To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 815
- compare with another revision
- download diff
- download tarball
- view history from revision 815
- Committer: Teddy Hogeborn
- Date: 2016-03-02 16:45:38 UTC
- Revision ID: teddy@recompile.se-20160302164538-n9ocll4izthzw1ov
Ignore any error from initramfs-tools' "configure_networking".
* initramfs-tools-script: Wrap call to "configure_networking" with
"set +e" and "set -e", since configure_networking was not designed
to run in a "set -e" environment.
Closes: 816513
Thanks: Carlos Alberto Lopez Perez <clopez@igalia.com>
Thanks: Ben Hutchings <ben@decadent.org.uk>
* initramfs-tools-script: Wrap call to "configure_networking" with
"set +e" and "set -e", since configure_networking was not designed
to run in a "set -e" environment.
Closes: 816513
Thanks: Carlos Alberto Lopez Perez <clopez@igalia.com>
Thanks: Ben Hutchings <ben@decadent.org.uk>
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -b
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
77
73
import itertools
78
74
import collections
79
75
import codecs
80
import unittest
81
76
82
77
import dbus
83
78
import dbus.service
84
import gi
85
from gi.repository import GLib
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
86
84
from dbus.mainloop.glib import DBusGMainLoop
87
85
import ctypes
88
86
import ctypes.util
89
87
import xml.dom.minidom
90
88
import inspect
91
89
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
95
# Show warnings by default
96
if not sys.warnoptions:
97
import warnings
98
warnings.simplefilter("default")
99
100
# Try to find the value of SO_BINDTODEVICE:
101
90
try:
102
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
103
# newer, and it is also the most natural place for it:
104
91
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
105
92
except AttributeError:
106
93
try:
107
# This is where SO_BINDTODEVICE was up to and including Python
108
# 2.6, and also 3.2:
109
94
from IN import SO_BINDTODEVICE
110
95
except ImportError:
111
# In Python 2.7 it seems to have been removed entirely.
112
# Try running the C preprocessor:
113
try:
114
cc = subprocess.Popen(["cc", "--language=c", "-E",
115
"/dev/stdin"],
116
stdin=subprocess.PIPE,
117
stdout=subprocess.PIPE)
118
stdout = cc.communicate(
119
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
120
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
121
except (OSError, ValueError, IndexError):
122
# No value found
123
SO_BINDTODEVICE = None
96
SO_BINDTODEVICE = None
124
97
125
98
if sys.version_info.major == 2:
126
99
str = unicode
127
100
128
if sys.version_info < (3, 2):
129
configparser.Configparser = configparser.SafeConfigParser
130
131
version = "1.8.9"
101
version = "1.7.3"
132
102
stored_state_file = "clients.pickle"
133
103
134
104
logger = logging.getLogger()
135
logging.captureWarnings(True) # Show warnings via the logging system
136
105
syslogger = None
137
106
138
107
try:
139
108
if_nametoindex = ctypes.cdll.LoadLibrary(
140
109
ctypes.util.find_library("c")).if_nametoindex
141
110
except (OSError, AttributeError):
142
111
143
112
def if_nametoindex(interface):
144
113
"Get an interface index the hard way, i.e. using fcntl()"
145
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
150
119
return interface_index
151
120
152
121
153
def copy_function(func):
154
"""Make a copy of a function"""
155
if sys.version_info.major == 2:
156
return types.FunctionType(func.func_code,
157
func.func_globals,
158
func.func_name,
159
func.func_defaults,
160
func.func_closure)
161
else:
162
return types.FunctionType(func.__code__,
163
func.__globals__,
164
func.__name__,
165
func.__defaults__,
166
func.__closure__)
167
168
169
122
def initlogger(debug, level=logging.WARNING):
170
123
"""init logger and add loglevel"""
171
124
172
125
global syslogger
173
126
syslogger = (logging.handlers.SysLogHandler(
174
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
address="/dev/log"))
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
176
129
syslogger.setFormatter(logging.Formatter
177
130
('Mandos [%(process)d]: %(levelname)s:'
178
131
' %(message)s'))
179
132
logger.addHandler(syslogger)
180
133
181
134
if debug:
182
135
console = logging.StreamHandler()
183
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
193
146
pass
194
147
195
148
196
class PGPEngine:
149
class PGPEngine(object):
197
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
198
151
199
152
def __init__(self):
200
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
201
154
self.gpg = "gpg"
202
155
try:
203
156
output = subprocess.check_output(["gpgconf"])
204
157
for line in output.splitlines():
205
name, text, path = line.split(b":")
206
if name == b"gpg":
158
name, text, path = line.split(":")
159
if name == "gpg":
207
160
self.gpg = path
208
161
break
209
162
except OSError as e:
212
165
self.gnupgargs = ['--batch',
213
166
'--homedir', self.tempdir,
214
167
'--force-mdc',
215
'--quiet']
216
# Only GPG version 1 has the --no-use-agent option.
217
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
218
self.gnupgargs.append("--no-use-agent")
219
168
'--quiet',
169
'--no-use-agent']
170
220
171
def __enter__(self):
221
172
return self
222
173
223
174
def __exit__(self, exc_type, exc_value, traceback):
224
175
self._cleanup()
225
176
return False
226
177
227
178
def __del__(self):
228
179
self._cleanup()
229
180
230
181
def _cleanup(self):
231
182
if self.tempdir is not None:
232
183
# Delete contents of tempdir
233
184
for root, dirs, files in os.walk(self.tempdir,
234
topdown=False):
185
topdown = False):
235
186
for filename in files:
236
187
os.remove(os.path.join(root, filename))
237
188
for dirname in dirs:
239
190
# Remove tempdir
240
191
os.rmdir(self.tempdir)
241
192
self.tempdir = None
242
193
243
194
def password_encode(self, password):
244
195
# Passphrase can not be empty and can not contain newlines or
245
196
# NUL bytes. So we prefix it and hex encode it.
250
201
.replace(b"\n", b"\\n")
251
202
.replace(b"\0", b"\\x00"))
252
203
return encoded
253
204
254
205
def encrypt(self, data, password):
255
206
passphrase = self.password_encode(password)
256
207
with tempfile.NamedTemporaryFile(
261
212
'--passphrase-file',
262
213
passfile.name]
263
214
+ self.gnupgargs,
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
268
219
if proc.returncode != 0:
269
220
raise PGPError(err)
270
221
return ciphertext
271
222
272
223
def decrypt(self, data, password):
273
224
passphrase = self.password_encode(password)
274
225
with tempfile.NamedTemporaryFile(
275
dir=self.tempdir) as passfile:
226
dir = self.tempdir) as passfile:
276
227
passfile.write(passphrase)
277
228
passfile.flush()
278
229
proc = subprocess.Popen([self.gpg, '--decrypt',
279
230
'--passphrase-file',
280
231
passfile.name]
281
232
+ self.gnupgargs,
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
286
237
if proc.returncode != 0:
287
238
raise PGPError(err)
288
239
return decrypted_plaintext
289
240
290
241
291
# Pretend that we have an Avahi module
292
class avahi:
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
298
DBUS_NAME = "org.freedesktop.Avahi"
299
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
DBUS_PATH_SERVER = "/"
302
303
@staticmethod
304
def string_array_to_txt_array(t):
305
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
for s in t), signature="ay")
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
315
316
317
242
class AvahiError(Exception):
318
243
def __init__(self, value, *args, **kwargs):
319
244
self.value = value
329
254
pass
330
255
331
256
332
class AvahiService:
257
class AvahiService(object):
333
258
"""An Avahi (Zeroconf) service.
334
259
335
260
Attributes:
336
261
interface: integer; avahi.IF_UNSPEC or an interface index.
337
262
Used to optionally bind to the specified interface.
349
274
server: D-Bus Server
350
275
bus: dbus.SystemBus()
351
276
"""
352
277
353
278
def __init__(self,
354
interface=avahi.IF_UNSPEC,
355
name=None,
356
servicetype=None,
357
port=None,
358
TXT=None,
359
domain="",
360
host="",
361
max_renames=32768,
362
protocol=avahi.PROTO_UNSPEC,
363
bus=None):
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
364
289
self.interface = interface
365
290
self.name = name
366
291
self.type = servicetype
375
300
self.server = None
376
301
self.bus = bus
377
302
self.entry_group_state_changed_match = None
378
303
379
304
def rename(self, remove=True):
380
305
"""Derived from the Avahi example code"""
381
306
if self.rename_count >= self.max_renames:
401
326
logger.critical("D-Bus Exception", exc_info=error)
402
327
self.cleanup()
403
328
os._exit(1)
404
329
405
330
def remove(self):
406
331
"""Derived from the Avahi example code"""
407
332
if self.entry_group_state_changed_match is not None:
409
334
self.entry_group_state_changed_match = None
410
335
if self.group is not None:
411
336
self.group.Reset()
412
337
413
338
def add(self):
414
339
"""Derived from the Avahi example code"""
415
340
self.remove()
432
357
dbus.UInt16(self.port),
433
358
avahi.string_array_to_txt_array(self.TXT))
434
359
self.group.Commit()
435
360
436
361
def entry_group_state_changed(self, state, error):
437
362
"""Derived from the Avahi example code"""
438
363
logger.debug("Avahi entry group state change: %i", state)
439
364
440
365
if state == avahi.ENTRY_GROUP_ESTABLISHED:
441
366
logger.debug("Zeroconf service established.")
442
367
elif state == avahi.ENTRY_GROUP_COLLISION:
446
371
logger.critical("Avahi: Error in group state changed %s",
447
372
str(error))
448
373
raise AvahiGroupError("State changed: {!s}".format(error))
449
374
450
375
def cleanup(self):
451
376
"""Derived from the Avahi example code"""
452
377
if self.group is not None:
457
382
pass
458
383
self.group = None
459
384
self.remove()
460
385
461
386
def server_state_changed(self, state, error=None):
462
387
"""Derived from the Avahi example code"""
463
388
logger.debug("Avahi server state change: %i", state)
492
417
logger.debug("Unknown state: %r", state)
493
418
else:
494
419
logger.debug("Unknown state: %r: %r", state, error)
495
420
496
421
def activate(self):
497
422
"""Derived from the Avahi example code"""
498
423
if self.server is None:
509
434
class AvahiServiceToSyslog(AvahiService):
510
435
def rename(self, *args, **kwargs):
511
436
"""Add the new name to the syslog messages"""
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
437
ret = AvahiService.rename(self, *args, **kwargs)
513
438
syslogger.setFormatter(logging.Formatter(
514
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
515
440
.format(self.name)))
516
441
return ret
517
442
518
519
443
# Pretend that we have a GnuTLS module
520
class gnutls:
521
"""This isn't so much a class as it is a module-like namespace."""
