To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 759
- compare with another revision
- download diff
- download tarball
- view history from revision 759
- Committer: Teddy Hogeborn
- Date: 2015-07-06 20:29:34 UTC
- mfrom: (738.1.6 route-external)
- Revision ID: teddy@recompile.se-20150706202934-09j06jm2fiw1bn80
Merge change to add local route when network is "unreachable".
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
48
44
import argparse
49
45
import datetime
50
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
51
53
try:
52
54
import ConfigParser as configparser
53
55
except ImportError:
77
79
import itertools
78
80
import collections
79
81
import codecs
80
import unittest
81
82
82
83
import dbus
83
84
import dbus.service
84
import gi
85
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
86
90
from dbus.mainloop.glib import DBusGMainLoop
87
91
import ctypes
88
92
import ctypes.util
89
93
import xml.dom.minidom
90
94
import inspect
91
95
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
str = unicode
95
96
# Show warnings by default
97
if not sys.warnoptions:
98
import warnings
99
warnings.simplefilter("default")
100
101
# Try to find the value of SO_BINDTODEVICE:
102
96
try:
103
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
104
# newer, and it is also the most natural place for it:
105
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
106
98
except AttributeError:
107
99
try:
108
# This is where SO_BINDTODEVICE was up to and including Python
109
# 2.6, and also 3.2:
110
100
from IN import SO_BINDTODEVICE
111
101
except ImportError:
112
# In Python 2.7 it seems to have been removed entirely.
113
# Try running the C preprocessor:
114
try:
115
cc = subprocess.Popen(["cc", "--language=c", "-E",
116
"/dev/stdin"],
117
stdin=subprocess.PIPE,
118
stdout=subprocess.PIPE)
119
stdout = cc.communicate(
120
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
121
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
122
except (OSError, ValueError, IndexError):
123
# No value found
124
SO_BINDTODEVICE = None
125
126
if sys.version_info < (3, 2):
127
configparser.Configparser = configparser.SafeConfigParser
128
129
version = "1.8.9"
102
SO_BINDTODEVICE = None
103
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
130
108
stored_state_file = "clients.pickle"
131
109
132
110
logger = logging.getLogger()
133
logging.captureWarnings(True) # Show warnings via the logging system
134
111
syslogger = None
135
112
136
113
try:
137
114
if_nametoindex = ctypes.cdll.LoadLibrary(
138
115
ctypes.util.find_library("c")).if_nametoindex
139
116
except (OSError, AttributeError):
140
117
141
118
def if_nametoindex(interface):
142
119
"Get an interface index the hard way, i.e. using fcntl()"
143
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
148
125
return interface_index
149
126
150
127
151
def copy_function(func):
152
"""Make a copy of a function"""
153
if sys.version_info.major == 2:
154
return types.FunctionType(func.func_code,
155
func.func_globals,
156
func.func_name,
157
func.func_defaults,
158
func.func_closure)
159
else:
160
return types.FunctionType(func.__code__,
161
func.__globals__,
162
func.__name__,
163
func.__defaults__,
164
func.__closure__)
165
166
167
128
def initlogger(debug, level=logging.WARNING):
168
129
"""init logger and add loglevel"""
169
130
170
131
global syslogger
171
132
syslogger = (logging.handlers.SysLogHandler(
172
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
173
address="/dev/log"))
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
174
135
syslogger.setFormatter(logging.Formatter
175
136
('Mandos [%(process)d]: %(levelname)s:'
176
137
' %(message)s'))
177
138
logger.addHandler(syslogger)
178
139
179
140
if debug:
180
141
console = logging.StreamHandler()
181
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
191
152
pass
192
153
193
154
194
class PGPEngine:
155
class PGPEngine(object):
195
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
196
157
197
158
def __init__(self):
198
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
199
self.gpg = "gpg"
200
try:
201
output = subprocess.check_output(["gpgconf"])
202
for line in output.splitlines():
203
name, text, path = line.split(b":")
204
if name == b"gpg":
205
self.gpg = path
206
break
207
except OSError as e:
208
if e.errno != errno.ENOENT:
209
raise
210
160
self.gnupgargs = ['--batch',
211
'--homedir', self.tempdir,
161
'--home', self.tempdir,
212
162
'--force-mdc',
213
'--quiet']
214
# Only GPG version 1 has the --no-use-agent option.
215
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
216
self.gnupgargs.append("--no-use-agent")
217
163
'--quiet',
164
'--no-use-agent']
165
218
166
def __enter__(self):
219
167
return self
220
168
221
169
def __exit__(self, exc_type, exc_value, traceback):
222
170
self._cleanup()
223
171
return False
224
172
225
173
def __del__(self):
226
174
self._cleanup()
227
175
228
176
def _cleanup(self):
229
177
if self.tempdir is not None:
230
178
# Delete contents of tempdir
231
179
for root, dirs, files in os.walk(self.tempdir,
232
topdown=False):
180
topdown = False):
233
181
for filename in files:
234
182
os.remove(os.path.join(root, filename))
235
183
for dirname in dirs:
237
185
# Remove tempdir
238
186
os.rmdir(self.tempdir)
239
187
self.tempdir = None
240
188
241
189
def password_encode(self, password):
242
190
# Passphrase can not be empty and can not contain newlines or
243
191
# NUL bytes. So we prefix it and hex encode it.
248
196
.replace(b"\n", b"\\n")
249
197
.replace(b"\0", b"\\x00"))
250
198
return encoded
251
199
252
200
def encrypt(self, data, password):
253
201
passphrase = self.password_encode(password)
254
202
with tempfile.NamedTemporaryFile(
255
203
dir=self.tempdir) as passfile:
256
204
passfile.write(passphrase)
257
205
passfile.flush()
258
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
259
207
'--passphrase-file',
260
208
passfile.name]
261
209
+ self.gnupgargs,
262
stdin=subprocess.PIPE,
263
stdout=subprocess.PIPE,
264
stderr=subprocess.PIPE)
265
ciphertext, err = proc.communicate(input=data)
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
266
214
if proc.returncode != 0:
267
215
raise PGPError(err)
268
216
return ciphertext
269
217
270
218
def decrypt(self, data, password):
271
219
passphrase = self.password_encode(password)
272
220
with tempfile.NamedTemporaryFile(
273
dir=self.tempdir) as passfile:
221
dir = self.tempdir) as passfile:
274
222
passfile.write(passphrase)
275
223
passfile.flush()
276
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
277
225
'--passphrase-file',
278
226
passfile.name]
279
227
+ self.gnupgargs,
280
stdin=subprocess.PIPE,
281
stdout=subprocess.PIPE,
282
stderr=subprocess.PIPE)
283
decrypted_plaintext, err = proc.communicate(input=data)
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
284
232
if proc.returncode != 0:
285
233
raise PGPError(err)
286
234
return decrypted_plaintext
287
235
288
236
289
# Pretend that we have an Avahi module
290
class avahi:
291
"""This isn't so much a class as it is a module-like namespace."""
292
IF_UNSPEC = -1 # avahi-common/address.h
293
PROTO_UNSPEC = -1 # avahi-common/address.h
294
PROTO_INET = 0 # avahi-common/address.h
295
PROTO_INET6 = 1 # avahi-common/address.h
296
DBUS_NAME = "org.freedesktop.Avahi"
297
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
298
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
299
DBUS_PATH_SERVER = "/"
300
301
@staticmethod
302
def string_array_to_txt_array(t):
303
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
304
for s in t), signature="ay")
305
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
306
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
307
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
308
SERVER_INVALID = 0 # avahi-common/defs.h
309
SERVER_REGISTERING = 1 # avahi-common/defs.h
310
SERVER_RUNNING = 2 # avahi-common/defs.h
311
SERVER_COLLISION = 3 # avahi-common/defs.h
312
SERVER_FAILURE = 4 # avahi-common/defs.h
313
314
315
237
class AvahiError(Exception):
316
238
def __init__(self, value, *args, **kwargs):
317
239
self.value = value
327
249
pass
328
250
329
251
330
class AvahiService:
252
class AvahiService(object):
331
253
"""An Avahi (Zeroconf) service.
332
254
333
255
Attributes:
334
256
interface: integer; avahi.IF_UNSPEC or an interface index.
335
257
Used to optionally bind to the specified interface.
347
269
server: D-Bus Server
348
270
bus: dbus.SystemBus()
349
271
"""
350
272
351
273
def __init__(self,
352
interface=avahi.IF_UNSPEC,
353
name=None,
354
servicetype=None,
355
port=None,
356
TXT=None,
357
domain="",
358
host="",
359
max_renames=32768,
360
protocol=avahi.PROTO_UNSPEC,
361
bus=None):
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
362
284
self.interface = interface
363
285
self.name = name
364
286
self.type = servicetype
373
295
self.server = None
374
296
self.bus = bus
375
297
self.entry_group_state_changed_match = None
376
298
377
299
def rename(self, remove=True):
378
300
"""Derived from the Avahi example code"""
379
301
if self.rename_count >= self.max_renames:
399
321
logger.critical("D-Bus Exception", exc_info=error)
400
322
self.cleanup()
401
323
os._exit(1)
402
324
403
325
def remove(self):
404
326
"""Derived from the Avahi example code"""
405
327
if self.entry_group_state_changed_match is not None:
407
329
self.entry_group_state_changed_match = None
408
330
if self.group is not None:
409
331
self.group.Reset()
410
332
411
333
def add(self):
412
334
"""Derived from the Avahi example code"""
413
335
self.remove()
430
352
dbus.UInt16(self.port),
431
353
avahi.string_array_to_txt_array(self.TXT))
432
354
self.group.Commit()
433
355
434
356
def entry_group_state_changed(self, state, error):
435
357
"""Derived from the Avahi example code"""
436
358
logger.debug("Avahi entry group state change: %i", state)
437
359
438
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
439
361
logger.debug("Zeroconf service established.")
440
362
elif state == avahi.ENTRY_GROUP_COLLISION:
444
366
logger.critical("Avahi: Error in group state changed %s",
445
367
str(error))
446
368
raise AvahiGroupError("State changed: {!s}".format(error))
447
369
448
370
def cleanup(self):
449
371
"""Derived from the Avahi example code"""
450
372
if self.group is not None:
455
377
pass
456
378
self.group = None
457
379
self.remove()
458
380
459
381
def server_state_changed(self, state, error=None):
460
382
"""Derived from the Avahi example code"""
461
383
logger.debug("Avahi server state change: %i", state)
473
395
logger.error(bad_states[state] + ": %r", error)
474
396
self.cleanup()
475
397
elif state == avahi.SERVER_RUNNING:
476
try:
477
self.add()
478
except dbus.exceptions.DBusException as error:
479
if (error.get_dbus_name()
480
== "org.freedesktop.Avahi.CollisionError"):
481
logger.info("Local Zeroconf service name"
482
" collision.")
483
return self.rename(remove=False)
484
else:
485
logger.critical("D-Bus Exception", exc_info=error)
486
self.cleanup()
487
os._exit(1)
398
self.add()
488
399
else:
489
400
if error is None:
490
401
logger.debug("Unknown state: %r", state)
491
402
else:
492
403
logger.debug("Unknown state: %r: %r", state, error)
493
404
494
405
def activate(self):
495
406
"""Derived from the Avahi example code"""
496
407
if self.server is None:
507
418
class AvahiServiceToSyslog(AvahiService):
508
419
def rename(self, *args, **kwargs):
509
420
"""Add the new name to the syslog messages"""
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
421
ret = AvahiService.rename(self, *args, **kwargs)
511
422
syslogger.setFormatter(logging.Formatter(
512
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
513
424
.format(self.name)))
514
425
return ret
515
426
516
517
# Pretend that we have a GnuTLS module
518
class gnutls:
519
"""This isn't so much a class as it is a module-like namespace."""
520
521
library = ctypes.util.find_library("gnutls")
522
if library is None:
523
library = ctypes.util.find_library("gnutls-deb0")
524
_library = ctypes.cdll.LoadLibrary(library)
525
del library
526
527
# Unless otherwise indicated, the constants and types below are
528
# all from the gnutls/gnutls.h C header file.
529
530
# Constants
531
E_SUCCESS = 0
532
E_INTERRUPTED = -52
533
E_AGAIN = -28
534
CRT_OPENPGP = 2
535
CRT_RAWPK = 3
536
CLIENT = 2
537
SHUT_RDWR = 0
538
CRD_CERTIFICATE = 1
539
E_NO_CERTIFICATE_FOUND = -49
540
X509_FMT_DER = 0
541
NO_TICKETS = 1<<10
542
ENABLE_RAWPK = 1<<18
543
CTYPE_PEERS = 3
544
KEYID_USE_SHA256 = 1 # gnutls/x509.h
545
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
546
547
# Types
548
class session_int(ctypes.Structure):
549
_fields_ = []
550
session_t = ctypes.POINTER(session_int)
551
552
class certificate_credentials_st(ctypes.Structure):
553
_fields_ = []
554
certificate_credentials_t = ctypes.POINTER(
555
certificate_credentials_st)
556
certificate_type_t = ctypes.c_int
557
558
class datum_t(ctypes.Structure):
559
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
('size', ctypes.c_uint)]
561
562
class openpgp_crt_int(ctypes.Structure):
563
_fields_ = []
564
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
565
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
566
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
credentials_type_t = ctypes.c_int
568
transport_ptr_t = ctypes.c_void_p
569
close_request_t = ctypes.c_int
570
571
# Exceptions
572
class Error(Exception):
573
def __init__(self, message=None, code=None, args=()):
574
# Default usage is by a message string, but if a return
575
# code is passed, convert it to a string with
576
# gnutls.strerror()
577
self.code = code
578
if message is None and code is not None:
579
message = gnutls.strerror(code)
580
return super(gnutls.Error, self).__init__(
581
message, *args)
582
583
class CertificateSecurityError(Error):
584
pass
585
586
# Classes
587
class Credentials:
588
def __init__(self):
589
self._c_object = gnutls.certificate_credentials_t()
590
gnutls.certificate_allocate_credentials(
591
ctypes.byref(self._c_object))
592
self.type = gnutls.CRD_CERTIFICATE
593
594
def __del__(self):
595
gnutls.certificate_free_credentials(self._c_object)
596
597
class ClientSession:
598
def __init__(self, socket, credentials=None):
599
self._c_object = gnutls.session_t()
600
gnutls_flags = gnutls.CLIENT
601
if gnutls.check_version(b"3.5.6"):
602
gnutls_flags |= gnutls.NO_TICKETS
603
if gnutls.has_rawpk:
604
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
606
del gnutls_flags
607
gnutls.set_default_priority(self._c_object)
608
gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
gnutls.handshake_set_private_extensions(self._c_object,
610
True)
611
self.socket = socket
612
if credentials is None:
613
credentials = gnutls.Credentials()
614
gnutls.credentials_set(self._c_object, credentials.type,
615
ctypes.cast(credentials._c_object,
616
ctypes.c_void_p))
617
self.credentials = credentials
618
619
def __del__(self):
620
gnutls.deinit(self._c_object)
621
622
def handshake(self):
623
return gnutls.handshake(self._c_object)
624
625
def send(self, data):
626
data = bytes(data)
627
data_len = len(data)
628
while data_len > 0:
629
data_len -= gnutls.record_send(self._c_object,
630
data[-data_len:],
631
data_len)
632
633
def bye(self):
634
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
635
636
# Error handling functions
637
def _error_code(result):
638
"""A function to raise exceptions on errors, suitable
639
for the 'restype' attribute on ctypes functions"""
640
if result >= 0:
641
return result
642
if result == gnutls.E_NO_CERTIFICATE_FOUND:
643
raise gnutls.CertificateSecurityError(code=result)
644
raise gnutls.Error(code=result)
645
646
def _retry_on_error(result, func, arguments):
647
"""A function to retry on some errors, suitable
648
for the 'errcheck' attribute on ctypes functions"""
649
while result < 0:
650
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
651
return _error_code(result)
652
result = func(*arguments)
