To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 750
- compare with another revision
- download diff
- download tarball
- view history from revision 750
- Committer: Teddy Hogeborn
- Date: 2015-05-30 16:47:00 UTC
- Revision ID: teddy@recompile.se-20150530164700-77zrd7964gdhbk1f
mandos: Disable D-Bus if any DBusException is raised when connecting.
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
48
44
import argparse
49
45
import datetime
50
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
51
53
try:
52
54
import ConfigParser as configparser
53
55
except ImportError:
76
78
import tempfile
77
79
import itertools
78
80
import collections
79
import codecs
80
import unittest
81
import random
82
81
83
82
import dbus
84
83
import dbus.service
85
import gi
86
from gi.repository import GLib
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
88
import avahi
87
89
from dbus.mainloop.glib import DBusGMainLoop
88
90
import ctypes
89
91
import ctypes.util
90
92
import xml.dom.minidom
91
93
import inspect
92
94
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
97
# Show warnings by default
98
if not sys.warnoptions:
99
import warnings
100
warnings.simplefilter("default")
101
102
# Try to find the value of SO_BINDTODEVICE:
103
95
try:
104
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
105
# newer, and it is also the most natural place for it:
106
96
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
107
97
except AttributeError:
108
98
try:
109
# This is where SO_BINDTODEVICE was up to and including Python
110
# 2.6, and also 3.2:
111
99
from IN import SO_BINDTODEVICE
112
100
except ImportError:
113
# In Python 2.7 it seems to have been removed entirely.
114
# Try running the C preprocessor:
115
try:
116
cc = subprocess.Popen(["cc", "--language=c", "-E",
117
"/dev/stdin"],
118
stdin=subprocess.PIPE,
119
stdout=subprocess.PIPE)
120
stdout = cc.communicate(
121
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
122
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
123
except (OSError, ValueError, IndexError):
124
# No value found
125
SO_BINDTODEVICE = None
126
127
if sys.version_info < (3, 2):
128
configparser.Configparser = configparser.SafeConfigParser
129
130
version = "1.8.9"
101
SO_BINDTODEVICE = None
102
103
if sys.version_info.major == 2:
104
str = unicode
105
106
version = "1.6.9"
131
107
stored_state_file = "clients.pickle"
132
108
133
109
logger = logging.getLogger()
134
logging.captureWarnings(True) # Show warnings via the logging system
135
110
syslogger = None
136
111
137
112
try:
138
113
if_nametoindex = ctypes.cdll.LoadLibrary(
139
114
ctypes.util.find_library("c")).if_nametoindex
140
115
except (OSError, AttributeError):
141
116
142
117
def if_nametoindex(interface):
143
118
"Get an interface index the hard way, i.e. using fcntl()"
144
119
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
149
124
return interface_index
150
125
151
126
152
def copy_function(func):
153
"""Make a copy of a function"""
154
if sys.version_info.major == 2:
155
return types.FunctionType(func.func_code,
156
func.func_globals,
157
func.func_name,
158
func.func_defaults,
159
func.func_closure)
160
else:
161
return types.FunctionType(func.__code__,
162
func.__globals__,
163
func.__name__,
164
func.__defaults__,
165
func.__closure__)
166
167
168
127
def initlogger(debug, level=logging.WARNING):
169
128
"""init logger and add loglevel"""
170
129
171
130
global syslogger
172
131
syslogger = (logging.handlers.SysLogHandler(
173
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
174
address="/dev/log"))
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
175
134
syslogger.setFormatter(logging.Formatter
176
135
('Mandos [%(process)d]: %(levelname)s:'
177
136
' %(message)s'))
178
137
logger.addHandler(syslogger)
179
138
180
139
if debug:
181
140
console = logging.StreamHandler()
182
141
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
192
151
pass
193
152
194
153
195
class PGPEngine:
154
class PGPEngine(object):
196
155
"""A simple class for OpenPGP symmetric encryption & decryption"""
197
156
198
157
def __init__(self):
199
158
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
200
self.gpg = "gpg"
201
try:
202
output = subprocess.check_output(["gpgconf"])
203
for line in output.splitlines():
204
name, text, path = line.split(b":")
205
if name == b"gpg":
206
self.gpg = path
207
break
208
except OSError as e:
209
if e.errno != errno.ENOENT:
210
raise
211
159
self.gnupgargs = ['--batch',
212
'--homedir', self.tempdir,
160
'--home', self.tempdir,
213
161
'--force-mdc',
214
'--quiet']
215
# Only GPG version 1 has the --no-use-agent option.
216
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
217
self.gnupgargs.append("--no-use-agent")
218
162
'--quiet',
163
'--no-use-agent']
164
219
165
def __enter__(self):
220
166
return self
221
167
222
168
def __exit__(self, exc_type, exc_value, traceback):
223
169
self._cleanup()
224
170
return False
225
171
226
172
def __del__(self):
227
173
self._cleanup()
228
174
229
175
def _cleanup(self):
230
176
if self.tempdir is not None:
231
177
# Delete contents of tempdir
232
178
for root, dirs, files in os.walk(self.tempdir,
233
topdown=False):
179
topdown = False):
234
180
for filename in files:
235
181
os.remove(os.path.join(root, filename))
236
182
for dirname in dirs:
238
184
# Remove tempdir
239
185
os.rmdir(self.tempdir)
240
186
self.tempdir = None
241
187
242
188
def password_encode(self, password):
243
189
# Passphrase can not be empty and can not contain newlines or
244
190
# NUL bytes. So we prefix it and hex encode it.
249
195
.replace(b"\n", b"\\n")
250
196
.replace(b"\0", b"\\x00"))
251
197
return encoded
252
198
253
199
def encrypt(self, data, password):
254
200
passphrase = self.password_encode(password)
255
201
with tempfile.NamedTemporaryFile(
256
202
dir=self.tempdir) as passfile:
257
203
passfile.write(passphrase)
258
204
passfile.flush()
259
proc = subprocess.Popen([self.gpg, '--symmetric',
205
proc = subprocess.Popen(['gpg', '--symmetric',
260
206
'--passphrase-file',
261
207
passfile.name]
262
208
+ self.gnupgargs,
263
stdin=subprocess.PIPE,
264
stdout=subprocess.PIPE,
265
stderr=subprocess.PIPE)
266
ciphertext, err = proc.communicate(input=data)
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
267
213
if proc.returncode != 0:
268
214
raise PGPError(err)
269
215
return ciphertext
270
216
271
217
def decrypt(self, data, password):
272
218
passphrase = self.password_encode(password)
273
219
with tempfile.NamedTemporaryFile(
274
dir=self.tempdir) as passfile:
220
dir = self.tempdir) as passfile:
275
221
passfile.write(passphrase)
276
222
passfile.flush()
277
proc = subprocess.Popen([self.gpg, '--decrypt',
223
proc = subprocess.Popen(['gpg', '--decrypt',
278
224
'--passphrase-file',
279
225
passfile.name]
280
226
+ self.gnupgargs,
281
stdin=subprocess.PIPE,
282
stdout=subprocess.PIPE,
283
stderr=subprocess.PIPE)
284
decrypted_plaintext, err = proc.communicate(input=data)
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
285
231
if proc.returncode != 0:
286
232
raise PGPError(err)
287
233
return decrypted_plaintext
288
234
289
235
290
# Pretend that we have an Avahi module
291
class avahi:
292
"""This isn't so much a class as it is a module-like namespace."""
293
IF_UNSPEC = -1 # avahi-common/address.h
294
PROTO_UNSPEC = -1 # avahi-common/address.h
295
PROTO_INET = 0 # avahi-common/address.h
296
PROTO_INET6 = 1 # avahi-common/address.h
297
DBUS_NAME = "org.freedesktop.Avahi"
298
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
299
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
300
DBUS_PATH_SERVER = "/"
301
302
@staticmethod
303
def string_array_to_txt_array(t):
304
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
305
for s in t), signature="ay")
306
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
307
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
308
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
309
SERVER_INVALID = 0 # avahi-common/defs.h
310
SERVER_REGISTERING = 1 # avahi-common/defs.h
311
SERVER_RUNNING = 2 # avahi-common/defs.h
312
SERVER_COLLISION = 3 # avahi-common/defs.h
313
SERVER_FAILURE = 4 # avahi-common/defs.h
314
315
316
236
class AvahiError(Exception):
317
237
def __init__(self, value, *args, **kwargs):
318
238
self.value = value
328
248
pass
329
249
330
250
331
class AvahiService:
251
class AvahiService(object):
332
252
"""An Avahi (Zeroconf) service.
333
253
334
254
Attributes:
335
255
interface: integer; avahi.IF_UNSPEC or an interface index.
336
256
Used to optionally bind to the specified interface.
348
268
server: D-Bus Server
349
269
bus: dbus.SystemBus()
350
270
"""
351
271
352
272
def __init__(self,
353
interface=avahi.IF_UNSPEC,
354
name=None,
355
servicetype=None,
356
port=None,
357
TXT=None,
358
domain="",
359
host="",
360
max_renames=32768,
361
protocol=avahi.PROTO_UNSPEC,
362
bus=None):
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
363
283
self.interface = interface
364
284
self.name = name
365
285
self.type = servicetype
374
294
self.server = None
375
295
self.bus = bus
376
296
self.entry_group_state_changed_match = None
377
297
378
298
def rename(self, remove=True):
379
299
"""Derived from the Avahi example code"""
380
300
if self.rename_count >= self.max_renames:
400
320
logger.critical("D-Bus Exception", exc_info=error)
401
321
self.cleanup()
402
322
os._exit(1)
403
323
404
324
def remove(self):
405
325
"""Derived from the Avahi example code"""
406
326
if self.entry_group_state_changed_match is not None:
408
328
self.entry_group_state_changed_match = None
409
329
if self.group is not None:
410
330
self.group.Reset()
411
331
412
332
def add(self):
413
333
"""Derived from the Avahi example code"""
414
334
self.remove()
431
351
dbus.UInt16(self.port),
432
352
avahi.string_array_to_txt_array(self.TXT))
433
353
self.group.Commit()
434
354
435
355
def entry_group_state_changed(self, state, error):
436
356
"""Derived from the Avahi example code"""
437
357
logger.debug("Avahi entry group state change: %i", state)
438
358
439
359
if state == avahi.ENTRY_GROUP_ESTABLISHED:
440
360
logger.debug("Zeroconf service established.")
441
361
elif state == avahi.ENTRY_GROUP_COLLISION:
445
365
logger.critical("Avahi: Error in group state changed %s",
446
366
str(error))
447
367
raise AvahiGroupError("State changed: {!s}".format(error))
448
368
449
369
def cleanup(self):
450
370
"""Derived from the Avahi example code"""
451
371
if self.group is not None:
456
376
pass
457
377
self.group = None
458
378
self.remove()
459
379
460
380
def server_state_changed(self, state, error=None):
461
381
"""Derived from the Avahi example code"""
462
382
logger.debug("Avahi server state change: %i", state)
474
394
logger.error(bad_states[state] + ": %r", error)
475
395
self.cleanup()
476
396
elif state == avahi.SERVER_RUNNING:
477
try:
478
self.add()
479
except dbus.exceptions.DBusException as error:
480
if (error.get_dbus_name()
481
== "org.freedesktop.Avahi.CollisionError"):
482
logger.info("Local Zeroconf service name"
483
" collision.")
484
return self.rename(remove=False)
485
else:
486
logger.critical("D-Bus Exception", exc_info=error)
487
self.cleanup()
488
os._exit(1)
397
self.add()
489
398
else:
490
399
if error is None:
491
400
logger.debug("Unknown state: %r", state)
492
401
else:
493
402
logger.debug("Unknown state: %r: %r", state, error)
494
403
495
404
def activate(self):
496
405
"""Derived from the Avahi example code"""
497
406
if self.server is None:
508
417
class AvahiServiceToSyslog(AvahiService):
509
418
def rename(self, *args, **kwargs):
510
419
"""Add the new name to the syslog messages"""
511
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
420
ret = AvahiService.rename(self, *args, **kwargs)
512
421
syslogger.setFormatter(logging.Formatter(
513
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
514
423
.format(self.name)))
515
424
return ret
516
425
517
426
518
# Pretend that we have a GnuTLS module
519
class gnutls:
520
"""This isn't so much a class as it is a module-like namespace."""
521
522
library = ctypes.util.find_library("gnutls")
523
if library is None:
524
library = ctypes.util.find_library("gnutls-deb0")
525
_library = ctypes.cdll.LoadLibrary(library)
526
del library
527
528
# Unless otherwise indicated, the constants and types below are
529
# all from the gnutls/gnutls.h C header file.
530
531
# Constants
532
E_SUCCESS = 0
533
E_INTERRUPTED = -52
534
E_AGAIN = -28
535
CRT_OPENPGP = 2
536
CRT_RAWPK = 3
537
CLIENT = 2
538
SHUT_RDWR = 0
539
CRD_CERTIFICATE = 1
540
E_NO_CERTIFICATE_FOUND = -49
541
X509_FMT_DER = 0
542
NO_TICKETS = 1<<10
543
ENABLE_RAWPK = 1<<18
544
CTYPE_PEERS = 3
545
KEYID_USE_SHA256 = 1 # gnutls/x509.h
546
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
547
548
# Types
549
class session_int(ctypes.Structure):
550
_fields_ = []
551
session_t = ctypes.POINTER(session_int)
552
553
class certificate_credentials_st(ctypes.Structure):
554
_fields_ = []
555
certificate_credentials_t = ctypes.POINTER(
556
certificate_credentials_st)
557
certificate_type_t = ctypes.c_int
558
559
class datum_t(ctypes.Structure):
560
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
561
('size', ctypes.c_uint)]
562
563
class openpgp_crt_int(ctypes.Structure):
564
_fields_ = []
565
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
566
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
567
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
568
credentials_type_t = ctypes.c_int
569
transport_ptr_t = ctypes.c_void_p
570
close_request_t = ctypes.c_int
571
572
# Exceptions
573
class Error(Exception):
574
def __init__(self, message=None, code=None, args=()):
575
# Default usage is by a message string, but if a return
576
# code is passed, convert it to a string with
577
# gnutls.strerror()
578
self.code = code
579
if message is None and code is not None:
580
message = gnutls.strerror(code)
581
return super(gnutls.Error, self).__init__(
582
message, *args)
583
584
class CertificateSecurityError(Error):
585
pass
586
587
# Classes
588
class Credentials:
589
def __init__(self):
590
self._c_object = gnutls.certificate_credentials_t()
591
gnutls.certificate_allocate_credentials(
592
ctypes.byref(self._c_object))
593
self.type = gnutls.CRD_CERTIFICATE
594
595
def __del__(self):
596
gnutls.certificate_free_credentials(self._c_object)
597
598
class ClientSession:
599
def __init__(self, socket, credentials=None):
600
self._c_object = gnutls.session_t()
601
gnutls_flags = gnutls.CLIENT
602
if gnutls.check_version(b"3.5.6"):
603
gnutls_flags |= gnutls.NO_TICKETS
604
if gnutls.has_rawpk:
605
gnutls_flags |= gnutls.ENABLE_RAWPK
606
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
607
del gnutls_flags
608
gnutls.set_default_priority(self._c_object)
609
gnutls.transport_set_ptr(self._c_object, socket.fileno())
610
gnutls.handshake_set_private_extensions(self._c_object,
611
True)
612
self.socket = socket
613
if credentials is None:
614
credentials = gnutls.Credentials()
615
gnutls.credentials_set(self._c_object, credentials.type,
616
ctypes.cast(credentials._c_object,
617
ctypes.c_void_p))
618
self.credentials = credentials
619
620
def __del__(self):
621
gnutls.deinit(self._c_object)
622
623
def handshake(self):
624
return gnutls.handshake(self._c_object)
625
626
def send(self, data):
627
data = bytes(data)
628
data_len = len(data)
629
while data_len > 0:
630
data_len -= gnutls.record_send(self._c_object,
631
data[-data_len:],
632
data_len)
633
634
def bye(self):
635
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
636
637
# Error handling functions
638
def _error_code(result):
639
"""A function to raise exceptions on errors, suitable
640
for the 'restype' attribute on ctypes functions"""
641
if result >= 0:
642
return result
643
if result == gnutls.E_NO_CERTIFICATE_FOUND:
644
raise gnutls.CertificateSecurityError(code=result)
645
raise gnutls.Error(code=result)
646
647
def _retry_on_error(result, func, arguments):
648
"""A function to retry on some errors, suitable
649
for the 'errcheck' attribute on ctypes functions"""
650
while result < 0:
651
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
652
return _error_code(result)
653
result = func(*arguments)
