To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 775
- compare with another revision
- download diff
- download tarball
- view history from revision 775
- Committer: Teddy Hogeborn
- Date: 2015-07-20 00:18:59 UTC
- Revision ID: teddy@recompile.se-20150720001859-4373dkxokj7bt666
plugin-runner: Minor fix: close helperdir before exiting in fork.
* plugin-runner.c: Minor fix: close helperdir before exiting in fork
if helper program could not be opened.
* plugin-runner.c: Minor fix: close helperdir before exiting in fork
if helper program could not be opened.
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
39
try:
43
40
import SocketServer as socketserver
47
44
import argparse
48
45
import datetime
49
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
50
53
try:
51
54
import ConfigParser as configparser
52
55
except ImportError:
79
82
80
83
import dbus
81
84
import dbus.service
82
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
83
90
from dbus.mainloop.glib import DBusGMainLoop
84
91
import ctypes
85
92
import ctypes.util
97
104
if sys.version_info.major == 2:
98
105
str = unicode
99
106
100
version = "1.7.7"
107
version = "1.6.9"
101
108
stored_state_file = "clients.pickle"
102
109
103
110
logger = logging.getLogger()
118
125
return interface_index
119
126
120
127
121
def copy_function(func):
122
"""Make a copy of a function"""
123
if sys.version_info.major == 2:
124
return types.FunctionType(func.func_code,
125
func.func_globals,
126
func.func_name,
127
func.func_defaults,
128
func.func_closure)
129
else:
130
return types.FunctionType(func.__code__,
131
func.__globals__,
132
func.__name__,
133
func.__defaults__,
134
func.__closure__)
135
136
137
128
def initlogger(debug, level=logging.WARNING):
138
129
"""init logger and add loglevel"""
139
130
166
157
167
158
def __init__(self):
168
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
169
self.gpg = "gpg"
170
try:
171
output = subprocess.check_output(["gpgconf"])
172
for line in output.splitlines():
173
name, text, path = line.split(b":")
174
if name == "gpg":
175
self.gpg = path
176
break
177
except OSError as e:
178
if e.errno != errno.ENOENT:
179
raise
180
160
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
161
'--home', self.tempdir,
182
162
'--force-mdc',
183
'--quiet']
184
# Only GPG version 1 has the --no-use-agent option.
185
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
186
self.gnupgargs.append("--no-use-agent")
163
'--quiet',
164
'--no-use-agent']
187
165
188
166
def __enter__(self):
189
167
return self
225
203
dir=self.tempdir) as passfile:
226
204
passfile.write(passphrase)
227
205
passfile.flush()
228
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
229
207
'--passphrase-file',
230
208
passfile.name]
231
209
+ self.gnupgargs,
243
221
dir = self.tempdir) as passfile:
244
222
passfile.write(passphrase)
245
223
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
247
225
'--passphrase-file',
248
226
passfile.name]
249
227
+ self.gnupgargs,
255
233
raise PGPError(err)
256
234
return decrypted_plaintext
257
235
258
# Pretend that we have an Avahi module
259
class Avahi(object):
260
"""This isn't so much a class as it is a module-like namespace.
261
It is instantiated once, and simulates having an Avahi module."""
262
IF_UNSPEC = -1 # avahi-common/address.h
263
PROTO_UNSPEC = -1 # avahi-common/address.h
264
PROTO_INET = 0 # avahi-common/address.h
265
PROTO_INET6 = 1 # avahi-common/address.h
266
DBUS_NAME = "org.freedesktop.Avahi"
267
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
268
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
269
DBUS_PATH_SERVER = "/"
270
def string_array_to_txt_array(self, t):
271
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
272
for s in t), signature="ay")
273
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
274
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
275
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
276
SERVER_INVALID = 0 # avahi-common/defs.h
277
SERVER_REGISTERING = 1 # avahi-common/defs.h
278
SERVER_RUNNING = 2 # avahi-common/defs.h
279
SERVER_COLLISION = 3 # avahi-common/defs.h
280
SERVER_FAILURE = 4 # avahi-common/defs.h
281
avahi = Avahi()
282
236
283
237
class AvahiError(Exception):
284
238
def __init__(self, value, *args, **kwargs):
481
435
.format(self.name)))
482
436
return ret
483
437
484
# Pretend that we have a GnuTLS module
485
class GnuTLS(object):
486
"""This isn't so much a class as it is a module-like namespace.
487
It is instantiated once, and simulates having a GnuTLS module."""
488
489
_library = ctypes.cdll.LoadLibrary(
490
ctypes.util.find_library("gnutls"))
491
_need_version = b"3.3.0"
492
def __init__(self):
493
# Need to use class name "GnuTLS" here, since this method is
494
# called before the assignment to the "gnutls" global variable
495
# happens.
496
if GnuTLS.check_version(self._need_version) is None:
497
raise GnuTLS.Error("Needs GnuTLS {} or later"
498
.format(self._need_version))
499
500
# Unless otherwise indicated, the constants and types below are
501
# all from the gnutls/gnutls.h C header file.
502
503
# Constants
504
E_SUCCESS = 0
505
E_INTERRUPTED = -52
506
E_AGAIN = -28
507
CRT_OPENPGP = 2
508
CLIENT = 2
509
SHUT_RDWR = 0
510
CRD_CERTIFICATE = 1
511
E_NO_CERTIFICATE_FOUND = -49
512
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
513
514
# Types
515
class session_int(ctypes.Structure):
516
_fields_ = []
517
session_t = ctypes.POINTER(session_int)
518
class certificate_credentials_st(ctypes.Structure):
519
_fields_ = []
520
certificate_credentials_t = ctypes.POINTER(
521
certificate_credentials_st)
522
certificate_type_t = ctypes.c_int
523
class datum_t(ctypes.Structure):
524
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
525
('size', ctypes.c_uint)]
526
class openpgp_crt_int(ctypes.Structure):
527
_fields_ = []
528
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
529
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
531
credentials_type_t = ctypes.c_int
532
transport_ptr_t = ctypes.c_void_p
533
close_request_t = ctypes.c_int
534
535
# Exceptions
536
class Error(Exception):
