To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 780
- compare with another revision
- download diff
- download tarball
- view history from revision 780
- Committer: Teddy Hogeborn
- Date: 2015-08-02 09:36:40 UTC
- Revision ID: teddy@recompile.se-20150802093640-nc0n17rbmqlbaxuf
Add D-Bus annotations on a few properties on the Client object.
The D-Bus property "Secret" on the interface
"se.recompile.Mandos.Client" should have the annotation
"org.freedesktop.DBus.Property.EmitsChangedSignal" set to
"invalidates". Also, the properties "Created", "Fingerprint", "Name",
and "ObjectPath" should have the same annotation set to "const".
* mandos (ClientDBus.Name_dbus_property): Set annotation
"org.freedesktop.DBus.Property.EmitsChangedSignal"
to "const".
(ClientDBus.Fingerprint_dbus_property): - '' -
(ClientDBus.Created_dbus_property): - '' -
(ClientDBus.ObjectPath_dbus_property): - '' -
(ClientDBus.Secret_dbus_property): Set annotation
"org.freedesktop.DBus.Property.EmitsChangedSignal"
to "invalidates".
The D-Bus property "Secret" on the interface
"se.recompile.Mandos.Client" should have the annotation
"org.freedesktop.DBus.Property.EmitsChangedSignal" set to
"invalidates". Also, the properties "Created", "Fingerprint", "Name",
and "ObjectPath" should have the same annotation set to "const".
* mandos (ClientDBus.Name_dbus_property): Set annotation
"org.freedesktop.DBus.Property.EmitsChangedSignal"
to "const".
(ClientDBus.Fingerprint_dbus_property): - '' -
(ClientDBus.Created_dbus_property): - '' -
(ClientDBus.ObjectPath_dbus_property): - '' -
(ClientDBus.Secret_dbus_property): Set annotation
"org.freedesktop.DBus.Property.EmitsChangedSignal"
to "invalidates".
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
1
#!/usr/bin/python2.7
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
39
try:
48
40
import SocketServer as socketserver
49
41
except ImportError:
50
42
import socketserver
51
43
import socket
44
import argparse
52
45
import datetime
53
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
54
53
try:
55
54
import ConfigParser as configparser
56
55
except ImportError:
57
56
import configparser
57
import sys
58
58
import re
59
import os
59
60
import signal
60
61
import subprocess
61
62
import atexit
62
63
import stat
64
import logging
63
65
import logging.handlers
64
66
import pwd
65
67
import contextlib
77
79
import itertools
78
80
import collections
79
81
import codecs
80
import random
81
import shlex
82
82
83
83
import dbus
84
84
import dbus.service
85
import gi
86
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
87
90
from dbus.mainloop.glib import DBusGMainLoop
88
91
import ctypes
89
92
import ctypes.util
90
93
import xml.dom.minidom
91
94
import inspect
92
95
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Add os.set_inheritable if it does not exist
114
try:
115
os.set_inheritable
116
except AttributeError:
117
def set_inheritable(fd, inheritable):
118
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
119
if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):
120
fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)
121
elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):
122
fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)
123
os.set_inheritable = set_inheritable
124
del set_inheritable
125
126
# Show warnings by default
127
if not sys.warnoptions:
128
import warnings
129
warnings.simplefilter("default")
130
131
# Try to find the value of SO_BINDTODEVICE:
132
try:
133
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
134
# newer, and it is also the most natural place for it:
96
try:
135
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
136
98
except AttributeError:
137
99
try:
138
# This is where SO_BINDTODEVICE was up to and including Python
139
# 2.6, and also 3.2:
140
100
from IN import SO_BINDTODEVICE
141
101
except ImportError:
142
# In Python 2.7 it seems to have been removed entirely.
143
# Try running the C preprocessor:
144
try:
145
cc = subprocess.Popen(["cc", "--language=c", "-E",
146
"/dev/stdin"],
147
stdin=subprocess.PIPE,
148
stdout=subprocess.PIPE)
149
stdout = cc.communicate(
150
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
151
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
152
except (OSError, ValueError, IndexError):
153
# No value found
154
SO_BINDTODEVICE = None
155
156
if sys.version_info < (3, 2):
157
configparser.Configparser = configparser.SafeConfigParser
158
159
version = "1.8.17"
102
SO_BINDTODEVICE = None
103
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
160
108
stored_state_file = "clients.pickle"
161
109
162
log = logging.getLogger(os.path.basename(sys.argv[0]))
163
logging.captureWarnings(True) # Show warnings via the logging system
110
logger = logging.getLogger()
164
111
syslogger = None
165
112
166
113
try:
167
114
if_nametoindex = ctypes.cdll.LoadLibrary(
168
115
ctypes.util.find_library("c")).if_nametoindex
169
116
except (OSError, AttributeError):
170
117
171
118
def if_nametoindex(interface):
172
119
"Get an interface index the hard way, i.e. using fcntl()"
173
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
178
125
return interface_index
179
126
180
127
181
def copy_function(func):
182
"""Make a copy of a function"""
183
if sys.version_info.major == 2:
184
return types.FunctionType(func.func_code,
185
func.func_globals,
186
func.func_name,
187
func.func_defaults,
188
func.func_closure)
189
else:
190
return types.FunctionType(func.__code__,
191
func.__globals__,
192
func.__name__,
193
func.__defaults__,
194
func.__closure__)
195
196
197
128
def initlogger(debug, level=logging.WARNING):
198
129
"""init logger and add loglevel"""
199
130
200
131
global syslogger
201
132
syslogger = (logging.handlers.SysLogHandler(
202
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
203
address="/dev/log"))
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
204
135
syslogger.setFormatter(logging.Formatter
205
("Mandos [%(process)d]: %(levelname)s:"
206
" %(message)s"))
207
log.addHandler(syslogger)
208
136
('Mandos [%(process)d]: %(levelname)s:'
137
' %(message)s'))
138
logger.addHandler(syslogger)
139
209
140
if debug:
210
141
console = logging.StreamHandler()
211
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
212
" [%(process)d]:"
213
" %(levelname)s:"
214
" %(message)s"))
215
log.addHandler(console)
216
log.setLevel(level)
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
143
' [%(process)d]:'
144
' %(levelname)s:'
145
' %(message)s'))
146
logger.addHandler(console)
147
logger.setLevel(level)
217
148
218
149
219
150
class PGPError(Exception):
221
152
pass
222
153
223
154
224
class PGPEngine:
155
class PGPEngine(object):
225
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
226
157
227
158
def __init__(self):
228
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
229
self.gpg = "gpg"
230
try:
231
output = subprocess.check_output(["gpgconf"])
232
for line in output.splitlines():
233
name, text, path = line.split(b":")
234
if name == b"gpg":
235
self.gpg = path
236
break
237
except OSError as e:
238
if e.errno != errno.ENOENT:
239
raise
240
self.gnupgargs = ["--batch",
241
"--homedir", self.tempdir,
242
"--force-mdc",
243
"--quiet"]
244
# Only GPG version 1 has the --no-use-agent option.
245
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
246
self.gnupgargs.append("--no-use-agent")
247
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
165
248
166
def __enter__(self):
249
167
return self
250
168
251
169
def __exit__(self, exc_type, exc_value, traceback):
252
170
self._cleanup()
253
171
return False
254
172
255
173
def __del__(self):
256
174
self._cleanup()
257
175
258
176
def _cleanup(self):
259
177
if self.tempdir is not None:
260
178
# Delete contents of tempdir
261
179
for root, dirs, files in os.walk(self.tempdir,
262
topdown=False):
180
topdown = False):
263
181
for filename in files:
264
182
os.remove(os.path.join(root, filename))
265
183
for dirname in dirs:
267
185
# Remove tempdir
268
186
os.rmdir(self.tempdir)
269
187
self.tempdir = None
270
188
271
189
def password_encode(self, password):
272
190
# Passphrase can not be empty and can not contain newlines or
273
191
# NUL bytes. So we prefix it and hex encode it.
278
196
.replace(b"\n", b"\\n")
279
197
.replace(b"\0", b"\\x00"))
280
198
return encoded
281
199
282
200
def encrypt(self, data, password):
283
201
passphrase = self.password_encode(password)
284
202
with tempfile.NamedTemporaryFile(
285
203
dir=self.tempdir) as passfile:
286
204
passfile.write(passphrase)
287
205
passfile.flush()
288
proc = subprocess.Popen([self.gpg, "--symmetric",
289
"--passphrase-file",
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
290
208
passfile.name]
291
209
+ self.gnupgargs,
292
stdin=subprocess.PIPE,
293
stdout=subprocess.PIPE,
294
stderr=subprocess.PIPE)
295
ciphertext, err = proc.communicate(input=data)
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
296
214
if proc.returncode != 0:
297
215
raise PGPError(err)
298
216
return ciphertext
299
217
300
218
def decrypt(self, data, password):
301
219
passphrase = self.password_encode(password)
302
220
with tempfile.NamedTemporaryFile(
303
dir=self.tempdir) as passfile:
221
dir = self.tempdir) as passfile:
304
222
passfile.write(passphrase)
305
223
passfile.flush()
306
proc = subprocess.Popen([self.gpg, "--decrypt",
307
"--passphrase-file",
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
308
226
passfile.name]
309
227
+ self.gnupgargs,
310
stdin=subprocess.PIPE,
311
stdout=subprocess.PIPE,
312
stderr=subprocess.PIPE)
313
decrypted_plaintext, err = proc.communicate(input=data)
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
314
232
if proc.returncode != 0:
315
233
raise PGPError(err)
316
234
return decrypted_plaintext
317
235
318
236
319
# Pretend that we have an Avahi module
320
class avahi:
321
"""This isn't so much a class as it is a module-like namespace."""
322
IF_UNSPEC = -1 # avahi-common/address.h
323
PROTO_UNSPEC = -1 # avahi-common/address.h
324
PROTO_INET = 0 # avahi-common/address.h
325
PROTO_INET6 = 1 # avahi-common/address.h
326
DBUS_NAME = "org.freedesktop.Avahi"
327
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
328
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
329
DBUS_PATH_SERVER = "/"
330
331
@staticmethod
332
def string_array_to_txt_array(t):
333
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
334
for s in t), signature="ay")
335
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
336
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
337
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
338
SERVER_INVALID = 0 # avahi-common/defs.h
339
SERVER_REGISTERING = 1 # avahi-common/defs.h
340
SERVER_RUNNING = 2 # avahi-common/defs.h
341
SERVER_COLLISION = 3 # avahi-common/defs.h
342
SERVER_FAILURE = 4 # avahi-common/defs.h
343
344
345
237
class AvahiError(Exception):
346
238
def __init__(self, value, *args, **kwargs):
347
239
self.value = value
357
249
pass
358
250
359
251
360
class AvahiService:
252
class AvahiService(object):
361
253
"""An Avahi (Zeroconf) service.
362
254
363
255
Attributes:
364
256
interface: integer; avahi.IF_UNSPEC or an interface index.
365
257
Used to optionally bind to the specified interface.
366
name: string; Example: "Mandos"
367
type: string; Example: "_mandos._tcp".
258
name: string; Example: 'Mandos'
259
type: string; Example: '_mandos._tcp'.
368
260
See <https://www.iana.org/assignments/service-names-port-numbers>
369
261
port: integer; what port to announce
370
262
TXT: list of strings; TXT record for the service
377
269
server: D-Bus Server
378
270
bus: dbus.SystemBus()
379
271
"""
380
272
381
273
def __init__(self,
382
interface=avahi.IF_UNSPEC,
383
name=None,
384
servicetype=None,
385
port=None,
386
TXT=None,
387
domain="",
388
host="",
389
max_renames=32768,
390
protocol=avahi.PROTO_UNSPEC,
391
bus=None):
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
392
284
self.interface = interface
393
285
self.name = name
394
286
self.type = servicetype
403
295
self.server = None
404
296
self.bus = bus
405
297
self.entry_group_state_changed_match = None
406
298
407
299
def rename(self, remove=True):
408
300
"""Derived from the Avahi example code"""
409
301
if self.rename_count >= self.max_renames:
410
log.critical("No suitable Zeroconf service name found"
411
" after %i retries, exiting.",
412
self.rename_count)
302
logger.critical("No suitable Zeroconf service name found"
303
" after %i retries, exiting.",
304
self.rename_count)
413
305
raise AvahiServiceError("Too many renames")
414
306
self.name = str(
415
307
self.server.GetAlternativeServiceName(self.name))
416
308
self.rename_count += 1
417
log.info("Changing Zeroconf service name to %r ...",
418
self.name)
309
logger.info("Changing Zeroconf service name to %r ...",
310
self.name)
419
311
if remove:
420
312
self.remove()
421
313
try:
423
315
except dbus.exceptions.DBusException as error:
424
316
if (error.get_dbus_name()
425
317
== "org.freedesktop.Avahi.CollisionError"):
426
log.info("Local Zeroconf service name collision.")
318
logger.info("Local Zeroconf service name collision.")
427
319
return self.rename(remove=False)
428
320
else:
429
log.critical("D-Bus Exception", exc_info=error)
321
logger.critical("D-Bus Exception", exc_info=error)
430
322
self.cleanup()
431
323
os._exit(1)
432
324
433
325
def remove(self):
434
326
"""Derived from the Avahi example code"""
435
327
if self.entry_group_state_changed_match is not None:
437
329
self.entry_group_state_changed_match = None
438
330
if self.group is not None:
439
331
self.group.Reset()
440
332
441
333
def add(self):
442
334
"""Derived from the Avahi example code"""
443
335
self.remove()
448
340
avahi.DBUS_INTERFACE_ENTRY_GROUP)
449
341
self.entry_group_state_changed_match = (
450
342
self.group.connect_to_signal(
451
"StateChanged", self.entry_group_state_changed))
452
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
453
self.name, self.type)
343
'StateChanged', self.entry_group_state_changed))
344
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
345
self.name, self.type)
454
346
self.group.AddService(
455
347
self.interface,
456
348
self.protocol,
460
352
dbus.UInt16(self.port),
461
353
avahi.string_array_to_txt_array(self.TXT))
462
354
self.group.Commit()
463
355
464
356
def entry_group_state_changed(self, state, error):
465
357
"""Derived from the Avahi example code"""
466
log.debug("Avahi entry group state change: %i", state)
467
358
logger.debug("Avahi entry group state change: %i", state)
359
468
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
469
log.debug("Zeroconf service established.")
361
logger.debug("Zeroconf service established.")
470
362
elif state == avahi.ENTRY_GROUP_COLLISION:
471
log.info("Zeroconf service name collision.")
363
logger.info("Zeroconf service name collision.")
472
364
self.rename()
473
365
elif state == avahi.ENTRY_GROUP_FAILURE:
474
log.critical("Avahi: Error in group state changed %s",
475
str(error))
366
logger.critical("Avahi: Error in group state changed %s",
367
str(error))
476
368
raise AvahiGroupError("State changed: {!s}".format(error))
477
369
478
370
def cleanup(self):
479
371
"""Derived from the Avahi example code"""
480
372
if self.group is not None:
485
377
pass
486
378
self.group = None
487
379
self.remove()
488
380
489
381
def server_state_changed(self, state, error=None):
490
382
"""Derived from the Avahi example code"""
491
log.debug("Avahi server state change: %i", state)
383
logger.debug("Avahi server state change: %i", state)
492
384
bad_states = {
493
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
494
386
avahi.SERVER_REGISTERING: None,
498
390
if state in bad_states:
499
391
if bad_states[state] is not None:
500
392
if error is None:
501
log.error(bad_states[state])
393
logger.error(bad_states[state])
502
394
else:
503
log.error(bad_states[state] + ": %r", error)
395
logger.error(bad_states[state] + ": %r", error)
504
396
self.cleanup()
505
397
elif state == avahi.SERVER_RUNNING:
506
398
try:
508
400
except dbus.exceptions.DBusException as error:
509
401
if (error.get_dbus_name()
510
402
== "org.freedesktop.Avahi.CollisionError"):
511
log.info("Local Zeroconf service name collision.")
403
logger.info("Local Zeroconf service name"
404
" collision.")
512
405
return self.rename(remove=False)
513
406
else:
514
log.critical("D-Bus Exception", exc_info=error)
407
logger.critical("D-Bus Exception", exc_info=error)
515
408
self.cleanup()
516
409
os._exit(1)
517
410
else:
518
411
if error is None:
519
log.debug("Unknown state: %r", state)
412
logger.debug("Unknown state: %r", state)
520
413
else:
521
log.debug("Unknown state: %r: %r", state, error)
522
414
logger.debug("Unknown state: %r: %r", state, error)
415
523
416
def activate(self):
524
417
"""Derived from the Avahi example code"""
525
418
if self.server is None:
536
429
class AvahiServiceToSyslog(AvahiService):
537
430
def rename(self, *args, **kwargs):
538
431
"""Add the new name to the syslog messages"""
539
ret = super(AvahiServiceToSyslog, self).rename(*args,
540
**kwargs)
432
ret = AvahiService.rename(self, *args, **kwargs)
541
433
syslogger.setFormatter(logging.Formatter(
542
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
543
435
.format(self.name)))
544
436
return ret
545
437
546
547
# Pretend that we have a GnuTLS module
548
class gnutls:
549
"""This isn't so much a class as it is a module-like namespace."""
