To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 752
- compare with another revision
- download diff
- download tarball
- view history from revision 752
- Committer: Teddy Hogeborn
- Date: 2015-05-31 15:56:58 UTC
- Revision ID: teddy@recompile.se-20150531155658-l7znu7zlqr2dmuwd
mandos: Generate better messages in exceptions.
mandos (ProxyClient.__init__): Include fingerprint in KeyError().
(rfc3339_duration_to_delta): Include duration in ValueError().
mandos (ProxyClient.__init__): Include fingerprint in KeyError().
(rfc3339_duration_to_delta): Include duration in ValueError().
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2018 Teddy Hogeborn
15
# Copyright © 2008-2018 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
48
44
import argparse
49
45
import datetime
50
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
51
53
try:
52
54
import ConfigParser as configparser
53
55
except ImportError:
80
82
81
83
import dbus
82
84
import dbus.service
83
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
84
90
from dbus.mainloop.glib import DBusGMainLoop
85
91
import ctypes
86
92
import ctypes.util
87
93
import xml.dom.minidom
88
94
import inspect
89
95
90
# Try to find the value of SO_BINDTODEVICE:
91
96
try:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
94
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
98
except AttributeError:
96
99
try:
97
# This is where SO_BINDTODEVICE was up to and including Python
98
# 2.6, and also 3.2:
99
100
from IN import SO_BINDTODEVICE
100
101
except ImportError:
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
103
try:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
"/dev/stdin"],
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
112
# No value found
113
SO_BINDTODEVICE = None
102
SO_BINDTODEVICE = None
114
103
115
104
if sys.version_info.major == 2:
116
105
str = unicode
117
106
118
version = "1.7.20"
107
version = "1.6.9"
119
108
stored_state_file = "clients.pickle"
120
109
121
110
logger = logging.getLogger()
125
114
if_nametoindex = ctypes.cdll.LoadLibrary(
126
115
ctypes.util.find_library("c")).if_nametoindex
127
116
except (OSError, AttributeError):
128
117
129
118
def if_nametoindex(interface):
130
119
"Get an interface index the hard way, i.e. using fcntl()"
131
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
136
125
return interface_index
137
126
138
127
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
143
func.func_globals,
144
func.func_name,
145
func.func_defaults,
146
func.func_closure)
147
else:
148
return types.FunctionType(func.__code__,
149
func.__globals__,
150
func.__name__,
151
func.__defaults__,
152
func.__closure__)
153
154
155
128
def initlogger(debug, level=logging.WARNING):
156
129
"""init logger and add loglevel"""
157
130
158
131
global syslogger
159
132
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
address="/dev/log"))
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
162
135
syslogger.setFormatter(logging.Formatter
163
136
('Mandos [%(process)d]: %(levelname)s:'
164
137
' %(message)s'))
165
138
logger.addHandler(syslogger)
166
139
167
140
if debug:
168
141
console = logging.StreamHandler()
169
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
181
154
182
155
class PGPEngine(object):
183
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
184
157
185
158
def __init__(self):
186
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
187
self.gpg = "gpg"
188
try:
189
output = subprocess.check_output(["gpgconf"])
190
for line in output.splitlines():
191
name, text, path = line.split(b":")
192
if name == "gpg":
193
self.gpg = path
194
break
195
except OSError as e:
196
if e.errno != errno.ENOENT:
197
raise
198
160
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
161
'--home', self.tempdir,
200
162
'--force-mdc',
201
'--quiet']
202
# Only GPG version 1 has the --no-use-agent option.
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
self.gnupgargs.append("--no-use-agent")
205
163
'--quiet',
164
'--no-use-agent']
165
206
166
def __enter__(self):
207
167
return self
208
168
209
169
def __exit__(self, exc_type, exc_value, traceback):
210
170
self._cleanup()
211
171
return False
212
172
213
173
def __del__(self):
214
174
self._cleanup()
215
175
216
176
def _cleanup(self):
217
177
if self.tempdir is not None:
218
178
# Delete contents of tempdir
219
179
for root, dirs, files in os.walk(self.tempdir,
220
topdown=False):
180
topdown = False):
221
181
for filename in files:
222
182
os.remove(os.path.join(root, filename))
223
183
for dirname in dirs:
225
185
# Remove tempdir
226
186
os.rmdir(self.tempdir)
227
187
self.tempdir = None
228
188
229
189
def password_encode(self, password):
230
190
# Passphrase can not be empty and can not contain newlines or
231
191
# NUL bytes. So we prefix it and hex encode it.
236
196
.replace(b"\n", b"\\n")
237
197
.replace(b"\0", b"\\x00"))
238
198
return encoded
239
199
240
200
def encrypt(self, data, password):
241
201
passphrase = self.password_encode(password)
242
202
with tempfile.NamedTemporaryFile(
243
203
dir=self.tempdir) as passfile:
244
204
passfile.write(passphrase)
245
205
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
247
207
'--passphrase-file',
248
208
passfile.name]
249
209
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
254
214
if proc.returncode != 0:
255
215
raise PGPError(err)
256
216
return ciphertext
257
217
258
218
def decrypt(self, data, password):
259
219
passphrase = self.password_encode(password)
260
220
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
221
dir = self.tempdir) as passfile:
262
222
passfile.write(passphrase)
263
223
passfile.flush()
264
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
265
225
'--passphrase-file',
266
226
passfile.name]
267
227
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
272
232
if proc.returncode != 0:
273
233
raise PGPError(err)
274
234
return decrypted_plaintext
275
235
276
236
277
# Pretend that we have an Avahi module
278
class Avahi(object):
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
289
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
avahi = Avahi()
302
303
304
237
class AvahiError(Exception):
305
238
def __init__(self, value, *args, **kwargs):
306
239
self.value = value
318
251
319
252
class AvahiService(object):
320
253
"""An Avahi (Zeroconf) service.
321
254
322
255
Attributes:
323
256
interface: integer; avahi.IF_UNSPEC or an interface index.
324
257
Used to optionally bind to the specified interface.
336
269
server: D-Bus Server
337
270
bus: dbus.SystemBus()
338
271
"""
339
272
340
273
def __init__(self,
341
interface=avahi.IF_UNSPEC,
342
name=None,
343
servicetype=None,
344
port=None,
345
TXT=None,
346
domain="",
347
host="",
348
max_renames=32768,
349
protocol=avahi.PROTO_UNSPEC,
350
bus=None):
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
351
284
self.interface = interface
352
285
self.name = name
353
286
self.type = servicetype
362
295
self.server = None
363
296
self.bus = bus
364
297
self.entry_group_state_changed_match = None
365
298
366
299
def rename(self, remove=True):
367
300
"""Derived from the Avahi example code"""
368
301
if self.rename_count >= self.max_renames:
388
321
logger.critical("D-Bus Exception", exc_info=error)
389
322
self.cleanup()
390
323
os._exit(1)
391
324
392
325
def remove(self):
393
326
"""Derived from the Avahi example code"""
394
327
if self.entry_group_state_changed_match is not None:
396
329
self.entry_group_state_changed_match = None
397
330
if self.group is not None:
398
331
self.group.Reset()
399
332
400
333
def add(self):
401
334
"""Derived from the Avahi example code"""
402
335
self.remove()
419
352
dbus.UInt16(self.port),
420
353
avahi.string_array_to_txt_array(self.TXT))
421
354
self.group.Commit()
422
355
423
356
def entry_group_state_changed(self, state, error):
424
357
"""Derived from the Avahi example code"""
425
358
logger.debug("Avahi entry group state change: %i", state)
426
359
427
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
428
361
logger.debug("Zeroconf service established.")
429
362
elif state == avahi.ENTRY_GROUP_COLLISION:
433
366
logger.critical("Avahi: Error in group state changed %s",
434
367
str(error))
435
368
raise AvahiGroupError("State changed: {!s}".format(error))
436
369
437
370
def cleanup(self):
438
371
"""Derived from the Avahi example code"""
439
372
if self.group is not None:
444
377
pass
445
378
self.group = None
446
379
self.remove()
447
380
448
381
def server_state_changed(self, state, error=None):
449
382
"""Derived from the Avahi example code"""
450
383
logger.debug("Avahi server state change: %i", state)
462
395
logger.error(bad_states[state] + ": %r", error)
463
396
self.cleanup()
464
397
elif state == avahi.SERVER_RUNNING:
465
try:
466
self.add()
467
except dbus.exceptions.DBusException as error:
468
if (error.get_dbus_name()
469
== "org.freedesktop.Avahi.CollisionError"):
470
logger.info("Local Zeroconf service name"
471
" collision.")
472
return self.rename(remove=False)
473
else:
474
logger.critical("D-Bus Exception", exc_info=error)
475
self.cleanup()
476
os._exit(1)
398
self.add()
477
399
else:
478
400
if error is None:
479
401
logger.debug("Unknown state: %r", state)
480
402
else:
481
403
logger.debug("Unknown state: %r: %r", state, error)
482
404
483
405
def activate(self):
484
406
"""Derived from the Avahi example code"""
485
407
if self.server is None:
496
418
class AvahiServiceToSyslog(AvahiService):
497
419
def rename(self, *args, **kwargs):
498
420
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
421
ret = AvahiService.rename(self, *args, **kwargs)
500
422
syslogger.setFormatter(logging.Formatter(
501
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
502
424
.format(self.name)))
503
425
return ret
504
426
505
427
506
# Pretend that we have a GnuTLS module
507
class GnuTLS(object):
508
"""This isn't so much a class as it is a module-like namespace.
509
It is instantiated once, and simulates having a GnuTLS module."""
510
511
library = ctypes.util.find_library("gnutls")
512
if library is None:
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
515
del library
516
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
518
519
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
525
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
528
529
# Constants
530
E_SUCCESS = 0
531
E_INTERRUPTED = -52
532
E_AGAIN = -28
533
CRT_OPENPGP = 2
534
CRT_RAWPK = 3
535
CLIENT = 2
536
SHUT_RDWR = 0
537
CRD_CERTIFICATE = 1
538
E_NO_CERTIFICATE_FOUND = -49
539
X509_FMT_DER = 0
540
NO_TICKETS = 1<<10
541
ENABLE_RAWPK = 1<<18
542
CTYPE_PEERS = 3
543
KEYID_USE_SHA256 = 1 # gnutls/x509.h
544
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
545
546
# Types
547
class session_int(ctypes.Structure):
548
_fields_ = []
549
session_t = ctypes.POINTER(session_int)
550
551
class certificate_credentials_st(ctypes.Structure):
552
_fields_ = []
553
certificate_credentials_t = ctypes.POINTER(
554
certificate_credentials_st)
555
certificate_type_t = ctypes.c_int
556
557
class datum_t(ctypes.Structure):
558
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
('size', ctypes.c_uint)]
560
561
class openpgp_crt_int(ctypes.Structure):
562
_fields_ = []
563
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
565
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
566
credentials_type_t = ctypes.c_int
567
transport_ptr_t = ctypes.c_void_p
568
close_request_t = ctypes.c_int
569
570
# Exceptions
571
class Error(Exception):
572
# We need to use the class name "GnuTLS" here, since this
573
# exception might be raised from within GnuTLS.__init__,
574
# which is called before the assignment to the "gnutls"
575
# global variable has happened.
576
def __init__(self, message=None, code=None, args=()):
577
# Default usage is by a message string, but if a return
578
# code is passed, convert it to a string with
579
# gnutls.strerror()
580
self.code = code
581
if message is None and code is not None:
582
message = GnuTLS.strerror(code)
583
return super(GnuTLS.Error, self).__init__(
584
message, *args)
585
586
class CertificateSecurityError(Error):
587
pass
588
589
# Classes
590
class Credentials(object):
591
def __init__(self):
592
self._c_object = gnutls.certificate_credentials_t()
593
gnutls.certificate_allocate_credentials(
594
ctypes.byref(self._c_object))
595
self.type = gnutls.CRD_CERTIFICATE
596
597
def __del__(self):
598
gnutls.certificate_free_credentials(self._c_object)
599
600
class ClientSession(object):
601
def __init__(self, socket, credentials=None):
602
self._c_object = gnutls.session_t()
603
gnutls_flags = gnutls.CLIENT
604
if gnutls.check_version("3.5.6"):
605
gnutls_flags |= gnutls.NO_TICKETS
606
if gnutls.has_rawpk:
607
gnutls_flags |= gnutls.ENABLE_RAWPK
608
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
609
del gnutls_flags
610
gnutls.set_default_priority(self._c_object)
611
gnutls.transport_set_ptr(self._c_object, socket.fileno())
612
gnutls.handshake_set_private_extensions(self._c_object,
613
True)
614
self.socket = socket
615
if credentials is None:
616
credentials = gnutls.Credentials()
617
gnutls.credentials_set(self._c_object, credentials.type,
618
ctypes.cast(credentials._c_object,
619
ctypes.c_void_p))
620
self.credentials = credentials
621
622
def __del__(self):
623
gnutls.deinit(self._c_object)
624
625
def handshake(self):
626
return gnutls.handshake(self._c_object)
627
628
def send(self, data):
629
data = bytes(data)
630
data_len = len(data)
631
while data_len > 0:
632
data_len -= gnutls.record_send(self._c_object,
633
data[-data_len:],
634
data_len)
635
636
def bye(self):
637
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
638
639
# Error handling functions
640
def _error_code(result):
641
"""A function to raise exceptions on errors, suitable
642
for the 'restype' attribute on ctypes functions"""
643
if result >= 0:
644
return result
645
if result == gnutls.E_NO_CERTIFICATE_FOUND:
646
raise gnutls.CertificateSecurityError(code=result)
647
raise gnutls.Error(code=result)
648
649
def _retry_on_error(result, func, arguments):
650
"""A function to retry on some errors, suitable
651
for the 'errcheck' attribute on ctypes functions"""
652
while result < 0:
653
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
654
return _error_code(result)
655
result = func(*arguments)