522
523
library = ctypes.util.find_library("gnutls")
524
if library is None:
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
527
del library
528
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
529
459
# Unless otherwise indicated, the constants and types below are
530
460
# all from the gnutls/gnutls.h C header file.
531
461
532
462
# Constants
533
463
E_SUCCESS = 0
534
464
E_INTERRUPTED = -52
535
465
E_AGAIN = -28
536
466
CRT_OPENPGP = 2
537
CRT_RAWPK = 3
538
467
CLIENT = 2
539
468
SHUT_RDWR = 0
540
469
CRD_CERTIFICATE = 1
541
470
E_NO_CERTIFICATE_FOUND = -49
542
X509_FMT_DER = 0
543
NO_TICKETS = 1<<10
544
ENABLE_RAWPK = 1<<18
545
CTYPE_PEERS = 3
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
547
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
472
549
473
# Types
550
474
class session_int(ctypes.Structure):
551
475
_fields_ = []
552
476
session_t = ctypes.POINTER(session_int)
553
554
477
class certificate_credentials_st(ctypes.Structure):
555
478
_fields_ = []
556
479
certificate_credentials_t = ctypes.POINTER(
557
480
certificate_credentials_st)
558
481
certificate_type_t = ctypes.c_int
559
560
482
class datum_t(ctypes.Structure):
561
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
484
('size', ctypes.c_uint)]
563
564
485
class openpgp_crt_int(ctypes.Structure):
565
486
_fields_ = []
566
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
568
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
569
credentials_type_t = ctypes.c_int
490
credentials_type_t = ctypes.c_int #
570
491
transport_ptr_t = ctypes.c_void_p
571
492
close_request_t = ctypes.c_int
572
493
573
494
# Exceptions
574
495
class Error(Exception):
575
def __init__(self, message=None, code=None, args=()):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
576
501
# Default usage is by a message string, but if a return
577
502
# code is passed, convert it to a string with
578
503
# gnutls.strerror()
579
504
self.code = code
580
505
if message is None and code is not None:
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
583
508
message, *args)
584
509
585
510
class CertificateSecurityError(Error):
586
511
pass
587
512
588
513
# Classes
589
class Credentials:
514
class Credentials(object):
590
515
def __init__(self):
591
516
self._c_object = gnutls.certificate_credentials_t()
592
517
gnutls.certificate_allocate_credentials(
593
518
ctypes.byref(self._c_object))
594
519
self.type = gnutls.CRD_CERTIFICATE
595
520
596
521
def __del__(self):
597
522
gnutls.certificate_free_credentials(self._c_object)
598
599
class ClientSession:
600
def __init__(self, socket, credentials=None):
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
601
526
self._c_object = gnutls.session_t()
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
605
if gnutls.has_rawpk:
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
608
del gnutls_flags
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
609
528
gnutls.set_default_priority(self._c_object)
610
529
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
530
gnutls.handshake_set_private_extensions(self._c_object,
617
536
ctypes.cast(credentials._c_object,
618
537
ctypes.c_void_p))
619
538
self.credentials = credentials
620
539
621
540
def __del__(self):
622
541
gnutls.deinit(self._c_object)
623
542
624
543
def handshake(self):
625
544
return gnutls.handshake(self._c_object)
626
545
627
546
def send(self, data):
628
547
data = bytes(data)
629
548
data_len = len(data)
631
550
data_len -= gnutls.record_send(self._c_object,
632
551
data[-data_len:],
633
552
data_len)
634
553
635
554
def bye(self):
636
555
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
637
556
638
557
# Error handling functions
639
558
def _error_code(result):
640
559
"""A function to raise exceptions on errors, suitable
642
561
if result >= 0:
643
562
return result
644
563
if result == gnutls.E_NO_CERTIFICATE_FOUND:
645
raise gnutls.CertificateSecurityError(code=result)
646
raise gnutls.Error(code=result)
647
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
648
567
def _retry_on_error(result, func, arguments):
649
568
"""A function to retry on some errors, suitable
650
569
for the 'errcheck' attribute on ctypes functions"""
653
572
return _error_code(result)
654
573
result = func(*arguments)
655
574
return result
656
575
657
576
# Unless otherwise indicated, the function declarations below are
658
577
# all from the gnutls/gnutls.h C header file.
659
578
660
579
# Functions
661
580
priority_set_direct = _library.gnutls_priority_set_direct
662
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
663
582
ctypes.POINTER(ctypes.c_char_p)]
664
583
priority_set_direct.restype = _error_code
665
584
666
585
init = _library.gnutls_init
667
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
668
587
init.restype = _error_code
669
588
670
589
set_default_priority = _library.gnutls_set_default_priority
671
590
set_default_priority.argtypes = [session_t]
672
591
set_default_priority.restype = _error_code
673
592
674
593
record_send = _library.gnutls_record_send
675
594
record_send.argtypes = [session_t, ctypes.c_void_p,
676
595
ctypes.c_size_t]
677
596
record_send.restype = ctypes.c_ssize_t
678
597
record_send.errcheck = _retry_on_error
679
598
680
599
certificate_allocate_credentials = (
681
600
_library.gnutls_certificate_allocate_credentials)
682
601
certificate_allocate_credentials.argtypes = [
683
602
ctypes.POINTER(certificate_credentials_t)]
684
603
certificate_allocate_credentials.restype = _error_code
685
604
686
605
certificate_free_credentials = (
687
606
_library.gnutls_certificate_free_credentials)
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
690
608
certificate_free_credentials.restype = None
691
609
692
610
handshake_set_private_extensions = (
693
611
_library.gnutls_handshake_set_private_extensions)
694
612
handshake_set_private_extensions.argtypes = [session_t,
695
613
ctypes.c_int]
696
614
handshake_set_private_extensions.restype = None
697
615
698
616
credentials_set = _library.gnutls_credentials_set
699
617
credentials_set.argtypes = [session_t, credentials_type_t,
700
618
ctypes.c_void_p]
701
619
credentials_set.restype = _error_code
702
620
703
621
strerror = _library.gnutls_strerror
704
622
strerror.argtypes = [ctypes.c_int]
705
623
strerror.restype = ctypes.c_char_p
706
624
707
625
certificate_type_get = _library.gnutls_certificate_type_get
708
626
certificate_type_get.argtypes = [session_t]
709
627
certificate_type_get.restype = _error_code
710
628
711
629
certificate_get_peers = _library.gnutls_certificate_get_peers
712
630
certificate_get_peers.argtypes = [session_t,
713
631
ctypes.POINTER(ctypes.c_uint)]
714
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
715
633
716
634
global_set_log_level = _library.gnutls_global_set_log_level
717
635
global_set_log_level.argtypes = [ctypes.c_int]
718
636
global_set_log_level.restype = None
719
637
720
638
global_set_log_function = _library.gnutls_global_set_log_function
721
639
global_set_log_function.argtypes = [log_func]
722
640
global_set_log_function.restype = None
723
641
724
642
deinit = _library.gnutls_deinit
725
643
deinit.argtypes = [session_t]
726
644
deinit.restype = None
727
645
728
646
handshake = _library.gnutls_handshake
729
647
handshake.argtypes = [session_t]
730
648
handshake.restype = _error_code
731
649
handshake.errcheck = _retry_on_error
732
650
733
651
transport_set_ptr = _library.gnutls_transport_set_ptr
734
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
735
653
transport_set_ptr.restype = None
736
654
737
655
bye = _library.gnutls_bye
738
656
bye.argtypes = [session_t, close_request_t]
739
657
bye.restype = _error_code
740
658
bye.errcheck = _retry_on_error
741
659
742
660
check_version = _library.gnutls_check_version
743
661
check_version.argtypes = [ctypes.c_char_p]
744
662
check_version.restype = ctypes.c_char_p
745
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
750
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
753
754
if has_rawpk:
755
# Types
756
class pubkey_st(ctypes.Structure):
757
_fields = []
758
pubkey_t = ctypes.POINTER(pubkey_st)
759
760
x509_crt_fmt_t = ctypes.c_int
761
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
766
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
769
x509_crt_fmt_t]
770
pubkey_import.restype = _error_code
771
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
777
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
781
else:
782
# All the function declarations below are from gnutls/openpgp.h
783
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
787
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
791
openpgp_crt_fmt_t]
792
openpgp_crt_import.restype = _error_code
793
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
798
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
802
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
806
ctypes.c_void_p,
807
ctypes.POINTER(
808
ctypes.c_size_t)]
809
openpgp_crt_get_fingerprint.restype = _error_code
810
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
815
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
816
693
# Remove non-public functions
817
694
del _error_code, _retry_on_error
818
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
819
697
820
698
def call_pipe(connection, # : multiprocessing.Connection
821
699
func, *args, **kwargs):
822
700
"""This function is meant to be called by multiprocessing.Process
823
701
824
702
This function runs func(*args, **kwargs), and writes the resulting
825
703
return value on the provided multiprocessing.Connection.
826
704
"""
827
705
connection.send(func(*args, **kwargs))
828
706
connection.close()
829
707
830
831
class Client:
708
class Client(object):
832
709
"""A representation of a client host served by this server.
833
710
834
711
Attributes:
835
712
approved: bool(); 'None' if not yet approved/disapproved
836
713
approval_delay: datetime.timedelta(); Time to wait for approval
837
714
approval_duration: datetime.timedelta(); Duration of one approval
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
840
running.
841
checker_callback_tag: a GLib event source tag, or None
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a gobject event source tag, or None
842
719
checker_command: string; External command which is run to check
843
720
if client lives. %() expansions are done at
844
721
runtime with vars(self) as dict, so that for
845
722
instance %(name)s can be used in the command.
