2842

tcp_server.enable()

3608

2843

tcp_server.server_activate()

3609

2844

3610

2845

# Find out what port we got

3611

2846

if zeroconf:

3612

2847

service.port = tcp_server.socket.getsockname()[1]

3617

2852

else: # IPv4

3618

2853

logger.info("Now listening on address %r, port %d",

3619

2854

*tcp_server.socket.getsockname())

3620

3621

# service.interface = tcp_server.socket.getsockname()[3]

3622

2855

2856

#service.interface = tcp_server.socket.getsockname()[3]

2857

3623

2858

try:

3624

2859

if zeroconf:

3625

2860

# From the Avahi example code

3630

2865

cleanup()

3631

2866

sys.exit(1)

3632

2867

# End of Avahi example code

3633

3634

GLib.io_add_watch(

3635

GLib.IOChannel.unix_new(tcp_server.fileno()),

3636

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3637

lambda *args, **kwargs: (tcp_server.handle_request

3638

(*args[2:], **kwargs) or True))

3639

2868

2869

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2870

lambda *args, **kwargs:

2871

(tcp_server.handle_request

2872

(*args[2:], **kwargs) or True))

2873

3640

2874

logger.debug("Starting main loop")

3641

2875

main_loop.run()

3642

2876

except AvahiError as error:

3651

2885

# Must run before the D-Bus bus name gets deregistered

3652

2886

cleanup()

3653

2887

3654

3655

def should_only_run_tests():

3656

parser = argparse.ArgumentParser(add_help=False)

3657

parser.add_argument("--check", action='store_true')

3658

args, unknown_args = parser.parse_known_args()

3659

run_tests = args.check

3660

if run_tests:

3661

# Remove --check argument from sys.argv

3662

sys.argv[1:] = unknown_args

3663

return run_tests

3664

3665

# Add all tests from doctest strings

3666

def load_tests(loader, tests, none):

3667

import doctest

3668

tests.addTests(doctest.DocTestSuite())

3669

return tests

3670

3671

2888

if __name__ == '__main__':

3672

try:

3673

if should_only_run_tests():

3674

# Call using ./mandos --check [--verbose]

3675

unittest.main()

3676

else:

3677

main()

3678

finally:

3679

logging.shutdown()

2889

main()