654
return result
655
656
# Unless otherwise indicated, the function declarations below are
657
# all from the gnutls/gnutls.h C header file.
658
659
# Functions
660
priority_set_direct = _library.gnutls_priority_set_direct
661
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
662
ctypes.POINTER(ctypes.c_char_p)]
663
priority_set_direct.restype = _error_code
664
665
init = _library.gnutls_init
666
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
667
init.restype = _error_code
668
669
set_default_priority = _library.gnutls_set_default_priority
670
set_default_priority.argtypes = [session_t]
671
set_default_priority.restype = _error_code
672
673
record_send = _library.gnutls_record_send
674
record_send.argtypes = [session_t, ctypes.c_void_p,
675
ctypes.c_size_t]
676
record_send.restype = ctypes.c_ssize_t
677
record_send.errcheck = _retry_on_error
678
679
certificate_allocate_credentials = (
680
_library.gnutls_certificate_allocate_credentials)
681
certificate_allocate_credentials.argtypes = [
682
ctypes.POINTER(certificate_credentials_t)]
683
certificate_allocate_credentials.restype = _error_code
684
685
certificate_free_credentials = (
686
_library.gnutls_certificate_free_credentials)
687
certificate_free_credentials.argtypes = [
688
certificate_credentials_t]
689
certificate_free_credentials.restype = None
690
691
handshake_set_private_extensions = (
692
_library.gnutls_handshake_set_private_extensions)
693
handshake_set_private_extensions.argtypes = [session_t,
694
ctypes.c_int]
695
handshake_set_private_extensions.restype = None
696
697
credentials_set = _library.gnutls_credentials_set
698
credentials_set.argtypes = [session_t, credentials_type_t,
699
ctypes.c_void_p]
700
credentials_set.restype = _error_code
701
702
strerror = _library.gnutls_strerror
703
strerror.argtypes = [ctypes.c_int]
704
strerror.restype = ctypes.c_char_p
705
706
certificate_type_get = _library.gnutls_certificate_type_get
707
certificate_type_get.argtypes = [session_t]
708
certificate_type_get.restype = _error_code
709
710
certificate_get_peers = _library.gnutls_certificate_get_peers
711
certificate_get_peers.argtypes = [session_t,
712
ctypes.POINTER(ctypes.c_uint)]
713
certificate_get_peers.restype = ctypes.POINTER(datum_t)
714
715
global_set_log_level = _library.gnutls_global_set_log_level
716
global_set_log_level.argtypes = [ctypes.c_int]
717
global_set_log_level.restype = None
718
719
global_set_log_function = _library.gnutls_global_set_log_function
720
global_set_log_function.argtypes = [log_func]
721
global_set_log_function.restype = None
722
723
deinit = _library.gnutls_deinit
724
deinit.argtypes = [session_t]
725
deinit.restype = None
726
727
handshake = _library.gnutls_handshake
728
handshake.argtypes = [session_t]
729
handshake.restype = _error_code
730
handshake.errcheck = _retry_on_error
731
732
transport_set_ptr = _library.gnutls_transport_set_ptr
733
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
734
transport_set_ptr.restype = None
735
736
bye = _library.gnutls_bye
737
bye.argtypes = [session_t, close_request_t]
738
bye.restype = _error_code
739
bye.errcheck = _retry_on_error
740
741
check_version = _library.gnutls_check_version
742
check_version.argtypes = [ctypes.c_char_p]
743
check_version.restype = ctypes.c_char_p
744
745
_need_version = b"3.3.0"
746
if check_version(_need_version) is None:
747
raise self.Error("Needs GnuTLS {} or later"
748
.format(_need_version))
749
750
_tls_rawpk_version = b"3.6.6"
751
has_rawpk = bool(check_version(_tls_rawpk_version))
752
753
if has_rawpk:
754
# Types
755
class pubkey_st(ctypes.Structure):
756
_fields = []
757
pubkey_t = ctypes.POINTER(pubkey_st)
758
759
x509_crt_fmt_t = ctypes.c_int
760
761
# All the function declarations below are from gnutls/abstract.h
762
pubkey_init = _library.gnutls_pubkey_init
763
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
764
pubkey_init.restype = _error_code
765
766
pubkey_import = _library.gnutls_pubkey_import
767
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
768
x509_crt_fmt_t]
769
pubkey_import.restype = _error_code
770
771
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
772
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
773
ctypes.POINTER(ctypes.c_ubyte),
774
ctypes.POINTER(ctypes.c_size_t)]
775
pubkey_get_key_id.restype = _error_code
776
777
pubkey_deinit = _library.gnutls_pubkey_deinit
778
pubkey_deinit.argtypes = [pubkey_t]
779
pubkey_deinit.restype = None
780
else:
781
# All the function declarations below are from gnutls/openpgp.h
782
783
openpgp_crt_init = _library.gnutls_openpgp_crt_init
784
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
785
openpgp_crt_init.restype = _error_code
786
787
openpgp_crt_import = _library.gnutls_openpgp_crt_import
788
openpgp_crt_import.argtypes = [openpgp_crt_t,
789
ctypes.POINTER(datum_t),
790
openpgp_crt_fmt_t]
791
openpgp_crt_import.restype = _error_code
792
793
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
794
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
795
ctypes.POINTER(ctypes.c_uint)]
796
openpgp_crt_verify_self.restype = _error_code
797
798
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
799
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
800
openpgp_crt_deinit.restype = None
801
802
openpgp_crt_get_fingerprint = (
803
_library.gnutls_openpgp_crt_get_fingerprint)
804
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
805
ctypes.c_void_p,
806
ctypes.POINTER(
807
ctypes.c_size_t)]
808
openpgp_crt_get_fingerprint.restype = _error_code
809
810
if check_version(b"3.6.4"):
811
certificate_type_get2 = _library.gnutls_certificate_type_get2
812
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
813
certificate_type_get2.restype = _error_code
814
815
# Remove non-public functions
816
del _error_code, _retry_on_error
817
818
819
def call_pipe(connection, # : multiprocessing.Connection
820
func, *args, **kwargs):
821
"""This function is meant to be called by multiprocessing.Process
822
823
This function runs func(*args, **kwargs), and writes the resulting
824
return value on the provided multiprocessing.Connection.
825
"""
826
connection.send(func(*args, **kwargs))
827
connection.close()
828
829
830
class Client:
427
class Client(object):
831
428
"""A representation of a client host served by this server.
832
429
833
430
Attributes:
834
431
approved: bool(); 'None' if not yet approved/disapproved
835
432
approval_delay: datetime.timedelta(); Time to wait for approval
836
433
approval_duration: datetime.timedelta(); Duration of one approval
837
checker: multiprocessing.Process(); a running checker process used
838
to see if the client lives. 'None' if no process is
839
running.
840
checker_callback_tag: a GLib event source tag, or None
434
checker: subprocess.Popen(); a running checker process used
435
to see if the client lives.
436
'None' if no process is running.
437
checker_callback_tag: a gobject event source tag, or None
841
438
checker_command: string; External command which is run to check
842
439
if client lives. %() expansions are done at
843
440
runtime with vars(self) as dict, so that for
844
441
instance %(name)s can be used in the command.
845
checker_initiator_tag: a GLib event source tag, or None
442
checker_initiator_tag: a gobject event source tag, or None
846
443
created: datetime.datetime(); (UTC) object creation
847
444
client_structure: Object describing what attributes a client has
848
445
and is used for storing the client at exit
849
446
current_checker_command: string; current running checker_command
850
disable_initiator_tag: a GLib event source tag, or None
447
disable_initiator_tag: a gobject event source tag, or None
851
448
enabled: bool()
852
449
fingerprint: string (40 or 32 hexadecimal digits); used to
853
uniquely identify an OpenPGP client
854
key_id: string (64 hexadecimal digits); used to uniquely identify
855
a client using raw public keys
450
uniquely identify the client
856
451
host: string; available for use by the checker command
857
452
interval: datetime.timedelta(); How often to start a new checker
858
453
last_approval_request: datetime.datetime(); (UTC) or None
860
455
last_checker_status: integer between 0 and 255 reflecting exit
861
456
status of last checker. -1 reflects crashed
862
457
checker, -2 means no checker completed yet.
863
last_checker_signal: The signal which killed the last checker, if
864
last_checker_status is -1
865
458
last_enabled: datetime.datetime(); (UTC) or None
866
459
name: string; from the config file, used in log messages and
867
460
D-Bus identifiers
874
467
disabled, or None
875
468
server_settings: The server_settings dict from main()
876
469
"""
877
470
878
471
runtime_expansions = ("approval_delay", "approval_duration",
879
"created", "enabled", "expires", "key_id",
472
"created", "enabled", "expires",
880
473
"fingerprint", "host", "interval",
881
474
"last_approval_request", "last_checked_ok",
882
475
"last_enabled", "name", "timeout")
891
484
"approved_by_default": "True",
892
485
"enabled": "True",
893
486
}
894
487
895
488
@staticmethod
896
489
def config_parser(config):
897
490
"""Construct a new dict of client settings of this form:
904
497
for client_name in config.sections():
905
498
section = dict(config.items(client_name))
906
499
client = settings[client_name] = {}
907
500
908
501
client["host"] = section["host"]
909
502
# Reformat values from string types to Python types
910
503
client["approved_by_default"] = config.getboolean(
911
504
client_name, "approved_by_default")
912
505
client["enabled"] = config.getboolean(client_name,
913
506
"enabled")
914
915
# Uppercase and remove spaces from key_id and fingerprint
916
# for later comparison purposes with return value from the
917
# key_id() and fingerprint() functions
918
client["key_id"] = (section.get("key_id", "").upper()
919
.replace(" ", ""))
507
508
# Uppercase and remove spaces from fingerprint for later
509
# comparison purposes with return value from the
510
# fingerprint() function
920
511
client["fingerprint"] = (section["fingerprint"].upper()
921
512
.replace(" ", ""))
922
513
if "secret" in section:
923
client["secret"] = codecs.decode(section["secret"]
924
.encode("utf-8"),
925
"base64")
514
client["secret"] = section["secret"].decode("base64")
926
515
elif "secfile" in section:
927
516
with open(os.path.expanduser(os.path.expandvars
928
517
(section["secfile"])),
943
532
client["last_approval_request"] = None
944
533
client["last_checked_ok"] = None
945
534
client["last_checker_status"] = -2
946
535
947
536
return settings
948
949
def __init__(self, settings, name=None, server_settings=None):
537
538
def __init__(self, settings, name = None, server_settings=None):
950
539
self.name = name
951
540
if server_settings is None:
952
541
server_settings = {}
954
543
# adding all client settings
955
544
for setting, value in settings.items():
956
545
setattr(self, setting, value)
957
546
958
547
if self.enabled:
959
548
if not hasattr(self, "last_enabled"):
960
549
self.last_enabled = datetime.datetime.utcnow()
964
553
else:
965
554
self.last_enabled = None
966
555
self.expires = None
967
556
968
557
logger.debug("Creating client %r", self.name)
969
logger.debug(" Key ID: %s", self.key_id)
970
558
logger.debug(" Fingerprint: %s", self.fingerprint)
971
559
self.created = settings.get("created",
972
560
datetime.datetime.utcnow())
973
561
974
562
# attributes specific for this server instance
975
563
self.checker = None
976
564
self.checker_initiator_tag = None
982
570
self.changedstate = multiprocessing_manager.Condition(
983
571
multiprocessing_manager.Lock())
984
572
self.client_structure = [attr
985
for attr in self.__dict__.keys()
573
for attr in self.__dict__.iterkeys()
986
574
if not attr.startswith("_")]
987
575
self.client_structure.append("client_structure")
988
576
989
577
for name, t in inspect.getmembers(
990
578
type(self), lambda obj: isinstance(obj, property)):
991
579
if not name.startswith("_"):
992
580
self.client_structure.append(name)
993
581
994
582
# Send notice to process children that client state has changed
995
583
def send_changedstate(self):
996
584
with self.changedstate:
997
585
self.changedstate.notify_all()
998
586
999
587
def enable(self):
1000
588
"""Start this client's checker and timeout hooks"""
1001
589
if getattr(self, "enabled", False):
1006
594
self.last_enabled = datetime.datetime.utcnow()
1007
595
self.init_checker()
1008
596
self.send_changedstate()
1009
597
1010
598
def disable(self, quiet=True):
1011
599
"""Disable this client."""
1012
600
if not getattr(self, "enabled", False):
1014
602
if not quiet:
1015
603
logger.info("Disabling client %s", self.name)
1016
604
if getattr(self, "disable_initiator_tag", None) is not None:
1017
GLib.source_remove(self.disable_initiator_tag)
605
gobject.source_remove(self.disable_initiator_tag)
1018
606
self.disable_initiator_tag = None
1019
607
self.expires = None
1020
608
if getattr(self, "checker_initiator_tag", None) is not None:
1021
GLib.source_remove(self.checker_initiator_tag)
609
gobject.source_remove(self.checker_initiator_tag)
1022
610
self.checker_initiator_tag = None
1023
611
self.stop_checker()
1024
612
self.enabled = False
1025
613
if not quiet:
1026
614
self.send_changedstate()
1027
# Do not run this again if called by a GLib.timeout_add
615
# Do not run this again if called by a gobject.timeout_add
1028
616
return False
1029
617
1030
618
def __del__(self):
1031
619
self.disable()
1032
620
1033
621
def init_checker(self):
1034
622
# Schedule a new checker to be started an 'interval' from now,
1035
623
# and every interval from then on.
1036
624
if self.checker_initiator_tag is not None:
1037
GLib.source_remove(self.checker_initiator_tag)
1038
self.checker_initiator_tag = GLib.timeout_add(
1039
random.randrange(int(self.interval.total_seconds() * 1000
1040
+ 1)),
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = gobject.timeout_add(
627
int(self.interval.total_seconds() * 1000),
1041
628
self.start_checker)
1042
629
# Schedule a disable() when 'timeout' has passed
1043
630
if self.disable_initiator_tag is not None:
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = gobject.timeout_add(
1046
633
int(self.timeout.total_seconds() * 1000), self.disable)
1047
634
# Also start a new checker *right now*.
1048
635
self.start_checker()
1049
1050
def checker_callback(self, source, condition, connection,
1051
command):
636
637
def checker_callback(self, pid, condition, command):
1052
638
"""The checker has completed, so take appropriate actions."""