537
# We need to use the class name "GnuTLS" here, since this
538
# exception might be raised from within GnuTLS.__init__,
539
# which is called before the assignment to the "gnutls"
540
# global variable has happened.
541
def __init__(self, message = None, code = None, args=()):
542
# Default usage is by a message string, but if a return
543
# code is passed, convert it to a string with
544
# gnutls.strerror()
545
self.code = code
546
if message is None and code is not None:
547
message = GnuTLS.strerror(code)
548
return super(GnuTLS.Error, self).__init__(
549
message, *args)
550
551
class CertificateSecurityError(Error):
552
pass
553
554
# Classes
555
class Credentials(object):
556
def __init__(self):
557
self._c_object = gnutls.certificate_credentials_t()
558
gnutls.certificate_allocate_credentials(
559
ctypes.byref(self._c_object))
560
self.type = gnutls.CRD_CERTIFICATE
561
562
def __del__(self):
563
gnutls.certificate_free_credentials(self._c_object)
564
565
class ClientSession(object):
566
def __init__(self, socket, credentials = None):
567
self._c_object = gnutls.session_t()
568
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
569
gnutls.set_default_priority(self._c_object)
570
gnutls.transport_set_ptr(self._c_object, socket.fileno())
571
gnutls.handshake_set_private_extensions(self._c_object,
572
True)
573
self.socket = socket
574
if credentials is None:
575
credentials = gnutls.Credentials()
576
gnutls.credentials_set(self._c_object, credentials.type,
577
ctypes.cast(credentials._c_object,
578
ctypes.c_void_p))
579
self.credentials = credentials
580
581
def __del__(self):
582
gnutls.deinit(self._c_object)
583
584
def handshake(self):
585
return gnutls.handshake(self._c_object)
586
587
def send(self, data):
588
data = bytes(data)
589
data_len = len(data)
590
while data_len > 0:
591
data_len -= gnutls.record_send(self._c_object,
592
data[-data_len:],
593
data_len)
594
595
def bye(self):
596
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
597
598
# Error handling functions
599
def _error_code(result):
600
"""A function to raise exceptions on errors, suitable
601
for the 'restype' attribute on ctypes functions"""
602
if result >= 0:
603
return result
604
if result == gnutls.E_NO_CERTIFICATE_FOUND:
605
raise gnutls.CertificateSecurityError(code = result)
606
raise gnutls.Error(code = result)
607
608
def _retry_on_error(result, func, arguments):
609
"""A function to retry on some errors, suitable
610
for the 'errcheck' attribute on ctypes functions"""
611
while result < 0:
612
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
613
return _error_code(result)
614
result = func(*arguments)
615
return result
616
617
# Unless otherwise indicated, the function declarations below are
618
# all from the gnutls/gnutls.h C header file.
619
620
# Functions
621
priority_set_direct = _library.gnutls_priority_set_direct
622
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
623
ctypes.POINTER(ctypes.c_char_p)]
624
priority_set_direct.restype = _error_code
625
626
init = _library.gnutls_init
627
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
628
init.restype = _error_code
629
630
set_default_priority = _library.gnutls_set_default_priority
631
set_default_priority.argtypes = [session_t]
632
set_default_priority.restype = _error_code
633
634
record_send = _library.gnutls_record_send
635
record_send.argtypes = [session_t, ctypes.c_void_p,
636
ctypes.c_size_t]
637
record_send.restype = ctypes.c_ssize_t
638
record_send.errcheck = _retry_on_error
639
640
certificate_allocate_credentials = (
641
_library.gnutls_certificate_allocate_credentials)
642
certificate_allocate_credentials.argtypes = [
643
ctypes.POINTER(certificate_credentials_t)]
644
certificate_allocate_credentials.restype = _error_code
645
646
certificate_free_credentials = (
647
_library.gnutls_certificate_free_credentials)
648
certificate_free_credentials.argtypes = [certificate_credentials_t]
649
certificate_free_credentials.restype = None
650
651
handshake_set_private_extensions = (
652
_library.gnutls_handshake_set_private_extensions)
653
handshake_set_private_extensions.argtypes = [session_t,
654
ctypes.c_int]
655
handshake_set_private_extensions.restype = None
656
657
credentials_set = _library.gnutls_credentials_set
658
credentials_set.argtypes = [session_t, credentials_type_t,
659
ctypes.c_void_p]
660
credentials_set.restype = _error_code
661
662
strerror = _library.gnutls_strerror
663
strerror.argtypes = [ctypes.c_int]
664
strerror.restype = ctypes.c_char_p
665
666
certificate_type_get = _library.gnutls_certificate_type_get
667
certificate_type_get.argtypes = [session_t]
668
certificate_type_get.restype = _error_code
669
670
certificate_get_peers = _library.gnutls_certificate_get_peers
671
certificate_get_peers.argtypes = [session_t,
672
ctypes.POINTER(ctypes.c_uint)]
673
certificate_get_peers.restype = ctypes.POINTER(datum_t)
674
675
global_set_log_level = _library.gnutls_global_set_log_level
676
global_set_log_level.argtypes = [ctypes.c_int]
677
global_set_log_level.restype = None
678
679
global_set_log_function = _library.gnutls_global_set_log_function
680
global_set_log_function.argtypes = [log_func]
681
global_set_log_function.restype = None
682
683
deinit = _library.gnutls_deinit
684
deinit.argtypes = [session_t]
685
deinit.restype = None
686
687
handshake = _library.gnutls_handshake
688
handshake.argtypes = [session_t]
689
handshake.restype = _error_code
690
handshake.errcheck = _retry_on_error
691
692
transport_set_ptr = _library.gnutls_transport_set_ptr
693
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
694
transport_set_ptr.restype = None
695
696
bye = _library.gnutls_bye
697
bye.argtypes = [session_t, close_request_t]
698
bye.restype = _error_code
699
bye.errcheck = _retry_on_error
700
701
check_version = _library.gnutls_check_version
702
check_version.argtypes = [ctypes.c_char_p]
703
check_version.restype = ctypes.c_char_p
704
705
# All the function declarations below are from gnutls/openpgp.h
706
707
openpgp_crt_init = _library.gnutls_openpgp_crt_init
708
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
709
openpgp_crt_init.restype = _error_code
710
711
openpgp_crt_import = _library.gnutls_openpgp_crt_import
712
openpgp_crt_import.argtypes = [openpgp_crt_t,
713
ctypes.POINTER(datum_t),
714
openpgp_crt_fmt_t]
715
openpgp_crt_import.restype = _error_code
716
717
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
718
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
719
ctypes.POINTER(ctypes.c_uint)]
720
openpgp_crt_verify_self.restype = _error_code
721
722
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
723
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
724
openpgp_crt_deinit.restype = None
725
726
openpgp_crt_get_fingerprint = (
727
_library.gnutls_openpgp_crt_get_fingerprint)
728
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
729
ctypes.c_void_p,
730
ctypes.POINTER(
731
ctypes.c_size_t)]
732
openpgp_crt_get_fingerprint.restype = _error_code
733
734
# Remove non-public functions
735
del _error_code, _retry_on_error
736
# Create the global "gnutls" object, simulating a module
737
gnutls = GnuTLS()
738
739
438
def call_pipe(connection, # : multiprocessing.Connection
740
439
func, *args, **kwargs):
741
440
"""This function is meant to be called by multiprocessing.Process
756
455
checker: subprocess.Popen(); a running checker process used
757
456
to see if the client lives.