550
551
library = ctypes.util.find_library("gnutls")
552
if library is None:
553
library = ctypes.util.find_library("gnutls-deb0")
554
_library = ctypes.cdll.LoadLibrary(library)
555
del library
556
557
# Unless otherwise indicated, the constants and types below are
558
# all from the gnutls/gnutls.h C header file.
559
560
# Constants
561
E_SUCCESS = 0
562
E_INTERRUPTED = -52
563
E_AGAIN = -28
564
CRT_OPENPGP = 2
565
CRT_RAWPK = 3
566
CLIENT = 2
567
SHUT_RDWR = 0
568
CRD_CERTIFICATE = 1
569
E_NO_CERTIFICATE_FOUND = -49
570
X509_FMT_DER = 0
571
NO_TICKETS = 1<<10
572
ENABLE_RAWPK = 1<<18
573
CTYPE_PEERS = 3
574
KEYID_USE_SHA256 = 1 # gnutls/x509.h
575
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
576
577
# Types
578
class _session_int(ctypes.Structure):
579
_fields_ = []
580
session_t = ctypes.POINTER(_session_int)
581
582
class certificate_credentials_st(ctypes.Structure):
583
_fields_ = []
584
certificate_credentials_t = ctypes.POINTER(
585
certificate_credentials_st)
586
certificate_type_t = ctypes.c_int
587
588
class datum_t(ctypes.Structure):
589
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
590
("size", ctypes.c_uint)]
591
592
class _openpgp_crt_int(ctypes.Structure):
593
_fields_ = []
594
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
595
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
596
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
597
credentials_type_t = ctypes.c_int
598
transport_ptr_t = ctypes.c_void_p
599
close_request_t = ctypes.c_int
600
601
# Exceptions
602
class Error(Exception):
603
def __init__(self, message=None, code=None, args=()):
604
# Default usage is by a message string, but if a return
605
# code is passed, convert it to a string with
606
# gnutls.strerror()
607
self.code = code
608
if message is None and code is not None:
609
message = gnutls.strerror(code).decode(
610
"utf-8", errors="replace")
611
return super(gnutls.Error, self).__init__(
612
message, *args)
613
614
class CertificateSecurityError(Error):
615
pass
616
617
class PointerTo:
618
def __init__(self, cls):
619
self.cls = cls
620
621
def from_param(self, obj):
622
if not isinstance(obj, self.cls):
623
raise TypeError("Not of type {}: {!r}"
624
.format(self.cls.__name__, obj))
625
return ctypes.byref(obj.from_param(obj))
626
627
class CastToVoidPointer:
628
def __init__(self, cls):
629
self.cls = cls
630
631
def from_param(self, obj):
632
if not isinstance(obj, self.cls):
633
raise TypeError("Not of type {}: {!r}"
634
.format(self.cls.__name__, obj))
635
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
636
637
class With_from_param:
638
@classmethod
639
def from_param(cls, obj):
640
return obj._as_parameter_
641
642
# Classes
643
class Credentials(With_from_param):
644
def __init__(self):
645
self._as_parameter_ = gnutls.certificate_credentials_t()
646
gnutls.certificate_allocate_credentials(self)
647
self.type = gnutls.CRD_CERTIFICATE
648
649
def __del__(self):
650
gnutls.certificate_free_credentials(self)
651
652
class ClientSession(With_from_param):
653
def __init__(self, socket, credentials=None):
654
self._as_parameter_ = gnutls.session_t()
655
gnutls_flags = gnutls.CLIENT
656
if gnutls.check_version(b"3.5.6"):
657
gnutls_flags |= gnutls.NO_TICKETS
658
if gnutls.has_rawpk:
659
gnutls_flags |= gnutls.ENABLE_RAWPK
660
gnutls.init(self, gnutls_flags)
661
del gnutls_flags
662
gnutls.set_default_priority(self)
663
gnutls.transport_set_ptr(self, socket.fileno())
664
gnutls.handshake_set_private_extensions(self, True)
665
self.socket = socket
666
if credentials is None:
667
credentials = gnutls.Credentials()
668
gnutls.credentials_set(self, credentials.type,
669
credentials)
670
self.credentials = credentials
671
672
def __del__(self):
673
gnutls.deinit(self)
674
675
def handshake(self):
676
return gnutls.handshake(self)
677
678
def send(self, data):
679
data = bytes(data)
680
data_len = len(data)
681
while data_len > 0:
682
data_len -= gnutls.record_send(self, data[-data_len:],
683
data_len)
684
685
def bye(self):
686
return gnutls.bye(self, gnutls.SHUT_RDWR)
687
688
# Error handling functions
689
def _error_code(result):
690
"""A function to raise exceptions on errors, suitable
691
for the "restype" attribute on ctypes functions"""
692
if result >= gnutls.E_SUCCESS:
693
return result
694
if result == gnutls.E_NO_CERTIFICATE_FOUND:
695
raise gnutls.CertificateSecurityError(code=result)
696
raise gnutls.Error(code=result)
697
698
def _retry_on_error(result, func, arguments,
699
_error_code=_error_code):
700
"""A function to retry on some errors, suitable
701
for the "errcheck" attribute on ctypes functions"""
702
while result < gnutls.E_SUCCESS:
703
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
704
return _error_code(result)
705
result = func(*arguments)
706
return result
707
708
# Unless otherwise indicated, the function declarations below are
709
# all from the gnutls/gnutls.h C header file.
710
711
# Functions
712
priority_set_direct = _library.gnutls_priority_set_direct
713
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
714
ctypes.POINTER(ctypes.c_char_p)]
715
priority_set_direct.restype = _error_code
716
717
init = _library.gnutls_init
718
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
719
init.restype = _error_code
720
721
set_default_priority = _library.gnutls_set_default_priority
722
set_default_priority.argtypes = [ClientSession]
723
set_default_priority.restype = _error_code
724
725
record_send = _library.gnutls_record_send
726
record_send.argtypes = [ClientSession, ctypes.c_void_p,
727
ctypes.c_size_t]
728
record_send.restype = ctypes.c_ssize_t
729
record_send.errcheck = _retry_on_error
730
731
certificate_allocate_credentials = (
732
_library.gnutls_certificate_allocate_credentials)
733
certificate_allocate_credentials.argtypes = [
734
PointerTo(Credentials)]
735
certificate_allocate_credentials.restype = _error_code
736
737
certificate_free_credentials = (
738
_library.gnutls_certificate_free_credentials)
739
certificate_free_credentials.argtypes = [Credentials]
740
certificate_free_credentials.restype = None
741
742
handshake_set_private_extensions = (
743
_library.gnutls_handshake_set_private_extensions)
744
handshake_set_private_extensions.argtypes = [ClientSession,
745
ctypes.c_int]
746
handshake_set_private_extensions.restype = None
747
748
credentials_set = _library.gnutls_credentials_set
749
credentials_set.argtypes = [ClientSession, credentials_type_t,
750
CastToVoidPointer(Credentials)]
751
credentials_set.restype = _error_code
752
753
strerror = _library.gnutls_strerror
754
strerror.argtypes = [ctypes.c_int]
755
strerror.restype = ctypes.c_char_p
756
757
certificate_type_get = _library.gnutls_certificate_type_get
758
certificate_type_get.argtypes = [ClientSession]
759
certificate_type_get.restype = _error_code
760
761
certificate_get_peers = _library.gnutls_certificate_get_peers
762
certificate_get_peers.argtypes = [ClientSession,
763
ctypes.POINTER(ctypes.c_uint)]
764
certificate_get_peers.restype = ctypes.POINTER(datum_t)
765
766
global_set_log_level = _library.gnutls_global_set_log_level
767
global_set_log_level.argtypes = [ctypes.c_int]
768
global_set_log_level.restype = None
769
770
global_set_log_function = _library.gnutls_global_set_log_function
771
global_set_log_function.argtypes = [log_func]
772
global_set_log_function.restype = None
773
774
deinit = _library.gnutls_deinit
775
deinit.argtypes = [ClientSession]
776
deinit.restype = None
777
778
handshake = _library.gnutls_handshake
779
handshake.argtypes = [ClientSession]
780
handshake.restype = ctypes.c_int
781
handshake.errcheck = _retry_on_error
782
783
transport_set_ptr = _library.gnutls_transport_set_ptr
784
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
785
transport_set_ptr.restype = None
786
787
bye = _library.gnutls_bye
788
bye.argtypes = [ClientSession, close_request_t]
789
bye.restype = ctypes.c_int
790
bye.errcheck = _retry_on_error
791
792
check_version = _library.gnutls_check_version
793
check_version.argtypes = [ctypes.c_char_p]
794
check_version.restype = ctypes.c_char_p
795
796
_need_version = b"3.3.0"
797
if check_version(_need_version) is None:
798
raise self.Error("Needs GnuTLS {} or later"
799
.format(_need_version))
800
801
_tls_rawpk_version = b"3.6.6"
802
has_rawpk = bool(check_version(_tls_rawpk_version))
803
804
if has_rawpk:
805
# Types
806
class pubkey_st(ctypes.Structure):
807
_fields = []
808
pubkey_t = ctypes.POINTER(pubkey_st)
809
810
x509_crt_fmt_t = ctypes.c_int
811
812
# All the function declarations below are from
813
# gnutls/abstract.h
814
pubkey_init = _library.gnutls_pubkey_init
815
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
816
pubkey_init.restype = _error_code
817
818
pubkey_import = _library.gnutls_pubkey_import
819
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
820
x509_crt_fmt_t]
821
pubkey_import.restype = _error_code
822
823
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
824
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
825
ctypes.POINTER(ctypes.c_ubyte),
826
ctypes.POINTER(ctypes.c_size_t)]
827
pubkey_get_key_id.restype = _error_code
828
829
pubkey_deinit = _library.gnutls_pubkey_deinit
830
pubkey_deinit.argtypes = [pubkey_t]
831
pubkey_deinit.restype = None
832
else:
833
# All the function declarations below are from
834
# gnutls/openpgp.h
835
836
openpgp_crt_init = _library.gnutls_openpgp_crt_init
837
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
838
openpgp_crt_init.restype = _error_code
839
840
openpgp_crt_import = _library.gnutls_openpgp_crt_import
841
openpgp_crt_import.argtypes = [openpgp_crt_t,
842
ctypes.POINTER(datum_t),
843
openpgp_crt_fmt_t]
844
openpgp_crt_import.restype = _error_code
845
846
openpgp_crt_verify_self = \
847
_library.gnutls_openpgp_crt_verify_self
848
openpgp_crt_verify_self.argtypes = [
849
openpgp_crt_t,
850
ctypes.c_uint,
851
ctypes.POINTER(ctypes.c_uint),
852
]
853
openpgp_crt_verify_self.restype = _error_code
854
855
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
856
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
857
openpgp_crt_deinit.restype = None
858
859
openpgp_crt_get_fingerprint = (
860
_library.gnutls_openpgp_crt_get_fingerprint)
861
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
862
ctypes.c_void_p,
863
ctypes.POINTER(
864
ctypes.c_size_t)]
865
openpgp_crt_get_fingerprint.restype = _error_code
866
867
if check_version(b"3.6.4"):
868
certificate_type_get2 = _library.gnutls_certificate_type_get2
869
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
870
certificate_type_get2.restype = _error_code
871
872
# Remove non-public functions
873
del _error_code, _retry_on_error
874
875
876
438
def call_pipe(connection, # : multiprocessing.Connection
877
439
func, *args, **kwargs):
878
440
"""This function is meant to be called by multiprocessing.Process
879
441
880
442
This function runs func(*args, **kwargs), and writes the resulting
881
443
return value on the provided multiprocessing.Connection.
882
444
"""
883
445
connection.send(func(*args, **kwargs))
884
446
connection.close()
885
447
886
887
class Client:
448
class Client(object):
888
449
"""A representation of a client host served by this server.
889
450
890
451
Attributes:
891
approved: bool(); None if not yet approved/disapproved
452
approved: bool(); 'None' if not yet approved/disapproved
892
453
approval_delay: datetime.timedelta(); Time to wait for approval
893
454
approval_duration: datetime.timedelta(); Duration of one approval
894
checker: multiprocessing.Process(); a running checker process used
895
to see if the client lives. None if no process is
896
running.
897
checker_callback_tag: a GLib event source tag, or None
455
checker: subprocess.Popen(); a running checker process used
456
to see if the client lives.
457
'None' if no process is running.
458
checker_callback_tag: a gobject event source tag, or None
898
459
checker_command: string; External command which is run to check
899
460
if client lives. %() expansions are done at
900
461
runtime with vars(self) as dict, so that for
901
462
instance %(name)s can be used in the command.
902
checker_initiator_tag: a GLib event source tag, or None
463
checker_initiator_tag: a gobject event source tag, or None
903
464
created: datetime.datetime(); (UTC) object creation
904
465
client_structure: Object describing what attributes a client has
905
466
and is used for storing the client at exit
906
467
current_checker_command: string; current running checker_command
907
disable_initiator_tag: a GLib event source tag, or None
468
disable_initiator_tag: a gobject event source tag, or None
908
469
enabled: bool()
909
470
fingerprint: string (40 or 32 hexadecimal digits); used to
910
uniquely identify an OpenPGP client
911
key_id: string (64 hexadecimal digits); used to uniquely identify
912
a client using raw public keys
471
uniquely identify the client
913
472
host: string; available for use by the checker command
914
473
interval: datetime.timedelta(); How often to start a new checker
915
474
last_approval_request: datetime.datetime(); (UTC) or None
931
490
disabled, or None
932
491
server_settings: The server_settings dict from main()
933
492
"""
934
493
935
494
runtime_expansions = ("approval_delay", "approval_duration",
936
"created", "enabled", "expires", "key_id",
495
"created", "enabled", "expires",
937
496
"fingerprint", "host", "interval",
938
497
"last_approval_request", "last_checked_ok",
939
498
"last_enabled", "name", "timeout")
948
507
"approved_by_default": "True",
949
508
"enabled": "True",
950
509
}
951
510
952
511
@staticmethod
953
512
def config_parser(config):
954
513
"""Construct a new dict of client settings of this form:
961
520
for client_name in config.sections():
962
521
section = dict(config.items(client_name))
963
522
client = settings[client_name] = {}
964
523
965
524
client["host"] = section["host"]
966
525
# Reformat values from string types to Python types
967
526
client["approved_by_default"] = config.getboolean(
968
527
client_name, "approved_by_default")
969
528
client["enabled"] = config.getboolean(client_name,
970
529
"enabled")
971
972
# Uppercase and remove spaces from key_id and fingerprint
973
# for later comparison purposes with return value from the
974
# key_id() and fingerprint() functions
975
client["key_id"] = (section.get("key_id", "").upper()
976
.replace(" ", ""))
977
client["fingerprint"] = (section.get("fingerprint",
978
"").upper()
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
534
client["fingerprint"] = (section["fingerprint"].upper()
979
535
.replace(" ", ""))
980
if not (client["key_id"] or client["fingerprint"]):
981
log.error("Skipping client %s without key_id or"
982
" fingerprint", client_name)
983
del settings[client_name]
984
continue
985
536
if "secret" in section:
986
client["secret"] = codecs.decode(section["secret"]
987
.encode("utf-8"),
988
"base64")
537
client["secret"] = section["secret"].decode("base64")
989
538
elif "secfile" in section:
990
539
with open(os.path.expanduser(os.path.expandvars
991
540
(section["secfile"])),
1006
555
client["last_approval_request"] = None
1007
556
client["last_checked_ok"] = None
1008
557
client["last_checker_status"] = -2
1009
558
1010
559
return settings
1011
1012
def __init__(self, settings, name=None, server_settings=None):
560
561
def __init__(self, settings, name = None, server_settings=None):
1013
562
self.name = name
1014
563
if server_settings is None:
1015
564
server_settings = {}
1017
566
# adding all client settings
1018
567
for setting, value in settings.items():
1019
568
setattr(self, setting, value)
1020
569
1021
570
if self.enabled:
1022
571
if not hasattr(self, "last_enabled"):
1023
572
self.last_enabled = datetime.datetime.utcnow()
1027
576
else:
1028
577
self.last_enabled = None
1029
578
self.expires = None
1030
1031
log.debug("Creating client %r", self.name)
1032
log.debug(" Key ID: %s", self.key_id)
1033
log.debug(" Fingerprint: %s", self.fingerprint)
579
580
logger.debug("Creating client %r", self.name)
581
logger.debug(" Fingerprint: %s", self.fingerprint)
1034
582
self.created = settings.get("created",
1035
583
datetime.datetime.utcnow())
1036
584
1037
585
# attributes specific for this server instance
1038
586
self.checker = None
1039
587
self.checker_initiator_tag = None
1045
593
self.changedstate = multiprocessing_manager.Condition(
1046
594
multiprocessing_manager.Lock())
1047
595
self.client_structure = [attr
1048
for attr in self.__dict__.keys()
596
for attr in self.__dict__.iterkeys()
1049
597
if not attr.startswith("_")]
1050
598
self.client_structure.append("client_structure")
1051
599
1052
600
for name, t in inspect.getmembers(
1053
601
type(self), lambda obj: isinstance(obj, property)):
1054
602
if not name.startswith("_"):
1055
603
self.client_structure.append(name)
1056
604
1057
605
# Send notice to process children that client state has changed
1058
606
def send_changedstate(self):
1059
607
with self.changedstate:
1060
608
self.changedstate.notify_all()
1061
609
1062
610
def enable(self):
1063
611
"""Start this client's checker and timeout hooks"""
1064
612
if getattr(self, "enabled", False):
1065
613
# Already enabled
1066
614
return
615
self.expires = datetime.datetime.utcnow() + self.timeout
1067
616
self.enabled = True
1068
617
self.last_enabled = datetime.datetime.utcnow()
1069
618
self.init_checker()
1070
619
self.send_changedstate()
1071
620
1072
621
def disable(self, quiet=True):
1073
622
"""Disable this client."""