653
return result
654
655
# Unless otherwise indicated, the function declarations below are
656
# all from the gnutls/gnutls.h C header file.
657
658
# Functions
659
priority_set_direct = _library.gnutls_priority_set_direct
660
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
661
ctypes.POINTER(ctypes.c_char_p)]
662
priority_set_direct.restype = _error_code
663
664
init = _library.gnutls_init
665
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
666
init.restype = _error_code
667
668
set_default_priority = _library.gnutls_set_default_priority
669
set_default_priority.argtypes = [session_t]
670
set_default_priority.restype = _error_code
671
672
record_send = _library.gnutls_record_send
673
record_send.argtypes = [session_t, ctypes.c_void_p,
674
ctypes.c_size_t]
675
record_send.restype = ctypes.c_ssize_t
676
record_send.errcheck = _retry_on_error
677
678
certificate_allocate_credentials = (
679
_library.gnutls_certificate_allocate_credentials)
680
certificate_allocate_credentials.argtypes = [
681
ctypes.POINTER(certificate_credentials_t)]
682
certificate_allocate_credentials.restype = _error_code
683
684
certificate_free_credentials = (
685
_library.gnutls_certificate_free_credentials)
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
688
certificate_free_credentials.restype = None
689
690
handshake_set_private_extensions = (
691
_library.gnutls_handshake_set_private_extensions)
692
handshake_set_private_extensions.argtypes = [session_t,
693
ctypes.c_int]
694
handshake_set_private_extensions.restype = None
695
696
credentials_set = _library.gnutls_credentials_set
697
credentials_set.argtypes = [session_t, credentials_type_t,
698
ctypes.c_void_p]
699
credentials_set.restype = _error_code
700
701
strerror = _library.gnutls_strerror
702
strerror.argtypes = [ctypes.c_int]
703
strerror.restype = ctypes.c_char_p
704
705
certificate_type_get = _library.gnutls_certificate_type_get
706
certificate_type_get.argtypes = [session_t]
707
certificate_type_get.restype = _error_code
708
709
certificate_get_peers = _library.gnutls_certificate_get_peers
710
certificate_get_peers.argtypes = [session_t,
711
ctypes.POINTER(ctypes.c_uint)]
712
certificate_get_peers.restype = ctypes.POINTER(datum_t)
713
714
global_set_log_level = _library.gnutls_global_set_log_level
715
global_set_log_level.argtypes = [ctypes.c_int]
716
global_set_log_level.restype = None
717
718
global_set_log_function = _library.gnutls_global_set_log_function
719
global_set_log_function.argtypes = [log_func]
720
global_set_log_function.restype = None
721
722
deinit = _library.gnutls_deinit
723
deinit.argtypes = [session_t]
724
deinit.restype = None
725
726
handshake = _library.gnutls_handshake
727
handshake.argtypes = [session_t]
728
handshake.restype = _error_code
729
handshake.errcheck = _retry_on_error
730
731
transport_set_ptr = _library.gnutls_transport_set_ptr
732
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
733
transport_set_ptr.restype = None
734
735
bye = _library.gnutls_bye
736
bye.argtypes = [session_t, close_request_t]
737
bye.restype = _error_code
738
bye.errcheck = _retry_on_error
739
740
check_version = _library.gnutls_check_version
741
check_version.argtypes = [ctypes.c_char_p]
742
check_version.restype = ctypes.c_char_p
743
744
_need_version = b"3.3.0"
745
if check_version(_need_version) is None:
746
raise self.Error("Needs GnuTLS {} or later"
747
.format(_need_version))
748
749
_tls_rawpk_version = b"3.6.6"
750
has_rawpk = bool(check_version(_tls_rawpk_version))
751
752
if has_rawpk:
753
# Types
754
class pubkey_st(ctypes.Structure):
755
_fields = []
756
pubkey_t = ctypes.POINTER(pubkey_st)
757
758
x509_crt_fmt_t = ctypes.c_int
759
760
# All the function declarations below are from gnutls/abstract.h
761
pubkey_init = _library.gnutls_pubkey_init
762
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
pubkey_init.restype = _error_code
764
765
pubkey_import = _library.gnutls_pubkey_import
766
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
767
x509_crt_fmt_t]
768
pubkey_import.restype = _error_code
769
770
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
771
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
772
ctypes.POINTER(ctypes.c_ubyte),
773
ctypes.POINTER(ctypes.c_size_t)]
774
pubkey_get_key_id.restype = _error_code
775
776
pubkey_deinit = _library.gnutls_pubkey_deinit
777
pubkey_deinit.argtypes = [pubkey_t]
778
pubkey_deinit.restype = None
779
else:
780
# All the function declarations below are from gnutls/openpgp.h
781
782
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
784
openpgp_crt_init.restype = _error_code
785
786
openpgp_crt_import = _library.gnutls_openpgp_crt_import
787
openpgp_crt_import.argtypes = [openpgp_crt_t,
788
ctypes.POINTER(datum_t),
789
openpgp_crt_fmt_t]
790
openpgp_crt_import.restype = _error_code
791
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
795
openpgp_crt_verify_self.restype = _error_code
796
797
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
798
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
799
openpgp_crt_deinit.restype = None
800
801
openpgp_crt_get_fingerprint = (
802
_library.gnutls_openpgp_crt_get_fingerprint)
803
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
804
ctypes.c_void_p,
805
ctypes.POINTER(
806
ctypes.c_size_t)]
807
openpgp_crt_get_fingerprint.restype = _error_code
808
809
if check_version(b"3.6.4"):
810
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
812
certificate_type_get2.restype = _error_code
813
814
# Remove non-public functions
815
del _error_code, _retry_on_error
816
817
818
427
def call_pipe(connection, # : multiprocessing.Connection
819
428
func, *args, **kwargs):
820
429
"""This function is meant to be called by multiprocessing.Process
821
430
822
431
This function runs func(*args, **kwargs), and writes the resulting
823
432
return value on the provided multiprocessing.Connection.
824
433
"""
825
434
connection.send(func(*args, **kwargs))
826
435
connection.close()
827
436
828
829
class Client:
437
class Client(object):
830
438
"""A representation of a client host served by this server.
831
439
832
440
Attributes:
833
441
approved: bool(); 'None' if not yet approved/disapproved
834
442
approval_delay: datetime.timedelta(); Time to wait for approval
835
443
approval_duration: datetime.timedelta(); Duration of one approval
836
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
838
running.
839
checker_callback_tag: a GLib event source tag, or None
444
checker: subprocess.Popen(); a running checker process used
445
to see if the client lives.
446
'None' if no process is running.
447
checker_callback_tag: a gobject event source tag, or None
840
448
checker_command: string; External command which is run to check
841
449
if client lives. %() expansions are done at
842
450
runtime with vars(self) as dict, so that for
843
451
instance %(name)s can be used in the command.
844
checker_initiator_tag: a GLib event source tag, or None
452
checker_initiator_tag: a gobject event source tag, or None
845
453
created: datetime.datetime(); (UTC) object creation
846
454
client_structure: Object describing what attributes a client has
847
455
and is used for storing the client at exit
848
456
current_checker_command: string; current running checker_command
849
disable_initiator_tag: a GLib event source tag, or None
457
disable_initiator_tag: a gobject event source tag, or None
850
458
enabled: bool()
851
459
fingerprint: string (40 or 32 hexadecimal digits); used to
852
uniquely identify an OpenPGP client
853
key_id: string (64 hexadecimal digits); used to uniquely identify
854
a client using raw public keys
460
uniquely identify the client
855
461
host: string; available for use by the checker command
856
462
interval: datetime.timedelta(); How often to start a new checker
857
463
last_approval_request: datetime.datetime(); (UTC) or None
873
479
disabled, or None
874
480
server_settings: The server_settings dict from main()
875
481
"""
876
482
877
483
runtime_expansions = ("approval_delay", "approval_duration",
878
"created", "enabled", "expires", "key_id",
484
"created", "enabled", "expires",
879
485
"fingerprint", "host", "interval",
880
486
"last_approval_request", "last_checked_ok",
881
487
"last_enabled", "name", "timeout")
890
496
"approved_by_default": "True",
891
497
"enabled": "True",
892
498
}
893
499
894
500
@staticmethod
895
501
def config_parser(config):
896
502
"""Construct a new dict of client settings of this form:
903
509
for client_name in config.sections():
904
510
section = dict(config.items(client_name))
905
511
client = settings[client_name] = {}
906
512
907
513
client["host"] = section["host"]
908
514
# Reformat values from string types to Python types
909
515
client["approved_by_default"] = config.getboolean(
910
516
client_name, "approved_by_default")
911
517
client["enabled"] = config.getboolean(client_name,
912
518
"enabled")
913
914
# Uppercase and remove spaces from key_id and fingerprint
915
# for later comparison purposes with return value from the
916
# key_id() and fingerprint() functions
917
client["key_id"] = (section.get("key_id", "").upper()
918
.replace(" ", ""))
519
520
# Uppercase and remove spaces from fingerprint for later
521
# comparison purposes with return value from the
522
# fingerprint() function
919
523
client["fingerprint"] = (section["fingerprint"].upper()
920
524
.replace(" ", ""))
921
525
if "secret" in section:
922
client["secret"] = codecs.decode(section["secret"]
923
.encode("utf-8"),
924
"base64")
526
client["secret"] = section["secret"].decode("base64")
925
527
elif "secfile" in section:
926
528
with open(os.path.expanduser(os.path.expandvars
927
529
(section["secfile"])),
942
544
client["last_approval_request"] = None
943
545
client["last_checked_ok"] = None
944
546
client["last_checker_status"] = -2
945
547
946
548
return settings
947
948
def __init__(self, settings, name=None, server_settings=None):
549
550
def __init__(self, settings, name = None, server_settings=None):
949
551
self.name = name
950
552
if server_settings is None:
951
553
server_settings = {}
953
555
# adding all client settings
954
556
for setting, value in settings.items():
955
557
setattr(self, setting, value)
956
558
957
559
if self.enabled:
958
560
if not hasattr(self, "last_enabled"):
959
561
self.last_enabled = datetime.datetime.utcnow()
963
565
else:
964
566
self.last_enabled = None
965
567
self.expires = None
966
568
967
569
logger.debug("Creating client %r", self.name)
968
logger.debug(" Key ID: %s", self.key_id)
969
570
logger.debug(" Fingerprint: %s", self.fingerprint)
970
571
self.created = settings.get("created",
971
572
datetime.datetime.utcnow())
972
573
973
574
# attributes specific for this server instance
974
575
self.checker = None
975
576
self.checker_initiator_tag = None
981
582
self.changedstate = multiprocessing_manager.Condition(
982
583
multiprocessing_manager.Lock())
983
584
self.client_structure = [attr
984
for attr in self.__dict__.keys()
585
for attr in self.__dict__.iterkeys()
985
586
if not attr.startswith("_")]
986
587
self.client_structure.append("client_structure")
987
588
988
589
for name, t in inspect.getmembers(
989
590
type(self), lambda obj: isinstance(obj, property)):
990
591
if not name.startswith("_"):
991
592
self.client_structure.append(name)
992
593
993
594
# Send notice to process children that client state has changed
994
595
def send_changedstate(self):
995
596
with self.changedstate:
996
597
self.changedstate.notify_all()
997
598
998
599
def enable(self):
999
600
"""Start this client's checker and timeout hooks"""
1000
601
if getattr(self, "enabled", False):
1005
606
self.last_enabled = datetime.datetime.utcnow()
1006
607
self.init_checker()
1007
608
self.send_changedstate()
1008
609
1009
610
def disable(self, quiet=True):
1010
611
"""Disable this client."""
1011
612
if not getattr(self, "enabled", False):
1013
614
if not quiet:
1014
615
logger.info("Disabling client %s", self.name)
1015
616
if getattr(self, "disable_initiator_tag", None) is not None:
1016
GLib.source_remove(self.disable_initiator_tag)
617
gobject.source_remove(self.disable_initiator_tag)
1017
618
self.disable_initiator_tag = None
1018
619
self.expires = None
1019
620
if getattr(self, "checker_initiator_tag", None) is not None:
1020
GLib.source_remove(self.checker_initiator_tag)
621
gobject.source_remove(self.checker_initiator_tag)
1021
622
self.checker_initiator_tag = None
1022
623
self.stop_checker()
1023
624
self.enabled = False
1024
625
if not quiet:
1025
626
self.send_changedstate()
1026
# Do not run this again if called by a GLib.timeout_add
627
# Do not run this again if called by a gobject.timeout_add
1027
628
return False
1028
629
1029
630
def __del__(self):
1030
631
self.disable()
1031
632
1032
633
def init_checker(self):
1033
634
# Schedule a new checker to be started an 'interval' from now,
1034
635
# and every interval from then on.
1035
636
if self.checker_initiator_tag is not None:
1036
GLib.source_remove(self.checker_initiator_tag)
1037
self.checker_initiator_tag = GLib.timeout_add(
637
gobject.source_remove(self.checker_initiator_tag)
638
self.checker_initiator_tag = gobject.timeout_add(
1038
639
int(self.interval.total_seconds() * 1000),
1039
640
self.start_checker)
1040
641
# Schedule a disable() when 'timeout' has passed
1041
642
if self.disable_initiator_tag is not None:
1042
GLib.source_remove(self.disable_initiator_tag)
1043
self.disable_initiator_tag = GLib.timeout_add(
643
gobject.source_remove(self.disable_initiator_tag)
644
self.disable_initiator_tag = gobject.timeout_add(
1044
645
int(self.timeout.total_seconds() * 1000), self.disable)
1045
646
# Also start a new checker *right now*.
1046
647
self.start_checker()
1047
648
1048
649
def checker_callback(self, source, condition, connection,
1049
650
command):
1050
651
"""The checker has completed, so take appropriate actions."""