758
457
'None' if no process is running.
759
checker_callback_tag: a GLib event source tag, or None
458
checker_callback_tag: a gobject event source tag, or None
760
459
checker_command: string; External command which is run to check
761
460
if client lives. %() expansions are done at
762
461
runtime with vars(self) as dict, so that for
763
462
instance %(name)s can be used in the command.
764
checker_initiator_tag: a GLib event source tag, or None
463
checker_initiator_tag: a gobject event source tag, or None
765
464
created: datetime.datetime(); (UTC) object creation
766
465
client_structure: Object describing what attributes a client has
767
466
and is used for storing the client at exit
768
467
current_checker_command: string; current running checker_command
769
disable_initiator_tag: a GLib event source tag, or None
468
disable_initiator_tag: a gobject event source tag, or None
770
469
enabled: bool()
771
470
fingerprint: string (40 or 32 hexadecimal digits); used to
772
471
uniquely identify the client
835
534
client["fingerprint"] = (section["fingerprint"].upper()
836
535
.replace(" ", ""))
837
536
if "secret" in section:
838
client["secret"] = codecs.decode(section["secret"]
839
.encode("utf-8"),
840
"base64")
537
client["secret"] = section["secret"].decode("base64")
841
538
elif "secfile" in section:
842
539
with open(os.path.expanduser(os.path.expandvars
843
540
(section["secfile"])),
896
593
self.changedstate = multiprocessing_manager.Condition(
897
594
multiprocessing_manager.Lock())
898
595
self.client_structure = [attr
899
for attr in self.__dict__.keys()
596
for attr in self.__dict__.iterkeys()
900
597
if not attr.startswith("_")]
901
598
self.client_structure.append("client_structure")
902
599
928
625
if not quiet:
929
626
logger.info("Disabling client %s", self.name)
930
627
if getattr(self, "disable_initiator_tag", None) is not None:
931
GLib.source_remove(self.disable_initiator_tag)
628
gobject.source_remove(self.disable_initiator_tag)
932
629
self.disable_initiator_tag = None
933
630
self.expires = None
934
631
if getattr(self, "checker_initiator_tag", None) is not None:
935
GLib.source_remove(self.checker_initiator_tag)
632
gobject.source_remove(self.checker_initiator_tag)
936
633
self.checker_initiator_tag = None
937
634
self.stop_checker()
938
635
self.enabled = False
939
636
if not quiet:
940
637
self.send_changedstate()
941
# Do not run this again if called by a GLib.timeout_add
638
# Do not run this again if called by a gobject.timeout_add
942
639
return False
943
640
944
641
def __del__(self):
948
645
# Schedule a new checker to be started an 'interval' from now,
949
646
# and every interval from then on.
950
647
if self.checker_initiator_tag is not None:
951
GLib.source_remove(self.checker_initiator_tag)
952
self.checker_initiator_tag = GLib.timeout_add(
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
953
650
int(self.interval.total_seconds() * 1000),
954
651
self.start_checker)
955
652
# Schedule a disable() when 'timeout' has passed
956
653
if self.disable_initiator_tag is not None:
957
GLib.source_remove(self.disable_initiator_tag)
958
self.disable_initiator_tag = GLib.timeout_add(
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
959
656
int(self.timeout.total_seconds() * 1000), self.disable)
960
657
# Also start a new checker *right now*.
961
658
self.start_checker()
997
694
if timeout is None:
998
695
timeout = self.timeout
999
696
if self.disable_initiator_tag is not None:
1000
GLib.source_remove(self.disable_initiator_tag)
697
gobject.source_remove(self.disable_initiator_tag)
1001
698
self.disable_initiator_tag = None
1002
699
if getattr(self, "enabled", False):
1003
self.disable_initiator_tag = GLib.timeout_add(
700
self.disable_initiator_tag = gobject.timeout_add(
1004
701
int(timeout.total_seconds() * 1000), self.disable)
1005
702
self.expires = datetime.datetime.utcnow() + timeout
1006
703
1061
758
args = (pipe[1], subprocess.call, command),
1062
759
kwargs = popen_args)
1063
760
self.checker.start()
1064
self.checker_callback_tag = GLib.io_add_watch(
1065
pipe[0].fileno(), GLib.IO_IN,
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
1066
763
self.checker_callback, pipe[0], command)
1067
# Re-run this periodically if run by GLib.timeout_add
764
# Re-run this periodically if run by gobject.timeout_add
1068
765
return True
1069
766
1070
767
def stop_checker(self):
1071
768
"""Force the checker process, if any, to stop."""
1072
769
if self.checker_callback_tag:
1073
GLib.source_remove(self.checker_callback_tag)
770
gobject.source_remove(self.checker_callback_tag)
1074
771
self.checker_callback_tag = None
1075
772
if getattr(self, "checker", None) is None:
1076
773
return
1145
842
access="r")
1146
843
def Property_dbus_property(self):
1147
844
return dbus.Boolean(False)
1148
1149
See also the DBusObjectWithAnnotations class.
1150
845
"""
1151
846
1152
847
def decorator(func):
1174
869
pass
1175
870
1176
871
1177
class DBusObjectWithAnnotations(dbus.service.Object):
1178
"""A D-Bus object with annotations.
872
class DBusObjectWithProperties(dbus.service.Object):
873
"""A D-Bus object with properties.
1179
874
1180
Classes inheriting from this can use the dbus_annotations
1181
decorator to add annotations to methods or signals.
875
Classes inheriting from this can use the dbus_service_property
876
decorator to expose methods as D-Bus properties. It exposes the
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
1182
878
"""
1183
879
1184
880
@staticmethod
1200
896
for name, athing in
1201
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1202
898
1203
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1204
out_signature = "s",
1205
path_keyword = 'object_path',
1206
connection_keyword = 'connection')
1207
def Introspect(self, object_path, connection):
1208
"""Overloading of standard D-Bus method.
1209
1210
Inserts annotation tags on methods and signals.
1211
"""
1212
xmlstring = dbus.service.Object.Introspect(self, object_path,
1213
connection)
1214
try:
1215
document = xml.dom.minidom.parseString(xmlstring)
1216
1217
for if_tag in document.getElementsByTagName("interface"):
1218
# Add annotation tags
1219
for typ in ("method", "signal"):
1220
for tag in if_tag.getElementsByTagName(typ):
1221
annots = dict()
1222
for name, prop in (self.