846
checker_initiator_tag: a GLib event source tag, or None
723
checker_initiator_tag: a gobject event source tag, or None
847
724
created: datetime.datetime(); (UTC) object creation
848
725
client_structure: Object describing what attributes a client has
849
726
and is used for storing the client at exit
850
727
current_checker_command: string; current running checker_command
851
disable_initiator_tag: a GLib event source tag, or None
728
disable_initiator_tag: a gobject event source tag, or None
852
729
enabled: bool()
853
730
fingerprint: string (40 or 32 hexadecimal digits); used to
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
731
uniquely identify the client
857
732
host: string; available for use by the checker command
858
733
interval: datetime.timedelta(); How often to start a new checker
859
734
last_approval_request: datetime.datetime(); (UTC) or None
875
750
disabled, or None
876
751
server_settings: The server_settings dict from main()
877
752
"""
878
753
879
754
runtime_expansions = ("approval_delay", "approval_duration",
880
"created", "enabled", "expires", "key_id",
755
"created", "enabled", "expires",
881
756
"fingerprint", "host", "interval",
882
757
"last_approval_request", "last_checked_ok",
883
758
"last_enabled", "name", "timeout")
892
767
"approved_by_default": "True",
893
768
"enabled": "True",
894
769
}
895
770
896
771
@staticmethod
897
772
def config_parser(config):
898
773
"""Construct a new dict of client settings of this form:
905
780
for client_name in config.sections():
906
781
section = dict(config.items(client_name))
907
782
client = settings[client_name] = {}
908
783
909
784
client["host"] = section["host"]
910
785
# Reformat values from string types to Python types
911
786
client["approved_by_default"] = config.getboolean(
912
787
client_name, "approved_by_default")
913
788
client["enabled"] = config.getboolean(client_name,
914
789
"enabled")
915
916
# Uppercase and remove spaces from key_id and fingerprint
917
# for later comparison purposes with return value from the
918
# key_id() and fingerprint() functions
919
client["key_id"] = (section.get("key_id", "").upper()
920
.replace(" ", ""))
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
921
794
client["fingerprint"] = (section["fingerprint"].upper()
922
795
.replace(" ", ""))
923
796
if "secret" in section:
924
client["secret"] = codecs.decode(section["secret"]
925
.encode("utf-8"),
926
"base64")
797
client["secret"] = section["secret"].decode("base64")
927
798
elif "secfile" in section:
928
799
with open(os.path.expanduser(os.path.expandvars
929
800
(section["secfile"])),
944
815
client["last_approval_request"] = None
945
816
client["last_checked_ok"] = None
946
817
client["last_checker_status"] = -2
947
818
948
819
return settings
949
950
def __init__(self, settings, name=None, server_settings=None):
820
821
def __init__(self, settings, name = None, server_settings=None):
951
822
self.name = name
952
823
if server_settings is None:
953
824
server_settings = {}
955
826
# adding all client settings
956
827
for setting, value in settings.items():
957
828
setattr(self, setting, value)
958
829
959
830
if self.enabled:
960
831
if not hasattr(self, "last_enabled"):
961
832
self.last_enabled = datetime.datetime.utcnow()
965
836
else:
966
837
self.last_enabled = None
967
838
self.expires = None
968
839
969
840
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
841
logger.debug(" Fingerprint: %s", self.fingerprint)
972
842
self.created = settings.get("created",
973
843
datetime.datetime.utcnow())
974
844
975
845
# attributes specific for this server instance
976
846
self.checker = None
977
847
self.checker_initiator_tag = None
983
853
self.changedstate = multiprocessing_manager.Condition(
984
854
multiprocessing_manager.Lock())
985
855
self.client_structure = [attr
986
for attr in self.__dict__.keys()
856
for attr in self.__dict__.iterkeys()
987
857
if not attr.startswith("_")]
988
858
self.client_structure.append("client_structure")
989
859
990
860
for name, t in inspect.getmembers(
991
861
type(self), lambda obj: isinstance(obj, property)):
992
862
if not name.startswith("_"):
993
863
self.client_structure.append(name)
994
864
995
865
# Send notice to process children that client state has changed
996
866
def send_changedstate(self):
997
867
with self.changedstate:
998
868
self.changedstate.notify_all()
999
869
1000
870
def enable(self):
1001
871
"""Start this client's checker and timeout hooks"""
1002
872
if getattr(self, "enabled", False):
1007
877
self.last_enabled = datetime.datetime.utcnow()
1008
878
self.init_checker()
1009
879
self.send_changedstate()
1010
880
1011
881
def disable(self, quiet=True):
1012
882
"""Disable this client."""
1013
883
if not getattr(self, "enabled", False):
1015
885
if not quiet:
1016
886
logger.info("Disabling client %s", self.name)
1017
887
if getattr(self, "disable_initiator_tag", None) is not None:
1018
GLib.source_remove(self.disable_initiator_tag)
888
gobject.source_remove(self.disable_initiator_tag)
1019
889
self.disable_initiator_tag = None
1020
890
self.expires = None
1021
891
if getattr(self, "checker_initiator_tag", None) is not None:
1022
GLib.source_remove(self.checker_initiator_tag)
892
gobject.source_remove(self.checker_initiator_tag)
1023
893
self.checker_initiator_tag = None
1024
894
self.stop_checker()
1025
895
self.enabled = False
1026
896
if not quiet:
1027
897
self.send_changedstate()
1028
# Do not run this again if called by a GLib.timeout_add
898
# Do not run this again if called by a gobject.timeout_add
1029
899
return False
1030
900
1031
901
def __del__(self):
1032
902
self.disable()
1033
903
1034
904
def init_checker(self):
1035
905
# Schedule a new checker to be started an 'interval' from now,
1036
906
# and every interval from then on.
1037
907
if self.checker_initiator_tag is not None:
1038
GLib.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = GLib.timeout_add(
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
1040
910
int(self.interval.total_seconds() * 1000),
1041
911
self.start_checker)
1042
912
# Schedule a disable() when 'timeout' has passed
1043
913
if self.disable_initiator_tag is not None:
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
1046
916
int(self.timeout.total_seconds() * 1000), self.disable)
1047
917
# Also start a new checker *right now*.
1048
918
self.start_checker()
1049
919
1050
920
def checker_callback(self, source, condition, connection,
1051
921
command):
1052
922
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
924
self.checker = None
1053
925
# Read return code from connection (see call_pipe)
1054
926
returncode = connection.recv()
1055
927
connection.close()
1056
if self.checker is not None:
1057
self.checker.join()
1058
self.checker_callback_tag = None
1059
self.checker = None
1060
928
1061
929
if returncode >= 0:
1062
930
self.last_checker_status = returncode
1063
931
self.last_checker_signal = None
1073
941
logger.warning("Checker for %(name)s crashed?",
1074
942
vars(self))
1075
943
return False
1076
944
1077
945
def checked_ok(self):
1078
946
"""Assert that the client has been seen, alive and well."""
1079
947
self.last_checked_ok = datetime.datetime.utcnow()
1080
948
self.last_checker_status = 0
1081
949
self.last_checker_signal = None
1082
950
self.bump_timeout()
1083
951
1084
952
def bump_timeout(self, timeout=None):
1085
953
"""Bump up the timeout for this client."""
1086
954
if timeout is None:
1087
955
timeout = self.timeout
1088
956
if self.disable_initiator_tag is not None:
1089
GLib.source_remove(self.disable_initiator_tag)
957
gobject.source_remove(self.disable_initiator_tag)
1090
958
self.disable_initiator_tag = None
1091
959
if getattr(self, "enabled", False):
1092
self.disable_initiator_tag = GLib.timeout_add(
960
self.disable_initiator_tag = gobject.timeout_add(
1093
961
int(timeout.total_seconds() * 1000), self.disable)
1094
962
self.expires = datetime.datetime.utcnow() + timeout
1095
963
1096
964
def need_approval(self):
1097
965
self.last_approval_request = datetime.datetime.utcnow()
1098
966
1099
967
def start_checker(self):
1100
968
"""Start a new checker subprocess if one is not running.
1101
969
1102
970
If a checker already exists, leave it running and do
1103
971
nothing."""
1104
972
# The reason for not killing a running checker is that if we
1109
977
# checkers alone, the checker would have to take more time
1110
978
# than 'timeout' for the client to be disabled, which is as it
1111
979
# should be.
1112
980
1113
981
if self.checker is not None and not self.checker.is_alive():
1114
982
logger.warning("Checker was not alive; joining")
1115
983
self.checker.join()
1119
987
# Escape attributes for the shell
1120
988
escaped_attrs = {
1121
989
attr: re.escape(str(getattr(self, attr)))
1122
for attr in self.runtime_expansions}
990
for attr in self.runtime_expansions }
1123
991
try:
1124
992
command = self.checker_command % escaped_attrs
1125
993
except TypeError as error:
1137
1005
# The exception is when not debugging but nevertheless
1138
1006
# running in the foreground; use the previously
1139
1007
# created wnull.
1140
popen_args = {"close_fds": True,
1141
"shell": True,
1142
"cwd": "/"}
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1143
1011
if (not self.server_settings["debug"]
1144
1012
and self.server_settings["foreground"]):
1145
1013
popen_args.update({"stdout": wnull,
1146
"stderr": wnull})
1147
pipe = multiprocessing.Pipe(duplex=False)
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1148
1016
self.checker = multiprocessing.Process(
1149
target=call_pipe,
1150
args=(pipe[1], subprocess.call, command),
1151
kwargs=popen_args)
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1152
1020
self.checker.start()
1153
self.checker_callback_tag = GLib.io_add_watch(
1154
GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1156
1023
self.checker_callback, pipe[0], command)
1157
# Re-run this periodically if run by GLib.timeout_add
1024
# Re-run this periodically if run by gobject.timeout_add
1158
1025
return True
1159
1026
1160
1027
def stop_checker(self):
1161
1028
"""Force the checker process, if any, to stop."""
1162
1029
if self.checker_callback_tag:
1163
GLib.source_remove(self.checker_callback_tag)
1030
gobject.source_remove(self.checker_callback_tag)
1164
1031
self.checker_callback_tag = None
1165
1032
if getattr(self, "checker", None) is None:
1166
1033
return
1175
1042
byte_arrays=False):
1176
1043
"""Decorators for marking methods of a DBusObjectWithProperties to
1177
1044
become properties on the D-Bus.
1178
1045
1179
1046
The decorated method will be called with no arguments by "Get"
1180
1047
and with one argument by "Set".
1181
1048
1182
1049
The parameters, where they are supported, are the same as
1183
1050
dbus.service.method, except there is only "signature", since the
1184
1051
type from Get() and the type sent to Set() is the same.
1188
1055
if byte_arrays and signature != "ay":
1189
1056
raise ValueError("Byte arrays not supported for non-'ay'"
1190
1057
" signature {!r}".format(signature))
1191
1058
1192
1059
def decorator(func):
1193
1060
func._dbus_is_property = True
1194
1061
func._dbus_interface = dbus_interface
1197
1064
func._dbus_name = func.__name__
1198
1065
if func._dbus_name.endswith("_dbus_property"):
1199
1066
func._dbus_name = func._dbus_name[:-14]
1200
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1201
1068
return func
1202
1069
1203
1070
return decorator
1204
1071
1205
1072
1206
1073
def dbus_interface_annotations(dbus_interface):
1207
1074
"""Decorator for marking functions returning interface annotations
1208
1075
1209
1076
Usage:
1210
1077
1211
1078
@dbus_interface_annotations("org.example.Interface")
1212
1079
def _foo(self): # Function name does not matter
1213
1080
return {"org.freedesktop.DBus.Deprecated": "true",
1214
1081
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1215
1082
"false"}
1216
1083
"""
1217
1084
1218
1085
def decorator(func):
1219
1086
func._dbus_is_interface = True
1220
1087
func._dbus_interface = dbus_interface
1221
1088
func._dbus_name = dbus_interface
1222
1089
return func
1223
1090
1224
1091
return decorator
1225
1092
1226
1093
1227
1094
def dbus_annotations(annotations):
1228
1095
"""Decorator to annotate D-Bus methods, signals or properties
1229
1096
Usage:
1230
1097
1231
1098
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1232
1099
"org.freedesktop.DBus.Property."
1233
1100
"EmitsChangedSignal": "false"})
1235
1102
access="r")
1236
1103
def Property_dbus_property(self):
1237
1104
return dbus.Boolean(False)
1238
1105
1239
1106
See also the DBusObjectWithAnnotations class.
1240
1107
"""
1241
1108
1242
1109
def decorator(func):
1243
1110
func._dbus_annotations = annotations
1244
1111
return func
1245
1112
1246
1113
return decorator
1247
1114
1248
1115
1266
1133
1267
1134
class DBusObjectWithAnnotations(dbus.service.Object):
1268
1135
"""A D-Bus object with annotations.
1269
1136
1270
1137
Classes inheriting from this can use the dbus_annotations
1271
1138
decorator to add annotations to methods or signals.
1272
1139
"""
1273
1140
1274
1141
@staticmethod
1275
1142
def _is_dbus_thing(thing):
1276
1143
"""Returns a function testing if an attribute is a D-Bus thing
1277
1144
1278
1145
If called like _is_dbus_thing("method") it returns a function
1279
1146
suitable for use as predicate to inspect.getmembers().