652
self.checker_callback_tag = None
653
self.checker = None
1051
654
# Read return code from connection (see call_pipe)
1052
655
returncode = connection.recv()
1053
656
connection.close()
1054
if self.checker is not None:
1055
self.checker.join()
1056
self.checker_callback_tag = None
1057
self.checker = None
1058
657
1059
658
if returncode >= 0:
1060
659
self.last_checker_status = returncode
1061
660
self.last_checker_signal = None
1071
670
logger.warning("Checker for %(name)s crashed?",
1072
671
vars(self))
1073
672
return False
1074
673
1075
674
def checked_ok(self):
1076
675
"""Assert that the client has been seen, alive and well."""
1077
676
self.last_checked_ok = datetime.datetime.utcnow()
1078
677
self.last_checker_status = 0
1079
678
self.last_checker_signal = None
1080
679
self.bump_timeout()
1081
680
1082
681
def bump_timeout(self, timeout=None):
1083
682
"""Bump up the timeout for this client."""
1084
683
if timeout is None:
1085
684
timeout = self.timeout
1086
685
if self.disable_initiator_tag is not None:
1087
GLib.source_remove(self.disable_initiator_tag)
686
gobject.source_remove(self.disable_initiator_tag)
1088
687
self.disable_initiator_tag = None
1089
688
if getattr(self, "enabled", False):
1090
self.disable_initiator_tag = GLib.timeout_add(
689
self.disable_initiator_tag = gobject.timeout_add(
1091
690
int(timeout.total_seconds() * 1000), self.disable)
1092
691
self.expires = datetime.datetime.utcnow() + timeout
1093
692
1094
693
def need_approval(self):
1095
694
self.last_approval_request = datetime.datetime.utcnow()
1096
695
1097
696
def start_checker(self):
1098
697
"""Start a new checker subprocess if one is not running.
1099
698
1100
699
If a checker already exists, leave it running and do
1101
700
nothing."""
1102
701
# The reason for not killing a running checker is that if we
1107
706
# checkers alone, the checker would have to take more time
1108
707
# than 'timeout' for the client to be disabled, which is as it
1109
708
# should be.
1110
709
1111
710
if self.checker is not None and not self.checker.is_alive():
1112
711
logger.warning("Checker was not alive; joining")
1113
712
self.checker.join()
1117
716
# Escape attributes for the shell
1118
717
escaped_attrs = {
1119
718
attr: re.escape(str(getattr(self, attr)))
1120
for attr in self.runtime_expansions}
719
for attr in self.runtime_expansions }
1121
720
try:
1122
721
command = self.checker_command % escaped_attrs
1123
722
except TypeError as error:
1135
734
# The exception is when not debugging but nevertheless
1136
735
# running in the foreground; use the previously
1137
736
# created wnull.
1138
popen_args = {"close_fds": True,
1139
"shell": True,
1140
"cwd": "/"}
737
popen_args = { "close_fds": True,
738
"shell": True,
739
"cwd": "/" }
1141
740
if (not self.server_settings["debug"]
1142
741
and self.server_settings["foreground"]):
1143
742
popen_args.update({"stdout": wnull,
1144
"stderr": wnull})
1145
pipe = multiprocessing.Pipe(duplex=False)
743
"stderr": wnull })
744
pipe = multiprocessing.Pipe(duplex = False)
1146
745
self.checker = multiprocessing.Process(
1147
target=call_pipe,
1148
args=(pipe[1], subprocess.call, command),
1149
kwargs=popen_args)
746
target = call_pipe,
747
args = (pipe[1], subprocess.call, command),
748
kwargs = popen_args)
1150
749
self.checker.start()
1151
self.checker_callback_tag = GLib.io_add_watch(
1152
GLib.IOChannel.unix_new(pipe[0].fileno()),
1153
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
750
self.checker_callback_tag = gobject.io_add_watch(
751
pipe[0].fileno(), gobject.IO_IN,
1154
752
self.checker_callback, pipe[0], command)
1155
# Re-run this periodically if run by GLib.timeout_add
753
# Re-run this periodically if run by gobject.timeout_add
1156
754
return True
1157
755
1158
756
def stop_checker(self):
1159
757
"""Force the checker process, if any, to stop."""
1160
758
if self.checker_callback_tag:
1161
GLib.source_remove(self.checker_callback_tag)
759
gobject.source_remove(self.checker_callback_tag)
1162
760
self.checker_callback_tag = None
1163
761
if getattr(self, "checker", None) is None:
1164
762
return
1173
771
byte_arrays=False):
1174
772
"""Decorators for marking methods of a DBusObjectWithProperties to
1175
773
become properties on the D-Bus.
1176
774
1177
775
The decorated method will be called with no arguments by "Get"
1178
776
and with one argument by "Set".
1179
777
1180
778
The parameters, where they are supported, are the same as
1181
779
dbus.service.method, except there is only "signature", since the
1182
780
type from Get() and the type sent to Set() is the same.
1186
784
if byte_arrays and signature != "ay":
1187
785
raise ValueError("Byte arrays not supported for non-'ay'"
1188
786
" signature {!r}".format(signature))
1189
787
1190
788
def decorator(func):
1191
789
func._dbus_is_property = True
1192
790
func._dbus_interface = dbus_interface
1195
793
func._dbus_name = func.__name__
1196
794
if func._dbus_name.endswith("_dbus_property"):
1197
795
func._dbus_name = func._dbus_name[:-14]
1198
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
796
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1199
797
return func
1200
798
1201
799
return decorator
1202
800
1203
801
1204
802
def dbus_interface_annotations(dbus_interface):
1205
803
"""Decorator for marking functions returning interface annotations
1206
804
1207
805
Usage:
1208
806
1209
807
@dbus_interface_annotations("org.example.Interface")
1210
808
def _foo(self): # Function name does not matter
1211
809
return {"org.freedesktop.DBus.Deprecated": "true",
1212
810
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1213
811
"false"}
1214
812
"""
1215
813
1216
814
def decorator(func):
1217
815
func._dbus_is_interface = True
1218
816
func._dbus_interface = dbus_interface
1219
817
func._dbus_name = dbus_interface
1220
818
return func
1221
819
1222
820
return decorator
1223
821
1224
822
1225
823
def dbus_annotations(annotations):
1226
824
"""Decorator to annotate D-Bus methods, signals or properties
1227
825
Usage:
1228
826
1229
827
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1230
828
"org.freedesktop.DBus.Property."
1231
829
"EmitsChangedSignal": "false"})
1233
831
access="r")
1234
832
def Property_dbus_property(self):
1235
833
return dbus.Boolean(False)
1236
1237
See also the DBusObjectWithAnnotations class.
1238
834
"""
1239
835
1240
836
def decorator(func):
1241
837
func._dbus_annotations = annotations
1242
838
return func
1243
839
1244
840
return decorator
1245
841
1246
842
1262
858
pass
1263
859
1264
860
1265
class DBusObjectWithAnnotations(dbus.service.Object):
1266
"""A D-Bus object with annotations.
1267
1268
Classes inheriting from this can use the dbus_annotations
1269
decorator to add annotations to methods or signals.
861
class DBusObjectWithProperties(dbus.service.Object):
862
"""A D-Bus object with properties.
863
864
Classes inheriting from this can use the dbus_service_property
865
decorator to expose methods as D-Bus properties. It exposes the
866
standard Get(), Set(), and GetAll() methods on the D-Bus.
1270
867
"""
1271
868
1272
869
@staticmethod
1273
870
def _is_dbus_thing(thing):
1274
871
"""Returns a function testing if an attribute is a D-Bus thing
1275
872
1276
873
If called like _is_dbus_thing("method") it returns a function
1277
874
suitable for use as predicate to inspect.getmembers().
1278
875
"""
1279
876
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1280
877
False)
1281
878
1282
879
def _get_all_dbus_things(self, thing):
1283
880
"""Returns a generator of (name, attribute) pairs
1284
881
"""
1287
884
for cls in self.__class__.__mro__
1288
885
for name, athing in
1289
886
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1290
1291
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1292
out_signature="s",
1293
path_keyword='object_path',
1294
connection_keyword='connection')
1295
def Introspect(self, object_path, connection):
1296
"""Overloading of standard D-Bus method.
1297
1298
Inserts annotation tags on methods and signals.
1299
"""
1300
xmlstring = dbus.service.Object.Introspect(self, object_path,
1301
connection)
1302
try:
1303
document = xml.dom.minidom.parseString(xmlstring)
1304
1305
for if_tag in document.getElementsByTagName("interface"):
1306
# Add annotation tags
1307
for typ in ("method", "signal"):
1308
for tag in if_tag.getElementsByTagName(typ):
1309
annots = dict()
1310
for name, prop in (self.
1311
_get_all_dbus_things(typ)):
1312
if (name == tag.getAttribute("name")
1313
and prop._dbus_interface
1314
== if_tag.getAttribute("name")):
1315
annots.update(getattr(
1316
prop, "_dbus_annotations", {}))
1317
for name, value in annots.items():
1318
ann_tag = document.createElement(
1319
"annotation")
1320
ann_tag.setAttribute("name", name)
1321
ann_tag.setAttribute("value", value)
1322
tag.appendChild(ann_tag)
1323
# Add interface annotation tags
1324
for annotation, value in dict(
1325
itertools.chain.from_iterable(
1326
annotations().items()
1327
for name, annotations
1328
in self._get_all_dbus_things("interface")
1329
if name == if_tag.getAttribute("name")
1330
)).items():
1331
ann_tag = document.createElement("annotation")
1332
ann_tag.setAttribute("name", annotation)
1333
ann_tag.setAttribute("value", value)
1334
if_tag.appendChild(ann_tag)
1335
# Fix argument name for the Introspect method itself
1336
if (if_tag.getAttribute("name")
1337
== dbus.INTROSPECTABLE_IFACE):
1338
for cn in if_tag.getElementsByTagName("method"):
1339
if cn.getAttribute("name") == "Introspect":
1340
for arg in cn.getElementsByTagName("arg"):
1341
if (arg.getAttribute("direction")
1342
== "out"):
1343
arg.setAttribute("name",
1344
"xml_data")
1345
xmlstring = document.toxml("utf-8")
1346
document.unlink()
1347
except (AttributeError, xml.dom.DOMException,
1348
xml.parsers.expat.ExpatError) as error:
1349
logger.error("Failed to override Introspection method",
1350
exc_info=error)
1351
return xmlstring
1352
1353
1354
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1355
"""A D-Bus object with properties.
1356
1357
Classes inheriting from this can use the dbus_service_property
1358
decorator to expose methods as D-Bus properties. It exposes the
1359
standard Get(), Set(), and GetAll() methods on the D-Bus.
1360
"""
1361
887
1362
888
def _get_dbus_property(self, interface_name, property_name):
1363
889
"""Returns a bound method if one exists which is a D-Bus
1364
890
property with the specified name and interface.
1369
895
if (value._dbus_name == property_name
1370
896
and value._dbus_interface == interface_name):
1371
897
return value.__get__(self)
1372
898
1373
899
# No such property
1374
900
raise DBusPropertyNotFound("{}:{}.{}".format(
1375
901
self.dbus_object_path, interface_name, property_name))
1376
1377
@classmethod
1378
def _get_all_interface_names(cls):
1379
"""Get a sequence of all interfaces supported by an object"""
1380
return (name for name in set(getattr(getattr(x, attr),
1381
"_dbus_interface", None)
1382
for x in (inspect.getmro(cls))
1383
for attr in dir(x))
1384
if name is not None)
1385
902
1386
903
@dbus.service.method(dbus.PROPERTIES_IFACE,
1387
904
in_signature="ss",
1388
905
out_signature="v")
1396
913
if not hasattr(value, "variant_level"):
1397
914
return value
1398
915
return type(value)(value, variant_level=value.variant_level+1)
1399
916
1400
917
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1401
918
def Set(self, interface_name, property_name, value):
1402
919
"""Standard D-Bus property Set() method, see D-Bus standard.
1411
928
raise ValueError("Byte arrays not supported for non-"
1412
929
"'ay' signature {!r}"
1413
930
.format(prop._dbus_signature))
1414
value = dbus.ByteArray(bytes(value))
931
value = dbus.ByteArray(b''.join(chr(byte)
932
for byte in value))
1415
933
prop(value)
1416
934
1417
935
@dbus.service.method(dbus.PROPERTIES_IFACE,
1418
936
in_signature="s",
1419
937
out_signature="a{sv}")
1420
938
def GetAll(self, interface_name):
1421
939
"""Standard D-Bus property GetAll() method, see D-Bus
1422
940
standard.
1423
941
1424
942
Note: Will not include properties with access="write".
1425
943
"""
1426
944
properties = {}
1437
955
properties[name] = value
1438
956
continue
1439
957
properties[name] = type(value)(
1440
value, variant_level=value.variant_level + 1)
958
value, variant_level = value.variant_level + 1)
1441
959
return dbus.Dictionary(properties, signature="sv")
1442
960
1443
961
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1444
962
def PropertiesChanged(self, interface_name, changed_properties,
1445
963
invalidated_properties):
1447
965
standard.
1448
966
"""
1449
967
pass
1450
968
1451
969
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1452
970
out_signature="s",
1453
971
path_keyword='object_path',
1454
972
connection_keyword='connection')
1455
973
def Introspect(self, object_path, connection):
1456
974
"""Overloading of standard D-Bus method.
1457
975
1458
976
Inserts property tags and interface annotation tags.
