To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 775
- compare with another revision
- download diff
- download tarball
- view history from revision 775
- Committer: Teddy Hogeborn
- Date: 2015-07-20 00:18:59 UTC
- Revision ID: teddy@recompile.se-20150720001859-4373dkxokj7bt666
plugin-runner: Minor fix: close helperdir before exiting in fork.
* plugin-runner.c: Minor fix: close helperdir before exiting in fork
if helper program could not be opened.
* plugin-runner.c: Minor fix: close helperdir before exiting in fork
if helper program could not be opened.
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
39
try:
43
40
import SocketServer as socketserver
47
44
import argparse
48
45
import datetime
49
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
50
53
try:
51
54
import ConfigParser as configparser
52
55
except ImportError:
79
82
80
83
import dbus
81
84
import dbus.service
82
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
83
90
from dbus.mainloop.glib import DBusGMainLoop
84
91
import ctypes
85
92
import ctypes.util
86
93
import xml.dom.minidom
87
94
import inspect
88
95
89
# Try to find the value of SO_BINDTODEVICE:
90
96
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
98
except AttributeError:
95
99
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
98
100
from IN import SO_BINDTODEVICE
99
101
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
102
SO_BINDTODEVICE = None
113
103
114
104
if sys.version_info.major == 2:
115
105
str = unicode
116
106
117
version = "1.7.7"
107
version = "1.6.9"
118
108
stored_state_file = "clients.pickle"
119
109
120
110
logger = logging.getLogger()
135
125
return interface_index
136
126
137
127
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
154
128
def initlogger(debug, level=logging.WARNING):
155
129
"""init logger and add loglevel"""
156
130
183
157
184
158
def __init__(self):
185
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
self.gpg = "gpg"
187
try:
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
191
if name == "gpg":
192
self.gpg = path
193
break
194
except OSError as e:
195
if e.errno != errno.ENOENT:
196
raise
197
160
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
161
'--home', self.tempdir,
199
162
'--force-mdc',
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
163
'--quiet',
164
'--no-use-agent']
204
165
205
166
def __enter__(self):
206
167
return self
242
203
dir=self.tempdir) as passfile:
243
204
passfile.write(passphrase)
244
205
passfile.flush()
245
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
246
207
'--passphrase-file',
247
208
passfile.name]
248
209
+ self.gnupgargs,
260
221
dir = self.tempdir) as passfile:
261
222
passfile.write(passphrase)
262
223
passfile.flush()
263
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
264
225
'--passphrase-file',
265
226
passfile.name]
266
227
+ self.gnupgargs,
272
233
raise PGPError(err)
273
234
return decrypted_plaintext
274
235
275
# Pretend that we have an Avahi module
276
class Avahi(object):
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
283
DBUS_NAME = "org.freedesktop.Avahi"
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
286
DBUS_PATH_SERVER = "/"
287
def string_array_to_txt_array(self, t):
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
289
for s in t), signature="ay")
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
298
avahi = Avahi()
299
236
300
237
class AvahiError(Exception):
301
238
def __init__(self, value, *args, **kwargs):
498
435
.format(self.name)))
499
436
return ret
500
437
501
# Pretend that we have a GnuTLS module
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
505
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
509
def __init__(self):
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
512
# happens.
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
516
517
# Unless otherwise indicated, the constants and types below are
518
# all from the gnutls/gnutls.h C header file.
519
520
# Constants
521
E_SUCCESS = 0
522
E_INTERRUPTED = -52
523
E_AGAIN = -28
524
CRT_OPENPGP = 2
525
CLIENT = 2
526
SHUT_RDWR = 0
527
CRD_CERTIFICATE = 1
528
E_NO_CERTIFICATE_FOUND = -49
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
530
531
# Types
532
class session_int(ctypes.Structure):
533
_fields_ = []
534
session_t = ctypes.POINTER(session_int)
535
class certificate_credentials_st(ctypes.Structure):
536
_fields_ = []
537
certificate_credentials_t = ctypes.POINTER(
538
certificate_credentials_st)
539
certificate_type_t = ctypes.c_int
540
class datum_t(ctypes.Structure):
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
('size', ctypes.c_uint)]
543
class openpgp_crt_int(ctypes.Structure):
544
_fields_ = []
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
548
credentials_type_t = ctypes.c_int
549
transport_ptr_t = ctypes.c_void_p
550
close_request_t = ctypes.c_int
551
552
# Exceptions
553
class Error(Exception):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
559
# Default usage is by a message string, but if a return
560
# code is passed, convert it to a string with
561
# gnutls.strerror()
562
self.code = code
563
if message is None and code is not None:
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
566
message, *args)
567
568
class CertificateSecurityError(Error):
569
pass
570
571
# Classes
572
class Credentials(object):
573
def __init__(self):
574
self._c_object = gnutls.certificate_credentials_t()
575
gnutls.certificate_allocate_credentials(
576
ctypes.byref(self._c_object))
577
self.type = gnutls.CRD_CERTIFICATE
578
579
def __del__(self):
580
gnutls.certificate_free_credentials(self._c_object)
581
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
584
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
586
gnutls.set_default_priority(self._c_object)
587
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
gnutls.handshake_set_private_extensions(self._c_object,
589
True)
590
self.socket = socket
591
if credentials is None:
592
credentials = gnutls.Credentials()
593
gnutls.credentials_set(self._c_object, credentials.type,
594
ctypes.cast(credentials._c_object,
595
ctypes.c_void_p))
596
self.credentials = credentials
597
598
def __del__(self):
599
gnutls.deinit(self._c_object)
600
601
def handshake(self):
602
return gnutls.handshake(self._c_object)
603
604
def send(self, data):
605
data = bytes(data)
606
data_len = len(data)
607
while data_len > 0:
608
data_len -= gnutls.record_send(self._c_object,
609
data[-data_len:],
610
data_len)
611
612
def bye(self):
613
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
614
615
# Error handling functions
616
def _error_code(result):
617
"""A function to raise exceptions on errors, suitable
618
for the 'restype' attribute on ctypes functions"""
619
if result >= 0:
620
return result
621
if result == gnutls.E_NO_CERTIFICATE_FOUND:
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
624
625
def _retry_on_error(result, func, arguments):
626
"""A function to retry on some errors, suitable
627
for the 'errcheck' attribute on ctypes functions"""
628
while result < 0:
629
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
630
return _error_code(result)
631
result = func(*arguments)