1280
1147
"""
1281
1148
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1282
1149
False)
1283
1150
1284
1151
def _get_all_dbus_things(self, thing):
1285
1152
"""Returns a generator of (name, attribute) pairs
1286
1153
"""
1289
1156
for cls in self.__class__.__mro__
1290
1157
for name, athing in
1291
1158
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1292
1159
1293
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
out_signature="s",
1295
path_keyword='object_path',
1296
connection_keyword='connection')
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1297
1164
def Introspect(self, object_path, connection):
1298
1165
"""Overloading of standard D-Bus method.
1299
1166
1300
1167
Inserts annotation tags on methods and signals.
1301
1168
"""
1302
1169
xmlstring = dbus.service.Object.Introspect(self, object_path,
1303
1170
connection)
1304
1171
try:
1305
1172
document = xml.dom.minidom.parseString(xmlstring)
1306
1173
1307
1174
for if_tag in document.getElementsByTagName("interface"):
1308
1175
# Add annotation tags
1309
1176
for typ in ("method", "signal"):
1336
1203
if_tag.appendChild(ann_tag)
1337
1204
# Fix argument name for the Introspect method itself
1338
1205
if (if_tag.getAttribute("name")
1339
== dbus.INTROSPECTABLE_IFACE):
1206
== dbus.INTROSPECTABLE_IFACE):
1340
1207
for cn in if_tag.getElementsByTagName("method"):
1341
1208
if cn.getAttribute("name") == "Introspect":
1342
1209
for arg in cn.getElementsByTagName("arg"):
1355
1222
1356
1223
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1357
1224
"""A D-Bus object with properties.
1358
1225
1359
1226
Classes inheriting from this can use the dbus_service_property
1360
1227
decorator to expose methods as D-Bus properties. It exposes the
1361
1228
standard Get(), Set(), and GetAll() methods on the D-Bus.
1362
1229
"""
1363
1230
1364
1231
def _get_dbus_property(self, interface_name, property_name):
1365
1232
"""Returns a bound method if one exists which is a D-Bus
1366
1233
property with the specified name and interface.
1371
1238
if (value._dbus_name == property_name
1372
1239
and value._dbus_interface == interface_name):
1373
1240
return value.__get__(self)
1374
1241
1375
1242
# No such property
1376
1243
raise DBusPropertyNotFound("{}:{}.{}".format(
1377
1244
self.dbus_object_path, interface_name, property_name))
1378
1245
1379
1246
@classmethod
1380
1247
def _get_all_interface_names(cls):
1381
1248
"""Get a sequence of all interfaces supported by an object"""
1384
1251
for x in (inspect.getmro(cls))
1385
1252
for attr in dir(x))
1386
1253
if name is not None)
1387
1254
1388
1255
@dbus.service.method(dbus.PROPERTIES_IFACE,
1389
1256
in_signature="ss",
1390
1257
out_signature="v")
1398
1265
if not hasattr(value, "variant_level"):
1399
1266
return value
1400
1267
return type(value)(value, variant_level=value.variant_level+1)
1401
1268
1402
1269
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1403
1270
def Set(self, interface_name, property_name, value):
1404
1271
"""Standard D-Bus property Set() method, see D-Bus standard.
1416
1283
value = dbus.ByteArray(b''.join(chr(byte)
1417
1284
for byte in value))
1418
1285
prop(value)
1419
1286
1420
1287
@dbus.service.method(dbus.PROPERTIES_IFACE,
1421
1288
in_signature="s",
1422
1289
out_signature="a{sv}")
1423
1290
def GetAll(self, interface_name):
1424
1291
"""Standard D-Bus property GetAll() method, see D-Bus
1425
1292
standard.
1426
1293
1427
1294
Note: Will not include properties with access="write".
1428
1295
"""
1429
1296
properties = {}
1440
1307
properties[name] = value
1441
1308
continue
1442
1309
properties[name] = type(value)(
1443
value, variant_level=value.variant_level + 1)
1310
value, variant_level = value.variant_level + 1)
1444
1311
return dbus.Dictionary(properties, signature="sv")
1445
1312
1446
1313
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1447
1314
def PropertiesChanged(self, interface_name, changed_properties,
1448
1315
invalidated_properties):
1450
1317
standard.
1451
1318
"""
1452
1319
pass
1453
1320
1454
1321
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1455
1322
out_signature="s",
1456
1323
path_keyword='object_path',
1457
1324
connection_keyword='connection')
1458
1325
def Introspect(self, object_path, connection):
1459
1326
"""Overloading of standard D-Bus method.
1460
1327
1461
1328
Inserts property tags and interface annotation tags.
1462
1329
"""
1463
1330
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1465
1332
connection)
1466
1333
try:
1467
1334
document = xml.dom.minidom.parseString(xmlstring)
1468
1335
1469
1336
def make_tag(document, name, prop):
1470
1337
e = document.createElement("property")
1471
1338
e.setAttribute("name", name)
1472
1339
e.setAttribute("type", prop._dbus_signature)
1473
1340
e.setAttribute("access", prop._dbus_access)
1474
1341
return e
1475
1342
1476
1343
for if_tag in document.getElementsByTagName("interface"):
1477
1344
# Add property tags
1478
1345
for tag in (make_tag(document, name, prop)
1520
1387
exc_info=error)
1521
1388
return xmlstring
1522
1389
1523
1524
1390
try:
1525
1391
dbus.OBJECT_MANAGER_IFACE
1526
1392
except AttributeError:
1527
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1528
1394
1529
1530
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1531
1396
"""A D-Bus object with an ObjectManager.
1532
1397
1533
1398
Classes inheriting from this exposes the standard
1534
1399
GetManagedObjects call and the InterfacesAdded and
1535
1400
InterfacesRemoved signals on the standard
1536
1401
"org.freedesktop.DBus.ObjectManager" interface.
1537
1402
1538
1403
Note: No signals are sent automatically; they must be sent
1539
1404
manually.
1540
1405
"""
1541
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1542
out_signature="a{oa{sa{sv}}}")
1407
out_signature = "a{oa{sa{sv}}}")
1543
1408
def GetManagedObjects(self):
1544
1409
"""This function must be overridden"""
1545
1410
raise NotImplementedError()
1546
1411
1547
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1548
signature="oa{sa{sv}}")
1413
signature = "oa{sa{sv}}")
1549
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1550
1415
pass
1551
1552
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1553
1418
def InterfacesRemoved(self, object_path, interfaces):
1554
1419
pass
1555
1420
1556
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1557
out_signature="s",
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1560
1425
def Introspect(self, object_path, connection):
1561
1426
"""Overloading of standard D-Bus method.
1562
1427
1563
1428
Override return argument name of GetManagedObjects to be
1564
1429
"objpath_interfaces_and_properties"
1565
1430
"""
1568
1433
connection)
1569
1434
try:
1570
1435
document = xml.dom.minidom.parseString(xmlstring)
1571
1436
1572
1437
for if_tag in document.getElementsByTagName("interface"):
1573
1438
# Fix argument name for the GetManagedObjects method
1574
1439
if (if_tag.getAttribute("name")
1575
== dbus.OBJECT_MANAGER_IFACE):
1440
== dbus.OBJECT_MANAGER_IFACE):
1576
1441
for cn in if_tag.getElementsByTagName("method"):
1577
1442
if (cn.getAttribute("name")
1578
1443
== "GetManagedObjects"):
1588
1453
except (AttributeError, xml.dom.DOMException,
1589
1454
xml.parsers.expat.ExpatError) as error:
1590
1455
logger.error("Failed to override Introspection method",
1591
exc_info=error)
1456
exc_info = error)
1592
1457
return xmlstring
1593
1458
1594
1595
1459
def datetime_to_dbus(dt, variant_level=0):
1596
1460
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1597
1461
if dt is None:
1598
return dbus.String("", variant_level=variant_level)
1462
return dbus.String("", variant_level = variant_level)
1599
1463
return dbus.String(dt.isoformat(), variant_level=variant_level)
1600
1464
1601
1465
1604
1468
dbus.service.Object, it will add alternate D-Bus attributes with
1605
1469
interface names according to the "alt_interface_names" mapping.
1606
1470
Usage:
1607
1471
1608
1472
@alternate_dbus_interfaces({"org.example.Interface":
1609
1473
"net.example.AlternateInterface"})
1610
1474
class SampleDBusObject(dbus.service.Object):
1611
1475
@dbus.service.method("org.example.Interface")
1612
1476
def SampleDBusMethod():
1613
1477
pass
1614
1478
1615
1479
The above "SampleDBusMethod" on "SampleDBusObject" will be
1616
1480
reachable via two interfaces: "org.example.Interface" and
1617
1481
"net.example.AlternateInterface", the latter of which will have
1618
1482
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1619
1483
"true", unless "deprecate" is passed with a False value.
1620
1484
1621
1485
This works for methods and signals, and also for D-Bus properties
1622
1486
(from DBusObjectWithProperties) and interfaces (from the
1623
1487
dbus_interface_annotations decorator).
1624
1488
"""
1625
1489
1626
1490
def wrapper(cls):
1627
1491
for orig_interface_name, alt_interface_name in (
1628
1492
alt_interface_names.items()):
1643
1507
interface_names.add(alt_interface)
1644
1508
# Is this a D-Bus signal?
1645
1509
if getattr(attribute, "_dbus_is_signal", False):
1646
# Extract the original non-method undecorated
1647
# function by black magic
1648
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1649
1513
nonmethod_func = (dict(
1650
1514
zip(attribute.func_code.co_freevars,
1651
1515
attribute.__closure__))
1652
1516
["func"].cell_contents)
1653
1517
else:
1654
nonmethod_func = (dict(
1655
zip(attribute.__code__.co_freevars,
1656
attribute.__closure__))
1657
["func"].cell_contents)
1518
nonmethod_func = attribute
1658
1519
# Create a new, but exactly alike, function
1659
1520
# object, and decorate it to be a new D-Bus signal
1660
1521
# with the alternate D-Bus interface name
1661
new_function = copy_function(nonmethod_func)
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1662
1536
new_function = (dbus.service.signal(
1663
1537
alt_interface,
1664
1538
attribute._dbus_signature)(new_function))
1668
1542
attribute._dbus_annotations)
1669
1543
except AttributeError:
1670
1544
pass
1671
1672
1545
# Define a creator of a function to call both the
1673
1546
# original and alternate functions, so both the
1674
1547
# original and alternate signals gets sent when
1677
1550
"""This function is a scope container to pass
1678
1551
func1 and func2 to the "call_both" function
1679
1552
outside of its arguments"""
1680
1553
1681
1554
@functools.wraps(func2)
1682
1555
def call_both(*args, **kwargs):
1683
1556
"""This function will emit two D-Bus
1684
1557
signals by calling func1 and func2"""
1685
1558
func1(*args, **kwargs)
1686
1559
func2(*args, **kwargs)
1687
# Make wrapper function look like a D-Bus
1688
# signal
1560
# Make wrapper function look like a D-Bus signal
1689
1561
for name, attr in inspect.getmembers(func2):
1690
1562
if name.startswith("_dbus_"):
1691
1563
setattr(call_both, name, attr)
1692
1564
1693
1565
return call_both
1694
1566
# Create the "call_both" function and add it to
1695
1567
# the class
1705
1577
alt_interface,
1706
1578
attribute._dbus_in_signature,
1707
1579
attribute._dbus_out_signature)
1708
(copy_function(attribute)))
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1709
1585
# Copy annotations, if any
1710
1586
try:
1711
1587
attr[attrname]._dbus_annotations = dict(
1723
1599
attribute._dbus_access,
1724
1600
attribute._dbus_get_args_options
1725
1601
["byte_arrays"])
1726
(copy_function(attribute)))
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1727
1608
# Copy annotations, if any
1728
1609
try:
1729
1610
attr[attrname]._dbus_annotations = dict(
1738
1619
# to the class.
1739
1620
attr[attrname] = (
1740
1621
dbus_interface_annotations(alt_interface)
1741
(copy_function(attribute)))
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1742
1627
if deprecate:
1743
1628
# Deprecate all alternate interfaces
1744
iname = "_AlternateDBusNames_interface_annotation{}"
1629
iname="_AlternateDBusNames_interface_annotation{}"
1745
1630
for interface_name in interface_names:
1746
1631
1747
1632
@dbus_interface_annotations(interface_name)
1748
1633
def func(self):
1749
return {"org.freedesktop.DBus.Deprecated":
1750
"true"}
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1751
1636
# Find an unused name
1752
1637
for aname in (iname.format(i)
1753
1638
for i in itertools.count()):
1757
1642
if interface_names:
1758
1643
# Replace the class with a new subclass of it with
1759
1644
# methods, signals, etc. as created above.
1760
if sys.version_info.major == 2:
1761
cls = type(b"{}Alternate".format(cls.__name__),
1762
(cls, ), attr)
1763
else:
1764
cls = type("{}Alternate".format(cls.__name__),
1765
(cls, ), attr)
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1766
1647
return cls
1767
1648
1768
1649
return wrapper
1769
1650
1770
1651
1772
1653
"se.bsnet.fukt.Mandos"})
1773
1654
class ClientDBus(Client, DBusObjectWithProperties):
1774
1655
"""A Client class using D-Bus
1775
1656
1776
1657
Attributes:
1777
1658
dbus_object_path: dbus.ObjectPath
1778
1659
bus: dbus.SystemBus()
1779
1660
"""
1780
1661
1781
1662
runtime_expansions = (Client.runtime_expansions
1782
1663
+ ("dbus_object_path", ))
1783
1664
1784
1665
_interface = "se.recompile.Mandos.Client"
1785
1666
1786
1667
# dbus.service.Object doesn't use super(), so we can't either.
1787
1788
def __init__(self, bus=None, *args, **kwargs):
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1789
1670
self.bus = bus
1790
1671
Client.__init__(self, *args, **kwargs)
1791
1672
# Only now, when this client is initialized, can it show up on
1797
1678
"/clients/" + client_object_name)
1798
1679
DBusObjectWithProperties.__init__(self, self.bus,
1799
1680
self.dbus_object_path)
1800
1681
1801
1682
def notifychangeproperty(transform_func, dbus_name,
1802
1683
type_func=lambda x: x,
1803
1684
variant_level=1,
1805
1686
_interface=_interface):
1806
1687
""" Modify a variable so that it's a property which announces
1807
1688
its changes to DBus.
1808
1689
1809
1690
transform_fun: Function that takes a value and a variant_level
1810
1691
and transforms it to a D-Bus type.
1811
1692
dbus_name: D-Bus name of the variable
1814
1695
variant_level: D-Bus variant level. Default: 1
1815
1696
"""
1816
1697
attrname = "_{}".format(dbus_name)
1817
1698
1818
1699
def setter(self, value):
1819
1700
if hasattr(self, "dbus_object_path"):
1820
1701
if (not hasattr(self, attrname) or
1827
1708
else:
1828
1709
dbus_value = transform_func(
1829
1710
type_func(value),
1830
variant_level=variant_level)
1711
variant_level = variant_level)
1831
1712
self.PropertyChanged(dbus.String(dbus_name),
1832
1713
dbus_value)
1833
1714
self.PropertiesChanged(
1834
1715
_interface,
1835
dbus.Dictionary({dbus.String(dbus_name):
1836
dbus_value}),
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1837
1718
dbus.Array())
1838
1719
setattr(self, attrname, value)
1839
1720
1840
1721
return property(lambda self: getattr(self, attrname), setter)
1841
1722
1842
1723
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1843
1724
approvals_pending = notifychangeproperty(dbus.Boolean,
1844
1725
"ApprovalPending",
1845
type_func=bool)
1726
type_func = bool)
1846
1727
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1847
1728
last_enabled = notifychangeproperty(datetime_to_dbus,
1848
1729
"LastEnabled")
1849
1730
checker = notifychangeproperty(
1850
1731
dbus.Boolean, "CheckerRunning",
1851
type_func=lambda checker: checker is not None)
1732
type_func = lambda checker: checker is not None)
1852
1733
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1853
1734
"LastCheckedOK")
1854
1735
last_checker_status = notifychangeproperty(dbus.Int16,
1859
1740
"ApprovedByDefault")
1860
1741
approval_delay = notifychangeproperty(
1861
1742
dbus.UInt64, "ApprovalDelay",
1862
type_func=lambda td: td.total_seconds() * 1000)
1743
type_func = lambda td: td.total_seconds() * 1000)
1863
1744
approval_duration = notifychangeproperty(
1864
1745
dbus.UInt64, "ApprovalDuration",
1865
type_func=lambda td: td.total_seconds() * 1000)
1746
type_func = lambda td: td.total_seconds() * 1000)
1866
1747
host = notifychangeproperty(dbus.String, "Host")
1867
1748
timeout = notifychangeproperty(
1868
1749
dbus.UInt64, "Timeout",
1869
type_func=lambda td: td.total_seconds() * 1000)
1750
type_func = lambda td: td.total_seconds() * 1000)
1870
1751
extended_timeout = notifychangeproperty(
1871
1752
dbus.UInt64, "ExtendedTimeout",
1872
type_func=lambda td: td.total_seconds() * 1000)
1753
type_func = lambda td: td.total_seconds() * 1000)
1873
1754
interval = notifychangeproperty(
1874
1755
dbus.UInt64, "Interval",
1875
type_func=lambda td: td.total_seconds() * 1000)
1756
type_func = lambda td: td.total_seconds() * 1000)
1876
1757
checker_command = notifychangeproperty(dbus.String, "Checker")
1877
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1878
1759
invalidate_only=True)
1879
1760
1880
1761
del notifychangeproperty
1881
1762
1882
1763
def __del__(self, *args, **kwargs):
1883
1764
try:
1884
1765
self.remove_from_connection()
1887
1768
if hasattr(DBusObjectWithProperties, "__del__"):
1888
1769
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1889
1770
Client.__del__(self, *args, **kwargs)
1890
1771
1891
1772
def checker_callback(self, source, condition,
1892
1773
connection, command, *args, **kwargs):
1893
1774
ret = Client.checker_callback(self, source, condition,
1909
1790
| self.last_checker_signal),
1910
1791
dbus.String(command))
1911
1792
return ret
1912
1793
1913
1794
def start_checker(self, *args, **kwargs):
1914
1795
old_checker_pid = getattr(self.checker, "pid", None)
1915
1796
r = Client.start_checker(self, *args, **kwargs)
1919
1800
# Emit D-Bus signal
1920
1801
self.CheckerStarted(self.current_checker_command)
1921
1802
return r
1922
1803
1923
1804
def _reset_approved(self):
1924
1805
self.approved = None
1925
1806
return False
1926
1807
1927
1808
def approve(self, value=True):
1928
1809
self.approved = value
1929
GLib.timeout_add(int(self.approval_duration.total_seconds()
1930
* 1000), self._reset_approved)
1810
gobject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1931
1812
self.send_changedstate()
1932
1933
# D-Bus methods, signals & properties
1934
1935
# Interfaces
1936
1937
# Signals
1938
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1939
1820
# CheckerCompleted - signal
1940
1821
@dbus.service.signal(_interface, signature="nxs")
1941
1822
def CheckerCompleted(self, exitcode, waitstatus, command):
1942
1823
"D-Bus signal"
1943
1824
pass
1944
1825
1945
1826
# CheckerStarted - signal
1946
1827
@dbus.service.signal(_interface, signature="s")
1947
1828
def CheckerStarted(self, command):
1948
1829
"D-Bus signal"
1949
1830
pass
1950
1831
1951
1832
# PropertyChanged - signal
1952
1833
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1953
1834
@dbus.service.signal(_interface, signature="sv")
1954
1835
def PropertyChanged(self, property, value):
1955
1836
"D-Bus signal"
1956
1837
pass
1957
1838
1958
1839
# GotSecret - signal
1959
1840
@dbus.service.signal(_interface)
1960
1841
def GotSecret(self):
1963
1844
server to mandos-client
1964
1845
"""
1965
1846
pass
1966
1847
1967
1848
# Rejected - signal
1968
1849
@dbus.service.signal(_interface, signature="s")
1969
1850
def Rejected(self, reason):
1970
1851
"D-Bus signal"
1971
1852
pass
1972
1853
1973
1854
# NeedApproval - signal
1974
1855
@dbus.service.signal(_interface, signature="tb")
1975
1856
def NeedApproval(self, timeout, default):
1976
1857
"D-Bus signal"
1977
1858
return self.need_approval()
1978
1979
# Methods
1980
1859
1860
## Methods
1861
1981
1862
# Approve - method
1982
1863
@dbus.service.method(_interface, in_signature="b")
1983
1864
def Approve(self, value):
1984
1865
self.approve(value)
1985
1866
1986
1867
# CheckedOK - method
1987
1868
@dbus.service.method(_interface)
1988
1869
def CheckedOK(self):
1989
1870
self.checked_ok()
1990
1871
1991
1872
# Enable - method
1992
1873
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1993
1874
@dbus.service.method(_interface)
1994
1875
def Enable(self):
1995
1876
"D-Bus method"
1996
1877
self.enable()
1997
1878
1998
1879
# StartChecker - method
1999
1880
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2000
1881
@dbus.service.method(_interface)
2001
1882
def StartChecker(self):
2002
1883
"D-Bus method"
2003
1884
self.start_checker()
2004
1885
2005
1886
# Disable - method
2006
1887
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2007
1888
@dbus.service.method(_interface)
2008
1889
def Disable(self):
2009
1890
"D-Bus method"
2010
1891
self.disable()
2011
1892
2012
1893
# StopChecker - method
2013
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2014
1895
@dbus.service.method(_interface)
2015
1896
def StopChecker(self):
2016
1897
self.stop_checker()
2017
2018
# Properties
2019
1898
1899
## Properties
1900
2020
1901
# ApprovalPending - property
2021
1902
@dbus_service_property(_interface, signature="b", access="read")
2022
1903
def ApprovalPending_dbus_property(self):
2023
1904
return dbus.Boolean(bool(self.approvals_pending))
2024
1905
2025
1906
# ApprovedByDefault - property
2026
1907
@dbus_service_property(_interface,
2027
1908
signature="b",
2030
1911
if value is None: # get
2031
1912
return dbus.Boolean(self.approved_by_default)
2032
1913
self.approved_by_default = bool(value)
2033
1914
2034
1915
# ApprovalDelay - property
2035
1916
@dbus_service_property(_interface,
2036
1917
signature="t",
2040
1921
return dbus.UInt64(self.approval_delay.total_seconds()
2041
1922
* 1000)
2042
1923
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2043
1924
2044
1925
# ApprovalDuration - property
2045
1926
@dbus_service_property(_interface,
2046
1927
signature="t",
2050
1931
return dbus.UInt64(self.approval_duration.total_seconds()
2051
1932
* 1000)
2052
1933
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2053
1934
2054
1935
# Name - property
2055
1936
@dbus_annotations(
2056
1937
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2057