1053
# Read return code from connection (see call_pipe)
1054
returncode = connection.recv()
1055
connection.close()
1056
if self.checker is not None:
1057
self.checker.join()
1058
639
self.checker_callback_tag = None
1059
640
self.checker = None
1060
1061
if returncode >= 0:
1062
self.last_checker_status = returncode
1063
self.last_checker_signal = None
641
if os.WIFEXITED(condition):
642
self.last_checker_status = os.WEXITSTATUS(condition)
1064
643
if self.last_checker_status == 0:
1065
644
logger.info("Checker for %(name)s succeeded",
1066
645
vars(self))
1069
648
logger.info("Checker for %(name)s failed", vars(self))
1070
649
else:
1071
650
self.last_checker_status = -1
1072
self.last_checker_signal = -returncode
1073
651
logger.warning("Checker for %(name)s crashed?",
1074
652
vars(self))
1075
return False
1076
653
1077
654
def checked_ok(self):
1078
655
"""Assert that the client has been seen, alive and well."""
1079
656
self.last_checked_ok = datetime.datetime.utcnow()
1080
657
self.last_checker_status = 0
1081
self.last_checker_signal = None
1082
658
self.bump_timeout()
1083
659
1084
660
def bump_timeout(self, timeout=None):
1085
661
"""Bump up the timeout for this client."""
1086
662
if timeout is None:
1087
663
timeout = self.timeout
1088
664
if self.disable_initiator_tag is not None:
1089
GLib.source_remove(self.disable_initiator_tag)
665
gobject.source_remove(self.disable_initiator_tag)
1090
666
self.disable_initiator_tag = None
1091
667
if getattr(self, "enabled", False):
1092
self.disable_initiator_tag = GLib.timeout_add(
668
self.disable_initiator_tag = gobject.timeout_add(
1093
669
int(timeout.total_seconds() * 1000), self.disable)
1094
670
self.expires = datetime.datetime.utcnow() + timeout
1095
671
1096
672
def need_approval(self):
1097
673
self.last_approval_request = datetime.datetime.utcnow()
1098
674
1099
675
def start_checker(self):
1100
676
"""Start a new checker subprocess if one is not running.
1101
677
1102
678
If a checker already exists, leave it running and do
1103
679
nothing."""
1104
680
# The reason for not killing a running checker is that if we
1109
685
# checkers alone, the checker would have to take more time
1110
686
# than 'timeout' for the client to be disabled, which is as it
1111
687
# should be.
1112
1113
if self.checker is not None and not self.checker.is_alive():
1114
logger.warning("Checker was not alive; joining")
1115
self.checker.join()
1116
self.checker = None
688
689
# If a checker exists, make sure it is not a zombie
690
try:
691
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
692
except AttributeError:
693
pass
694
except OSError as error:
695
if error.errno != errno.ECHILD:
696
raise
697
else:
698
if pid:
699
logger.warning("Checker was a zombie")
700
gobject.source_remove(self.checker_callback_tag)
701
self.checker_callback(pid, status,
702
self.current_checker_command)
1117
703
# Start a new checker if needed
1118
704
if self.checker is None:
1119
705
# Escape attributes for the shell
1120
706
escaped_attrs = {
1121
707
attr: re.escape(str(getattr(self, attr)))
1122
for attr in self.runtime_expansions}
708
for attr in self.runtime_expansions }
1123
709
try:
1124
710
command = self.checker_command % escaped_attrs
1125
711
except TypeError as error:
1128
714
exc_info=error)
1129
715
return True # Try again later
1130
716
self.current_checker_command = command
1131
logger.info("Starting checker %r for %s", command,
1132
self.name)
1133
# We don't need to redirect stdout and stderr, since
1134
# in normal mode, that is already done by daemon(),
1135
# and in debug mode we don't want to. (Stdin is
1136
# always replaced by /dev/null.)
1137
# The exception is when not debugging but nevertheless
1138
# running in the foreground; use the previously
1139
# created wnull.
1140
popen_args = {"close_fds": True,
1141
"shell": True,
1142
"cwd": "/"}
1143
if (not self.server_settings["debug"]
1144
and self.server_settings["foreground"]):
1145
popen_args.update({"stdout": wnull,
1146
"stderr": wnull})
1147
pipe = multiprocessing.Pipe(duplex=False)
1148
self.checker = multiprocessing.Process(
1149
target=call_pipe,
1150
args=(pipe[1], subprocess.call, command),
1151
kwargs=popen_args)
1152
self.checker.start()
1153
self.checker_callback_tag = GLib.io_add_watch(
1154
GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1156
self.checker_callback, pipe[0], command)
1157
# Re-run this periodically if run by GLib.timeout_add
717
try:
718
logger.info("Starting checker %r for %s", command,
719
self.name)
720
# We don't need to redirect stdout and stderr, since
721
# in normal mode, that is already done by daemon(),
722
# and in debug mode we don't want to. (Stdin is
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
726
# created wnull.
727
popen_args = {}
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
731
"stderr": wnull })
732
self.checker = subprocess.Popen(command,
733
close_fds=True,
734
shell=True,
735
cwd="/",
736
**popen_args)
737
except OSError as error:
738
logger.error("Failed to start subprocess",
739
exc_info=error)
740
return True
741
self.checker_callback_tag = gobject.child_watch_add(
742
self.checker.pid, self.checker_callback, data=command)
743
# The checker may have completed before the gobject
744
# watch was added. Check for this.
745
try:
746
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
747
except OSError as error:
748
if error.errno == errno.ECHILD:
749
# This should never happen
750
logger.error("Child process vanished",
751
exc_info=error)
752
return True
753
raise
754
if pid:
755
gobject.source_remove(self.checker_callback_tag)
756
self.checker_callback(pid, status, command)
757
# Re-run this periodically if run by gobject.timeout_add
1158
758
return True
1159
759
1160
760
def stop_checker(self):
1161
761
"""Force the checker process, if any, to stop."""
1162
762
if self.checker_callback_tag:
1163
GLib.source_remove(self.checker_callback_tag)
763
gobject.source_remove(self.checker_callback_tag)
1164
764
self.checker_callback_tag = None
1165
765
if getattr(self, "checker", None) is None:
1166
766
return
1167
767
logger.debug("Stopping checker for %(name)s", vars(self))
1168
self.checker.terminate()
768
try:
769
self.checker.terminate()
770
#time.sleep(0.5)
771
#if self.checker.poll() is None:
772
# self.checker.kill()
773
except OSError as error:
774
if error.errno != errno.ESRCH: # No such process
775
raise
1169
776
self.checker = None
1170
777
1171
778
1175
782
byte_arrays=False):
1176
783
"""Decorators for marking methods of a DBusObjectWithProperties to
1177
784
become properties on the D-Bus.
1178
785
1179
786
The decorated method will be called with no arguments by "Get"
1180
787
and with one argument by "Set".
1181
788
1182
789
The parameters, where they are supported, are the same as
1183
790
dbus.service.method, except there is only "signature", since the
1184
791
type from Get() and the type sent to Set() is the same.
1188
795
if byte_arrays and signature != "ay":
1189
796
raise ValueError("Byte arrays not supported for non-'ay'"
1190
797
" signature {!r}".format(signature))
1191
798
1192
799
def decorator(func):
1193
800
func._dbus_is_property = True
1194
801
func._dbus_interface = dbus_interface
1197
804
func._dbus_name = func.__name__
1198
805
if func._dbus_name.endswith("_dbus_property"):
1199
806
func._dbus_name = func._dbus_name[:-14]
1200
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1201
808
return func
1202
809
1203
810
return decorator
1204
811
1205
812
1206
813
def dbus_interface_annotations(dbus_interface):
1207
814
"""Decorator for marking functions returning interface annotations
1208
815
1209
816
Usage:
1210
817
1211
818
@dbus_interface_annotations("org.example.Interface")
1212
819
def _foo(self): # Function name does not matter
1213
820
return {"org.freedesktop.DBus.Deprecated": "true",
1214
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1215
822
"false"}
1216
823
"""
1217
824
1218
825
def decorator(func):
1219
826
func._dbus_is_interface = True
1220
827
func._dbus_interface = dbus_interface
1221
828
func._dbus_name = dbus_interface
1222
829
return func
1223
830
1224
831
return decorator
1225
832
1226
833
1227
834
def dbus_annotations(annotations):
1228
835
"""Decorator to annotate D-Bus methods, signals or properties
1229
836
Usage:
1230
837
1231
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1232
839
"org.freedesktop.DBus.Property."
1233
840
"EmitsChangedSignal": "false"})
1235
842
access="r")
1236
843
def Property_dbus_property(self):
1237
844
return dbus.Boolean(False)
1238
1239
See also the DBusObjectWithAnnotations class.
1240
845
"""
1241
846
1242
847
def decorator(func):
1243
848
func._dbus_annotations = annotations
1244
849
return func
1245
850
1246
851
return decorator
1247
852
1248
853
1264
869
pass
1265
870
1266
871
1267
class DBusObjectWithAnnotations(dbus.service.Object):
1268
"""A D-Bus object with annotations.
1269
1270
Classes inheriting from this can use the dbus_annotations
1271
decorator to add annotations to methods or signals.
872
class DBusObjectWithProperties(dbus.service.Object):
873
"""A D-Bus object with properties.
874
875
Classes inheriting from this can use the dbus_service_property
876
decorator to expose methods as D-Bus properties. It exposes the
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
1272
878
"""
1273
879
1274
880
@staticmethod
1275
881
def _is_dbus_thing(thing):
1276
882
"""Returns a function testing if an attribute is a D-Bus thing
1277
883
1278
884
If called like _is_dbus_thing("method") it returns a function
1279
885
suitable for use as predicate to inspect.getmembers().
1280
886
"""
1281
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1282
888
False)
1283
889
1284
890
def _get_all_dbus_things(self, thing):
1285
891
"""Returns a generator of (name, attribute) pairs
1286
892
"""
1289
895
for cls in self.__class__.__mro__
1290
896
for name, athing in
1291
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1292
1293
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
out_signature="s",
1295
path_keyword='object_path',
1296
connection_keyword='connection')
1297
def Introspect(self, object_path, connection):
1298
"""Overloading of standard D-Bus method.
1299
1300
Inserts annotation tags on methods and signals.
1301
"""
1302
xmlstring = dbus.service.Object.Introspect(self, object_path,
1303
connection)
1304
try:
1305
document = xml.dom.minidom.parseString(xmlstring)
1306
1307
for if_tag in document.getElementsByTagName("interface"):
1308
# Add annotation tags
1309
for typ in ("method", "signal"):
1310
for tag in if_tag.getElementsByTagName(typ):
1311
annots = dict()
1312
for name, prop in (self.
1313
_get_all_dbus_things(typ)):
1314
if (name == tag.getAttribute("name")
1315
and prop._dbus_interface
1316
== if_tag.getAttribute("name")):
1317
annots.update(getattr(
1318
prop, "_dbus_annotations", {}))
1319
for name, value in annots.items():
1320
ann_tag = document.createElement(
1321
"annotation")
1322
ann_tag.setAttribute("name", name)
1323
ann_tag.setAttribute("value", value)
1324
tag.appendChild(ann_tag)
1325
# Add interface annotation tags
1326
for annotation, value in dict(
1327
itertools.chain.from_iterable(
1328
annotations().items()
1329
for name, annotations
1330
in self._get_all_dbus_things("interface")
1331
if name == if_tag.getAttribute("name")
1332
)).items():
1333
ann_tag = document.createElement("annotation")
1334
ann_tag.setAttribute("name", annotation)
1335
ann_tag.setAttribute("value", value)
1336
if_tag.appendChild(ann_tag)
1337
# Fix argument name for the Introspect method itself
1338
if (if_tag.getAttribute("name")
1339
== dbus.INTROSPECTABLE_IFACE):
1340
for cn in if_tag.getElementsByTagName("method"):
1341
if cn.getAttribute("name") == "Introspect":
1342
for arg in cn.getElementsByTagName("arg"):
1343
if (arg.getAttribute("direction")
1344
== "out"):
1345
arg.setAttribute("name",
1346
"xml_data")
1347
xmlstring = document.toxml("utf-8")
1348
document.unlink()
1349
except (AttributeError, xml.dom.DOMException,
1350
xml.parsers.expat.ExpatError) as error:
1351
logger.error("Failed to override Introspection method",
1352
exc_info=error)
1353
return xmlstring
1354
1355
1356
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1357
"""A D-Bus object with properties.
1358
1359
Classes inheriting from this can use the dbus_service_property
1360
decorator to expose methods as D-Bus properties. It exposes the
1361
standard Get(), Set(), and GetAll() methods on the D-Bus.
1362
"""
1363
898
1364
899
def _get_dbus_property(self, interface_name, property_name):
1365
900
"""Returns a bound method if one exists which is a D-Bus
1366
901
property with the specified name and interface.
1371
906
if (value._dbus_name == property_name
1372
907
and value._dbus_interface == interface_name):
1373
908
return value.__get__(self)
1374
909
1375
910
# No such property
1376
911
raise DBusPropertyNotFound("{}:{}.{}".format(
1377
912
self.dbus_object_path, interface_name, property_name))
1378
1379
@classmethod
1380
def _get_all_interface_names(cls):
1381
"""Get a sequence of all interfaces supported by an object"""
1382
return (name for name in set(getattr(getattr(x, attr),
1383
"_dbus_interface", None)
1384
for x in (inspect.getmro(cls))
1385
for attr in dir(x))
1386
if name is not None)
1387
913
1388
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
1389
915
in_signature="ss",
1390
916
out_signature="v")
1398
924
if not hasattr(value, "variant_level"):
1399
925
return value
1400
926
return type(value)(value, variant_level=value.variant_level+1)
1401
927
1402
928
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1403
929
def Set(self, interface_name, property_name, value):
1404
930
"""Standard D-Bus property Set() method, see D-Bus standard.
1413
939
raise ValueError("Byte arrays not supported for non-"
1414
940
"'ay' signature {!r}"
1415
941
.format(prop._dbus_signature))
1416
value = dbus.ByteArray(bytes(value))
942
value = dbus.ByteArray(b''.join(chr(byte)
943
for byte in value))
1417
944
prop(value)
1418
945
1419
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
1420
947
in_signature="s",
1421
948
out_signature="a{sv}")
1422
949
def GetAll(self, interface_name):
1423
950
"""Standard D-Bus property GetAll() method, see D-Bus
1424
951
standard.
1425
952
1426
953
Note: Will not include properties with access="write".
1427
954
"""
1428
955
properties = {}
1439
966
properties[name] = value
1440
967
continue
1441
968
properties[name] = type(value)(
1442
value, variant_level=value.variant_level + 1)
969
value, variant_level = value.variant_level + 1)
1443
970
return dbus.Dictionary(properties, signature="sv")
1444
971
1445
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1446
973
def PropertiesChanged(self, interface_name, changed_properties,
1447
974
invalidated_properties):
1449
976
standard.
1450
977
"""
1451
978
pass
1452
979
1453
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1454
981
out_signature="s",
1455
982
path_keyword='object_path',
1456
983
connection_keyword='connection')
1457
984
def Introspect(self, object_path, connection):
1458
985
"""Overloading of standard D-Bus method.
1459
986
1460
987
Inserts property tags and interface annotation tags.