1074
623
if not getattr(self, "enabled", False):
1075
624
return False
1076
625
if not quiet:
1077
log.info("Disabling client %s", self.name)
626
logger.info("Disabling client %s", self.name)
1078
627
if getattr(self, "disable_initiator_tag", None) is not None:
1079
GLib.source_remove(self.disable_initiator_tag)
628
gobject.source_remove(self.disable_initiator_tag)
1080
629
self.disable_initiator_tag = None
1081
630
self.expires = None
1082
631
if getattr(self, "checker_initiator_tag", None) is not None:
1083
GLib.source_remove(self.checker_initiator_tag)
632
gobject.source_remove(self.checker_initiator_tag)
1084
633
self.checker_initiator_tag = None
1085
634
self.stop_checker()
1086
635
self.enabled = False
1087
636
if not quiet:
1088
637
self.send_changedstate()
1089
# Do not run this again if called by a GLib.timeout_add
638
# Do not run this again if called by a gobject.timeout_add
1090
639
return False
1091
640
1092
641
def __del__(self):
1093
642
self.disable()
1094
1095
def init_checker(self, randomize_start=False):
1096
# Schedule a new checker to be started a randomly selected
1097
# time (a fraction of 'interval') from now. This spreads out
1098
# the startup of checkers over time when the server is
1099
# started.
643
644
def init_checker(self):
645
# Schedule a new checker to be started an 'interval' from now,
646
# and every interval from then on.
1100
647
if self.checker_initiator_tag is not None:
1101
GLib.source_remove(self.checker_initiator_tag)
1102
interval_milliseconds = int(self.interval.total_seconds()
1103
* 1000)
1104
if randomize_start:
1105
delay_milliseconds = random.randrange(
1106
interval_milliseconds + 1)
1107
else:
1108
delay_milliseconds = interval_milliseconds
1109
self.checker_initiator_tag = GLib.timeout_add(
1110
delay_milliseconds, self.start_checker, randomize_start)
1111
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1112
# A checker might take up to an 'interval' of time, so we can
1113
# expire at the soonest one interval after a checker was
1114
# started. Since the initial checker is delayed, the expire
1115
# time might have to be extended.
1116
now = datetime.datetime.utcnow()
1117
self.expires = now + delay + self.interval
1118
# Schedule a disable() at expire time
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
652
# Schedule a disable() when 'timeout' has passed
1119
653
if self.disable_initiator_tag is not None:
1120
GLib.source_remove(self.disable_initiator_tag)
1121
self.disable_initiator_tag = GLib.timeout_add(
1122
int((self.expires - now).total_seconds() * 1000),
1123
self.disable)
1124
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
657
# Also start a new checker *right now*.
658
self.start_checker()
659
1125
660
def checker_callback(self, source, condition, connection,
1126
661
command):
1127
662
"""The checker has completed, so take appropriate actions."""
663
self.checker_callback_tag = None
664
self.checker = None
1128
665
# Read return code from connection (see call_pipe)
1129
666
returncode = connection.recv()
1130
667
connection.close()
1131
if self.checker is not None:
1132
self.checker.join()
1133
self.checker_callback_tag = None
1134
self.checker = None
1135
668
1136
669
if returncode >= 0:
1137
670
self.last_checker_status = returncode
1138
671
self.last_checker_signal = None
1139
672
if self.last_checker_status == 0:
1140
log.info("Checker for %(name)s succeeded", vars(self))
673
logger.info("Checker for %(name)s succeeded",
674
vars(self))
1141
675
self.checked_ok()
1142
676
else:
1143
log.info("Checker for %(name)s failed", vars(self))
677
logger.info("Checker for %(name)s failed", vars(self))
1144
678
else:
1145
679
self.last_checker_status = -1
1146
680
self.last_checker_signal = -returncode
1147
log.warning("Checker for %(name)s crashed?", vars(self))
681
logger.warning("Checker for %(name)s crashed?",
682
vars(self))
1148
683
return False
1149
684
1150
685
def checked_ok(self):
1151
686
"""Assert that the client has been seen, alive and well."""
1152
687
self.last_checked_ok = datetime.datetime.utcnow()
1153
688
self.last_checker_status = 0
1154
689
self.last_checker_signal = None
1155
690
self.bump_timeout()
1156
691
1157
692
def bump_timeout(self, timeout=None):
1158
693
"""Bump up the timeout for this client."""
1159
694
if timeout is None:
1160
695
timeout = self.timeout
1161
696
if self.disable_initiator_tag is not None:
1162
GLib.source_remove(self.disable_initiator_tag)
697
gobject.source_remove(self.disable_initiator_tag)
1163
698
self.disable_initiator_tag = None
1164
699
if getattr(self, "enabled", False):
1165
self.disable_initiator_tag = GLib.timeout_add(
700
self.disable_initiator_tag = gobject.timeout_add(
1166
701
int(timeout.total_seconds() * 1000), self.disable)
1167
702
self.expires = datetime.datetime.utcnow() + timeout
1168
703
1169
704
def need_approval(self):
1170
705
self.last_approval_request = datetime.datetime.utcnow()
1171
1172
def start_checker(self, start_was_randomized=False):
706
707
def start_checker(self):
1173
708
"""Start a new checker subprocess if one is not running.
1174
709
1175
710
If a checker already exists, leave it running and do
1176
711
nothing."""
1177
712
# The reason for not killing a running checker is that if we
1182
717
# checkers alone, the checker would have to take more time
1183
718
# than 'timeout' for the client to be disabled, which is as it
1184
719
# should be.
1185
720
1186
721
if self.checker is not None and not self.checker.is_alive():
1187
log.warning("Checker was not alive; joining")
722
logger.warning("Checker was not alive; joining")
1188
723
self.checker.join()
1189
724
self.checker = None
1190
725
# Start a new checker if needed
1191
726
if self.checker is None:
1192
727
# Escape attributes for the shell
1193
728
escaped_attrs = {
1194
attr: shlex.quote(str(getattr(self, attr)))
1195
for attr in self.runtime_expansions}
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
1196
731
try:
1197
732
command = self.checker_command % escaped_attrs
1198
733
except TypeError as error:
1199
log.error('Could not format string "%s"',
1200
self.checker_command, exc_info=error)
734
logger.error('Could not format string "%s"',
735
self.checker_command,
736
exc_info=error)
1201
737
return True # Try again later
1202
738
self.current_checker_command = command
1203
log.info("Starting checker %r for %s", command, self.name)
739
logger.info("Starting checker %r for %s", command,
740
self.name)
1204
741
# We don't need to redirect stdout and stderr, since
1205
742
# in normal mode, that is already done by daemon(),
1206
743
# and in debug mode we don't want to. (Stdin is
1208
745
# The exception is when not debugging but nevertheless
1209
746
# running in the foreground; use the previously
1210
747
# created wnull.
1211
popen_args = {"close_fds": True,
1212
"shell": True,
1213
"cwd": "/"}
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
1214
751
if (not self.server_settings["debug"]
1215
752
and self.server_settings["foreground"]):
1216
753
popen_args.update({"stdout": wnull,
1217
"stderr": wnull})
1218
pipe = multiprocessing.Pipe(duplex=False)
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
1219
756
self.checker = multiprocessing.Process(
1220
target=call_pipe,
1221
args=(pipe[1], subprocess.call, command),
1222
kwargs=popen_args)
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
1223
760
self.checker.start()
1224
self.checker_callback_tag = GLib.io_add_watch(
1225
GLib.IOChannel.unix_new(pipe[0].fileno()),
1226
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
1227
763
self.checker_callback, pipe[0], command)
1228
if start_was_randomized:
1229
# We were started after a random delay; Schedule a new
1230
# checker to be started an 'interval' from now, and every
1231
# interval from then on.
1232
now = datetime.datetime.utcnow()
1233
self.checker_initiator_tag = GLib.timeout_add(
1234
int(self.interval.total_seconds() * 1000),
1235
self.start_checker)
1236
self.expires = max(self.expires, now + self.interval)
1237
# Don't start a new checker again after same random delay
1238
return False
1239
# Re-run this periodically if run by GLib.timeout_add
764
# Re-run this periodically if run by gobject.timeout_add
1240
765
return True
1241
766
1242
767
def stop_checker(self):
1243
768
"""Force the checker process, if any, to stop."""
1244
769
if self.checker_callback_tag:
1245
GLib.source_remove(self.checker_callback_tag)
770
gobject.source_remove(self.checker_callback_tag)
1246
771
self.checker_callback_tag = None
1247
772
if getattr(self, "checker", None) is None:
1248
773
return
1249
log.debug("Stopping checker for %(name)s", vars(self))
774
logger.debug("Stopping checker for %(name)s", vars(self))
1250
775
self.checker.terminate()
1251
776
self.checker = None
1252
777
1257
782
byte_arrays=False):
1258
783
"""Decorators for marking methods of a DBusObjectWithProperties to
1259
784
become properties on the D-Bus.
1260
785
1261
786
The decorated method will be called with no arguments by "Get"
1262
787
and with one argument by "Set".
1263
788
1264
789
The parameters, where they are supported, are the same as
1265
790
dbus.service.method, except there is only "signature", since the
1266
791
type from Get() and the type sent to Set() is the same.
1270
795
if byte_arrays and signature != "ay":
1271
796
raise ValueError("Byte arrays not supported for non-'ay'"
1272
797
" signature {!r}".format(signature))
1273
798
1274
799
def decorator(func):
1275
800
func._dbus_is_property = True
1276
801
func._dbus_interface = dbus_interface
1279
804
func._dbus_name = func.__name__
1280
805
if func._dbus_name.endswith("_dbus_property"):
1281
806
func._dbus_name = func._dbus_name[:-14]
1282
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1283
808
return func
1284
809
1285
810
return decorator
1286
811
1287
812
1288
813
def dbus_interface_annotations(dbus_interface):
1289
814
"""Decorator for marking functions returning interface annotations
1290
815
1291
816
Usage:
1292
817
1293
818
@dbus_interface_annotations("org.example.Interface")
1294
819
def _foo(self): # Function name does not matter
1295
820
return {"org.freedesktop.DBus.Deprecated": "true",
1296
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1297
822
"false"}
1298
823
"""
1299
824
1300
825
def decorator(func):
1301
826
func._dbus_is_interface = True
1302
827
func._dbus_interface = dbus_interface
1303
828
func._dbus_name = dbus_interface
1304
829
return func
1305
830
1306
831
return decorator
1307
832
1308
833
1309
834
def dbus_annotations(annotations):
1310
835
"""Decorator to annotate D-Bus methods, signals or properties
1311
836
Usage:
1312
837
1313
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1314
839
"org.freedesktop.DBus.Property."
1315
840
"EmitsChangedSignal": "false"})
1317
842
access="r")
1318
843
def Property_dbus_property(self):
1319
844
return dbus.Boolean(False)
1320
1321
See also the DBusObjectWithAnnotations class.
1322
845
"""
1323
846
1324
847
def decorator(func):
1325
848
func._dbus_annotations = annotations
1326
849
return func
1327
850
1328
851
return decorator
1329
852
1330
853
1346
869
pass
1347
870
1348
871
1349
class DBusObjectWithAnnotations(dbus.service.Object):
1350
"""A D-Bus object with annotations.
1351
1352
Classes inheriting from this can use the dbus_annotations
1353
decorator to add annotations to methods or signals.
872
class DBusObjectWithProperties(dbus.service.Object):
873
"""A D-Bus object with properties.
874
875
Classes inheriting from this can use the dbus_service_property
876
decorator to expose methods as D-Bus properties. It exposes the
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
1354
878
"""
1355
879
1356
880
@staticmethod
1357
881
def _is_dbus_thing(thing):
1358
882
"""Returns a function testing if an attribute is a D-Bus thing
1359
883
1360
884
If called like _is_dbus_thing("method") it returns a function
1361
885
suitable for use as predicate to inspect.getmembers().
1362
886
"""
1363
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1364
888
False)
1365
889
1366
890
def _get_all_dbus_things(self, thing):
1367
891
"""Returns a generator of (name, attribute) pairs
1368
892
"""
1371
895
for cls in self.__class__.__mro__
1372
896
for name, athing in
1373
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1374
1375
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1376
out_signature="s",
1377
path_keyword="object_path",
1378
connection_keyword="connection")
1379
def Introspect(self, object_path, connection):
1380
"""Overloading of standard D-Bus method.
1381
1382
Inserts annotation tags on methods and signals.
1383
"""
1384
xmlstring = dbus.service.Object.Introspect(self, object_path,
1385
connection)
1386
try:
1387
document = xml.dom.minidom.parseString(xmlstring)
1388
1389
for if_tag in document.getElementsByTagName("interface"):
1390
# Add annotation tags
1391
for typ in ("method", "signal"):
1392
for tag in if_tag.getElementsByTagName(typ):
1393
annots = dict()
1394
for name, prop in (self.
1395
_get_all_dbus_things(typ)):
1396
if (name == tag.getAttribute("name")
1397
and prop._dbus_interface
1398
== if_tag.getAttribute("name")):
1399
annots.update(getattr(
1400
prop, "_dbus_annotations", {}))
1401
for name, value in annots.items():
1402
ann_tag = document.createElement(
1403
"annotation")
1404
ann_tag.setAttribute("name", name)
1405
ann_tag.setAttribute("value", value)
1406
tag.appendChild(ann_tag)
1407
# Add interface annotation tags
1408
for annotation, value in dict(
1409
itertools.chain.from_iterable(
1410
annotations().items()
1411
for name, annotations
1412
in self._get_all_dbus_things("interface")
1413
if name == if_tag.getAttribute("name")
1414
)).items():
1415
ann_tag = document.createElement("annotation")
1416
ann_tag.setAttribute("name", annotation)
1417
ann_tag.setAttribute("value", value)
1418
if_tag.appendChild(ann_tag)
1419
# Fix argument name for the Introspect method itself
1420
if (if_tag.getAttribute("name")
1421
== dbus.INTROSPECTABLE_IFACE):
1422
for cn in if_tag.getElementsByTagName("method"):
1423
if cn.getAttribute("name") == "Introspect":
1424
for arg in cn.getElementsByTagName("arg"):
1425
if (arg.getAttribute("direction")
1426
== "out"):
1427
arg.setAttribute("name",
1428
"xml_data")
1429
xmlstring = document.toxml("utf-8")
1430
document.unlink()
1431
except (AttributeError, xml.dom.DOMException,
1432
xml.parsers.expat.ExpatError) as error:
1433
log.error("Failed to override Introspection method",
1434
exc_info=error)
1435
return xmlstring
1436
1437
1438
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1439
"""A D-Bus object with properties.
1440
1441
Classes inheriting from this can use the dbus_service_property
1442
decorator to expose methods as D-Bus properties. It exposes the
1443
standard Get(), Set(), and GetAll() methods on the D-Bus.
1444
"""
1445
898
1446
899
def _get_dbus_property(self, interface_name, property_name):
1447
900
"""Returns a bound method if one exists which is a D-Bus
1448
901
property with the specified name and interface.
1453
906
if (value._dbus_name == property_name
1454
907
and value._dbus_interface == interface_name):
1455
908
return value.__get__(self)
1456
909
1457
910
# No such property
1458
911
raise DBusPropertyNotFound("{}:{}.{}".format(
1459
912
self.dbus_object_path, interface_name, property_name))
1460
1461
@classmethod
1462
def _get_all_interface_names(cls):
1463
"""Get a sequence of all interfaces supported by an object"""
1464
return (name for name in set(getattr(getattr(x, attr),
1465
"_dbus_interface", None)
1466
for x in (inspect.getmro(cls))
1467
for attr in dir(x))
1468
if name is not None)
1469
913
1470
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
1471
915
in_signature="ss",
1472
916
out_signature="v")
1480
924
if not hasattr(value, "variant_level"):
1481
925
return value
1482
926
return type(value)(value, variant_level=value.variant_level+1)
1483
927
1484
928
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1485
929
def Set(self, interface_name, property_name, value):
1486
930
"""Standard D-Bus property Set() method, see D-Bus standard.
1495
939
raise ValueError("Byte arrays not supported for non-"
1496
940
"'ay' signature {!r}"
1497
941
.format(prop._dbus_signature))
1498
value = dbus.ByteArray(bytes(value))
942
value = dbus.ByteArray(b''.join(chr(byte)
943
for byte in value))
1499
944
prop(value)
1500
945
1501
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
1502
947
in_signature="s",
1503
948
out_signature="a{sv}")
1504
949
def GetAll(self, interface_name):
1505
950
"""Standard D-Bus property GetAll() method, see D-Bus
1506
951
standard.
1507
952
1508
953
Note: Will not include properties with access="write".
1509
954
"""
1510
955
properties = {}
1521
966
properties[name] = value
1522
967
continue
1523
968
properties[name] = type(value)(
1524
value, variant_level=value.variant_level + 1)
969
value, variant_level = value.variant_level + 1)
1525
970
return dbus.Dictionary(properties, signature="sv")
1526
971
1527
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1528
973
def PropertiesChanged(self, interface_name, changed_properties,
1529
974
invalidated_properties):
1531
976
standard.