1459
977
"""
1460
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1461
object_path,
1462
connection)
978
xmlstring = dbus.service.Object.Introspect(self, object_path,
979
connection)
1463
980
try:
1464
981
document = xml.dom.minidom.parseString(xmlstring)
1465
982
1466
983
def make_tag(document, name, prop):
1467
984
e = document.createElement("property")
1468
985
e.setAttribute("name", name)
1469
986
e.setAttribute("type", prop._dbus_signature)
1470
987
e.setAttribute("access", prop._dbus_access)
1471
988
return e
1472
989
1473
990
for if_tag in document.getElementsByTagName("interface"):
1474
991
# Add property tags
1475
992
for tag in (make_tag(document, name, prop)
1478
995
if prop._dbus_interface
1479
996
== if_tag.getAttribute("name")):
1480
997
if_tag.appendChild(tag)
1481
# Add annotation tags for properties
1482
for tag in if_tag.getElementsByTagName("property"):
1483
annots = dict()
1484
for name, prop in self._get_all_dbus_things(
1485
"property"):
1486
if (name == tag.getAttribute("name")
1487
and prop._dbus_interface
1488
== if_tag.getAttribute("name")):
1489
annots.update(getattr(
1490
prop, "_dbus_annotations", {}))
1491
for name, value in annots.items():
1492
ann_tag = document.createElement(
1493
"annotation")
1494
ann_tag.setAttribute("name", name)
1495
ann_tag.setAttribute("value", value)
1496
tag.appendChild(ann_tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr(
1008
prop, "_dbus_annotations", {}))
1009
for name, value in annots.items():
1010
ann_tag = document.createElement(
1011
"annotation")
1012
ann_tag.setAttribute("name", name)
1013
ann_tag.setAttribute("value", value)
1014
tag.appendChild(ann_tag)
1015
# Add interface annotation tags
1016
for annotation, value in dict(
1017
itertools.chain.from_iterable(
1018
annotations().items()
1019
for name, annotations
1020
in self._get_all_dbus_things("interface")
1021
if name == if_tag.getAttribute("name")
1022
)).items():
1023
ann_tag = document.createElement("annotation")
1024
ann_tag.setAttribute("name", annotation)
1025
ann_tag.setAttribute("value", value)
1026
if_tag.appendChild(ann_tag)
1497
1027
# Add the names to the return values for the
1498
1028
# "org.freedesktop.DBus.Properties" methods
1499
1029
if (if_tag.getAttribute("name")
1518
1048
return xmlstring
1519
1049
1520
1050
1521
try:
1522
dbus.OBJECT_MANAGER_IFACE
1523
except AttributeError:
1524
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1525
1526
1527
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1528
"""A D-Bus object with an ObjectManager.
1529
1530
Classes inheriting from this exposes the standard
1531
GetManagedObjects call and the InterfacesAdded and
1532
InterfacesRemoved signals on the standard
1533
"org.freedesktop.DBus.ObjectManager" interface.
1534
1535
Note: No signals are sent automatically; they must be sent
1536
manually.
1537
"""
1538
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1539
out_signature="a{oa{sa{sv}}}")
1540
def GetManagedObjects(self):
1541
"""This function must be overridden"""
1542
raise NotImplementedError()
1543
1544
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1545
signature="oa{sa{sv}}")
1546
def InterfacesAdded(self, object_path, interfaces_and_properties):
1547
pass
1548
1549
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1550
def InterfacesRemoved(self, object_path, interfaces):
1551
pass
1552
1553
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1554
out_signature="s",
1555
path_keyword='object_path',
1556
connection_keyword='connection')
1557
def Introspect(self, object_path, connection):
1558
"""Overloading of standard D-Bus method.
1559
1560
Override return argument name of GetManagedObjects to be
1561
"objpath_interfaces_and_properties"
1562
"""
1563
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1564
object_path,
1565
connection)
1566
try:
1567
document = xml.dom.minidom.parseString(xmlstring)
1568
1569
for if_tag in document.getElementsByTagName("interface"):
1570
# Fix argument name for the GetManagedObjects method
1571
if (if_tag.getAttribute("name")
1572
== dbus.OBJECT_MANAGER_IFACE):
1573
for cn in if_tag.getElementsByTagName("method"):
1574
if (cn.getAttribute("name")
1575
== "GetManagedObjects"):
1576
for arg in cn.getElementsByTagName("arg"):
1577
if (arg.getAttribute("direction")
1578
== "out"):
1579
arg.setAttribute(
1580
"name",
1581
"objpath_interfaces"
1582
"_and_properties")
1583
xmlstring = document.toxml("utf-8")
1584
document.unlink()
1585
except (AttributeError, xml.dom.DOMException,
1586
xml.parsers.expat.ExpatError) as error:
1587
logger.error("Failed to override Introspection method",
1588
exc_info=error)
1589
return xmlstring
1590
1591
1592
1051
def datetime_to_dbus(dt, variant_level=0):
1593
1052
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1594
1053
if dt is None:
1595
return dbus.String("", variant_level=variant_level)
1054
return dbus.String("", variant_level = variant_level)
1596
1055
return dbus.String(dt.isoformat(), variant_level=variant_level)
1597
1056
1598
1057
1601
1060
dbus.service.Object, it will add alternate D-Bus attributes with
1602
1061
interface names according to the "alt_interface_names" mapping.
1603
1062
Usage:
1604
1063
1605
1064
@alternate_dbus_interfaces({"org.example.Interface":
1606
1065
"net.example.AlternateInterface"})
1607
1066
class SampleDBusObject(dbus.service.Object):
1608
1067
@dbus.service.method("org.example.Interface")
1609
1068
def SampleDBusMethod():
1610
1069
pass
1611
1070
1612
1071
The above "SampleDBusMethod" on "SampleDBusObject" will be
1613
1072
reachable via two interfaces: "org.example.Interface" and
1614
1073
"net.example.AlternateInterface", the latter of which will have
1615
1074
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1616
1075
"true", unless "deprecate" is passed with a False value.
1617
1076
1618
1077
This works for methods and signals, and also for D-Bus properties
1619
1078
(from DBusObjectWithProperties) and interfaces (from the
1620
1079
dbus_interface_annotations decorator).
1621
1080
"""
1622
1081
1623
1082
def wrapper(cls):
1624
1083
for orig_interface_name, alt_interface_name in (
1625
1084
alt_interface_names.items()):
1640
1099
interface_names.add(alt_interface)
1641
1100
# Is this a D-Bus signal?
1642
1101
if getattr(attribute, "_dbus_is_signal", False):
1643
# Extract the original non-method undecorated
1644
# function by black magic
1645
1102
if sys.version_info.major == 2:
1103
# Extract the original non-method undecorated
1104
# function by black magic
1646
1105
nonmethod_func = (dict(
1647
1106
zip(attribute.func_code.co_freevars,
1648
1107
attribute.__closure__))
1649
1108
["func"].cell_contents)
1650
1109
else:
1651
nonmethod_func = (dict(
1652
zip(attribute.__code__.co_freevars,
1653
attribute.__closure__))
1654
["func"].cell_contents)
1110
nonmethod_func = attribute
1655
1111
# Create a new, but exactly alike, function
1656
1112
# object, and decorate it to be a new D-Bus signal
1657
1113
# with the alternate D-Bus interface name
1658
new_function = copy_function(nonmethod_func)
1114
if sys.version_info.major == 2:
1115
new_function = types.FunctionType(
1116
nonmethod_func.func_code,
1117
nonmethod_func.func_globals,
1118
nonmethod_func.func_name,
1119
nonmethod_func.func_defaults,
1120
nonmethod_func.func_closure)
1121
else:
1122
new_function = types.FunctionType(
1123
nonmethod_func.__code__,
1124
nonmethod_func.__globals__,
1125
nonmethod_func.__name__,
1126
nonmethod_func.__defaults__,
1127
nonmethod_func.__closure__)
1659
1128
new_function = (dbus.service.signal(
1660
1129
alt_interface,
1661
1130
attribute._dbus_signature)(new_function))
1665
1134
attribute._dbus_annotations)
1666
1135
except AttributeError:
1667
1136
pass
1668
1669
1137
# Define a creator of a function to call both the
1670
1138
# original and alternate functions, so both the
1671
1139
# original and alternate signals gets sent when
1674
1142
"""This function is a scope container to pass
1675
1143
func1 and func2 to the "call_both" function
1676
1144
outside of its arguments"""
1677
1678
@functools.wraps(func2)
1145
1679
1146
def call_both(*args, **kwargs):
1680
1147
"""This function will emit two D-Bus
1681
1148
signals by calling func1 and func2"""
1682
1149
func1(*args, **kwargs)
1683
1150
func2(*args, **kwargs)
1684
# Make wrapper function look like a D-Bus
1685
# signal
1686
for name, attr in inspect.getmembers(func2):
1687
if name.startswith("_dbus_"):
1688
setattr(call_both, name, attr)
1689
1151
1690
1152
return call_both
1691
1153
# Create the "call_both" function and add it to
1692
1154
# the class
1702
1164
alt_interface,
1703
1165
attribute._dbus_in_signature,
1704
1166
attribute._dbus_out_signature)
1705
(copy_function(attribute)))
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1706
1172
# Copy annotations, if any
1707
1173
try:
1708
1174
attr[attrname]._dbus_annotations = dict(
1720
1186
attribute._dbus_access,
1721
1187
attribute._dbus_get_args_options
1722
1188
["byte_arrays"])
1723
(copy_function(attribute)))
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1724
1195
# Copy annotations, if any
1725
1196
try:
1726
1197
attr[attrname]._dbus_annotations = dict(
1735
1206
# to the class.
1736
1207
attr[attrname] = (
1737
1208
dbus_interface_annotations(alt_interface)
1738
(copy_function(attribute)))
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1739
1214
if deprecate:
1740
1215
# Deprecate all alternate interfaces
1741
iname = "_AlternateDBusNames_interface_annotation{}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1742
1217
for interface_name in interface_names:
1743
1218
1744
1219
@dbus_interface_annotations(interface_name)
1745
1220
def func(self):
1746
return {"org.freedesktop.DBus.Deprecated":
1747
"true"}
1221
return { "org.freedesktop.DBus.Deprecated":
1222
"true" }
1748
1223
# Find an unused name
1749
1224
for aname in (iname.format(i)
1750
1225
for i in itertools.count()):
1754
1229
if interface_names:
1755
1230
# Replace the class with a new subclass of it with
1756
1231
# methods, signals, etc. as created above.
1757
if sys.version_info.major == 2:
1758
cls = type(b"{}Alternate".format(cls.__name__),
1759
(cls, ), attr)
1760
else:
1761
cls = type("{}Alternate".format(cls.__name__),
1762
(cls, ), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1763
1234
return cls
1764
1235
1765
1236
return wrapper
1766
1237
1767
1238
1769
1240
"se.bsnet.fukt.Mandos"})
1770
1241
class ClientDBus(Client, DBusObjectWithProperties):
1771
1242
"""A Client class using D-Bus
1772
1243
1773
1244
Attributes:
1774
1245
dbus_object_path: dbus.ObjectPath
1775
1246
bus: dbus.SystemBus()
1776
1247
"""
1777
1248
1778
1249
runtime_expansions = (Client.runtime_expansions
1779
1250
+ ("dbus_object_path", ))
1780
1251
1781
1252
_interface = "se.recompile.Mandos.Client"
1782
1253
1783
1254
# dbus.service.Object doesn't use super(), so we can't either.
1784
1785
def __init__(self, bus=None, *args, **kwargs):
1255
1256
def __init__(self, bus = None, *args, **kwargs):
1786
1257
self.bus = bus
1787
1258
Client.__init__(self, *args, **kwargs)
1788
1259
# Only now, when this client is initialized, can it show up on
1794
1265
"/clients/" + client_object_name)
1795
1266
DBusObjectWithProperties.__init__(self, self.bus,
1796
1267
self.dbus_object_path)
1797
1268
1798
1269
def notifychangeproperty(transform_func, dbus_name,
1799
1270
type_func=lambda x: x,
1800
1271
variant_level=1,
1802
1273
_interface=_interface):
1803
1274
""" Modify a variable so that it's a property which announces
1804
1275
its changes to DBus.
1805
1276
1806
1277
transform_fun: Function that takes a value and a variant_level
1807
1278
and transforms it to a D-Bus type.