656
return result
657
658
# Unless otherwise indicated, the function declarations below are
659
# all from the gnutls/gnutls.h C header file.
660
661
# Functions
662
priority_set_direct = _library.gnutls_priority_set_direct
663
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
664
ctypes.POINTER(ctypes.c_char_p)]
665
priority_set_direct.restype = _error_code
666
667
init = _library.gnutls_init
668
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
669
init.restype = _error_code
670
671
set_default_priority = _library.gnutls_set_default_priority
672
set_default_priority.argtypes = [session_t]
673
set_default_priority.restype = _error_code
674
675
record_send = _library.gnutls_record_send
676
record_send.argtypes = [session_t, ctypes.c_void_p,
677
ctypes.c_size_t]
678
record_send.restype = ctypes.c_ssize_t
679
record_send.errcheck = _retry_on_error
680
681
certificate_allocate_credentials = (
682
_library.gnutls_certificate_allocate_credentials)
683
certificate_allocate_credentials.argtypes = [
684
ctypes.POINTER(certificate_credentials_t)]
685
certificate_allocate_credentials.restype = _error_code
686
687
certificate_free_credentials = (
688
_library.gnutls_certificate_free_credentials)
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
691
certificate_free_credentials.restype = None
692
693
handshake_set_private_extensions = (
694
_library.gnutls_handshake_set_private_extensions)
695
handshake_set_private_extensions.argtypes = [session_t,
696
ctypes.c_int]
697
handshake_set_private_extensions.restype = None
698
699
credentials_set = _library.gnutls_credentials_set
700
credentials_set.argtypes = [session_t, credentials_type_t,
701
ctypes.c_void_p]
702
credentials_set.restype = _error_code
703
704
strerror = _library.gnutls_strerror
705
strerror.argtypes = [ctypes.c_int]
706
strerror.restype = ctypes.c_char_p
707
708
certificate_type_get = _library.gnutls_certificate_type_get
709
certificate_type_get.argtypes = [session_t]
710
certificate_type_get.restype = _error_code
711
712
certificate_get_peers = _library.gnutls_certificate_get_peers
713
certificate_get_peers.argtypes = [session_t,
714
ctypes.POINTER(ctypes.c_uint)]
715
certificate_get_peers.restype = ctypes.POINTER(datum_t)
716
717
global_set_log_level = _library.gnutls_global_set_log_level
718
global_set_log_level.argtypes = [ctypes.c_int]
719
global_set_log_level.restype = None
720
721
global_set_log_function = _library.gnutls_global_set_log_function
722
global_set_log_function.argtypes = [log_func]
723
global_set_log_function.restype = None
724
725
deinit = _library.gnutls_deinit
726
deinit.argtypes = [session_t]
727
deinit.restype = None
728
729
handshake = _library.gnutls_handshake
730
handshake.argtypes = [session_t]
731
handshake.restype = _error_code
732
handshake.errcheck = _retry_on_error
733
734
transport_set_ptr = _library.gnutls_transport_set_ptr
735
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
736
transport_set_ptr.restype = None
737
738
bye = _library.gnutls_bye
739
bye.argtypes = [session_t, close_request_t]
740
bye.restype = _error_code
741
bye.errcheck = _retry_on_error
742
743
check_version = _library.gnutls_check_version
744
check_version.argtypes = [ctypes.c_char_p]
745
check_version.restype = ctypes.c_char_p
746
747
has_rawpk = bool(check_version(_tls_rawpk_version))
748
749
if has_rawpk:
750
# Types
751
class pubkey_st(ctypes.Structure):
752
_fields = []
753
pubkey_t = ctypes.POINTER(pubkey_st)
754
755
x509_crt_fmt_t = ctypes.c_int
756
757
# All the function declarations below are from gnutls/abstract.h
758
pubkey_init = _library.gnutls_pubkey_init
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
pubkey_init.restype = _error_code
761
762
pubkey_import = _library.gnutls_pubkey_import
763
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
764
x509_crt_fmt_t]
765
pubkey_import.restype = _error_code
766
767
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
ctypes.POINTER(ctypes.c_ubyte),
770
ctypes.POINTER(ctypes.c_size_t)]
771
pubkey_get_key_id.restype = _error_code
772
773
pubkey_deinit = _library.gnutls_pubkey_deinit
774
pubkey_deinit.argtypes = [pubkey_t]
775
pubkey_deinit.restype = None
776
else:
777
# All the function declarations below are from gnutls/openpgp.h
778
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
openpgp_crt_init.restype = _error_code
782
783
openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
openpgp_crt_import.argtypes = [openpgp_crt_t,
785
ctypes.POINTER(datum_t),
786
openpgp_crt_fmt_t]
787
openpgp_crt_import.restype = _error_code
788
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
792
openpgp_crt_verify_self.restype = _error_code
793
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
openpgp_crt_deinit.restype = None
797
798
openpgp_crt_get_fingerprint = (
799
_library.gnutls_openpgp_crt_get_fingerprint)
800
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
801
ctypes.c_void_p,
802
ctypes.POINTER(
803
ctypes.c_size_t)]
804
openpgp_crt_get_fingerprint.restype = _error_code
805
806
if check_version("3.6.4"):
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
certificate_type_get2.restype = _error_code
810
811
# Remove non-public functions
812
del _error_code, _retry_on_error
813
# Create the global "gnutls" object, simulating a module
814
gnutls = GnuTLS()
815
816
817
def call_pipe(connection, # : multiprocessing.Connection
818
func, *args, **kwargs):
819
"""This function is meant to be called by multiprocessing.Process
820
821
This function runs func(*args, **kwargs), and writes the resulting
822
return value on the provided multiprocessing.Connection.
823
"""
824
connection.send(func(*args, **kwargs))
825
connection.close()
826
827
828
428
class Client(object):
829
429
"""A representation of a client host served by this server.
830
430
831
431
Attributes:
832
432
approved: bool(); 'None' if not yet approved/disapproved
833
433
approval_delay: datetime.timedelta(); Time to wait for approval
835
435
checker: subprocess.Popen(); a running checker process used
836
436
to see if the client lives.
837
437
'None' if no process is running.
838
checker_callback_tag: a GLib event source tag, or None
438
checker_callback_tag: a gobject event source tag, or None
839
439
checker_command: string; External command which is run to check
840
440
if client lives. %() expansions are done at
841
441
runtime with vars(self) as dict, so that for
842
442
instance %(name)s can be used in the command.
843
checker_initiator_tag: a GLib event source tag, or None
443
checker_initiator_tag: a gobject event source tag, or None
844
444
created: datetime.datetime(); (UTC) object creation
845
445
client_structure: Object describing what attributes a client has
846
446
and is used for storing the client at exit
847
447
current_checker_command: string; current running checker_command
848
disable_initiator_tag: a GLib event source tag, or None
448
disable_initiator_tag: a gobject event source tag, or None
849
449
enabled: bool()
850
450
fingerprint: string (40 or 32 hexadecimal digits); used to
851
uniquely identify an OpenPGP client
852
key_id: string (64 hexadecimal digits); used to uniquely identify
853
a client using raw public keys
451
uniquely identify the client
854
452
host: string; available for use by the checker command
855
453
interval: datetime.timedelta(); How often to start a new checker
856
454
last_approval_request: datetime.datetime(); (UTC) or None
858
456
last_checker_status: integer between 0 and 255 reflecting exit
859
457
status of last checker. -1 reflects crashed
860
458
checker, -2 means no checker completed yet.
861
last_checker_signal: The signal which killed the last checker, if
862
last_checker_status is -1
863
459
last_enabled: datetime.datetime(); (UTC) or None
864
460
name: string; from the config file, used in log messages and
865
461
D-Bus identifiers
872
468
disabled, or None
873
469
server_settings: The server_settings dict from main()
874
470
"""
875
471
876
472
runtime_expansions = ("approval_delay", "approval_duration",
877
"created", "enabled", "expires", "key_id",
473
"created", "enabled", "expires",
878
474
"fingerprint", "host", "interval",
879
475
"last_approval_request", "last_checked_ok",
880
476
"last_enabled", "name", "timeout")
889
485
"approved_by_default": "True",
890
486
"enabled": "True",
891
487
}
892
488
893
489
@staticmethod
894
490
def config_parser(config):
895
491
"""Construct a new dict of client settings of this form:
902
498
for client_name in config.sections():
903
499
section = dict(config.items(client_name))
904
500
client = settings[client_name] = {}
905
501
906
502
client["host"] = section["host"]
907
503
# Reformat values from string types to Python types
908
504
client["approved_by_default"] = config.getboolean(
909
505
client_name, "approved_by_default")
910
506
client["enabled"] = config.getboolean(client_name,
911
507
"enabled")
912
913
# Uppercase and remove spaces from key_id and fingerprint
914
# for later comparison purposes with return value from the
915
# key_id() and fingerprint() functions
916
client["key_id"] = (section.get("key_id", "").upper()
917
.replace(" ", ""))
508
509
# Uppercase and remove spaces from fingerprint for later
510
# comparison purposes with return value from the
511
# fingerprint() function
918
512
client["fingerprint"] = (section["fingerprint"].upper()
919
513
.replace(" ", ""))
920
514
if "secret" in section:
921
client["secret"] = codecs.decode(section["secret"]
922
.encode("utf-8"),
923
"base64")
515
client["secret"] = section["secret"].decode("base64")
924
516
elif "secfile" in section:
925
517
with open(os.path.expanduser(os.path.expandvars
926
518
(section["secfile"])),
941
533
client["last_approval_request"] = None
942
534
client["last_checked_ok"] = None
943
535
client["last_checker_status"] = -2
944
536
945
537
return settings
946
947
def __init__(self, settings, name=None, server_settings=None):
538
539
def __init__(self, settings, name = None, server_settings=None):
948
540
self.name = name
949
541
if server_settings is None:
950
542
server_settings = {}
952
544
# adding all client settings
953
545
for setting, value in settings.items():
954
546
setattr(self, setting, value)
955
547
956
548
if self.enabled:
957
549
if not hasattr(self, "last_enabled"):
958
550
self.last_enabled = datetime.datetime.utcnow()
962
554
else:
963
555
self.last_enabled = None
964
556
self.expires = None
965
557
966
558
logger.debug("Creating client %r", self.name)
967
logger.debug(" Key ID: %s", self.key_id)
968
559
logger.debug(" Fingerprint: %s", self.fingerprint)
969
560
self.created = settings.get("created",
970
561
datetime.datetime.utcnow())
971
562
972
563
# attributes specific for this server instance
973
564
self.checker = None
974
565
self.checker_initiator_tag = None
980
571
self.changedstate = multiprocessing_manager.Condition(
981
572
multiprocessing_manager.Lock())
982
573
self.client_structure = [attr
983
for attr in self.__dict__.keys()
574
for attr in self.__dict__.iterkeys()
984
575
if not attr.startswith("_")]
985
576
self.client_structure.append("client_structure")
986
577
987
578
for name, t in inspect.getmembers(
988
579
type(self), lambda obj: isinstance(obj, property)):
989
580
if not name.startswith("_"):
990
581
self.client_structure.append(name)
991
582
992
583
# Send notice to process children that client state has changed
993
584
def send_changedstate(self):
994
585
with self.changedstate:
995
586
self.changedstate.notify_all()
996
587
997
588
def enable(self):
998
589
"""Start this client's checker and timeout hooks"""
999
590
if getattr(self, "enabled", False):
1004
595
self.last_enabled = datetime.datetime.utcnow()
1005
596
self.init_checker()
1006
597
self.send_changedstate()
1007
598
1008
599
def disable(self, quiet=True):
1009
600
"""Disable this client."""
1010
601
if not getattr(self, "enabled", False):
1012
603
if not quiet:
1013
604
logger.info("Disabling client %s", self.name)
1014
605
if getattr(self, "disable_initiator_tag", None) is not None:
1015
GLib.source_remove(self.disable_initiator_tag)
606
gobject.source_remove(self.disable_initiator_tag)
1016
607
self.disable_initiator_tag = None
1017
608
self.expires = None
1018
609
if getattr(self, "checker_initiator_tag", None) is not None:
1019
GLib.source_remove(self.checker_initiator_tag)
610
gobject.source_remove(self.checker_initiator_tag)
1020
611
self.checker_initiator_tag = None
1021
612
self.stop_checker()
1022
613
self.enabled = False
1023
614
if not quiet:
1024
615
self.send_changedstate()
1025
# Do not run this again if called by a GLib.timeout_add
616
# Do not run this again if called by a gobject.timeout_add
1026
617
return False
1027
618
1028
619
def __del__(self):
1029
620
self.disable()
1030
621
1031
622
def init_checker(self):
1032
623
# Schedule a new checker to be started an 'interval' from now,
1033
624
# and every interval from then on.
1034
625
if self.checker_initiator_tag is not None:
1035
GLib.source_remove(self.checker_initiator_tag)
1036
self.checker_initiator_tag = GLib.timeout_add(
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
1037
628
int(self.interval.total_seconds() * 1000),
1038
629
self.start_checker)
1039
630
# Schedule a disable() when 'timeout' has passed
1040
631
if self.disable_initiator_tag is not None:
1041
GLib.source_remove(self.disable_initiator_tag)
1042
self.disable_initiator_tag = GLib.timeout_add(
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
1043
634
int(self.timeout.total_seconds() * 1000), self.disable)
1044
635
# Also start a new checker *right now*.
1045
636
self.start_checker()
1046
1047
def checker_callback(self, source, condition, connection,
1048
command):
637
638
def checker_callback(self, pid, condition, command):
1049
639
"""The checker has completed, so take appropriate actions."""
1050
640
self.checker_callback_tag = None
1051
641
self.checker = None
1052
# Read return code from connection (see call_pipe)
1053
returncode = connection.recv()
1054
connection.close()
1055
1056
if returncode >= 0:
1057
self.last_checker_status = returncode
1058
self.last_checker_signal = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
1059
644
if self.last_checker_status == 0:
1060
645
logger.info("Checker for %(name)s succeeded",
1061
646
vars(self))
1064
649
logger.info("Checker for %(name)s failed", vars(self))
1065
650
else:
1066
651
self.last_checker_status = -1
1067
self.last_checker_signal = -returncode
1068
652
logger.warning("Checker for %(name)s crashed?",
1069
653
vars(self))
1070
return False
1071
654
1072
655
def checked_ok(self):
1073
656
"""Assert that the client has been seen, alive and well."""