1461
988
"""
1462
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1463
object_path,
1464
connection)
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
990
connection)
1465
991
try:
1466
992
document = xml.dom.minidom.parseString(xmlstring)
1467
993
1468
994
def make_tag(document, name, prop):
1469
995
e = document.createElement("property")
1470
996
e.setAttribute("name", name)
1471
997
e.setAttribute("type", prop._dbus_signature)
1472
998
e.setAttribute("access", prop._dbus_access)
1473
999
return e
1474
1000
1475
1001
for if_tag in document.getElementsByTagName("interface"):
1476
1002
# Add property tags
1477
1003
for tag in (make_tag(document, name, prop)
1480
1006
if prop._dbus_interface
1481
1007
== if_tag.getAttribute("name")):
1482
1008
if_tag.appendChild(tag)
1483
# Add annotation tags for properties
1484
for tag in if_tag.getElementsByTagName("property"):
1485
annots = dict()
1486
for name, prop in self._get_all_dbus_things(
1487
"property"):
1488
if (name == tag.getAttribute("name")
1489
and prop._dbus_interface
1490
== if_tag.getAttribute("name")):
1491
annots.update(getattr(
1492
prop, "_dbus_annotations", {}))
1493
for name, value in annots.items():
1494
ann_tag = document.createElement(
1495
"annotation")
1496
ann_tag.setAttribute("name", name)
1497
ann_tag.setAttribute("value", value)
1498
tag.appendChild(ann_tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1499
1038
# Add the names to the return values for the
1500
1039
# "org.freedesktop.DBus.Properties" methods
1501
1040
if (if_tag.getAttribute("name")
1520
1059
return xmlstring
1521
1060
1522
1061
1523
try:
1524
dbus.OBJECT_MANAGER_IFACE
1525
except AttributeError:
1526
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1527
1528
1529
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1530
"""A D-Bus object with an ObjectManager.
1531
1532
Classes inheriting from this exposes the standard
1533
GetManagedObjects call and the InterfacesAdded and
1534
InterfacesRemoved signals on the standard
1535
"org.freedesktop.DBus.ObjectManager" interface.
1536
1537
Note: No signals are sent automatically; they must be sent
1538
manually.
1539
"""
1540
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1541
out_signature="a{oa{sa{sv}}}")
1542
def GetManagedObjects(self):
1543
"""This function must be overridden"""
1544
raise NotImplementedError()
1545
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1547
signature="oa{sa{sv}}")
1548
def InterfacesAdded(self, object_path, interfaces_and_properties):
1549
pass
1550
1551
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1552
def InterfacesRemoved(self, object_path, interfaces):
1553
pass
1554
1555
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1556
out_signature="s",
1557
path_keyword='object_path',
1558
connection_keyword='connection')
1559
def Introspect(self, object_path, connection):
1560
"""Overloading of standard D-Bus method.
1561
1562
Override return argument name of GetManagedObjects to be
1563
"objpath_interfaces_and_properties"
1564
"""
1565
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1566
object_path,
1567
connection)
1568
try:
1569
document = xml.dom.minidom.parseString(xmlstring)
1570
1571
for if_tag in document.getElementsByTagName("interface"):
1572
# Fix argument name for the GetManagedObjects method
1573
if (if_tag.getAttribute("name")
1574
== dbus.OBJECT_MANAGER_IFACE):
1575
for cn in if_tag.getElementsByTagName("method"):
1576
if (cn.getAttribute("name")
1577
== "GetManagedObjects"):
1578
for arg in cn.getElementsByTagName("arg"):
1579
if (arg.getAttribute("direction")
1580
== "out"):
1581
arg.setAttribute(
1582
"name",
1583
"objpath_interfaces"
1584
"_and_properties")
1585
xmlstring = document.toxml("utf-8")
1586
document.unlink()
1587
except (AttributeError, xml.dom.DOMException,
1588
xml.parsers.expat.ExpatError) as error:
1589
logger.error("Failed to override Introspection method",
1590
exc_info=error)
1591
return xmlstring
1592
1593
1594
1062
def datetime_to_dbus(dt, variant_level=0):
1595
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1596
1064
if dt is None:
1597
return dbus.String("", variant_level=variant_level)
1065
return dbus.String("", variant_level = variant_level)
1598
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1599
1067
1600
1068
1603
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1604
1072
interface names according to the "alt_interface_names" mapping.
1605
1073
Usage:
1606
1074
1607
1075
@alternate_dbus_interfaces({"org.example.Interface":
1608
1076
"net.example.AlternateInterface"})
1609
1077
class SampleDBusObject(dbus.service.Object):
1610
1078
@dbus.service.method("org.example.Interface")
1611
1079
def SampleDBusMethod():
1612
1080
pass
1613
1081
1614
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1615
1083
reachable via two interfaces: "org.example.Interface" and
1616
1084
"net.example.AlternateInterface", the latter of which will have
1617
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1618
1086
"true", unless "deprecate" is passed with a False value.
1619
1087
1620
1088
This works for methods and signals, and also for D-Bus properties
1621
1089
(from DBusObjectWithProperties) and interfaces (from the
1622
1090
dbus_interface_annotations decorator).
1623
1091
"""
1624
1092
1625
1093
def wrapper(cls):
1626
1094
for orig_interface_name, alt_interface_name in (
1627
1095
alt_interface_names.items()):
1644
1112
if getattr(attribute, "_dbus_is_signal", False):
1645
1113
# Extract the original non-method undecorated
1646
1114
# function by black magic
1647
if sys.version_info.major == 2:
1648
nonmethod_func = (dict(
1649
zip(attribute.func_code.co_freevars,
1650
attribute.__closure__))
1651
["func"].cell_contents)
1652
else:
1653
nonmethod_func = (dict(
1654
zip(attribute.__code__.co_freevars,
1655
attribute.__closure__))
1656
["func"].cell_contents)
1115
nonmethod_func = (dict(
1116
zip(attribute.func_code.co_freevars,
1117
attribute.__closure__))
1118
["func"].cell_contents)
1657
1119
# Create a new, but exactly alike, function
1658
1120
# object, and decorate it to be a new D-Bus signal
1659
1121
# with the alternate D-Bus interface name
1660
new_function = copy_function(nonmethod_func)
1661
1122
new_function = (dbus.service.signal(
1662
alt_interface,
1663
attribute._dbus_signature)(new_function))
1123
alt_interface, attribute._dbus_signature)
1124
(types.FunctionType(
1125
nonmethod_func.func_code,
1126
nonmethod_func.func_globals,
1127
nonmethod_func.func_name,
1128
nonmethod_func.func_defaults,
1129
nonmethod_func.func_closure)))
1664
1130
# Copy annotations, if any
1665
1131
try:
1666
1132
new_function._dbus_annotations = dict(
1667
1133
attribute._dbus_annotations)
1668
1134
except AttributeError:
1669
1135
pass
1670
1671
1136
# Define a creator of a function to call both the
1672
1137
# original and alternate functions, so both the
1673
1138
# original and alternate signals gets sent when
1676
1141
"""This function is a scope container to pass
1677
1142
func1 and func2 to the "call_both" function
1678
1143
outside of its arguments"""
1679
1680
@functools.wraps(func2)
1144
1681
1145
def call_both(*args, **kwargs):
1682
1146
"""This function will emit two D-Bus
1683
1147
signals by calling func1 and func2"""
1684
1148
func1(*args, **kwargs)
1685
1149
func2(*args, **kwargs)
1686
# Make wrapper function look like a D-Bus
1687
# signal
1688
for name, attr in inspect.getmembers(func2):
1689
if name.startswith("_dbus_"):
1690
setattr(call_both, name, attr)
1691
1150
1692
1151
return call_both
1693
1152
# Create the "call_both" function and add it to
1694
1153
# the class
1704
1163
alt_interface,
1705
1164
attribute._dbus_in_signature,
1706
1165
attribute._dbus_out_signature)
1707
(copy_function(attribute)))
1166
(types.FunctionType(attribute.func_code,
1167
attribute.func_globals,
1168
attribute.func_name,
1169
attribute.func_defaults,
1170
attribute.func_closure)))
1708
1171
# Copy annotations, if any
1709
1172
try:
1710
1173
attr[attrname]._dbus_annotations = dict(
1722
1185
attribute._dbus_access,
1723
1186
attribute._dbus_get_args_options
1724
1187
["byte_arrays"])
1725
(copy_function(attribute)))
1188
(types.FunctionType(
1189
attribute.func_code,
1190
attribute.func_globals,
1191
attribute.func_name,
1192
attribute.func_defaults,
1193
attribute.func_closure)))
1726
1194
# Copy annotations, if any
1727
1195
try:
1728
1196
attr[attrname]._dbus_annotations = dict(
1737
1205
# to the class.
1738
1206
attr[attrname] = (
1739
1207
dbus_interface_annotations(alt_interface)
1740
(copy_function(attribute)))
1208
(types.FunctionType(attribute.func_code,
1209
attribute.func_globals,
1210
attribute.func_name,
1211
attribute.func_defaults,
1212
attribute.func_closure)))
1741
1213
if deprecate:
1742
1214
# Deprecate all alternate interfaces
1743
iname = "_AlternateDBusNames_interface_annotation{}"
1215
iname="_AlternateDBusNames_interface_annotation{}"
1744
1216
for interface_name in interface_names:
1745
1217
1746
1218
@dbus_interface_annotations(interface_name)
1747
1219
def func(self):
1748
return {"org.freedesktop.DBus.Deprecated":
1749
"true"}
1220
return { "org.freedesktop.DBus.Deprecated":
1221
"true" }
1750
1222
# Find an unused name
1751
1223
for aname in (iname.format(i)
1752
1224
for i in itertools.count()):
1756
1228
if interface_names:
1757
1229
# Replace the class with a new subclass of it with
1758
1230
# methods, signals, etc. as created above.
1759
if sys.version_info.major == 2:
1760
cls = type(b"{}Alternate".format(cls.__name__),
1761
(cls, ), attr)
1762
else:
1763
cls = type("{}Alternate".format(cls.__name__),
1764
(cls, ), attr)
1231
cls = type(b"{}Alternate".format(cls.__name__),
1232
(cls, ), attr)
1765
1233
return cls
1766
1234
1767
1235
return wrapper
1768
1236
1769
1237
1771
1239
"se.bsnet.fukt.Mandos"})
1772
1240
class ClientDBus(Client, DBusObjectWithProperties):
1773
1241
"""A Client class using D-Bus
1774
1242
1775
1243
Attributes:
1776
1244
dbus_object_path: dbus.ObjectPath
1777
1245
bus: dbus.SystemBus()
1778
1246
"""
1779
1247
1780
1248
runtime_expansions = (Client.runtime_expansions
1781
1249
+ ("dbus_object_path", ))
1782
1250
1783
1251
_interface = "se.recompile.Mandos.Client"
1784
1252
1785
1253
# dbus.service.Object doesn't use super(), so we can't either.
1786
1787
def __init__(self, bus=None, *args, **kwargs):
1254
1255
def __init__(self, bus = None, *args, **kwargs):
1788
1256
self.bus = bus
1789
1257
Client.__init__(self, *args, **kwargs)
1790
1258
# Only now, when this client is initialized, can it show up on
1796
1264
"/clients/" + client_object_name)
1797
1265
DBusObjectWithProperties.__init__(self, self.bus,
1798
1266
self.dbus_object_path)
1799
1267
1800
1268
def notifychangeproperty(transform_func, dbus_name,
1801
1269
type_func=lambda x: x,
1802
1270
variant_level=1,
1804
1272
_interface=_interface):
1805
1273
""" Modify a variable so that it's a property which announces
1806
1274
its changes to DBus.
1807
1275
1808
1276
transform_fun: Function that takes a value and a variant_level
1809
1277
and transforms it to a D-Bus type.