1808
1279
dbus_name: D-Bus name of the variable
1811
1282
variant_level: D-Bus variant level. Default: 1
1812
1283
"""
1813
1284
attrname = "_{}".format(dbus_name)
1814
1285
1815
1286
def setter(self, value):
1816
1287
if hasattr(self, "dbus_object_path"):
1817
1288
if (not hasattr(self, attrname) or
1824
1295
else:
1825
1296
dbus_value = transform_func(
1826
1297
type_func(value),
1827
variant_level=variant_level)
1298
variant_level = variant_level)
1828
1299
self.PropertyChanged(dbus.String(dbus_name),
1829
1300
dbus_value)
1830
1301
self.PropertiesChanged(
1831
1302
_interface,
1832
dbus.Dictionary({dbus.String(dbus_name):
1833
dbus_value}),
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1834
1305
dbus.Array())
1835
1306
setattr(self, attrname, value)
1836
1307
1837
1308
return property(lambda self: getattr(self, attrname), setter)
1838
1309
1839
1310
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1840
1311
approvals_pending = notifychangeproperty(dbus.Boolean,
1841
1312
"ApprovalPending",
1842
type_func=bool)
1313
type_func = bool)
1843
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1844
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1845
1316
"LastEnabled")
1846
1317
checker = notifychangeproperty(
1847
1318
dbus.Boolean, "CheckerRunning",
1848
type_func=lambda checker: checker is not None)
1319
type_func = lambda checker: checker is not None)
1849
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1850
1321
"LastCheckedOK")
1851
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1856
1327
"ApprovedByDefault")
1857
1328
approval_delay = notifychangeproperty(
1858
1329
dbus.UInt64, "ApprovalDelay",
1859
type_func=lambda td: td.total_seconds() * 1000)
1330
type_func = lambda td: td.total_seconds() * 1000)
1860
1331
approval_duration = notifychangeproperty(
1861
1332
dbus.UInt64, "ApprovalDuration",
1862
type_func=lambda td: td.total_seconds() * 1000)
1333
type_func = lambda td: td.total_seconds() * 1000)
1863
1334
host = notifychangeproperty(dbus.String, "Host")
1864
1335
timeout = notifychangeproperty(
1865
1336
dbus.UInt64, "Timeout",
1866
type_func=lambda td: td.total_seconds() * 1000)
1337
type_func = lambda td: td.total_seconds() * 1000)
1867
1338
extended_timeout = notifychangeproperty(
1868
1339
dbus.UInt64, "ExtendedTimeout",
1869
type_func=lambda td: td.total_seconds() * 1000)
1340
type_func = lambda td: td.total_seconds() * 1000)
1870
1341
interval = notifychangeproperty(
1871
1342
dbus.UInt64, "Interval",
1872
type_func=lambda td: td.total_seconds() * 1000)
1343
type_func = lambda td: td.total_seconds() * 1000)
1873
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1874
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1875
1346
invalidate_only=True)
1876
1347
1877
1348
del notifychangeproperty
1878
1349
1879
1350
def __del__(self, *args, **kwargs):
1880
1351
try:
1881
1352
self.remove_from_connection()
1884
1355
if hasattr(DBusObjectWithProperties, "__del__"):
1885
1356
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1886
1357
Client.__del__(self, *args, **kwargs)
1887
1358
1888
1359
def checker_callback(self, source, condition,
1889
1360
connection, command, *args, **kwargs):
1890
1361
ret = Client.checker_callback(self, source, condition,
1894
1365
if exitstatus >= 0:
1895
1366
# Emit D-Bus signal
1896
1367
self.CheckerCompleted(dbus.Int16(exitstatus),
1897
# This is specific to GNU libC
1898
dbus.Int64(exitstatus << 8),
1368
dbus.Int64(0),
1899
1369
dbus.String(command))
1900
1370
else:
1901
1371
# Emit D-Bus signal
1902
1372
self.CheckerCompleted(dbus.Int16(-1),
1903
1373
dbus.Int64(
1904
# This is specific to GNU libC
1905
(exitstatus << 8)
1906
| self.last_checker_signal),
1374
self.last_checker_signal),
1907
1375
dbus.String(command))
1908
1376
return ret
1909
1377
1910
1378
def start_checker(self, *args, **kwargs):
1911
1379
old_checker_pid = getattr(self.checker, "pid", None)
1912
1380
r = Client.start_checker(self, *args, **kwargs)
1916
1384
# Emit D-Bus signal
1917
1385
self.CheckerStarted(self.current_checker_command)
1918
1386
return r
1919
1387
1920
1388
def _reset_approved(self):
1921
1389
self.approved = None
1922
1390
return False
1923
1391
1924
1392
def approve(self, value=True):
1925
1393
self.approved = value
1926
GLib.timeout_add(int(self.approval_duration.total_seconds()
1927
* 1000), self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1928
1396
self.send_changedstate()
1929
1930
# D-Bus methods, signals & properties
1931
1932
# Interfaces
1933
1934
# Signals
1935
1397
1398
## D-Bus methods, signals & properties
1399
1400
## Interfaces
1401
1402
## Signals
1403
1936
1404
# CheckerCompleted - signal
1937
1405
@dbus.service.signal(_interface, signature="nxs")
1938
1406
def CheckerCompleted(self, exitcode, waitstatus, command):
1939
1407
"D-Bus signal"
1940
1408
pass
1941
1409
1942
1410
# CheckerStarted - signal
1943
1411
@dbus.service.signal(_interface, signature="s")
1944
1412
def CheckerStarted(self, command):
1945
1413
"D-Bus signal"
1946
1414
pass
1947
1415
1948
1416
# PropertyChanged - signal
1949
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1950
1418
@dbus.service.signal(_interface, signature="sv")
1951
1419
def PropertyChanged(self, property, value):
1952
1420
"D-Bus signal"
1953
1421
pass
1954
1422
1955
1423
# GotSecret - signal
1956
1424
@dbus.service.signal(_interface)
1957
1425
def GotSecret(self):
1960
1428
server to mandos-client
1961
1429
"""
1962
1430
pass
1963
1431
1964
1432
# Rejected - signal
1965
1433
@dbus.service.signal(_interface, signature="s")
1966
1434
def Rejected(self, reason):
1967
1435
"D-Bus signal"
1968
1436
pass
1969
1437
1970
1438
# NeedApproval - signal
1971
1439
@dbus.service.signal(_interface, signature="tb")
1972
1440
def NeedApproval(self, timeout, default):
1973
1441
"D-Bus signal"
1974
1442
return self.need_approval()
1975
1976
# Methods
1977
1443
1444
## Methods
1445
1978
1446
# Approve - method
1979
1447
@dbus.service.method(_interface, in_signature="b")
1980
1448
def Approve(self, value):
1981
1449
self.approve(value)
1982
1450
1983
1451
# CheckedOK - method
1984
1452
@dbus.service.method(_interface)
1985
1453
def CheckedOK(self):
1986
1454
self.checked_ok()
1987
1455
1988
1456
# Enable - method
1989
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1990
1457
@dbus.service.method(_interface)
1991
1458
def Enable(self):
1992
1459
"D-Bus method"
1993
1460
self.enable()
1994
1461
1995
1462
# StartChecker - method
1996
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1997
1463
@dbus.service.method(_interface)
1998
1464
def StartChecker(self):
1999
1465
"D-Bus method"
2000
1466
self.start_checker()
2001
1467
2002
1468
# Disable - method
2003
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2004
1469
@dbus.service.method(_interface)
2005
1470
def Disable(self):
2006
1471
"D-Bus method"
2007
1472
self.disable()
2008
1473
2009
1474
# StopChecker - method
2010
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2011
1475
@dbus.service.method(_interface)
2012
1476
def StopChecker(self):
2013
1477
self.stop_checker()
2014
2015
# Properties
2016
1478
1479
## Properties
1480
2017
1481
# ApprovalPending - property
2018
1482
@dbus_service_property(_interface, signature="b", access="read")
2019
1483
def ApprovalPending_dbus_property(self):
2020
1484
return dbus.Boolean(bool(self.approvals_pending))
2021
1485
2022
1486
# ApprovedByDefault - property
2023
1487
@dbus_service_property(_interface,
2024
1488
signature="b",
2027
1491
if value is None: # get
2028
1492
return dbus.Boolean(self.approved_by_default)
2029
1493
self.approved_by_default = bool(value)
2030
1494
2031
1495
# ApprovalDelay - property
2032
1496
@dbus_service_property(_interface,
2033
1497
signature="t",
2037
1501
return dbus.UInt64(self.approval_delay.total_seconds()
2038
1502
* 1000)
2039
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2040
1504
2041
1505
# ApprovalDuration - property
2042
1506
@dbus_service_property(_interface,
2043
1507
signature="t",
2047
1511
return dbus.UInt64(self.approval_duration.total_seconds()
2048
1512
* 1000)
2049
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2050
1514
2051
1515
# Name - property
2052
@dbus_annotations(
2053
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2054
1516
@dbus_service_property(_interface, signature="s", access="read")
2055
1517
def Name_dbus_property(self):
2056
1518
return dbus.String(self.name)
2057
2058
# KeyID - property
2059
@dbus_annotations(
2060
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2061
@dbus_service_property(_interface, signature="s", access="read")
2062
def KeyID_dbus_property(self):
2063
return dbus.String(self.key_id)
2064
1519
2065
1520
# Fingerprint - property
2066
@dbus_annotations(
2067
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2068
1521
@dbus_service_property(_interface, signature="s", access="read")
2069
1522
def Fingerprint_dbus_property(self):
2070
1523
return dbus.String(self.fingerprint)
2071
1524
2072
1525
# Host - property
2073
1526
@dbus_service_property(_interface,
2074
1527
signature="s",
2077
1530
if value is None: # get
2078
1531
return dbus.String(self.host)
2079
1532
self.host = str(value)
2080
1533
2081
1534
# Created - property
2082
@dbus_annotations(
2083
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2084
1535
@dbus_service_property(_interface, signature="s", access="read")
2085
1536
def Created_dbus_property(self):
2086
1537
return datetime_to_dbus(self.created)
2087
1538
2088
1539
# LastEnabled - property
2089
1540
@dbus_service_property(_interface, signature="s", access="read")
2090
1541
def LastEnabled_dbus_property(self):
2091
1542
return datetime_to_dbus(self.last_enabled)
2092
1543
2093
1544
# Enabled - property
2094
1545
@dbus_service_property(_interface,
2095
1546
signature="b",
2101
1552
self.enable()
2102
1553
else:
2103
1554
self.disable()
2104
1555
2105
1556
# LastCheckedOK - property
2106
1557
@dbus_service_property(_interface,
2107
1558
signature="s",
2111
1562
self.checked_ok()
2112
1563
return
2113
1564
return datetime_to_dbus(self.last_checked_ok)
2114
1565
2115
1566
# LastCheckerStatus - property
2116
1567
@dbus_service_property(_interface, signature="n", access="read")
2117
1568
def LastCheckerStatus_dbus_property(self):
2118
1569
return dbus.Int16(self.last_checker_status)
2119
1570
2120
1571
# Expires - property
2121
1572
@dbus_service_property(_interface, signature="s", access="read")
2122
1573
def Expires_dbus_property(self):
2123
1574
return datetime_to_dbus(self.expires)
2124
1575
2125
1576
# LastApprovalRequest - property
2126
1577
@dbus_service_property(_interface, signature="s", access="read")
2127
1578
def LastApprovalRequest_dbus_property(self):
2128
1579
return datetime_to_dbus(self.last_approval_request)
2129
1580
2130
1581
# Timeout - property
2131
1582
@dbus_service_property(_interface,
2132
1583
signature="t",
2147
1598
if (getattr(self, "disable_initiator_tag", None)
2148
1599
is None):
2149
1600
return
2150
GLib.source_remove(self.disable_initiator_tag)
2151
self.disable_initiator_tag = GLib.timeout_add(
1601
gobject.source_remove(self.disable_initiator_tag)
1602
self.disable_initiator_tag = gobject.timeout_add(
2152
1603
int((self.expires - now).total_seconds() * 1000),
2153
1604
self.disable)
2154
1605
2155
1606
# ExtendedTimeout - property
2156
1607
@dbus_service_property(_interface,
2157
1608
signature="t",
2161
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
2162
1613
* 1000)
2163
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2164
1615
2165
1616
# Interval - property
2166
1617
@dbus_service_property(_interface,
2167
1618
signature="t",
2174
1625
return
2175
1626
if self.enabled:
2176
1627
# Reschedule checker run
2177
GLib.source_remove(self.checker_initiator_tag)
2178
self.checker_initiator_tag = GLib.timeout_add(
1628
gobject.source_remove(self.checker_initiator_tag)
1629
self.checker_initiator_tag = gobject.timeout_add(
2179
1630
value, self.start_checker)
2180
self.start_checker() # Start one now, too
2181
1631
self.start_checker() # Start one now, too
1632
2182
1633
# Checker - property
2183
1634
@dbus_service_property(_interface,
2184
1635
signature="s",
2187
1638
if value is None: # get
2188
1639
return dbus.String(self.checker_command)
2189
1640
self.checker_command = str(value)
2190
1641
2191
1642
# CheckerRunning - property
2192
1643
@dbus_service_property(_interface,
2193
1644
signature="b",
2199
1650
self.start_checker()
2200
1651
else:
2201
1652
self.stop_checker()
2202
1653
2203
1654
# ObjectPath - property
2204
@dbus_annotations(
2205
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2206
"org.freedesktop.DBus.Deprecated": "true"})
2207
1655
@dbus_service_property(_interface, signature="o", access="read")
2208
1656
def ObjectPath_dbus_property(self):
2209
return self.dbus_object_path # is already a dbus.ObjectPath
2210
1657
return self.dbus_object_path # is already a dbus.ObjectPath
1658
2211
1659
# Secret = property
2212
@dbus_annotations(
2213
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2214
"invalidates"})
2215
1660
@dbus_service_property(_interface,
2216
1661
signature="ay",
2217
1662
access="write",
2218
1663
byte_arrays=True)
2219
1664
def Secret_dbus_property(self, value):
2220
1665
self.secret = bytes(value)
2221
1666
2222
1667
del _interface
2223
1668
2224
1669
2225
class ProxyClient:
2226
def __init__(self, child_pipe, key_id, fpr, address):
1670
class ProxyClient(object):
1671
def __init__(self, child_pipe, fpr, address):
2227
1672
self._pipe = child_pipe
2228
self._pipe.send(('init', key_id, fpr, address))
1673
self._pipe.send(('init', fpr, address))
2229
1674
if not self._pipe.recv():
2230
raise KeyError(key_id or fpr)
2231
1675
raise KeyError(fpr)
1676
2232
1677
def __getattribute__(self, name):
2233
1678
if name == '_pipe':
2234
1679
return super(ProxyClient, self).__getattribute__(name)
2237
1682
if data[0] == 'data':
2238
1683
return data[1]
2239
1684
if data[0] == 'function':
2240
1685
2241
1686
def func(*args, **kwargs):
2242
1687
self._pipe.send(('funcall', name, args, kwargs))
2243
1688
return self._pipe.recv()[1]
2244
1689
2245
1690
return func
2246
1691
2247
1692
def __setattr__(self, name, value):
2248
1693
if name == '_pipe':
2249
1694
return super(ProxyClient, self).__setattr__(name, value)
2252
1697
2253
1698
class ClientHandler(socketserver.BaseRequestHandler, object):
2254
1699
"""A class to handle client connections.
2255
1700
2256
1701
Instantiated once for each connection to handle it.
2257
1702
Note: This will run in its own forked process."""