1223
_get_all_dbus_things(typ)):
1224
if (name == tag.getAttribute("name")
1225
and prop._dbus_interface
1226
== if_tag.getAttribute("name")):
1227
annots.update(getattr(
1228
prop, "_dbus_annotations", {}))
1229
for name, value in annots.items():
1230
ann_tag = document.createElement(
1231
"annotation")
1232
ann_tag.setAttribute("name", name)
1233
ann_tag.setAttribute("value", value)
1234
tag.appendChild(ann_tag)
1235
# Add interface annotation tags
1236
for annotation, value in dict(
1237
itertools.chain.from_iterable(
1238
annotations().items()
1239
for name, annotations
1240
in self._get_all_dbus_things("interface")
1241
if name == if_tag.getAttribute("name")
1242
)).items():
1243
ann_tag = document.createElement("annotation")
1244
ann_tag.setAttribute("name", annotation)
1245
ann_tag.setAttribute("value", value)
1246
if_tag.appendChild(ann_tag)
1247
# Fix argument name for the Introspect method itself
1248
if (if_tag.getAttribute("name")
1249
== dbus.INTROSPECTABLE_IFACE):
1250
for cn in if_tag.getElementsByTagName("method"):
1251
if cn.getAttribute("name") == "Introspect":
1252
for arg in cn.getElementsByTagName("arg"):
1253
if (arg.getAttribute("direction")
1254
== "out"):
1255
arg.setAttribute("name",
1256
"xml_data")
1257
xmlstring = document.toxml("utf-8")
1258
document.unlink()
1259
except (AttributeError, xml.dom.DOMException,
1260
xml.parsers.expat.ExpatError) as error:
1261
logger.error("Failed to override Introspection method",
1262
exc_info=error)
1263
return xmlstring
1264
1265
1266
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1267
"""A D-Bus object with properties.
1268
1269
Classes inheriting from this can use the dbus_service_property
1270
decorator to expose methods as D-Bus properties. It exposes the
1271
standard Get(), Set(), and GetAll() methods on the D-Bus.
1272
"""
1273
1274
899
def _get_dbus_property(self, interface_name, property_name):
1275
900
"""Returns a bound method if one exists which is a D-Bus
1276
901
property with the specified name and interface.
1286
911
raise DBusPropertyNotFound("{}:{}.{}".format(
1287
912
self.dbus_object_path, interface_name, property_name))
1288
913
1289
@classmethod
1290
def _get_all_interface_names(cls):
1291
"""Get a sequence of all interfaces supported by an object"""
1292
return (name for name in set(getattr(getattr(x, attr),
1293
"_dbus_interface", None)
1294
for x in (inspect.getmro(cls))
1295
for attr in dir(x))
1296
if name is not None)
1297
1298
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
1299
915
in_signature="ss",
1300
916
out_signature="v")
1370
986
1371
987
Inserts property tags and interface annotation tags.
1372
988
"""
1373
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1374
object_path,
1375
connection)
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
990
connection)
1376
991
try:
1377
992
document = xml.dom.minidom.parseString(xmlstring)
1378
993
1391
1006
if prop._dbus_interface
1392
1007
== if_tag.getAttribute("name")):
1393
1008
if_tag.appendChild(tag)
1394
# Add annotation tags for properties
1395
for tag in if_tag.getElementsByTagName("property"):
1396
annots = dict()
1397
for name, prop in self._get_all_dbus_things(
1398
"property"):
1399
if (name == tag.getAttribute("name")
1400
and prop._dbus_interface
1401
== if_tag.getAttribute("name")):
1402
annots.update(getattr(
1403
prop, "_dbus_annotations", {}))
1404
for name, value in annots.items():
1405
ann_tag = document.createElement(
1406
"annotation")
1407
ann_tag.setAttribute("name", name)
1408
ann_tag.setAttribute("value", value)
1409
tag.appendChild(ann_tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1410
1038
# Add the names to the return values for the
1411
1039
# "org.freedesktop.DBus.Properties" methods
1412
1040
if (if_tag.getAttribute("name")
1430
1058
exc_info=error)
1431
1059
return xmlstring
1432
1060
1433
try:
1434
dbus.OBJECT_MANAGER_IFACE
1435
except AttributeError:
1436
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1437
1438
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1439
"""A D-Bus object with an ObjectManager.
1440
1441
Classes inheriting from this exposes the standard
1442
GetManagedObjects call and the InterfacesAdded and
1443
InterfacesRemoved signals on the standard
1444
"org.freedesktop.DBus.ObjectManager" interface.
1445
1446
Note: No signals are sent automatically; they must be sent
1447
manually.
1448
"""
1449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1450
out_signature = "a{oa{sa{sv}}}")
1451
def GetManagedObjects(self):
1452
"""This function must be overridden"""
1453
raise NotImplementedError()
1454
1455
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1456
signature = "oa{sa{sv}}")
1457
def InterfacesAdded(self, object_path, interfaces_and_properties):
1458
pass
1459
1460
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1461
def InterfacesRemoved(self, object_path, interfaces):
1462
pass
1463
1464
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1465
out_signature = "s",
1466
path_keyword = 'object_path',
1467
connection_keyword = 'connection')
1468
def Introspect(self, object_path, connection):
1469
"""Overloading of standard D-Bus method.
1470
1471
Override return argument name of GetManagedObjects to be
1472
"objpath_interfaces_and_properties"
1473
"""
1474
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1475
object_path,
1476
connection)
1477
try:
1478
document = xml.dom.minidom.parseString(xmlstring)
1479
1480
for if_tag in document.getElementsByTagName("interface"):
1481
# Fix argument name for the GetManagedObjects method
1482
if (if_tag.getAttribute("name")
1483
== dbus.OBJECT_MANAGER_IFACE):
1484
for cn in if_tag.getElementsByTagName("method"):
1485
if (cn.getAttribute("name")
1486
== "GetManagedObjects"):
1487
for arg in cn.getElementsByTagName("arg"):
1488
if (arg.getAttribute("direction")
1489
== "out"):
1490
arg.setAttribute(
1491
"name",
1492
"objpath_interfaces"
1493
"_and_properties")
1494
xmlstring = document.toxml("utf-8")
1495
document.unlink()
1496
except (AttributeError, xml.dom.DOMException,
1497
xml.parsers.expat.ExpatError) as error:
1498
logger.error("Failed to override Introspection method",
1499
exc_info = error)
1500
return xmlstring
1501
1061
1502
1062
def datetime_to_dbus(dt, variant_level=0):
1503
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1550
1110
interface_names.add(alt_interface)