632
return result
633
634
# Unless otherwise indicated, the function declarations below are
635
# all from the gnutls/gnutls.h C header file.
636
637
# Functions
638
priority_set_direct = _library.gnutls_priority_set_direct
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
640
ctypes.POINTER(ctypes.c_char_p)]
641
priority_set_direct.restype = _error_code
642
643
init = _library.gnutls_init
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
645
init.restype = _error_code
646
647
set_default_priority = _library.gnutls_set_default_priority
648
set_default_priority.argtypes = [session_t]
649
set_default_priority.restype = _error_code
650
651
record_send = _library.gnutls_record_send
652
record_send.argtypes = [session_t, ctypes.c_void_p,
653
ctypes.c_size_t]
654
record_send.restype = ctypes.c_ssize_t
655
record_send.errcheck = _retry_on_error
656
657
certificate_allocate_credentials = (
658
_library.gnutls_certificate_allocate_credentials)
659
certificate_allocate_credentials.argtypes = [
660
ctypes.POINTER(certificate_credentials_t)]
661
certificate_allocate_credentials.restype = _error_code
662
663
certificate_free_credentials = (
664
_library.gnutls_certificate_free_credentials)
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
666
certificate_free_credentials.restype = None
667
668
handshake_set_private_extensions = (
669
_library.gnutls_handshake_set_private_extensions)
670
handshake_set_private_extensions.argtypes = [session_t,
671
ctypes.c_int]
672
handshake_set_private_extensions.restype = None
673
674
credentials_set = _library.gnutls_credentials_set
675
credentials_set.argtypes = [session_t, credentials_type_t,
676
ctypes.c_void_p]
677
credentials_set.restype = _error_code
678
679
strerror = _library.gnutls_strerror
680
strerror.argtypes = [ctypes.c_int]
681
strerror.restype = ctypes.c_char_p
682
683
certificate_type_get = _library.gnutls_certificate_type_get
684
certificate_type_get.argtypes = [session_t]
685
certificate_type_get.restype = _error_code
686
687
certificate_get_peers = _library.gnutls_certificate_get_peers
688
certificate_get_peers.argtypes = [session_t,
689
ctypes.POINTER(ctypes.c_uint)]
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
691
692
global_set_log_level = _library.gnutls_global_set_log_level
693
global_set_log_level.argtypes = [ctypes.c_int]
694
global_set_log_level.restype = None
695
696
global_set_log_function = _library.gnutls_global_set_log_function
697
global_set_log_function.argtypes = [log_func]
698
global_set_log_function.restype = None
699
700
deinit = _library.gnutls_deinit
701
deinit.argtypes = [session_t]
702
deinit.restype = None
703
704
handshake = _library.gnutls_handshake
705
handshake.argtypes = [session_t]
706
handshake.restype = _error_code
707
handshake.errcheck = _retry_on_error
708
709
transport_set_ptr = _library.gnutls_transport_set_ptr
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
711
transport_set_ptr.restype = None
712
713
bye = _library.gnutls_bye
714
bye.argtypes = [session_t, close_request_t]
715
bye.restype = _error_code
716
bye.errcheck = _retry_on_error
717
718
check_version = _library.gnutls_check_version
719
check_version.argtypes = [ctypes.c_char_p]
720
check_version.restype = ctypes.c_char_p
721
722
# All the function declarations below are from gnutls/openpgp.h
723
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
727
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
731
openpgp_crt_fmt_t]
732
openpgp_crt_import.restype = _error_code
733
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
738
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
742
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
746
ctypes.c_void_p,
747
ctypes.POINTER(
748
ctypes.c_size_t)]
749
openpgp_crt_get_fingerprint.restype = _error_code
750
751
# Remove non-public functions
752
del _error_code, _retry_on_error
753
# Create the global "gnutls" object, simulating a module
754
gnutls = GnuTLS()
755
756
438
def call_pipe(connection, # : multiprocessing.Connection
757
439
func, *args, **kwargs):
758
440
"""This function is meant to be called by multiprocessing.Process
773
455
checker: subprocess.Popen(); a running checker process used
774
456
to see if the client lives.
775
457
'None' if no process is running.
776
checker_callback_tag: a GLib event source tag, or None
458
checker_callback_tag: a gobject event source tag, or None
777
459
checker_command: string; External command which is run to check
778
460
if client lives. %() expansions are done at
779
461
runtime with vars(self) as dict, so that for
780
462
instance %(name)s can be used in the command.
781
checker_initiator_tag: a GLib event source tag, or None
463
checker_initiator_tag: a gobject event source tag, or None
782
464
created: datetime.datetime(); (UTC) object creation
783
465
client_structure: Object describing what attributes a client has
784
466
and is used for storing the client at exit
785
467
current_checker_command: string; current running checker_command
786
disable_initiator_tag: a GLib event source tag, or None
468
disable_initiator_tag: a gobject event source tag, or None
787
469
enabled: bool()
788
470
fingerprint: string (40 or 32 hexadecimal digits); used to
789
471
uniquely identify the client
852
534
client["fingerprint"] = (section["fingerprint"].upper()
853
535
.replace(" ", ""))
854
536
if "secret" in section:
855
client["secret"] = codecs.decode(section["secret"]
856
.encode("utf-8"),
857
"base64")
537
client["secret"] = section["secret"].decode("base64")
858
538
elif "secfile" in section:
859
539
with open(os.path.expanduser(os.path.expandvars
860
540
(section["secfile"])),
913
593
self.changedstate = multiprocessing_manager.Condition(
914
594
multiprocessing_manager.Lock())
915
595
self.client_structure = [attr
916
for attr in self.__dict__.keys()
596
for attr in self.__dict__.iterkeys()
917
597
if not attr.startswith("_")]
918
598
self.client_structure.append("client_structure")
919
599
945
625
if not quiet:
946
626
logger.info("Disabling client %s", self.name)
947
627
if getattr(self, "disable_initiator_tag", None) is not None:
948
GLib.source_remove(self.disable_initiator_tag)
628
gobject.source_remove(self.disable_initiator_tag)
949
629
self.disable_initiator_tag = None
950
630
self.expires = None
951
631
if getattr(self, "checker_initiator_tag", None) is not None:
952
GLib.source_remove(self.checker_initiator_tag)
632
gobject.source_remove(self.checker_initiator_tag)
953
633
self.checker_initiator_tag = None
954
634
self.stop_checker()
955
635
self.enabled = False
956
636
if not quiet:
957
637
self.send_changedstate()
958
# Do not run this again if called by a GLib.timeout_add
638
# Do not run this again if called by a gobject.timeout_add
959
639
return False
960
640
961
641
def __del__(self):
