To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 752
- compare with another revision
- download diff
- download tarball
- view history from revision 752
- Committer: Teddy Hogeborn
- Date: 2015-05-31 15:56:58 UTC
- Revision ID: teddy@recompile.se-20150531155658-l7znu7zlqr2dmuwd
mandos: Generate better messages in exceptions.
mandos (ProxyClient.__init__): Include fingerprint in KeyError().
(rfc3339_duration_to_delta): Include duration in ValueError().
mandos (ProxyClient.__init__): Include fingerprint in KeyError().
(rfc3339_duration_to_delta): Include duration in ValueError().
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
39
try:
43
40
import SocketServer as socketserver
47
44
import argparse
48
45
import datetime
49
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
50
53
try:
51
54
import ConfigParser as configparser
52
55
except ImportError:
79
82
80
83
import dbus
81
84
import dbus.service
82
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
83
90
from dbus.mainloop.glib import DBusGMainLoop
84
91
import ctypes
85
92
import ctypes.util
97
104
if sys.version_info.major == 2:
98
105
str = unicode
99
106
100
version = "1.7.7"
107
version = "1.6.9"
101
108
stored_state_file = "clients.pickle"
102
109
103
110
logger = logging.getLogger()
118
125
return interface_index
119
126
120
127
121
def copy_function(func):
122
"""Make a copy of a function"""
123
if sys.version_info.major == 2:
124
return types.FunctionType(func.func_code,
125
func.func_globals,
126
func.func_name,
127
func.func_defaults,
128
func.func_closure)
129
else:
130
return types.FunctionType(func.__code__,
131
func.__globals__,
132
func.__name__,
133
func.__defaults__,
134
func.__closure__)
135
136
137
128
def initlogger(debug, level=logging.WARNING):
138
129
"""init logger and add loglevel"""
139
130
166
157
167
158
def __init__(self):
168
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
169
self.gpg = "gpg"
170
try:
171
output = subprocess.check_output(["gpgconf"])
172
for line in output.splitlines():
173
name, text, path = line.split(b":")
174
if name == "gpg":
175
self.gpg = path
176
break
177
except OSError as e:
178
if e.errno != errno.ENOENT:
179
raise
180
160
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
161
'--home', self.tempdir,
182
162
'--force-mdc',
183
'--quiet']
184
# Only GPG version 1 has the --no-use-agent option.
185
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
186
self.gnupgargs.append("--no-use-agent")
163
'--quiet',
164
'--no-use-agent']
187
165
188
166
def __enter__(self):
189
167
return self
225
203
dir=self.tempdir) as passfile:
226
204
passfile.write(passphrase)
227
205
passfile.flush()
228
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
229
207
'--passphrase-file',
230
208
passfile.name]
231
209
+ self.gnupgargs,
243
221
dir = self.tempdir) as passfile:
244
222
passfile.write(passphrase)
245
223
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
247
225
'--passphrase-file',
248
226
passfile.name]
249
227
+ self.gnupgargs,
255
233
raise PGPError(err)
256
234
return decrypted_plaintext
257
235
258
# Pretend that we have an Avahi module
259
class Avahi(object):
260
"""This isn't so much a class as it is a module-like namespace.
261
It is instantiated once, and simulates having an Avahi module."""
262
IF_UNSPEC = -1 # avahi-common/address.h
263
PROTO_UNSPEC = -1 # avahi-common/address.h
264
PROTO_INET = 0 # avahi-common/address.h
265
PROTO_INET6 = 1 # avahi-common/address.h
266
DBUS_NAME = "org.freedesktop.Avahi"
267
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
268
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
269
DBUS_PATH_SERVER = "/"
270
def string_array_to_txt_array(self, t):
271
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
272
for s in t), signature="ay")
273
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
274
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
275
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
276
SERVER_INVALID = 0 # avahi-common/defs.h
277
SERVER_REGISTERING = 1 # avahi-common/defs.h
278
SERVER_RUNNING = 2 # avahi-common/defs.h
279
SERVER_COLLISION = 3 # avahi-common/defs.h
280
SERVER_FAILURE = 4 # avahi-common/defs.h
281
avahi = Avahi()
282
236
283
237
class AvahiError(Exception):
284
238
def __init__(self, value, *args, **kwargs):
441
395
logger.error(bad_states[state] + ": %r", error)
442
396
self.cleanup()
443
397
elif state == avahi.SERVER_RUNNING:
444
try:
445
self.add()
446
except dbus.exceptions.DBusException as error:
447
if (error.get_dbus_name()
448
== "org.freedesktop.Avahi.CollisionError"):
449
logger.info("Local Zeroconf service name"
450
" collision.")
451
return self.rename(remove=False)
452
else:
453
logger.critical("D-Bus Exception", exc_info=error)
454
self.cleanup()
455
os._exit(1)
398
self.add()
456
399
else:
457
400
if error is None:
458
401
logger.debug("Unknown state: %r", state)
481
424
.format(self.name)))
482
425
return ret
483
426
484
# Pretend that we have a GnuTLS module
485
class GnuTLS(object):
486
"""This isn't so much a class as it is a module-like namespace.
487
It is instantiated once, and simulates having a GnuTLS module."""
488
489
_library = ctypes.cdll.LoadLibrary(
490
ctypes.util.find_library("gnutls"))
491
_need_version = b"3.3.0"
492
def __init__(self):
493
# Need to use class name "GnuTLS" here, since this method is
494
# called before the assignment to the "gnutls" global variable
495
# happens.
496
if GnuTLS.check_version(self._need_version) is None:
497
raise GnuTLS.Error("Needs GnuTLS {} or later"
498
.format(self._need_version))
499
500
# Unless otherwise indicated, the constants and types below are
501
# all from the gnutls/gnutls.h C header file.
502
503
# Constants
504
E_SUCCESS = 0
505
E_INTERRUPTED = -52
506
E_AGAIN = -28
507
CRT_OPENPGP = 2
508
CLIENT = 2
509
SHUT_RDWR = 0
510
CRD_CERTIFICATE = 1
511
E_NO_CERTIFICATE_FOUND = -49
512
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
513
514
# Types
515
class session_int(ctypes.Structure):
516
_fields_ = []
517
session_t = ctypes.POINTER(session_int)
518
class certificate_credentials_st(ctypes.Structure):
519
_fields_ = []
520
certificate_credentials_t = ctypes.POINTER(
521
certificate_credentials_st)
522
certificate_type_t = ctypes.c_int
523
class datum_t(ctypes.Structure):
524
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
525
('size', ctypes.c_uint)]
526
class openpgp_crt_int(ctypes.Structure):
527
_fields_ = []
528
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
529
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
531
credentials_type_t = ctypes.c_int
532
transport_ptr_t = ctypes.c_void_p
533
close_request_t = ctypes.c_int
534
535
# Exceptions
536
class Error(Exception):