1551
1111
# Is this a D-Bus signal?
1552
1112
if getattr(attribute, "_dbus_is_signal", False):
1553
# Extract the original non-method undecorated
1554
# function by black magic
1555
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1556
1116
nonmethod_func = (dict(
1557
1117
zip(attribute.func_code.co_freevars,
1558
1118
attribute.__closure__))
1559
1119
["func"].cell_contents)
1560
1120
else:
1561
nonmethod_func = (dict(
1562
zip(attribute.__code__.co_freevars,
1563
attribute.__closure__))
1564
["func"].cell_contents)
1121
nonmethod_func = attribute
1565
1122
# Create a new, but exactly alike, function
1566
1123
# object, and decorate it to be a new D-Bus signal
1567
1124
# with the alternate D-Bus interface name
1568
new_function = copy_function(nonmethod_func)
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1132
else:
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1569
1139
new_function = (dbus.service.signal(
1570
1140
alt_interface,
1571
1141
attribute._dbus_signature)(new_function))
1584
1154
func1 and func2 to the "call_both" function
1585
1155
outside of its arguments"""
1586
1156
1587
@functools.wraps(func2)
1588
1157
def call_both(*args, **kwargs):
1589
1158
"""This function will emit two D-Bus
1590
1159
signals by calling func1 and func2"""
1591
1160
func1(*args, **kwargs)
1592
1161
func2(*args, **kwargs)
1593
# Make wrapper function look like a D-Bus signal
1594
for name, attr in inspect.getmembers(func2):
1595
if name.startswith("_dbus_"):
1596
setattr(call_both, name, attr)
1597
1162
1598
1163
return call_both
1599
1164
# Create the "call_both" function and add it to
1610
1175
alt_interface,
1611
1176
attribute._dbus_in_signature,
1612
1177
attribute._dbus_out_signature)
1613
(copy_function(attribute)))
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1614
1183
# Copy annotations, if any
1615
1184
try:
1616
1185
attr[attrname]._dbus_annotations = dict(
1628
1197
attribute._dbus_access,
1629
1198
attribute._dbus_get_args_options
1630
1199
["byte_arrays"])
1631
(copy_function(attribute)))
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1632
1206
# Copy annotations, if any
1633
1207
try:
1634
1208
attr[attrname]._dbus_annotations = dict(
1643
1217
# to the class.
1644
1218
attr[attrname] = (
1645
1219
dbus_interface_annotations(alt_interface)
1646
(copy_function(attribute)))
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1647
1225
if deprecate:
1648
1226
# Deprecate all alternate interfaces
1649
1227
iname="_AlternateDBusNames_interface_annotation{}"
1662
1240
if interface_names:
1663
1241
# Replace the class with a new subclass of it with
1664
1242
# methods, signals, etc. as created above.
1665
if sys.version_info.major == 2:
1666
cls = type(b"{}Alternate".format(cls.__name__),
1667
(cls, ), attr)
1668
else:
1669
cls = type("{}Alternate".format(cls.__name__),
1670
(cls, ), attr)
1243
cls = type(b"{}Alternate".format(cls.__name__),
1244
(cls, ), attr)
1671
1245
return cls
1672
1246
1673
1247
return wrapper
1802
1376
if exitstatus >= 0:
1803
1377
# Emit D-Bus signal
1804
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
1805
# This is specific to GNU libC
1806
dbus.Int64(exitstatus << 8),
1379
dbus.Int64(0),
1807
1380
dbus.String(command))
1808
1381
else:
1809
1382
# Emit D-Bus signal
1810
1383
self.CheckerCompleted(dbus.Int16(-1),
1811
1384
dbus.Int64(
1812
# This is specific to GNU libC
1813
(exitstatus << 8)
1814
| self.last_checker_signal),
1385
self.last_checker_signal),
1815
1386
dbus.String(command))
1816
1387
return ret
1817
1388
1831
1402
1832
1403
def approve(self, value=True):
1833
1404
self.approved = value
1834
GLib.timeout_add(int(self.approval_duration.total_seconds()
1835
* 1000), self._reset_approved)
1405
gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
* 1000), self._reset_approved)
1836
1407
self.send_changedstate()
1837
1408
1838
1409
## D-Bus methods, signals & properties
1894
1465
self.checked_ok()
1895
1466
1896
1467
# Enable - method
1897
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1898
1468
@dbus.service.method(_interface)
1899
1469
def Enable(self):
1900
1470
"D-Bus method"
1901
1471
self.enable()
1902
1472
1903
1473
# StartChecker - method
1904
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1905
1474
@dbus.service.method(_interface)
1906
1475
def StartChecker(self):
1907
1476
"D-Bus method"
1908
1477
self.start_checker()
1909
1478
1910
1479
# Disable - method
1911
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1912
1480
@dbus.service.method(_interface)
1913
1481
def Disable(self):
1914
1482
"D-Bus method"
1915
1483
self.disable()
1916
1484
1917
1485
# StopChecker - method
1918
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1919
1486
@dbus.service.method(_interface)
1920
1487
def StopChecker(self):
1921
1488
self.stop_checker()
1957
1524
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1958
1525
1959
1526
# Name - property
1960
@dbus_annotations(
1961
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1962
1527
@dbus_service_property(_interface, signature="s", access="read")
1963
1528
def Name_dbus_property(self):
1964
1529
return dbus.String(self.name)
1965
1530
1966
1531
# Fingerprint - property
1967
@dbus_annotations(
1968
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1969
1532
@dbus_service_property(_interface, signature="s", access="read")
1970
1533
def Fingerprint_dbus_property(self):
1971
1534
return dbus.String(self.fingerprint)
1980
1543
self.host = str(value)
1981
1544
1982
1545
# Created - property
1983
@dbus_annotations(
1984
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1985
1546
@dbus_service_property(_interface, signature="s", access="read")
1986
1547
def Created_dbus_property(self):
1987
1548
return datetime_to_dbus(self.created)
2048
1609
if (getattr(self, "disable_initiator_tag", None)
2049
1610
is None):
2050
1611
return
2051
GLib.source_remove(self.disable_initiator_tag)
2052
self.disable_initiator_tag = GLib.timeout_add(
1612
gobject.source_remove(self.disable_initiator_tag)
1613
self.disable_initiator_tag = gobject.timeout_add(
2053
1614
int((self.expires - now).total_seconds() * 1000),
2054
1615
self.disable)
2055
1616
2075
1636
return
2076
1637
if self.enabled:
2077
1638
# Reschedule checker run
2078
GLib.source_remove(self.checker_initiator_tag)
2079
self.checker_initiator_tag = GLib.timeout_add(
1639
gobject.source_remove(self.checker_initiator_tag)
1640
self.checker_initiator_tag = gobject.timeout_add(
2080
1641
value, self.start_checker)
2081
1642
self.start_checker() # Start one now, too
2082
1643
2102
1663
self.stop_checker()
2103
1664
2104
1665
# ObjectPath - property
2105
@dbus_annotations(
2106
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2107
"org.freedesktop.DBus.Deprecated": "true"})
2108
1666
@dbus_service_property(_interface, signature="o", access="read")
2109
1667
def ObjectPath_dbus_property(self):
2110
1668
return self.dbus_object_path # is already a dbus.ObjectPath
2111
1669
2112
1670
# Secret = property
2113
@dbus_annotations(
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2115
"invalidates"})
2116
1671
@dbus_service_property(_interface,
2117
1672
signature="ay",
2118
1673
access="write",
2164
1719
logger.debug("Pipe FD: %d",
2165
1720
self.server.child_pipe.fileno())
2166
1721
2167
session = gnutls.ClientSession(self.request)
1722
session = gnutls.connection.ClientSession(
1723
self.request, gnutls.connection .X509Credentials())