965
645
# Schedule a new checker to be started an 'interval' from now,
966
646
# and every interval from then on.
967
647
if self.checker_initiator_tag is not None:
968
GLib.source_remove(self.checker_initiator_tag)
969
self.checker_initiator_tag = GLib.timeout_add(
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
970
650
int(self.interval.total_seconds() * 1000),
971
651
self.start_checker)
972
652
# Schedule a disable() when 'timeout' has passed
973
653
if self.disable_initiator_tag is not None:
974
GLib.source_remove(self.disable_initiator_tag)
975
self.disable_initiator_tag = GLib.timeout_add(
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
976
656
int(self.timeout.total_seconds() * 1000), self.disable)
977
657
# Also start a new checker *right now*.
978
658
self.start_checker()
1014
694
if timeout is None:
1015
695
timeout = self.timeout
1016
696
if self.disable_initiator_tag is not None:
1017
GLib.source_remove(self.disable_initiator_tag)
697
gobject.source_remove(self.disable_initiator_tag)
1018
698
self.disable_initiator_tag = None
1019
699
if getattr(self, "enabled", False):
1020
self.disable_initiator_tag = GLib.timeout_add(
700
self.disable_initiator_tag = gobject.timeout_add(
1021
701
int(timeout.total_seconds() * 1000), self.disable)
1022
702
self.expires = datetime.datetime.utcnow() + timeout
1023
703
1078
758
args = (pipe[1], subprocess.call, command),
1079
759
kwargs = popen_args)
1080
760
self.checker.start()
1081
self.checker_callback_tag = GLib.io_add_watch(
1082
pipe[0].fileno(), GLib.IO_IN,
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
1083
763
self.checker_callback, pipe[0], command)
1084
# Re-run this periodically if run by GLib.timeout_add
764
# Re-run this periodically if run by gobject.timeout_add
1085
765
return True
1086
766
1087
767
def stop_checker(self):
1088
768
"""Force the checker process, if any, to stop."""
1089
769
if self.checker_callback_tag:
1090
GLib.source_remove(self.checker_callback_tag)
770
gobject.source_remove(self.checker_callback_tag)
1091
771
self.checker_callback_tag = None
1092
772
if getattr(self, "checker", None) is None:
1093
773
return
1162
842
access="r")
1163
843
def Property_dbus_property(self):
1164
844
return dbus.Boolean(False)
1165
1166
See also the DBusObjectWithAnnotations class.
1167
845
"""
1168
846
1169
847
def decorator(func):
1191
869
pass
1192
870
1193
871
1194
class DBusObjectWithAnnotations(dbus.service.Object):
1195
"""A D-Bus object with annotations.
872
class DBusObjectWithProperties(dbus.service.Object):
873
"""A D-Bus object with properties.
1196
874
1197
Classes inheriting from this can use the dbus_annotations
1198
decorator to add annotations to methods or signals.
875
Classes inheriting from this can use the dbus_service_property
876
decorator to expose methods as D-Bus properties. It exposes the
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
1199
878
"""
1200
879
1201
880
@staticmethod
1217
896
for name, athing in
1218
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1219
898
1220
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1221
out_signature = "s",
1222
path_keyword = 'object_path',
1223
connection_keyword = 'connection')
1224
def Introspect(self, object_path, connection):
1225
"""Overloading of standard D-Bus method.
1226
1227
Inserts annotation tags on methods and signals.
1228
"""
1229
xmlstring = dbus.service.Object.Introspect(self, object_path,
1230
connection)
1231
try:
1232
document = xml.dom.minidom.parseString(xmlstring)
1233
1234
for if_tag in document.getElementsByTagName("interface"):
1235
# Add annotation tags
1236
for typ in ("method", "signal"):
1237
for tag in if_tag.getElementsByTagName(typ):
1238
annots = dict()
1239
for name, prop in (self.
1240
_get_all_dbus_things(typ)):
1241
if (name == tag.getAttribute("name")
1242
and prop._dbus_interface
1243
== if_tag.getAttribute("name")):
1244
annots.update(getattr(
1245
prop, "_dbus_annotations", {}))
1246
for name, value in annots.items():
1247
ann_tag = document.createElement(
1248
"annotation")
1249
ann_tag.setAttribute("name", name)
1250
ann_tag.setAttribute("value", value)
1251
tag.appendChild(ann_tag)
1252
# Add interface annotation tags
1253
for annotation, value in dict(
1254
itertools.chain.from_iterable(
1255
annotations().items()
1256
for name, annotations
1257
in self._get_all_dbus_things("interface")
1258
if name == if_tag.getAttribute("name")
1259
)).items():
1260
ann_tag = document.createElement("annotation")
1261
ann_tag.setAttribute("name", annotation)
1262
ann_tag.setAttribute("value", value)
1263
if_tag.appendChild(ann_tag)
1264
# Fix argument name for the Introspect method itself
1265
if (if_tag.getAttribute("name")
1266
== dbus.INTROSPECTABLE_IFACE):
1267
for cn in if_tag.getElementsByTagName("method"):
1268
if cn.getAttribute("name") == "Introspect":
1269
for arg in cn.getElementsByTagName("arg"):
1270
if (arg.getAttribute("direction")
1271
== "out"):
1272
arg.setAttribute("name",
1273
"xml_data")
1274
xmlstring = document.toxml("utf-8")
1275
document.unlink()
1276
except (AttributeError, xml.dom.DOMException,
1277
xml.parsers.expat.ExpatError) as error:
1278
logger.error("Failed to override Introspection method",
1279
exc_info=error)
1280
return xmlstring
1281
1282
1283
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1284
"""A D-Bus object with properties.
1285
1286
Classes inheriting from this can use the dbus_service_property
1287
decorator to expose methods as D-Bus properties. It exposes the
1288
standard Get(), Set(), and GetAll() methods on the D-Bus.
1289
"""
1290
1291
899
def _get_dbus_property(self, interface_name, property_name):
1292
900
"""Returns a bound method if one exists which is a D-Bus
1293
901
property with the specified name and interface.
1303
911
raise DBusPropertyNotFound("{}:{}.{}".format(
1304
912
self.dbus_object_path, interface_name, property_name))
1305
913
1306
@classmethod
1307
def _get_all_interface_names(cls):
1308
"""Get a sequence of all interfaces supported by an object"""
1309
return (name for name in set(getattr(getattr(x, attr),
1310
"_dbus_interface", None)
1311
for x in (inspect.getmro(cls))
1312
for attr in dir(x))
1313
if name is not None)
1314
1315
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
1316
915
in_signature="ss",
1317
916
out_signature="v")
1387
986
1388
987
Inserts property tags and interface annotation tags.