2258
1703
2259
1704
def handle(self):
2260
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
2261
1706
logger.info("TCP connection from: %s",
2262
1707
str(self.client_address))
2263
1708
logger.debug("Pipe FD: %d",
2264
1709
self.server.child_pipe.fileno())
2265
2266
session = gnutls.ClientSession(self.request)
2267
2268
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2269
# "+AES-256-CBC", "+SHA1",
2270
# "+COMP-NULL", "+CTYPE-OPENPGP",
2271
# "+DHE-DSS"))
1710
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1713
1714
# Note: gnutls.connection.X509Credentials is really a
1715
# generic GnuTLS certificate credentials object so long as
1716
# no X.509 keys are added to it. Therefore, we can use it
1717
# here despite using OpenPGP certificates.
1718
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
# "+AES-256-CBC", "+SHA1",
1721
# "+COMP-NULL", "+CTYPE-OPENPGP",
1722
# "+DHE-DSS"))
2272
1723
# Use a fallback default, since this MUST be set.
2273
1724
priority = self.server.gnutls_priority
2274
1725
if priority is None:
2275
1726
priority = "NORMAL"
2276
gnutls.priority_set_direct(session._c_object,
2277
priority.encode("utf-8"),
2278
None)
2279
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1729
2280
1730
# Start communication using the Mandos protocol
2281
1731
# Get protocol number
2282
1732
line = self.request.makefile().readline()
2287
1737
except (ValueError, IndexError, RuntimeError) as error:
2288
1738
logger.error("Unknown protocol version: %s", error)
2289
1739
return
2290
1740
2291
1741
# Start GnuTLS connection
2292
1742
try:
2293
1743
session.handshake()
2294
except gnutls.Error as error:
1744
except gnutls.errors.GNUTLSError as error:
2295
1745
logger.warning("Handshake failed: %s", error)
2296
1746
# Do not run session.bye() here: the session is not
2297
1747
# established. Just abandon the request.
2298
1748
return
2299
1749
logger.debug("Handshake succeeded")
2300
1750
2301
1751
approval_required = False
2302
1752
try:
2303
if gnutls.has_rawpk:
2304
fpr = b""
2305
try:
2306
key_id = self.key_id(
2307
self.peer_certificate(session))
2308
except (TypeError, gnutls.Error) as error:
2309
logger.warning("Bad certificate: %s", error)
2310
return
2311
logger.debug("Key ID: %s", key_id)
2312
2313
else:
2314
key_id = b""
2315
try:
2316
fpr = self.fingerprint(
2317
self.peer_certificate(session))
2318
except (TypeError, gnutls.Error) as error:
2319
logger.warning("Bad certificate: %s", error)
2320
return
2321
logger.debug("Fingerprint: %s", fpr)
2322
2323
try:
2324
client = ProxyClient(child_pipe, key_id, fpr,
1753
try:
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1756
except (TypeError,
1757
gnutls.errors.GNUTLSError) as error:
1758
logger.warning("Bad certificate: %s", error)
1759
return
1760
logger.debug("Fingerprint: %s", fpr)
1761
1762
try:
1763
client = ProxyClient(child_pipe, fpr,
2325
1764
self.client_address)
2326
1765
except KeyError:
2327
1766
return
2328
1767
2329
1768
if client.approval_delay:
2330
1769
delay = client.approval_delay
2331
1770
client.approvals_pending += 1
2332
1771
approval_required = True
2333
1772
2334
1773
while True:
2335
1774
if not client.enabled:
2336
1775
logger.info("Client %s is disabled",
2339
1778
# Emit D-Bus signal
2340
1779
client.Rejected("Disabled")
2341
1780
return
2342
1781
2343
1782
if client.approved or not client.approval_delay:
2344
# We are approved or approval is disabled
1783
#We are approved or approval is disabled
2345
1784
break
2346
1785
elif client.approved is None:
2347
1786
logger.info("Client %s needs approval",
2358
1797
# Emit D-Bus signal
2359
1798
client.Rejected("Denied")
2360
1799
return
2361
2362
# wait until timeout or approved
1800
1801
#wait until timeout or approved
2363
1802
time = datetime.datetime.now()
2364
1803
client.changedstate.acquire()
2365
1804
client.changedstate.wait(delay.total_seconds())
2378
1817
break
2379
1818
else:
2380
1819
delay -= time2 - time
2381
2382
try:
2383
session.send(client.secret)
2384
except gnutls.Error as error:
2385
logger.warning("gnutls send failed",
2386
exc_info=error)
2387
return
2388
1820
1821
sent_size = 0
1822
while sent_size < len(client.secret):
1823
try:
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1827
exc_info=error)
1828
return
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1832
sent_size += sent
1833
2389
1834
logger.info("Sending secret to %s", client.name)
2390
1835
# bump the timeout using extended_timeout
2391
1836
client.bump_timeout(client.extended_timeout)
2392
1837
if self.server.use_dbus:
2393
1838
# Emit D-Bus signal
2394
1839
client.GotSecret()
2395
1840
2396
1841
finally:
2397
1842
if approval_required:
2398
1843
client.approvals_pending -= 1
2399
1844
try:
2400
1845
session.bye()
2401
except gnutls.Error as error:
1846
except gnutls.errors.GNUTLSError as error:
2402
1847
logger.warning("GnuTLS bye failed",
2403
1848
exc_info=error)
2404
1849
2405
1850
@staticmethod
2406
1851
def peer_certificate(session):
2407
"Return the peer's certificate as a bytestring"
2408
try:
2409
cert_type = gnutls.certificate_type_get2(session._c_object,
2410
gnutls.CTYPE_PEERS)
2411
except AttributeError:
2412
cert_type = gnutls.certificate_type_get(session._c_object)
2413
if gnutls.has_rawpk:
2414
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2415
else:
2416
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2417
# If not a valid certificate type...
2418
if cert_type not in valid_cert_types:
2419
logger.info("Cert type %r not in %r", cert_type,
2420
valid_cert_types)
2421
# ...return invalid data
2422
return b""
1852
"Return the peer's OpenPGP certificate as a bytestring"
1853
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2423
1859
list_size = ctypes.c_uint(1)
2424
cert_list = (gnutls.certificate_get_peers
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2425
1862
(session._c_object, ctypes.byref(list_size)))
2426
1863
if not bool(cert_list) and list_size.value != 0:
2427
raise gnutls.Error("error getting peer certificate")
1864
raise gnutls.errors.GNUTLSError("error getting peer"
1865
" certificate")
2428
1866
if list_size.value == 0:
2429
1867
return None
2430
1868
cert = cert_list[0]
2431
1869
return ctypes.string_at(cert.data, cert.size)
2432
2433
@staticmethod
2434
def key_id(certificate):
2435
"Convert a certificate bytestring to a hexdigit key ID"
2436
# New GnuTLS "datum" with the public key
2437
datum = gnutls.datum_t(
2438
ctypes.cast(ctypes.c_char_p(certificate),
2439
ctypes.POINTER(ctypes.c_ubyte)),
2440
ctypes.c_uint(len(certificate)))
2441
# XXX all these need to be created in the gnutls "module"
2442
# New empty GnuTLS certificate
2443
pubkey = gnutls.pubkey_t()
2444
gnutls.pubkey_init(ctypes.byref(pubkey))
2445
# Import the raw public key into the certificate
2446
gnutls.pubkey_import(pubkey,
2447
ctypes.byref(datum),
2448
gnutls.X509_FMT_DER)
2449
# New buffer for the key ID
2450
buf = ctypes.create_string_buffer(32)
2451
buf_len = ctypes.c_size_t(len(buf))
2452
# Get the key ID from the raw public key into the buffer
2453
gnutls.pubkey_get_key_id(pubkey,
2454
gnutls.KEYID_USE_SHA256,
2455
ctypes.cast(ctypes.byref(buf),
2456
ctypes.POINTER(ctypes.c_ubyte)),
2457
ctypes.byref(buf_len))
2458
# Deinit the certificate
2459
gnutls.pubkey_deinit(pubkey)
2460
2461
# Convert the buffer to a Python bytestring
2462
key_id = ctypes.string_at(buf, buf_len.value)
2463
# Convert the bytestring to hexadecimal notation
2464
hex_key_id = binascii.hexlify(key_id).upper()
2465
return hex_key_id
2466
1870
2467
1871
@staticmethod
2468
1872
def fingerprint(openpgp):
2469
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2470
1874
# New GnuTLS "datum" with the OpenPGP public key
2471
datum = gnutls.datum_t(
1875
datum = gnutls.library.types.gnutls_datum_t(
2472
1876
ctypes.cast(ctypes.c_char_p(openpgp),
2473
1877
ctypes.POINTER(ctypes.c_ubyte)),
2474
1878
ctypes.c_uint(len(openpgp)))
2475
1879
# New empty GnuTLS certificate
2476
crt = gnutls.openpgp_crt_t()
2477
gnutls.openpgp_crt_init(ctypes.byref(crt))
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
2478
1883
# Import the OpenPGP public key into the certificate
2479
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2480
gnutls.OPENPGP_FMT_RAW)
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2481
1887
# Verify the self signature in the key
2482
1888
crtverify = ctypes.c_uint()
2483
gnutls.openpgp_crt_verify_self(crt, 0,
2484
ctypes.byref(crtverify))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2485
1891
if crtverify.value != 0:
2486
gnutls.openpgp_crt_deinit(crt)
2487
raise gnutls.CertificateSecurityError(code
2488
=crtverify.value)
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
2489
1895
# New buffer for the fingerprint
2490
1896
buf = ctypes.create_string_buffer(20)
2491
1897
buf_len = ctypes.c_size_t()
2492
1898
# Get the fingerprint from the certificate into the buffer
2493
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2494
ctypes.byref(buf_len))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2495
1901
# Deinit the certificate
2496
gnutls.openpgp_crt_deinit(crt)
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2497
1903
# Convert the buffer to a Python bytestring
2498
1904
fpr = ctypes.string_at(buf, buf_len.value)
2499
1905
# Convert the bytestring to hexadecimal notation
2501
1907
return hex_fpr
2502
1908
2503
1909
2504
class MultiprocessingMixIn:
1910
class MultiprocessingMixIn(object):
2505
1911
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2506
1912
2507
1913
def sub_process_main(self, request, address):
2508
1914
try:
2509
1915
self.finish_request(request, address)
2510
1916
except Exception:
2511
1917
self.handle_error(request, address)
2512
1918
self.close_request(request)
2513
1919
2514
1920
def process_request(self, request, address):
2515
1921
"""Start a new process to process the request."""
2516
proc = multiprocessing.Process(target=self.sub_process_main,
2517
args=(request, address))
1922
proc = multiprocessing.Process(target = self.sub_process_main,
1923
args = (request, address))
2518
1924
proc.start()
2519
1925
return proc
2520
1926
2521
1927
2522
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1928
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2523
1929
""" adds a pipe to the MixIn """
2524
1930
2525
1931
def process_request(self, request, client_address):
2526
1932
"""Overrides and wraps the original process_request().
2527
1933
2528
1934
This function creates a new pipe in self.pipe
2529
1935
"""
2530
1936
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2531
1937
2532
1938
proc = MultiprocessingMixIn.process_request(self, request,
2533
1939
client_address)
2534
1940
self.child_pipe.close()
2535
1941
self.add_pipe(parent_pipe, proc)
2536
1942
2537
1943
def add_pipe(self, parent_pipe, proc):
2538
1944
"""Dummy function; override as necessary"""
2539
1945
raise NotImplementedError()
2540
1946
2541
1947
2542
1948
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2543
socketserver.TCPServer):
1949
socketserver.TCPServer, object):
2544
1950
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2545
1951
2546
1952
Attributes:
2547
1953
enabled: Boolean; whether this server is activated yet
2548
1954
interface: None or a network interface name (string)
2549
1955
use_ipv6: Boolean; to use IPv6 or not
2550
1956
"""
2551
1957
2552
1958
def __init__(self, server_address, RequestHandlerClass,
2553
1959
interface=None,
2554
1960
use_ipv6=True,
2564
1970
self.socketfd = socketfd
2565
1971
# Save the original socket.socket() function
2566
1972
self.socket_socket = socket.socket
2567
2568
1973
# To implement --socket, we monkey patch socket.socket.
2569
#
1974
#
2570
1975
# (When socketserver.TCPServer is a new-style class, we
2571
1976
# could make self.socket into a property instead of monkey
2572
1977
# patching socket.socket.)
2573
#
1978
#
2574
1979
# Create a one-time-only replacement for socket.socket()
2575
1980
@functools.wraps(socket.socket)
2576
1981
def socket_wrapper(*args, **kwargs):
2588
1993
# socket_wrapper(), if socketfd was set.
2589
1994
socketserver.TCPServer.__init__(self, server_address,
2590
1995
RequestHandlerClass)
2591
1996
2592
1997
def server_bind(self):
2593
1998
"""This overrides the normal server_bind() function
2594
1999
to bind to an interface if one was specified, and also NOT to
2595
2000
bind to an address or port if they were not specified."""
2596
global SO_BINDTODEVICE
2597
2001
if self.interface is not None:
2598
2002
if SO_BINDTODEVICE is None:
2599
# Fall back to a hard-coded value which seems to be
2600
# common enough.
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2602
SO_BINDTODEVICE = 25
2603
try:
2604
self.socket.setsockopt(
2605
socket.SOL_SOCKET, SO_BINDTODEVICE,
2606
(self.interface + "\0").encode("utf-8"))
2607
except socket.error as error:
2608
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2611
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2614
self.interface)
2615
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2618
else:
2619
raise
2003
logger.error("SO_BINDTODEVICE does not exist;"
2004
" cannot bind to interface %s",
2005
self.interface)
2006
else:
2007
try:
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
2011
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
2016
logger.error("SO_BINDTODEVICE not available;"
2017
" cannot bind to interface %s",
2018
self.interface)
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2022
else:
2023
raise
2620
2024
# Only bind(2) the socket if we really need to.
2621
2025
if self.server_address[0] or self.server_address[1]:
2622
if self.server_address[1]:
2623
self.allow_reuse_address = True
2624
2026
if not self.server_address[0]:
2625
2027
if self.address_family == socket.AF_INET6:
2626
any_address = "::" # in6addr_any
2028
any_address = "::" # in6addr_any
2627
2029
else:
2628
any_address = "0.0.0.0" # INADDR_ANY
2030
any_address = "0.0.0.0" # INADDR_ANY
2629
2031
self.server_address = (any_address,
2630
2032
self.server_address[1])
2631
2033
elif not self.server_address[1]:
2641
2043
2642
2044
class MandosServer(IPv6_TCPServer):
2643
2045
"""Mandos server.
2644
2046
2645
2047
Attributes:
2646
2048
clients: set of Client objects
2647
2049
gnutls_priority GnuTLS priority string
2648
2050
use_dbus: Boolean; to emit D-Bus signals or not
2649
2650
Assumes a GLib.MainLoop event loop.
2051
2052
Assumes a gobject.MainLoop event loop.