1724
1725
# Note: gnutls.connection.X509Credentials is really a
1726
# generic GnuTLS certificate credentials object so long as
1727
# no X.509 keys are added to it. Therefore, we can use it
1728
# here despite using OpenPGP certificates.
2168
1729
2169
1730
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2170
1731
# "+AES-256-CBC", "+SHA1",
2174
1735
priority = self.server.gnutls_priority
2175
1736
if priority is None:
2176
1737
priority = "NORMAL"
2177
gnutls.priority_set_direct(session._c_object, priority,
2178
None)
1738
gnutls.library.functions.gnutls_priority_set_direct(
1739
session._c_object, priority, None)
2179
1740
2180
1741
# Start communication using the Mandos protocol
2181
1742
# Get protocol number
2191
1752
# Start GnuTLS connection
2192
1753
try:
2193
1754
session.handshake()
2194
except gnutls.Error as error:
1755
except gnutls.errors.GNUTLSError as error:
2195
1756
logger.warning("Handshake failed: %s", error)
2196
1757
# Do not run session.bye() here: the session is not
2197
1758
# established. Just abandon the request.
2203
1764
try:
2204
1765
fpr = self.fingerprint(
2205
1766
self.peer_certificate(session))
2206
except (TypeError, gnutls.Error) as error:
1767
except (TypeError,
1768
gnutls.errors.GNUTLSError) as error:
2207
1769
logger.warning("Bad certificate: %s", error)
2208
1770
return
2209
1771
logger.debug("Fingerprint: %s", fpr)
2267
1829
else:
2268
1830
delay -= time2 - time
2269
1831
2270
try:
2271
session.send(client.secret)
2272
except gnutls.Error as error:
2273
logger.warning("gnutls send failed",
2274
exc_info = error)
2275
return
1832
sent_size = 0
1833
while sent_size < len(client.secret):
1834
try:
1835
sent = session.send(client.secret[sent_size:])
1836
except gnutls.errors.GNUTLSError as error:
1837
logger.warning("gnutls send failed",
1838
exc_info=error)
1839
return
1840
logger.debug("Sent: %d, remaining: %d", sent,
1841
len(client.secret) - (sent_size
1842
+ sent))
1843
sent_size += sent
2276
1844
2277
1845
logger.info("Sending secret to %s", client.name)
2278
1846
# bump the timeout using extended_timeout
2286
1854
client.approvals_pending -= 1
2287
1855
try:
2288
1856
session.bye()
2289
except gnutls.Error as error:
1857
except gnutls.errors.GNUTLSError as error:
2290
1858
logger.warning("GnuTLS bye failed",
2291
1859
exc_info=error)
2292
1860
2294
1862
def peer_certificate(session):
2295
1863
"Return the peer's OpenPGP certificate as a bytestring"
2296
1864
# If not an OpenPGP certificate...
2297
if (gnutls.certificate_type_get(session._c_object)
2298
!= gnutls.CRT_OPENPGP):
2299
# ...return invalid data
2300
return b""
1865
if (gnutls.library.functions.gnutls_certificate_type_get(
1866
session._c_object)
1867
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
# ...do the normal thing
1869
return session.peer_certificate
2301
1870
list_size = ctypes.c_uint(1)
2302
cert_list = (gnutls.certificate_get_peers
1871
cert_list = (gnutls.library.functions
1872
.gnutls_certificate_get_peers
2303
1873
(session._c_object, ctypes.byref(list_size)))
2304
1874
if not bool(cert_list) and list_size.value != 0:
2305
raise gnutls.Error("error getting peer certificate")
1875
raise gnutls.errors.GNUTLSError("error getting peer"
1876
" certificate")
2306
1877
if list_size.value == 0:
2307
1878
return None
2308
1879
cert = cert_list[0]
2312
1883
def fingerprint(openpgp):
2313
1884
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2314
1885
# New GnuTLS "datum" with the OpenPGP public key
2315
datum = gnutls.datum_t(
1886
datum = gnutls.library.types.gnutls_datum_t(
2316
1887
ctypes.cast(ctypes.c_char_p(openpgp),
2317
1888
ctypes.POINTER(ctypes.c_ubyte)),
2318
1889
ctypes.c_uint(len(openpgp)))
2319
1890
# New empty GnuTLS certificate
2320
crt = gnutls.openpgp_crt_t()
2321
gnutls.openpgp_crt_init(ctypes.byref(crt))
1891
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
gnutls.library.functions.gnutls_openpgp_crt_init(
1893
ctypes.byref(crt))
2322
1894
# Import the OpenPGP public key into the certificate
2323
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2324
gnutls.OPENPGP_FMT_RAW)
1895
gnutls.library.functions.gnutls_openpgp_crt_import(
1896
crt, ctypes.byref(datum),
1897
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2325
1898
# Verify the self signature in the key
2326
1899
crtverify = ctypes.c_uint()
2327
gnutls.openpgp_crt_verify_self(crt, 0,
2328
ctypes.byref(crtverify))
1900
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
crt, 0, ctypes.byref(crtverify))
2329
1902
if crtverify.value != 0:
2330
gnutls.openpgp_crt_deinit(crt)
2331
raise gnutls.CertificateSecurityError("Verify failed")
1903
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
raise gnutls.errors.CertificateSecurityError(
1905
"Verify failed")
2332
1906
# New buffer for the fingerprint
2333
1907
buf = ctypes.create_string_buffer(20)
2334
1908
buf_len = ctypes.c_size_t()
2335
1909
# Get the fingerprint from the certificate into the buffer
2336
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2337
ctypes.byref(buf_len))
1910
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2338
1912
# Deinit the certificate
2339
gnutls.openpgp_crt_deinit(crt)
1913
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2340
1914
# Convert the buffer to a Python bytestring
2341
1915
fpr = ctypes.string_at(buf, buf_len.value)
2342
1916
# Convert the bytestring to hexadecimal notation
2486
2060
gnutls_priority GnuTLS priority string
2487
2061
use_dbus: Boolean; to emit D-Bus signals or not
2488
2062
2489
Assumes a GLib.MainLoop event loop.