1389
988
"""
1390
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1391
object_path,
1392
connection)
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
990
connection)
1393
991
try:
1394
992
document = xml.dom.minidom.parseString(xmlstring)
1395
993
1408
1006
if prop._dbus_interface
1409
1007
== if_tag.getAttribute("name")):
1410
1008
if_tag.appendChild(tag)
1411
# Add annotation tags for properties
1412
for tag in if_tag.getElementsByTagName("property"):
1413
annots = dict()
1414
for name, prop in self._get_all_dbus_things(
1415
"property"):
1416
if (name == tag.getAttribute("name")
1417
and prop._dbus_interface
1418
== if_tag.getAttribute("name")):
1419
annots.update(getattr(
1420
prop, "_dbus_annotations", {}))
1421
for name, value in annots.items():
1422
ann_tag = document.createElement(
1423
"annotation")
1424
ann_tag.setAttribute("name", name)
1425
ann_tag.setAttribute("value", value)
1426
tag.appendChild(ann_tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1427
1038
# Add the names to the return values for the
1428
1039
# "org.freedesktop.DBus.Properties" methods
1429
1040
if (if_tag.getAttribute("name")
1447
1058
exc_info=error)
1448
1059
return xmlstring
1449
1060
1450
try:
1451
dbus.OBJECT_MANAGER_IFACE
1452
except AttributeError:
1453
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1454
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1456
"""A D-Bus object with an ObjectManager.
1457
1458
Classes inheriting from this exposes the standard
1459
GetManagedObjects call and the InterfacesAdded and
1460
InterfacesRemoved signals on the standard
1461
"org.freedesktop.DBus.ObjectManager" interface.
1462
1463
Note: No signals are sent automatically; they must be sent
1464
manually.
1465
"""
1466
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1467
out_signature = "a{oa{sa{sv}}}")
1468
def GetManagedObjects(self):
1469
"""This function must be overridden"""
1470
raise NotImplementedError()
1471
1472
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1473
signature = "oa{sa{sv}}")
1474
def InterfacesAdded(self, object_path, interfaces_and_properties):
1475
pass
1476
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1478
def InterfacesRemoved(self, object_path, interfaces):
1479
pass
1480
1481
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1485
def Introspect(self, object_path, connection):
1486
"""Overloading of standard D-Bus method.
1487
1488
Override return argument name of GetManagedObjects to be
1489
"objpath_interfaces_and_properties"
1490
"""
1491
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1492
object_path,
1493
connection)
1494
try:
1495
document = xml.dom.minidom.parseString(xmlstring)
1496
1497
for if_tag in document.getElementsByTagName("interface"):
1498
# Fix argument name for the GetManagedObjects method
1499
if (if_tag.getAttribute("name")
1500
== dbus.OBJECT_MANAGER_IFACE):
1501
for cn in if_tag.getElementsByTagName("method"):
1502
if (cn.getAttribute("name")
1503
== "GetManagedObjects"):
1504
for arg in cn.getElementsByTagName("arg"):
1505
if (arg.getAttribute("direction")
1506
== "out"):
1507
arg.setAttribute(
1508
"name",
1509
"objpath_interfaces"
1510
"_and_properties")
1511
xmlstring = document.toxml("utf-8")
1512
document.unlink()
1513
except (AttributeError, xml.dom.DOMException,
1514
xml.parsers.expat.ExpatError) as error:
1515
logger.error("Failed to override Introspection method",
1516
exc_info = error)
1517
return xmlstring
1518
1061
1519
1062
def datetime_to_dbus(dt, variant_level=0):
1520
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1567
1110
interface_names.add(alt_interface)
1568
1111
# Is this a D-Bus signal?
1569
1112
if getattr(attribute, "_dbus_is_signal", False):
1570
# Extract the original non-method undecorated
1571
# function by black magic
1572
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1573
1116
nonmethod_func = (dict(
1574
1117
zip(attribute.func_code.co_freevars,
1575
1118
attribute.__closure__))
1576
1119
["func"].cell_contents)
1577
1120
else:
1578
nonmethod_func = (dict(
1579
zip(attribute.__code__.co_freevars,
1580
attribute.__closure__))
1581
["func"].cell_contents)
1121
nonmethod_func = attribute
1582
1122
# Create a new, but exactly alike, function
1583
1123
# object, and decorate it to be a new D-Bus signal
1584
1124
# with the alternate D-Bus interface name
1585
new_function = copy_function(nonmethod_func)
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1132
else:
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1586
1139
new_function = (dbus.service.signal(
1587
1140
alt_interface,
1588
1141
attribute._dbus_signature)(new_function))
1601
1154
func1 and func2 to the "call_both" function
1602
1155
outside of its arguments"""
1603
1156
1604
@functools.wraps(func2)
1605
1157
def call_both(*args, **kwargs):
1606
1158
"""This function will emit two D-Bus
1607
1159
signals by calling func1 and func2"""
1608
1160
func1(*args, **kwargs)
1609
1161
func2(*args, **kwargs)
1610
# Make wrapper function look like a D-Bus signal
1611
for name, attr in inspect.getmembers(func2):
1612
if name.startswith("_dbus_"):
1613
setattr(call_both, name, attr)
1614
1162
1615
1163
return call_both
1616
1164
# Create the "call_both" function and add it to
1627
1175
alt_interface,
1628
1176
attribute._dbus_in_signature,
1629
1177
attribute._dbus_out_signature)
1630
(copy_function(attribute)))
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1631
1183
# Copy annotations, if any
1632
1184
try:
1633
1185
attr[attrname]._dbus_annotations = dict(
1645
1197
attribute._dbus_access,
1646
1198
attribute._dbus_get_args_options
1647
1199
["byte_arrays"])
1648
(copy_function(attribute)))
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1649
1206
# Copy annotations, if any
1650
1207
try:
1651
1208
attr[attrname]._dbus_annotations = dict(
1660
1217
# to the class.
1661
1218
attr[attrname] = (
1662
1219
dbus_interface_annotations(alt_interface)
1663
(copy_function(attribute)))
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1664
1225
if deprecate:
1665
1226
# Deprecate all alternate interfaces
1666
1227
iname="_AlternateDBusNames_interface_annotation{}"
1679
1240
if interface_names:
1680
1241
# Replace the class with a new subclass of it with
1681
1242
# methods, signals, etc. as created above.
1682
if sys.version_info.major == 2:
1683
cls = type(b"{}Alternate".format(cls.__name__),
1684
(cls, ), attr)
1685
else:
1686
cls = type("{}Alternate".format(cls.__name__),
1687
(cls, ), attr)
1243
cls = type(b"{}Alternate".format(cls.__name__),
1244
(cls, ), attr)
1688
1245
return cls
1689
1246
1690
1247
return wrapper
1819
1376
if exitstatus >= 0:
1820
1377
# Emit D-Bus signal
1821
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
1822
# This is specific to GNU libC
1823
dbus.Int64(exitstatus << 8),
1379
dbus.Int64(0),
1824
1380
dbus.String(command))
1825
1381
else:
1826
1382
# Emit D-Bus signal
1827
1383
self.CheckerCompleted(dbus.Int16(-1),
1828
1384
dbus.Int64(
1829
# This is specific to GNU libC
1830
(exitstatus << 8)
1831
| self.last_checker_signal),
1385
self.last_checker_signal),
1832
1386
dbus.String(command))
1833
1387
return ret
1834
1388
1848
1402
1849
1403
def approve(self, value=True):
1850
1404
self.approved = value
1851
GLib.timeout_add(int(self.approval_duration.total_seconds()
1852
* 1000), self._reset_approved)
1405
gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
* 1000), self._reset_approved)
1853
1407
self.send_changedstate()
1854
1408
1855
1409
## D-Bus methods, signals & properties
1911
1465
self.checked_ok()
1912
1466
1913
1467
# Enable - method
1914
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1915
1468
@dbus.service.method(_interface)
1916
1469
def Enable(self):
1917
1470
"D-Bus method"
1918
1471
self.enable()
1919
1472
1920
1473
# StartChecker - method
1921
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1922
1474
@dbus.service.method(_interface)
1923
1475
def StartChecker(self):
1924
1476
"D-Bus method"
1925
1477
self.start_checker()
1926
1478
1927
1479
# Disable - method
1928
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1929
1480
@dbus.service.method(_interface)
1930
1481
def Disable(self):
1931
1482
"D-Bus method"
1932
1483
self.disable()
1933
1484
1934
1485
# StopChecker - method
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1936
1486
@dbus.service.method(_interface)
1937
1487
def StopChecker(self):
1938
1488
self.stop_checker()
1974
1524
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1975
1525
1976
1526
# Name - property
1977
@dbus_annotations(
1978
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1979
1527
@dbus_service_property(_interface, signature="s", access="read")
1980
1528
def Name_dbus_property(self):
1981
1529
return dbus.String(self.name)
1982
1530
1983
1531
# Fingerprint - property
1984
@dbus_annotations(
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
1532
@dbus_service_property(_interface, signature="s", access="read")
1987
1533
def Fingerprint_dbus_property(self):
1988
1534
return dbus.String(self.fingerprint)
1997
1543
self.host = str(value)
1998
1544
1999
1545
# Created - property
2000
@dbus_annotations(
2001
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2002
1546
@dbus_service_property(_interface, signature="s", access="read")
2003
1547
def Created_dbus_property(self):
2004
1548
return datetime_to_dbus(self.created)
2065
1609
if (getattr(self, "disable_initiator_tag", None)
2066
1610
is None):
2067
1611
return
2068
GLib.source_remove(self.disable_initiator_tag)
2069
self.disable_initiator_tag = GLib.timeout_add(
1612
gobject.source_remove(self.disable_initiator_tag)
1613
self.disable_initiator_tag = gobject.timeout_add(
2070
1614
int((self.expires - now).total_seconds() * 1000),
2071
1615
self.disable)
2072
1616
2092
1636
return
2093
1637
if self.enabled:
2094
1638
# Reschedule checker run
2095
GLib.source_remove(self.checker_initiator_tag)
2096
self.checker_initiator_tag = GLib.timeout_add(
1639
gobject.source_remove(self.checker_initiator_tag)
1640
self.checker_initiator_tag = gobject.timeout_add(
2097
1641
value, self.start_checker)
2098
1642
self.start_checker() # Start one now, too
2099
1643
2119
1663
self.stop_checker()
2120
1664
2121
1665
# ObjectPath - property
2122
@dbus_annotations(
2123
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2124
"org.freedesktop.DBus.Deprecated": "true"})
2125
1666
@dbus_service_property(_interface, signature="o", access="read")
2126
1667
def ObjectPath_dbus_property(self):
2127
1668
return self.dbus_object_path # is already a dbus.ObjectPath
2128
1669
2129
1670
# Secret = property
2130
@dbus_annotations(
2131
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2132
"invalidates"})
2133
1671
@dbus_service_property(_interface,
2134
1672
signature="ay",
2135
1673
access="write",
2181
1719
logger.debug("Pipe FD: %d",
2182
1720
self.server.child_pipe.fileno())
2183
1721
2184
session = gnutls.ClientSession(self.request)
1722
session = gnutls.connection.ClientSession(
1723
self.request, gnutls.connection .X509Credentials())
1724
1725
# Note: gnutls.connection.X509Credentials is really a
1726
# generic GnuTLS certificate credentials object so long as
1727
# no X.509 keys are added to it. Therefore, we can use it
1728
# here despite using OpenPGP certificates.
2185
1729
2186
1730
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
1731
# "+AES-256-CBC", "+SHA1",
2191
1735
priority = self.server.gnutls_priority
2192
1736
if priority is None:
2193
1737
priority = "NORMAL"
2194
gnutls.priority_set_direct(session._c_object,
2195
priority.encode("utf-8"),
2196
None)
1738
gnutls.library.functions.gnutls_priority_set_direct(
1739
session._c_object, priority, None)
2197
1740
2198
1741
# Start communication using the Mandos protocol
2199
1742
# Get protocol number
2209
1752
# Start GnuTLS connection
2210
1753
try:
2211
1754
session.handshake()
2212
except gnutls.Error as error:
1755
except gnutls.errors.GNUTLSError as error:
2213
1756
logger.warning("Handshake failed: %s", error)