1074
657
self.last_checked_ok = datetime.datetime.utcnow()
1075
658
self.last_checker_status = 0
1076
self.last_checker_signal = None
1077
659
self.bump_timeout()
1078
660
1079
661
def bump_timeout(self, timeout=None):
1080
662
"""Bump up the timeout for this client."""
1081
663
if timeout is None:
1082
664
timeout = self.timeout
1083
665
if self.disable_initiator_tag is not None:
1084
GLib.source_remove(self.disable_initiator_tag)
666
gobject.source_remove(self.disable_initiator_tag)
1085
667
self.disable_initiator_tag = None
1086
668
if getattr(self, "enabled", False):
1087
self.disable_initiator_tag = GLib.timeout_add(
669
self.disable_initiator_tag = gobject.timeout_add(
1088
670
int(timeout.total_seconds() * 1000), self.disable)
1089
671
self.expires = datetime.datetime.utcnow() + timeout
1090
672
1091
673
def need_approval(self):
1092
674
self.last_approval_request = datetime.datetime.utcnow()
1093
675
1094
676
def start_checker(self):
1095
677
"""Start a new checker subprocess if one is not running.
1096
678
1097
679
If a checker already exists, leave it running and do
1098
680
nothing."""
1099
681
# The reason for not killing a running checker is that if we
1104
686
# checkers alone, the checker would have to take more time
1105
687
# than 'timeout' for the client to be disabled, which is as it
1106
688
# should be.
1107
1108
if self.checker is not None and not self.checker.is_alive():
1109
logger.warning("Checker was not alive; joining")
1110
self.checker.join()
1111
self.checker = None
689
690
# If a checker exists, make sure it is not a zombie
691
try:
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
698
else:
699
if pid:
700
logger.warning("Checker was a zombie")
701
gobject.source_remove(self.checker_callback_tag)
702
self.checker_callback(pid, status,
703
self.current_checker_command)
1112
704
# Start a new checker if needed
1113
705
if self.checker is None:
1114
706
# Escape attributes for the shell
1115
707
escaped_attrs = {
1116
708
attr: re.escape(str(getattr(self, attr)))
1117
for attr in self.runtime_expansions}
709
for attr in self.runtime_expansions }
1118
710
try:
1119
711
command = self.checker_command % escaped_attrs
1120
712
except TypeError as error:
1123
715
exc_info=error)
1124
716
return True # Try again later
1125
717
self.current_checker_command = command
1126
logger.info("Starting checker %r for %s", command,
1127
self.name)
1128
# We don't need to redirect stdout and stderr, since
1129
# in normal mode, that is already done by daemon(),
1130
# and in debug mode we don't want to. (Stdin is
1131
# always replaced by /dev/null.)
1132
# The exception is when not debugging but nevertheless
1133
# running in the foreground; use the previously
1134
# created wnull.
1135
popen_args = {"close_fds": True,
1136
"shell": True,
1137
"cwd": "/"}
1138
if (not self.server_settings["debug"]
1139
and self.server_settings["foreground"]):
1140
popen_args.update({"stdout": wnull,
1141
"stderr": wnull})
1142
pipe = multiprocessing.Pipe(duplex=False)
1143
self.checker = multiprocessing.Process(
1144
target=call_pipe,
1145
args=(pipe[1], subprocess.call, command),
1146
kwargs=popen_args)
1147
self.checker.start()
1148
self.checker_callback_tag = GLib.io_add_watch(
1149
pipe[0].fileno(), GLib.IO_IN,
1150
self.checker_callback, pipe[0], command)
1151
# Re-run this periodically if run by GLib.timeout_add
718
try:
719
logger.info("Starting checker %r for %s", command,
720
self.name)
721
# We don't need to redirect stdout and stderr, since
722
# in normal mode, that is already done by daemon(),
723
# and in debug mode we don't want to. (Stdin is
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
733
self.checker = subprocess.Popen(command,
734
close_fds=True,
735
shell=True,
736
cwd="/",
737
**popen_args)
738
except OSError as error:
739
logger.error("Failed to start subprocess",
740
exc_info=error)
741
return True
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1152
759
return True
1153
760
1154
761
def stop_checker(self):
1155
762
"""Force the checker process, if any, to stop."""
1156
763
if self.checker_callback_tag:
1157
GLib.source_remove(self.checker_callback_tag)
764
gobject.source_remove(self.checker_callback_tag)
1158
765
self.checker_callback_tag = None
1159
766
if getattr(self, "checker", None) is None:
1160
767
return
1161
768
logger.debug("Stopping checker for %(name)s", vars(self))
1162
self.checker.terminate()
769
try:
770
self.checker.terminate()
771
#time.sleep(0.5)
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
776
raise
1163
777
self.checker = None
1164
778
1165
779
1169
783
byte_arrays=False):
1170
784
"""Decorators for marking methods of a DBusObjectWithProperties to
1171
785
become properties on the D-Bus.
1172
786
1173
787
The decorated method will be called with no arguments by "Get"
1174
788
and with one argument by "Set".
1175
789
1176
790
The parameters, where they are supported, are the same as
1177
791
dbus.service.method, except there is only "signature", since the
1178
792
type from Get() and the type sent to Set() is the same.
1182
796
if byte_arrays and signature != "ay":
1183
797
raise ValueError("Byte arrays not supported for non-'ay'"
1184
798
" signature {!r}".format(signature))
1185
799
1186
800
def decorator(func):
1187
801
func._dbus_is_property = True
1188
802
func._dbus_interface = dbus_interface
1191
805
func._dbus_name = func.__name__
1192
806
if func._dbus_name.endswith("_dbus_property"):
1193
807
func._dbus_name = func._dbus_name[:-14]
1194
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1195
809
return func
1196
810
1197
811
return decorator
1198
812
1199
813
1200
814
def dbus_interface_annotations(dbus_interface):
1201
815
"""Decorator for marking functions returning interface annotations
1202
816
1203
817
Usage:
1204
818
1205
819
@dbus_interface_annotations("org.example.Interface")
1206
820
def _foo(self): # Function name does not matter
1207
821
return {"org.freedesktop.DBus.Deprecated": "true",
1208
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1209
823
"false"}
1210
824
"""
1211
825
1212
826
def decorator(func):
1213
827
func._dbus_is_interface = True
1214
828
func._dbus_interface = dbus_interface
1215
829
func._dbus_name = dbus_interface
1216
830
return func
1217
831
1218
832
return decorator
1219
833
1220
834
1221
835
def dbus_annotations(annotations):
1222
836
"""Decorator to annotate D-Bus methods, signals or properties
1223
837
Usage:
1224
838
1225
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1226
840
"org.freedesktop.DBus.Property."
1227
841
"EmitsChangedSignal": "false"})
1229
843
access="r")
1230
844
def Property_dbus_property(self):
1231
845
return dbus.Boolean(False)
1232
1233
See also the DBusObjectWithAnnotations class.
1234
846
"""
1235
847
1236
848
def decorator(func):
1237
849
func._dbus_annotations = annotations
1238
850
return func
1239
851
1240
852
return decorator
1241
853
1242
854
1258
870
pass
1259
871
1260
872
1261
class DBusObjectWithAnnotations(dbus.service.Object):
1262
"""A D-Bus object with annotations.
1263
1264
Classes inheriting from this can use the dbus_annotations
1265
decorator to add annotations to methods or signals.
873
class DBusObjectWithProperties(dbus.service.Object):
874
"""A D-Bus object with properties.
875
876
Classes inheriting from this can use the dbus_service_property
877
decorator to expose methods as D-Bus properties. It exposes the
878
standard Get(), Set(), and GetAll() methods on the D-Bus.
1266
879
"""
1267
880
1268
881
@staticmethod
1269
882
def _is_dbus_thing(thing):
1270
883
"""Returns a function testing if an attribute is a D-Bus thing
1271
884
1272
885
If called like _is_dbus_thing("method") it returns a function
1273
886
suitable for use as predicate to inspect.getmembers().
1274
887
"""
1275
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1276
889
False)
1277
890
1278
891
def _get_all_dbus_things(self, thing):
1279
892
"""Returns a generator of (name, attribute) pairs
1280
893
"""
1283
896
for cls in self.__class__.__mro__
1284
897
for name, athing in
1285
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1286
1287
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1288
out_signature="s",
1289
path_keyword='object_path',
1290
connection_keyword='connection')
1291
def Introspect(self, object_path, connection):
1292
"""Overloading of standard D-Bus method.
1293
1294
Inserts annotation tags on methods and signals.
1295
"""
1296
xmlstring = dbus.service.Object.Introspect(self, object_path,
1297
connection)
1298
try:
1299
document = xml.dom.minidom.parseString(xmlstring)
1300
1301
for if_tag in document.getElementsByTagName("interface"):
1302
# Add annotation tags
1303
for typ in ("method", "signal"):
1304
for tag in if_tag.getElementsByTagName(typ):
1305
annots = dict()
1306
for name, prop in (self.
1307
_get_all_dbus_things(typ)):
1308
if (name == tag.getAttribute("name")
1309
and prop._dbus_interface
1310
== if_tag.getAttribute("name")):
1311
annots.update(getattr(
1312
prop, "_dbus_annotations", {}))
1313
for name, value in annots.items():
1314
ann_tag = document.createElement(
1315
"annotation")
1316
ann_tag.setAttribute("name", name)
1317
ann_tag.setAttribute("value", value)
1318
tag.appendChild(ann_tag)
1319
# Add interface annotation tags
1320
for annotation, value in dict(
1321
itertools.chain.from_iterable(
1322
annotations().items()
1323
for name, annotations
1324
in self._get_all_dbus_things("interface")
1325
if name == if_tag.getAttribute("name")
1326
)).items():
1327
ann_tag = document.createElement("annotation")
1328
ann_tag.setAttribute("name", annotation)
1329
ann_tag.setAttribute("value", value)
1330
if_tag.appendChild(ann_tag)
1331
# Fix argument name for the Introspect method itself
1332
if (if_tag.getAttribute("name")
1333
== dbus.INTROSPECTABLE_IFACE):
1334
for cn in if_tag.getElementsByTagName("method"):
1335
if cn.getAttribute("name") == "Introspect":
1336
for arg in cn.getElementsByTagName("arg"):
1337
if (arg.getAttribute("direction")
1338
== "out"):
1339
arg.setAttribute("name",
1340
"xml_data")
1341
xmlstring = document.toxml("utf-8")
1342
document.unlink()
1343
except (AttributeError, xml.dom.DOMException,
1344
xml.parsers.expat.ExpatError) as error:
1345
logger.error("Failed to override Introspection method",
1346
exc_info=error)
1347
return xmlstring
1348
1349
1350
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1351
"""A D-Bus object with properties.
1352
1353
Classes inheriting from this can use the dbus_service_property
1354
decorator to expose methods as D-Bus properties. It exposes the
1355
standard Get(), Set(), and GetAll() methods on the D-Bus.
1356
"""
1357
899
1358
900
def _get_dbus_property(self, interface_name, property_name):
1359
901
"""Returns a bound method if one exists which is a D-Bus
1360
902
property with the specified name and interface.
1365
907
if (value._dbus_name == property_name
1366
908
and value._dbus_interface == interface_name):
1367
909
return value.__get__(self)
1368
910
1369
911
# No such property
1370
912
raise DBusPropertyNotFound("{}:{}.{}".format(
1371
913
self.dbus_object_path, interface_name, property_name))
1372
1373
@classmethod
1374
def _get_all_interface_names(cls):
1375
"""Get a sequence of all interfaces supported by an object"""
1376
return (name for name in set(getattr(getattr(x, attr),
1377
"_dbus_interface", None)
1378
for x in (inspect.getmro(cls))
1379
for attr in dir(x))
1380
if name is not None)
1381
914
1382
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
1383
916
in_signature="ss",
1384
917
out_signature="v")
1392
925
if not hasattr(value, "variant_level"):
1393
926
return value
1394
927
return type(value)(value, variant_level=value.variant_level+1)
1395
928
1396
929
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1397
930
def Set(self, interface_name, property_name, value):
1398
931
"""Standard D-Bus property Set() method, see D-Bus standard.
1410
943
value = dbus.ByteArray(b''.join(chr(byte)
1411
944
for byte in value))
1412
945
prop(value)
1413
946
1414
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
1415
948
in_signature="s",
1416
949
out_signature="a{sv}")
1417
950
def GetAll(self, interface_name):
1418
951
"""Standard D-Bus property GetAll() method, see D-Bus
1419
952
standard.
1420
953
1421
954
Note: Will not include properties with access="write".
1422
955
"""
1423
956
properties = {}
1434
967
properties[name] = value
1435
968
continue
1436
969
properties[name] = type(value)(
1437
value, variant_level=value.variant_level + 1)
970
value, variant_level = value.variant_level + 1)
1438
971
return dbus.Dictionary(properties, signature="sv")
1439
972
1440
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1441
974
def PropertiesChanged(self, interface_name, changed_properties,
1442
975
invalidated_properties):
1444
977
standard.
1445
978
"""
1446
979
pass
1447
980
1448
981
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1449
982
out_signature="s",
1450
983
path_keyword='object_path',
1451
984
connection_keyword='connection')
1452
985
def Introspect(self, object_path, connection):
1453
986
"""Overloading of standard D-Bus method.
1454
987
1455
988
Inserts property tags and interface annotation tags.