1810
1278
dbus_name: D-Bus name of the variable
1813
1281
variant_level: D-Bus variant level. Default: 1
1814
1282
"""
1815
1283
attrname = "_{}".format(dbus_name)
1816
1284
1817
1285
def setter(self, value):
1818
1286
if hasattr(self, "dbus_object_path"):
1819
1287
if (not hasattr(self, attrname) or
1826
1294
else:
1827
1295
dbus_value = transform_func(
1828
1296
type_func(value),
1829
variant_level=variant_level)
1297
variant_level = variant_level)
1830
1298
self.PropertyChanged(dbus.String(dbus_name),
1831
1299
dbus_value)
1832
1300
self.PropertiesChanged(
1833
1301
_interface,
1834
dbus.Dictionary({dbus.String(dbus_name):
1835
dbus_value}),
1302
dbus.Dictionary({ dbus.String(dbus_name):
1303
dbus_value }),
1836
1304
dbus.Array())
1837
1305
setattr(self, attrname, value)
1838
1306
1839
1307
return property(lambda self: getattr(self, attrname), setter)
1840
1308
1841
1309
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1842
1310
approvals_pending = notifychangeproperty(dbus.Boolean,
1843
1311
"ApprovalPending",
1844
type_func=bool)
1312
type_func = bool)
1845
1313
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1846
1314
last_enabled = notifychangeproperty(datetime_to_dbus,
1847
1315
"LastEnabled")
1848
1316
checker = notifychangeproperty(
1849
1317
dbus.Boolean, "CheckerRunning",
1850
type_func=lambda checker: checker is not None)
1318
type_func = lambda checker: checker is not None)
1851
1319
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1852
1320
"LastCheckedOK")
1853
1321
last_checker_status = notifychangeproperty(dbus.Int16,
1858
1326
"ApprovedByDefault")
1859
1327
approval_delay = notifychangeproperty(
1860
1328
dbus.UInt64, "ApprovalDelay",
1861
type_func=lambda td: td.total_seconds() * 1000)
1329
type_func = lambda td: td.total_seconds() * 1000)
1862
1330
approval_duration = notifychangeproperty(
1863
1331
dbus.UInt64, "ApprovalDuration",
1864
type_func=lambda td: td.total_seconds() * 1000)
1332
type_func = lambda td: td.total_seconds() * 1000)
1865
1333
host = notifychangeproperty(dbus.String, "Host")
1866
1334
timeout = notifychangeproperty(
1867
1335
dbus.UInt64, "Timeout",
1868
type_func=lambda td: td.total_seconds() * 1000)
1336
type_func = lambda td: td.total_seconds() * 1000)
1869
1337
extended_timeout = notifychangeproperty(
1870
1338
dbus.UInt64, "ExtendedTimeout",
1871
type_func=lambda td: td.total_seconds() * 1000)
1339
type_func = lambda td: td.total_seconds() * 1000)
1872
1340
interval = notifychangeproperty(
1873
1341
dbus.UInt64, "Interval",
1874
type_func=lambda td: td.total_seconds() * 1000)
1342
type_func = lambda td: td.total_seconds() * 1000)
1875
1343
checker_command = notifychangeproperty(dbus.String, "Checker")
1876
1344
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1877
1345
invalidate_only=True)
1878
1346
1879
1347
del notifychangeproperty
1880
1348
1881
1349
def __del__(self, *args, **kwargs):
1882
1350
try:
1883
1351
self.remove_from_connection()
1886
1354
if hasattr(DBusObjectWithProperties, "__del__"):
1887
1355
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1888
1356
Client.__del__(self, *args, **kwargs)
1889
1890
def checker_callback(self, source, condition,
1891
connection, command, *args, **kwargs):
1892
ret = Client.checker_callback(self, source, condition,
1893
connection, command, *args,
1894
**kwargs)
1895
exitstatus = self.last_checker_status
1896
if exitstatus >= 0:
1357
1358
def checker_callback(self, pid, condition, command,
1359
*args, **kwargs):
1360
self.checker_callback_tag = None
1361
self.checker = None
1362
if os.WIFEXITED(condition):
1363
exitstatus = os.WEXITSTATUS(condition)
1897
1364
# Emit D-Bus signal
1898
1365
self.CheckerCompleted(dbus.Int16(exitstatus),
1899
# This is specific to GNU libC
1900
dbus.Int64(exitstatus << 8),
1366
dbus.Int64(condition),
1901
1367
dbus.String(command))
1902
1368
else:
1903
1369
# Emit D-Bus signal
1904
1370
self.CheckerCompleted(dbus.Int16(-1),
1905
dbus.Int64(
1906
# This is specific to GNU libC
1907
(exitstatus << 8)
1908
| self.last_checker_signal),
1371
dbus.Int64(condition),
1909
1372
dbus.String(command))
1910
return ret
1911
1373
1374
return Client.checker_callback(self, pid, condition, command,
1375
*args, **kwargs)
1376
1912
1377
def start_checker(self, *args, **kwargs):
1913
1378
old_checker_pid = getattr(self.checker, "pid", None)
1914
1379
r = Client.start_checker(self, *args, **kwargs)
1918
1383
# Emit D-Bus signal
1919
1384
self.CheckerStarted(self.current_checker_command)
1920
1385
return r
1921
1386
1922
1387
def _reset_approved(self):
1923
1388
self.approved = None
1924
1389
return False
1925
1390
1926
1391
def approve(self, value=True):
1927
1392
self.approved = value
1928
GLib.timeout_add(int(self.approval_duration.total_seconds()
1929
* 1000), self._reset_approved)
1393
gobject.timeout_add(int(self.approval_duration.total_seconds()
1394
* 1000), self._reset_approved)
1930
1395
self.send_changedstate()
1931
1932
# D-Bus methods, signals & properties
1933
1934
# Interfaces
1935
1936
# Signals
1937
1396
1397
## D-Bus methods, signals & properties
1398
1399
## Interfaces
1400
1401
## Signals
1402
1938
1403
# CheckerCompleted - signal
1939
1404
@dbus.service.signal(_interface, signature="nxs")
1940
1405
def CheckerCompleted(self, exitcode, waitstatus, command):
1941
1406
"D-Bus signal"
1942
1407
pass
1943
1408
1944
1409
# CheckerStarted - signal
1945
1410
@dbus.service.signal(_interface, signature="s")
1946
1411
def CheckerStarted(self, command):
1947
1412
"D-Bus signal"
1948
1413
pass
1949
1414
1950
1415
# PropertyChanged - signal
1951
1416
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1952
1417
@dbus.service.signal(_interface, signature="sv")
1953
1418
def PropertyChanged(self, property, value):
1954
1419
"D-Bus signal"
1955
1420
pass
1956
1421
1957
1422
# GotSecret - signal
1958
1423
@dbus.service.signal(_interface)
1959
1424
def GotSecret(self):
1962
1427
server to mandos-client
1963
1428
"""
1964
1429
pass
1965
1430
1966
1431
# Rejected - signal
1967
1432
@dbus.service.signal(_interface, signature="s")
1968
1433
def Rejected(self, reason):
1969
1434
"D-Bus signal"
1970
1435
pass
1971
1436
1972
1437
# NeedApproval - signal
1973
1438
@dbus.service.signal(_interface, signature="tb")
1974
1439
def NeedApproval(self, timeout, default):
1975
1440
"D-Bus signal"
1976
1441
return self.need_approval()
1977
1978
# Methods
1979
1442
1443
## Methods
1444
1980
1445
# Approve - method
1981
1446
@dbus.service.method(_interface, in_signature="b")
1982
1447
def Approve(self, value):
1983
1448
self.approve(value)
1984
1449
1985
1450
# CheckedOK - method
1986
1451
@dbus.service.method(_interface)
1987
1452
def CheckedOK(self):
1988
1453
self.checked_ok()
1989
1454
1990
1455
# Enable - method
1991
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1992
1456
@dbus.service.method(_interface)
1993
1457
def Enable(self):
1994
1458
"D-Bus method"
1995
1459
self.enable()
1996
1460
1997
1461
# StartChecker - method
1998
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1999
1462
@dbus.service.method(_interface)
2000
1463
def StartChecker(self):
2001
1464
"D-Bus method"
2002
1465
self.start_checker()
2003
1466
2004
1467
# Disable - method
2005
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2006
1468
@dbus.service.method(_interface)
2007
1469
def Disable(self):
2008
1470
"D-Bus method"
2009
1471
self.disable()
2010
1472
2011
1473
# StopChecker - method
2012
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2013
1474
@dbus.service.method(_interface)
2014
1475
def StopChecker(self):
2015
1476
self.stop_checker()
2016
2017
# Properties
2018
1477
1478
## Properties
1479
2019
1480
# ApprovalPending - property
2020
1481
@dbus_service_property(_interface, signature="b", access="read")
2021
1482
def ApprovalPending_dbus_property(self):
2022
1483
return dbus.Boolean(bool(self.approvals_pending))
2023
1484
2024
1485
# ApprovedByDefault - property
2025
1486
@dbus_service_property(_interface,
2026
1487
signature="b",
2029
1490
if value is None: # get
2030
1491
return dbus.Boolean(self.approved_by_default)
2031
1492
self.approved_by_default = bool(value)
2032
1493
2033
1494
# ApprovalDelay - property
2034
1495
@dbus_service_property(_interface,
2035
1496
signature="t",
2039
1500
return dbus.UInt64(self.approval_delay.total_seconds()
2040
1501
* 1000)
2041
1502
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2042
1503
2043
1504
# ApprovalDuration - property
2044
1505
@dbus_service_property(_interface,
2045
1506
signature="t",
2049
1510
return dbus.UInt64(self.approval_duration.total_seconds()
2050
1511
* 1000)
2051
1512
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2052
1513
2053
1514
# Name - property
2054
@dbus_annotations(
2055
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2056
1515
@dbus_service_property(_interface, signature="s", access="read")
2057
1516
def Name_dbus_property(self):
2058
1517
return dbus.String(self.name)
2059
2060
# KeyID - property
2061
@dbus_annotations(
2062
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2063
@dbus_service_property(_interface, signature="s", access="read")
2064
def KeyID_dbus_property(self):
2065
return dbus.String(self.key_id)
2066
1518
2067
1519
# Fingerprint - property
2068
@dbus_annotations(
2069
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2070
1520
@dbus_service_property(_interface, signature="s", access="read")
2071
1521
def Fingerprint_dbus_property(self):
2072
1522
return dbus.String(self.fingerprint)
2073
1523
2074
1524
# Host - property
2075
1525
@dbus_service_property(_interface,
2076
1526
signature="s",
2079
1529
if value is None: # get
2080
1530
return dbus.String(self.host)
2081
1531
self.host = str(value)
2082
1532
2083
1533
# Created - property
2084
@dbus_annotations(
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2086
1534
@dbus_service_property(_interface, signature="s", access="read")
2087
1535
def Created_dbus_property(self):
2088
1536
return datetime_to_dbus(self.created)
2089
1537
2090
1538
# LastEnabled - property
2091
1539
@dbus_service_property(_interface, signature="s", access="read")
2092
1540
def LastEnabled_dbus_property(self):
2093
1541
return datetime_to_dbus(self.last_enabled)
2094
1542
2095
1543
# Enabled - property
2096
1544
@dbus_service_property(_interface,
2097
1545
signature="b",
2103
1551
self.enable()
2104
1552
else:
2105
1553
self.disable()
2106
1554
2107
1555
# LastCheckedOK - property
2108
1556
@dbus_service_property(_interface,
2109
1557
signature="s",
2113
1561
self.checked_ok()
2114
1562
return
2115
1563
return datetime_to_dbus(self.last_checked_ok)
2116
1564
2117
1565
# LastCheckerStatus - property
2118
1566
@dbus_service_property(_interface, signature="n", access="read")
2119
1567
def LastCheckerStatus_dbus_property(self):
2120
1568
return dbus.Int16(self.last_checker_status)
2121
1569
2122
1570
# Expires - property
2123
1571
@dbus_service_property(_interface, signature="s", access="read")
2124
1572
def Expires_dbus_property(self):
2125
1573
return datetime_to_dbus(self.expires)
2126
1574
2127
1575
# LastApprovalRequest - property
2128
1576
@dbus_service_property(_interface, signature="s", access="read")
2129
1577
def LastApprovalRequest_dbus_property(self):
2130
1578
return datetime_to_dbus(self.last_approval_request)
2131
1579
2132
1580
# Timeout - property
2133
1581
@dbus_service_property(_interface,
2134
1582
signature="t",
2149
1597
if (getattr(self, "disable_initiator_tag", None)
2150
1598
is None):
2151
1599
return
2152
GLib.source_remove(self.disable_initiator_tag)
2153
self.disable_initiator_tag = GLib.timeout_add(
1600
gobject.source_remove(self.disable_initiator_tag)
1601
self.disable_initiator_tag = gobject.timeout_add(
2154
1602
int((self.expires - now).total_seconds() * 1000),
2155
1603
self.disable)
2156
1604
2157
1605
# ExtendedTimeout - property
2158
1606
@dbus_service_property(_interface,
2159
1607
signature="t",
2163
1611
return dbus.UInt64(self.extended_timeout.total_seconds()
2164
1612
* 1000)
2165
1613
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2166
1614
2167
1615
# Interval - property
2168
1616
@dbus_service_property(_interface,
2169
1617
signature="t",
2176
1624
return
2177
1625
if self.enabled:
2178
1626
# Reschedule checker run
2179
GLib.source_remove(self.checker_initiator_tag)
2180
self.checker_initiator_tag = GLib.timeout_add(
1627
gobject.source_remove(self.checker_initiator_tag)
1628
self.checker_initiator_tag = gobject.timeout_add(
2181
1629
value, self.start_checker)
2182
self.start_checker() # Start one now, too
2183
1630
self.start_checker() # Start one now, too
1631
2184
1632
# Checker - property
2185
1633
@dbus_service_property(_interface,
2186
1634
signature="s",
2189
1637
if value is None: # get
2190
1638
return dbus.String(self.checker_command)
2191
1639
self.checker_command = str(value)
2192
1640
2193
1641
# CheckerRunning - property
2194
1642
@dbus_service_property(_interface,
2195
1643
signature="b",
2201
1649
self.start_checker()
2202
1650
else:
2203
1651
self.stop_checker()
2204
1652
2205
1653
# ObjectPath - property
2206
@dbus_annotations(
2207
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2208
"org.freedesktop.DBus.Deprecated": "true"})
2209
1654
@dbus_service_property(_interface, signature="o", access="read")
2210
1655
def ObjectPath_dbus_property(self):
2211
return self.dbus_object_path # is already a dbus.ObjectPath
2212
1656
return self.dbus_object_path # is already a dbus.ObjectPath
1657
2213
1658
# Secret = property
2214
@dbus_annotations(
2215
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2216
"invalidates"})
2217
1659
@dbus_service_property(_interface,
2218
1660
signature="ay",
2219
1661
access="write",
2220
1662
byte_arrays=True)
2221
1663
def Secret_dbus_property(self, value):
2222
1664
self.secret = bytes(value)
2223
1665
2224
1666
del _interface
2225
1667
2226
1668
2227
class ProxyClient:
2228
def __init__(self, child_pipe, key_id, fpr, address):
1669
class ProxyClient(object):
1670
def __init__(self, child_pipe, fpr, address):
2229
1671
self._pipe = child_pipe
2230
self._pipe.send(('init', key_id, fpr, address))
1672
self._pipe.send(('init', fpr, address))
2231
1673
if not self._pipe.recv():
2232
raise KeyError(key_id or fpr)
2233
1674
raise KeyError()
1675
2234
1676
def __getattribute__(self, name):
2235
1677
if name == '_pipe':
2236
1678
return super(ProxyClient, self).__getattribute__(name)
2239
1681
if data[0] == 'data':
2240
1682
return data[1]
2241
1683
if data[0] == 'function':
2242
1684
2243
1685
def func(*args, **kwargs):
2244
1686
self._pipe.send(('funcall', name, args, kwargs))
2245
1687
return self._pipe.recv()[1]
2246
1688
2247
1689
return func
2248
1690
2249
1691
def __setattr__(self, name, value):
2250
1692
if name == '_pipe':
2251
1693
return super(ProxyClient, self).__setattr__(name, value)
2254
1696
2255
1697
class ClientHandler(socketserver.BaseRequestHandler, object):
2256
1698
"""A class to handle client connections.
2257
1699
2258
1700
Instantiated once for each connection to handle it.
2259
1701
Note: This will run in its own forked process."""
2260
1702
2261
1703
def handle(self):
2262
1704
with contextlib.closing(self.server.child_pipe) as child_pipe:
2263
1705
logger.info("TCP connection from: %s",
2264
1706
str(self.client_address))
2265
1707
logger.debug("Pipe FD: %d",
2266
1708
self.server.child_pipe.fileno())
2267
2268
session = gnutls.ClientSession(self.request)
2269
2270
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2271
# "+AES-256-CBC", "+SHA1",
2272
# "+COMP-NULL", "+CTYPE-OPENPGP",
2273
# "+DHE-DSS"))
1709
1710
session = gnutls.connection.ClientSession(
1711
self.request, gnutls.connection .X509Credentials())
1712
1713
# Note: gnutls.connection.X509Credentials is really a
1714
# generic GnuTLS certificate credentials object so long as
1715
# no X.509 keys are added to it. Therefore, we can use it
1716
# here despite using OpenPGP certificates.
1717
1718
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1719
# "+AES-256-CBC", "+SHA1",
1720
# "+COMP-NULL", "+CTYPE-OPENPGP",
1721
# "+DHE-DSS"))
2274
1722
# Use a fallback default, since this MUST be set.
2275
1723
priority = self.server.gnutls_priority
2276
1724
if priority is None:
2277
1725
priority = "NORMAL"
2278
gnutls.priority_set_direct(session._c_object,
2279
priority.encode("utf-8"),
2280
None)
2281
1726
gnutls.library.functions.gnutls_priority_set_direct(
1727
session._c_object, priority, None)
1728
2282
1729
# Start communication using the Mandos protocol
2283
1730
# Get protocol number
2284
1731
line = self.request.makefile().readline()
2289
1736
except (ValueError, IndexError, RuntimeError) as error:
2290
1737
logger.error("Unknown protocol version: %s", error)
2291
1738
return
2292
1739
2293
1740
# Start GnuTLS connection
2294
1741
try:
2295
1742
session.handshake()
2296
except gnutls.Error as error:
1743
except gnutls.errors.GNUTLSError as error:
2297
1744
logger.warning("Handshake failed: %s", error)