2214
1757
# Do not run session.bye() here: the session is not
2215
1758
# established. Just abandon the request.
2221
1764
try:
2222
1765
fpr = self.fingerprint(
2223
1766
self.peer_certificate(session))
2224
except (TypeError, gnutls.Error) as error:
1767
except (TypeError,
1768
gnutls.errors.GNUTLSError) as error:
2225
1769
logger.warning("Bad certificate: %s", error)
2226
1770
return
2227
1771
logger.debug("Fingerprint: %s", fpr)
2285
1829
else:
2286
1830
delay -= time2 - time
2287
1831
2288
try:
2289
session.send(client.secret)
2290
except gnutls.Error as error:
2291
logger.warning("gnutls send failed",
2292
exc_info = error)
2293
return
1832
sent_size = 0
1833
while sent_size < len(client.secret):
1834
try:
1835
sent = session.send(client.secret[sent_size:])
1836
except gnutls.errors.GNUTLSError as error:
1837
logger.warning("gnutls send failed",
1838
exc_info=error)
1839
return
1840
logger.debug("Sent: %d, remaining: %d", sent,
1841
len(client.secret) - (sent_size
1842
+ sent))
1843
sent_size += sent
2294
1844
2295
1845
logger.info("Sending secret to %s", client.name)
2296
1846
# bump the timeout using extended_timeout
2304
1854
client.approvals_pending -= 1
2305
1855
try:
2306
1856
session.bye()
2307
except gnutls.Error as error:
1857
except gnutls.errors.GNUTLSError as error:
2308
1858
logger.warning("GnuTLS bye failed",
2309
1859
exc_info=error)
2310
1860
2312
1862
def peer_certificate(session):
2313
1863
"Return the peer's OpenPGP certificate as a bytestring"
2314
1864
# If not an OpenPGP certificate...
2315
if (gnutls.certificate_type_get(session._c_object)
2316
!= gnutls.CRT_OPENPGP):
2317
# ...return invalid data
2318
return b""
1865
if (gnutls.library.functions.gnutls_certificate_type_get(
1866
session._c_object)
1867
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
# ...do the normal thing
1869
return session.peer_certificate
2319
1870
list_size = ctypes.c_uint(1)
2320
cert_list = (gnutls.certificate_get_peers
1871
cert_list = (gnutls.library.functions
1872
.gnutls_certificate_get_peers
2321
1873
(session._c_object, ctypes.byref(list_size)))
2322
1874
if not bool(cert_list) and list_size.value != 0:
2323
raise gnutls.Error("error getting peer certificate")
1875
raise gnutls.errors.GNUTLSError("error getting peer"
1876
" certificate")
2324
1877
if list_size.value == 0:
2325
1878
return None
2326
1879
cert = cert_list[0]
2330
1883
def fingerprint(openpgp):
2331
1884
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2332
1885
# New GnuTLS "datum" with the OpenPGP public key
2333
datum = gnutls.datum_t(
1886
datum = gnutls.library.types.gnutls_datum_t(
2334
1887
ctypes.cast(ctypes.c_char_p(openpgp),
2335
1888
ctypes.POINTER(ctypes.c_ubyte)),
2336
1889
ctypes.c_uint(len(openpgp)))
2337
1890
# New empty GnuTLS certificate
2338
crt = gnutls.openpgp_crt_t()
2339
gnutls.openpgp_crt_init(ctypes.byref(crt))
1891
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
gnutls.library.functions.gnutls_openpgp_crt_init(
1893
ctypes.byref(crt))
2340
1894
# Import the OpenPGP public key into the certificate
2341
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2342
gnutls.OPENPGP_FMT_RAW)
1895
gnutls.library.functions.gnutls_openpgp_crt_import(
1896
crt, ctypes.byref(datum),
1897
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2343
1898
# Verify the self signature in the key
2344
1899
crtverify = ctypes.c_uint()
2345
gnutls.openpgp_crt_verify_self(crt, 0,
2346
ctypes.byref(crtverify))
1900
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
crt, 0, ctypes.byref(crtverify))
2347
1902
if crtverify.value != 0:
2348
gnutls.openpgp_crt_deinit(crt)
2349
raise gnutls.CertificateSecurityError("Verify failed")
1903
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
raise gnutls.errors.CertificateSecurityError(
1905
"Verify failed")
2350
1906
# New buffer for the fingerprint
2351
1907
buf = ctypes.create_string_buffer(20)
2352
1908
buf_len = ctypes.c_size_t()
2353
1909
# Get the fingerprint from the certificate into the buffer
2354
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2355
ctypes.byref(buf_len))
1910
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2356
1912
# Deinit the certificate
2357
gnutls.openpgp_crt_deinit(crt)
1913
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2358
1914
# Convert the buffer to a Python bytestring
2359
1915
fpr = ctypes.string_at(buf, buf_len.value)
2360
1916
# Convert the bytestring to hexadecimal notation
2455
2011
bind to an address or port if they were not specified."""
2456
2012
if self.interface is not None:
2457
2013
if SO_BINDTODEVICE is None:
2458
# Fall back to a hard-coded value which seems to be
2459
# common enough.
2460
logger.warning("SO_BINDTODEVICE not found, trying 25")
2461
SO_BINDTODEVICE = 25
2462
try:
2463
self.socket.setsockopt(
2464
socket.SOL_SOCKET, SO_BINDTODEVICE,
2465
(self.interface + "\0").encode("utf-8"))
2466
except socket.error as error:
2467
if error.errno == errno.EPERM:
2468
logger.error("No permission to bind to"
2469
" interface %s", self.interface)
2470
elif error.errno == errno.ENOPROTOOPT:
2471
logger.error("SO_BINDTODEVICE not available;"
2472
" cannot bind to interface %s",
2473
self.interface)
2474
elif error.errno == errno.ENODEV:
2475
logger.error("Interface %s does not exist,"
2476
" cannot bind", self.interface)
2477
else:
2478
raise
2014
logger.error("SO_BINDTODEVICE does not exist;"
2015
" cannot bind to interface %s",
2016
self.interface)
2017
else:
2018
try:
2019
self.socket.setsockopt(
2020
socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
(self.interface + "\0").encode("utf-8"))
2022
except socket.error as error:
2023
if error.errno == errno.EPERM:
2024
logger.error("No permission to bind to"
2025
" interface %s", self.interface)
2026
elif error.errno == errno.ENOPROTOOPT:
2027
logger.error("SO_BINDTODEVICE not available;"
2028
" cannot bind to interface %s",
2029
self.interface)
2030
elif error.errno == errno.ENODEV:
2031
logger.error("Interface %s does not exist,"
2032
" cannot bind", self.interface)
2033
else:
2034
raise
2479
2035
# Only bind(2) the socket if we really need to.
2480
2036
if self.server_address[0] or self.server_address[1]:
2481
2037
if not self.server_address[0]:
2504
2060
gnutls_priority GnuTLS priority string
2505
2061
use_dbus: Boolean; to emit D-Bus signals or not
2506
2062
2507
Assumes a GLib.MainLoop event loop.
2063
Assumes a gobject.MainLoop event loop.