1456
989
"""
1457
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1458
object_path,
1459
connection)
990
xmlstring = dbus.service.Object.Introspect(self, object_path,
991
connection)
1460
992
try:
1461
993
document = xml.dom.minidom.parseString(xmlstring)
1462
994
1463
995
def make_tag(document, name, prop):
1464
996
e = document.createElement("property")
1465
997
e.setAttribute("name", name)
1466
998
e.setAttribute("type", prop._dbus_signature)
1467
999
e.setAttribute("access", prop._dbus_access)
1468
1000
return e
1469
1001
1470
1002
for if_tag in document.getElementsByTagName("interface"):
1471
1003
# Add property tags
1472
1004
for tag in (make_tag(document, name, prop)
1475
1007
if prop._dbus_interface
1476
1008
== if_tag.getAttribute("name")):
1477
1009
if_tag.appendChild(tag)
1478
# Add annotation tags for properties
1479
for tag in if_tag.getElementsByTagName("property"):
1480
annots = dict()
1481
for name, prop in self._get_all_dbus_things(
1482
"property"):
1483
if (name == tag.getAttribute("name")
1484
and prop._dbus_interface
1485
== if_tag.getAttribute("name")):
1486
annots.update(getattr(
1487
prop, "_dbus_annotations", {}))
1488
for name, value in annots.items():
1489
ann_tag = document.createElement(
1490
"annotation")
1491
ann_tag.setAttribute("name", name)
1492
ann_tag.setAttribute("value", value)
1493
tag.appendChild(ann_tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1013
annots = dict()
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1023
"annotation")
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1034
)).items():
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1494
1039
# Add the names to the return values for the
1495
1040
# "org.freedesktop.DBus.Properties" methods
1496
1041
if (if_tag.getAttribute("name")
1515
1060
return xmlstring
1516
1061
1517
1062
1518
try:
1519
dbus.OBJECT_MANAGER_IFACE
1520
except AttributeError:
1521
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1522
1523
1524
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1525
"""A D-Bus object with an ObjectManager.
1526
1527
Classes inheriting from this exposes the standard
1528
GetManagedObjects call and the InterfacesAdded and
1529
InterfacesRemoved signals on the standard
1530
"org.freedesktop.DBus.ObjectManager" interface.
1531
1532
Note: No signals are sent automatically; they must be sent
1533
manually.
1534
"""
1535
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1536
out_signature="a{oa{sa{sv}}}")
1537
def GetManagedObjects(self):
1538
"""This function must be overridden"""
1539
raise NotImplementedError()
1540
1541
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1542
signature="oa{sa{sv}}")
1543
def InterfacesAdded(self, object_path, interfaces_and_properties):
1544
pass
1545
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1547
def InterfacesRemoved(self, object_path, interfaces):
1548
pass
1549
1550
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1551
out_signature="s",
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1554
def Introspect(self, object_path, connection):
1555
"""Overloading of standard D-Bus method.
1556
1557
Override return argument name of GetManagedObjects to be
1558
"objpath_interfaces_and_properties"
1559
"""
1560
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1561
object_path,
1562
connection)
1563
try:
1564
document = xml.dom.minidom.parseString(xmlstring)
1565
1566
for if_tag in document.getElementsByTagName("interface"):
1567
# Fix argument name for the GetManagedObjects method
1568
if (if_tag.getAttribute("name")
1569
== dbus.OBJECT_MANAGER_IFACE):
1570
for cn in if_tag.getElementsByTagName("method"):
1571
if (cn.getAttribute("name")
1572
== "GetManagedObjects"):
1573
for arg in cn.getElementsByTagName("arg"):
1574
if (arg.getAttribute("direction")
1575
== "out"):
1576
arg.setAttribute(
1577
"name",
1578
"objpath_interfaces"
1579
"_and_properties")
1580
xmlstring = document.toxml("utf-8")
1581
document.unlink()
1582
except (AttributeError, xml.dom.DOMException,
1583
xml.parsers.expat.ExpatError) as error:
1584
logger.error("Failed to override Introspection method",
1585
exc_info=error)
1586
return xmlstring
1587
1588
1589
1063
def datetime_to_dbus(dt, variant_level=0):
1590
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1591
1065
if dt is None:
1592
return dbus.String("", variant_level=variant_level)
1066
return dbus.String("", variant_level = variant_level)
1593
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1594
1068
1595
1069
1598
1072
dbus.service.Object, it will add alternate D-Bus attributes with
1599
1073
interface names according to the "alt_interface_names" mapping.
1600
1074
Usage:
1601
1075
1602
1076
@alternate_dbus_interfaces({"org.example.Interface":
1603
1077
"net.example.AlternateInterface"})
1604
1078
class SampleDBusObject(dbus.service.Object):
1605
1079
@dbus.service.method("org.example.Interface")
1606
1080
def SampleDBusMethod():
1607
1081
pass
1608
1082
1609
1083
The above "SampleDBusMethod" on "SampleDBusObject" will be
1610
1084
reachable via two interfaces: "org.example.Interface" and
1611
1085
"net.example.AlternateInterface", the latter of which will have
1612
1086
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1613
1087
"true", unless "deprecate" is passed with a False value.
1614
1088
1615
1089
This works for methods and signals, and also for D-Bus properties
1616
1090
(from DBusObjectWithProperties) and interfaces (from the
1617
1091
dbus_interface_annotations decorator).
1618
1092
"""
1619
1093
1620
1094
def wrapper(cls):
1621
1095
for orig_interface_name, alt_interface_name in (
1622
1096
alt_interface_names.items()):
1639
1113
if getattr(attribute, "_dbus_is_signal", False):
1640
1114
# Extract the original non-method undecorated
1641
1115
# function by black magic
1642
if sys.version_info.major == 2:
1643
nonmethod_func = (dict(
1644
zip(attribute.func_code.co_freevars,
1645
attribute.__closure__))
1646
["func"].cell_contents)
1647
else:
1648
nonmethod_func = (dict(
1649
zip(attribute.__code__.co_freevars,
1650
attribute.__closure__))
1651
["func"].cell_contents)
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1652
1120
# Create a new, but exactly alike, function
1653
1121
# object, and decorate it to be a new D-Bus signal
1654
1122
# with the alternate D-Bus interface name
1655
new_function = copy_function(nonmethod_func)
1656
1123
new_function = (dbus.service.signal(
1657
alt_interface,
1658
attribute._dbus_signature)(new_function))
1124
alt_interface, attribute._dbus_signature)
1125
(types.FunctionType(
1126
nonmethod_func.func_code,
1127
nonmethod_func.func_globals,
1128
nonmethod_func.func_name,
1129
nonmethod_func.func_defaults,
1130
nonmethod_func.func_closure)))
1659
1131
# Copy annotations, if any
1660
1132
try:
1661
1133
new_function._dbus_annotations = dict(
1662
1134
attribute._dbus_annotations)
1663
1135
except AttributeError:
1664
1136
pass
1665
1666
1137
# Define a creator of a function to call both the
1667
1138
# original and alternate functions, so both the
1668
1139
# original and alternate signals gets sent when
1671
1142
"""This function is a scope container to pass
1672
1143
func1 and func2 to the "call_both" function
1673
1144
outside of its arguments"""
1674
1675
@functools.wraps(func2)
1145
1676
1146
def call_both(*args, **kwargs):
1677
1147
"""This function will emit two D-Bus
1678
1148
signals by calling func1 and func2"""
1679
1149
func1(*args, **kwargs)
1680
1150
func2(*args, **kwargs)
1681
# Make wrapper function look like a D-Bus
1682
# signal
1683
for name, attr in inspect.getmembers(func2):
1684
if name.startswith("_dbus_"):
1685
setattr(call_both, name, attr)
1686
1151
1687
1152
return call_both
1688
1153
# Create the "call_both" function and add it to
1689
1154
# the class
1699
1164
alt_interface,
1700
1165
attribute._dbus_in_signature,
1701
1166
attribute._dbus_out_signature)
1702
(copy_function(attribute)))
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1703
1172
# Copy annotations, if any
1704
1173
try:
1705
1174
attr[attrname]._dbus_annotations = dict(
1717
1186
attribute._dbus_access,
1718
1187
attribute._dbus_get_args_options
1719
1188
["byte_arrays"])
1720
(copy_function(attribute)))
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1721
1195
# Copy annotations, if any
1722
1196
try:
1723
1197
attr[attrname]._dbus_annotations = dict(
1732
1206
# to the class.
1733
1207
attr[attrname] = (
1734
1208
dbus_interface_annotations(alt_interface)
1735
(copy_function(attribute)))
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1736
1214
if deprecate:
1737
1215
# Deprecate all alternate interfaces
1738
iname = "_AlternateDBusNames_interface_annotation{}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1739
1217
for interface_name in interface_names:
1740
1218
1741
1219
@dbus_interface_annotations(interface_name)
1742
1220
def func(self):
1743
return {"org.freedesktop.DBus.Deprecated":
1744
"true"}
1221
return { "org.freedesktop.DBus.Deprecated":
1222
"true" }
1745
1223
# Find an unused name
1746
1224
for aname in (iname.format(i)
1747
1225
for i in itertools.count()):
1751
1229
if interface_names:
1752
1230
# Replace the class with a new subclass of it with
1753
1231
# methods, signals, etc. as created above.
1754
if sys.version_info.major == 2:
1755
cls = type(b"{}Alternate".format(cls.__name__),
1756
(cls, ), attr)
1757
else:
1758
cls = type("{}Alternate".format(cls.__name__),
1759
(cls, ), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1760
1234
return cls
1761
1235
1762
1236
return wrapper
1763
1237
1764
1238
1766
1240
"se.bsnet.fukt.Mandos"})
1767
1241
class ClientDBus(Client, DBusObjectWithProperties):
1768
1242
"""A Client class using D-Bus
1769
1243
1770
1244
Attributes:
1771
1245
dbus_object_path: dbus.ObjectPath
1772
1246
bus: dbus.SystemBus()
1773
1247
"""
1774
1248
1775
1249
runtime_expansions = (Client.runtime_expansions
1776
1250
+ ("dbus_object_path", ))
1777
1251
1778
1252
_interface = "se.recompile.Mandos.Client"
1779
1253
1780
1254
# dbus.service.Object doesn't use super(), so we can't either.
1781
1782
def __init__(self, bus=None, *args, **kwargs):
1255
1256
def __init__(self, bus = None, *args, **kwargs):
1783
1257
self.bus = bus
1784
1258
Client.__init__(self, *args, **kwargs)
1785
1259
# Only now, when this client is initialized, can it show up on
1791
1265
"/clients/" + client_object_name)
1792
1266
DBusObjectWithProperties.__init__(self, self.bus,
1793
1267
self.dbus_object_path)
1794
1268
1795
1269
def notifychangeproperty(transform_func, dbus_name,
1796
1270
type_func=lambda x: x,
1797
1271
variant_level=1,
1799
1273
_interface=_interface):
1800
1274
""" Modify a variable so that it's a property which announces
1801
1275
its changes to DBus.
1802
1276
1803
1277
transform_fun: Function that takes a value and a variant_level
1804
1278
and transforms it to a D-Bus type.