537
# We need to use the class name "GnuTLS" here, since this
538
# exception might be raised from within GnuTLS.__init__,
539
# which is called before the assignment to the "gnutls"
540
# global variable has happened.
541
def __init__(self, message = None, code = None, args=()):
542
# Default usage is by a message string, but if a return
543
# code is passed, convert it to a string with
544
# gnutls.strerror()
545
self.code = code
546
if message is None and code is not None:
547
message = GnuTLS.strerror(code)
548
return super(GnuTLS.Error, self).__init__(
549
message, *args)
550
551
class CertificateSecurityError(Error):
552
pass
553
554
# Classes
555
class Credentials(object):
556
def __init__(self):
557
self._c_object = gnutls.certificate_credentials_t()
558
gnutls.certificate_allocate_credentials(
559
ctypes.byref(self._c_object))
560
self.type = gnutls.CRD_CERTIFICATE
561
562
def __del__(self):
563
gnutls.certificate_free_credentials(self._c_object)
564
565
class ClientSession(object):
566
def __init__(self, socket, credentials = None):
567
self._c_object = gnutls.session_t()
568
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
569
gnutls.set_default_priority(self._c_object)
570
gnutls.transport_set_ptr(self._c_object, socket.fileno())
571
gnutls.handshake_set_private_extensions(self._c_object,
572
True)
573
self.socket = socket
574
if credentials is None:
575
credentials = gnutls.Credentials()
576
gnutls.credentials_set(self._c_object, credentials.type,
577
ctypes.cast(credentials._c_object,
578
ctypes.c_void_p))
579
self.credentials = credentials
580
581
def __del__(self):
582
gnutls.deinit(self._c_object)
583
584
def handshake(self):
585
return gnutls.handshake(self._c_object)
586
587
def send(self, data):
588
data = bytes(data)
589
data_len = len(data)
590
while data_len > 0:
591
data_len -= gnutls.record_send(self._c_object,
592
data[-data_len:],
593
data_len)
594
595
def bye(self):
596
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
597
598
# Error handling functions
599
def _error_code(result):
600
"""A function to raise exceptions on errors, suitable
601
for the 'restype' attribute on ctypes functions"""
602
if result >= 0:
603
return result
604
if result == gnutls.E_NO_CERTIFICATE_FOUND:
605
raise gnutls.CertificateSecurityError(code = result)
606
raise gnutls.Error(code = result)
607
608
def _retry_on_error(result, func, arguments):
609
"""A function to retry on some errors, suitable
610
for the 'errcheck' attribute on ctypes functions"""
611
while result < 0:
612
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
613
return _error_code(result)
614
result = func(*arguments)
615
return result
616
617
# Unless otherwise indicated, the function declarations below are
618
# all from the gnutls/gnutls.h C header file.
619
620
# Functions
621
priority_set_direct = _library.gnutls_priority_set_direct
622
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
623
ctypes.POINTER(ctypes.c_char_p)]
624
priority_set_direct.restype = _error_code
625
626
init = _library.gnutls_init
627
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
628
init.restype = _error_code
629
630
set_default_priority = _library.gnutls_set_default_priority
631
set_default_priority.argtypes = [session_t]
632
set_default_priority.restype = _error_code
633
634
record_send = _library.gnutls_record_send
635
record_send.argtypes = [session_t, ctypes.c_void_p,
636
ctypes.c_size_t]
637
record_send.restype = ctypes.c_ssize_t
638
record_send.errcheck = _retry_on_error
639
640
certificate_allocate_credentials = (
641
_library.gnutls_certificate_allocate_credentials)
642
certificate_allocate_credentials.argtypes = [
643
ctypes.POINTER(certificate_credentials_t)]
644
certificate_allocate_credentials.restype = _error_code
645
646
certificate_free_credentials = (
647
_library.gnutls_certificate_free_credentials)
648
certificate_free_credentials.argtypes = [certificate_credentials_t]
649
certificate_free_credentials.restype = None
650
651
handshake_set_private_extensions = (
652
_library.gnutls_handshake_set_private_extensions)
653
handshake_set_private_extensions.argtypes = [session_t,
654
ctypes.c_int]
655
handshake_set_private_extensions.restype = None
656
657
credentials_set = _library.gnutls_credentials_set
658
credentials_set.argtypes = [session_t, credentials_type_t,
659
ctypes.c_void_p]
660
credentials_set.restype = _error_code
661
662
strerror = _library.gnutls_strerror
663
strerror.argtypes = [ctypes.c_int]
664
strerror.restype = ctypes.c_char_p
665
666
certificate_type_get = _library.gnutls_certificate_type_get
667
certificate_type_get.argtypes = [session_t]
668
certificate_type_get.restype = _error_code
669
670
certificate_get_peers = _library.gnutls_certificate_get_peers
671
certificate_get_peers.argtypes = [session_t,
672
ctypes.POINTER(ctypes.c_uint)]
673
certificate_get_peers.restype = ctypes.POINTER(datum_t)
674
675
global_set_log_level = _library.gnutls_global_set_log_level
676
global_set_log_level.argtypes = [ctypes.c_int]
677
global_set_log_level.restype = None
678
679
global_set_log_function = _library.gnutls_global_set_log_function
680
global_set_log_function.argtypes = [log_func]
681
global_set_log_function.restype = None
682
683
deinit = _library.gnutls_deinit
684
deinit.argtypes = [session_t]
685
deinit.restype = None
686
687
handshake = _library.gnutls_handshake
688
handshake.argtypes = [session_t]
689
handshake.restype = _error_code
690
handshake.errcheck = _retry_on_error
691
692
transport_set_ptr = _library.gnutls_transport_set_ptr
693
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
694
transport_set_ptr.restype = None
695
696
bye = _library.gnutls_bye
697
bye.argtypes = [session_t, close_request_t]
698
bye.restype = _error_code
699
bye.errcheck = _retry_on_error
700
701
check_version = _library.gnutls_check_version
702
check_version.argtypes = [ctypes.c_char_p]
703
check_version.restype = ctypes.c_char_p
704
705
# All the function declarations below are from gnutls/openpgp.h
706
707
openpgp_crt_init = _library.gnutls_openpgp_crt_init
708
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
709
openpgp_crt_init.restype = _error_code
710
711
openpgp_crt_import = _library.gnutls_openpgp_crt_import
712
openpgp_crt_import.argtypes = [openpgp_crt_t,
713
ctypes.POINTER(datum_t),
714
openpgp_crt_fmt_t]
715
openpgp_crt_import.restype = _error_code
716
717
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
718
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
719
ctypes.POINTER(ctypes.c_uint)]
720
openpgp_crt_verify_self.restype = _error_code
721
722
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
723
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
724
openpgp_crt_deinit.restype = None
725
726
openpgp_crt_get_fingerprint = (
727
_library.gnutls_openpgp_crt_get_fingerprint)
728
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
729
ctypes.c_void_p,
730
ctypes.POINTER(
731
ctypes.c_size_t)]
732
openpgp_crt_get_fingerprint.restype = _error_code
733
734
# Remove non-public functions
735
del _error_code, _retry_on_error
736
# Create the global "gnutls" object, simulating a module
737
gnutls = GnuTLS()
738
739
def call_pipe(connection, # : multiprocessing.Connection
740
func, *args, **kwargs):
741
"""This function is meant to be called by multiprocessing.Process
742
743
This function runs func(*args, **kwargs), and writes the resulting
744
return value on the provided multiprocessing.Connection.
745
"""
746
connection.send(func(*args, **kwargs))
747
connection.close()
748
427
749
428
class Client(object):
750
429
"""A representation of a client host served by this server.
756
435
checker: subprocess.Popen(); a running checker process used
757
436
to see if the client lives.
758
437
'None' if no process is running.
759
checker_callback_tag: a GLib event source tag, or None
438
checker_callback_tag: a gobject event source tag, or None
760
439
checker_command: string; External command which is run to check
761
440
if client lives. %() expansions are done at
762
441
runtime with vars(self) as dict, so that for
763
442
instance %(name)s can be used in the command.