1532
977
"""
1533
978
pass
1534
979
1535
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1536
981
out_signature="s",
1537
path_keyword="object_path",
1538
connection_keyword="connection")
982
path_keyword='object_path',
983
connection_keyword='connection')
1539
984
def Introspect(self, object_path, connection):
1540
985
"""Overloading of standard D-Bus method.
1541
986
1542
987
Inserts property tags and interface annotation tags.
1543
988
"""
1544
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1545
object_path,
1546
connection)
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
990
connection)
1547
991
try:
1548
992
document = xml.dom.minidom.parseString(xmlstring)
1549
993
1550
994
def make_tag(document, name, prop):
1551
995
e = document.createElement("property")
1552
996
e.setAttribute("name", name)
1553
997
e.setAttribute("type", prop._dbus_signature)
1554
998
e.setAttribute("access", prop._dbus_access)
1555
999
return e
1556
1000
1557
1001
for if_tag in document.getElementsByTagName("interface"):
1558
1002
# Add property tags
1559
1003
for tag in (make_tag(document, name, prop)
1562
1006
if prop._dbus_interface
1563
1007
== if_tag.getAttribute("name")):
1564
1008
if_tag.appendChild(tag)
1565
# Add annotation tags for properties
1566
for tag in if_tag.getElementsByTagName("property"):
1567
annots = dict()
1568
for name, prop in self._get_all_dbus_things(
1569
"property"):
1570
if (name == tag.getAttribute("name")
1571
and prop._dbus_interface
1572
== if_tag.getAttribute("name")):
1573
annots.update(getattr(
1574
prop, "_dbus_annotations", {}))
1575
for name, value in annots.items():
1576
ann_tag = document.createElement(
1577
"annotation")
1578
ann_tag.setAttribute("name", name)
1579
ann_tag.setAttribute("value", value)
1580
tag.appendChild(ann_tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1581
1038
# Add the names to the return values for the
1582
1039
# "org.freedesktop.DBus.Properties" methods
1583
1040
if (if_tag.getAttribute("name")
1597
1054
document.unlink()
1598
1055
except (AttributeError, xml.dom.DOMException,
1599
1056
xml.parsers.expat.ExpatError) as error:
1600
log.error("Failed to override Introspection method",
1601
exc_info=error)
1602
return xmlstring
1603
1604
1605
try:
1606
dbus.OBJECT_MANAGER_IFACE
1607
except AttributeError:
1608
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1609
1610
1611
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1612
"""A D-Bus object with an ObjectManager.
1613
1614
Classes inheriting from this exposes the standard
1615
GetManagedObjects call and the InterfacesAdded and
1616
InterfacesRemoved signals on the standard
1617
"org.freedesktop.DBus.ObjectManager" interface.
1618
1619
Note: No signals are sent automatically; they must be sent
1620
manually.
1621
"""
1622
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1623
out_signature="a{oa{sa{sv}}}")
1624
def GetManagedObjects(self):
1625
"""This function must be overridden"""
1626
raise NotImplementedError()
1627
1628
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1629
signature="oa{sa{sv}}")
1630
def InterfacesAdded(self, object_path, interfaces_and_properties):
1631
pass
1632
1633
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1634
def InterfacesRemoved(self, object_path, interfaces):
1635
pass
1636
1637
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1638
out_signature="s",
1639
path_keyword="object_path",
1640
connection_keyword="connection")
1641
def Introspect(self, object_path, connection):
1642
"""Overloading of standard D-Bus method.
1643
1644
Override return argument name of GetManagedObjects to be
1645
"objpath_interfaces_and_properties"
1646
"""
1647
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1648
object_path,
1649
connection)
1650
try:
1651
document = xml.dom.minidom.parseString(xmlstring)
1652
1653
for if_tag in document.getElementsByTagName("interface"):
1654
# Fix argument name for the GetManagedObjects method
1655
if (if_tag.getAttribute("name")
1656
== dbus.OBJECT_MANAGER_IFACE):
1657
for cn in if_tag.getElementsByTagName("method"):
1658
if (cn.getAttribute("name")
1659
== "GetManagedObjects"):
1660
for arg in cn.getElementsByTagName("arg"):
1661
if (arg.getAttribute("direction")
1662
== "out"):
1663
arg.setAttribute(
1664
"name",
1665
"objpath_interfaces"
1666
"_and_properties")
1667
xmlstring = document.toxml("utf-8")
1668
document.unlink()
1669
except (AttributeError, xml.dom.DOMException,
1670
xml.parsers.expat.ExpatError) as error:
1671
log.error("Failed to override Introspection method",
1672
exc_info=error)
1057
logger.error("Failed to override Introspection method",
1058
exc_info=error)
1673
1059
return xmlstring
1674
1060
1675
1061
1676
1062
def datetime_to_dbus(dt, variant_level=0):
1677
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1678
1064
if dt is None:
1679
return dbus.String("", variant_level=variant_level)
1065
return dbus.String("", variant_level = variant_level)
1680
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1681
1067
1682
1068
1685
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1686
1072
interface names according to the "alt_interface_names" mapping.
1687
1073
Usage:
1688
1074
1689
1075
@alternate_dbus_interfaces({"org.example.Interface":
1690
1076
"net.example.AlternateInterface"})
1691
1077
class SampleDBusObject(dbus.service.Object):
1692
1078
@dbus.service.method("org.example.Interface")
1693
1079
def SampleDBusMethod():
1694
1080
pass
1695
1081
1696
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1697
1083
reachable via two interfaces: "org.example.Interface" and
1698
1084
"net.example.AlternateInterface", the latter of which will have
1699
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1700
1086
"true", unless "deprecate" is passed with a False value.
1701
1087
1702
1088
This works for methods and signals, and also for D-Bus properties
1703
1089
(from DBusObjectWithProperties) and interfaces (from the
1704
1090
dbus_interface_annotations decorator).
1705
1091
"""
1706
1092
1707
1093
def wrapper(cls):
1708
1094
for orig_interface_name, alt_interface_name in (
1709
1095
alt_interface_names.items()):
1724
1110
interface_names.add(alt_interface)
1725
1111
# Is this a D-Bus signal?
1726
1112
if getattr(attribute, "_dbus_is_signal", False):
1727
# Extract the original non-method undecorated
1728
# function by black magic
1729
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1730
1116
nonmethod_func = (dict(
1731
1117
zip(attribute.func_code.co_freevars,
1732
1118
attribute.__closure__))
1733
1119
["func"].cell_contents)
1734
1120
else:
1735
nonmethod_func = (dict(
1736
zip(attribute.__code__.co_freevars,
1737
attribute.__closure__))
1738
["func"].cell_contents)
1121
nonmethod_func = attribute
1739
1122
# Create a new, but exactly alike, function
1740
1123
# object, and decorate it to be a new D-Bus signal
1741
1124
# with the alternate D-Bus interface name
1742
new_function = copy_function(nonmethod_func)
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1132
else:
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1743
1139
new_function = (dbus.service.signal(
1744
1140
alt_interface,
1745
1141
attribute._dbus_signature)(new_function))
1749
1145
attribute._dbus_annotations)
1750
1146
except AttributeError:
1751
1147
pass
1752
1753
1148
# Define a creator of a function to call both the
1754
1149
# original and alternate functions, so both the
1755
1150
# original and alternate signals gets sent when
1758
1153
"""This function is a scope container to pass
1759
1154
func1 and func2 to the "call_both" function
1760
1155
outside of its arguments"""
1761
1762
@functools.wraps(func2)
1156
1763
1157
def call_both(*args, **kwargs):
1764
1158
"""This function will emit two D-Bus
1765
1159
signals by calling func1 and func2"""
1766
1160
func1(*args, **kwargs)
1767
1161
func2(*args, **kwargs)
1768
# Make wrapper function look like a D-Bus
1769
# signal
1770
for name, attr in inspect.getmembers(func2):
1771
if name.startswith("_dbus_"):
1772
setattr(call_both, name, attr)
1773
1162
1774
1163
return call_both
1775
1164
# Create the "call_both" function and add it to
1776
1165
# the class
1786
1175
alt_interface,
1787
1176
attribute._dbus_in_signature,
1788
1177
attribute._dbus_out_signature)
1789
(copy_function(attribute)))
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1790
1183
# Copy annotations, if any
1791
1184
try:
1792
1185
attr[attrname]._dbus_annotations = dict(
1804
1197
attribute._dbus_access,
1805
1198
attribute._dbus_get_args_options
1806
1199
["byte_arrays"])
1807
(copy_function(attribute)))
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1808
1206
# Copy annotations, if any
1809
1207
try:
1810
1208
attr[attrname]._dbus_annotations = dict(
1819
1217
# to the class.
1820
1218
attr[attrname] = (
1821
1219
dbus_interface_annotations(alt_interface)
1822
(copy_function(attribute)))
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1823
1225
if deprecate:
1824
1226
# Deprecate all alternate interfaces
1825
iname = "_AlternateDBusNames_interface_annotation{}"
1227
iname="_AlternateDBusNames_interface_annotation{}"
1826
1228
for interface_name in interface_names:
1827
1229
1828
1230
@dbus_interface_annotations(interface_name)
1829
1231
def func(self):
1830
return {"org.freedesktop.DBus.Deprecated":
1831
"true"}
1232
return { "org.freedesktop.DBus.Deprecated":
1233
"true" }
1832
1234
# Find an unused name
1833
1235
for aname in (iname.format(i)
1834
1236
for i in itertools.count()):
1838
1240
if interface_names:
1839
1241
# Replace the class with a new subclass of it with
1840
1242
# methods, signals, etc. as created above.
1841
if sys.version_info.major == 2:
1842
cls = type(b"{}Alternate".format(cls.__name__),
1843
(cls, ), attr)
1844
else:
1845
cls = type("{}Alternate".format(cls.__name__),
1846
(cls, ), attr)
1243
cls = type(b"{}Alternate".format(cls.__name__),
1244
(cls, ), attr)
1847
1245
return cls
1848
1246
1849
1247
return wrapper
1850
1248
1851
1249
1853
1251
"se.bsnet.fukt.Mandos"})
1854
1252
class ClientDBus(Client, DBusObjectWithProperties):
1855
1253
"""A Client class using D-Bus
1856
1254
1857
1255
Attributes:
1858
1256
dbus_object_path: dbus.ObjectPath
1859
1257
bus: dbus.SystemBus()
1860
1258
"""
1861
1259
1862
1260
runtime_expansions = (Client.runtime_expansions
1863
1261
+ ("dbus_object_path", ))
1864
1262
1865
1263
_interface = "se.recompile.Mandos.Client"
1866
1264
1867
1265
# dbus.service.Object doesn't use super(), so we can't either.
1868
1869
def __init__(self, bus=None, *args, **kwargs):
1266
1267
def __init__(self, bus = None, *args, **kwargs):
1870
1268
self.bus = bus
1871
1269
Client.__init__(self, *args, **kwargs)
1872
1270
# Only now, when this client is initialized, can it show up on
1878
1276
"/clients/" + client_object_name)
1879
1277
DBusObjectWithProperties.__init__(self, self.bus,
1880
1278
self.dbus_object_path)
1881
1279
1882
1280
def notifychangeproperty(transform_func, dbus_name,
1883
1281
type_func=lambda x: x,
1884
1282
variant_level=1,
1886
1284
_interface=_interface):
1887
1285
""" Modify a variable so that it's a property which announces
1888
1286
its changes to DBus.
1889
1287
1890
1288
transform_fun: Function that takes a value and a variant_level
1891
1289
and transforms it to a D-Bus type.
1892
1290
dbus_name: D-Bus name of the variable
1895
1293
variant_level: D-Bus variant level. Default: 1
1896
1294
"""
1897
1295
attrname = "_{}".format(dbus_name)
1898
1296
1899
1297
def setter(self, value):
1900
1298
if hasattr(self, "dbus_object_path"):
1901
1299
if (not hasattr(self, attrname) or
1908
1306
else:
1909
1307
dbus_value = transform_func(
1910
1308
type_func(value),
1911
variant_level=variant_level)
1309
variant_level = variant_level)
1912
1310
self.PropertyChanged(dbus.String(dbus_name),
1913
1311
dbus_value)
1914
1312
self.PropertiesChanged(
1915
1313
_interface,
1916
dbus.Dictionary({dbus.String(dbus_name):
1917
dbus_value}),
1314
dbus.Dictionary({ dbus.String(dbus_name):
1315
dbus_value }),
1918
1316
dbus.Array())
1919
1317
setattr(self, attrname, value)
1920
1318
1921
1319
return property(lambda self: getattr(self, attrname), setter)
1922
1320
1923
1321
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1924
1322
approvals_pending = notifychangeproperty(dbus.Boolean,
1925
1323
"ApprovalPending",
1926
type_func=bool)
1324
type_func = bool)
1927
1325
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1928
1326
last_enabled = notifychangeproperty(datetime_to_dbus,
1929
1327
"LastEnabled")
1930
1328
checker = notifychangeproperty(
1931
1329
dbus.Boolean, "CheckerRunning",
1932
type_func=lambda checker: checker is not None)
1330
type_func = lambda checker: checker is not None)
1933
1331
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1934
1332
"LastCheckedOK")
1935
1333
last_checker_status = notifychangeproperty(dbus.Int16,
1940
1338
"ApprovedByDefault")
1941
1339
approval_delay = notifychangeproperty(
1942
1340
dbus.UInt64, "ApprovalDelay",
1943
type_func=lambda td: td.total_seconds() * 1000)
1341
type_func = lambda td: td.total_seconds() * 1000)
1944
1342
approval_duration = notifychangeproperty(
1945
1343
dbus.UInt64, "ApprovalDuration",
1946
type_func=lambda td: td.total_seconds() * 1000)
1344
type_func = lambda td: td.total_seconds() * 1000)
1947
1345
host = notifychangeproperty(dbus.String, "Host")
1948
1346
timeout = notifychangeproperty(
1949
1347
dbus.UInt64, "Timeout",
1950
type_func=lambda td: td.total_seconds() * 1000)
1348
type_func = lambda td: td.total_seconds() * 1000)
1951
1349
extended_timeout = notifychangeproperty(
1952
1350
dbus.UInt64, "ExtendedTimeout",
1953
type_func=lambda td: td.total_seconds() * 1000)
1351
type_func = lambda td: td.total_seconds() * 1000)
1954
1352
interval = notifychangeproperty(
1955
1353
dbus.UInt64, "Interval",
1956
type_func=lambda td: td.total_seconds() * 1000)
1354
type_func = lambda td: td.total_seconds() * 1000)
1957
1355
checker_command = notifychangeproperty(dbus.String, "Checker")
1958
1356
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1959
1357
invalidate_only=True)
1960
1358
1961
1359
del notifychangeproperty
1962
1360
1963
1361
def __del__(self, *args, **kwargs):
1964
1362
try:
1965
1363
self.remove_from_connection()
1968
1366
if hasattr(DBusObjectWithProperties, "__del__"):
1969
1367
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1970
1368
Client.__del__(self, *args, **kwargs)
1971
1369
1972
1370
def checker_callback(self, source, condition,
1973
1371
connection, command, *args, **kwargs):
1974
1372
ret = Client.checker_callback(self, source, condition,
1978
1376
if exitstatus >= 0:
1979
1377
# Emit D-Bus signal
1980
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
1981
# This is specific to GNU libC
1982
dbus.Int64(exitstatus << 8),
1379
dbus.Int64(0),
1983
1380
dbus.String(command))
1984
1381
else:
1985
1382
# Emit D-Bus signal
1986
1383
self.CheckerCompleted(dbus.Int16(-1),
1987
1384
dbus.Int64(
1988
# This is specific to GNU libC
1989
(exitstatus << 8)
1990
| self.last_checker_signal),
1385
self.last_checker_signal),
1991
1386
dbus.String(command))
1992
1387
return ret
1993
1388
1994
1389
def start_checker(self, *args, **kwargs):
1995
1390
old_checker_pid = getattr(self.checker, "pid", None)
1996
1391
r = Client.start_checker(self, *args, **kwargs)
2000
1395
# Emit D-Bus signal
2001
1396
self.CheckerStarted(self.current_checker_command)
2002
1397
return r
2003
1398
2004
1399
def _reset_approved(self):
2005
1400
self.approved = None
2006
1401
return False
2007
1402
2008
1403
def approve(self, value=True):
2009
1404
self.approved = value
2010
GLib.timeout_add(int(self.approval_duration.total_seconds()
2011
* 1000), self._reset_approved)
1405
gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
* 1000), self._reset_approved)
2012
1407
self.send_changedstate()
2013
2014
# D-Bus methods, signals & properties
2015
2016
# Interfaces
2017
2018
# Signals
2019
1408
1409
## D-Bus methods, signals & properties
1410
1411
## Interfaces
1412
1413
## Signals
1414
2020
1415
# CheckerCompleted - signal
2021
1416
@dbus.service.signal(_interface, signature="nxs")
2022
1417
def CheckerCompleted(self, exitcode, waitstatus, command):
2023
1418
"D-Bus signal"
2024
1419
pass
2025
1420
2026
1421
# CheckerStarted - signal
2027
1422
@dbus.service.signal(_interface, signature="s")
2028
1423
def CheckerStarted(self, command):
2029
1424
"D-Bus signal"
2030
1425
pass
2031
1426
2032
1427
# PropertyChanged - signal
2033
1428
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2034
1429
@dbus.service.signal(_interface, signature="sv")
2035
1430
def PropertyChanged(self, property, value):
2036
1431
"D-Bus signal"
2037
1432
pass
2038
1433