1805
1279
dbus_name: D-Bus name of the variable
1808
1282
variant_level: D-Bus variant level. Default: 1
1809
1283
"""
1810
1284
attrname = "_{}".format(dbus_name)
1811
1285
1812
1286
def setter(self, value):
1813
1287
if hasattr(self, "dbus_object_path"):
1814
1288
if (not hasattr(self, attrname) or
1821
1295
else:
1822
1296
dbus_value = transform_func(
1823
1297
type_func(value),
1824
variant_level=variant_level)
1298
variant_level = variant_level)
1825
1299
self.PropertyChanged(dbus.String(dbus_name),
1826
1300
dbus_value)
1827
1301
self.PropertiesChanged(
1828
1302
_interface,
1829
dbus.Dictionary({dbus.String(dbus_name):
1830
dbus_value}),
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1831
1305
dbus.Array())
1832
1306
setattr(self, attrname, value)
1833
1307
1834
1308
return property(lambda self: getattr(self, attrname), setter)
1835
1309
1836
1310
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1837
1311
approvals_pending = notifychangeproperty(dbus.Boolean,
1838
1312
"ApprovalPending",
1839
type_func=bool)
1313
type_func = bool)
1840
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1841
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1842
1316
"LastEnabled")
1843
1317
checker = notifychangeproperty(
1844
1318
dbus.Boolean, "CheckerRunning",
1845
type_func=lambda checker: checker is not None)
1319
type_func = lambda checker: checker is not None)
1846
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1847
1321
"LastCheckedOK")
1848
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1853
1327
"ApprovedByDefault")
1854
1328
approval_delay = notifychangeproperty(
1855
1329
dbus.UInt64, "ApprovalDelay",
1856
type_func=lambda td: td.total_seconds() * 1000)
1330
type_func = lambda td: td.total_seconds() * 1000)
1857
1331
approval_duration = notifychangeproperty(
1858
1332
dbus.UInt64, "ApprovalDuration",
1859
type_func=lambda td: td.total_seconds() * 1000)
1333
type_func = lambda td: td.total_seconds() * 1000)
1860
1334
host = notifychangeproperty(dbus.String, "Host")
1861
1335
timeout = notifychangeproperty(
1862
1336
dbus.UInt64, "Timeout",
1863
type_func=lambda td: td.total_seconds() * 1000)
1337
type_func = lambda td: td.total_seconds() * 1000)
1864
1338
extended_timeout = notifychangeproperty(
1865
1339
dbus.UInt64, "ExtendedTimeout",
1866
type_func=lambda td: td.total_seconds() * 1000)
1340
type_func = lambda td: td.total_seconds() * 1000)
1867
1341
interval = notifychangeproperty(
1868
1342
dbus.UInt64, "Interval",
1869
type_func=lambda td: td.total_seconds() * 1000)
1343
type_func = lambda td: td.total_seconds() * 1000)
1870
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1871
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1872
1346
invalidate_only=True)
1873
1347
1874
1348
del notifychangeproperty
1875
1349
1876
1350
def __del__(self, *args, **kwargs):
1877
1351
try:
1878
1352
self.remove_from_connection()
1881
1355
if hasattr(DBusObjectWithProperties, "__del__"):
1882
1356
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1883
1357
Client.__del__(self, *args, **kwargs)
1884
1885
def checker_callback(self, source, condition,
1886
connection, command, *args, **kwargs):
1887
ret = Client.checker_callback(self, source, condition,
1888
connection, command, *args,
1889
**kwargs)
1890
exitstatus = self.last_checker_status
1891
if exitstatus >= 0:
1358
1359
def checker_callback(self, pid, condition, command,
1360
*args, **kwargs):
1361
self.checker_callback_tag = None
1362
self.checker = None
1363
if os.WIFEXITED(condition):
1364
exitstatus = os.WEXITSTATUS(condition)
1892
1365
# Emit D-Bus signal
1893
1366
self.CheckerCompleted(dbus.Int16(exitstatus),
1894
# This is specific to GNU libC
1895
dbus.Int64(exitstatus << 8),
1367
dbus.Int64(condition),
1896
1368
dbus.String(command))
1897
1369
else:
1898
1370
# Emit D-Bus signal
1899
1371
self.CheckerCompleted(dbus.Int16(-1),
1900
dbus.Int64(
1901
# This is specific to GNU libC
1902
(exitstatus << 8)
1903
| self.last_checker_signal),
1372
dbus.Int64(condition),
1904
1373
dbus.String(command))
1905
return ret
1906
1374
1375
return Client.checker_callback(self, pid, condition, command,
1376
*args, **kwargs)
1377
1907
1378
def start_checker(self, *args, **kwargs):
1908
1379
old_checker_pid = getattr(self.checker, "pid", None)
1909
1380
r = Client.start_checker(self, *args, **kwargs)
1913
1384
# Emit D-Bus signal
1914
1385
self.CheckerStarted(self.current_checker_command)
1915
1386
return r
1916
1387
1917
1388
def _reset_approved(self):
1918
1389
self.approved = None
1919
1390
return False
1920
1391
1921
1392
def approve(self, value=True):
1922
1393
self.approved = value
1923
GLib.timeout_add(int(self.approval_duration.total_seconds()
1924
* 1000), self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1925
1396
self.send_changedstate()
1926
1927
# D-Bus methods, signals & properties
1928
1929
# Interfaces
1930
1931
# Signals
1932
1397
1398
## D-Bus methods, signals & properties
1399
1400
## Interfaces
1401
1402
## Signals
1403
1933
1404
# CheckerCompleted - signal
1934
1405
@dbus.service.signal(_interface, signature="nxs")
1935
1406
def CheckerCompleted(self, exitcode, waitstatus, command):
1936
1407
"D-Bus signal"
1937
1408
pass
1938
1409
1939
1410
# CheckerStarted - signal
1940
1411
@dbus.service.signal(_interface, signature="s")
1941
1412
def CheckerStarted(self, command):
1942
1413
"D-Bus signal"
1943
1414
pass
1944
1415
1945
1416
# PropertyChanged - signal
1946
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1947
1418
@dbus.service.signal(_interface, signature="sv")
1948
1419
def PropertyChanged(self, property, value):
1949
1420
"D-Bus signal"
1950
1421
pass
1951
1422
1952
1423
# GotSecret - signal
1953
1424
@dbus.service.signal(_interface)
1954
1425
def GotSecret(self):
1957
1428
server to mandos-client
1958
1429
"""
1959
1430
pass
1960
1431
1961
1432
# Rejected - signal
1962
1433
@dbus.service.signal(_interface, signature="s")
1963
1434
def Rejected(self, reason):
1964
1435
"D-Bus signal"
1965
1436
pass
1966
1437
1967
1438
# NeedApproval - signal
1968
1439
@dbus.service.signal(_interface, signature="tb")
1969
1440
def NeedApproval(self, timeout, default):
1970
1441
"D-Bus signal"
1971
1442
return self.need_approval()
1972
1973
# Methods
1974
1443
1444
## Methods
1445
1975
1446
# Approve - method
1976
1447
@dbus.service.method(_interface, in_signature="b")
1977
1448
def Approve(self, value):
1978
1449
self.approve(value)
1979
1450
1980
1451
# CheckedOK - method
1981
1452
@dbus.service.method(_interface)
1982
1453
def CheckedOK(self):
1983
1454
self.checked_ok()
1984
1455
1985
1456
# Enable - method
1986
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1987
1457
@dbus.service.method(_interface)
1988
1458
def Enable(self):
1989
1459
"D-Bus method"
1990
1460
self.enable()
1991
1461
1992
1462
# StartChecker - method
1993
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1994
1463
@dbus.service.method(_interface)
1995
1464
def StartChecker(self):
1996
1465
"D-Bus method"
1997
1466
self.start_checker()
1998
1467
1999
1468
# Disable - method
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2001
1469
@dbus.service.method(_interface)
2002
1470
def Disable(self):
2003
1471
"D-Bus method"
2004
1472
self.disable()
2005
1473
2006
1474
# StopChecker - method
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2008
1475
@dbus.service.method(_interface)
2009
1476
def StopChecker(self):
2010
1477
self.stop_checker()
2011
2012
# Properties
2013
1478
1479
## Properties
1480
2014
1481
# ApprovalPending - property
2015
1482
@dbus_service_property(_interface, signature="b", access="read")
2016
1483
def ApprovalPending_dbus_property(self):
2017
1484
return dbus.Boolean(bool(self.approvals_pending))
2018
1485
2019
1486
# ApprovedByDefault - property
2020
1487
@dbus_service_property(_interface,
2021
1488
signature="b",
2024
1491
if value is None: # get
2025
1492
return dbus.Boolean(self.approved_by_default)
2026
1493
self.approved_by_default = bool(value)
2027
1494
2028
1495
# ApprovalDelay - property
2029
1496
@dbus_service_property(_interface,
2030
1497
signature="t",
2034
1501
return dbus.UInt64(self.approval_delay.total_seconds()
2035
1502
* 1000)
2036
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2037
1504
2038
1505
# ApprovalDuration - property
2039
1506
@dbus_service_property(_interface,
2040
1507
signature="t",
2044
1511
return dbus.UInt64(self.approval_duration.total_seconds()
2045
1512
* 1000)
2046
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2047
1514
2048
1515
# Name - property
2049
@dbus_annotations(
2050
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2051
1516
@dbus_service_property(_interface, signature="s", access="read")
2052
1517
def Name_dbus_property(self):
2053
1518
return dbus.String(self.name)
2054
2055
# KeyID - property
2056
@dbus_annotations(
2057
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2058
@dbus_service_property(_interface, signature="s", access="read")
2059
def KeyID_dbus_property(self):
2060
return dbus.String(self.key_id)
2061
1519
2062
1520
# Fingerprint - property
2063
@dbus_annotations(
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2065
1521
@dbus_service_property(_interface, signature="s", access="read")
2066
1522
def Fingerprint_dbus_property(self):
2067
1523
return dbus.String(self.fingerprint)
2068
1524
2069
1525
# Host - property
2070
1526
@dbus_service_property(_interface,
2071
1527
signature="s",
2074
1530
if value is None: # get
2075
1531
return dbus.String(self.host)
2076
1532
self.host = str(value)
2077
1533
2078
1534
# Created - property
2079
@dbus_annotations(
2080
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2081
1535
@dbus_service_property(_interface, signature="s", access="read")
2082
1536
def Created_dbus_property(self):
2083
1537
return datetime_to_dbus(self.created)
2084
1538
2085
1539
# LastEnabled - property
2086
1540
@dbus_service_property(_interface, signature="s", access="read")
2087
1541
def LastEnabled_dbus_property(self):
2088
1542
return datetime_to_dbus(self.last_enabled)
2089
1543
2090
1544
# Enabled - property
2091
1545
@dbus_service_property(_interface,
2092
1546
signature="b",
2098
1552
self.enable()
2099
1553
else:
2100
1554
self.disable()
2101
1555
2102
1556
# LastCheckedOK - property
2103
1557
@dbus_service_property(_interface,
2104
1558
signature="s",
2108
1562
self.checked_ok()
2109
1563
return
2110
1564
return datetime_to_dbus(self.last_checked_ok)
2111
1565
2112
1566
# LastCheckerStatus - property
2113
1567
@dbus_service_property(_interface, signature="n", access="read")
2114
1568
def LastCheckerStatus_dbus_property(self):
2115
1569
return dbus.Int16(self.last_checker_status)
2116
1570
2117
1571
# Expires - property
2118
1572
@dbus_service_property(_interface, signature="s", access="read")
2119
1573
def Expires_dbus_property(self):
2120
1574
return datetime_to_dbus(self.expires)
2121
1575
2122
1576
# LastApprovalRequest - property
2123
1577
@dbus_service_property(_interface, signature="s", access="read")
2124
1578
def LastApprovalRequest_dbus_property(self):
2125
1579
return datetime_to_dbus(self.last_approval_request)
2126
1580
2127
1581
# Timeout - property
2128
1582
@dbus_service_property(_interface,
2129
1583
signature="t",
2144
1598
if (getattr(self, "disable_initiator_tag", None)
2145
1599
is None):
2146
1600
return
2147
GLib.source_remove(self.disable_initiator_tag)
2148
self.disable_initiator_tag = GLib.timeout_add(
1601
gobject.source_remove(self.disable_initiator_tag)
1602
self.disable_initiator_tag = gobject.timeout_add(
2149
1603
int((self.expires - now).total_seconds() * 1000),
2150
1604
self.disable)
2151
1605
2152
1606
# ExtendedTimeout - property
2153
1607
@dbus_service_property(_interface,
2154
1608
signature="t",
2158
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
2159
1613
* 1000)
2160
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2161
1615
2162
1616
# Interval - property
2163
1617
@dbus_service_property(_interface,
2164
1618
signature="t",
2171
1625
return
2172
1626
if self.enabled:
2173
1627
# Reschedule checker run
2174
GLib.source_remove(self.checker_initiator_tag)
2175
self.checker_initiator_tag = GLib.timeout_add(
1628
gobject.source_remove(self.checker_initiator_tag)
1629
self.checker_initiator_tag = gobject.timeout_add(
2176
1630
value, self.start_checker)
2177
self.start_checker() # Start one now, too
2178
1631
self.start_checker() # Start one now, too
1632
2179
1633
# Checker - property
2180
1634
@dbus_service_property(_interface,
2181
1635
signature="s",
2184
1638
if value is None: # get
2185
1639
return dbus.String(self.checker_command)
2186
1640
self.checker_command = str(value)
2187
1641
2188
1642
# CheckerRunning - property
2189
1643
@dbus_service_property(_interface,
2190
1644
signature="b",
2196
1650
self.start_checker()
2197
1651
else:
2198
1652
self.stop_checker()
2199
1653
2200
1654
# ObjectPath - property
2201
@dbus_annotations(
2202
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2203
"org.freedesktop.DBus.Deprecated": "true"})
2204
1655
@dbus_service_property(_interface, signature="o", access="read")
2205
1656
def ObjectPath_dbus_property(self):
2206
return self.dbus_object_path # is already a dbus.ObjectPath
2207
1657
return self.dbus_object_path # is already a dbus.ObjectPath
1658
2208
1659
# Secret = property
2209
@dbus_annotations(
2210
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2211
"invalidates"})
2212
1660
@dbus_service_property(_interface,
2213
1661
signature="ay",
2214
1662
access="write",
2215
1663
byte_arrays=True)
2216
1664
def Secret_dbus_property(self, value):
2217
1665
self.secret = bytes(value)
2218
1666
2219
1667
del _interface
2220
1668
2221
1669
2222
1670
class ProxyClient(object):
2223
def __init__(self, child_pipe, key_id, fpr, address):
1671
def __init__(self, child_pipe, fpr, address):
2224
1672
self._pipe = child_pipe
2225
self._pipe.send(('init', key_id, fpr, address))
1673
self._pipe.send(('init', fpr, address))
2226
1674
if not self._pipe.recv():
2227
raise KeyError(key_id or fpr)
2228
1675
raise KeyError(fpr)
1676
2229
1677
def __getattribute__(self, name):
2230
1678
if name == '_pipe':
2231
1679
return super(ProxyClient, self).__getattribute__(name)
2234
1682
if data[0] == 'data':
2235
1683
return data[1]
2236
1684
if data[0] == 'function':
2237
1685
2238
1686
def func(*args, **kwargs):
2239
1687
self._pipe.send(('funcall', name, args, kwargs))
2240
1688
return self._pipe.recv()[1]
2241
1689
2242
1690
return func
2243
1691
2244
1692
def __setattr__(self, name, value):
2245
1693
if name == '_pipe':
2246
1694
return super(ProxyClient, self).__setattr__(name, value)
2249
1697
2250
1698
class ClientHandler(socketserver.BaseRequestHandler, object):
2251
1699
"""A class to handle client connections.
2252
1700
2253
1701
Instantiated once for each connection to handle it.
2254
1702
Note: This will run in its own forked process."""