2298
1745
# Do not run session.bye() here: the session is not
2299
1746
# established. Just abandon the request.
2300
1747
return
2301
1748
logger.debug("Handshake succeeded")
2302
1749
2303
1750
approval_required = False
2304
1751
try:
2305
if gnutls.has_rawpk:
2306
fpr = b""
2307
try:
2308
key_id = self.key_id(
2309
self.peer_certificate(session))
2310
except (TypeError, gnutls.Error) as error:
2311
logger.warning("Bad certificate: %s", error)
2312
return
2313
logger.debug("Key ID: %s", key_id)
2314
2315
else:
2316
key_id = b""
2317
try:
2318
fpr = self.fingerprint(
2319
self.peer_certificate(session))
2320
except (TypeError, gnutls.Error) as error:
2321
logger.warning("Bad certificate: %s", error)
2322
return
2323
logger.debug("Fingerprint: %s", fpr)
2324
2325
try:
2326
client = ProxyClient(child_pipe, key_id, fpr,
1752
try:
1753
fpr = self.fingerprint(
1754
self.peer_certificate(session))
1755
except (TypeError,
1756
gnutls.errors.GNUTLSError) as error:
1757
logger.warning("Bad certificate: %s", error)
1758
return
1759
logger.debug("Fingerprint: %s", fpr)
1760
1761
try:
1762
client = ProxyClient(child_pipe, fpr,
2327
1763
self.client_address)
2328
1764
except KeyError:
2329
1765
return
2330
1766
2331
1767
if client.approval_delay:
2332
1768
delay = client.approval_delay
2333
1769
client.approvals_pending += 1
2334
1770
approval_required = True
2335
1771
2336
1772
while True:
2337
1773
if not client.enabled:
2338
1774
logger.info("Client %s is disabled",
2341
1777
# Emit D-Bus signal
2342
1778
client.Rejected("Disabled")
2343
1779
return
2344
1780
2345
1781
if client.approved or not client.approval_delay:
2346
# We are approved or approval is disabled
1782
#We are approved or approval is disabled
2347
1783
break
2348
1784
elif client.approved is None:
2349
1785
logger.info("Client %s needs approval",
2360
1796
# Emit D-Bus signal
2361
1797
client.Rejected("Denied")
2362
1798
return
2363
2364
# wait until timeout or approved
1799
1800
#wait until timeout or approved
2365
1801
time = datetime.datetime.now()
2366
1802
client.changedstate.acquire()
2367
1803
client.changedstate.wait(delay.total_seconds())
2380
1816
break
2381
1817
else:
2382
1818
delay -= time2 - time
2383
2384
try:
2385
session.send(client.secret)
2386
except gnutls.Error as error:
2387
logger.warning("gnutls send failed",
2388
exc_info=error)
2389
return
2390
1819
1820
sent_size = 0
1821
while sent_size < len(client.secret):
1822
try:
1823
sent = session.send(client.secret[sent_size:])
1824
except gnutls.errors.GNUTLSError as error:
1825
logger.warning("gnutls send failed",
1826
exc_info=error)
1827
return
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
1830
+ sent))
1831
sent_size += sent
1832
2391
1833
logger.info("Sending secret to %s", client.name)
2392
1834
# bump the timeout using extended_timeout
2393
1835
client.bump_timeout(client.extended_timeout)
2394
1836
if self.server.use_dbus:
2395
1837
# Emit D-Bus signal
2396
1838
client.GotSecret()
2397
1839
2398
1840
finally:
2399
1841
if approval_required:
2400
1842
client.approvals_pending -= 1
2401
1843
try:
2402
1844
session.bye()
2403
except gnutls.Error as error:
1845
except gnutls.errors.GNUTLSError as error:
2404
1846
logger.warning("GnuTLS bye failed",
2405
1847
exc_info=error)
2406
1848
2407
1849
@staticmethod
2408
1850
def peer_certificate(session):
2409
"Return the peer's certificate as a bytestring"
2410
try:
2411
cert_type = gnutls.certificate_type_get2(session._c_object,
2412
gnutls.CTYPE_PEERS)
2413
except AttributeError:
2414
cert_type = gnutls.certificate_type_get(session._c_object)
2415
if gnutls.has_rawpk:
2416
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2417
else:
2418
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2419
# If not a valid certificate type...
2420
if cert_type not in valid_cert_types:
2421
logger.info("Cert type %r not in %r", cert_type,
2422
valid_cert_types)
2423
# ...return invalid data
2424
return b""
1851
"Return the peer's OpenPGP certificate as a bytestring"
1852
# If not an OpenPGP certificate...
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
1854
session._c_object)
1855
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1856
# ...do the normal thing
1857
return session.peer_certificate
2425
1858
list_size = ctypes.c_uint(1)
2426
cert_list = (gnutls.certificate_get_peers
1859
cert_list = (gnutls.library.functions
1860
.gnutls_certificate_get_peers
2427
1861
(session._c_object, ctypes.byref(list_size)))
2428
1862
if not bool(cert_list) and list_size.value != 0:
2429
raise gnutls.Error("error getting peer certificate")
1863
raise gnutls.errors.GNUTLSError("error getting peer"
1864
" certificate")
2430
1865
if list_size.value == 0:
2431
1866
return None
2432
1867
cert = cert_list[0]
2433
1868
return ctypes.string_at(cert.data, cert.size)
2434
2435
@staticmethod
2436
def key_id(certificate):
2437
"Convert a certificate bytestring to a hexdigit key ID"
2438
# New GnuTLS "datum" with the public key
2439
datum = gnutls.datum_t(
2440
ctypes.cast(ctypes.c_char_p(certificate),
2441
ctypes.POINTER(ctypes.c_ubyte)),
2442
ctypes.c_uint(len(certificate)))
2443
# XXX all these need to be created in the gnutls "module"
2444
# New empty GnuTLS certificate
2445
pubkey = gnutls.pubkey_t()
2446
gnutls.pubkey_init(ctypes.byref(pubkey))
2447
# Import the raw public key into the certificate
2448
gnutls.pubkey_import(pubkey,
2449
ctypes.byref(datum),
2450
gnutls.X509_FMT_DER)
2451
# New buffer for the key ID
2452
buf = ctypes.create_string_buffer(32)
2453
buf_len = ctypes.c_size_t(len(buf))
2454
# Get the key ID from the raw public key into the buffer
2455
gnutls.pubkey_get_key_id(pubkey,
2456
gnutls.KEYID_USE_SHA256,
2457
ctypes.cast(ctypes.byref(buf),
2458
ctypes.POINTER(ctypes.c_ubyte)),
2459
ctypes.byref(buf_len))
2460
# Deinit the certificate
2461
gnutls.pubkey_deinit(pubkey)
2462
2463
# Convert the buffer to a Python bytestring
2464
key_id = ctypes.string_at(buf, buf_len.value)
2465
# Convert the bytestring to hexadecimal notation
2466
hex_key_id = binascii.hexlify(key_id).upper()
2467
return hex_key_id
2468
1869
2469
1870
@staticmethod
2470
1871
def fingerprint(openpgp):
2471
1872
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2472
1873
# New GnuTLS "datum" with the OpenPGP public key
2473
datum = gnutls.datum_t(
1874
datum = gnutls.library.types.gnutls_datum_t(
2474
1875
ctypes.cast(ctypes.c_char_p(openpgp),
2475
1876
ctypes.POINTER(ctypes.c_ubyte)),
2476
1877
ctypes.c_uint(len(openpgp)))
2477
1878
# New empty GnuTLS certificate
2478
crt = gnutls.openpgp_crt_t()
2479
gnutls.openpgp_crt_init(ctypes.byref(crt))
1879
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1880
gnutls.library.functions.gnutls_openpgp_crt_init(
1881
ctypes.byref(crt))
2480
1882
# Import the OpenPGP public key into the certificate
2481
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2482
gnutls.OPENPGP_FMT_RAW)
1883
gnutls.library.functions.gnutls_openpgp_crt_import(
1884
crt, ctypes.byref(datum),
1885
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2483
1886
# Verify the self signature in the key
2484
1887
crtverify = ctypes.c_uint()
2485
gnutls.openpgp_crt_verify_self(crt, 0,
2486
ctypes.byref(crtverify))
1888
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1889
crt, 0, ctypes.byref(crtverify))
2487
1890
if crtverify.value != 0:
2488
gnutls.openpgp_crt_deinit(crt)
2489
raise gnutls.CertificateSecurityError(code
2490
=crtverify.value)
1891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1892
raise gnutls.errors.CertificateSecurityError(
1893
"Verify failed")
2491
1894
# New buffer for the fingerprint
2492
1895
buf = ctypes.create_string_buffer(20)
2493
1896
buf_len = ctypes.c_size_t()
2494
1897
# Get the fingerprint from the certificate into the buffer
2495
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2496
ctypes.byref(buf_len))
1898
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1899
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2497
1900
# Deinit the certificate
2498
gnutls.openpgp_crt_deinit(crt)
1901
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2499
1902
# Convert the buffer to a Python bytestring
2500
1903
fpr = ctypes.string_at(buf, buf_len.value)
2501
1904
# Convert the bytestring to hexadecimal notation
2503
1906
return hex_fpr
2504
1907
2505
1908
2506
class MultiprocessingMixIn:
1909
class MultiprocessingMixIn(object):
2507
1910
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2508
1911
2509
1912
def sub_process_main(self, request, address):
2510
1913
try:
2511
1914
self.finish_request(request, address)
2512
1915
except Exception:
2513
1916
self.handle_error(request, address)
2514
1917
self.close_request(request)
2515
1918
2516
1919
def process_request(self, request, address):
2517
1920
"""Start a new process to process the request."""
2518
proc = multiprocessing.Process(target=self.sub_process_main,
2519
args=(request, address))
1921
proc = multiprocessing.Process(target = self.sub_process_main,
1922
args = (request, address))
2520
1923
proc.start()
2521
1924
return proc
2522
1925
2523
1926
2524
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1927
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2525
1928
""" adds a pipe to the MixIn """
2526
1929
2527
1930
def process_request(self, request, client_address):
2528
1931
"""Overrides and wraps the original process_request().
2529
1932
2530
1933
This function creates a new pipe in self.pipe
2531
1934
"""
2532
1935
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2533
1936
2534
1937
proc = MultiprocessingMixIn.process_request(self, request,
2535
1938
client_address)
2536
1939
self.child_pipe.close()
2537
1940
self.add_pipe(parent_pipe, proc)
2538
1941
2539
1942
def add_pipe(self, parent_pipe, proc):
2540
1943
"""Dummy function; override as necessary"""
2541
1944
raise NotImplementedError()
2542
1945
2543
1946
2544
1947
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2545
socketserver.TCPServer):
1948
socketserver.TCPServer, object):
2546
1949
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2547
1950
2548
1951
Attributes:
2549
1952
enabled: Boolean; whether this server is activated yet
2550
1953
interface: None or a network interface name (string)
2551
1954
use_ipv6: Boolean; to use IPv6 or not
2552
1955
"""
2553
1956
2554
1957
def __init__(self, server_address, RequestHandlerClass,
2555
1958
interface=None,
2556
1959
use_ipv6=True,
2566
1969
self.socketfd = socketfd
2567
1970
# Save the original socket.socket() function
2568
1971
self.socket_socket = socket.socket
2569
2570
1972
# To implement --socket, we monkey patch socket.socket.
2571
#
1973
#
2572
1974
# (When socketserver.TCPServer is a new-style class, we
2573
1975
# could make self.socket into a property instead of monkey
2574
1976
# patching socket.socket.)
2575
#
1977
#
2576
1978
# Create a one-time-only replacement for socket.socket()
2577
1979
@functools.wraps(socket.socket)
2578
1980
def socket_wrapper(*args, **kwargs):
2590
1992
# socket_wrapper(), if socketfd was set.
2591
1993
socketserver.TCPServer.__init__(self, server_address,
2592
1994
RequestHandlerClass)
2593
1995
2594
1996
def server_bind(self):
2595
1997
"""This overrides the normal server_bind() function
2596
1998
to bind to an interface if one was specified, and also NOT to
2597
1999
bind to an address or port if they were not specified."""
2598
global SO_BINDTODEVICE
2599
2000
if self.interface is not None:
2600
2001
if SO_BINDTODEVICE is None:
2601
# Fall back to a hard-coded value which seems to be
2602
# common enough.
2603
logger.warning("SO_BINDTODEVICE not found, trying 25")
2604
SO_BINDTODEVICE = 25
2605
try:
2606
self.socket.setsockopt(
2607
socket.SOL_SOCKET, SO_BINDTODEVICE,
2608
(self.interface + "\0").encode("utf-8"))
2609
except socket.error as error:
2610
if error.errno == errno.EPERM:
2611
logger.error("No permission to bind to"
2612
" interface %s", self.interface)
2613
elif error.errno == errno.ENOPROTOOPT:
2614
logger.error("SO_BINDTODEVICE not available;"
2615
" cannot bind to interface %s",
2616
self.interface)
2617
elif error.errno == errno.ENODEV:
2618
logger.error("Interface %s does not exist,"
2619
" cannot bind", self.interface)
2620
else:
2621
raise
2002
logger.error("SO_BINDTODEVICE does not exist;"
2003
" cannot bind to interface %s",
2004
self.interface)
2005
else:
2006
try:
2007
self.socket.setsockopt(
2008
socket.SOL_SOCKET, SO_BINDTODEVICE,
2009
(self.interface + "\0").encode("utf-8"))
2010
except socket.error as error:
2011
if error.errno == errno.EPERM:
2012
logger.error("No permission to bind to"
2013
" interface %s", self.interface)
2014
elif error.errno == errno.ENOPROTOOPT:
2015
logger.error("SO_BINDTODEVICE not available;"
2016
" cannot bind to interface %s",
2017
self.interface)
2018
elif error.errno == errno.ENODEV:
2019
logger.error("Interface %s does not exist,"
2020
" cannot bind", self.interface)
2021
else:
2022
raise
2622
2023
# Only bind(2) the socket if we really need to.
2623
2024
if self.server_address[0] or self.server_address[1]:
2624
if self.server_address[1]:
2625
self.allow_reuse_address = True
2626
2025
if not self.server_address[0]:
2627
2026
if self.address_family == socket.AF_INET6:
2628
any_address = "::" # in6addr_any
2027
any_address = "::" # in6addr_any
2629
2028
else:
2630
any_address = "0.0.0.0" # INADDR_ANY
2029
any_address = "0.0.0.0" # INADDR_ANY
2631
2030
self.server_address = (any_address,
2632
2031
self.server_address[1])
2633
2032
elif not self.server_address[1]:
2643
2042
2644
2043
class MandosServer(IPv6_TCPServer):
2645
2044
"""Mandos server.
2646
2045
2647
2046
Attributes:
2648
2047
clients: set of Client objects
2649
2048
gnutls_priority GnuTLS priority string
2650
2049
use_dbus: Boolean; to emit D-Bus signals or not
2651
2652
Assumes a GLib.MainLoop event loop.
2050
2051
Assumes a gobject.MainLoop event loop.