2651
2053
"""
2652
2054
2653
2055
def __init__(self, server_address, RequestHandlerClass,
2654
2056
interface=None,
2655
2057
use_ipv6=True,
2665
2067
self.gnutls_priority = gnutls_priority
2666
2068
IPv6_TCPServer.__init__(self, server_address,
2667
2069
RequestHandlerClass,
2668
interface=interface,
2669
use_ipv6=use_ipv6,
2670
socketfd=socketfd)
2671
2070
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2073
2672
2074
def server_activate(self):
2673
2075
if self.enabled:
2674
2076
return socketserver.TCPServer.server_activate(self)
2675
2077
2676
2078
def enable(self):
2677
2079
self.enabled = True
2678
2080
2679
2081
def add_pipe(self, parent_pipe, proc):
2680
2082
# Call "handle_ipc" for both data and EOF events
2681
GLib.io_add_watch(
2682
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2683
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2684
2086
functools.partial(self.handle_ipc,
2685
parent_pipe=parent_pipe,
2686
proc=proc))
2687
2087
parent_pipe = parent_pipe,
2088
proc = proc))
2089
2688
2090
def handle_ipc(self, source, condition,
2689
2091
parent_pipe=None,
2690
proc=None,
2092
proc = None,
2691
2093
client_object=None):
2692
2094
# error, or the other end of multiprocessing.Pipe has closed
2693
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2694
2096
# Wait for other process to exit
2695
2097
proc.join()
2696
2098
return False
2697
2099
2698
2100
# Read a request from the child
2699
2101
request = parent_pipe.recv()
2700
2102
command = request[0]
2701
2103
2702
2104
if command == 'init':
2703
key_id = request[1].decode("ascii")
2704
fpr = request[2].decode("ascii")
2705
address = request[3]
2706
2707
for c in self.clients.values():
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2709
continue
2710
if key_id and c.key_id == key_id:
2711
client = c
2712
break
2713
if fpr and c.fingerprint == fpr:
2105
fpr = request[1]
2106
address = request[2]
2107
2108
for c in self.clients.itervalues():
2109
if c.fingerprint == fpr:
2714
2110
client = c
2715
2111
break
2716
2112
else:
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
2719
2115
if self.use_dbus:
2720
2116
# Emit D-Bus signal
2721
mandos_dbus_service.ClientNotFound(key_id or fpr,
2117
mandos_dbus_service.ClientNotFound(fpr,
2722
2118
address[0])
2723
2119
parent_pipe.send(False)
2724
2120
return False
2725
2726
GLib.io_add_watch(
2727
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2728
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2121
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2729
2125
functools.partial(self.handle_ipc,
2730
parent_pipe=parent_pipe,
2731
proc=proc,
2732
client_object=client))
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
2733
2129
parent_pipe.send(True)
2734
2130
# remove the old hook in favor of the new above hook on
2735
2131
# same fileno
2738
2134
funcname = request[1]
2739
2135
args = request[2]
2740
2136
kwargs = request[3]
2741
2137
2742
2138
parent_pipe.send(('data', getattr(client_object,
2743
2139
funcname)(*args,
2744
2140
**kwargs)))
2745
2141
2746
2142
if command == 'getattr':
2747
2143
attrname = request[1]
2748
2144
if isinstance(client_object.__getattribute__(attrname),
2751
2147
else:
2752
2148
parent_pipe.send((
2753
2149
'data', client_object.__getattribute__(attrname)))
2754
2150
2755
2151
if command == 'setattr':
2756
2152
attrname = request[1]
2757
2153
value = request[2]
2758
2154
setattr(client_object, attrname, value)
2759
2155
2760
2156
return True
2761
2157
2762
2158
2763
2159
def rfc3339_duration_to_delta(duration):
2764
2160
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2765
2766
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2767
True
2768
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2769
True
2770
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2771
True
2772
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2773
True
2774
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2775
True
2776
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2777
True
2778
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2779
True
2161
2162
>>> rfc3339_duration_to_delta("P7D")
2163
datetime.timedelta(7)
2164
>>> rfc3339_duration_to_delta("PT60S")
2165
datetime.timedelta(0, 60)
2166
>>> rfc3339_duration_to_delta("PT60M")
2167
datetime.timedelta(0, 3600)
2168
>>> rfc3339_duration_to_delta("PT24H")
2169
datetime.timedelta(1)
2170
>>> rfc3339_duration_to_delta("P1W")
2171
datetime.timedelta(7)
2172
>>> rfc3339_duration_to_delta("PT5M30S")
2173
datetime.timedelta(0, 330)
2174
>>> rfc3339_duration_to_delta("P1DT3M20S")
2175
datetime.timedelta(1, 200)
2780
2176
"""
2781
2177
2782
2178
# Parsing an RFC 3339 duration with regular expressions is not
2783
2179
# possible - there would have to be multiple places for the same
2784
2180
# values, like seconds. The current code, while more esoteric, is
2785
2181
# cleaner without depending on a parsing library. If Python had a
2786
2182
# built-in library for parsing we would use it, but we'd like to
2787
2183
# avoid excessive use of external libraries.
2788
2184
2789
2185
# New type for defining tokens, syntax, and semantics all-in-one
2790
2186
Token = collections.namedtuple("Token", (
2791
2187
"regexp", # To match token; if "value" is not None, must have
2824
2220
frozenset((token_year, token_month,
2825
2221
token_day, token_time,
2826
2222
token_week)))
2827
# Define starting values:
2828
# Value so far
2829
value = datetime.timedelta()
2223
# Define starting values
2224
value = datetime.timedelta() # Value so far
2830
2225
found_token = None
2831
# Following valid tokens
2832
followers = frozenset((token_duration, ))
2833
# String left to parse
2834
s = duration
2226
followers = frozenset((token_duration, )) # Following valid tokens
2227
s = duration # String left to parse
2835
2228
# Loop until end token is found
2836
2229
while found_token is not token_end:
2837
2230
# Search for any currently valid tokens
2861
2254
2862
2255
def string_to_delta(interval):
2863
2256
"""Parse a string and return a datetime.timedelta
2864
2865
>>> string_to_delta('7d') == datetime.timedelta(7)
2866
True
2867
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2868
True
2869
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2870
True
2871
>>> string_to_delta('24h') == datetime.timedelta(1)
2872
True
2873
>>> string_to_delta('1w') == datetime.timedelta(7)
2874
True
2875
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2876
True
2257
2258
>>> string_to_delta('7d')
2259
datetime.timedelta(7)
2260
>>> string_to_delta('60s')
2261
datetime.timedelta(0, 60)
2262
>>> string_to_delta('60m')
2263
datetime.timedelta(0, 3600)
2264
>>> string_to_delta('24h')
2265
datetime.timedelta(1)
2266
>>> string_to_delta('1w')
2267
datetime.timedelta(7)
2268
>>> string_to_delta('5m 30s')
2269
datetime.timedelta(0, 330)
2877
2270
"""
2878
2271
2879
2272
try:
2880
2273
return rfc3339_duration_to_delta(interval)
2881
2274
except ValueError:
2882
2275
pass
2883
2276
2884
2277
timevalue = datetime.timedelta(0)
2885
2278
for s in interval.split():
2886
2279
try:
2904
2297
return timevalue
2905
2298
2906
2299
2907
def daemon(nochdir=False, noclose=False):
2300
def daemon(nochdir = False, noclose = False):
2908
2301
"""See daemon(3). Standard BSD Unix function.
2909
2302
2910
2303
This should really exist as os.daemon, but it doesn't (yet)."""
2911
2304
if os.fork():
2912
2305
sys.exit()
2930
2323
2931
2324
2932
2325
def main():
2933
2326
2934
2327
##################################################################
2935
2328
# Parsing of options, both command line and config file
2936
2329
2937
2330
parser = argparse.ArgumentParser()
2938
2331
parser.add_argument("-v", "--version", action="version",
2939
version="%(prog)s {}".format(version),
2332
version = "%(prog)s {}".format(version),
2940
2333
help="show version number and exit")
2941
2334
parser.add_argument("-i", "--interface", metavar="IF",
2942
2335
help="Bind to interface IF")
2978
2371
parser.add_argument("--no-zeroconf", action="store_false",
2979
2372
dest="zeroconf", help="Do not use Zeroconf",
2980
2373
default=None)
2981
2374
2982
2375
options = parser.parse_args()
2983
2376
2377
if options.check:
2378
import doctest
2379
fail_count, test_count = doctest.testmod()
2380
sys.exit(os.EX_OK if fail_count == 0 else 1)
2381
2984
2382
# Default values for config file for server-global settings
2985
if gnutls.has_rawpk:
2986
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2987
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2988
else:
2989
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2990
":+SIGN-DSA-SHA256")
2991
server_defaults = {"interface": "",
2992
"address": "",
2993
"port": "",
2994
"debug": "False",
2995
"priority": priority,
2996
"servicename": "Mandos",
2997
"use_dbus": "True",
2998
"use_ipv6": "True",
2999
"debuglevel": "",
3000
"restore": "True",
3001
"socket": "",
3002
"statedir": "/var/lib/mandos",
3003
"foreground": "False",
3004
"zeroconf": "True",
3005
}
3006
del priority
3007
2383
server_defaults = { "interface": "",
2384
"address": "",
2385
"port": "",
2386
"debug": "False",
2387
"priority":
2388
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2389
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2390
"servicename": "Mandos",
2391
"use_dbus": "True",
2392
"use_ipv6": "True",
2393
"debuglevel": "",
2394
"restore": "True",
2395
"socket": "",
2396
"statedir": "/var/lib/mandos",
2397
"foreground": "False",
2398
"zeroconf": "True",
2399
}
2400
3008
2401
# Parse config file for server-global settings
3009
server_config = configparser.ConfigParser(server_defaults)
2402
server_config = configparser.SafeConfigParser(server_defaults)
3010
2403
del server_defaults
3011
2404
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3012
# Convert the ConfigParser object to a dict
2405
# Convert the SafeConfigParser object to a dict
3013
2406
server_settings = server_config.defaults()
3014
2407
# Use the appropriate methods on the non-string config options
3015
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3016
"foreground", "zeroconf"):
2408
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3017
2409
server_settings[option] = server_config.getboolean("DEFAULT",
3018
2410
option)
3019
2411
if server_settings["port"]:
3029
2421
server_settings["socket"] = os.dup(server_settings
3030
2422
["socket"])
3031
2423
del server_config
3032
2424
3033
2425
# Override the settings from the config file with command line
3034
2426
# options, if set.
3035
2427
for option in ("interface", "address", "port", "debug",
3053
2445
if server_settings["debug"]:
3054
2446
server_settings["foreground"] = True
3055
2447
# Now we have our good server settings in "server_settings"
3056
2448
3057
2449
##################################################################
3058
2450
3059
2451
if (not server_settings["zeroconf"]
3060
2452
and not (server_settings["port"]
3061
2453
or server_settings["socket"] != "")):
3062
2454
parser.error("Needs port or socket to work without Zeroconf")
3063
2455
3064
2456
# For convenience
3065
2457
debug = server_settings["debug"]
3066
2458
debuglevel = server_settings["debuglevel"]
3070
2462
stored_state_file)
3071
2463
foreground = server_settings["foreground"]
3072
2464
zeroconf = server_settings["zeroconf"]
3073
2465
3074
2466
if debug:
3075
2467
initlogger(debug, logging.DEBUG)
3076
2468
else:
3079
2471
else:
3080
2472
level = getattr(logging, debuglevel.upper())
3081
2473
initlogger(debug, level)
3082
2474
3083
2475
if server_settings["servicename"] != "Mandos":
3084
2476
syslogger.setFormatter(
3085
2477
logging.Formatter('Mandos ({}) [%(process)d]:'
3086
2478
' %(levelname)s: %(message)s'.format(
3087
2479
server_settings["servicename"])))
3088
2480
3089
2481
# Parse config file with clients
3090
client_config = configparser.ConfigParser(Client.client_defaults)
2482
client_config = configparser.SafeConfigParser(Client
2483
.client_defaults)
3091
2484
client_config.read(os.path.join(server_settings["configdir"],
3092
2485
"clients.conf"))
3093
2486
3094
2487
global mandos_dbus_service
3095
2488
mandos_dbus_service = None
3096
2489
3097
2490
socketfd = None
3098
2491
if server_settings["socket"] != "":
3099
2492
socketfd = server_settings["socket"]
3115
2508
except IOError as e:
3116
2509
logger.error("Could not open file %r", pidfilename,
3117
2510
exc_info=e)
3118
3119
for name, group in (("_mandos", "_mandos"),
3120
("mandos", "mandos"),
3121
("nobody", "nogroup")):
2511
2512
for name in ("_mandos", "mandos", "nobody"):
3122
2513
try:
3123
2514
uid = pwd.getpwnam(name).pw_uid
3124
gid = pwd.getpwnam(group).pw_gid
2515
gid = pwd.getpwnam(name).pw_gid
3125
2516
break
3126
2517
except KeyError:
3127
2518
continue
3131
2522
try:
3132
2523
os.setgid(gid)
3133
2524
os.setuid(uid)
3134
if debug:
3135
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3136
gid))
3137
2525
except OSError as error:
3138
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3139
.format(uid, gid, os.strerror(error.errno)))
3140
2526
if error.errno != errno.EPERM:
3141
2527
raise
3142
2528
3143
2529
if debug:
3144
2530
# Enable all possible GnuTLS debugging
3145
2531
3146
2532
# "Use a log level over 10 to enable all debugging options."
3147
2533
# - GnuTLS manual
3148
gnutls.global_set_log_level(11)
3149
3150
@gnutls.log_func
2534
gnutls.library.functions.gnutls_global_set_log_level(11)
2535
2536
@gnutls.library.types.gnutls_log_func
3151
2537
def debug_gnutls(level, string):
3152
2538
logger.debug("GnuTLS: %s", string[:-1])
3153
3154
gnutls.global_set_log_function(debug_gnutls)
3155
2539
2540
gnutls.library.functions.gnutls_global_set_log_function(
2541
debug_gnutls)
2542
3156
2543
# Redirect stdin so all checkers get /dev/null
3157
2544
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3158
2545
os.dup2(null, sys.stdin.fileno())
3159
2546
if null > 2:
3160
2547
os.close(null)
3161
2548
3162
2549
# Need to fork before connecting to D-Bus
3163
2550
if not foreground:
3164
2551
# Close all input and output, do double fork, etc.
3165
2552
daemon()
3166
3167
if gi.version_info < (3, 10, 2):
3168
# multiprocessing will use threads, so before we use GLib we
3169
# need to inform GLib that threads will be used.
3170
GLib.threads_init()