1938
@dbus_service_property(_interface, signature="s", access="read")
2058
1939
def Name_dbus_property(self):
2059
1940
return dbus.String(self.name)
2060
2061
# KeyID - property
2062
@dbus_annotations(
2063
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2064
@dbus_service_property(_interface, signature="s", access="read")
2065
def KeyID_dbus_property(self):
2066
return dbus.String(self.key_id)
2067
1941
2068
1942
# Fingerprint - property
2069
1943
@dbus_annotations(
2070
1944
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2071
1945
@dbus_service_property(_interface, signature="s", access="read")
2072
1946
def Fingerprint_dbus_property(self):
2073
1947
return dbus.String(self.fingerprint)
2074
1948
2075
1949
# Host - property
2076
1950
@dbus_service_property(_interface,
2077
1951
signature="s",
2080
1954
if value is None: # get
2081
1955
return dbus.String(self.host)
2082
1956
self.host = str(value)
2083
1957
2084
1958
# Created - property
2085
1959
@dbus_annotations(
2086
1960
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2087
1961
@dbus_service_property(_interface, signature="s", access="read")
2088
1962
def Created_dbus_property(self):
2089
1963
return datetime_to_dbus(self.created)
2090
1964
2091
1965
# LastEnabled - property
2092
1966
@dbus_service_property(_interface, signature="s", access="read")
2093
1967
def LastEnabled_dbus_property(self):
2094
1968
return datetime_to_dbus(self.last_enabled)
2095
1969
2096
1970
# Enabled - property
2097
1971
@dbus_service_property(_interface,
2098
1972
signature="b",
2104
1978
self.enable()
2105
1979
else:
2106
1980
self.disable()
2107
1981
2108
1982
# LastCheckedOK - property
2109
1983
@dbus_service_property(_interface,
2110
1984
signature="s",
2114
1988
self.checked_ok()
2115
1989
return
2116
1990
return datetime_to_dbus(self.last_checked_ok)
2117
1991
2118
1992
# LastCheckerStatus - property
2119
1993
@dbus_service_property(_interface, signature="n", access="read")
2120
1994
def LastCheckerStatus_dbus_property(self):
2121
1995
return dbus.Int16(self.last_checker_status)
2122
1996
2123
1997
# Expires - property
2124
1998
@dbus_service_property(_interface, signature="s", access="read")
2125
1999
def Expires_dbus_property(self):
2126
2000
return datetime_to_dbus(self.expires)
2127
2001
2128
2002
# LastApprovalRequest - property
2129
2003
@dbus_service_property(_interface, signature="s", access="read")
2130
2004
def LastApprovalRequest_dbus_property(self):
2131
2005
return datetime_to_dbus(self.last_approval_request)
2132
2006
2133
2007
# Timeout - property
2134
2008
@dbus_service_property(_interface,
2135
2009
signature="t",
2150
2024
if (getattr(self, "disable_initiator_tag", None)
2151
2025
is None):
2152
2026
return
2153
GLib.source_remove(self.disable_initiator_tag)
2154
self.disable_initiator_tag = GLib.timeout_add(
2027
gobject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = gobject.timeout_add(
2155
2029
int((self.expires - now).total_seconds() * 1000),
2156
2030
self.disable)
2157
2031
2158
2032
# ExtendedTimeout - property
2159
2033
@dbus_service_property(_interface,
2160
2034
signature="t",
2164
2038
return dbus.UInt64(self.extended_timeout.total_seconds()
2165
2039
* 1000)
2166
2040
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2167
2041
2168
2042
# Interval - property
2169
2043
@dbus_service_property(_interface,
2170
2044
signature="t",
2177
2051
return
2178
2052
if self.enabled:
2179
2053
# Reschedule checker run
2180
GLib.source_remove(self.checker_initiator_tag)
2181
self.checker_initiator_tag = GLib.timeout_add(
2054
gobject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = gobject.timeout_add(
2182
2056
value, self.start_checker)
2183
self.start_checker() # Start one now, too
2184
2057
self.start_checker() # Start one now, too
2058
2185
2059
# Checker - property
2186
2060
@dbus_service_property(_interface,
2187
2061
signature="s",
2190
2064
if value is None: # get
2191
2065
return dbus.String(self.checker_command)
2192
2066
self.checker_command = str(value)
2193
2067
2194
2068
# CheckerRunning - property
2195
2069
@dbus_service_property(_interface,
2196
2070
signature="b",
2202
2076
self.start_checker()
2203
2077
else:
2204
2078
self.stop_checker()
2205
2079
2206
2080
# ObjectPath - property
2207
2081
@dbus_annotations(
2208
2082
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2209
2083
"org.freedesktop.DBus.Deprecated": "true"})
2210
2084
@dbus_service_property(_interface, signature="o", access="read")
2211
2085
def ObjectPath_dbus_property(self):
2212
return self.dbus_object_path # is already a dbus.ObjectPath
2213
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2214
2088
# Secret = property
2215
2089
@dbus_annotations(
2216
2090
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2221
2095
byte_arrays=True)
2222
2096
def Secret_dbus_property(self, value):
2223
2097
self.secret = bytes(value)
2224
2098
2225
2099
del _interface
2226
2100
2227
2101
2228
class ProxyClient:
2229
def __init__(self, child_pipe, key_id, fpr, address):
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2230
2104
self._pipe = child_pipe
2231
self._pipe.send(('init', key_id, fpr, address))
2105
self._pipe.send(('init', fpr, address))
2232
2106
if not self._pipe.recv():
2233
raise KeyError(key_id or fpr)
2234
2107
raise KeyError(fpr)
2108
2235
2109
def __getattribute__(self, name):
2236
2110
if name == '_pipe':
2237
2111
return super(ProxyClient, self).__getattribute__(name)
2240
2114
if data[0] == 'data':
2241
2115
return data[1]
2242
2116
if data[0] == 'function':
2243
2117
2244
2118
def func(*args, **kwargs):
2245
2119
self._pipe.send(('funcall', name, args, kwargs))
2246
2120
return self._pipe.recv()[1]
2247
2121
2248
2122
return func
2249
2123
2250
2124
def __setattr__(self, name, value):
2251
2125
if name == '_pipe':
2252
2126
return super(ProxyClient, self).__setattr__(name, value)
2255
2129
2256
2130
class ClientHandler(socketserver.BaseRequestHandler, object):
2257
2131
"""A class to handle client connections.
2258
2132
2259
2133
Instantiated once for each connection to handle it.
2260
2134
Note: This will run in its own forked process."""
2261
2135
2262
2136
def handle(self):
2263
2137
with contextlib.closing(self.server.child_pipe) as child_pipe:
2264
2138
logger.info("TCP connection from: %s",
2265
2139
str(self.client_address))
2266
2140
logger.debug("Pipe FD: %d",
2267
2141
self.server.child_pipe.fileno())
2268
2142
2269
2143
session = gnutls.ClientSession(self.request)
2270
2271
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2272
# "+AES-256-CBC", "+SHA1",
2273
# "+COMP-NULL", "+CTYPE-OPENPGP",
2274
# "+DHE-DSS"))
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2275
2149
# Use a fallback default, since this MUST be set.
2276
2150
priority = self.server.gnutls_priority
2277
2151
if priority is None:
2278
2152
priority = "NORMAL"
2279
gnutls.priority_set_direct(session._c_object,
2280
priority.encode("utf-8"),
2153
gnutls.priority_set_direct(session._c_object, priority,
2281
2154
None)
2282
2155
2283
2156
# Start communication using the Mandos protocol
2284
2157
# Get protocol number
2285
2158
line = self.request.makefile().readline()
2290
2163
except (ValueError, IndexError, RuntimeError) as error:
2291
2164
logger.error("Unknown protocol version: %s", error)
2292
2165
return
2293
2166
2294
2167
# Start GnuTLS connection
2295
2168
try:
2296
2169
session.handshake()
2300
2173
# established. Just abandon the request.
2301
2174
return
2302
2175
logger.debug("Handshake succeeded")
2303
2176
2304
2177
approval_required = False
2305
2178
try:
2306
if gnutls.has_rawpk:
2307
fpr = b""
2308
try:
2309
key_id = self.key_id(
2310
self.peer_certificate(session))
2311
except (TypeError, gnutls.Error) as error:
2312
logger.warning("Bad certificate: %s", error)
2313
return
2314
logger.debug("Key ID: %s", key_id)
2315
2316
else:
2317
key_id = b""
2318
try:
2319
fpr = self.fingerprint(
2320
self.peer_certificate(session))
2321
except (TypeError, gnutls.Error) as error:
2322
logger.warning("Bad certificate: %s", error)
2323
return
2324
logger.debug("Fingerprint: %s", fpr)
2325
2326
try:
2327
client = ProxyClient(child_pipe, key_id, fpr,
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2328
2189
self.client_address)
2329
2190
except KeyError:
2330
2191
return
2331
2192
2332
2193
if client.approval_delay:
2333
2194
delay = client.approval_delay
2334
2195
client.approvals_pending += 1
2335
2196
approval_required = True
2336
2197
2337
2198
while True:
2338
2199
if not client.enabled:
2339
2200
logger.info("Client %s is disabled",
2342
2203
# Emit D-Bus signal
2343
2204
client.Rejected("Disabled")
2344
2205
return
2345
2206
2346
2207
if client.approved or not client.approval_delay:
2347
# We are approved or approval is disabled
2208
#We are approved or approval is disabled
2348
2209
break
2349
2210
elif client.approved is None:
2350
2211
logger.info("Client %s needs approval",
2361
2222
# Emit D-Bus signal
2362
2223
client.Rejected("Denied")
2363
2224
return
2364
2365
# wait until timeout or approved
2225
2226
#wait until timeout or approved
2366
2227
time = datetime.datetime.now()
2367
2228
client.changedstate.acquire()
2368
2229
client.changedstate.wait(delay.total_seconds())
2381
2242
break
2382
2243
else:
2383
2244
delay -= time2 - time
2384
2245
2385
2246
try:
2386
2247
session.send(client.secret)
2387
2248
except gnutls.Error as error:
2388
2249
logger.warning("gnutls send failed",
2389
exc_info=error)
2250
exc_info = error)
2390
2251
return
2391
2252
2392
2253
logger.info("Sending secret to %s", client.name)
2393
2254
# bump the timeout using extended_timeout
2394
2255
client.bump_timeout(client.extended_timeout)
2395
2256
if self.server.use_dbus:
2396
2257
# Emit D-Bus signal
2397
2258
client.GotSecret()
2398
2259
2399
2260
finally:
2400
2261
if approval_required:
2401
2262
client.approvals_pending -= 1
2404
2265
except gnutls.Error as error:
2405
2266
logger.warning("GnuTLS bye failed",
2406
2267
exc_info=error)
2407
2268
2408
2269
@staticmethod
2409
2270
def peer_certificate(session):
2410
"Return the peer's certificate as a bytestring"
2411
try:
2412
cert_type = gnutls.certificate_type_get2(session._c_object,
2413
gnutls.CTYPE_PEERS)
2414
except AttributeError:
2415
cert_type = gnutls.certificate_type_get(session._c_object)
2416
if gnutls.has_rawpk:
2417
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2418
else:
2419
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2420
# If not a valid certificate type...
2421
if cert_type not in valid_cert_types:
2422
logger.info("Cert type %r not in %r", cert_type,
2423
valid_cert_types)
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2424
2275
# ...return invalid data
2425
2276
return b""
2426
2277
list_size = ctypes.c_uint(1)
2432
2283
return None
2433
2284
cert = cert_list[0]
2434
2285
return ctypes.string_at(cert.data, cert.size)
2435
2436
@staticmethod
2437
def key_id(certificate):
2438
"Convert a certificate bytestring to a hexdigit key ID"
2439
# New GnuTLS "datum" with the public key
2440
datum = gnutls.datum_t(
2441
ctypes.cast(ctypes.c_char_p(certificate),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.c_uint(len(certificate)))
2444
# XXX all these need to be created in the gnutls "module"
2445
# New empty GnuTLS certificate
2446
pubkey = gnutls.pubkey_t()
2447
gnutls.pubkey_init(ctypes.byref(pubkey))
2448
# Import the raw public key into the certificate
2449
gnutls.pubkey_import(pubkey,
2450
ctypes.byref(datum),
2451
gnutls.X509_FMT_DER)
2452
# New buffer for the key ID
2453
buf = ctypes.create_string_buffer(32)
2454
buf_len = ctypes.c_size_t(len(buf))
2455
# Get the key ID from the raw public key into the buffer
2456
gnutls.pubkey_get_key_id(pubkey,
2457
gnutls.KEYID_USE_SHA256,
2458
ctypes.cast(ctypes.byref(buf),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.byref(buf_len))
2461
# Deinit the certificate
2462
gnutls.pubkey_deinit(pubkey)
2463
2464
# Convert the buffer to a Python bytestring
2465
key_id = ctypes.string_at(buf, buf_len.value)
2466
# Convert the bytestring to hexadecimal notation
2467
hex_key_id = binascii.hexlify(key_id).upper()
2468
return hex_key_id
2469
2286
2470
2287
@staticmethod
2471
2288
def fingerprint(openpgp):
2472
2289
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2487
2304
ctypes.byref(crtverify))
2488
2305
if crtverify.value != 0:
2489
2306
gnutls.openpgp_crt_deinit(crt)
2490
raise gnutls.CertificateSecurityError(code
2491
=crtverify.value)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2492
2308
# New buffer for the fingerprint
2493
2309
buf = ctypes.create_string_buffer(20)
2494
2310
buf_len = ctypes.c_size_t()
2504
2320
return hex_fpr
2505
2321
2506
2322
2507
class MultiprocessingMixIn:
2323
class MultiprocessingMixIn(object):
2508
2324
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2509
2325
2510
2326
def sub_process_main(self, request, address):
2511
2327
try:
2512
2328
self.finish_request(request, address)
2513
2329
except Exception:
2514
2330
self.handle_error(request, address)
2515
2331
self.close_request(request)
2516
2332
2517
2333
def process_request(self, request, address):
2518
2334
"""Start a new process to process the request."""
2519
proc = multiprocessing.Process(target=self.sub_process_main,
2520
args=(request, address))
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2521
2337
proc.start()
2522
2338
return proc
2523
2339
2524
2340
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2526
2342
""" adds a pipe to the MixIn """
2527
2343
2528
2344
def process_request(self, request, client_address):
2529
2345
"""Overrides and wraps the original process_request().
2530
2346
2531
2347
This function creates a new pipe in self.pipe
2532
2348
"""
2533
2349
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2534
2350
2535
2351
proc = MultiprocessingMixIn.process_request(self, request,
2536
2352
client_address)
2537
2353
self.child_pipe.close()
2538
2354
self.add_pipe(parent_pipe, proc)
2539
2355
2540
2356
def add_pipe(self, parent_pipe, proc):
2541
2357
"""Dummy function; override as necessary"""
2542
2358
raise NotImplementedError()
2543
2359
2544
2360
2545
2361
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2546
socketserver.TCPServer):
2362
socketserver.TCPServer, object):
2547
2363
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2548
2364
2549
2365
Attributes:
2550
2366
enabled: Boolean; whether this server is activated yet
2551
2367
interface: None or a network interface name (string)
2552
2368
use_ipv6: Boolean; to use IPv6 or not
2553
2369
"""
2554
2370
2555
2371
def __init__(self, server_address, RequestHandlerClass,
2556
2372
interface=None,
2557
2373
use_ipv6=True,
2567
2383
self.socketfd = socketfd
2568
2384
# Save the original socket.socket() function
2569
2385
self.socket_socket = socket.socket
2570
2571
2386
# To implement --socket, we monkey patch socket.socket.
2572
#
2387
#
2573
2388
# (When socketserver.TCPServer is a new-style class, we
2574
2389
# could make self.socket into a property instead of monkey
2575
2390
# patching socket.socket.)
2576
#
2391
#
2577
2392
# Create a one-time-only replacement for socket.socket()
2578
2393
@functools.wraps(socket.socket)
2579
2394
def socket_wrapper(*args, **kwargs):
2591
2406
# socket_wrapper(), if socketfd was set.
2592
2407
socketserver.TCPServer.__init__(self, server_address,
2593
2408
RequestHandlerClass)
2594
2409
2595
2410
def server_bind(self):
2596
2411
"""This overrides the normal server_bind() function
2597
2412
to bind to an interface if one was specified, and also NOT to
2598
2413
bind to an address or port if they were not specified."""
2599
global SO_BINDTODEVICE
2600
2414
if self.interface is not None:
2601
2415
if SO_BINDTODEVICE is None:
2602
# Fall back to a hard-coded value which seems to be
2603
# common enough.
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2605
SO_BINDTODEVICE = 25
2606
try:
2607
self.socket.setsockopt(
2608
socket.SOL_SOCKET, SO_BINDTODEVICE,
2609
(self.interface + "\0").encode("utf-8"))
2610
except socket.error as error:
2611
if error.errno == errno.EPERM:
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2614
elif error.errno == errno.ENOPROTOOPT:
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2617
self.interface)
2618
elif error.errno == errno.ENODEV:
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2621
else:
2622
raise
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2623
2437
# Only bind(2) the socket if we really need to.
2624
2438
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2627
2439
if not self.server_address[0]:
2628
2440
if self.address_family == socket.AF_INET6:
2629
any_address = "::" # in6addr_any
2441
any_address = "::" # in6addr_any
2630
2442
else:
2631
any_address = "0.0.0.0" # INADDR_ANY
2443
any_address = "0.0.0.0" # INADDR_ANY
2632
2444
self.server_address = (any_address,
2633
2445
self.server_address[1])
2634
2446
elif not self.server_address[1]:
2644
2456
2645
2457
class MandosServer(IPv6_TCPServer):
2646
2458
"""Mandos server.
2647
2459
2648
2460
Attributes:
2649
2461
clients: set of Client objects
2650
2462
gnutls_priority GnuTLS priority string
2651
2463
use_dbus: Boolean; to emit D-Bus signals or not
2652
2653
Assumes a GLib.MainLoop event loop.
2464
2465
Assumes a gobject.MainLoop event loop.
2654
2466
"""
2655
2467
2656
2468
def __init__(self, server_address, RequestHandlerClass,
2657
2469
interface=None,
2658
2470
use_ipv6=True,
2668
2480
self.gnutls_priority = gnutls_priority
2669
2481
IPv6_TCPServer.__init__(self, server_address,
2670
2482
RequestHandlerClass,
2671
interface=interface,
2672
use_ipv6=use_ipv6,
2673
socketfd=socketfd)
2674
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2675
2487
def server_activate(self):
2676
2488
if self.enabled:
2677
2489
return socketserver.TCPServer.server_activate(self)
2678
2490
2679
2491
def enable(self):
2680
2492
self.enabled = True
2681
2493
2682
2494
def add_pipe(self, parent_pipe, proc):
2683
2495
# Call "handle_ipc" for both data and EOF events
2684
GLib.io_add_watch(
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2496
gobject.io_add_watch(
2497
parent_pipe.fileno(),
2498
gobject.IO_IN | gobject.IO_HUP,
2687
2499
functools.partial(self.handle_ipc,
2688
parent_pipe=parent_pipe,
2689
proc=proc))
2690
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2691
2503
def handle_ipc(self, source, condition,
2692
2504
parent_pipe=None,
2693
proc=None,
2505
proc = None,
2694
2506
client_object=None):
2695
2507
# error, or the other end of multiprocessing.Pipe has closed
2696
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2697
2509
# Wait for other process to exit
2698
2510
proc.join()
2699
2511
return False
2700
2512
2701
2513
# Read a request from the child
2702
2514
request = parent_pipe.recv()
2703
2515
command = request[0]
2704
2516
2705
2517
if command == 'init':
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2709
2710
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2712
continue
2713
if key_id and c.key_id == key_id:
2714
client = c
2715
break
2716
if fpr and c.fingerprint == fpr:
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2717
2523
client = c
2718
2524
break
2719
2525
else:
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2722
2528
if self.use_dbus:
2723
2529
# Emit D-Bus signal
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2530
mandos_dbus_service.ClientNotFound(fpr,
2725
2531
address[0])
2726
2532
parent_pipe.send(False)
2727
2533
return False
2728
2729
GLib.io_add_watch(
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2534
2535
gobject.io_add_watch(
2536
parent_pipe.fileno(),
2537
gobject.IO_IN | gobject.IO_HUP,
2732
2538
functools.partial(self.handle_ipc,
2733
parent_pipe=parent_pipe,
2734
proc=proc,
2735
client_object=client))
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2736
2542
parent_pipe.send(True)
2737
2543
# remove the old hook in favor of the new above hook on
2738
2544
# same fileno
2741
2547
funcname = request[1]
2742
2548
args = request[2]
2743
2549
kwargs = request[3]
2744
2550
2745
2551
parent_pipe.send(('data', getattr(client_object,
2746
2552
funcname)(*args,
2747
2553
**kwargs)))
2748
2554
2749
2555
if command == 'getattr':
2750
2556
attrname = request[1]
2751
2557
if isinstance(client_object.__getattribute__(attrname),
2754
2560
else:
2755
2561
parent_pipe.send((
2756
2562
'data', client_object.__getattribute__(attrname)))
2757
2563
2758
2564
if command == 'setattr':
2759
2565
attrname = request[1]
2760
2566
value = request[2]
2761
2567
setattr(client_object, attrname, value)
2762
2568
2763
2569
return True
2764
2570
2765
2571
2766
2572
def rfc3339_duration_to_delta(duration):
2767
2573
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2768
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
True
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
True
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
True
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
True
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
True
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
True
2574
2575
>>> rfc3339_duration_to_delta("P7D")
2576
datetime.timedelta(7)
2577
>>> rfc3339_duration_to_delta("PT60S")
2578
datetime.timedelta(0, 60)
2579
>>> rfc3339_duration_to_delta("PT60M")
2580
datetime.timedelta(0, 3600)
2581
>>> rfc3339_duration_to_delta("PT24H")
2582
datetime.timedelta(1)
2583
>>> rfc3339_duration_to_delta("P1W")
2584
datetime.timedelta(7)
2585
>>> rfc3339_duration_to_delta("PT5M30S")
2586
datetime.timedelta(0, 330)
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
datetime.timedelta(1, 200)
2783
2589
"""