764
checker_initiator_tag: a GLib event source tag, or None
443
checker_initiator_tag: a gobject event source tag, or None
765
444
created: datetime.datetime(); (UTC) object creation
766
445
client_structure: Object describing what attributes a client has
767
446
and is used for storing the client at exit
768
447
current_checker_command: string; current running checker_command
769
disable_initiator_tag: a GLib event source tag, or None
448
disable_initiator_tag: a gobject event source tag, or None
770
449
enabled: bool()
771
450
fingerprint: string (40 or 32 hexadecimal digits); used to
772
451
uniquely identify the client
777
456
last_checker_status: integer between 0 and 255 reflecting exit
778
457
status of last checker. -1 reflects crashed
779
458
checker, -2 means no checker completed yet.
780
last_checker_signal: The signal which killed the last checker, if
781
last_checker_status is -1
782
459
last_enabled: datetime.datetime(); (UTC) or None
783
460
name: string; from the config file, used in log messages and
784
461
D-Bus identifiers
835
512
client["fingerprint"] = (section["fingerprint"].upper()
836
513
.replace(" ", ""))
837
514
if "secret" in section:
838
client["secret"] = codecs.decode(section["secret"]
839
.encode("utf-8"),
840
"base64")
515
client["secret"] = section["secret"].decode("base64")
841
516
elif "secfile" in section:
842
517
with open(os.path.expanduser(os.path.expandvars
843
518
(section["secfile"])),
896
571
self.changedstate = multiprocessing_manager.Condition(
897
572
multiprocessing_manager.Lock())
898
573
self.client_structure = [attr
899
for attr in self.__dict__.keys()
574
for attr in self.__dict__.iterkeys()
900
575
if not attr.startswith("_")]
901
576
self.client_structure.append("client_structure")
902
577
928
603
if not quiet:
929
604
logger.info("Disabling client %s", self.name)
930
605
if getattr(self, "disable_initiator_tag", None) is not None:
931
GLib.source_remove(self.disable_initiator_tag)
606
gobject.source_remove(self.disable_initiator_tag)
932
607
self.disable_initiator_tag = None
933
608
self.expires = None
934
609
if getattr(self, "checker_initiator_tag", None) is not None:
935
GLib.source_remove(self.checker_initiator_tag)
610
gobject.source_remove(self.checker_initiator_tag)
936
611
self.checker_initiator_tag = None
937
612
self.stop_checker()
938
613
self.enabled = False
939
614
if not quiet:
940
615
self.send_changedstate()
941
# Do not run this again if called by a GLib.timeout_add
616
# Do not run this again if called by a gobject.timeout_add
942
617
return False
943
618
944
619
def __del__(self):
948
623
# Schedule a new checker to be started an 'interval' from now,
949
624
# and every interval from then on.
950
625
if self.checker_initiator_tag is not None:
951
GLib.source_remove(self.checker_initiator_tag)
952
self.checker_initiator_tag = GLib.timeout_add(
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
953
628
int(self.interval.total_seconds() * 1000),
954
629
self.start_checker)
955
630
# Schedule a disable() when 'timeout' has passed
956
631
if self.disable_initiator_tag is not None:
957
GLib.source_remove(self.disable_initiator_tag)
958
self.disable_initiator_tag = GLib.timeout_add(
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
959
634
int(self.timeout.total_seconds() * 1000), self.disable)
960
635
# Also start a new checker *right now*.
961
636
self.start_checker()
962
637
963
def checker_callback(self, source, condition, connection,
964
command):
638
def checker_callback(self, pid, condition, command):
965
639
"""The checker has completed, so take appropriate actions."""
966
640
self.checker_callback_tag = None
967
641
self.checker = None
968
# Read return code from connection (see call_pipe)
969
returncode = connection.recv()
970
connection.close()
971
972
if returncode >= 0:
973
self.last_checker_status = returncode
974
self.last_checker_signal = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
975
644
if self.last_checker_status == 0:
976
645
logger.info("Checker for %(name)s succeeded",
977
646
vars(self))
980
649
logger.info("Checker for %(name)s failed", vars(self))
981
650
else:
982
651
self.last_checker_status = -1
983
self.last_checker_signal = -returncode
984
652
logger.warning("Checker for %(name)s crashed?",
985
653
vars(self))
986
return False
987
654
988
655
def checked_ok(self):
989
656
"""Assert that the client has been seen, alive and well."""
990
657
self.last_checked_ok = datetime.datetime.utcnow()
991
658
self.last_checker_status = 0
992
self.last_checker_signal = None
993
659
self.bump_timeout()
994
660
995
661
def bump_timeout(self, timeout=None):
997
663
if timeout is None:
998
664
timeout = self.timeout
999
665
if self.disable_initiator_tag is not None:
1000
GLib.source_remove(self.disable_initiator_tag)
666
gobject.source_remove(self.disable_initiator_tag)
1001
667
self.disable_initiator_tag = None
1002
668
if getattr(self, "enabled", False):
1003
self.disable_initiator_tag = GLib.timeout_add(
669
self.disable_initiator_tag = gobject.timeout_add(
1004
670
int(timeout.total_seconds() * 1000), self.disable)
1005
671
self.expires = datetime.datetime.utcnow() + timeout
1006
672
1021
687
# than 'timeout' for the client to be disabled, which is as it
1022
688
# should be.
1023
689
1024
if self.checker is not None and not self.checker.is_alive():
1025
logger.warning("Checker was not alive; joining")
1026
self.checker.join()
1027
self.checker = None
690
# If a checker exists, make sure it is not a zombie
691
try:
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
698
else:
699
if pid:
700
logger.warning("Checker was a zombie")
701
gobject.source_remove(self.checker_callback_tag)
702
self.checker_callback(pid, status,
703
self.current_checker_command)
1028
704
# Start a new checker if needed
1029
705
if self.checker is None:
1030
706
# Escape attributes for the shell
1039
715
exc_info=error)
1040
716
return True # Try again later
1041
717
self.current_checker_command = command
1042
logger.info("Starting checker %r for %s", command,
1043
self.name)
1044
# We don't need to redirect stdout and stderr, since
1045
# in normal mode, that is already done by daemon(),
1046
# and in debug mode we don't want to. (Stdin is
1047
# always replaced by /dev/null.)
1048
# The exception is when not debugging but nevertheless
1049
# running in the foreground; use the previously
1050
# created wnull.
1051
popen_args = { "close_fds": True,
1052
"shell": True,
1053
"cwd": "/" }
1054
if (not self.server_settings["debug"]
1055
and self.server_settings["foreground"]):
1056
popen_args.update({"stdout": wnull,
1057
"stderr": wnull })
1058
pipe = multiprocessing.Pipe(duplex = False)
1059
self.checker = multiprocessing.Process(
1060
target = call_pipe,
1061
args = (pipe[1], subprocess.call, command),
1062
kwargs = popen_args)
1063
self.checker.start()
1064
self.checker_callback_tag = GLib.io_add_watch(
1065
pipe[0].fileno(), GLib.IO_IN,
1066
self.checker_callback, pipe[0], command)
1067
# Re-run this periodically if run by GLib.timeout_add
718
try:
719
logger.info("Starting checker %r for %s", command,
720
self.name)
721
# We don't need to redirect stdout and stderr, since
722
# in normal mode, that is already done by daemon(),
723
# and in debug mode we don't want to. (Stdin is
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
733
self.checker = subprocess.Popen(command,
734
close_fds=True,
735
shell=True,
736
cwd="/",
737
**popen_args)
738
except OSError as error:
739
logger.error("Failed to start subprocess",
740
exc_info=error)
741
return True
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1068
759
return True
1069
760
1070
761
def stop_checker(self):
1071
762
"""Force the checker process, if any, to stop."""