3171
2553
2554
# multiprocessing will use threads, so before we use gobject we
2555
# need to inform gobject that threads will be used.
2556
gobject.threads_init()
2557
3172
2558
global main_loop
3173
2559
# From the Avahi example code
3174
2560
DBusGMainLoop(set_as_default=True)
3175
main_loop = GLib.MainLoop()
2561
main_loop = gobject.MainLoop()
3176
2562
bus = dbus.SystemBus()
3177
2563
# End of Avahi example code
3178
2564
if use_dbus:
3191
2577
if zeroconf:
3192
2578
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
2579
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
3196
protocol=protocol,
3197
bus=bus)
2580
name = server_settings["servicename"],
2581
servicetype = "_mandos._tcp",
2582
protocol = protocol,
2583
bus = bus)
3198
2584
if server_settings["interface"]:
3199
2585
service.interface = if_nametoindex(
3200
2586
server_settings["interface"].encode("utf-8"))
3201
2587
3202
2588
global multiprocessing_manager
3203
2589
multiprocessing_manager = multiprocessing.Manager()
3204
2590
3205
2591
client_class = Client
3206
2592
if use_dbus:
3207
client_class = functools.partial(ClientDBus, bus=bus)
3208
2593
client_class = functools.partial(ClientDBus, bus = bus)
2594
3209
2595
client_settings = Client.config_parser(client_config)
3210
2596
old_client_settings = {}
3211
2597
clients_data = {}
3212
2598
3213
2599
# This is used to redirect stdout and stderr for checker processes
3214
2600
global wnull
3215
wnull = open(os.devnull, "w") # A writable /dev/null
2601
wnull = open(os.devnull, "w") # A writable /dev/null
3216
2602
# Only used if server is running in foreground but not in debug
3217
2603
# mode
3218
2604
if debug or not foreground:
3219
2605
wnull.close()
3220
2606
3221
2607
# Get client data and settings from last running state.
3222
2608
if server_settings["restore"]:
3223
2609
try:
3224
2610
with open(stored_state_path, "rb") as stored_state:
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3227
stored_state)
3228
else:
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3232
# clients_data
3233
# .keys()
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3236
else key): value
3237
for key, value in
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3243
for k, v in
3244
clients_data[key].items()}
3245
clients_data[key] = value
3246
# .client_structure
3247
value["client_structure"] = [
3248
(s.decode("utf-8")
3249
if isinstance(s, bytes)
3250
else s) for s in
3251
value["client_structure"]]
3252
# .name, .host, and .checker_command
3253
for k in ("name", "host", "checker_command"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if "key_id" not in value:
3257
value["key_id"] = ""
3258
elif "fingerprint" not in value:
3259
value["fingerprint"] = ""
3260
# old_client_settings
3261
# .keys()
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3265
else key): value
3266
for key, value in
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3269
# .host and .checker_command
3270
for value in old_client_settings.values():
3271
for attribute in ("host", "checker_command"):
3272
if isinstance(value[attribute], bytes):
3273
value[attribute] = (value[attribute]
3274
.decode("utf-8"))
2611
clients_data, old_client_settings = pickle.load(
2612
stored_state)
3275
2613
os.remove(stored_state_path)
3276
2614
except IOError as e:
3277
2615
if e.errno == errno.ENOENT:
3285
2623
logger.warning("Could not load persistent state: "
3286
2624
"EOFError:",
3287
2625
exc_info=e)
3288
2626
3289
2627
with PGPEngine() as pgp:
3290
2628
for client_name, client in clients_data.items():
3291
2629
# Skip removed clients
3292
2630
if client_name not in client_settings:
3293
2631
continue
3294
2632
3295
2633
# Decide which value to use after restoring saved state.
3296
2634
# We have three different values: Old config file,
3297
2635
# new config file, and saved state.
3308
2646
client[name] = value
3309
2647
except KeyError:
3310
2648
pass
3311
2649
3312
2650
# Clients who has passed its expire date can still be
3313
2651
# enabled if its last checker was successful. A Client
3314
2652
# whose checker succeeded before we stored its state is
3347
2685
client_name))
3348
2686
client["secret"] = (client_settings[client_name]
3349
2687
["secret"])
3350
2688
3351
2689
# Add/remove clients based on new changes made to config
3352
2690
for client_name in (set(old_client_settings)
3353
2691
- set(client_settings)):
3355
2693
for client_name in (set(client_settings)
3356
2694
- set(old_client_settings)):
3357
2695
clients_data[client_name] = client_settings[client_name]
3358
2696
3359
2697
# Create all client objects
3360
2698
for client_name, client in clients_data.items():
3361
2699
tcp_server.clients[client_name] = client_class(
3362
name=client_name,
3363
settings=client,
3364
server_settings=server_settings)
3365
2700
name = client_name,
2701
settings = client,
2702
server_settings = server_settings)
2703
3366
2704
if not tcp_server.clients:
3367
2705
logger.warning("No clients defined")
3368
2706
3369
2707
if not foreground:
3370
2708
if pidfile is not None:
3371
2709
pid = os.getpid()
3377
2715
pidfilename, pid)
3378
2716
del pidfile
3379
2717
del pidfilename
3380
3381
for termsig in (signal.SIGHUP, signal.SIGTERM):
3382
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3383
lambda: main_loop.quit() and False)
3384
2718
2719
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2720
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2721
3385
2722
if use_dbus:
3386
2723
3387
2724
@alternate_dbus_interfaces(
3388
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3389
class MandosDBusService(DBusObjectWithObjectManager):
2725
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2726
class MandosDBusService(DBusObjectWithProperties):
3390
2727
"""A D-Bus proxy object"""
3391
2728
3392
2729
def __init__(self):
3393
2730
dbus.service.Object.__init__(self, bus, "/")
3394
2731
3395
2732
_interface = "se.recompile.Mandos"
3396
2733
2734
@dbus_interface_annotations(_interface)
2735
def _foo(self):
2736
return {
2737
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2738
"false" }
2739
3397
2740
@dbus.service.signal(_interface, signature="o")
3398
2741
def ClientAdded(self, objpath):
3399
2742
"D-Bus signal"
3400
2743
pass
3401
2744
3402
2745
@dbus.service.signal(_interface, signature="ss")
3403
def ClientNotFound(self, key_id, address):
2746
def ClientNotFound(self, fingerprint, address):
3404
2747
"D-Bus signal"
3405
2748
pass
3406
3407
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3408
"true"})
2749
3409
2750
@dbus.service.signal(_interface, signature="os")
3410
2751
def ClientRemoved(self, objpath, name):
3411
2752
"D-Bus signal"
3412
2753
pass
3413
3414
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3415
"true"})
2754
3416
2755
@dbus.service.method(_interface, out_signature="ao")
3417
2756
def GetAllClients(self):
3418
2757
"D-Bus method"
3419
2758
return dbus.Array(c.dbus_object_path for c in
3420
tcp_server.clients.values())
3421
3422
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3423
"true"})
2759
tcp_server.clients.itervalues())
2760
3424
2761
@dbus.service.method(_interface,
3425
2762
out_signature="a{oa{sv}}")
3426
2763
def GetAllClientsWithProperties(self):
3427
2764
"D-Bus method"
3428
2765
return dbus.Dictionary(
3429
{c.dbus_object_path: c.GetAll(
3430
"se.recompile.Mandos.Client")
3431
for c in tcp_server.clients.values()},
2766
{ c.dbus_object_path: c.GetAll("")
2767
for c in tcp_server.clients.itervalues() },
3432
2768
signature="oa{sv}")
3433
2769
3434
2770
@dbus.service.method(_interface, in_signature="o")
3435
2771
def RemoveClient(self, object_path):
3436
2772
"D-Bus method"
3437
for c in tcp_server.clients.values():
2773
for c in tcp_server.clients.itervalues():
3438
2774
if c.dbus_object_path == object_path:
3439
2775
del tcp_server.clients[c.name]
3440
2776
c.remove_from_connection()
3441
# Don't signal the disabling
2777
# Don't signal anything except ClientRemoved
3442
2778
c.disable(quiet=True)
3443
# Emit D-Bus signal for removal
3444
self.client_removed_signal(c)
2779
# Emit D-Bus signal
2780
self.ClientRemoved(object_path, c.name)
3445
2781
return
3446
2782
raise KeyError(object_path)
3447
2783
3448
2784
del _interface
3449
3450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3451
out_signature="a{oa{sa{sv}}}")
3452
def GetManagedObjects(self):
3453
"""D-Bus method"""
3454
return dbus.Dictionary(
3455
{client.dbus_object_path:
3456
dbus.Dictionary(
3457
{interface: client.GetAll(interface)
3458
for interface in
3459
client._get_all_interface_names()})
3460
for client in tcp_server.clients.values()})
3461
3462
def client_added_signal(self, client):
3463
"""Send the new standard signal and the old signal"""
3464
if use_dbus:
3465
# New standard signal
3466
self.InterfacesAdded(
3467
client.dbus_object_path,
3468
dbus.Dictionary(
3469
{interface: client.GetAll(interface)
3470
for interface in
3471
client._get_all_interface_names()}))
3472
# Old signal
3473
self.ClientAdded(client.dbus_object_path)
3474
3475
def client_removed_signal(self, client):
3476
"""Send the new standard signal and the old signal"""
3477
if use_dbus:
3478
# New standard signal
3479
self.InterfacesRemoved(
3480
client.dbus_object_path,
3481
client._get_all_interface_names())
3482
# Old signal
3483
self.ClientRemoved(client.dbus_object_path,
3484
client.name)
3485
2785
3486
2786
mandos_dbus_service = MandosDBusService()
3487
3488
# Save modules to variables to exempt the modules from being
3489
# unloaded before the function registered with atexit() is run.
3490
mp = multiprocessing
3491
wn = wnull
3492
2787
3493
2788
def cleanup():
3494
2789
"Cleanup function; run on exit"
3495
2790
if zeroconf:
3496
2791
service.cleanup()
3497
3498
mp.active_children()
3499
wn.close()
2792
2793
multiprocessing.active_children()
2794
wnull.close()
3500
2795
if not (tcp_server.clients or client_settings):
3501
2796
return
3502
2797
3503
2798
# Store client before exiting. Secrets are encrypted with key
3504
2799
# based on what config file has. If config file is
3505
2800
# removed/edited, old secret will thus be unrecovable.
3506
2801
clients = {}
3507
2802
with PGPEngine() as pgp:
3508
for client in tcp_server.clients.values():
2803
for client in tcp_server.clients.itervalues():
3509
2804
key = client_settings[client.name]["secret"]
3510
2805
client.encrypted_secret = pgp.encrypt(client.secret,
3511
2806
key)
3512
2807
client_dict = {}
3513
2808
3514
2809
# A list of attributes that can not be pickled
3515
2810
# + secret.
3516
exclude = {"bus", "changedstate", "secret",
3517
"checker", "server_settings"}
2811
exclude = { "bus", "changedstate", "secret",
2812
"checker", "server_settings" }
3518
2813
for name, typ in inspect.getmembers(dbus.service
3519
2814
.Object):
3520
2815
exclude.add(name)
3521
2816
3522
2817
client_dict["encrypted_secret"] = (client
3523
2818
.encrypted_secret)
3524
2819
for attr in client.client_structure:
3525
2820
if attr not in exclude:
3526
2821
client_dict[attr] = getattr(client, attr)
3527
2822
3528
2823
clients[client.name] = client_dict
3529
2824
del client_settings[client.name]["secret"]
3530
2825
3531
2826
try:
3532
2827
with tempfile.NamedTemporaryFile(
3533
2828
mode='wb',
3535
2830
prefix='clients-',
3536
2831
dir=os.path.dirname(stored_state_path),
3537
2832
delete=False) as stored_state:
3538
pickle.dump((clients, client_settings), stored_state,
3539
protocol=2)
2833
pickle.dump((clients, client_settings), stored_state)
3540
2834
tempname = stored_state.name
3541
2835
os.rename(tempname, stored_state_path)
3542
2836
except (IOError, OSError) as e:
3552
2846
logger.warning("Could not save persistent state:",
3553
2847
exc_info=e)
3554
2848
raise
3555
2849
3556
2850
# Delete all clients, and settings from config
3557
2851
while tcp_server.clients:
3558
2852
name, client = tcp_server.clients.popitem()
3559
2853
if use_dbus:
3560
2854
client.remove_from_connection()
3561
# Don't signal the disabling
2855
# Don't signal anything except ClientRemoved
3562
2856
client.disable(quiet=True)
3563
# Emit D-Bus signal for removal
3564
2857
if use_dbus:
3565
mandos_dbus_service.client_removed_signal(client)
2858
# Emit D-Bus signal
2859
mandos_dbus_service.ClientRemoved(
2860
client.dbus_object_path, client.name)
3566
2861
client_settings.clear()
3567
2862
3568
2863
atexit.register(cleanup)
3569
3570
for client in tcp_server.clients.values():
2864
2865
for client in tcp_server.clients.itervalues():
3571
2866
if use_dbus:
3572
# Emit D-Bus signal for adding
3573
mandos_dbus_service.client_added_signal(client)
2867
# Emit D-Bus signal
2868
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3574
2869
# Need to initiate checking of clients
3575
2870
if client.enabled:
3576
2871
client.init_checker()
3577
2872
3578
2873
tcp_server.enable()
3579
2874
tcp_server.server_activate()
3580
2875
3581
2876
# Find out what port we got
3582
2877
if zeroconf:
3583
2878
service.port = tcp_server.socket.getsockname()[1]
3588
2883
else: # IPv4
3589
2884
logger.info("Now listening on address %r, port %d",
3590
2885
*tcp_server.socket.getsockname())
3591
3592
# service.interface = tcp_server.socket.getsockname()[3]
3593
2886
2887
#service.interface = tcp_server.socket.getsockname()[3]
2888
3594
2889
try:
3595
2890
if zeroconf:
3596
2891
# From the Avahi example code
3601
2896
cleanup()
3602
2897
sys.exit(1)
3603
2898
# End of Avahi example code
3604
3605
GLib.io_add_watch(
3606
GLib.IOChannel.unix_new(tcp_server.fileno()),
3607
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3608
lambda *args, **kwargs: (tcp_server.handle_request
3609
(*args[2:], **kwargs) or True))
3610
2899
2900
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2901
lambda *args, **kwargs:
2902
(tcp_server.handle_request
2903
(*args[2:], **kwargs) or True))
2904
3611
2905
logger.debug("Starting main loop")
3612
2906
main_loop.run()
3613
2907
except AvahiError as error:
3622
2916
# Must run before the D-Bus bus name gets deregistered
3623
2917
cleanup()
3624
2918
3625
3626
def should_only_run_tests():
3627
parser = argparse.ArgumentParser(add_help=False)
3628
parser.add_argument("--check", action='store_true')
3629
args, unknown_args = parser.parse_known_args()
3630
run_tests = args.check
3631
if run_tests:
3632
# Remove --check argument from sys.argv
3633
sys.argv[1:] = unknown_args
3634
return run_tests
3635
3636
# Add all tests from doctest strings
3637
def load_tests(loader, tests, none):
3638
import doctest
3639
tests.addTests(doctest.DocTestSuite())
3640
return tests
3641
2919
3642
2920
if __name__ == '__main__':
3643
try:
3644
if should_only_run_tests():
3645
# Call using ./mandos --check [--verbose]
3646
unittest.main()
3647
else:
3648
main()
3649
finally:
3650
logging.shutdown()
2921
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0