2653
2052
"""
2654
2053
2655
2054
def __init__(self, server_address, RequestHandlerClass,
2656
2055
interface=None,
2657
2056
use_ipv6=True,
2667
2066
self.gnutls_priority = gnutls_priority
2668
2067
IPv6_TCPServer.__init__(self, server_address,
2669
2068
RequestHandlerClass,
2670
interface=interface,
2671
use_ipv6=use_ipv6,
2672
socketfd=socketfd)
2673
2069
interface = interface,
2070
use_ipv6 = use_ipv6,
2071
socketfd = socketfd)
2072
2674
2073
def server_activate(self):
2675
2074
if self.enabled:
2676
2075
return socketserver.TCPServer.server_activate(self)
2677
2076
2678
2077
def enable(self):
2679
2078
self.enabled = True
2680
2079
2681
2080
def add_pipe(self, parent_pipe, proc):
2682
2081
# Call "handle_ipc" for both data and EOF events
2683
GLib.io_add_watch(
2684
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2685
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2082
gobject.io_add_watch(
2083
parent_pipe.fileno(),
2084
gobject.IO_IN | gobject.IO_HUP,
2686
2085
functools.partial(self.handle_ipc,
2687
parent_pipe=parent_pipe,
2688
proc=proc))
2689
2086
parent_pipe = parent_pipe,
2087
proc = proc))
2088
2690
2089
def handle_ipc(self, source, condition,
2691
2090
parent_pipe=None,
2692
proc=None,
2091
proc = None,
2693
2092
client_object=None):
2694
2093
# error, or the other end of multiprocessing.Pipe has closed
2695
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2094
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2696
2095
# Wait for other process to exit
2697
2096
proc.join()
2698
2097
return False
2699
2098
2700
2099
# Read a request from the child
2701
2100
request = parent_pipe.recv()
2702
2101
command = request[0]
2703
2102
2704
2103
if command == 'init':
2705
key_id = request[1].decode("ascii")
2706
fpr = request[2].decode("ascii")
2707
address = request[3]
2708
2709
for c in self.clients.values():
2710
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2711
continue
2712
if key_id and c.key_id == key_id:
2713
client = c
2714
break
2715
if fpr and c.fingerprint == fpr:
2104
fpr = request[1]
2105
address = request[2]
2106
2107
for c in self.clients.itervalues():
2108
if c.fingerprint == fpr:
2716
2109
client = c
2717
2110
break
2718
2111
else:
2719
logger.info("Client not found for key ID: %s, address"
2720
": %s", key_id or fpr, address)
2112
logger.info("Client not found for fingerprint: %s, ad"
2113
"dress: %s", fpr, address)
2721
2114
if self.use_dbus:
2722
2115
# Emit D-Bus signal
2723
mandos_dbus_service.ClientNotFound(key_id or fpr,
2116
mandos_dbus_service.ClientNotFound(fpr,
2724
2117
address[0])
2725
2118
parent_pipe.send(False)
2726
2119
return False
2727
2728
GLib.io_add_watch(
2729
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2730
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2120
2121
gobject.io_add_watch(
2122
parent_pipe.fileno(),
2123
gobject.IO_IN | gobject.IO_HUP,
2731
2124
functools.partial(self.handle_ipc,
2732
parent_pipe=parent_pipe,
2733
proc=proc,
2734
client_object=client))
2125
parent_pipe = parent_pipe,
2126
proc = proc,
2127
client_object = client))
2735
2128
parent_pipe.send(True)
2736
2129
# remove the old hook in favor of the new above hook on
2737
2130
# same fileno
2740
2133
funcname = request[1]
2741
2134
args = request[2]
2742
2135
kwargs = request[3]
2743
2136
2744
2137
parent_pipe.send(('data', getattr(client_object,
2745
2138
funcname)(*args,
2746
2139
**kwargs)))
2747
2140
2748
2141
if command == 'getattr':
2749
2142
attrname = request[1]
2750
if isinstance(client_object.__getattribute__(attrname),
2751
collections.Callable):
2143
if callable(client_object.__getattribute__(attrname)):
2752
2144
parent_pipe.send(('function', ))
2753
2145
else:
2754
2146
parent_pipe.send((
2755
2147
'data', client_object.__getattribute__(attrname)))
2756
2148
2757
2149
if command == 'setattr':
2758
2150
attrname = request[1]
2759
2151
value = request[2]
2760
2152
setattr(client_object, attrname, value)
2761
2153
2762
2154
return True
2763
2155
2764
2156
2765
2157
def rfc3339_duration_to_delta(duration):
2766
2158
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2767
2768
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2769
True
2770
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2771
True
2772
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2773
True
2774
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2775
True
2776
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2777
True
2778
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2779
True
2780
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2781
True
2159
2160
>>> rfc3339_duration_to_delta("P7D")
2161
datetime.timedelta(7)
2162
>>> rfc3339_duration_to_delta("PT60S")
2163
datetime.timedelta(0, 60)
2164
>>> rfc3339_duration_to_delta("PT60M")
2165
datetime.timedelta(0, 3600)
2166
>>> rfc3339_duration_to_delta("PT24H")
2167
datetime.timedelta(1)
2168
>>> rfc3339_duration_to_delta("P1W")
2169
datetime.timedelta(7)
2170
>>> rfc3339_duration_to_delta("PT5M30S")
2171
datetime.timedelta(0, 330)
2172
>>> rfc3339_duration_to_delta("P1DT3M20S")
2173
datetime.timedelta(1, 200)
2782
2174
"""
2783
2175
2784
2176
# Parsing an RFC 3339 duration with regular expressions is not
2785
2177
# possible - there would have to be multiple places for the same
2786
2178
# values, like seconds. The current code, while more esoteric, is
2787
2179
# cleaner without depending on a parsing library. If Python had a
2788
2180
# built-in library for parsing we would use it, but we'd like to
2789
2181
# avoid excessive use of external libraries.
2790
2182
2791
2183
# New type for defining tokens, syntax, and semantics all-in-one
2184
Token = collections.namedtuple("Token",
2185
("regexp", # To match token; if
2186
# "value" is not None,
2187
# must have a "group"
2188
# containing digits
2189
"value", # datetime.timedelta or
2190
# None
2191
"followers")) # Tokens valid after
2192
# this token
2792
2193
Token = collections.namedtuple("Token", (
2793
2194
"regexp", # To match token; if "value" is not None, must have
2794
2195
# a "group" containing digits
2826
2227
frozenset((token_year, token_month,
2827
2228
token_day, token_time,
2828
2229
token_week)))
2829
# Define starting values:
2830
# Value so far
2831
value = datetime.timedelta()
2230
# Define starting values
2231
value = datetime.timedelta() # Value so far
2832
2232
found_token = None
2833
# Following valid tokens
2834
followers = frozenset((token_duration, ))
2835
# String left to parse
2836
s = duration
2233
followers = frozenset((token_duration,)) # Following valid tokens
2234
s = duration # String left to parse
2837
2235
# Loop until end token is found
2838
2236
while found_token is not token_end:
2839
2237
# Search for any currently valid tokens
2855
2253
break
2856
2254
else:
2857
2255
# No currently valid tokens were found
2858
raise ValueError("Invalid RFC 3339 duration: {!r}"
2859
.format(duration))
2256
raise ValueError("Invalid RFC 3339 duration")
2860
2257
# End token found
2861
2258
return value
2862
2259
2863
2260
2864
2261
def string_to_delta(interval):
2865
2262
"""Parse a string and return a datetime.timedelta
2866
2867
>>> string_to_delta('7d') == datetime.timedelta(7)
2868
True
2869
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2870
True
2871
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2872
True
2873
>>> string_to_delta('24h') == datetime.timedelta(1)
2874
True
2875
>>> string_to_delta('1w') == datetime.timedelta(7)
2876
True
2877
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2878
True
2263
2264
>>> string_to_delta('7d')
2265
datetime.timedelta(7)
2266
>>> string_to_delta('60s')
2267
datetime.timedelta(0, 60)
2268
>>> string_to_delta('60m')
2269
datetime.timedelta(0, 3600)
2270
>>> string_to_delta('24h')
2271
datetime.timedelta(1)
2272
>>> string_to_delta('1w')
2273
datetime.timedelta(7)
2274
>>> string_to_delta('5m 30s')
2275
datetime.timedelta(0, 330)
2879
2276
"""
2880
2277
2881
2278
try:
2882
2279
return rfc3339_duration_to_delta(interval)
2883
2280
except ValueError:
2884
2281
pass
2885
2282
2886
2283
timevalue = datetime.timedelta(0)
2887
2284
for s in interval.split():
2888
2285
try:
2906
2303
return timevalue
2907
2304
2908
2305
2909
def daemon(nochdir=False, noclose=False):
2306
def daemon(nochdir = False, noclose = False):
2910
2307
"""See daemon(3). Standard BSD Unix function.
2911
2308
2912
2309
This should really exist as os.daemon, but it doesn't (yet)."""
2913
2310
if os.fork():
2914
2311
sys.exit()
2932
2329
2933
2330
2934
2331
def main():
2935
2332
2936
2333
##################################################################
2937
2334
# Parsing of options, both command line and config file
2938
2335
2939
2336
parser = argparse.ArgumentParser()
2940
2337
parser.add_argument("-v", "--version", action="version",
2941
version="%(prog)s {}".format(version),
2338
version = "%(prog)s {}".format(version),
2942
2339
help="show version number and exit")
2943
2340
parser.add_argument("-i", "--interface", metavar="IF",
2944
2341
help="Bind to interface IF")
2980
2377
parser.add_argument("--no-zeroconf", action="store_false",
2981
2378
dest="zeroconf", help="Do not use Zeroconf",
2982
2379
default=None)
2983
2380
2984
2381
options = parser.parse_args()
2985
2382
2383
if options.check:
2384
import doctest
2385
fail_count, test_count = doctest.testmod()
2386
sys.exit(os.EX_OK if fail_count == 0 else 1)
2387
2986
2388
# Default values for config file for server-global settings
2987
if gnutls.has_rawpk:
2988
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2989
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2990
else:
2991
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2992
":+SIGN-DSA-SHA256")
2993
server_defaults = {"interface": "",
2994
"address": "",
2995
"port": "",
2996
"debug": "False",
2997
"priority": priority,
2998
"servicename": "Mandos",
2999
"use_dbus": "True",
3000
"use_ipv6": "True",
3001
"debuglevel": "",
3002
"restore": "True",
3003
"socket": "",
3004
"statedir": "/var/lib/mandos",
3005
"foreground": "False",
3006
"zeroconf": "True",
3007
}
3008
del priority
3009
2389
server_defaults = { "interface": "",
2390
"address": "",
2391
"port": "",
2392
"debug": "False",
2393
"priority":
2394
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2395
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2396
"servicename": "Mandos",
2397
"use_dbus": "True",
2398
"use_ipv6": "True",
2399
"debuglevel": "",
2400
"restore": "True",
2401
"socket": "",
2402
"statedir": "/var/lib/mandos",
2403
"foreground": "False",
2404
"zeroconf": "True",
2405
}
2406
3010
2407
# Parse config file for server-global settings
3011
server_config = configparser.ConfigParser(server_defaults)
2408
server_config = configparser.SafeConfigParser(server_defaults)
3012
2409
del server_defaults
3013
2410
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3014
# Convert the ConfigParser object to a dict
2411
# Convert the SafeConfigParser object to a dict
3015
2412
server_settings = server_config.defaults()
3016
2413
# Use the appropriate methods on the non-string config options
3017
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3018
"foreground", "zeroconf"):
2414
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3019
2415
server_settings[option] = server_config.getboolean("DEFAULT",
3020
2416
option)
3021
2417
if server_settings["port"]:
3031
2427
server_settings["socket"] = os.dup(server_settings
3032
2428
["socket"])
3033
2429
del server_config
3034
2430
3035
2431
# Override the settings from the config file with command line
3036
2432
# options, if set.
3037
2433
for option in ("interface", "address", "port", "debug",
3055
2451
if server_settings["debug"]:
3056
2452
server_settings["foreground"] = True
3057
2453
# Now we have our good server settings in "server_settings"
3058
2454
3059
2455
##################################################################
3060
2456
3061
2457
if (not server_settings["zeroconf"]
3062
2458
and not (server_settings["port"]
3063
2459
or server_settings["socket"] != "")):
3064
2460
parser.error("Needs port or socket to work without Zeroconf")
3065
2461
3066
2462
# For convenience
3067
2463
debug = server_settings["debug"]
3068
2464
debuglevel = server_settings["debuglevel"]
3072
2468
stored_state_file)
3073
2469
foreground = server_settings["foreground"]
3074
2470
zeroconf = server_settings["zeroconf"]
3075
2471
3076
2472
if debug:
3077
2473
initlogger(debug, logging.DEBUG)
3078
2474
else:
3081
2477
else:
3082
2478
level = getattr(logging, debuglevel.upper())
3083
2479
initlogger(debug, level)
3084
2480
3085
2481
if server_settings["servicename"] != "Mandos":
3086
2482
syslogger.setFormatter(
3087
2483
logging.Formatter('Mandos ({}) [%(process)d]:'
3088
2484
' %(levelname)s: %(message)s'.format(
3089
2485
server_settings["servicename"])))
3090
2486
3091
2487
# Parse config file with clients
3092
client_config = configparser.ConfigParser(Client.client_defaults)
2488
client_config = configparser.SafeConfigParser(Client
2489
.client_defaults)
3093
2490
client_config.read(os.path.join(server_settings["configdir"],
3094
2491
"clients.conf"))
3095
2492
3096
2493
global mandos_dbus_service
3097
2494
mandos_dbus_service = None
3098
2495
3099
2496
socketfd = None
3100
2497
if server_settings["socket"] != "":
3101
2498
socketfd = server_settings["socket"]
3113
2510
pidfilename = "/var/run/mandos.pid"
3114
2511
pidfile = None
3115
2512
try:
3116
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2513
pidfile = open(pidfilename, "w")
3117
2514
except IOError as e:
3118
2515
logger.error("Could not open file %r", pidfilename,
3119
2516
exc_info=e)
3120
3121
for name, group in (("_mandos", "_mandos"),
3122
("mandos", "mandos"),
3123
("nobody", "nogroup")):
2517
2518
for name in ("_mandos", "mandos", "nobody"):
3124
2519
try:
3125
2520
uid = pwd.getpwnam(name).pw_uid
3126
gid = pwd.getpwnam(group).pw_gid
2521
gid = pwd.getpwnam(name).pw_gid
3127
2522
break
3128
2523
except KeyError:
3129
2524
continue
3133
2528
try:
3134
2529
os.setgid(gid)
3135
2530
os.setuid(uid)
3136
if debug:
3137
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3138
gid))
3139
2531
except OSError as error:
3140
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3141
.format(uid, gid, os.strerror(error.errno)))
3142
2532
if error.errno != errno.EPERM:
3143
2533
raise
3144
2534
3145
2535
if debug:
3146
2536
# Enable all possible GnuTLS debugging
3147
2537
3148
2538
# "Use a log level over 10 to enable all debugging options."
3149
2539
# - GnuTLS manual
3150
gnutls.global_set_log_level(11)
3151
3152
@gnutls.log_func
2540
gnutls.library.functions.gnutls_global_set_log_level(11)
2541
2542
@gnutls.library.types.gnutls_log_func
3153
2543
def debug_gnutls(level, string):
3154
2544
logger.debug("GnuTLS: %s", string[:-1])
3155
3156
gnutls.global_set_log_function(debug_gnutls)
3157
2545
2546
gnutls.library.functions.gnutls_global_set_log_function(
2547
debug_gnutls)
2548
3158
2549
# Redirect stdin so all checkers get /dev/null
3159
2550
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3160
2551
os.dup2(null, sys.stdin.fileno())
3161
2552
if null > 2:
3162
2553
os.close(null)
3163
2554
3164
2555
# Need to fork before connecting to D-Bus
3165
2556
if not foreground:
3166
2557
# Close all input and output, do double fork, etc.
3167
2558
daemon()
3168
3169
if gi.version_info < (3, 10, 2):
3170
# multiprocessing will use threads, so before we use GLib we
3171
# need to inform GLib that threads will be used.
3172
GLib.threads_init()
3173
2559
2560
# multiprocessing will use threads, so before we use gobject we
2561
# need to inform gobject that threads will be used.
2562
gobject.threads_init()
2563
3174
2564
global main_loop
3175
2565
# From the Avahi example code
3176
2566
DBusGMainLoop(set_as_default=True)
3177
main_loop = GLib.MainLoop()
2567
main_loop = gobject.MainLoop()
3178
2568
bus = dbus.SystemBus()
3179
2569
# End of Avahi example code
3180
2570
if use_dbus:
3193
2583
if zeroconf:
3194
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3195
2585
service = AvahiServiceToSyslog(
3196
name=server_settings["servicename"],
3197
servicetype="_mandos._tcp",
3198
protocol=protocol,
3199
bus=bus)
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
2589
bus = bus)
3200
2590
if server_settings["interface"]:
3201
2591
service.interface = if_nametoindex(
3202
2592
server_settings["interface"].encode("utf-8"))
3203
2593
3204
2594
global multiprocessing_manager
3205
2595
multiprocessing_manager = multiprocessing.Manager()
3206
2596
3207
2597
client_class = Client
3208
2598
if use_dbus:
3209
client_class = functools.partial(ClientDBus, bus=bus)
3210
2599
client_class = functools.partial(ClientDBus, bus = bus)
2600
3211
2601
client_settings = Client.config_parser(client_config)
3212
2602
old_client_settings = {}
3213
2603
clients_data = {}
3214
2604
3215
2605
# This is used to redirect stdout and stderr for checker processes
3216
2606
global wnull
3217
wnull = open(os.devnull, "w") # A writable /dev/null
2607
wnull = open(os.devnull, "w") # A writable /dev/null
3218
2608
# Only used if server is running in foreground but not in debug
3219
2609
# mode
3220
2610
if debug or not foreground:
3221
2611
wnull.close()