2508
2064
"""
2509
2065
2510
2066
def __init__(self, server_address, RequestHandlerClass,
2535
2091
2536
2092
def add_pipe(self, parent_pipe, proc):
2537
2093
# Call "handle_ipc" for both data and EOF events
2538
GLib.io_add_watch(
2094
gobject.io_add_watch(
2539
2095
parent_pipe.fileno(),
2540
GLib.IO_IN | GLib.IO_HUP,
2096
gobject.IO_IN | gobject.IO_HUP,
2541
2097
functools.partial(self.handle_ipc,
2542
2098
parent_pipe = parent_pipe,
2543
2099
proc = proc))
2547
2103
proc = None,
2548
2104
client_object=None):
2549
2105
# error, or the other end of multiprocessing.Pipe has closed
2550
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2106
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2551
2107
# Wait for other process to exit
2552
2108
proc.join()
2553
2109
return False
2560
2116
fpr = request[1]
2561
2117
address = request[2]
2562
2118
2563
for c in self.clients.values():
2119
for c in self.clients.itervalues():
2564
2120
if c.fingerprint == fpr:
2565
2121
client = c
2566
2122
break
2574
2130
parent_pipe.send(False)
2575
2131
return False
2576
2132
2577
GLib.io_add_watch(
2133
gobject.io_add_watch(
2578
2134
parent_pipe.fileno(),
2579
GLib.IO_IN | GLib.IO_HUP,
2135
gobject.IO_IN | gobject.IO_HUP,
2580
2136
functools.partial(self.handle_ipc,
2581
2137
parent_pipe = parent_pipe,
2582
2138
proc = proc,
2841
2397
"debug": "False",
2842
2398
"priority":
2843
2399
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2844
":+SIGN-DSA-SHA256",
2400
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2845
2401
"servicename": "Mandos",
2846
2402
"use_dbus": "True",
2847
2403
"use_ipv6": "True",
2964
2520
logger.error("Could not open file %r", pidfilename,
2965
2521
exc_info=e)
2966
2522
2967
for name, group in (("_mandos", "_mandos"),
2968
("mandos", "mandos"),
2969
("nobody", "nogroup")):
2523
for name in ("_mandos", "mandos", "nobody"):
2970
2524
try:
2971
2525
uid = pwd.getpwnam(name).pw_uid
2972
gid = pwd.getpwnam(group).pw_gid
2526
gid = pwd.getpwnam(name).pw_gid
2973
2527
break
2974
2528
except KeyError:
2975
2529
continue
2979
2533
try:
2980
2534
os.setgid(gid)
2981
2535
os.setuid(uid)
2982
if debug:
2983
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2984
gid))
2985
2536
except OSError as error:
2986
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2987
.format(uid, gid, os.strerror(error.errno)))
2988
2537
if error.errno != errno.EPERM:
2989
2538
raise
2990
2539
2993
2542
2994
2543
# "Use a log level over 10 to enable all debugging options."
2995
2544
# - GnuTLS manual
2996
gnutls.global_set_log_level(11)
2545
gnutls.library.functions.gnutls_global_set_log_level(11)
2997
2546
2998
@gnutls.log_func
2547
@gnutls.library.types.gnutls_log_func
2999
2548
def debug_gnutls(level, string):
3000
2549
logger.debug("GnuTLS: %s", string[:-1])
3001
2550
3002
gnutls.global_set_log_function(debug_gnutls)
2551
gnutls.library.functions.gnutls_global_set_log_function(
2552
debug_gnutls)
3003
2553
3004
2554
# Redirect stdin so all checkers get /dev/null
3005
2555
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3012
2562
# Close all input and output, do double fork, etc.
3013
2563
daemon()
3014
2564
3015
# multiprocessing will use threads, so before we use GLib we need
3016
# to inform GLib that threads will be used.
3017
GLib.threads_init()
2565
# multiprocessing will use threads, so before we use gobject we
2566
# need to inform gobject that threads will be used.
2567
gobject.threads_init()
3018
2568
3019
2569
global main_loop
3020
2570
# From the Avahi example code
3021
2571
DBusGMainLoop(set_as_default=True)
3022
main_loop = GLib.MainLoop()
2572
main_loop = gobject.MainLoop()
3023
2573
bus = dbus.SystemBus()
3024
2574
# End of Avahi example code
3025
2575
if use_dbus:
3069
2619
if server_settings["restore"]:
3070
2620
try:
3071
2621
with open(stored_state_path, "rb") as stored_state:
3072
if sys.version_info.major == 2:
3073
clients_data, old_client_settings = pickle.load(
3074
stored_state)
3075
else:
3076
bytes_clients_data, bytes_old_client_settings = (
3077
pickle.load(stored_state, encoding = "bytes"))
3078
### Fix bytes to strings
3079
## clients_data
3080
# .keys()
3081
clients_data = { (key.decode("utf-8")
3082
if isinstance(key, bytes)
3083
else key): value
3084
for key, value in
3085
bytes_clients_data.items() }
3086
del bytes_clients_data
3087
for key in clients_data:
3088
value = { (k.decode("utf-8")
3089
if isinstance(k, bytes) else k): v
3090
for k, v in
3091
clients_data[key].items() }
3092
clients_data[key] = value
3093
# .client_structure
3094
value["client_structure"] = [
3095
(s.decode("utf-8")
3096
if isinstance(s, bytes)
3097
else s) for s in
3098
value["client_structure"] ]
3099
# .name & .host
3100
for k in ("name", "host"):
3101
if isinstance(value[k], bytes):
3102
value[k] = value[k].decode("utf-8")
3103
## old_client_settings
3104
# .keys()
3105
old_client_settings = {
3106
(key.decode("utf-8")
3107
if isinstance(key, bytes)
3108
else key): value
3109
for key, value in
3110
bytes_old_client_settings.items() }
3111
del bytes_old_client_settings
3112
# .host
3113
for value in old_client_settings.values():
3114
if isinstance(value["host"], bytes):
3115
value["host"] = (value["host"]
3116
.decode("utf-8"))
2622
clients_data, old_client_settings = pickle.load(
2623
stored_state)
3117
2624
os.remove(stored_state_path)
3118
2625
except IOError as e:
3119
2626
if e.errno == errno.ENOENT:
3220
2727
del pidfile
3221
2728
del pidfilename
3222
2729
3223
for termsig in (signal.SIGHUP, signal.SIGTERM):
3224
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3225
lambda: main_loop.quit() and False)
2730
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2731
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3226
2732
3227
2733
if use_dbus:
3228
2734
3229
2735
@alternate_dbus_interfaces(
3230
2736
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3231
class MandosDBusService(DBusObjectWithObjectManager):
2737
class MandosDBusService(DBusObjectWithProperties):
3232
2738
"""A D-Bus proxy object"""
3233
2739
3234
2740
def __init__(self):