1072
763
if self.checker_callback_tag:
1073
GLib.source_remove(self.checker_callback_tag)
764
gobject.source_remove(self.checker_callback_tag)
1074
765
self.checker_callback_tag = None
1075
766
if getattr(self, "checker", None) is None:
1076
767
return
1077
768
logger.debug("Stopping checker for %(name)s", vars(self))
1078
self.checker.terminate()
769
try:
770
self.checker.terminate()
771
#time.sleep(0.5)
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
776
raise
1079
777
self.checker = None
1080
778
1081
779
1145
843
access="r")
1146
844
def Property_dbus_property(self):
1147
845
return dbus.Boolean(False)
1148
1149
See also the DBusObjectWithAnnotations class.
1150
846
"""
1151
847
1152
848
def decorator(func):
1174
870
pass
1175
871
1176
872
1177
class DBusObjectWithAnnotations(dbus.service.Object):
1178
"""A D-Bus object with annotations.
873
class DBusObjectWithProperties(dbus.service.Object):
874
"""A D-Bus object with properties.
1179
875
1180
Classes inheriting from this can use the dbus_annotations
1181
decorator to add annotations to methods or signals.
876
Classes inheriting from this can use the dbus_service_property
877
decorator to expose methods as D-Bus properties. It exposes the
878
standard Get(), Set(), and GetAll() methods on the D-Bus.
1182
879
"""
1183
880
1184
881
@staticmethod
1200
897
for name, athing in
1201
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1202
899
1203
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1204
out_signature = "s",
1205
path_keyword = 'object_path',
1206
connection_keyword = 'connection')
1207
def Introspect(self, object_path, connection):
1208
"""Overloading of standard D-Bus method.
1209
1210
Inserts annotation tags on methods and signals.
1211
"""
1212
xmlstring = dbus.service.Object.Introspect(self, object_path,
1213
connection)
1214
try:
1215
document = xml.dom.minidom.parseString(xmlstring)
1216
1217
for if_tag in document.getElementsByTagName("interface"):
1218
# Add annotation tags
1219
for typ in ("method", "signal"):
1220
for tag in if_tag.getElementsByTagName(typ):
1221
annots = dict()
1222
for name, prop in (self.
1223
_get_all_dbus_things(typ)):
1224
if (name == tag.getAttribute("name")
1225
and prop._dbus_interface
1226
== if_tag.getAttribute("name")):
1227
annots.update(getattr(
1228
prop, "_dbus_annotations", {}))
1229
for name, value in annots.items():
1230
ann_tag = document.createElement(
1231
"annotation")
1232
ann_tag.setAttribute("name", name)
1233
ann_tag.setAttribute("value", value)
1234
tag.appendChild(ann_tag)
1235
# Add interface annotation tags
1236
for annotation, value in dict(
1237
itertools.chain.from_iterable(
1238
annotations().items()
1239
for name, annotations
1240
in self._get_all_dbus_things("interface")
1241
if name == if_tag.getAttribute("name")
1242
)).items():
1243
ann_tag = document.createElement("annotation")
1244
ann_tag.setAttribute("name", annotation)
1245
ann_tag.setAttribute("value", value)
1246
if_tag.appendChild(ann_tag)
1247
# Fix argument name for the Introspect method itself
1248
if (if_tag.getAttribute("name")
1249
== dbus.INTROSPECTABLE_IFACE):
1250
for cn in if_tag.getElementsByTagName("method"):
1251
if cn.getAttribute("name") == "Introspect":
1252
for arg in cn.getElementsByTagName("arg"):
1253
if (arg.getAttribute("direction")
1254
== "out"):
1255
arg.setAttribute("name",
1256
"xml_data")
1257
xmlstring = document.toxml("utf-8")
1258
document.unlink()
1259
except (AttributeError, xml.dom.DOMException,
1260
xml.parsers.expat.ExpatError) as error:
1261
logger.error("Failed to override Introspection method",
1262
exc_info=error)
1263
return xmlstring
1264
1265
1266
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1267
"""A D-Bus object with properties.
1268
1269
Classes inheriting from this can use the dbus_service_property
1270
decorator to expose methods as D-Bus properties. It exposes the
1271
standard Get(), Set(), and GetAll() methods on the D-Bus.
1272
"""
1273
1274
900
def _get_dbus_property(self, interface_name, property_name):
1275
901
"""Returns a bound method if one exists which is a D-Bus
1276
902
property with the specified name and interface.
1286
912
raise DBusPropertyNotFound("{}:{}.{}".format(
1287
913
self.dbus_object_path, interface_name, property_name))
1288
914
1289
@classmethod
1290
def _get_all_interface_names(cls):
1291
"""Get a sequence of all interfaces supported by an object"""
1292
return (name for name in set(getattr(getattr(x, attr),
1293
"_dbus_interface", None)
1294
for x in (inspect.getmro(cls))
1295
for attr in dir(x))
1296
if name is not None)
1297
1298
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
1299
916
in_signature="ss",
1300
917
out_signature="v")
1370
987
1371
988
Inserts property tags and interface annotation tags.
1372
989
"""
1373
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1374
object_path,
1375
connection)
990
xmlstring = dbus.service.Object.Introspect(self, object_path,
991
connection)
1376
992
try:
1377
993
document = xml.dom.minidom.parseString(xmlstring)
1378
994
1391
1007
if prop._dbus_interface
1392
1008
== if_tag.getAttribute("name")):
1393
1009
if_tag.appendChild(tag)
1394
# Add annotation tags for properties
1395
for tag in if_tag.getElementsByTagName("property"):
1396
annots = dict()
1397
for name, prop in self._get_all_dbus_things(
1398
"property"):
1399
if (name == tag.getAttribute("name")
1400
and prop._dbus_interface
1401
== if_tag.getAttribute("name")):
1402
annots.update(getattr(
1403
prop, "_dbus_annotations", {}))
1404
for name, value in annots.items():
1405
ann_tag = document.createElement(
1406
"annotation")
1407
ann_tag.setAttribute("name", name)
1408
ann_tag.setAttribute("value", value)
1409
tag.appendChild(ann_tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1013
annots = dict()
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1023
"annotation")
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1034
)).items():
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1410
1039
# Add the names to the return values for the
1411
1040
# "org.freedesktop.DBus.Properties" methods
1412
1041
if (if_tag.getAttribute("name")
1430
1059
exc_info=error)
1431
1060
return xmlstring
1432
1061
1433
try:
1434
dbus.OBJECT_MANAGER_IFACE
1435
except AttributeError:
1436
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1437
1438
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1439
"""A D-Bus object with an ObjectManager.
1440
1441
Classes inheriting from this exposes the standard
1442
GetManagedObjects call and the InterfacesAdded and
1443
InterfacesRemoved signals on the standard
1444
"org.freedesktop.DBus.ObjectManager" interface.
1445
1446
Note: No signals are sent automatically; they must be sent
1447
manually.
1448
"""
1449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1450
out_signature = "a{oa{sa{sv}}}")
1451
def GetManagedObjects(self):
1452
"""This function must be overridden"""
1453
raise NotImplementedError()
1454
1455
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1456
signature = "oa{sa{sv}}")
1457
def InterfacesAdded(self, object_path, interfaces_and_properties):
1458
pass
1459
1460
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1461
def InterfacesRemoved(self, object_path, interfaces):
1462
pass
1463
1464
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1465
out_signature = "s",
1466
path_keyword = 'object_path',
1467
connection_keyword = 'connection')
1468
def Introspect(self, object_path, connection):
1469
"""Overloading of standard D-Bus method.