2039
1434
# GotSecret - signal
2040
1435
@dbus.service.signal(_interface)
2041
1436
def GotSecret(self):
2044
1439
server to mandos-client
2045
1440
"""
2046
1441
pass
2047
1442
2048
1443
# Rejected - signal
2049
1444
@dbus.service.signal(_interface, signature="s")
2050
1445
def Rejected(self, reason):
2051
1446
"D-Bus signal"
2052
1447
pass
2053
1448
2054
1449
# NeedApproval - signal
2055
1450
@dbus.service.signal(_interface, signature="tb")
2056
1451
def NeedApproval(self, timeout, default):
2057
1452
"D-Bus signal"
2058
1453
return self.need_approval()
2059
2060
# Methods
2061
1454
1455
## Methods
1456
2062
1457
# Approve - method
2063
1458
@dbus.service.method(_interface, in_signature="b")
2064
1459
def Approve(self, value):
2065
1460
self.approve(value)
2066
1461
2067
1462
# CheckedOK - method
2068
1463
@dbus.service.method(_interface)
2069
1464
def CheckedOK(self):
2070
1465
self.checked_ok()
2071
1466
2072
1467
# Enable - method
2073
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2074
1468
@dbus.service.method(_interface)
2075
1469
def Enable(self):
2076
1470
"D-Bus method"
2077
1471
self.enable()
2078
1472
2079
1473
# StartChecker - method
2080
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2081
1474
@dbus.service.method(_interface)
2082
1475
def StartChecker(self):
2083
1476
"D-Bus method"
2084
1477
self.start_checker()
2085
1478
2086
1479
# Disable - method
2087
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2088
1480
@dbus.service.method(_interface)
2089
1481
def Disable(self):
2090
1482
"D-Bus method"
2091
1483
self.disable()
2092
1484
2093
1485
# StopChecker - method
2094
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2095
1486
@dbus.service.method(_interface)
2096
1487
def StopChecker(self):
2097
1488
self.stop_checker()
2098
2099
# Properties
2100
1489
1490
## Properties
1491
2101
1492
# ApprovalPending - property
2102
1493
@dbus_service_property(_interface, signature="b", access="read")
2103
1494
def ApprovalPending_dbus_property(self):
2104
1495
return dbus.Boolean(bool(self.approvals_pending))
2105
1496
2106
1497
# ApprovedByDefault - property
2107
1498
@dbus_service_property(_interface,
2108
1499
signature="b",
2111
1502
if value is None: # get
2112
1503
return dbus.Boolean(self.approved_by_default)
2113
1504
self.approved_by_default = bool(value)
2114
1505
2115
1506
# ApprovalDelay - property
2116
1507
@dbus_service_property(_interface,
2117
1508
signature="t",
2121
1512
return dbus.UInt64(self.approval_delay.total_seconds()
2122
1513
* 1000)
2123
1514
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2124
1515
2125
1516
# ApprovalDuration - property
2126
1517
@dbus_service_property(_interface,
2127
1518
signature="t",
2131
1522
return dbus.UInt64(self.approval_duration.total_seconds()
2132
1523
* 1000)
2133
1524
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2134
1525
2135
1526
# Name - property
2136
1527
@dbus_annotations(
2137
1528
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2138
1529
@dbus_service_property(_interface, signature="s", access="read")
2139
1530
def Name_dbus_property(self):
2140
1531
return dbus.String(self.name)
2141
2142
# KeyID - property
2143
@dbus_annotations(
2144
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2145
@dbus_service_property(_interface, signature="s", access="read")
2146
def KeyID_dbus_property(self):
2147
return dbus.String(self.key_id)
2148
1532
2149
1533
# Fingerprint - property
2150
1534
@dbus_annotations(
2151
1535
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2152
1536
@dbus_service_property(_interface, signature="s", access="read")
2153
1537
def Fingerprint_dbus_property(self):
2154
1538
return dbus.String(self.fingerprint)
2155
1539
2156
1540
# Host - property
2157
1541
@dbus_service_property(_interface,
2158
1542
signature="s",
2161
1545
if value is None: # get
2162
1546
return dbus.String(self.host)
2163
1547
self.host = str(value)
2164
1548
2165
1549
# Created - property
2166
1550
@dbus_annotations(
2167
1551
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2168
1552
@dbus_service_property(_interface, signature="s", access="read")
2169
1553
def Created_dbus_property(self):
2170
1554
return datetime_to_dbus(self.created)
2171
1555
2172
1556
# LastEnabled - property
2173
1557
@dbus_service_property(_interface, signature="s", access="read")
2174
1558
def LastEnabled_dbus_property(self):
2175
1559
return datetime_to_dbus(self.last_enabled)
2176
1560
2177
1561
# Enabled - property
2178
1562
@dbus_service_property(_interface,
2179
1563
signature="b",
2185
1569
self.enable()
2186
1570
else:
2187
1571
self.disable()
2188
1572
2189
1573
# LastCheckedOK - property
2190
1574
@dbus_service_property(_interface,
2191
1575
signature="s",
2195
1579
self.checked_ok()
2196
1580
return
2197
1581
return datetime_to_dbus(self.last_checked_ok)
2198
1582
2199
1583
# LastCheckerStatus - property
2200
1584
@dbus_service_property(_interface, signature="n", access="read")
2201
1585
def LastCheckerStatus_dbus_property(self):
2202
1586
return dbus.Int16(self.last_checker_status)
2203
1587
2204
1588
# Expires - property
2205
1589
@dbus_service_property(_interface, signature="s", access="read")
2206
1590
def Expires_dbus_property(self):
2207
1591
return datetime_to_dbus(self.expires)
2208
1592
2209
1593
# LastApprovalRequest - property
2210
1594
@dbus_service_property(_interface, signature="s", access="read")
2211
1595
def LastApprovalRequest_dbus_property(self):
2212
1596
return datetime_to_dbus(self.last_approval_request)
2213
1597
2214
1598
# Timeout - property
2215
1599
@dbus_service_property(_interface,
2216
1600
signature="t",
2231
1615
if (getattr(self, "disable_initiator_tag", None)
2232
1616
is None):
2233
1617
return
2234
GLib.source_remove(self.disable_initiator_tag)
2235
self.disable_initiator_tag = GLib.timeout_add(
1618
gobject.source_remove(self.disable_initiator_tag)
1619
self.disable_initiator_tag = gobject.timeout_add(
2236
1620
int((self.expires - now).total_seconds() * 1000),
2237
1621
self.disable)
2238
1622
2239
1623
# ExtendedTimeout - property
2240
1624
@dbus_service_property(_interface,
2241
1625
signature="t",
2245
1629
return dbus.UInt64(self.extended_timeout.total_seconds()
2246
1630
* 1000)
2247
1631
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2248
1632
2249
1633
# Interval - property
2250
1634
@dbus_service_property(_interface,
2251
1635
signature="t",
2258
1642
return
2259
1643
if self.enabled:
2260
1644
# Reschedule checker run
2261
GLib.source_remove(self.checker_initiator_tag)
2262
self.checker_initiator_tag = GLib.timeout_add(
1645
gobject.source_remove(self.checker_initiator_tag)
1646
self.checker_initiator_tag = gobject.timeout_add(
2263
1647
value, self.start_checker)
2264
self.start_checker() # Start one now, too
2265
1648
self.start_checker() # Start one now, too
1649
2266
1650
# Checker - property
2267
1651
@dbus_service_property(_interface,
2268
1652
signature="s",
2271
1655
if value is None: # get
2272
1656
return dbus.String(self.checker_command)
2273
1657
self.checker_command = str(value)
2274
1658
2275
1659
# CheckerRunning - property
2276
1660
@dbus_service_property(_interface,
2277
1661
signature="b",
2283
1667
self.start_checker()
2284
1668
else:
2285
1669
self.stop_checker()
2286
1670
2287
1671
# ObjectPath - property
2288
1672
@dbus_annotations(
2289
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2290
"org.freedesktop.DBus.Deprecated": "true"})
1673
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2291
1674
@dbus_service_property(_interface, signature="o", access="read")
2292
1675
def ObjectPath_dbus_property(self):
2293
return self.dbus_object_path # is already a dbus.ObjectPath
2294
1676
return self.dbus_object_path # is already a dbus.ObjectPath
1677
2295
1678
# Secret = property
2296
1679
@dbus_annotations(
2297
1680
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2302
1685
byte_arrays=True)
2303
1686
def Secret_dbus_property(self, value):
2304
1687
self.secret = bytes(value)
2305
1688
2306
1689
del _interface
2307
1690
2308
1691
2309
class ProxyClient:
2310
def __init__(self, child_pipe, key_id, fpr, address):
1692
class ProxyClient(object):
1693
def __init__(self, child_pipe, fpr, address):
2311
1694
self._pipe = child_pipe
2312
self._pipe.send(("init", key_id, fpr, address))
1695
self._pipe.send(('init', fpr, address))
2313
1696
if not self._pipe.recv():
2314
raise KeyError(key_id or fpr)
2315
1697
raise KeyError(fpr)
1698
2316
1699
def __getattribute__(self, name):
2317
if name == "_pipe":
1700
if name == '_pipe':
2318
1701
return super(ProxyClient, self).__getattribute__(name)
2319
self._pipe.send(("getattr", name))
1702
self._pipe.send(('getattr', name))
2320
1703
data = self._pipe.recv()
2321
if data[0] == "data":
1704
if data[0] == 'data':
2322
1705
return data[1]
2323
if data[0] == "function":
2324
1706
if data[0] == 'function':
1707
2325
1708
def func(*args, **kwargs):
2326
self._pipe.send(("funcall", name, args, kwargs))
1709
self._pipe.send(('funcall', name, args, kwargs))
2327
1710
return self._pipe.recv()[1]
2328
1711
2329
1712
return func
2330
1713
2331
1714
def __setattr__(self, name, value):
2332
if name == "_pipe":
1715
if name == '_pipe':
2333
1716
return super(ProxyClient, self).__setattr__(name, value)
2334
self._pipe.send(("setattr", name, value))
1717
self._pipe.send(('setattr', name, value))
2335
1718
2336
1719
2337
1720
class ClientHandler(socketserver.BaseRequestHandler, object):
2338
1721
"""A class to handle client connections.
2339
1722
2340
1723
Instantiated once for each connection to handle it.
2341
1724
Note: This will run in its own forked process."""
2342
1725
2343
1726
def handle(self):
2344
1727
with contextlib.closing(self.server.child_pipe) as child_pipe:
2345
log.info("TCP connection from: %s",
2346
str(self.client_address))
2347
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2348
2349
session = gnutls.ClientSession(self.request)
2350
2351
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2352
# "+AES-256-CBC", "+SHA1",
2353
# "+COMP-NULL", "+CTYPE-OPENPGP",
2354
# "+DHE-DSS"))
1728
logger.info("TCP connection from: %s",
1729
str(self.client_address))
1730
logger.debug("Pipe FD: %d",
1731
self.server.child_pipe.fileno())
1732
1733
session = gnutls.connection.ClientSession(
1734
self.request, gnutls.connection .X509Credentials())
1735
1736
# Note: gnutls.connection.X509Credentials is really a
1737
# generic GnuTLS certificate credentials object so long as
1738
# no X.509 keys are added to it. Therefore, we can use it
1739
# here despite using OpenPGP certificates.
1740
1741
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1742
# "+AES-256-CBC", "+SHA1",
1743
# "+COMP-NULL", "+CTYPE-OPENPGP",
1744
# "+DHE-DSS"))
2355
1745
# Use a fallback default, since this MUST be set.
2356
1746
priority = self.server.gnutls_priority
2357
1747
if priority is None:
2358
1748
priority = "NORMAL"
2359
gnutls.priority_set_direct(session,
2360
priority.encode("utf-8"), None)
2361
1749
gnutls.library.functions.gnutls_priority_set_direct(
1750
session._c_object, priority, None)
1751
2362
1752
# Start communication using the Mandos protocol
2363
1753
# Get protocol number
2364
1754
line = self.request.makefile().readline()
2365
log.debug("Protocol version: %r", line)
1755
logger.debug("Protocol version: %r", line)
2366
1756
try:
2367
1757
if int(line.strip().split()[0]) > 1:
2368
1758
raise RuntimeError(line)
2369
1759
except (ValueError, IndexError, RuntimeError) as error:
2370
log.error("Unknown protocol version: %s", error)
1760
logger.error("Unknown protocol version: %s", error)
2371
1761
return
2372
1762
2373
1763
# Start GnuTLS connection
2374
1764
try:
2375
1765
session.handshake()
2376
except gnutls.Error as error:
2377
log.warning("Handshake failed: %s", error)
1766
except gnutls.errors.GNUTLSError as error:
1767
logger.warning("Handshake failed: %s", error)
2378
1768
# Do not run session.bye() here: the session is not
2379
1769
# established. Just abandon the request.
2380
1770
return
2381
log.debug("Handshake succeeded")
2382
1771
logger.debug("Handshake succeeded")
1772
2383
1773
approval_required = False
2384
1774
try:
2385
if gnutls.has_rawpk:
2386
fpr = b""
2387
try:
2388
key_id = self.key_id(
2389
self.peer_certificate(session))
2390
except (TypeError, gnutls.Error) as error:
2391
log.warning("Bad certificate: %s", error)
2392
return
2393
log.debug("Key ID: %s",
2394
key_id.decode("utf-8",
2395
errors="replace"))
2396
2397
else:
2398
key_id = b""
2399
try:
2400
fpr = self.fingerprint(
2401
self.peer_certificate(session))
2402
except (TypeError, gnutls.Error) as error:
2403
log.warning("Bad certificate: %s", error)
2404
return
2405
log.debug("Fingerprint: %s", fpr)
2406
2407
try:
2408
client = ProxyClient(child_pipe, key_id, fpr,
1775
try:
1776
fpr = self.fingerprint(
1777
self.peer_certificate(session))
1778
except (TypeError,
1779
gnutls.errors.GNUTLSError) as error:
1780
logger.warning("Bad certificate: %s", error)
1781
return
1782
logger.debug("Fingerprint: %s", fpr)
1783
1784
try:
1785
client = ProxyClient(child_pipe, fpr,
2409
1786
self.client_address)
2410
1787
except KeyError:
2411
1788
return
2412
1789
2413
1790
if client.approval_delay:
2414
1791
delay = client.approval_delay
2415
1792
client.approvals_pending += 1
2416
1793
approval_required = True
2417
1794
2418
1795
while True:
2419
1796
if not client.enabled:
2420
log.info("Client %s is disabled", client.name)
1797
logger.info("Client %s is disabled",
1798
client.name)
2421
1799
if self.server.use_dbus:
2422
1800
# Emit D-Bus signal
2423
1801
client.Rejected("Disabled")
2424
1802
return
2425
1803
2426
1804
if client.approved or not client.approval_delay:
2427
# We are approved or approval is disabled
1805
#We are approved or approval is disabled
2428
1806
break
2429
1807
elif client.approved is None:
2430
log.info("Client %s needs approval",
2431
client.name)
1808
logger.info("Client %s needs approval",
1809
client.name)
2432
1810
if self.server.use_dbus:
2433
1811
# Emit D-Bus signal
2434
1812
client.NeedApproval(
2435
1813
client.approval_delay.total_seconds()
2436
1814
* 1000, client.approved_by_default)
2437
1815
else:
2438
log.warning("Client %s was not approved",
2439
client.name)
1816
logger.warning("Client %s was not approved",
1817
client.name)
2440
1818
if self.server.use_dbus:
2441
1819
# Emit D-Bus signal
2442
1820
client.Rejected("Denied")
2443
1821
return
2444
2445
# wait until timeout or approved
1822
1823
#wait until timeout or approved
2446
1824
time = datetime.datetime.now()
2447
1825
client.changedstate.acquire()
2448
1826
client.changedstate.wait(delay.total_seconds())
2450
1828
time2 = datetime.datetime.now()
2451
1829
if (time2 - time) >= delay:
2452
1830
if not client.approved_by_default:
2453
log.warning("Client %s timed out while"
2454
" waiting for approval",
2455
client.name)
1831
logger.warning("Client %s timed out while"
1832
" waiting for approval",
1833
client.name)
2456
1834
if self.server.use_dbus:
2457
1835
# Emit D-Bus signal
2458
1836
client.Rejected("Approval timed out")
2461
1839
break
2462
1840
else:
2463
1841
delay -= time2 - time
2464
2465
try:
2466
session.send(client.secret)
2467
except gnutls.Error as error:
2468
log.warning("gnutls send failed", exc_info=error)
2469
return
2470
2471
log.info("Sending secret to %s", client.name)
1842
1843
sent_size = 0
1844
while sent_size < len(client.secret):
1845
try:
1846
sent = session.send(client.secret[sent_size:])
1847
except gnutls.errors.GNUTLSError as error:
1848
logger.warning("gnutls send failed",
1849
exc_info=error)
1850
return
1851
logger.debug("Sent: %d, remaining: %d", sent,
1852
len(client.secret) - (sent_size
1853
+ sent))
1854
sent_size += sent
1855
1856
logger.info("Sending secret to %s", client.name)
2472
1857
# bump the timeout using extended_timeout
2473
1858
client.bump_timeout(client.extended_timeout)
2474
1859
if self.server.use_dbus:
2475
1860
# Emit D-Bus signal
2476
1861
client.GotSecret()
2477
1862
2478
1863
finally:
2479
1864
if approval_required:
2480
1865
client.approvals_pending -= 1
2481
1866
try:
2482
1867
session.bye()
2483
except gnutls.Error as error:
2484
log.warning("GnuTLS bye failed", exc_info=error)
2485
1868
except gnutls.errors.GNUTLSError as error:
1869
logger.warning("GnuTLS bye failed",
1870
exc_info=error)
1871
2486
1872
@staticmethod
2487
1873
def peer_certificate(session):
2488
"Return the peer's certificate as a bytestring"
2489
try:
2490
cert_type = gnutls.certificate_type_get2(
2491
session, gnutls.CTYPE_PEERS)
2492
except AttributeError:
2493
cert_type = gnutls.certificate_type_get(session)
2494
if gnutls.has_rawpk:
2495
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2496
else:
2497
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2498
# If not a valid certificate type...
2499
if cert_type not in valid_cert_types:
2500
log.info("Cert type %r not in %r", cert_type,
2501
valid_cert_types)
2502
# ...return invalid data
2503
return b""
1874
"Return the peer's OpenPGP certificate as a bytestring"
1875
# If not an OpenPGP certificate...
1876
if (gnutls.library.functions.gnutls_certificate_type_get(
1877
session._c_object)
1878
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1879
# ...do the normal thing
1880
return session.peer_certificate
2504
1881
list_size = ctypes.c_uint(1)
2505
cert_list = (gnutls.certificate_get_peers
2506
(session, ctypes.byref(list_size)))
1882
cert_list = (gnutls.library.functions
1883
.gnutls_certificate_get_peers
1884
(session._c_object, ctypes.byref(list_size)))
2507
1885
if not bool(cert_list) and list_size.value != 0:
2508
raise gnutls.Error("error getting peer certificate")
1886
raise gnutls.errors.GNUTLSError("error getting peer"
1887
" certificate")
2509
1888
if list_size.value == 0:
2510
1889
return None
2511
1890
cert = cert_list[0]
2512
1891
return ctypes.string_at(cert.data, cert.size)
2513
2514
@staticmethod
2515
def key_id(certificate):
2516
"Convert a certificate bytestring to a hexdigit key ID"
2517
# New GnuTLS "datum" with the public key
2518
datum = gnutls.datum_t(
2519
ctypes.cast(ctypes.c_char_p(certificate),
2520
ctypes.POINTER(ctypes.c_ubyte)),
2521
ctypes.c_uint(len(certificate)))
2522
# XXX all these need to be created in the gnutls "module"
2523
# New empty GnuTLS certificate
2524
pubkey = gnutls.pubkey_t()
2525
gnutls.pubkey_init(ctypes.byref(pubkey))
2526
# Import the raw public key into the certificate
2527
gnutls.pubkey_import(pubkey,
2528
ctypes.byref(datum),
2529
gnutls.X509_FMT_DER)
2530
# New buffer for the key ID
2531
buf = ctypes.create_string_buffer(32)
2532
buf_len = ctypes.c_size_t(len(buf))
2533
# Get the key ID from the raw public key into the buffer
2534
gnutls.pubkey_get_key_id(
2535
pubkey,
2536
gnutls.KEYID_USE_SHA256,
2537
ctypes.cast(ctypes.byref(buf),
2538
ctypes.POINTER(ctypes.c_ubyte)),
2539
ctypes.byref(buf_len))
2540
# Deinit the certificate
2541
gnutls.pubkey_deinit(pubkey)
2542
2543
# Convert the buffer to a Python bytestring
2544
key_id = ctypes.string_at(buf, buf_len.value)
2545
# Convert the bytestring to hexadecimal notation
2546
hex_key_id = binascii.hexlify(key_id).upper()
2547
return hex_key_id
2548
1892
2549
1893
@staticmethod
2550
1894
def fingerprint(openpgp):
2551
1895
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2552
1896
# New GnuTLS "datum" with the OpenPGP public key
2553
datum = gnutls.datum_t(
1897
datum = gnutls.library.types.gnutls_datum_t(
2554
1898
ctypes.cast(ctypes.c_char_p(openpgp),
2555
1899
ctypes.POINTER(ctypes.c_ubyte)),
2556
1900
ctypes.c_uint(len(openpgp)))
2557
1901
# New empty GnuTLS certificate
2558
crt = gnutls.openpgp_crt_t()
2559
gnutls.openpgp_crt_init(ctypes.byref(crt))
1902
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1903
gnutls.library.functions.gnutls_openpgp_crt_init(
1904
ctypes.byref(crt))
2560
1905
# Import the OpenPGP public key into the certificate
2561
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2562
gnutls.OPENPGP_FMT_RAW)
1906
gnutls.library.functions.gnutls_openpgp_crt_import(
1907
crt, ctypes.byref(datum),
1908
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2563
1909
# Verify the self signature in the key
2564
1910
crtverify = ctypes.c_uint()
2565
gnutls.openpgp_crt_verify_self(crt, 0,
2566
ctypes.byref(crtverify))
1911
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1912
crt, 0, ctypes.byref(crtverify))
2567
1913
if crtverify.value != 0:
2568
gnutls.openpgp_crt_deinit(crt)
2569
raise gnutls.CertificateSecurityError(code
2570
=crtverify.value)
1914
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1915
raise gnutls.errors.CertificateSecurityError(
1916
"Verify failed")
2571
1917
# New buffer for the fingerprint
2572
1918
buf = ctypes.create_string_buffer(20)
2573
1919
buf_len = ctypes.c_size_t()
2574
1920
# Get the fingerprint from the certificate into the buffer
2575
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2576
ctypes.byref(buf_len))
1921
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1922
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2577
1923
# Deinit the certificate
2578
gnutls.openpgp_crt_deinit(crt)
1924
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2579
1925
# Convert the buffer to a Python bytestring
2580
1926
fpr = ctypes.string_at(buf, buf_len.value)
2581
1927
# Convert the bytestring to hexadecimal notation
2583
1929
return hex_fpr
2584
1930
2585
1931
2586
class MultiprocessingMixIn:
1932
class MultiprocessingMixIn(object):
2587
1933
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2588
1934
2589
1935
def sub_process_main(self, request, address):
2590
1936
try:
2591
1937
self.finish_request(request, address)
2592
1938
except Exception:
2593
1939
self.handle_error(request, address)
2594
1940
self.close_request(request)
2595
1941
2596
1942
def process_request(self, request, address):
2597
1943
"""Start a new process to process the request."""
2598
proc = multiprocessing.Process(target=self.sub_process_main,
2599
args=(request, address))
1944
proc = multiprocessing.Process(target = self.sub_process_main,
1945
args = (request, address))
2600
1946
proc.start()
2601
1947
return proc
2602
1948
2603
1949
2604
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1950
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2605
1951
""" adds a pipe to the MixIn """
2606
1952
2607
1953
def process_request(self, request, client_address):
2608
1954
"""Overrides and wraps the original process_request().
2609
1955
2610
1956
This function creates a new pipe in self.pipe
2611
1957
"""
2612
1958
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2613
1959
2614
1960
proc = MultiprocessingMixIn.process_request(self, request,
2615
1961
client_address)
2616
1962
self.child_pipe.close()
2617
1963
self.add_pipe(parent_pipe, proc)
2618
1964
2619
1965
def add_pipe(self, parent_pipe, proc):
2620
1966
"""Dummy function; override as necessary"""
2621
1967
raise NotImplementedError()
2622
1968
2623
1969
2624
1970
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2625
socketserver.TCPServer):
2626
"""IPv6-capable TCP server. Accepts None as address and/or port
2627
1971
socketserver.TCPServer, object):
1972
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1973
2628
1974
Attributes:
2629
1975
enabled: Boolean; whether this server is activated yet
2630
1976
interface: None or a network interface name (string)
2631
1977
use_ipv6: Boolean; to use IPv6 or not
2632
1978
"""
2633
1979
2634
1980
def __init__(self, server_address, RequestHandlerClass,
2635
1981
interface=None,
2636
1982
use_ipv6=True,
2646
1992
self.socketfd = socketfd
2647
1993
# Save the original socket.socket() function
2648
1994
self.socket_socket = socket.socket
2649
2650
1995
# To implement --socket, we monkey patch socket.socket.
2651
#
1996
#
2652
1997
# (When socketserver.TCPServer is a new-style class, we
2653
1998
# could make self.socket into a property instead of monkey
2654
1999
# patching socket.socket.)
2655
#
2000
#
2656
2001
# Create a one-time-only replacement for socket.socket()
2657
2002
@functools.wraps(socket.socket)
2658
2003
def socket_wrapper(*args, **kwargs):
2670
2015
# socket_wrapper(), if socketfd was set.
2671
2016
socketserver.TCPServer.__init__(self, server_address,
2672
2017
RequestHandlerClass)
2673
2018
2674
2019
def server_bind(self):
2675
2020
"""This overrides the normal server_bind() function
2676
2021
to bind to an interface if one was specified, and also NOT to
2677
2022
bind to an address or port if they were not specified."""
2678
global SO_BINDTODEVICE
2679
2023
if self.interface is not None:
2680
2024
if SO_BINDTODEVICE is None:
2681
# Fall back to a hard-coded value which seems to be
2682
# common enough.
2683
log.warning("SO_BINDTODEVICE not found, trying 25")
2684
SO_BINDTODEVICE = 25
2685
try:
2686
self.socket.setsockopt(
2687
socket.SOL_SOCKET, SO_BINDTODEVICE,
2688
(self.interface + "\0").encode("utf-8"))
2689
except socket.error as error:
2690
if error.errno == errno.EPERM:
2691
log.error("No permission to bind to interface %s",
2692
self.interface)
2693
elif error.errno == errno.ENOPROTOOPT:
2694
log.error("SO_BINDTODEVICE not available; cannot"
2695
" bind to interface %s", self.interface)
2696
elif error.errno == errno.ENODEV:
2697
log.error("Interface %s does not exist, cannot"
2698
" bind", self.interface)
2699
else:
2700
raise
2025
logger.error("SO_BINDTODEVICE does not exist;"
2026
" cannot bind to interface %s",
2027
self.interface)
2028
else:
2029
try:
2030
self.socket.setsockopt(
2031
socket.SOL_SOCKET, SO_BINDTODEVICE,
2032
(self.interface + "\0").encode("utf-8"))
2033
except socket.error as error:
2034
if error.errno == errno.EPERM:
2035
logger.error("No permission to bind to"
2036
" interface %s", self.interface)
2037
elif error.errno == errno.ENOPROTOOPT:
2038
logger.error("SO_BINDTODEVICE not available;"
2039
" cannot bind to interface %s",
2040
self.interface)
2041
elif error.errno == errno.ENODEV:
2042
logger.error("Interface %s does not exist,"
2043
" cannot bind", self.interface)
2044
else:
2045
raise
2701
2046
# Only bind(2) the socket if we really need to.
2702
2047
if self.server_address[0] or self.server_address[1]:
2703
if self.server_address[1]:
2704
self.allow_reuse_address = True
2705
2048
if not self.server_address[0]:
2706
2049
if self.address_family == socket.AF_INET6:
2707
any_address = "::" # in6addr_any
2050
any_address = "::" # in6addr_any
2708
2051
else:
2709
any_address = "0.0.0.0" # INADDR_ANY
2052
any_address = "0.0.0.0" # INADDR_ANY
2710
2053
self.server_address = (any_address,
2711
2054
self.server_address[1])
2712
2055
elif not self.server_address[1]:
2722
2065
2723
2066
class MandosServer(IPv6_TCPServer):
2724
2067
"""Mandos server.
2725
2068
2726
2069
Attributes:
2727
2070
clients: set of Client objects
2728
2071
gnutls_priority GnuTLS priority string
2729
2072
use_dbus: Boolean; to emit D-Bus signals or not
2730
2731
Assumes a GLib.MainLoop event loop.
2073
2074
Assumes a gobject.MainLoop event loop.
2732
2075
"""
2733
2076
2734
2077
def __init__(self, server_address, RequestHandlerClass,
2735
2078
interface=None,
2736
2079
use_ipv6=True,
2746
2089
self.gnutls_priority = gnutls_priority
2747
2090
IPv6_TCPServer.__init__(self, server_address,
2748
2091
RequestHandlerClass,
2749
interface=interface,
2750
use_ipv6=use_ipv6,
2751
socketfd=socketfd)
2752
2092
interface = interface,
2093
use_ipv6 = use_ipv6,
2094
socketfd = socketfd)
2095
2753
2096
def server_activate(self):
2754
2097
if self.enabled:
2755
2098
return socketserver.TCPServer.server_activate(self)
2756
2099
2757
2100
def enable(self):
2758
2101
self.enabled = True
2759
2102
2760
2103
def add_pipe(self, parent_pipe, proc):
2761
2104
# Call "handle_ipc" for both data and EOF events
2762
GLib.io_add_watch(
2763
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2764
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2105
gobject.io_add_watch(
2106
parent_pipe.fileno(),
2107
gobject.IO_IN | gobject.IO_HUP,
2765
2108
functools.partial(self.handle_ipc,
2766
parent_pipe=parent_pipe,
2767
proc=proc))
2768
2109
parent_pipe = parent_pipe,
2110
proc = proc))
2111
2769
2112
def handle_ipc(self, source, condition,
2770
2113
parent_pipe=None,
2771
proc=None,
2114
proc = None,
2772
2115
client_object=None):
2773
2116
# error, or the other end of multiprocessing.Pipe has closed
2774
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2117
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2775
2118
# Wait for other process to exit
2776
2119
proc.join()
2777
2120
return False
2778
2121
2779
2122
# Read a request from the child
2780
2123
request = parent_pipe.recv()
2781
2124
command = request[0]
2782
2783
if command == "init":
2784
key_id = request[1].decode("ascii")
2785
fpr = request[2].decode("ascii")
2786
address = request[3]
2787
2788
for c in self.clients.values():
2789
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2790
"27AE41E4649B934CA495991B7852B855"):
2791
continue
2792
if key_id and c.key_id == key_id:
2793
client = c
2794
break
2795
if fpr and c.fingerprint == fpr:
2125
2126
if command == 'init':
2127
fpr = request[1]
2128
address = request[2]
2129
2130
for c in self.clients.itervalues():
2131
if c.fingerprint == fpr:
2796
2132
client = c
2797
2133
break
2798
2134
else:
2799
log.info("Client not found for key ID: %s, address:"
2800
" %s", key_id or fpr, address)
2135
logger.info("Client not found for fingerprint: %s, ad"
2136
"dress: %s", fpr, address)
2801
2137
if self.use_dbus:
2802
2138
# Emit D-Bus signal
2803
mandos_dbus_service.ClientNotFound(key_id or fpr,
2139
mandos_dbus_service.ClientNotFound(fpr,
2804
2140
address[0])
2805
2141
parent_pipe.send(False)
2806
2142
return False
2807
2808
GLib.io_add_watch(
2809
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2810
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2143
2144
gobject.io_add_watch(
2145
parent_pipe.fileno(),
2146
gobject.IO_IN | gobject.IO_HUP,
2811
2147
functools.partial(self.handle_ipc,
2812
parent_pipe=parent_pipe,
2813
proc=proc,
2814
client_object=client))
2148
parent_pipe = parent_pipe,
2149
proc = proc,
2150
client_object = client))
2815
2151
parent_pipe.send(True)
2816
2152
# remove the old hook in favor of the new above hook on
2817
2153
# same fileno
2818
2154
return False
2819
if command == "funcall":
2155
if command == 'funcall':
2820
2156
funcname = request[1]
2821
2157
args = request[2]
2822
2158
kwargs = request[3]
2823
2824
parent_pipe.send(("data", getattr(client_object,
2159
2160
parent_pipe.send(('data', getattr(client_object,
2825
2161
funcname)(*args,
2826
2162
**kwargs)))
2827
2828
if command == "getattr":
2163
2164
if command == 'getattr':
2829
2165
attrname = request[1]
2830
2166
if isinstance(client_object.__getattribute__(attrname),
2831
collections.abc.Callable):
2832
parent_pipe.send(("function", ))
2167
collections.Callable):
2168
parent_pipe.send(('function', ))
2833
2169
else:
2834
2170
parent_pipe.send((
2835
"data", client_object.__getattribute__(attrname)))
2836
2837
if command == "setattr":
2171
'data', client_object.__getattribute__(attrname)))
2172
2173
if command == 'setattr':
2838
2174
attrname = request[1]
2839
2175
value = request[2]
2840
2176
setattr(client_object, attrname, value)
2841
2177
2842
2178
return True
2843
2179
2844
2180
2845
2181
def rfc3339_duration_to_delta(duration):
2846
2182
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2847
2848
>>> timedelta = datetime.timedelta
2849
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2850
True
2851
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2852
True
2853
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2854
True
2855
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2856
True
2857
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2858
True
2859
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2860
True
2861
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2862
True
2863
>>> del timedelta
2183
2184
>>> rfc3339_duration_to_delta("P7D")
2185
datetime.timedelta(7)
2186
>>> rfc3339_duration_to_delta("PT60S")
2187
datetime.timedelta(0, 60)
2188
>>> rfc3339_duration_to_delta("PT60M")
2189
datetime.timedelta(0, 3600)
2190
>>> rfc3339_duration_to_delta("PT24H")
2191
datetime.timedelta(1)
2192
>>> rfc3339_duration_to_delta("P1W")
2193
datetime.timedelta(7)
2194
>>> rfc3339_duration_to_delta("PT5M30S")
2195
datetime.timedelta(0, 330)
2196
>>> rfc3339_duration_to_delta("P1DT3M20S")
2197
datetime.timedelta(1, 200)
2864
2198
"""