3236
2742
3237
2743
_interface = "se.recompile.Mandos"
3238
2744
2745
@dbus_interface_annotations(_interface)
2746
def _foo(self):
2747
return {
2748
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
"false" }
2750
3239
2751
@dbus.service.signal(_interface, signature="o")
3240
2752
def ClientAdded(self, objpath):
3241
2753
"D-Bus signal"
3246
2758
"D-Bus signal"
3247
2759
pass
3248
2760
3249
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3250
"true"})
3251
2761
@dbus.service.signal(_interface, signature="os")
3252
2762
def ClientRemoved(self, objpath, name):
3253
2763
"D-Bus signal"
3254
2764
pass
3255
2765
3256
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3257
"true"})
3258
2766
@dbus.service.method(_interface, out_signature="ao")
3259
2767
def GetAllClients(self):
3260
2768
"D-Bus method"
3261
2769
return dbus.Array(c.dbus_object_path for c in
3262
tcp_server.clients.values())
2770
tcp_server.clients.itervalues())
3263
2771
3264
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3265
"true"})
3266
2772
@dbus.service.method(_interface,
3267
2773
out_signature="a{oa{sv}}")
3268
2774
def GetAllClientsWithProperties(self):
3269
2775
"D-Bus method"
3270
2776
return dbus.Dictionary(
3271
{ c.dbus_object_path: c.GetAll(
3272
"se.recompile.Mandos.Client")
3273
for c in tcp_server.clients.values() },
2777
{ c.dbus_object_path: c.GetAll("")
2778
for c in tcp_server.clients.itervalues() },
3274
2779
signature="oa{sv}")
3275
2780
3276
2781
@dbus.service.method(_interface, in_signature="o")
3277
2782
def RemoveClient(self, object_path):
3278
2783
"D-Bus method"
3279
for c in tcp_server.clients.values():
2784
for c in tcp_server.clients.itervalues():
3280
2785
if c.dbus_object_path == object_path:
3281
2786
del tcp_server.clients[c.name]
3282
2787
c.remove_from_connection()
3283
# Don't signal the disabling
2788
# Don't signal anything except ClientRemoved
3284
2789
c.disable(quiet=True)
3285
# Emit D-Bus signal for removal
3286
self.client_removed_signal(c)
2790
# Emit D-Bus signal
2791
self.ClientRemoved(object_path, c.name)
3287
2792
return
3288
2793
raise KeyError(object_path)
3289
2794
3290
2795
del _interface
3291
3292
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3293
out_signature = "a{oa{sa{sv}}}")
3294
def GetManagedObjects(self):
3295
"""D-Bus method"""
3296
return dbus.Dictionary(
3297
{ client.dbus_object_path:
3298
dbus.Dictionary(
3299
{ interface: client.GetAll(interface)
3300
for interface in
3301
client._get_all_interface_names()})
3302
for client in tcp_server.clients.values()})
3303
3304
def client_added_signal(self, client):
3305
"""Send the new standard signal and the old signal"""
3306
if use_dbus:
3307
# New standard signal
3308
self.InterfacesAdded(
3309
client.dbus_object_path,
3310
dbus.Dictionary(
3311
{ interface: client.GetAll(interface)
3312
for interface in
3313
client._get_all_interface_names()}))
3314
# Old signal
3315
self.ClientAdded(client.dbus_object_path)
3316
3317
def client_removed_signal(self, client):
3318
"""Send the new standard signal and the old signal"""
3319
if use_dbus:
3320
# New standard signal
3321
self.InterfacesRemoved(
3322
client.dbus_object_path,
3323
client._get_all_interface_names())
3324
# Old signal
3325
self.ClientRemoved(client.dbus_object_path,
3326
client.name)
3327
2796
3328
2797
mandos_dbus_service = MandosDBusService()
3329
2798
3330
# Save modules to variables to exempt the modules from being
3331
# unloaded before the function registered with atexit() is run.
3332
mp = multiprocessing
3333
wn = wnull
3334
2799
def cleanup():
3335
2800
"Cleanup function; run on exit"
3336
2801
if zeroconf:
3337
2802
service.cleanup()
3338
2803
3339
mp.active_children()
3340
wn.close()
2804
multiprocessing.active_children()
2805
wnull.close()
3341
2806
if not (tcp_server.clients or client_settings):
3342
2807
return
3343
2808
3346
2811
# removed/edited, old secret will thus be unrecovable.
3347
2812
clients = {}
3348
2813
with PGPEngine() as pgp:
3349
for client in tcp_server.clients.values():
2814
for client in tcp_server.clients.itervalues():
3350
2815
key = client_settings[client.name]["secret"]
3351
2816
client.encrypted_secret = pgp.encrypt(client.secret,
3352
2817
key)
3376
2841
prefix='clients-',
3377
2842
dir=os.path.dirname(stored_state_path),
3378
2843
delete=False) as stored_state:
3379
pickle.dump((clients, client_settings), stored_state,
3380
protocol = 2)
2844
pickle.dump((clients, client_settings), stored_state)
3381
2845
tempname = stored_state.name
3382
2846
os.rename(tempname, stored_state_path)
3383
2847
except (IOError, OSError) as e:
3399
2863
name, client = tcp_server.clients.popitem()
3400
2864
if use_dbus:
3401
2865
client.remove_from_connection()
3402
# Don't signal the disabling
2866
# Don't signal anything except ClientRemoved
3403
2867
client.disable(quiet=True)
3404
# Emit D-Bus signal for removal
3405
2868
if use_dbus:
3406
mandos_dbus_service.client_removed_signal(client)
2869
# Emit D-Bus signal
2870
mandos_dbus_service.ClientRemoved(
2871
client.dbus_object_path, client.name)
3407
2872
client_settings.clear()
3408
2873
3409
2874
atexit.register(cleanup)
3410
2875
3411
for client in tcp_server.clients.values():
2876
for client in tcp_server.clients.itervalues():
3412
2877
if use_dbus:
3413
# Emit D-Bus signal for adding
3414
mandos_dbus_service.client_added_signal(client)
2878
# Emit D-Bus signal
2879
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3415
2880
# Need to initiate checking of clients
3416
2881
if client.enabled:
3417
2882
client.init_checker()
3443
2908
sys.exit(1)
3444
2909
# End of Avahi example code
3445
2910
3446
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3447
lambda *args, **kwargs:
3448
(tcp_server.handle_request
3449
(*args[2:], **kwargs) or True))
2911
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2912
lambda *args, **kwargs:
2913
(tcp_server.handle_request
2914
(*args[2:], **kwargs) or True))
3450
2915
3451
2916
logger.debug("Starting main loop")
3452
2917
main_loop.run()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0