2063
Assumes a gobject.MainLoop event loop.
2490
2064
"""
2491
2065
2492
2066
def __init__(self, server_address, RequestHandlerClass,
2517
2091
2518
2092
def add_pipe(self, parent_pipe, proc):
2519
2093
# Call "handle_ipc" for both data and EOF events
2520
GLib.io_add_watch(
2094
gobject.io_add_watch(
2521
2095
parent_pipe.fileno(),
2522
GLib.IO_IN | GLib.IO_HUP,
2096
gobject.IO_IN | gobject.IO_HUP,
2523
2097
functools.partial(self.handle_ipc,
2524
2098
parent_pipe = parent_pipe,
2525
2099
proc = proc))
2529
2103
proc = None,
2530
2104
client_object=None):
2531
2105
# error, or the other end of multiprocessing.Pipe has closed
2532
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2106
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2533
2107
# Wait for other process to exit
2534
2108
proc.join()
2535
2109
return False
2542
2116
fpr = request[1]
2543
2117
address = request[2]
2544
2118
2545
for c in self.clients.values():
2119
for c in self.clients.itervalues():
2546
2120
if c.fingerprint == fpr:
2547
2121
client = c
2548
2122
break
2556
2130
parent_pipe.send(False)
2557
2131
return False
2558
2132
2559
GLib.io_add_watch(
2133
gobject.io_add_watch(
2560
2134
parent_pipe.fileno(),
2561
GLib.IO_IN | GLib.IO_HUP,
2135
gobject.IO_IN | gobject.IO_HUP,
2562
2136
functools.partial(self.handle_ipc,
2563
2137
parent_pipe = parent_pipe,
2564
2138
proc = proc,
2823
2397
"debug": "False",
2824
2398
"priority":
2825
2399
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2826
":+SIGN-DSA-SHA256",
2400
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2827
2401
"servicename": "Mandos",
2828
2402
"use_dbus": "True",
2829
2403
"use_ipv6": "True",
2946
2520
logger.error("Could not open file %r", pidfilename,
2947
2521
exc_info=e)
2948
2522
2949
for name, group in (("_mandos", "_mandos"),
2950
("mandos", "mandos"),
2951
("nobody", "nogroup")):
2523
for name in ("_mandos", "mandos", "nobody"):
2952
2524
try:
2953
2525
uid = pwd.getpwnam(name).pw_uid
2954
gid = pwd.getpwnam(group).pw_gid
2526
gid = pwd.getpwnam(name).pw_gid
2955
2527
break
2956
2528
except KeyError:
2957
2529
continue
2961
2533
try:
2962
2534
os.setgid(gid)
2963
2535
os.setuid(uid)
2964
if debug:
2965
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2966
gid))
2967
2536
except OSError as error:
2968
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2969
.format(uid, gid, os.strerror(error.errno)))
2970
2537
if error.errno != errno.EPERM:
2971
2538
raise
2972
2539
2975
2542
2976
2543
# "Use a log level over 10 to enable all debugging options."
2977
2544
# - GnuTLS manual
2978
gnutls.global_set_log_level(11)
2545
gnutls.library.functions.gnutls_global_set_log_level(11)
2979
2546
2980
@gnutls.log_func
2547
@gnutls.library.types.gnutls_log_func
2981
2548
def debug_gnutls(level, string):
2982
2549
logger.debug("GnuTLS: %s", string[:-1])
2983
2550
2984
gnutls.global_set_log_function(debug_gnutls)
2551
gnutls.library.functions.gnutls_global_set_log_function(
2552
debug_gnutls)
2985
2553
2986
2554
# Redirect stdin so all checkers get /dev/null
2987
2555
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2994
2562
# Close all input and output, do double fork, etc.
2995
2563
daemon()
2996
2564
2997
# multiprocessing will use threads, so before we use GLib we need
2998
# to inform GLib that threads will be used.
2999
GLib.threads_init()
2565
# multiprocessing will use threads, so before we use gobject we
2566
# need to inform gobject that threads will be used.
2567
gobject.threads_init()
3000
2568
3001
2569
global main_loop
3002
2570
# From the Avahi example code
3003
2571
DBusGMainLoop(set_as_default=True)
3004
main_loop = GLib.MainLoop()
2572
main_loop = gobject.MainLoop()
3005
2573
bus = dbus.SystemBus()
3006
2574
# End of Avahi example code
3007
2575
if use_dbus:
3051
2619
if server_settings["restore"]:
3052
2620
try:
3053
2621
with open(stored_state_path, "rb") as stored_state:
3054
if sys.version_info.major == 2:
3055
clients_data, old_client_settings = pickle.load(
3056
stored_state)
3057
else:
3058
bytes_clients_data, bytes_old_client_settings = (
3059
pickle.load(stored_state, encoding = "bytes"))
3060
### Fix bytes to strings
3061
## clients_data
3062
# .keys()
3063
clients_data = { (key.decode("utf-8")
3064
if isinstance(key, bytes)
3065
else key): value
3066
for key, value in
3067
bytes_clients_data.items() }
3068
del bytes_clients_data
3069
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3074
clients_data[key] = value
3075
# .client_structure
3076
value["client_structure"] = [
3077
(s.decode("utf-8")
3078
if isinstance(s, bytes)
3079
else s) for s in
3080
value["client_structure"] ]
3081
# .name & .host
3082
for k in ("name", "host"):
3083
if isinstance(value[k], bytes):
3084
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys()
3087
old_client_settings = {
3088
(key.decode("utf-8")
3089
if isinstance(key, bytes)
3090
else key): value
3091
for key, value in
3092
bytes_old_client_settings.items() }
3093
del bytes_old_client_settings
3094
# .host
3095
for value in old_client_settings.values():
3096
if isinstance(value["host"], bytes):
3097
value["host"] = (value["host"]
3098
.decode("utf-8"))
2622
clients_data, old_client_settings = pickle.load(
2623
stored_state)
3099
2624
os.remove(stored_state_path)
3100
2625
except IOError as e:
3101
2626
if e.errno == errno.ENOENT:
3202
2727
del pidfile
3203
2728
del pidfilename
3204
2729
3205
for termsig in (signal.SIGHUP, signal.SIGTERM):
3206
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3207
lambda: main_loop.quit() and False)
2730
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2731
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3208
2732
3209
2733
if use_dbus:
3210
2734
3211
2735
@alternate_dbus_interfaces(
3212
2736