2865
2199
2866
2200
# Parsing an RFC 3339 duration with regular expressions is not
2867
2201
# possible - there would have to be multiple places for the same
2868
2202
# values, like seconds. The current code, while more esoteric, is
2869
2203
# cleaner without depending on a parsing library. If Python had a
2870
2204
# built-in library for parsing we would use it, but we'd like to
2871
2205
# avoid excessive use of external libraries.
2872
2206
2873
2207
# New type for defining tokens, syntax, and semantics all-in-one
2874
2208
Token = collections.namedtuple("Token", (
2875
2209
"regexp", # To match token; if "value" is not None, must have
2908
2242
frozenset((token_year, token_month,
2909
2243
token_day, token_time,
2910
2244
token_week)))
2911
# Define starting values:
2912
# Value so far
2913
value = datetime.timedelta()
2245
# Define starting values
2246
value = datetime.timedelta() # Value so far
2914
2247
found_token = None
2915
# Following valid tokens
2916
followers = frozenset((token_duration, ))
2917
# String left to parse
2918
s = duration
2248
followers = frozenset((token_duration, )) # Following valid tokens
2249
s = duration # String left to parse
2919
2250
# Loop until end token is found
2920
2251
while found_token is not token_end:
2921
2252
# Search for any currently valid tokens
2945
2276
2946
2277
def string_to_delta(interval):
2947
2278
"""Parse a string and return a datetime.timedelta
2948
2949
>>> string_to_delta("7d") == datetime.timedelta(7)
2950
True
2951
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2952
True
2953
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2954
True
2955
>>> string_to_delta("24h") == datetime.timedelta(1)
2956
True
2957
>>> string_to_delta("1w") == datetime.timedelta(7)
2958
True
2959
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2960
True
2279
2280
>>> string_to_delta('7d')
2281
datetime.timedelta(7)
2282
>>> string_to_delta('60s')
2283
datetime.timedelta(0, 60)
2284
>>> string_to_delta('60m')
2285
datetime.timedelta(0, 3600)
2286
>>> string_to_delta('24h')
2287
datetime.timedelta(1)
2288
>>> string_to_delta('1w')
2289
datetime.timedelta(7)
2290
>>> string_to_delta('5m 30s')
2291
datetime.timedelta(0, 330)
2961
2292
"""
2962
2293
2963
2294
try:
2964
2295
return rfc3339_duration_to_delta(interval)
2965
2296
except ValueError:
2966
2297
pass
2967
2298
2968
2299
timevalue = datetime.timedelta(0)
2969
2300
for s in interval.split():
2970
2301
try:
2988
2319
return timevalue
2989
2320
2990
2321
2991
def daemon(nochdir=False, noclose=False):
2322
def daemon(nochdir = False, noclose = False):
2992
2323
"""See daemon(3). Standard BSD Unix function.
2993
2324
2994
2325
This should really exist as os.daemon, but it doesn't (yet)."""
2995
2326
if os.fork():
2996
2327
sys.exit()
3014
2345
3015
2346
3016
2347
def main():
3017
2348
3018
2349
##################################################################
3019
2350
# Parsing of options, both command line and config file
3020
2351
3021
2352
parser = argparse.ArgumentParser()
3022
2353
parser.add_argument("-v", "--version", action="version",
3023
version="%(prog)s {}".format(version),
2354
version = "%(prog)s {}".format(version),
3024
2355
help="show version number and exit")
3025
2356
parser.add_argument("-i", "--interface", metavar="IF",
3026
2357
help="Bind to interface IF")
3062
2393
parser.add_argument("--no-zeroconf", action="store_false",
3063
2394
dest="zeroconf", help="Do not use Zeroconf",
3064
2395
default=None)
3065
2396
3066
2397
options = parser.parse_args()
3067
2398
2399
if options.check:
2400
import doctest
2401
fail_count, test_count = doctest.testmod()
2402
sys.exit(os.EX_OK if fail_count == 0 else 1)
2403
3068
2404
# Default values for config file for server-global settings
3069
if gnutls.has_rawpk:
3070
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3072
else:
3073
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3074
":+SIGN-DSA-SHA256")
3075
server_defaults = {"interface": "",
3076
"address": "",
3077
"port": "",
3078
"debug": "False",
3079
"priority": priority,
3080
"servicename": "Mandos",
3081
"use_dbus": "True",
3082
"use_ipv6": "True",
3083
"debuglevel": "",
3084
"restore": "True",
3085
"socket": "",
3086
"statedir": "/var/lib/mandos",
3087
"foreground": "False",
3088
"zeroconf": "True",
3089
}
3090
del priority
3091
2405
server_defaults = { "interface": "",
2406
"address": "",
2407
"port": "",
2408
"debug": "False",
2409
"priority":
2410
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2411
":+SIGN-DSA-SHA256",
2412
"servicename": "Mandos",
2413
"use_dbus": "True",
2414
"use_ipv6": "True",
2415
"debuglevel": "",
2416
"restore": "True",
2417
"socket": "",
2418
"statedir": "/var/lib/mandos",
2419
"foreground": "False",
2420
"zeroconf": "True",
2421
}
2422
3092
2423
# Parse config file for server-global settings
3093
server_config = configparser.ConfigParser(server_defaults)
2424
server_config = configparser.SafeConfigParser(server_defaults)
3094
2425
del server_defaults
3095
2426
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3096
# Convert the ConfigParser object to a dict
2427
# Convert the SafeConfigParser object to a dict
3097
2428
server_settings = server_config.defaults()
3098
2429
# Use the appropriate methods on the non-string config options
3099
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3100
"foreground", "zeroconf"):
2430
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3101
2431
server_settings[option] = server_config.getboolean("DEFAULT",
3102
2432
option)
3103
2433
if server_settings["port"]:
3109
2439
# Later, stdin will, and stdout and stderr might, be dup'ed
3110
2440
# over with an opened os.devnull. But we don't want this to
3111
2441
# happen with a supplied network socket.
3112
while 0 <= server_settings["socket"] <= 2:
2442
if 0 <= server_settings["socket"] <= 2:
3113
2443
server_settings["socket"] = os.dup(server_settings
3114
2444
["socket"])
3115
os.set_inheritable(server_settings["socket"], False)
3116
2445
del server_config
3117
2446
3118
2447
# Override the settings from the config file with command line
3119
2448
# options, if set.
3120
2449
for option in ("interface", "address", "port", "debug",
3138
2467
if server_settings["debug"]:
3139
2468
server_settings["foreground"] = True
3140
2469
# Now we have our good server settings in "server_settings"
3141
2470
3142
2471
##################################################################
3143
2472
3144
2473
if (not server_settings["zeroconf"]
3145
2474
and not (server_settings["port"]
3146
2475
or server_settings["socket"] != "")):
3147
2476
parser.error("Needs port or socket to work without Zeroconf")
3148
2477
3149
2478
# For convenience
3150
2479
debug = server_settings["debug"]
3151
2480
debuglevel = server_settings["debuglevel"]
3155
2484
stored_state_file)
3156
2485
foreground = server_settings["foreground"]
3157
2486
zeroconf = server_settings["zeroconf"]
3158
2487
3159
2488
if debug:
3160
2489
initlogger(debug, logging.DEBUG)
3161
2490
else:
3164
2493
else:
3165
2494
level = getattr(logging, debuglevel.upper())
3166
2495
initlogger(debug, level)
3167
2496
3168
2497
if server_settings["servicename"] != "Mandos":
3169
2498
syslogger.setFormatter(
3170
logging.Formatter("Mandos ({}) [%(process)d]:"
3171
" %(levelname)s: %(message)s".format(
2499
logging.Formatter('Mandos ({}) [%(process)d]:'
2500
' %(levelname)s: %(message)s'.format(
3172
2501
server_settings["servicename"])))
3173
2502
3174
2503
# Parse config file with clients
3175
client_config = configparser.ConfigParser(Client.client_defaults)
2504
client_config = configparser.SafeConfigParser(Client
2505
.client_defaults)
3176
2506
client_config.read(os.path.join(server_settings["configdir"],
3177
2507
"clients.conf"))
3178
2508
3179
2509
global mandos_dbus_service
3180
2510
mandos_dbus_service = None
3181
2511
3182
2512
socketfd = None
3183
2513
if server_settings["socket"] != "":
3184
2514
socketfd = server_settings["socket"]
3198
2528
try:
3199
2529
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3200
2530
except IOError as e:
3201
log.error("Could not open file %r", pidfilename,
3202
exc_info=e)
3203
3204
for name, group in (("_mandos", "_mandos"),
3205
("mandos", "mandos"),
3206
("nobody", "nogroup")):
2531
logger.error("Could not open file %r", pidfilename,
2532
exc_info=e)
2533
2534
for name in ("_mandos", "mandos", "nobody"):
3207
2535
try:
3208
2536
uid = pwd.getpwnam(name).pw_uid
3209
gid = pwd.getpwnam(group).pw_gid
2537
gid = pwd.getpwnam(name).pw_gid
3210
2538
break
3211
2539
except KeyError:
3212
2540
continue
3216
2544
try:
3217
2545
os.setgid(gid)
3218
2546
os.setuid(uid)
3219
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3220
2547
except OSError as error:
3221
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3222
os.strerror(error.errno))
3223
2548
if error.errno != errno.EPERM:
3224
2549
raise
3225
2550
3226
2551
if debug:
3227
2552
# Enable all possible GnuTLS debugging
3228
2553
3229
2554
# "Use a log level over 10 to enable all debugging options."
3230
2555
# - GnuTLS manual
3231
gnutls.global_set_log_level(11)
3232
3233
@gnutls.log_func
2556
gnutls.library.functions.gnutls_global_set_log_level(11)
2557
2558
@gnutls.library.types.gnutls_log_func
3234
2559
def debug_gnutls(level, string):
3235
log.debug("GnuTLS: %s",
3236
string[:-1].decode("utf-8", errors="replace"))
3237
3238
gnutls.global_set_log_function(debug_gnutls)
3239
2560
logger.debug("GnuTLS: %s", string[:-1])
2561
2562
gnutls.library.functions.gnutls_global_set_log_function(
2563
debug_gnutls)
2564
3240
2565
# Redirect stdin so all checkers get /dev/null
3241
2566
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3242
2567
os.dup2(null, sys.stdin.fileno())
3243
2568
if null > 2:
3244
2569
os.close(null)
3245
2570
3246
2571
# Need to fork before connecting to D-Bus
3247
2572
if not foreground:
3248
2573
# Close all input and output, do double fork, etc.
3249
2574
daemon()
3250
3251
if gi.version_info < (3, 10, 2):
3252
# multiprocessing will use threads, so before we use GLib we
3253
# need to inform GLib that threads will be used.
3254
GLib.threads_init()
3255
2575
2576
# multiprocessing will use threads, so before we use gobject we
2577
# need to inform gobject that threads will be used.
2578
gobject.threads_init()
2579
3256
2580
global main_loop
3257
2581
# From the Avahi example code
3258
2582
DBusGMainLoop(set_as_default=True)
3259
main_loop = GLib.MainLoop()
3260
if use_dbus or zeroconf:
3261
bus = dbus.SystemBus()
2583
main_loop = gobject.MainLoop()
2584
bus = dbus.SystemBus()
3262
2585
# End of Avahi example code
3263
2586
if use_dbus:
3264
2587
try:
3269
2592
"se.bsnet.fukt.Mandos", bus,
3270
2593
do_not_queue=True)
3271
2594
except dbus.exceptions.DBusException as e:
3272
log.error("Disabling D-Bus:", exc_info=e)
2595
logger.error("Disabling D-Bus:", exc_info=e)
3273
2596
use_dbus = False
3274
2597
server_settings["use_dbus"] = False
3275
2598
tcp_server.use_dbus = False
3276
2599
if zeroconf:
3277
2600
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3278
2601
service = AvahiServiceToSyslog(
3279
name=server_settings["servicename"],
3280
servicetype="_mandos._tcp",
3281
protocol=protocol,
3282
bus=bus)
2602
name = server_settings["servicename"],
2603
servicetype = "_mandos._tcp",
2604
protocol = protocol,
2605
bus = bus)
3283
2606
if server_settings["interface"]:
3284
2607
service.interface = if_nametoindex(
3285
2608
server_settings["interface"].encode("utf-8"))
3286
2609
3287
2610
global multiprocessing_manager
3288
2611
multiprocessing_manager = multiprocessing.Manager()
3289
2612
3290
2613
client_class = Client
3291
2614
if use_dbus:
3292
client_class = functools.partial(ClientDBus, bus=bus)
3293
2615
client_class = functools.partial(ClientDBus, bus = bus)
2616
3294
2617
client_settings = Client.config_parser(client_config)
3295
2618
old_client_settings = {}
3296
2619
clients_data = {}
3297
2620
3298
2621
# This is used to redirect stdout and stderr for checker processes
3299
2622
global wnull
3300
wnull = open(os.devnull, "w") # A writable /dev/null
2623
wnull = open(os.devnull, "w") # A writable /dev/null
3301
2624
# Only used if server is running in foreground but not in debug
3302
2625
# mode
3303
2626
if debug or not foreground:
3304
2627
wnull.close()
3305
2628
3306
2629
# Get client data and settings from last running state.
3307
2630
if server_settings["restore"]:
3308
2631
try:
3309
2632
with open(stored_state_path, "rb") as stored_state:
3310
if sys.version_info.major == 2:
3311
clients_data, old_client_settings = pickle.load(
3312
stored_state)
3313
else:
3314
bytes_clients_data, bytes_old_client_settings = (
3315
pickle.load(stored_state, encoding="bytes"))
3316
# Fix bytes to strings
3317
# clients_data
3318
# .keys()
3319
clients_data = {(key.decode("utf-8")
3320
if isinstance(key, bytes)
3321
else key): value
3322
for key, value in
3323
bytes_clients_data.items()}
3324
del bytes_clients_data
3325
for key in clients_data:
3326
value = {(k.decode("utf-8")
3327
if isinstance(k, bytes) else k): v
3328
for k, v in
3329
clients_data[key].items()}
3330
clients_data[key] = value
3331
# .client_structure
3332
value["client_structure"] = [
3333
(s.decode("utf-8")
3334
if isinstance(s, bytes)
3335
else s) for s in
3336
value["client_structure"]]
3337
# .name, .host, and .checker_command
3338
for k in ("name", "host", "checker_command"):
3339
if isinstance(value[k], bytes):
3340
value[k] = value[k].decode("utf-8")
3341
if "key_id" not in value:
3342
value["key_id"] = ""
3343
elif "fingerprint" not in value:
3344
value["fingerprint"] = ""
3345
# old_client_settings
3346
# .keys()
3347
old_client_settings = {
3348
(key.decode("utf-8")
3349
if isinstance(key, bytes)
3350
else key): value
3351
for key, value in
3352
bytes_old_client_settings.items()}
3353
del bytes_old_client_settings
3354
# .host and .checker_command
3355
for value in old_client_settings.values():
3356
for attribute in ("host", "checker_command"):
3357
if isinstance(value[attribute], bytes):
3358
value[attribute] = (value[attribute]
3359
.decode("utf-8"))
2633
clients_data, old_client_settings = pickle.load(
2634
stored_state)
3360
2635
os.remove(stored_state_path)
3361
2636
except IOError as e:
3362
2637
if e.errno == errno.ENOENT:
3363
log.warning("Could not load persistent state:"
3364
" %s", os.strerror(e.errno))
2638
logger.warning("Could not load persistent state:"
2639
" {}".format(os.strerror(e.errno)))
3365
2640
else:
3366
log.critical("Could not load persistent state:",
3367
exc_info=e)
2641
logger.critical("Could not load persistent state:",
2642
exc_info=e)
3368
2643
raise
3369
2644
except EOFError as e:
3370
log.warning("Could not load persistent state: EOFError:",
3371
exc_info=e)
3372
2645
logger.warning("Could not load persistent state: "
2646
"EOFError:",
2647
exc_info=e)
2648
3373
2649
with PGPEngine() as pgp:
3374
2650
for client_name, client in clients_data.items():
3375
2651
# Skip removed clients
3376
2652
if client_name not in client_settings:
3377
2653
continue
3378
2654
3379
2655
# Decide which value to use after restoring saved state.
3380
2656
# We have three different values: Old config file,
3381
2657
# new config file, and saved state.
3392
2668
client[name] = value
3393
2669
except KeyError:
3394
2670
pass
3395
2671
3396
2672
# Clients who has passed its expire date can still be
3397
2673
# enabled if its last checker was successful. A Client
3398
2674
# whose checker succeeded before we stored its state is
3401
2677
if client["enabled"]:
3402
2678
if datetime.datetime.utcnow() >= client["expires"]:
3403
2679
if not client["last_checked_ok"]:
3404
log.warning("disabling client %s - Client"
3405
" never performed a successful"
3406
" checker", client_name)
2680
logger.warning(
2681
"disabling client {} - Client never "
2682
"performed a successful checker".format(
2683
client_name))
3407
2684
client["enabled"] = False
3408
2685
elif client["last_checker_status"] != 0:
3409
log.warning("disabling client %s - Client"
3410
" last checker failed with error"
3411
" code %s", client_name,
3412
client["last_checker_status"])
2686
logger.warning(
2687
"disabling client {} - Client last"
2688
" checker failed with error code"
2689
" {}".format(
2690
client_name,
2691
client["last_checker_status"]))
3413
2692
client["enabled"] = False
3414
2693
else:
3415
2694
client["expires"] = (
3416
2695
datetime.datetime.utcnow()
3417
2696
+ client["timeout"])
3418
log.debug("Last checker succeeded, keeping %s"
3419
" enabled", client_name)
2697
logger.debug("Last checker succeeded,"
2698
" keeping {} enabled".format(
2699
client_name))
3420
2700
try:
3421
2701
client["secret"] = pgp.decrypt(
3422
2702
client["encrypted_secret"],
3423
2703
client_settings[client_name]["secret"])
3424
2704
except PGPError:
3425
2705
# If decryption fails, we use secret from new settings
3426
log.debug("Failed to decrypt %s old secret",
3427
client_name)
2706
logger.debug("Failed to decrypt {} old secret".format(
2707
client_name))
3428
2708
client["secret"] = (client_settings[client_name]
3429
2709
["secret"])
3430
2710
3431
2711
# Add/remove clients based on new changes made to config
3432
2712
for client_name in (set(old_client_settings)
3433
2713
- set(client_settings)):
3435
2715
for client_name in (set(client_settings)
3436
2716
- set(old_client_settings)):
3437
2717
clients_data[client_name] = client_settings[client_name]
3438
2718
3439
2719
# Create all client objects
3440
2720
for client_name, client in clients_data.items():
3441
2721
tcp_server.clients[client_name] = client_class(
3442
name=client_name,
3443
settings=client,
3444
server_settings=server_settings)
3445
2722
name = client_name,
2723
settings = client,
2724
server_settings = server_settings)
2725
3446
2726
if not tcp_server.clients:
3447
log.warning("No clients defined")
3448
2727
logger.warning("No clients defined")
2728
3449
2729
if not foreground:
3450
2730
if pidfile is not None:
3451
2731
pid = os.getpid()
3453
2733
with pidfile:
3454
2734
print(pid, file=pidfile)
3455
2735
except IOError:
3456
log.error("Could not write to file %r with PID %d",
3457
pidfilename, pid)
2736
logger.error("Could not write to file %r with PID %d",
2737
pidfilename, pid)
3458
2738
del pidfile
3459
2739
del pidfilename
3460
3461
for termsig in (signal.SIGHUP, signal.SIGTERM):
3462
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3463
lambda: main_loop.quit() and False)
3464
2740
2741
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2742
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2743
3465
2744
if use_dbus:
3466
2745
3467
2746
@alternate_dbus_interfaces(
3468
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3469
class MandosDBusService(DBusObjectWithObjectManager):
2747
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2748
class MandosDBusService(DBusObjectWithProperties):
3470
2749
"""A D-Bus proxy object"""
3471
2750
3472
2751
def __init__(self):
3473
2752
dbus.service.Object.__init__(self, bus, "/")
3474
2753
3475
2754
_interface = "se.recompile.Mandos"
3476
2755
2756
@dbus_interface_annotations(_interface)
2757
def _foo(self):
2758
return {
2759
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2760
"false" }
2761
3477
2762
@dbus.service.signal(_interface, signature="o")
3478
2763
def ClientAdded(self, objpath):
3479
2764
"D-Bus signal"
3480
2765
pass
3481
2766
3482
2767
@dbus.service.signal(_interface, signature="ss")
3483
def ClientNotFound(self, key_id, address):
2768
def ClientNotFound(self, fingerprint, address):
3484
2769
"D-Bus signal"
3485
2770
pass
3486
3487
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3488
"true"})
2771
3489
2772
@dbus.service.signal(_interface, signature="os")
3490
2773
def ClientRemoved(self, objpath, name):
3491
2774
"D-Bus signal"
3492
2775
pass
3493
3494
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3495
"true"})
2776
3496
2777
@dbus.service.method(_interface, out_signature="ao")
3497
2778
def GetAllClients(self):
3498
2779
"D-Bus method"
3499
2780
return dbus.Array(c.dbus_object_path for c in
3500
tcp_server.clients.values())
3501
3502
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3503
"true"})
2781
tcp_server.clients.itervalues())
2782
3504
2783
@dbus.service.method(_interface,
3505
2784
out_signature="a{oa{sv}}")
3506
2785
def GetAllClientsWithProperties(self):
3507
2786
"D-Bus method"
3508
2787
return dbus.Dictionary(
3509
{c.dbus_object_path: c.GetAll(
3510
"se.recompile.Mandos.Client")
3511
for c in tcp_server.clients.values()},
2788
{ c.dbus_object_path: c.GetAll("")
2789
for c in tcp_server.clients.itervalues() },
3512
2790
signature="oa{sv}")
3513
2791
3514
2792
@dbus.service.method(_interface, in_signature="o")
3515
2793
def RemoveClient(self, object_path):
3516
2794
"D-Bus method"
3517
for c in tcp_server.clients.values():
2795
for c in tcp_server.clients.itervalues():
3518
2796
if c.dbus_object_path == object_path:
3519
2797
del tcp_server.clients[c.name]
3520
2798
c.remove_from_connection()
3521
# Don't signal the disabling
2799
# Don't signal anything except ClientRemoved
3522
2800
c.disable(quiet=True)
3523
# Emit D-Bus signal for removal
3524
self.client_removed_signal(c)
2801
# Emit D-Bus signal
2802
self.ClientRemoved(object_path, c.name)
3525
2803
return
3526
2804
raise KeyError(object_path)
3527
2805
3528
2806
del _interface
3529
3530
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3531
out_signature="a{oa{sa{sv}}}")
3532
def GetManagedObjects(self):
3533
"""D-Bus method"""
3534
return dbus.Dictionary(
3535
{client.dbus_object_path:
3536
dbus.Dictionary(
3537
{interface: client.GetAll(interface)
3538
for interface in
3539
client._get_all_interface_names()})
3540
for client in tcp_server.clients.values()})
3541
3542
def client_added_signal(self, client):
3543
"""Send the new standard signal and the old signal"""
3544
if use_dbus:
3545
# New standard signal
3546
self.InterfacesAdded(
3547
client.dbus_object_path,
3548
dbus.Dictionary(
3549
{interface: client.GetAll(interface)
3550
for interface in
3551
client._get_all_interface_names()}))
3552
# Old signal
3553
self.ClientAdded(client.dbus_object_path)
3554
3555
def client_removed_signal(self, client):
3556
"""Send the new standard signal and the old signal"""
3557
if use_dbus:
3558
# New standard signal
3559
self.InterfacesRemoved(
3560
client.dbus_object_path,
3561
client._get_all_interface_names())
3562
# Old signal
3563
self.ClientRemoved(client.dbus_object_path,
3564
client.name)
3565
2807
3566
2808
mandos_dbus_service = MandosDBusService()
3567
3568
# Save modules to variables to exempt the modules from being
3569
# unloaded before the function registered with atexit() is run.
3570
mp = multiprocessing
3571
wn = wnull
3572
2809
3573
2810
def cleanup():
3574
2811
"Cleanup function; run on exit"
3575
2812
if zeroconf:
3576
2813
service.cleanup()
3577
3578
mp.active_children()
3579
wn.close()
2814
2815
multiprocessing.active_children()
2816
wnull.close()
3580
2817
if not (tcp_server.clients or client_settings):
3581
2818
return
3582
2819
3583
2820
# Store client before exiting. Secrets are encrypted with key
3584
2821
# based on what config file has. If config file is
3585
2822
# removed/edited, old secret will thus be unrecovable.
3586
2823
clients = {}
3587
2824
with PGPEngine() as pgp:
3588
for client in tcp_server.clients.values():
2825
for client in tcp_server.clients.itervalues():
3589
2826
key = client_settings[client.name]["secret"]
3590
2827
client.encrypted_secret = pgp.encrypt(client.secret,
3591
2828
key)
3592
2829
client_dict = {}
3593
2830
3594
2831
# A list of attributes that can not be pickled
3595
2832
# + secret.
3596
exclude = {"bus", "changedstate", "secret",
3597
"checker", "server_settings"}
2833
exclude = { "bus", "changedstate", "secret",
2834
"checker", "server_settings" }
3598
2835
for name, typ in inspect.getmembers(dbus.service
3599
2836
.Object):
3600
2837
exclude.add(name)
3601
2838
3602
2839
client_dict["encrypted_secret"] = (client
3603
2840
.encrypted_secret)
3604
2841
for attr in client.client_structure:
3605
2842
if attr not in exclude:
3606
2843
client_dict[attr] = getattr(client, attr)
3607
2844
3608
2845
clients[client.name] = client_dict
3609
2846
del client_settings[client.name]["secret"]
3610
2847
3611
2848
try:
3612
2849
with tempfile.NamedTemporaryFile(
3613
mode="wb",
2850
mode='wb',
3614
2851
suffix=".pickle",
3615
prefix="clients-",
2852
prefix='clients-',
3616
2853
dir=os.path.dirname(stored_state_path),
3617
2854
delete=False) as stored_state:
3618
pickle.dump((clients, client_settings), stored_state,
3619
protocol=2)
2855
pickle.dump((clients, client_settings), stored_state)
3620
2856
tempname = stored_state.name
3621
2857
os.rename(tempname, stored_state_path)
3622
2858
except (IOError, OSError) as e:
3626
2862
except NameError:
3627
2863
pass
3628
2864
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3629
log.warning("Could not save persistent state: %s",
3630
os.strerror(e.errno))
2865
logger.warning("Could not save persistent state: {}"
2866
.format(os.strerror(e.errno)))
3631
2867
else:
3632
log.warning("Could not save persistent state:",
3633
exc_info=e)
2868
logger.warning("Could not save persistent state:",
2869
exc_info=e)
3634
2870
raise
3635
2871
3636
2872
# Delete all clients, and settings from config
3637
2873
while tcp_server.clients:
3638
2874
name, client = tcp_server.clients.popitem()
3639
2875
if use_dbus:
3640
2876
client.remove_from_connection()
3641
# Don't signal the disabling
2877
# Don't signal anything except ClientRemoved
3642
2878
client.disable(quiet=True)
3643
# Emit D-Bus signal for removal
3644
2879
if use_dbus:
3645
mandos_dbus_service.client_removed_signal(client)
2880
# Emit D-Bus signal
2881
mandos_dbus_service.ClientRemoved(
2882
client.dbus_object_path, client.name)
3646
2883
client_settings.clear()
3647
2884
3648
2885
atexit.register(cleanup)
3649
3650
for client in tcp_server.clients.values():
2886
2887
for client in tcp_server.clients.itervalues():
3651
2888
if use_dbus:
3652
# Emit D-Bus signal for adding
3653
mandos_dbus_service.client_added_signal(client)
2889
# Emit D-Bus signal
2890
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3654
2891
# Need to initiate checking of clients
3655
2892
if client.enabled:
3656
client.init_checker(randomize_start=True)
3657
2893
client.init_checker()
2894
3658
2895
tcp_server.enable()
3659
2896
tcp_server.server_activate()
3660
2897
3661
2898
# Find out what port we got
3662
2899
if zeroconf:
3663
2900
service.port = tcp_server.socket.getsockname()[1]
3664
2901
if use_ipv6:
3665
log.info("Now listening on address %r, port %d, flowinfo %d,"
3666
" scope_id %d", *tcp_server.socket.getsockname())
2902
logger.info("Now listening on address %r, port %d,"
2903
" flowinfo %d, scope_id %d",
2904
*tcp_server.socket.getsockname())
3667
2905
else: # IPv4
3668
log.info("Now listening on address %r, port %d",
3669
*tcp_server.socket.getsockname())
3670
3671
# service.interface = tcp_server.socket.getsockname()[3]
3672
2906
logger.info("Now listening on address %r, port %d",
2907
*tcp_server.socket.getsockname())
2908
2909
#service.interface = tcp_server.socket.getsockname()[3]
2910
3673
2911
try:
3674
2912
if zeroconf:
3675
2913
# From the Avahi example code
3676
2914
try:
3677
2915
service.activate()
3678
2916
except dbus.exceptions.DBusException as error:
3679
log.critical("D-Bus Exception", exc_info=error)
2917
logger.critical("D-Bus Exception", exc_info=error)
3680
2918
cleanup()
3681
2919
sys.exit(1)
3682
2920
# End of Avahi example code
3683
3684
GLib.io_add_watch(
3685
GLib.IOChannel.unix_new(tcp_server.fileno()),
3686
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3687
lambda *args, **kwargs: (tcp_server.handle_request
3688
(*args[2:], **kwargs) or True))
3689
3690
log.debug("Starting main loop")
2921
2922
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2923
lambda *args, **kwargs:
2924
(tcp_server.handle_request
2925
(*args[2:], **kwargs) or True))
2926
2927
logger.debug("Starting main loop")
3691
2928
main_loop.run()
3692
2929
except AvahiError as error:
3693
log.critical("Avahi Error", exc_info=error)
2930
logger.critical("Avahi Error", exc_info=error)
3694
2931
cleanup()
3695
2932
sys.exit(1)
3696
2933
except KeyboardInterrupt:
3697
2934
if debug:
3698
2935
print("", file=sys.stderr)
3699
log.debug("Server received KeyboardInterrupt")
3700
log.debug("Server exiting")
2936
logger.debug("Server received KeyboardInterrupt")
2937
logger.debug("Server exiting")
3701
2938
# Must run before the D-Bus bus name gets deregistered
3702
2939
cleanup()
3703
2940
3704
3705
def parse_test_args():
3706
# type: () -> argparse.Namespace
3707
parser = argparse.ArgumentParser(add_help=False)
3708
parser.add_argument("--check", action="store_true")
3709
parser.add_argument("--prefix", )
3710
args, unknown_args = parser.parse_known_args()
3711
if args.check:
3712
# Remove test options from sys.argv
3713
sys.argv[1:] = unknown_args
3714
return args
3715
3716
# Add all tests from doctest strings
3717
def load_tests(loader, tests, none):
3718
import doctest
3719
tests.addTests(doctest.DocTestSuite())
3720
return tests
3721
3722
if __name__ == "__main__":
3723
options = parse_test_args()
3724
try:
3725
if options.check:
3726
extra_test_prefix = options.prefix
3727
if extra_test_prefix is not None:
3728
if not (unittest.main(argv=[""], exit=False)
3729
.result.wasSuccessful()):
3730
sys.exit(1)
3731
class ExtraTestLoader(unittest.TestLoader):
3732
testMethodPrefix = extra_test_prefix
3733
# Call using ./scriptname --test [--verbose]
3734
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3735
else:
3736
unittest.main(argv=[""])
3737
else:
3738
main()
3739
finally:
3740
logging.shutdown()
3741
3742
# Local Variables:
3743
# run-tests:
3744
# (lambda (&optional extra)
3745
# (if (not (funcall run-tests-in-test-buffer default-directory
3746
# extra))
3747
# (funcall show-test-buffer-in-test-window)
3748
# (funcall remove-test-window)
3749
# (if extra (message "Extra tests run successfully!"))))
3750
# run-tests-in-test-buffer:
3751
# (lambda (dir &optional extra)
3752
# (with-current-buffer (get-buffer-create "*Test*")
3753
# (setq buffer-read-only nil
3754
# default-directory dir)
3755
# (erase-buffer)
3756
# (compilation-mode))
3757
# (let ((process-result
3758
# (let ((inhibit-read-only t))
3759
# (process-file-shell-command
3760
# (funcall get-command-line extra) nil "*Test*"))))
3761
# (and (numberp process-result)
3762
# (= process-result 0))))
3763
# get-command-line:
3764
# (lambda (&optional extra)
3765
# (let ((quoted-script
3766
# (shell-quote-argument (funcall get-script-name))))
3767
# (format
3768
# (concat "%s --check" (if extra " --prefix=atest" ""))
3769
# quoted-script)))
3770
# get-script-name:
3771
# (lambda ()
3772
# (if (fboundp 'file-local-name)
3773
# (file-local-name (buffer-file-name))
3774
# (or (file-remote-p (buffer-file-name) 'localname)
3775
# (buffer-file-name))))
3776
# remove-test-window:
3777
# (lambda ()
3778
# (let ((test-window (get-buffer-window "*Test*")))
3779
# (if test-window (delete-window test-window))))
3780
# show-test-buffer-in-test-window:
3781
# (lambda ()
3782
# (when (not (get-buffer-window-list "*Test*"))
3783
# (setq next-error-last-buffer (get-buffer "*Test*"))
3784
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3785
# (display-buffer-overriding-action
3786
# `((display-buffer-in-side-window) (side . ,side)
3787
# (window-height . fit-window-to-buffer)
3788
# (window-width . fit-window-to-buffer))))
3789
# (display-buffer "*Test*"))))
3790
# eval:
3791
# (progn
3792
# (let* ((run-extra-tests (lambda () (interactive)
3793
# (funcall run-tests t)))
3794
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3795
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3796
# (setq minor-mode-overriding-map-alist
3797
# (cons `(run-tests . ,outer-keymap)
3798
# minor-mode-overriding-map-alist)))
3799
# (add-hook 'after-save-hook run-tests 90 t))
3800
# End:
2941
2942
if __name__ == '__main__':
2943
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0