3222
2612
3223
2613
# Get client data and settings from last running state.
3224
2614
if server_settings["restore"]:
3225
2615
try:
3226
2616
with open(stored_state_path, "rb") as stored_state:
3227
if sys.version_info.major == 2:
3228
clients_data, old_client_settings = pickle.load(
3229
stored_state)
3230
else:
3231
bytes_clients_data, bytes_old_client_settings = (
3232
pickle.load(stored_state, encoding="bytes"))
3233
# Fix bytes to strings
3234
# clients_data
3235
# .keys()
3236
clients_data = {(key.decode("utf-8")
3237
if isinstance(key, bytes)
3238
else key): value
3239
for key, value in
3240
bytes_clients_data.items()}
3241
del bytes_clients_data
3242
for key in clients_data:
3243
value = {(k.decode("utf-8")
3244
if isinstance(k, bytes) else k): v
3245
for k, v in
3246
clients_data[key].items()}
3247
clients_data[key] = value
3248
# .client_structure
3249
value["client_structure"] = [
3250
(s.decode("utf-8")
3251
if isinstance(s, bytes)
3252
else s) for s in
3253
value["client_structure"]]
3254
# .name, .host, and .checker_command
3255
for k in ("name", "host", "checker_command"):
3256
if isinstance(value[k], bytes):
3257
value[k] = value[k].decode("utf-8")
3258
if "key_id" not in value:
3259
value["key_id"] = ""
3260
elif "fingerprint" not in value:
3261
value["fingerprint"] = ""
3262
# old_client_settings
3263
# .keys()
3264
old_client_settings = {
3265
(key.decode("utf-8")
3266
if isinstance(key, bytes)
3267
else key): value
3268
for key, value in
3269
bytes_old_client_settings.items()}
3270
del bytes_old_client_settings
3271
# .host and .checker_command
3272
for value in old_client_settings.values():
3273
for attribute in ("host", "checker_command"):
3274
if isinstance(value[attribute], bytes):
3275
value[attribute] = (value[attribute]
3276
.decode("utf-8"))
2617
clients_data, old_client_settings = pickle.load(
2618
stored_state)
3277
2619
os.remove(stored_state_path)
3278
2620
except IOError as e:
3279
2621
if e.errno == errno.ENOENT:
3287
2629
logger.warning("Could not load persistent state: "
3288
2630
"EOFError:",
3289
2631
exc_info=e)
3290
2632
3291
2633
with PGPEngine() as pgp:
3292
2634
for client_name, client in clients_data.items():
3293
2635
# Skip removed clients
3294
2636
if client_name not in client_settings:
3295
2637
continue
3296
2638
3297
2639
# Decide which value to use after restoring saved state.
3298
2640
# We have three different values: Old config file,
3299
2641
# new config file, and saved state.
3310
2652
client[name] = value
3311
2653
except KeyError:
3312
2654
pass
3313
2655
3314
2656
# Clients who has passed its expire date can still be
3315
# enabled if its last checker was successful. A Client
2657
# enabled if its last checker was successful. Clients
3316
2658
# whose checker succeeded before we stored its state is
3317
2659
# assumed to have successfully run all checkers during
3318
2660
# downtime.
3349
2691
client_name))
3350
2692
client["secret"] = (client_settings[client_name]
3351
2693
["secret"])
3352
2694
3353
2695
# Add/remove clients based on new changes made to config
3354
2696
for client_name in (set(old_client_settings)
3355
2697
- set(client_settings)):
3357
2699
for client_name in (set(client_settings)
3358
2700
- set(old_client_settings)):
3359
2701
clients_data[client_name] = client_settings[client_name]
3360
2702
3361
2703
# Create all client objects
3362
2704
for client_name, client in clients_data.items():
3363
2705
tcp_server.clients[client_name] = client_class(
3364
name=client_name,
3365
settings=client,
3366
server_settings=server_settings)
3367
2706
name = client_name,
2707
settings = client,
2708
server_settings = server_settings)
2709
3368
2710
if not tcp_server.clients:
3369
2711
logger.warning("No clients defined")
3370
2712
3371
2713
if not foreground:
3372
2714
if pidfile is not None:
3373
pid = os.getpid()
3374
2715
try:
3375
2716
with pidfile:
3376
print(pid, file=pidfile)
2717
pid = os.getpid()
2718
pidfile.write("{}\n".format(pid).encode("utf-8"))
3377
2719
except IOError:
3378
2720
logger.error("Could not write to file %r with PID %d",
3379
2721
pidfilename, pid)
3380
2722
del pidfile
3381
2723
del pidfilename
3382
3383
for termsig in (signal.SIGHUP, signal.SIGTERM):
3384
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3385
lambda: main_loop.quit() and False)
3386
2724
2725
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2726
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2727
3387
2728
if use_dbus:
3388
2729
3389
2730
@alternate_dbus_interfaces(
3390
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3391
class MandosDBusService(DBusObjectWithObjectManager):
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2732
class MandosDBusService(DBusObjectWithProperties):
3392
2733
"""A D-Bus proxy object"""
3393
2734
3394
2735
def __init__(self):
3395
2736
dbus.service.Object.__init__(self, bus, "/")
3396
2737
3397
2738
_interface = "se.recompile.Mandos"
3398
2739
2740
@dbus_interface_annotations(_interface)
2741
def _foo(self):
2742
return {
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2744
"false" }
2745
3399
2746
@dbus.service.signal(_interface, signature="o")
3400
2747
def ClientAdded(self, objpath):
3401
2748
"D-Bus signal"
3402
2749
pass
3403
2750
3404
2751
@dbus.service.signal(_interface, signature="ss")
3405
def ClientNotFound(self, key_id, address):
2752
def ClientNotFound(self, fingerprint, address):
3406
2753
"D-Bus signal"
3407
2754
pass
3408
3409
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3410
"true"})
2755
3411
2756
@dbus.service.signal(_interface, signature="os")
3412
2757
def ClientRemoved(self, objpath, name):
3413
2758
"D-Bus signal"
3414
2759
pass
3415
3416
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3417
"true"})
2760
3418
2761
@dbus.service.method(_interface, out_signature="ao")
3419
2762
def GetAllClients(self):
3420
2763
"D-Bus method"
3421
2764
return dbus.Array(c.dbus_object_path for c in
3422
tcp_server.clients.values())
3423
3424
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3425
"true"})
2765
tcp_server.clients.itervalues())
2766
3426
2767
@dbus.service.method(_interface,
3427
2768
out_signature="a{oa{sv}}")
3428
2769
def GetAllClientsWithProperties(self):
3429
2770
"D-Bus method"
3430
2771
return dbus.Dictionary(
3431
{c.dbus_object_path: c.GetAll(
3432
"se.recompile.Mandos.Client")
3433
for c in tcp_server.clients.values()},
2772
{ c.dbus_object_path: c.GetAll("")
2773
for c in tcp_server.clients.itervalues() },
3434
2774
signature="oa{sv}")
3435
2775
3436
2776
@dbus.service.method(_interface, in_signature="o")
3437
2777
def RemoveClient(self, object_path):
3438
2778
"D-Bus method"
3439
for c in tcp_server.clients.values():
2779
for c in tcp_server.clients.itervalues():
3440
2780
if c.dbus_object_path == object_path:
3441
2781
del tcp_server.clients[c.name]
3442
2782
c.remove_from_connection()
3443
# Don't signal the disabling
2783
# Don't signal anything except ClientRemoved
3444
2784
c.disable(quiet=True)
3445
# Emit D-Bus signal for removal
3446
self.client_removed_signal(c)
2785
# Emit D-Bus signal
2786
self.ClientRemoved(object_path, c.name)
3447
2787
return
3448
2788
raise KeyError(object_path)
3449
2789
3450
2790
del _interface
3451
3452
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3453
out_signature="a{oa{sa{sv}}}")
3454
def GetManagedObjects(self):
3455
"""D-Bus method"""
3456
return dbus.Dictionary(
3457
{client.dbus_object_path:
3458
dbus.Dictionary(
3459
{interface: client.GetAll(interface)
3460
for interface in
3461
client._get_all_interface_names()})
3462
for client in tcp_server.clients.values()})
3463
3464
def client_added_signal(self, client):
3465
"""Send the new standard signal and the old signal"""
3466
if use_dbus:
3467
# New standard signal
3468
self.InterfacesAdded(
3469
client.dbus_object_path,
3470
dbus.Dictionary(
3471
{interface: client.GetAll(interface)
3472
for interface in
3473
client._get_all_interface_names()}))
3474
# Old signal
3475
self.ClientAdded(client.dbus_object_path)
3476
3477
def client_removed_signal(self, client):
3478
"""Send the new standard signal and the old signal"""
3479
if use_dbus:
3480
# New standard signal
3481
self.InterfacesRemoved(
3482
client.dbus_object_path,
3483
client._get_all_interface_names())
3484
# Old signal
3485
self.ClientRemoved(client.dbus_object_path,
3486
client.name)
3487
2791
3488
2792
mandos_dbus_service = MandosDBusService()
3489
3490
# Save modules to variables to exempt the modules from being
3491
# unloaded before the function registered with atexit() is run.
3492
mp = multiprocessing
3493
wn = wnull
3494
2793
3495
2794
def cleanup():
3496
2795
"Cleanup function; run on exit"
3497
2796
if zeroconf:
3498
2797
service.cleanup()
3499
3500
mp.active_children()
3501
wn.close()
2798
2799
multiprocessing.active_children()
2800
wnull.close()
3502
2801
if not (tcp_server.clients or client_settings):
3503
2802
return
3504
2803
3505
2804
# Store client before exiting. Secrets are encrypted with key
3506
2805
# based on what config file has. If config file is
3507
2806
# removed/edited, old secret will thus be unrecovable.
3508
2807
clients = {}
3509
2808
with PGPEngine() as pgp:
3510
for client in tcp_server.clients.values():
2809
for client in tcp_server.clients.itervalues():
3511
2810
key = client_settings[client.name]["secret"]
3512
2811
client.encrypted_secret = pgp.encrypt(client.secret,
3513
2812
key)
3514
2813
client_dict = {}
3515
2814
3516
2815
# A list of attributes that can not be pickled
3517
2816
# + secret.
3518
exclude = {"bus", "changedstate", "secret",
3519
"checker", "server_settings"}
2817
exclude = { "bus", "changedstate", "secret",
2818
"checker", "server_settings" }
3520
2819
for name, typ in inspect.getmembers(dbus.service
3521
2820
.Object):
3522
2821
exclude.add(name)
3523
2822
3524
2823
client_dict["encrypted_secret"] = (client
3525
2824
.encrypted_secret)
3526
2825
for attr in client.client_structure:
3527
2826
if attr not in exclude:
3528
2827
client_dict[attr] = getattr(client, attr)
3529
2828
3530
2829
clients[client.name] = client_dict
3531
2830
del client_settings[client.name]["secret"]
3532
2831
3533
2832
try:
3534
2833
with tempfile.NamedTemporaryFile(
3535
2834
mode='wb',
3537
2836
prefix='clients-',
3538
2837
dir=os.path.dirname(stored_state_path),
3539
2838
delete=False) as stored_state:
3540
pickle.dump((clients, client_settings), stored_state,
3541
protocol=2)
2839
pickle.dump((clients, client_settings), stored_state)
3542
2840
tempname = stored_state.name
3543
2841
os.rename(tempname, stored_state_path)
3544
2842
except (IOError, OSError) as e:
3554
2852
logger.warning("Could not save persistent state:",
3555
2853
exc_info=e)
3556
2854
raise
3557
2855
3558
2856
# Delete all clients, and settings from config
3559
2857
while tcp_server.clients:
3560
2858
name, client = tcp_server.clients.popitem()
3561
2859
if use_dbus:
3562
2860
client.remove_from_connection()
3563
# Don't signal the disabling
2861
# Don't signal anything except ClientRemoved
3564
2862
client.disable(quiet=True)
3565
# Emit D-Bus signal for removal
3566
2863
if use_dbus:
3567
mandos_dbus_service.client_removed_signal(client)
2864
# Emit D-Bus signal
2865
mandos_dbus_service.ClientRemoved(
2866
client.dbus_object_path, client.name)
3568
2867
client_settings.clear()
3569
2868
3570
2869
atexit.register(cleanup)
3571
3572
for client in tcp_server.clients.values():
2870
2871
for client in tcp_server.clients.itervalues():
3573
2872
if use_dbus:
3574
# Emit D-Bus signal for adding
3575
mandos_dbus_service.client_added_signal(client)
2873
# Emit D-Bus signal
2874
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3576
2875
# Need to initiate checking of clients
3577
2876
if client.enabled:
3578
2877
client.init_checker()
3579
2878
3580
2879
tcp_server.enable()
3581
2880
tcp_server.server_activate()
3582
2881
3583
2882
# Find out what port we got
3584
2883
if zeroconf:
3585
2884
service.port = tcp_server.socket.getsockname()[1]
3590
2889
else: # IPv4
3591
2890
logger.info("Now listening on address %r, port %d",
3592
2891
*tcp_server.socket.getsockname())
3593
3594
# service.interface = tcp_server.socket.getsockname()[3]
3595
2892
2893
#service.interface = tcp_server.socket.getsockname()[3]
2894
3596
2895
try:
3597
2896
if zeroconf:
3598
2897
# From the Avahi example code
3603
2902
cleanup()
3604
2903
sys.exit(1)
3605
2904
# End of Avahi example code
3606
3607
GLib.io_add_watch(
3608
GLib.IOChannel.unix_new(tcp_server.fileno()),
3609
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3610
lambda *args, **kwargs: (tcp_server.handle_request
3611
(*args[2:], **kwargs) or True))
3612
2905
2906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2907
lambda *args, **kwargs:
2908
(tcp_server.handle_request
2909
(*args[2:], **kwargs) or True))
2910
3613
2911
logger.debug("Starting main loop")
3614
2912
main_loop.run()
3615
2913
except AvahiError as error:
3624
2922
# Must run before the D-Bus bus name gets deregistered
3625
2923
cleanup()
3626
2924
3627
3628
def should_only_run_tests():
3629
parser = argparse.ArgumentParser(add_help=False)
3630
parser.add_argument("--check", action='store_true')
3631
args, unknown_args = parser.parse_known_args()
3632
run_tests = args.check
3633
if run_tests:
3634
# Remove --check argument from sys.argv
3635
sys.argv[1:] = unknown_args
3636
return run_tests
3637
3638
# Add all tests from doctest strings
3639
def load_tests(loader, tests, none):
3640
import doctest
3641
tests.addTests(doctest.DocTestSuite())
3642
return tests
3643
2925
3644
2926
if __name__ == '__main__':
3645
try:
3646
if should_only_run_tests():
3647
# Call using ./mandos --check [--verbose]
3648
unittest.main()
3649
else:
3650
main()
3651
finally:
3652
logging.shutdown()
2927
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0