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3213
class MandosDBusService(DBusObjectWithObjectManager):
2737
class MandosDBusService(DBusObjectWithProperties):
3214
2738
"""A D-Bus proxy object"""
3215
2739
3216
2740
def __init__(self):
3218
2742
3219
2743
_interface = "se.recompile.Mandos"
3220
2744
2745
@dbus_interface_annotations(_interface)
2746
def _foo(self):
2747
return {
2748
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
"false" }
2750
3221
2751
@dbus.service.signal(_interface, signature="o")
3222
2752
def ClientAdded(self, objpath):
3223
2753
"D-Bus signal"
3228
2758
"D-Bus signal"
3229
2759
pass
3230
2760
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3232
"true"})
3233
2761
@dbus.service.signal(_interface, signature="os")
3234
2762
def ClientRemoved(self, objpath, name):
3235
2763
"D-Bus signal"
3236
2764
pass
3237
2765
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3239
"true"})
3240
2766
@dbus.service.method(_interface, out_signature="ao")
3241
2767
def GetAllClients(self):
3242
2768
"D-Bus method"
3243
2769
return dbus.Array(c.dbus_object_path for c in
3244
tcp_server.clients.values())
2770
tcp_server.clients.itervalues())
3245
2771
3246
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3247
"true"})
3248
2772
@dbus.service.method(_interface,
3249
2773
out_signature="a{oa{sv}}")
3250
2774
def GetAllClientsWithProperties(self):
3251
2775
"D-Bus method"
3252
2776
return dbus.Dictionary(
3253
{ c.dbus_object_path: c.GetAll(
3254
"se.recompile.Mandos.Client")
3255
for c in tcp_server.clients.values() },
2777
{ c.dbus_object_path: c.GetAll("")
2778
for c in tcp_server.clients.itervalues() },
3256
2779
signature="oa{sv}")
3257
2780
3258
2781
@dbus.service.method(_interface, in_signature="o")
3259
2782
def RemoveClient(self, object_path):
3260
2783
"D-Bus method"
3261
for c in tcp_server.clients.values():
2784
for c in tcp_server.clients.itervalues():
3262
2785
if c.dbus_object_path == object_path:
3263
2786
del tcp_server.clients[c.name]
3264
2787
c.remove_from_connection()
3265
# Don't signal the disabling
2788
# Don't signal anything except ClientRemoved
3266
2789
c.disable(quiet=True)
3267
# Emit D-Bus signal for removal
3268
self.client_removed_signal(c)
2790
# Emit D-Bus signal
2791
self.ClientRemoved(object_path, c.name)
3269
2792
return
3270
2793
raise KeyError(object_path)
3271
2794
3272
2795
del _interface
3273
3274
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3275
out_signature = "a{oa{sa{sv}}}")
3276
def GetManagedObjects(self):
3277
"""D-Bus method"""
3278
return dbus.Dictionary(
3279
{ client.dbus_object_path:
3280
dbus.Dictionary(
3281
{ interface: client.GetAll(interface)
3282
for interface in
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3285
3286
def client_added_signal(self, client):
3287
"""Send the new standard signal and the old signal"""
3288
if use_dbus:
3289
# New standard signal
3290
self.InterfacesAdded(
3291
client.dbus_object_path,
3292
dbus.Dictionary(
3293
{ interface: client.GetAll(interface)
3294
for interface in
3295
client._get_all_interface_names()}))
3296
# Old signal
3297
self.ClientAdded(client.dbus_object_path)
3298
3299
def client_removed_signal(self, client):
3300
"""Send the new standard signal and the old signal"""
3301
if use_dbus:
3302
# New standard signal
3303
self.InterfacesRemoved(
3304
client.dbus_object_path,
3305
client._get_all_interface_names())
3306
# Old signal
3307
self.ClientRemoved(client.dbus_object_path,
3308
client.name)
3309
2796
3310
2797
mandos_dbus_service = MandosDBusService()
3311
2798
3324
2811
# removed/edited, old secret will thus be unrecovable.
3325
2812
clients = {}
3326
2813
with PGPEngine() as pgp:
3327
for client in tcp_server.clients.values():
2814
for client in tcp_server.clients.itervalues():
3328
2815
key = client_settings[client.name]["secret"]
3329
2816
client.encrypted_secret = pgp.encrypt(client.secret,
3330
2817
key)
3354
2841
prefix='clients-',
3355
2842
dir=os.path.dirname(stored_state_path),
3356
2843
delete=False) as stored_state:
3357
pickle.dump((clients, client_settings), stored_state,
3358
protocol = 2)
2844
pickle.dump((clients, client_settings), stored_state)
3359
2845
tempname = stored_state.name
3360
2846
os.rename(tempname, stored_state_path)
3361
2847
except (IOError, OSError) as e:
3377
2863
name, client = tcp_server.clients.popitem()
3378
2864
if use_dbus:
3379
2865
client.remove_from_connection()
3380
# Don't signal the disabling
2866
# Don't signal anything except ClientRemoved
3381
2867
client.disable(quiet=True)
3382
# Emit D-Bus signal for removal
3383
2868
if use_dbus:
3384
mandos_dbus_service.client_removed_signal(client)
2869
# Emit D-Bus signal
2870
mandos_dbus_service.ClientRemoved(
2871
client.dbus_object_path, client.name)
3385
2872
client_settings.clear()
3386
2873
3387
2874
atexit.register(cleanup)
3388
2875
3389
for client in tcp_server.clients.values():
2876
for client in tcp_server.clients.itervalues():
3390
2877
if use_dbus:
3391
# Emit D-Bus signal for adding
3392
mandos_dbus_service.client_added_signal(client)
2878
# Emit D-Bus signal
2879
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3393
2880
# Need to initiate checking of clients
3394
2881
if client.enabled:
3395
2882
client.init_checker()
3421
2908
sys.exit(1)
3422
2909
# End of Avahi example code
3423
2910
3424
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3425
lambda *args, **kwargs:
3426
(tcp_server.handle_request
3427
(*args[2:], **kwargs) or True))
2911
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2912
lambda *args, **kwargs:
2913
(tcp_server.handle_request
2914
(*args[2:], **kwargs) or True))
3428
2915
3429
2916
logger.debug("Starting main loop")
3430
2917
main_loop.run()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0