1470
1471
Override return argument name of GetManagedObjects to be
1472
"objpath_interfaces_and_properties"
1473
"""
1474
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1475
object_path,
1476
connection)
1477
try:
1478
document = xml.dom.minidom.parseString(xmlstring)
1479
1480
for if_tag in document.getElementsByTagName("interface"):
1481
# Fix argument name for the GetManagedObjects method
1482
if (if_tag.getAttribute("name")
1483
== dbus.OBJECT_MANAGER_IFACE):
1484
for cn in if_tag.getElementsByTagName("method"):
1485
if (cn.getAttribute("name")
1486
== "GetManagedObjects"):
1487
for arg in cn.getElementsByTagName("arg"):
1488
if (arg.getAttribute("direction")
1489
== "out"):
1490
arg.setAttribute(
1491
"name",
1492
"objpath_interfaces"
1493
"_and_properties")
1494
xmlstring = document.toxml("utf-8")
1495
document.unlink()
1496
except (AttributeError, xml.dom.DOMException,
1497
xml.parsers.expat.ExpatError) as error:
1498
logger.error("Failed to override Introspection method",
1499
exc_info = error)
1500
return xmlstring
1501
1062
1502
1063
def datetime_to_dbus(dt, variant_level=0):
1503
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1552
1113
if getattr(attribute, "_dbus_is_signal", False):
1553
1114
# Extract the original non-method undecorated
1554
1115
# function by black magic
1555
if sys.version_info.major == 2:
1556
nonmethod_func = (dict(
1557
zip(attribute.func_code.co_freevars,
1558
attribute.__closure__))
1559
["func"].cell_contents)
1560
else:
1561
nonmethod_func = (dict(
1562
zip(attribute.__code__.co_freevars,
1563
attribute.__closure__))
1564
["func"].cell_contents)
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1565
1120
# Create a new, but exactly alike, function
1566
1121
# object, and decorate it to be a new D-Bus signal
1567
1122
# with the alternate D-Bus interface name
1568
new_function = copy_function(nonmethod_func)
1569
1123
new_function = (dbus.service.signal(
1570
alt_interface,
1571
attribute._dbus_signature)(new_function))
1124
alt_interface, attribute._dbus_signature)
1125
(types.FunctionType(
1126
nonmethod_func.func_code,
1127
nonmethod_func.func_globals,
1128
nonmethod_func.func_name,
1129
nonmethod_func.func_defaults,
1130
nonmethod_func.func_closure)))
1572
1131
# Copy annotations, if any
1573
1132
try:
1574
1133
new_function._dbus_annotations = dict(
1584
1143
func1 and func2 to the "call_both" function
1585
1144
outside of its arguments"""
1586
1145
1587
@functools.wraps(func2)
1588
1146
def call_both(*args, **kwargs):
1589
1147
"""This function will emit two D-Bus
1590
1148
signals by calling func1 and func2"""
1591
1149
func1(*args, **kwargs)
1592
1150
func2(*args, **kwargs)
1593
# Make wrapper function look like a D-Bus signal
1594
for name, attr in inspect.getmembers(func2):
1595
if name.startswith("_dbus_"):
1596
setattr(call_both, name, attr)
1597
1151
1598
1152
return call_both
1599
1153
# Create the "call_both" function and add it to
1610
1164
alt_interface,
1611
1165
attribute._dbus_in_signature,
1612
1166
attribute._dbus_out_signature)
1613
(copy_function(attribute)))
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1614
1172
# Copy annotations, if any
1615
1173
try:
1616
1174
attr[attrname]._dbus_annotations = dict(
1628
1186
attribute._dbus_access,
1629
1187
attribute._dbus_get_args_options
1630
1188
["byte_arrays"])
1631
(copy_function(attribute)))
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1632
1195
# Copy annotations, if any
1633
1196
try:
1634
1197
attr[attrname]._dbus_annotations = dict(
1643
1206
# to the class.
1644
1207
attr[attrname] = (
1645
1208
dbus_interface_annotations(alt_interface)
1646
(copy_function(attribute)))
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1647
1214
if deprecate:
1648
1215
# Deprecate all alternate interfaces
1649
1216
iname="_AlternateDBusNames_interface_annotation{}"
1662
1229
if interface_names:
1663
1230
# Replace the class with a new subclass of it with
1664
1231
# methods, signals, etc. as created above.
1665
if sys.version_info.major == 2:
1666
cls = type(b"{}Alternate".format(cls.__name__),
1667
(cls, ), attr)
1668
else:
1669
cls = type("{}Alternate".format(cls.__name__),
1670
(cls, ), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1671
1234
return cls
1672
1235
1673
1236
return wrapper
1793
1356
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1794
1357
Client.__del__(self, *args, **kwargs)
1795
1358
1796
def checker_callback(self, source, condition,
1797
connection, command, *args, **kwargs):
1798
ret = Client.checker_callback(self, source, condition,
1799
connection, command, *args,
1800
**kwargs)
1801
exitstatus = self.last_checker_status
1802
if exitstatus >= 0:
1359
def checker_callback(self, pid, condition, command,
1360
*args, **kwargs):
1361
self.checker_callback_tag = None
1362
self.checker = None
1363
if os.WIFEXITED(condition):
1364
exitstatus = os.WEXITSTATUS(condition)
1803
1365
# Emit D-Bus signal
1804
1366
self.CheckerCompleted(dbus.Int16(exitstatus),
1805
# This is specific to GNU libC
1806
dbus.Int64(exitstatus << 8),
1367
dbus.Int64(condition),
1807
1368
dbus.String(command))
1808
1369
else:
1809
1370
# Emit D-Bus signal
1810
1371
self.CheckerCompleted(dbus.Int16(-1),
1811
dbus.Int64(
1812
# This is specific to GNU libC
1813
(exitstatus << 8)
1814
| self.last_checker_signal),
1372
dbus.Int64(condition),
1815
1373
dbus.String(command))
1816
return ret
1374
1375
return Client.checker_callback(self, pid, condition, command,
1376
*args, **kwargs)
1817
1377
1818
1378
def start_checker(self, *args, **kwargs):
1819
1379
old_checker_pid = getattr(self.checker, "pid", None)
1831
1391
1832
1392
def approve(self, value=True):
1833
1393
self.approved = value
1834
GLib.timeout_add(int(self.approval_duration.total_seconds()
1835
* 1000), self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1836
1396
self.send_changedstate()
1837
1397
1838
1398
## D-Bus methods, signals & properties
1894
1454
self.checked_ok()
1895
1455
1896
1456
# Enable - method
1897
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1898
1457
@dbus.service.method(_interface)
1899
1458
def Enable(self):
1900
1459
"D-Bus method"
1901
1460
self.enable()
1902
1461
1903
1462
# StartChecker - method
1904
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1905
1463
@dbus.service.method(_interface)
1906
1464
def StartChecker(self):
1907
1465
"D-Bus method"
1908
1466
self.start_checker()
1909
1467
1910
1468
# Disable - method
1911
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1912
1469
@dbus.service.method(_interface)
1913
1470
def Disable(self):
1914
1471
"D-Bus method"
1915
1472
self.disable()
1916
1473
1917
1474
# StopChecker - method
1918
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1919
1475
@dbus.service.method(_interface)
1920
1476
def StopChecker(self):
1921
1477
self.stop_checker()
1957
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1958
1514
1959
1515
# Name - property
1960
@dbus_annotations(
1961
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1962
1516
@dbus_service_property(_interface, signature="s", access="read")
1963
1517
def Name_dbus_property(self):
1964
1518