2255
1703
2256
1704
def handle(self):
2257
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
2258
1706
logger.info("TCP connection from: %s",
2259
1707
str(self.client_address))
2260
1708
logger.debug("Pipe FD: %d",
2261
1709
self.server.child_pipe.fileno())
2262
2263
session = gnutls.ClientSession(self.request)
2264
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
# "+AES-256-CBC", "+SHA1",
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
2268
# "+DHE-DSS"))
1710
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1713
1714
# Note: gnutls.connection.X509Credentials is really a
1715
# generic GnuTLS certificate credentials object so long as
1716
# no X.509 keys are added to it. Therefore, we can use it
1717
# here despite using OpenPGP certificates.
1718
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
# "+AES-256-CBC", "+SHA1",
1721
# "+COMP-NULL", "+CTYPE-OPENPGP",
1722
# "+DHE-DSS"))
2269
1723
# Use a fallback default, since this MUST be set.
2270
1724
priority = self.server.gnutls_priority
2271
1725
if priority is None:
2272
1726
priority = "NORMAL"
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
2275
None)
2276
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1729
2277
1730
# Start communication using the Mandos protocol
2278
1731
# Get protocol number
2279
1732
line = self.request.makefile().readline()
2284
1737
except (ValueError, IndexError, RuntimeError) as error:
2285
1738
logger.error("Unknown protocol version: %s", error)
2286
1739
return
2287
1740
2288
1741
# Start GnuTLS connection
2289
1742
try:
2290
1743
session.handshake()
2291
except gnutls.Error as error:
1744
except gnutls.errors.GNUTLSError as error:
2292
1745
logger.warning("Handshake failed: %s", error)
2293
1746
# Do not run session.bye() here: the session is not
2294
1747
# established. Just abandon the request.
2295
1748
return
2296
1749
logger.debug("Handshake succeeded")
2297
1750
2298
1751
approval_required = False
2299
1752
try:
2300
if gnutls.has_rawpk:
2301
fpr = ""
2302
try:
2303
key_id = self.key_id(
2304
self.peer_certificate(session))
2305
except (TypeError, gnutls.Error) as error:
2306
logger.warning("Bad certificate: %s", error)
2307
return
2308
logger.debug("Key ID: %s", key_id)
2309
2310
else:
2311
key_id = ""
2312
try:
2313
fpr = self.fingerprint(
2314
self.peer_certificate(session))
2315
except (TypeError, gnutls.Error) as error:
2316
logger.warning("Bad certificate: %s", error)
2317
return
2318
logger.debug("Fingerprint: %s", fpr)
2319
2320
try:
2321
client = ProxyClient(child_pipe, key_id, fpr,
1753
try:
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1756
except (TypeError,
1757
gnutls.errors.GNUTLSError) as error:
1758
logger.warning("Bad certificate: %s", error)
1759
return
1760
logger.debug("Fingerprint: %s", fpr)
1761
1762
try:
1763
client = ProxyClient(child_pipe, fpr,
2322
1764
self.client_address)
2323
1765
except KeyError:
2324
1766
return
2325
1767
2326
1768
if client.approval_delay:
2327
1769
delay = client.approval_delay
2328
1770
client.approvals_pending += 1
2329
1771
approval_required = True
2330
1772
2331
1773
while True:
2332
1774
if not client.enabled:
2333
1775
logger.info("Client %s is disabled",
2336
1778
# Emit D-Bus signal
2337
1779
client.Rejected("Disabled")
2338
1780
return
2339
1781
2340
1782
if client.approved or not client.approval_delay:
2341
# We are approved or approval is disabled
1783
#We are approved or approval is disabled
2342
1784
break
2343
1785
elif client.approved is None:
2344
1786
logger.info("Client %s needs approval",
2355
1797
# Emit D-Bus signal
2356
1798
client.Rejected("Denied")
2357
1799
return
2358
2359
# wait until timeout or approved
1800
1801
#wait until timeout or approved
2360
1802
time = datetime.datetime.now()
2361
1803
client.changedstate.acquire()
2362
1804
client.changedstate.wait(delay.total_seconds())
2375
1817
break
2376
1818
else:
2377
1819
delay -= time2 - time
2378
2379
try:
2380
session.send(client.secret)
2381
except gnutls.Error as error:
2382
logger.warning("gnutls send failed",
2383
exc_info=error)
2384
return
2385
1820
1821
sent_size = 0
1822
while sent_size < len(client.secret):
1823
try:
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1827
exc_info=error)
1828
return
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1832
sent_size += sent
1833
2386
1834
logger.info("Sending secret to %s", client.name)
2387
1835
# bump the timeout using extended_timeout
2388
1836
client.bump_timeout(client.extended_timeout)
2389
1837
if self.server.use_dbus:
2390
1838
# Emit D-Bus signal
2391
1839
client.GotSecret()
2392
1840
2393
1841
finally:
2394
1842
if approval_required:
2395
1843
client.approvals_pending -= 1
2396
1844
try:
2397
1845
session.bye()
2398
except gnutls.Error as error:
1846
except gnutls.errors.GNUTLSError as error:
2399
1847
logger.warning("GnuTLS bye failed",
2400
1848
exc_info=error)
2401
1849
2402
1850
@staticmethod
2403
1851
def peer_certificate(session):
2404
"Return the peer's certificate as a bytestring"
2405
try:
2406
cert_type = gnutls.certificate_type_get2(session._c_object,
2407
gnutls.CTYPE_PEERS)
2408
except AttributeError:
2409
cert_type = gnutls.certificate_type_get(session._c_object)
2410
if gnutls.has_rawpk:
2411
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2412
else:
2413
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2414
# If not a valid certificate type...
2415
if cert_type not in valid_cert_types:
2416
logger.info("Cert type %r not in %r", cert_type,
2417
valid_cert_types)
2418
# ...return invalid data
2419
return b""
1852
"Return the peer's OpenPGP certificate as a bytestring"
1853
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2420
1859
list_size = ctypes.c_uint(1)
2421
cert_list = (gnutls.certificate_get_peers
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2422
1862
(session._c_object, ctypes.byref(list_size)))
2423
1863
if not bool(cert_list) and list_size.value != 0:
2424
raise gnutls.Error("error getting peer certificate")
1864
raise gnutls.errors.GNUTLSError("error getting peer"
1865
" certificate")
2425
1866
if list_size.value == 0:
2426
1867
return None
2427
1868
cert = cert_list[0]
2428
1869
return ctypes.string_at(cert.data, cert.size)
2429
2430
@staticmethod
2431
def key_id(certificate):
2432
"Convert a certificate bytestring to a hexdigit key ID"
2433
# New GnuTLS "datum" with the public key
2434
datum = gnutls.datum_t(
2435
ctypes.cast(ctypes.c_char_p(certificate),
2436
ctypes.POINTER(ctypes.c_ubyte)),
2437
ctypes.c_uint(len(certificate)))
2438
# XXX all these need to be created in the gnutls "module"
2439
# New empty GnuTLS certificate
2440
pubkey = gnutls.pubkey_t()
2441
gnutls.pubkey_init(ctypes.byref(pubkey))
2442
# Import the raw public key into the certificate
2443
gnutls.pubkey_import(pubkey,
2444
ctypes.byref(datum),
2445
gnutls.X509_FMT_DER)
2446
# New buffer for the key ID
2447
buf = ctypes.create_string_buffer(32)
2448
buf_len = ctypes.c_size_t(len(buf))
2449
# Get the key ID from the raw public key into the buffer
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2455
# Deinit the certificate
2456
gnutls.pubkey_deinit(pubkey)
2457
2458
# Convert the buffer to a Python bytestring
2459
key_id = ctypes.string_at(buf, buf_len.value)
2460
# Convert the bytestring to hexadecimal notation
2461
hex_key_id = binascii.hexlify(key_id).upper()
2462
return hex_key_id
2463
1870
2464
1871
@staticmethod
2465
1872
def fingerprint(openpgp):
2466
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2467
1874
# New GnuTLS "datum" with the OpenPGP public key
2468
datum = gnutls.datum_t(
1875
datum = gnutls.library.types.gnutls_datum_t(
2469
1876
ctypes.cast(ctypes.c_char_p(openpgp),
2470
1877
ctypes.POINTER(ctypes.c_ubyte)),
2471
1878
ctypes.c_uint(len(openpgp)))
2472
1879
# New empty GnuTLS certificate
2473
crt = gnutls.openpgp_crt_t()
2474
gnutls.openpgp_crt_init(ctypes.byref(crt))
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
2475
1883
# Import the OpenPGP public key into the certificate
2476
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2477
gnutls.OPENPGP_FMT_RAW)
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2478
1887
# Verify the self signature in the key
2479
1888
crtverify = ctypes.c_uint()
2480
gnutls.openpgp_crt_verify_self(crt, 0,
2481
ctypes.byref(crtverify))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2482
1891
if crtverify.value != 0:
2483
gnutls.openpgp_crt_deinit(crt)
2484
raise gnutls.CertificateSecurityError(code
2485
=crtverify.value)
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
2486
1895
# New buffer for the fingerprint
2487
1896
buf = ctypes.create_string_buffer(20)
2488
1897
buf_len = ctypes.c_size_t()
2489
1898
# Get the fingerprint from the certificate into the buffer
2490
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2491
ctypes.byref(buf_len))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2492
1901
# Deinit the certificate
2493
gnutls.openpgp_crt_deinit(crt)
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2494
1903
# Convert the buffer to a Python bytestring
2495
1904
fpr = ctypes.string_at(buf, buf_len.value)
2496
1905
# Convert the bytestring to hexadecimal notation
2500
1909
2501
1910
class MultiprocessingMixIn(object):
2502
1911
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2503
1912
2504
1913
def sub_process_main(self, request, address):
2505
1914
try:
2506
1915
self.finish_request(request, address)
2507
1916
except Exception:
2508
1917
self.handle_error(request, address)
2509
1918
self.close_request(request)
2510
1919
2511
1920
def process_request(self, request, address):
2512
1921
"""Start a new process to process the request."""
2513
proc = multiprocessing.Process(target=self.sub_process_main,
2514
args=(request, address))
1922
proc = multiprocessing.Process(target = self.sub_process_main,
1923
args = (request, address))
2515
1924
proc.start()
2516
1925
return proc
2517
1926
2518
1927
2519
1928
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2520
1929
""" adds a pipe to the MixIn """
2521
1930
2522
1931
def process_request(self, request, client_address):
2523
1932
"""Overrides and wraps the original process_request().
2524
1933
2525
1934
This function creates a new pipe in self.pipe
2526
1935
"""
2527
1936
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2528
1937
2529
1938
proc = MultiprocessingMixIn.process_request(self, request,
2530
1939
client_address)
2531
1940
self.child_pipe.close()
2532
1941
self.add_pipe(parent_pipe, proc)
2533
1942
2534
1943
def add_pipe(self, parent_pipe, proc):
2535
1944
"""Dummy function; override as necessary"""
2536
1945
raise NotImplementedError()
2539
1948
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2540
1949
socketserver.TCPServer, object):
2541
1950
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2542
1951
2543
1952
Attributes:
2544
1953
enabled: Boolean; whether this server is activated yet
2545
1954
interface: None or a network interface name (string)
2546
1955
use_ipv6: Boolean; to use IPv6 or not
2547
1956
"""
2548
1957
2549
1958
def __init__(self, server_address, RequestHandlerClass,
2550
1959
interface=None,
2551
1960
use_ipv6=True,
2561
1970
self.socketfd = socketfd
2562
1971
# Save the original socket.socket() function
2563
1972
self.socket_socket = socket.socket
2564
2565
1973
# To implement --socket, we monkey patch socket.socket.
2566
#
1974
#
2567
1975
# (When socketserver.TCPServer is a new-style class, we
2568
1976
# could make self.socket into a property instead of monkey
2569
1977
# patching socket.socket.)
2570
#
1978
#
2571
1979
# Create a one-time-only replacement for socket.socket()
2572
1980
@functools.wraps(socket.socket)
2573
1981
def socket_wrapper(*args, **kwargs):
2585
1993
# socket_wrapper(), if socketfd was set.
2586
1994
socketserver.TCPServer.__init__(self, server_address,
2587
1995
RequestHandlerClass)
2588
1996
2589
1997
def server_bind(self):
2590
1998
"""This overrides the normal server_bind() function
2591
1999
to bind to an interface if one was specified, and also NOT to
2592
2000
bind to an address or port if they were not specified."""
2593
global SO_BINDTODEVICE
2594
2001
if self.interface is not None:
2595
2002
if SO_BINDTODEVICE is None:
2596
# Fall back to a hard-coded value which seems to be
2597
# common enough.
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
SO_BINDTODEVICE = 25
2600
try:
2601
self.socket.setsockopt(
2602
socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
(self.interface + "\0").encode("utf-8"))
2604
except socket.error as error:
2605
if error.errno == errno.EPERM:
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2608
elif error.errno == errno.ENOPROTOOPT:
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2611
self.interface)
2612
elif error.errno == errno.ENODEV:
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
2615
else:
2616
raise
2003
logger.error("SO_BINDTODEVICE does not exist;"
2004
" cannot bind to interface %s",
2005
self.interface)
2006
else:
2007
try:
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
2011
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
2016
logger.error("SO_BINDTODEVICE not available;"
2017
" cannot bind to interface %s",
2018
self.interface)
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2022
else:
2023
raise
2617
2024
# Only bind(2) the socket if we really need to.
2618
2025
if self.server_address[0] or self.server_address[1]:
2619
2026
if not self.server_address[0]:
2620
2027
if self.address_family == socket.AF_INET6:
2621
any_address = "::" # in6addr_any
2028
any_address = "::" # in6addr_any
2622
2029
else:
2623
any_address = "0.0.0.0" # INADDR_ANY
2030
any_address = "0.0.0.0" # INADDR_ANY
2624
2031
self.server_address = (any_address,
2625
2032
self.server_address[1])
2626
2033
elif not self.server_address[1]:
2636
2043
2637
2044
class MandosServer(IPv6_TCPServer):
2638
2045
"""Mandos server.
2639
2046
2640
2047
Attributes:
2641
2048
clients: set of Client objects
2642
2049
gnutls_priority GnuTLS priority string
2643
2050
use_dbus: Boolean; to emit D-Bus signals or not
2644
2645
Assumes a GLib.MainLoop event loop.
2051
2052
Assumes a gobject.MainLoop event loop.
2646
2053
"""
2647
2054
2648
2055
def __init__(self, server_address, RequestHandlerClass,
2649
2056
interface=None,
2650
2057
use_ipv6=True,
2660
2067
self.gnutls_priority = gnutls_priority
2661
2068
IPv6_TCPServer.__init__(self, server_address,
2662
2069
RequestHandlerClass,
2663
interface=interface,
2664
use_ipv6=use_ipv6,
2665
socketfd=socketfd)
2666
2070
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2073
2667
2074
def server_activate(self):
2668
2075
if self.enabled:
2669
2076
return socketserver.TCPServer.server_activate(self)
2670
2077
2671
2078
def enable(self):
2672
2079
self.enabled = True
2673
2080
2674
2081
def add_pipe(self, parent_pipe, proc):
2675
2082
# Call "handle_ipc" for both data and EOF events
2676
GLib.io_add_watch(
2083
gobject.io_add_watch(
2677
2084
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2085
gobject.IO_IN | gobject.IO_HUP,
2679
2086
functools.partial(self.handle_ipc,
2680
parent_pipe=parent_pipe,
2681
proc=proc))
2682
2087
parent_pipe = parent_pipe,
2088
proc = proc))
2089
2683
2090
def handle_ipc(self, source, condition,
2684
2091
parent_pipe=None,
2685
proc=None,
2092
proc = None,
2686
2093
client_object=None):
2687
2094
# error, or the other end of multiprocessing.Pipe has closed
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2689
2096
# Wait for other process to exit
2690
2097
proc.join()
2691
2098
return False
2692
2099
2693
2100
# Read a request from the child
2694
2101
request = parent_pipe.recv()
2695
2102
command = request[0]
2696
2103
2697
2104
if command == 'init':
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2701
2702
for c in self.clients.values():
2703
if key_id and c.key_id == key_id:
2704
client = c
2705
break
2706
if fpr and c.fingerprint == fpr:
2105
fpr = request[1]
2106
address = request[2]
2107
2108
for c in self.clients.itervalues():
2109
if c.fingerprint == fpr:
2707
2110
client = c
2708
2111
break
2709
2112
else:
2710
logger.info("Client not found for key ID: %s, address"
2711
": %s", key_id or fpr, address)
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
2712
2115
if self.use_dbus:
2713
2116
# Emit D-Bus signal
2714
mandos_dbus_service.ClientNotFound(key_id or fpr,
2117
mandos_dbus_service.ClientNotFound(fpr,
2715
2118
address[0])
2716
2119
parent_pipe.send(False)
2717
2120
return False
2718
2719
GLib.io_add_watch(
2121
2122
gobject.io_add_watch(
2720
2123
parent_pipe.fileno(),
2721
GLib.IO_IN | GLib.IO_HUP,
2124
gobject.IO_IN | gobject.IO_HUP,
2722
2125
functools.partial(self.handle_ipc,
2723
parent_pipe=parent_pipe,
2724
proc=proc,
2725
client_object=client))
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
2726
2129
parent_pipe.send(True)
2727
2130
# remove the old hook in favor of the new above hook on
2728
2131
# same fileno
2731
2134
funcname = request[1]
2732
2135
args = request[2]
2733
2136
kwargs = request[3]
2734
2137
2735
2138
parent_pipe.send(('data', getattr(client_object,
2736
2139
funcname)(*args,
2737
2140
**kwargs)))
2738
2141
2739
2142
if command == 'getattr':
2740
2143
attrname = request[1]
2741
if isinstance(client_object.__getattribute__(attrname),
2742
collections.Callable):
2144
if callable(client_object.__getattribute__(attrname)):
2743
2145
parent_pipe.send(('function', ))
2744
2146
else:
2745
2147
parent_pipe.send((
2746
2148
'data', client_object.__getattribute__(attrname)))
2747
2149
2748
2150
if command == 'setattr':
2749
2151
attrname = request[1]
2750
2152
value = request[2]
2751
2153
setattr(client_object, attrname, value)
2752
2154
2753
2155
return True
2754
2156
2755
2157
2756
2158
def rfc3339_duration_to_delta(duration):
2757
2159
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2758
2160
2759
2161
>>> rfc3339_duration_to_delta("P7D")
2760
2162
datetime.timedelta(7)
2761
2163
>>> rfc3339_duration_to_delta("PT60S")
2771
2173
>>> rfc3339_duration_to_delta("P1DT3M20S")
2772
2174
datetime.timedelta(1, 200)
2773
2175
"""
2774
2176
2775
2177
# Parsing an RFC 3339 duration with regular expressions is not
2776
2178
# possible - there would have to be multiple places for the same
2777
2179
# values, like seconds. The current code, while more esoteric, is
2778
2180
# cleaner without depending on a parsing library. If Python had a
2779
2181
# built-in library for parsing we would use it, but we'd like to
2780
2182
# avoid excessive use of external libraries.
2781
2183
2782
2184
# New type for defining tokens, syntax, and semantics all-in-one
2185
Token = collections.namedtuple("Token",
2186
("regexp", # To match token; if
2187
# "value" is not None,
2188
# must have a "group"
2189
# containing digits
2190
"value", # datetime.timedelta or
2191
# None
2192
"followers")) # Tokens valid after
2193
# this token
2783
2194
Token = collections.namedtuple("Token", (
2784
2195
"regexp", # To match token; if "value" is not None, must have
2785
2196
# a "group" containing digits
2817
2228
frozenset((token_year, token_month,
2818
2229
token_day, token_time,
2819
2230
token_week)))
2820
# Define starting values:
2821
# Value so far
2822
value = datetime.timedelta()
2231
# Define starting values
2232
value = datetime.timedelta() # Value so far
2823
2233
found_token = None
2824
# Following valid tokens
2825
followers = frozenset((token_duration, ))
2826
# String left to parse
2827
s = duration
2234
followers = frozenset((token_duration,)) # Following valid tokens
2235
s = duration # String left to parse
2828
2236
# Loop until end token is found
2829
2237
while found_token is not token_end:
2830
2238
# Search for any currently valid tokens
2854
2262
2855
2263
def string_to_delta(interval):
2856
2264
"""Parse a string and return a datetime.timedelta
2857
2265
2858
2266
>>> string_to_delta('7d')
2859
2267
datetime.timedelta(7)
2860
2268
>>> string_to_delta('60s')
2868
2276
>>> string_to_delta('5m 30s')
2869
2277
datetime.timedelta(0, 330)
2870
2278
"""
2871
2279
2872
2280
try:
2873
2281
return rfc3339_duration_to_delta(interval)
2874
2282
except ValueError:
2875
2283
pass
2876
2284
2877
2285
timevalue = datetime.timedelta(0)
2878
2286
for s in interval.split():
2879
2287
try:
2897
2305
return timevalue
2898
2306
2899
2307
2900
def daemon(nochdir=False, noclose=False):
2308
def daemon(nochdir = False, noclose = False):
2901
2309
"""See daemon(3). Standard BSD Unix function.
2902
2310
2903
2311
This should really exist as os.daemon, but it doesn't (yet)."""
2904
2312
if os.fork():
2905
2313
sys.exit()
2923
2331
2924
2332
2925
2333
def main():
2926
2334
2927
2335
##################################################################
2928
2336
# Parsing of options, both command line and config file
2929
2337
2930
2338
parser = argparse.ArgumentParser()
2931
2339
parser.add_argument("-v", "--version", action="version",
2932
version="%(prog)s {}".format(version),
2340
version = "%(prog)s {}".format(version),
2933
2341
help="show version number and exit")
2934
2342
parser.add_argument("-i", "--interface", metavar="IF",
2935
2343
help="Bind to interface IF")
2971
2379
parser.add_argument("--no-zeroconf", action="store_false",
2972
2380
dest="zeroconf", help="Do not use Zeroconf",
2973
2381
default=None)
2974
2382
2975
2383
options = parser.parse_args()
2976
2384
2977
2385
if options.check:
2978
2386
import doctest
2979
2387
fail_count, test_count = doctest.testmod()
2980
2388
sys.exit(os.EX_OK if fail_count == 0 else 1)
2981
2389
2982
2390
# Default values for config file for server-global settings
2983
if gnutls.has_rawpk:
2984
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2985
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2986
else:
2987
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2988
":+SIGN-DSA-SHA256")
2989
server_defaults = {"interface": "",
2990
"address": "",
2991
"port": "",
2992
"debug": "False",
2993
"priority": priority,
2994
"servicename": "Mandos",
2995
"use_dbus": "True",
2996
"use_ipv6": "True",
2997
"debuglevel": "",
2998
"restore": "True",
2999
"socket": "",
3000
"statedir": "/var/lib/mandos",
3001
"foreground": "False",
3002
"zeroconf": "True",
3003
}
3004
del priority
3005
2391
server_defaults = { "interface": "",
2392
"address": "",
2393
"port": "",
2394
"debug": "False",
2395
"priority":
2396
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2397
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2398
"servicename": "Mandos",
2399
"use_dbus": "True",
2400
"use_ipv6": "True",
2401
"debuglevel": "",
2402
"restore": "True",
2403
"socket": "",
2404
"statedir": "/var/lib/mandos",
2405
"foreground": "False",
2406
"zeroconf": "True",
2407
}
2408
3006
2409
# Parse config file for server-global settings
3007
2410
server_config = configparser.SafeConfigParser(server_defaults)
3008
2411
del server_defaults
3010
2413
# Convert the SafeConfigParser object to a dict
3011
2414
server_settings = server_config.defaults()
3012
2415
# Use the appropriate methods on the non-string config options
3013
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3014
"foreground", "zeroconf"):
2416
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3015
2417
server_settings[option] = server_config.getboolean("DEFAULT",
3016
2418
option)
3017
2419
if server_settings["port"]:
3027
2429
server_settings["socket"] = os.dup(server_settings
3028
2430
["socket"])
3029
2431
del server_config
3030
2432
3031
2433
# Override the settings from the config file with command line
3032
2434
# options, if set.
3033
2435
for option in ("interface", "address", "port", "debug",
3051
2453
if server_settings["debug"]:
3052
2454
server_settings["foreground"] = True
3053
2455
# Now we have our good server settings in "server_settings"
3054
2456
3055
2457
##################################################################
3056
2458
3057
2459
if (not server_settings["zeroconf"]
3058
2460
and not (server_settings["port"]
3059
2461
or server_settings["socket"] != "")):
3060
2462
parser.error("Needs port or socket to work without Zeroconf")
3061
2463
3062
2464
# For convenience
3063
2465
debug = server_settings["debug"]
3064
2466
debuglevel = server_settings["debuglevel"]
3068
2470
stored_state_file)
3069
2471
foreground = server_settings["foreground"]
3070
2472
zeroconf = server_settings["zeroconf"]
3071
2473
3072
2474
if debug:
3073
2475
initlogger(debug, logging.DEBUG)
3074
2476
else:
3077
2479
else:
3078
2480
level = getattr(logging, debuglevel.upper())
3079
2481
initlogger(debug, level)
3080
2482
3081
2483
if server_settings["servicename"] != "Mandos":
3082
2484
syslogger.setFormatter(
3083
2485
logging.Formatter('Mandos ({}) [%(process)d]:'
3084
2486
' %(levelname)s: %(message)s'.format(
3085
2487
server_settings["servicename"])))
3086
2488
3087
2489
# Parse config file with clients
3088
2490
client_config = configparser.SafeConfigParser(Client
3089
2491
.client_defaults)
3090
2492
client_config.read(os.path.join(server_settings["configdir"],
3091
2493
"clients.conf"))
3092
2494
3093
2495
global mandos_dbus_service
3094
2496
mandos_dbus_service = None
3095
2497
3096
2498
socketfd = None
3097
2499
if server_settings["socket"] != "":
3098
2500
socketfd = server_settings["socket"]
3114
2516
except IOError as e:
3115
2517
logger.error("Could not open file %r", pidfilename,
3116
2518
exc_info=e)
3117
3118
for name, group in (("_mandos", "_mandos"),
3119
("mandos", "mandos"),
3120
("nobody", "nogroup")):
2519
2520
for name in ("_mandos", "mandos", "nobody"):
3121
2521
try:
3122
2522
uid = pwd.getpwnam(name).pw_uid
3123
gid = pwd.getpwnam(group).pw_gid
2523
gid = pwd.getpwnam(name).pw_gid
3124
2524
break
3125
2525
except KeyError:
3126
2526
continue
3130
2530
try:
3131
2531
os.setgid(gid)
3132
2532
os.setuid(uid)
3133
if debug:
3134
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3135
gid))
3136
2533
except OSError as error:
3137
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3138
.format(uid, gid, os.strerror(error.errno)))
3139
2534
if error.errno != errno.EPERM:
3140
2535
raise
3141
2536
3142
2537
if debug:
3143
2538
# Enable all possible GnuTLS debugging
3144
2539
3145
2540
# "Use a log level over 10 to enable all debugging options."
3146
2541
# - GnuTLS manual
3147
gnutls.global_set_log_level(11)
3148
3149
@gnutls.log_func
2542
gnutls.library.functions.gnutls_global_set_log_level(11)
2543
2544
@gnutls.library.types.gnutls_log_func
3150
2545
def debug_gnutls(level, string):
3151
2546
logger.debug("GnuTLS: %s", string[:-1])
3152
3153
gnutls.global_set_log_function(debug_gnutls)
3154
2547
2548
gnutls.library.functions.gnutls_global_set_log_function(
2549
debug_gnutls)
2550
3155
2551
# Redirect stdin so all checkers get /dev/null
3156
2552
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3157
2553
os.dup2(null, sys.stdin.fileno())
3158
2554
if null > 2:
3159
2555
os.close(null)
3160
2556
3161
2557
# Need to fork before connecting to D-Bus
3162
2558
if not foreground:
3163
2559
# Close all input and output, do double fork, etc.
3164
2560
daemon()
3165
3166
# multiprocessing will use threads, so before we use GLib we need
3167
# to inform GLib that threads will be used.
3168
GLib.threads_init()
3169
2561
2562
# multiprocessing will use threads, so before we use gobject we
2563
# need to inform gobject that threads will be used.
2564
gobject.threads_init()
2565
3170
2566
global main_loop
3171
2567
# From the Avahi example code
3172
2568
DBusGMainLoop(set_as_default=True)
3173
main_loop = GLib.MainLoop()
2569
main_loop = gobject.MainLoop()
3174
2570
bus = dbus.SystemBus()
3175
2571
# End of Avahi example code
3176
2572
if use_dbus:
3189
2585
if zeroconf:
3190
2586
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3191
2587
service = AvahiServiceToSyslog(
3192
name=server_settings["servicename"],
3193
servicetype="_mandos._tcp",
3194
protocol=protocol,
3195
bus=bus)
2588
name = server_settings["servicename"],
2589
servicetype = "_mandos._tcp",
2590
protocol = protocol,
2591
bus = bus)
3196
2592
if server_settings["interface"]:
3197
2593
service.interface = if_nametoindex(
3198
2594
server_settings["interface"].encode("utf-8"))
3199
2595
3200
2596
global multiprocessing_manager
3201
2597
multiprocessing_manager = multiprocessing.Manager()
3202
2598
3203
2599
client_class = Client
3204
2600
if use_dbus:
3205
client_class = functools.partial(ClientDBus, bus=bus)
3206
2601
client_class = functools.partial(ClientDBus, bus = bus)
2602
3207
2603
client_settings = Client.config_parser(client_config)
3208
2604
old_client_settings = {}
3209
2605
clients_data = {}
3210
2606
3211
2607
# This is used to redirect stdout and stderr for checker processes
3212
2608
global wnull
3213
wnull = open(os.devnull, "w") # A writable /dev/null
2609
wnull = open(os.devnull, "w") # A writable /dev/null
3214
2610
# Only used if server is running in foreground but not in debug
3215
2611
# mode
3216
2612
if debug or not foreground:
3217
2613
wnull.close()