return dbus.String(self.name)
1965
1519
1966
1520
# Fingerprint - property
1967
@dbus_annotations(
1968
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1969
1521
@dbus_service_property(_interface, signature="s", access="read")
1970
1522
def Fingerprint_dbus_property(self):
1971
1523
return dbus.String(self.fingerprint)
1980
1532
self.host = str(value)
1981
1533
1982
1534
# Created - property
1983
@dbus_annotations(
1984
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1985
1535
@dbus_service_property(_interface, signature="s", access="read")
1986
1536
def Created_dbus_property(self):
1987
1537
return datetime_to_dbus(self.created)
2048
1598
if (getattr(self, "disable_initiator_tag", None)
2049
1599
is None):
2050
1600
return
2051
GLib.source_remove(self.disable_initiator_tag)
2052
self.disable_initiator_tag = GLib.timeout_add(
1601
gobject.source_remove(self.disable_initiator_tag)
1602
self.disable_initiator_tag = gobject.timeout_add(
2053
1603
int((self.expires - now).total_seconds() * 1000),
2054
1604
self.disable)
2055
1605
2075
1625
return
2076
1626
if self.enabled:
2077
1627
# Reschedule checker run
2078
GLib.source_remove(self.checker_initiator_tag)
2079
self.checker_initiator_tag = GLib.timeout_add(
1628
gobject.source_remove(self.checker_initiator_tag)
1629
self.checker_initiator_tag = gobject.timeout_add(
2080
1630
value, self.start_checker)
2081
1631
self.start_checker() # Start one now, too
2082
1632
2102
1652
self.stop_checker()
2103
1653
2104
1654
# ObjectPath - property
2105
@dbus_annotations(
2106
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2107
"org.freedesktop.DBus.Deprecated": "true"})
2108
1655
@dbus_service_property(_interface, signature="o", access="read")
2109
1656
def ObjectPath_dbus_property(self):
2110
1657
return self.dbus_object_path # is already a dbus.ObjectPath
2111
1658
2112
1659
# Secret = property
2113
@dbus_annotations(
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2115
"invalidates"})
2116
1660
@dbus_service_property(_interface,
2117
1661
signature="ay",
2118
1662
access="write",
2164
1708
logger.debug("Pipe FD: %d",
2165
1709
self.server.child_pipe.fileno())
2166
1710
2167
session = gnutls.ClientSession(self.request)
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1713
1714
# Note: gnutls.connection.X509Credentials is really a
1715
# generic GnuTLS certificate credentials object so long as
1716
# no X.509 keys are added to it. Therefore, we can use it
1717
# here despite using OpenPGP certificates.
2168
1718
2169
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2170
1720
# "+AES-256-CBC", "+SHA1",
2174
1724
priority = self.server.gnutls_priority
2175
1725
if priority is None:
2176
1726
priority = "NORMAL"
2177
gnutls.priority_set_direct(session._c_object, priority,
2178
None)
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
2179
1729
2180
1730
# Start communication using the Mandos protocol
2181
1731
# Get protocol number
2191
1741
# Start GnuTLS connection
2192
1742
try:
2193
1743
session.handshake()
2194
except gnutls.Error as error:
1744
except gnutls.errors.GNUTLSError as error:
2195
1745
logger.warning("Handshake failed: %s", error)
2196
1746
# Do not run session.bye() here: the session is not
2197
1747
# established. Just abandon the request.
2203
1753
try:
2204
1754
fpr = self.fingerprint(
2205
1755
self.peer_certificate(session))
2206
except (TypeError, gnutls.Error) as error:
1756
except (TypeError,
1757
gnutls.errors.GNUTLSError) as error:
2207
1758
logger.warning("Bad certificate: %s", error)
2208
1759
return
2209
1760
logger.debug("Fingerprint: %s", fpr)
2267
1818
else:
2268
1819
delay -= time2 - time
2269
1820
2270
try:
2271
session.send(client.secret)
2272
except gnutls.Error as error:
2273
logger.warning("gnutls send failed",
2274
exc_info = error)
2275
return
1821
sent_size = 0
1822
while sent_size < len(client.secret):
1823
try:
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1827
exc_info=error)
1828
return
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1832
sent_size += sent
2276
1833
2277
1834
logger.info("Sending secret to %s", client.name)
2278
1835
# bump the timeout using extended_timeout
2286
1843
client.approvals_pending -= 1
2287
1844
try:
2288
1845
session.bye()
2289
except gnutls.Error as error:
1846
except gnutls.errors.GNUTLSError as error:
2290
1847
logger.warning("GnuTLS bye failed",
2291
1848
exc_info=error)
2292
1849
2294
1851
def peer_certificate(session):
2295
1852
"Return the peer's OpenPGP certificate as a bytestring"
2296
1853
# If not an OpenPGP certificate...
2297
if (gnutls.certificate_type_get(session._c_object)
2298
!= gnutls.CRT_OPENPGP):
2299
# ...return invalid data
2300
return b""
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2301
1859
list_size = ctypes.c_uint(1)
2302
cert_list = (gnutls.certificate_get_peers
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2303
1862
(session._c_object, ctypes.byref(list_size)))
2304
1863
if not bool(cert_list) and list_size.value != 0:
2305
raise gnutls.Error("error getting peer certificate")
1864
raise gnutls.errors.GNUTLSError("error getting peer"
1865
" certificate")
2306
1866
if list_size.value == 0:
2307
1867
return None
2308
1868
cert = cert_list[0]
2312
1872
def fingerprint(openpgp):
2313
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2314
1874
# New GnuTLS "datum" with the OpenPGP public key
2315
datum = gnutls.datum_t(
1875
datum = gnutls.library.types.gnutls_datum_t(
2316
1876
ctypes.cast(ctypes.c_char_p(openpgp),
2317
1877
ctypes.POINTER(ctypes.c_ubyte)),
2318
1878
ctypes.c_uint(len(openpgp)))
2319
1879
# New empty GnuTLS certificate
2320
crt = gnutls.openpgp_crt_t()
2321
gnutls.openpgp_crt_init(ctypes.byref(crt))
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
2322
1883
# Import the OpenPGP public key into the certificate
2323
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2324
gnutls.OPENPGP_FMT_RAW)
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2325
1887
# Verify the self signature in the key
2326
1888
crtverify = ctypes.c_uint()
2327
gnutls.openpgp_crt_verify_self(crt, 0,
2328
ctypes.byref(crtverify))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2329
1891
if crtverify.value != 0:
2330
gnutls.openpgp_crt_deinit(crt)
2331
raise gnutls.CertificateSecurityError("Verify failed")
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
2332
1895
# New buffer for the fingerprint
2333
1896
buf = ctypes.create_string_buffer(20)
2334
1897
buf_len = ctypes.c_size_t()
2335
1898
# Get the fingerprint from the certificate into the buffer
2336
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2337
ctypes.byref(buf_len))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2338
1901
# Deinit the certificate
2339
gnutls.openpgp_crt_deinit(crt)
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2340
1903
# Convert the buffer to a Python bytestring
2341
1904
fpr = ctypes.string_at(buf, buf_len.value)
2342
1905
# Convert the bytestring to hexadecimal notation
2486
2049
gnutls_priority GnuTLS priority string
2487
2050
use_dbus: Boolean; to emit D-Bus signals or not
2488
2051
2489
Assumes a GLib.MainLoop event loop.