3218
2614
3219
2615
# Get client data and settings from last running state.
3220
2616
if server_settings["restore"]:
3221
2617
try:
3222
2618
with open(stored_state_path, "rb") as stored_state:
3223
if sys.version_info.major == 2:
3224
clients_data, old_client_settings = pickle.load(
3225
stored_state)
3226
else:
3227
bytes_clients_data, bytes_old_client_settings = (
3228
pickle.load(stored_state, encoding="bytes"))
3229
# Fix bytes to strings
3230
# clients_data
3231
# .keys()
3232
clients_data = {(key.decode("utf-8")
3233
if isinstance(key, bytes)
3234
else key): value
3235
for key, value in
3236
bytes_clients_data.items()}
3237
del bytes_clients_data
3238
for key in clients_data:
3239
value = {(k.decode("utf-8")
3240
if isinstance(k, bytes) else k): v
3241
for k, v in
3242
clients_data[key].items()}
3243
clients_data[key] = value
3244
# .client_structure
3245
value["client_structure"] = [
3246
(s.decode("utf-8")
3247
if isinstance(s, bytes)
3248
else s) for s in
3249
value["client_structure"]]
3250
# .name & .host
3251
for k in ("name", "host"):
3252
if isinstance(value[k], bytes):
3253
value[k] = value[k].decode("utf-8")
3254
if not value.has_key("key_id"):
3255
value["key_id"] = ""
3256
elif not value.has_key("fingerprint"):
3257
value["fingerprint"] = ""
3258
# old_client_settings
3259
# .keys()
3260
old_client_settings = {
3261
(key.decode("utf-8")
3262
if isinstance(key, bytes)
3263
else key): value
3264
for key, value in
3265
bytes_old_client_settings.items()}
3266
del bytes_old_client_settings
3267
# .host
3268
for value in old_client_settings.values():
3269
if isinstance(value["host"], bytes):
3270
value["host"] = (value["host"]
3271
.decode("utf-8"))
2619
clients_data, old_client_settings = pickle.load(
2620
stored_state)
3272
2621
os.remove(stored_state_path)
3273
2622
except IOError as e:
3274
2623
if e.errno == errno.ENOENT:
3282
2631
logger.warning("Could not load persistent state: "
3283
2632
"EOFError:",
3284
2633
exc_info=e)
3285
2634
3286
2635
with PGPEngine() as pgp:
3287
2636
for client_name, client in clients_data.items():
3288
2637
# Skip removed clients
3289
2638
if client_name not in client_settings:
3290
2639
continue
3291
2640
3292
2641
# Decide which value to use after restoring saved state.
3293
2642
# We have three different values: Old config file,
3294
2643
# new config file, and saved state.
3305
2654
client[name] = value
3306
2655
except KeyError:
3307
2656
pass
3308
2657
3309
2658
# Clients who has passed its expire date can still be
3310
# enabled if its last checker was successful. A Client
2659
# enabled if its last checker was successful. Clients
3311
2660
# whose checker succeeded before we stored its state is
3312
2661
# assumed to have successfully run all checkers during
3313
2662
# downtime.
3344
2693
client_name))
3345
2694
client["secret"] = (client_settings[client_name]
3346
2695
["secret"])
3347
2696
3348
2697
# Add/remove clients based on new changes made to config
3349
2698
for client_name in (set(old_client_settings)
3350
2699
- set(client_settings)):
3352
2701
for client_name in (set(client_settings)
3353
2702
- set(old_client_settings)):
3354
2703
clients_data[client_name] = client_settings[client_name]
3355
2704
3356
2705
# Create all client objects
3357
2706
for client_name, client in clients_data.items():
3358
2707
tcp_server.clients[client_name] = client_class(
3359
name=client_name,
3360
settings=client,
3361
server_settings=server_settings)
3362
2708
name = client_name,
2709
settings = client,
2710
server_settings = server_settings)
2711
3363
2712
if not tcp_server.clients:
3364
2713
logger.warning("No clients defined")
3365
2714
3366
2715
if not foreground:
3367
2716
if pidfile is not None:
3368
2717
pid = os.getpid()
3374
2723
pidfilename, pid)
3375
2724
del pidfile
3376
2725
del pidfilename
3377
3378
for termsig in (signal.SIGHUP, signal.SIGTERM):
3379
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3380
lambda: main_loop.quit() and False)
3381
2726
2727
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2728
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2729
3382
2730
if use_dbus:
3383
2731
3384
2732
@alternate_dbus_interfaces(
3385
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3386
class MandosDBusService(DBusObjectWithObjectManager):
2733
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2734
class MandosDBusService(DBusObjectWithProperties):
3387
2735
"""A D-Bus proxy object"""
3388
2736
3389
2737
def __init__(self):
3390
2738
dbus.service.Object.__init__(self, bus, "/")
3391
2739
3392
2740
_interface = "se.recompile.Mandos"
3393
2741
2742
@dbus_interface_annotations(_interface)
2743
def _foo(self):
2744
return {
2745
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2746
"false" }
2747
3394
2748
@dbus.service.signal(_interface, signature="o")
3395
2749
def ClientAdded(self, objpath):
3396
2750
"D-Bus signal"
3397
2751
pass
3398
2752
3399
2753
@dbus.service.signal(_interface, signature="ss")
3400
def ClientNotFound(self, key_id, address):
2754
def ClientNotFound(self, fingerprint, address):
3401
2755
"D-Bus signal"
3402
2756
pass
3403
3404
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3405
"true"})
2757
3406
2758
@dbus.service.signal(_interface, signature="os")
3407
2759
def ClientRemoved(self, objpath, name):
3408
2760
"D-Bus signal"
3409
2761
pass
3410
3411
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3412
"true"})
2762
3413
2763
@dbus.service.method(_interface, out_signature="ao")
3414
2764
def GetAllClients(self):
3415
2765
"D-Bus method"
3416
2766
return dbus.Array(c.dbus_object_path for c in
3417
tcp_server.clients.values())
3418
3419
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3420
"true"})
2767
tcp_server.clients.itervalues())
2768
3421
2769
@dbus.service.method(_interface,
3422
2770
out_signature="a{oa{sv}}")
3423
2771
def GetAllClientsWithProperties(self):
3424
2772
"D-Bus method"
3425
2773
return dbus.Dictionary(
3426
{c.dbus_object_path: c.GetAll(
3427
"se.recompile.Mandos.Client")
3428
for c in tcp_server.clients.values()},
2774
{ c.dbus_object_path: c.GetAll("")
2775
for c in tcp_server.clients.itervalues() },
3429
2776
signature="oa{sv}")
3430
2777
3431
2778
@dbus.service.method(_interface, in_signature="o")
3432
2779
def RemoveClient(self, object_path):
3433
2780
"D-Bus method"
3434
for c in tcp_server.clients.values():
2781
for c in tcp_server.clients.itervalues():
3435
2782
if c.dbus_object_path == object_path:
3436
2783
del tcp_server.clients[c.name]
3437
2784
c.remove_from_connection()
3438
# Don't signal the disabling
2785
# Don't signal anything except ClientRemoved
3439
2786
c.disable(quiet=True)
3440
# Emit D-Bus signal for removal
3441
self.client_removed_signal(c)
2787
# Emit D-Bus signal
2788
self.ClientRemoved(object_path, c.name)
3442
2789
return
3443
2790
raise KeyError(object_path)
3444
2791
3445
2792
del _interface
3446
3447
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3448
out_signature="a{oa{sa{sv}}}")
3449
def GetManagedObjects(self):
3450
"""D-Bus method"""
3451
return dbus.Dictionary(
3452
{client.dbus_object_path:
3453
dbus.Dictionary(
3454
{interface: client.GetAll(interface)
3455
for interface in
3456
client._get_all_interface_names()})
3457
for client in tcp_server.clients.values()})
3458
3459
def client_added_signal(self, client):
3460
"""Send the new standard signal and the old signal"""
3461
if use_dbus:
3462
# New standard signal
3463
self.InterfacesAdded(
3464
client.dbus_object_path,
3465
dbus.Dictionary(
3466
{interface: client.GetAll(interface)
3467
for interface in
3468
client._get_all_interface_names()}))
3469
# Old signal
3470
self.ClientAdded(client.dbus_object_path)
3471
3472
def client_removed_signal(self, client):
3473
"""Send the new standard signal and the old signal"""
3474
if use_dbus:
3475
# New standard signal
3476
self.InterfacesRemoved(
3477
client.dbus_object_path,
3478
client._get_all_interface_names())
3479
# Old signal
3480
self.ClientRemoved(client.dbus_object_path,
3481
client.name)
3482
2793
3483
2794
mandos_dbus_service = MandosDBusService()
3484
3485
# Save modules to variables to exempt the modules from being
3486
# unloaded before the function registered with atexit() is run.
3487
mp = multiprocessing
3488
wn = wnull
3489
2795
3490
2796
def cleanup():
3491
2797
"Cleanup function; run on exit"
3492
2798
if zeroconf:
3493
2799
service.cleanup()
3494
3495
mp.active_children()
3496
wn.close()
2800
2801
multiprocessing.active_children()
2802
wnull.close()
3497
2803
if not (tcp_server.clients or client_settings):
3498
2804
return
3499
2805
3500
2806
# Store client before exiting. Secrets are encrypted with key
3501
2807
# based on what config file has. If config file is
3502
2808
# removed/edited, old secret will thus be unrecovable.
3503
2809
clients = {}
3504
2810
with PGPEngine() as pgp:
3505
for client in tcp_server.clients.values():
2811
for client in tcp_server.clients.itervalues():
3506
2812
key = client_settings[client.name]["secret"]
3507
2813
client.encrypted_secret = pgp.encrypt(client.secret,
3508
2814
key)
3509
2815
client_dict = {}
3510
2816
3511
2817
# A list of attributes that can not be pickled
3512
2818
# + secret.
3513
exclude = {"bus", "changedstate", "secret",
3514
"checker", "server_settings"}
2819
exclude = { "bus", "changedstate", "secret",
2820
"checker", "server_settings" }
3515
2821
for name, typ in inspect.getmembers(dbus.service
3516
2822
.Object):
3517
2823
exclude.add(name)
3518
2824
3519
2825
client_dict["encrypted_secret"] = (client
3520
2826
.encrypted_secret)
3521
2827
for attr in client.client_structure:
3522
2828
if attr not in exclude:
3523
2829
client_dict[attr] = getattr(client, attr)
3524
2830
3525
2831
clients[client.name] = client_dict
3526
2832
del client_settings[client.name]["secret"]
3527
2833
3528
2834
try:
3529
2835
with tempfile.NamedTemporaryFile(
3530
2836
mode='wb',
3532
2838
prefix='clients-',
3533
2839
dir=os.path.dirname(stored_state_path),
3534
2840
delete=False) as stored_state:
3535
pickle.dump((clients, client_settings), stored_state,
3536
protocol=2)
2841
pickle.dump((clients, client_settings), stored_state)
3537
2842
tempname = stored_state.name
3538
2843
os.rename(tempname, stored_state_path)
3539
2844
except (IOError, OSError) as e:
3549
2854
logger.warning("Could not save persistent state:",
3550
2855
exc_info=e)
3551
2856
raise
3552
2857
3553
2858
# Delete all clients, and settings from config
3554
2859
while tcp_server.clients:
3555
2860
name, client = tcp_server.clients.popitem()
3556
2861
if use_dbus:
3557
2862
client.remove_from_connection()
3558
# Don't signal the disabling
2863
# Don't signal anything except ClientRemoved
3559
2864
client.disable(quiet=True)
3560
# Emit D-Bus signal for removal
3561
2865
if use_dbus:
3562
mandos_dbus_service.client_removed_signal(client)
2866
# Emit D-Bus signal
2867
mandos_dbus_service.ClientRemoved(
2868
client.dbus_object_path, client.name)
3563
2869
client_settings.clear()
3564
2870
3565
2871
atexit.register(cleanup)
3566
3567
for client in tcp_server.clients.values():
2872
2873
for client in tcp_server.clients.itervalues():
3568
2874
if use_dbus:
3569
# Emit D-Bus signal for adding
3570
mandos_dbus_service.client_added_signal(client)
2875
# Emit D-Bus signal
2876
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3571
2877
# Need to initiate checking of clients
3572
2878
if client.enabled:
3573
2879
client.init_checker()
3574
2880
3575
2881
tcp_server.enable()
3576
2882
tcp_server.server_activate()
3577
2883
3578
2884
# Find out what port we got
3579
2885
if zeroconf:
3580
2886
service.port = tcp_server.socket.getsockname()[1]
3585
2891
else: # IPv4
3586
2892
logger.info("Now listening on address %r, port %d",
3587
2893
*tcp_server.socket.getsockname())
3588
3589
# service.interface = tcp_server.socket.getsockname()[3]
3590
2894
2895
#service.interface = tcp_server.socket.getsockname()[3]
2896
3591
2897
try:
3592
2898
if zeroconf:
3593
2899
# From the Avahi example code
3598
2904
cleanup()
3599
2905
sys.exit(1)
3600
2906
# End of Avahi example code
3601
3602
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3603
lambda *args, **kwargs:
3604
(tcp_server.handle_request
3605
(*args[2:], **kwargs) or True))
3606
2907
2908
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2909
lambda *args, **kwargs:
2910
(tcp_server.handle_request
2911
(*args[2:], **kwargs) or True))
2912
3607
2913
logger.debug("Starting main loop")
3608
2914
main_loop.run()
3609
2915
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0