2052
Assumes a gobject.MainLoop event loop.
2490
2053
"""
2491
2054
2492
2055
def __init__(self, server_address, RequestHandlerClass,
2517
2080
2518
2081
def add_pipe(self, parent_pipe, proc):
2519
2082
# Call "handle_ipc" for both data and EOF events
2520
GLib.io_add_watch(
2083
gobject.io_add_watch(
2521
2084
parent_pipe.fileno(),
2522
GLib.IO_IN | GLib.IO_HUP,
2085
gobject.IO_IN | gobject.IO_HUP,
2523
2086
functools.partial(self.handle_ipc,
2524
2087
parent_pipe = parent_pipe,
2525
2088
proc = proc))
2529
2092
proc = None,
2530
2093
client_object=None):
2531
2094
# error, or the other end of multiprocessing.Pipe has closed
2532
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2533
2096
# Wait for other process to exit
2534
2097
proc.join()
2535
2098
return False
2542
2105
fpr = request[1]
2543
2106
address = request[2]
2544
2107
2545
for c in self.clients.values():
2108
for c in self.clients.itervalues():
2546
2109
if c.fingerprint == fpr:
2547
2110
client = c
2548
2111
break
2556
2119
parent_pipe.send(False)
2557
2120
return False
2558
2121
2559
GLib.io_add_watch(
2122
gobject.io_add_watch(
2560
2123
parent_pipe.fileno(),
2561
GLib.IO_IN | GLib.IO_HUP,
2124
gobject.IO_IN | gobject.IO_HUP,
2562
2125
functools.partial(self.handle_ipc,
2563
2126
parent_pipe = parent_pipe,
2564
2127
proc = proc,
2578
2141
2579
2142
if command == 'getattr':
2580
2143
attrname = request[1]
2581
if isinstance(client_object.__getattribute__(attrname),
2582
collections.Callable):
2144
if callable(client_object.__getattribute__(attrname)):
2583
2145
parent_pipe.send(('function', ))
2584
2146
else:
2585
2147
parent_pipe.send((
2620
2182
# avoid excessive use of external libraries.
2621
2183
2622
2184
# New type for defining tokens, syntax, and semantics all-in-one
2185
Token = collections.namedtuple("Token",
2186
("regexp", # To match token; if
2187
# "value" is not None,
2188
# must have a "group"
2189
# containing digits
2190
"value", # datetime.timedelta or
2191
# None
2192
"followers")) # Tokens valid after
2193
# this token
2623
2194
Token = collections.namedtuple("Token", (
2624
2195
"regexp", # To match token; if "value" is not None, must have
2625
2196
# a "group" containing digits
2660
2231
# Define starting values
2661
2232
value = datetime.timedelta() # Value so far
2662
2233
found_token = None
2663
followers = frozenset((token_duration, )) # Following valid tokens
2234
followers = frozenset((token_duration,)) # Following valid tokens
2664
2235
s = duration # String left to parse
2665
2236
# Loop until end token is found
2666
2237
while found_token is not token_end:
2823
2394
"debug": "False",
2824
2395
"priority":
2825
2396
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2826
":+SIGN-DSA-SHA256",
2397
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2827
2398
"servicename": "Mandos",
2828
2399
"use_dbus": "True",
2829
2400
"use_ipv6": "True",
2946
2517
logger.error("Could not open file %r", pidfilename,
2947
2518
exc_info=e)
2948
2519
2949
for name, group in (("_mandos", "_mandos"),
2950
("mandos", "mandos"),
2951
("nobody", "nogroup")):
2520
for name in ("_mandos", "mandos", "nobody"):
2952
2521
try:
2953
2522
uid = pwd.getpwnam(name).pw_uid
2954
gid = pwd.getpwnam(group).pw_gid
2523
gid = pwd.getpwnam(name).pw_gid
2955
2524
break
2956
2525
except KeyError:
2957
2526
continue
2961
2530
try:
2962
2531
os.setgid(gid)
2963
2532
os.setuid(uid)
2964
if debug:
2965
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2966
gid))
2967
2533
except OSError as error:
2968
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2969
.format(uid, gid, os.strerror(error.errno)))
2970
2534
if error.errno != errno.EPERM:
2971
2535
raise
2972
2536
2975
2539
2976
2540
# "Use a log level over 10 to enable all debugging options."
2977
2541
# - GnuTLS manual
2978
gnutls.global_set_log_level(11)
2542
gnutls.library.functions.gnutls_global_set_log_level(11)
2979
2543
2980
@gnutls.log_func
2544
@gnutls.library.types.gnutls_log_func
2981
2545
def debug_gnutls(level, string):
2982
2546
logger.debug("GnuTLS: %s", string[:-1])
2983
2547
2984
gnutls.global_set_log_function(debug_gnutls)
2548
gnutls.library.functions.gnutls_global_set_log_function(
2549
debug_gnutls)
2985
2550
2986
2551
# Redirect stdin so all checkers get /dev/null
2987
2552
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2994
2559
# Close all input and output, do double fork, etc.
2995
2560
daemon()
2996
2561
2997
# multiprocessing will use threads, so before we use GLib we need
2998
# to inform GLib that threads will be used.
2999
GLib.threads_init()
2562
# multiprocessing will use threads, so before we use gobject we
2563
# need to inform gobject that threads will be used.
2564
gobject.threads_init()
3000
2565
3001
2566
global main_loop
3002
2567
# From the Avahi example code
3003
2568
DBusGMainLoop(set_as_default=True)
3004
main_loop = GLib.MainLoop()
2569
main_loop = gobject.MainLoop()
3005
2570
bus = dbus.SystemBus()
3006
2571
# End of Avahi example code
3007
2572
if use_dbus:
3051
2616
if server_settings["restore"]:
3052
2617
try:
3053
2618
with open(stored_state_path, "rb") as stored_state:
3054
if sys.version_info.major == 2:
3055
clients_data, old_client_settings = pickle.load(
3056
stored_state)
3057
else:
3058
bytes_clients_data, bytes_old_client_settings = (
3059
pickle.load(stored_state, encoding = "bytes"))
3060
### Fix bytes to strings
3061
## clients_data
3062
# .keys()
3063
clients_data = { (key.decode("utf-8")
3064
if isinstance(key, bytes)
3065
else key): value
3066
for key, value in
3067
bytes_clients_data.items() }
3068
del bytes_clients_data
3069
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3074
clients_data[key] = value
3075
# .client_structure
3076
value["client_structure"] = [
3077
(s.decode("utf-8")
3078
if isinstance(s, bytes)
3079
else s) for s in
3080
value["client_structure"] ]
3081
# .name & .host
3082
for k in ("name", "host"):
3083
if isinstance(value[k], bytes):
3084
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys()
3087
old_client_settings = {
3088
(key.decode("utf-8")
3089
if isinstance(key, bytes)
3090
else key): value
3091
for key, value in
3092
bytes_old_client_settings.items() }
3093
del bytes_old_client_settings
3094
# .host
3095
for value in old_client_settings.values():
3096
if isinstance(value["host"], bytes):
3097
value["host"] = (value["host"]
3098
.decode("utf-8"))
2619
clients_data, old_client_settings = pickle.load(
2620
stored_state)
3099
2621
os.remove(stored_state_path)
3100
2622
except IOError as e:
3101
2623
if e.errno == errno.ENOENT:
3134
2656
pass
3135
2657
3136
2658
# Clients who has passed its expire date can still be
3137
# enabled if its last checker was successful. A Client
2659
# enabled if its last checker was successful. Clients
3138
2660
# whose checker succeeded before we stored its state is
3139
2661
# assumed to have successfully run all checkers during
3140
2662
# downtime.
3202
2724
del pidfile
3203
2725
del pidfilename
3204
2726
3205
for termsig in (signal.SIGHUP, signal.SIGTERM):
3206
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3207
lambda: main_loop.quit() and False)
2727
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2728
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3208
2729
3209
2730
if use_dbus:
3210
2731
3211
2732
@alternate_dbus_interfaces(
3212
2733
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3213
class MandosDBusService(DBusObjectWithObjectManager):
2734
class MandosDBusService(DBusObjectWithProperties):
3214
2735
"""A D-Bus proxy object"""
3215
2736
3216
2737
def __init__(self):
3218
2739
3219
2740
_interface = "se.recompile.Mandos"
3220
2741
2742
@dbus_interface_annotations(_interface)
2743
def _foo(self):
2744
return {
2745
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2746
"false" }
2747
3221
2748
@dbus.service.signal(_interface, signature="o")
3222
2749
def ClientAdded(self, objpath):
3223
2750
"D-Bus signal"
3228
2755
"D-Bus signal"
3229
2756
pass
3230
2757
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3232
"true"})
3233
2758
@dbus.service.signal(_interface, signature="os")
3234
2759
def ClientRemoved(self, objpath, name):
3235
2760
"D-Bus signal"
3236
2761
pass
3237
2762
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3239
"true"})
3240
2763
@dbus.service.method(_interface, out_signature="ao")
3241
2764
def GetAllClients(self):
3242
2765
"D-Bus method"
3243
2766
return dbus.Array(c.dbus_object_path for c in
3244
tcp_server.clients.values())
2767
tcp_server.clients.itervalues())
3245
2768
3246
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3247
"true"})
3248
2769
@dbus.service.method(_interface,
3249
2770
out_signature="a{oa{sv}}")
3250
2771
def GetAllClientsWithProperties(self):
3251
2772
"D-Bus method"
3252
2773
return dbus.Dictionary(
3253
{ c.dbus_object_path: c.GetAll(
3254
"se.recompile.Mandos.Client")
3255
for c in tcp_server.clients.values() },
2774
{ c.dbus_object_path: c.GetAll("")
2775
for c in tcp_server.clients.itervalues() },
3256
2776
signature="oa{sv}")
3257
2777
3258
2778
@dbus.service.method(_interface, in_signature="o")
3259
2779
def RemoveClient(self, object_path):
3260
2780
"D-Bus method"
3261
for c in tcp_server.clients.values():
2781
for c in tcp_server.clients.itervalues():
3262
2782
if c.dbus_object_path == object_path:
3263
2783
del tcp_server.clients[c.name]
3264
2784
c.remove_from_connection()
3265
# Don't signal the disabling
2785
# Don't signal anything except ClientRemoved
3266
2786
c.disable(quiet=True)
3267
# Emit D-Bus signal for removal
3268
self.client_removed_signal(c)
2787
# Emit D-Bus signal
2788
self.ClientRemoved(object_path, c.name)
3269
2789
return
3270
2790
raise KeyError(object_path)
3271
2791
3272
2792
del _interface
3273
3274
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3275
out_signature = "a{oa{sa{sv}}}")
3276
def GetManagedObjects(self):
3277
"""D-Bus method"""
3278
return dbus.Dictionary(
3279
{ client.dbus_object_path:
3280
dbus.Dictionary(
3281
{ interface: client.GetAll(interface)
3282
for interface in
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3285
3286
def client_added_signal(self, client):
3287
"""Send the new standard signal and the old signal"""
3288
if use_dbus:
3289
# New standard signal
3290
self.InterfacesAdded(
3291
client.dbus_object_path,
3292
dbus.Dictionary(
3293
{ interface: client.GetAll(interface)
3294
for interface in
3295
client._get_all_interface_names()}))
3296
# Old signal
3297
self.ClientAdded(client.dbus_object_path)
3298
3299
def client_removed_signal(self, client):
3300
"""Send the new standard signal and the old signal"""
3301
if use_dbus:
3302
# New standard signal
3303
self.InterfacesRemoved(
3304
client.dbus_object_path,
3305
client._get_all_interface_names())
3306
# Old signal
3307
self.ClientRemoved(client.dbus_object_path,
3308
client.name)
3309
2793
3310
2794
mandos_dbus_service = MandosDBusService()
3311
2795
3312
# Save modules to variables to exempt the modules from being
3313
# unloaded before the function registered with atexit() is run.
3314
mp = multiprocessing
3315
wn = wnull
3316
2796
def cleanup():
3317
2797
"Cleanup function; run on exit"
3318
2798
if zeroconf:
3319
2799
service.cleanup()
3320
2800
3321
mp.active_children()
3322
wn.close()
2801
multiprocessing.active_children()
2802
wnull.close()
3323
2803
if not (tcp_server.clients or client_settings):
3324
2804
return
3325
2805
3328
2808
# removed/edited, old secret will thus be unrecovable.
3329
2809
clients = {}
3330
2810
with PGPEngine() as pgp:
3331
for client in tcp_server.clients.values():
2811
for client in tcp_server.clients.itervalues():
3332
2812
key = client_settings[client.name]["secret"]
3333
2813
client.encrypted_secret = pgp.encrypt(client.secret,
3334
2814
key)
3358
2838
prefix='clients-',
3359
2839
dir=os.path.dirname(stored_state_path),
3360
2840
delete=False) as stored_state:
3361
pickle.dump((clients, client_settings), stored_state,
3362
protocol = 2)
2841
pickle.dump((clients, client_settings), stored_state)
3363
2842
tempname = stored_state.name
3364
2843
os.rename(tempname, stored_state_path)
3365
2844
except (IOError, OSError) as e:
3381
2860
name, client = tcp_server.clients.popitem()
3382
2861
if use_dbus:
3383
2862
client.remove_from_connection()
3384
# Don't signal the disabling
2863
# Don't signal anything except ClientRemoved
3385
2864
client.disable(quiet=True)
3386
# Emit D-Bus signal for removal
3387
2865
if use_dbus:
3388
mandos_dbus_service.client_removed_signal(client)
2866
# Emit D-Bus signal
2867
mandos_dbus_service.ClientRemoved(
2868
client.dbus_object_path, client.name)
3389
2869
client_settings.clear()
3390
2870
3391
2871
atexit.register(cleanup)
3392
2872
3393
for client in tcp_server.clients.values():
2873
for client in tcp_server.clients.itervalues():
3394
2874
if use_dbus:
3395
# Emit D-Bus signal for adding
3396
mandos_dbus_service.client_added_signal(client)
2875
# Emit D-Bus signal
2876
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3397
2877
# Need to initiate checking of clients
3398
2878
if client.enabled:
3399
2879
client.init_checker()
3425
2905
sys.exit(1)
3426
2906
# End of Avahi example code
3427
2907
3428
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3429
lambda *args, **kwargs:
3430
(tcp_server.handle_request
3431
(*args[2:], **kwargs) or True))
2908
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2909
lambda *args, **kwargs:
2910
(tcp_server.handle_request
2911
(*args[2:], **kwargs) or True))
3432
2912
3433
2913
logger.debug("Starting main loop")
3434
2914
main_loop.run()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0