2784
2590
2785
2591
# Parsing an RFC 3339 duration with regular expressions is not
2786
2592
# possible - there would have to be multiple places for the same
2787
2593
# values, like seconds. The current code, while more esoteric, is
2788
2594
# cleaner without depending on a parsing library. If Python had a
2789
2595
# built-in library for parsing we would use it, but we'd like to
2790
2596
# avoid excessive use of external libraries.
2791
2597
2792
2598
# New type for defining tokens, syntax, and semantics all-in-one
2793
2599
Token = collections.namedtuple("Token", (
2794
2600
"regexp", # To match token; if "value" is not None, must have
2827
2633
frozenset((token_year, token_month,
2828
2634
token_day, token_time,
2829
2635
token_week)))
2830
# Define starting values:
2831
# Value so far
2832
value = datetime.timedelta()
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2833
2638
found_token = None
2834
# Following valid tokens
2835
followers = frozenset((token_duration, ))
2836
# String left to parse
2837
s = duration
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2838
2641
# Loop until end token is found
2839
2642
while found_token is not token_end:
2840
2643
# Search for any currently valid tokens
2864
2667
2865
2668
def string_to_delta(interval):
2866
2669
"""Parse a string and return a datetime.timedelta
2867
2868
>>> string_to_delta('7d') == datetime.timedelta(7)
2869
True
2870
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
True
2872
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
True
2874
>>> string_to_delta('24h') == datetime.timedelta(1)
2875
True
2876
>>> string_to_delta('1w') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2879
True
2670
2671
>>> string_to_delta('7d')
2672
datetime.timedelta(7)
2673
>>> string_to_delta('60s')
2674
datetime.timedelta(0, 60)
2675
>>> string_to_delta('60m')
2676
datetime.timedelta(0, 3600)
2677
>>> string_to_delta('24h')
2678
datetime.timedelta(1)
2679
>>> string_to_delta('1w')
2680
datetime.timedelta(7)
2681
>>> string_to_delta('5m 30s')
2682
datetime.timedelta(0, 330)
2880
2683
"""
2881
2684
2882
2685
try:
2883
2686
return rfc3339_duration_to_delta(interval)
2884
2687
except ValueError:
2885
2688
pass
2886
2689
2887
2690
timevalue = datetime.timedelta(0)
2888
2691
for s in interval.split():
2889
2692
try:
2907
2710
return timevalue
2908
2711
2909
2712
2910
def daemon(nochdir=False, noclose=False):
2713
def daemon(nochdir = False, noclose = False):
2911
2714
"""See daemon(3). Standard BSD Unix function.
2912
2715
2913
2716
This should really exist as os.daemon, but it doesn't (yet)."""
2914
2717
if os.fork():
2915
2718
sys.exit()
2933
2736
2934
2737
2935
2738
def main():
2936
2739
2937
2740
##################################################################
2938
2741
# Parsing of options, both command line and config file
2939
2742
2940
2743
parser = argparse.ArgumentParser()
2941
2744
parser.add_argument("-v", "--version", action="version",
2942
version="%(prog)s {}".format(version),
2745
version = "%(prog)s {}".format(version),
2943
2746
help="show version number and exit")
2944
2747
parser.add_argument("-i", "--interface", metavar="IF",
2945
2748
help="Bind to interface IF")
2981
2784
parser.add_argument("--no-zeroconf", action="store_false",
2982
2785
dest="zeroconf", help="Do not use Zeroconf",
2983
2786
default=None)
2984
2787
2985
2788
options = parser.parse_args()
2986
2789
2790
if options.check:
2791
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
2987
2795
# Default values for config file for server-global settings
2988
if gnutls.has_rawpk:
2989
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2990
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2991
else:
2992
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2993
":+SIGN-DSA-SHA256")
2994
server_defaults = {"interface": "",
2995
"address": "",
2996
"port": "",
2997
"debug": "False",
2998
"priority": priority,
2999
"servicename": "Mandos",
3000
"use_dbus": "True",
3001
"use_ipv6": "True",
3002
"debuglevel": "",
3003
"restore": "True",
3004
"socket": "",
3005
"statedir": "/var/lib/mandos",
3006
"foreground": "False",
3007
"zeroconf": "True",
3008
}
3009
del priority
3010
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
3011
2814
# Parse config file for server-global settings
3012
server_config = configparser.ConfigParser(server_defaults)
2815
server_config = configparser.SafeConfigParser(server_defaults)
3013
2816
del server_defaults
3014
2817
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3015
# Convert the ConfigParser object to a dict
2818
# Convert the SafeConfigParser object to a dict
3016
2819
server_settings = server_config.defaults()
3017
2820
# Use the appropriate methods on the non-string config options
3018
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3019
"foreground", "zeroconf"):
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3020
2822
server_settings[option] = server_config.getboolean("DEFAULT",
3021
2823
option)
3022
2824
if server_settings["port"]:
3032
2834
server_settings["socket"] = os.dup(server_settings
3033
2835
["socket"])
3034
2836
del server_config
3035
2837
3036
2838
# Override the settings from the config file with command line
3037
2839
# options, if set.
3038
2840
for option in ("interface", "address", "port", "debug",
3056
2858
if server_settings["debug"]:
3057
2859
server_settings["foreground"] = True
3058
2860
# Now we have our good server settings in "server_settings"
3059
2861
3060
2862
##################################################################
3061
2863
3062
2864
if (not server_settings["zeroconf"]
3063
2865
and not (server_settings["port"]
3064
2866
or server_settings["socket"] != "")):
3065
2867
parser.error("Needs port or socket to work without Zeroconf")
3066
2868
3067
2869
# For convenience
3068
2870
debug = server_settings["debug"]
3069
2871
debuglevel = server_settings["debuglevel"]
3073
2875
stored_state_file)
3074
2876
foreground = server_settings["foreground"]
3075
2877
zeroconf = server_settings["zeroconf"]
3076
2878
3077
2879
if debug:
3078
2880
initlogger(debug, logging.DEBUG)
3079
2881
else:
3082
2884
else:
3083
2885
level = getattr(logging, debuglevel.upper())
3084
2886
initlogger(debug, level)
3085
2887
3086
2888
if server_settings["servicename"] != "Mandos":
3087
2889
syslogger.setFormatter(
3088
2890
logging.Formatter('Mandos ({}) [%(process)d]:'
3089
2891
' %(levelname)s: %(message)s'.format(
3090
2892
server_settings["servicename"])))
3091
2893
3092
2894
# Parse config file with clients
3093
client_config = configparser.ConfigParser(Client.client_defaults)
2895
client_config = configparser.SafeConfigParser(Client
2896
.client_defaults)
3094
2897
client_config.read(os.path.join(server_settings["configdir"],
3095
2898
"clients.conf"))
3096
2899
3097
2900
global mandos_dbus_service
3098
2901
mandos_dbus_service = None
3099
2902
3100
2903
socketfd = None
3101
2904
if server_settings["socket"] != "":
3102
2905
socketfd = server_settings["socket"]
3118
2921
except IOError as e:
3119
2922
logger.error("Could not open file %r", pidfilename,
3120
2923
exc_info=e)
3121
3122
for name, group in (("_mandos", "_mandos"),
3123
("mandos", "mandos"),
3124
("nobody", "nogroup")):
2924
2925
for name in ("_mandos", "mandos", "nobody"):
3125
2926
try:
3126
2927
uid = pwd.getpwnam(name).pw_uid
3127
gid = pwd.getpwnam(group).pw_gid
2928
gid = pwd.getpwnam(name).pw_gid
3128
2929
break
3129
2930
except KeyError:
3130
2931
continue
3134
2935
try:
3135
2936
os.setgid(gid)
3136
2937
os.setuid(uid)
3137
if debug:
3138
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3139
gid))
3140
2938
except OSError as error:
3141
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3142
.format(uid, gid, os.strerror(error.errno)))
3143
2939
if error.errno != errno.EPERM:
3144
2940
raise
3145
2941
3146
2942
if debug:
3147
2943
# Enable all possible GnuTLS debugging
3148
2944
3149
2945
# "Use a log level over 10 to enable all debugging options."
3150
2946
# - GnuTLS manual
3151
2947
gnutls.global_set_log_level(11)
3152
2948
3153
2949
@gnutls.log_func
3154
2950
def debug_gnutls(level, string):
3155
2951
logger.debug("GnuTLS: %s", string[:-1])
3156
2952
3157
2953
gnutls.global_set_log_function(debug_gnutls)
3158
2954
3159
2955
# Redirect stdin so all checkers get /dev/null
3160
2956
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3161
2957
os.dup2(null, sys.stdin.fileno())
3162
2958
if null > 2:
3163
2959
os.close(null)
3164
2960
3165
2961
# Need to fork before connecting to D-Bus
3166
2962
if not foreground:
3167
2963
# Close all input and output, do double fork, etc.
3168
2964
daemon()
3169
3170
if gi.version_info < (3, 10, 2):
3171
# multiprocessing will use threads, so before we use GLib we
3172
# need to inform GLib that threads will be used.
3173
GLib.threads_init()
3174
2965
2966
# multiprocessing will use threads, so before we use gobject we
2967
# need to inform gobject that threads will be used.
2968
gobject.threads_init()
2969
3175
2970
global main_loop
3176
2971
# From the Avahi example code
3177
2972
DBusGMainLoop(set_as_default=True)
3178
main_loop = GLib.MainLoop()
2973
main_loop = gobject.MainLoop()
3179
2974
bus = dbus.SystemBus()
3180
2975
# End of Avahi example code
3181
2976
if use_dbus:
3194
2989
if zeroconf:
3195
2990
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3196
2991
service = AvahiServiceToSyslog(
3197
name=server_settings["servicename"],
3198
servicetype="_mandos._tcp",
3199
protocol=protocol,
3200
bus=bus)
2992
name = server_settings["servicename"],
2993
servicetype = "_mandos._tcp",
2994
protocol = protocol,
2995
bus = bus)
3201
2996
if server_settings["interface"]:
3202
2997
service.interface = if_nametoindex(
3203
2998
server_settings["interface"].encode("utf-8"))
3204
2999
3205
3000
global multiprocessing_manager
3206
3001
multiprocessing_manager = multiprocessing.Manager()
3207
3002
3208
3003
client_class = Client
3209
3004
if use_dbus:
3210
client_class = functools.partial(ClientDBus, bus=bus)
3211
3005
client_class = functools.partial(ClientDBus, bus = bus)
3006
3212
3007
client_settings = Client.config_parser(client_config)
3213
3008
old_client_settings = {}
3214
3009
clients_data = {}
3215
3010
3216
3011
# This is used to redirect stdout and stderr for checker processes
3217
3012
global wnull
3218
wnull = open(os.devnull, "w") # A writable /dev/null
3013
wnull = open(os.devnull, "w") # A writable /dev/null
3219
3014
# Only used if server is running in foreground but not in debug
3220
3015
# mode
3221
3016
if debug or not foreground:
3222
3017
wnull.close()
3223
3018
3224
3019
# Get client data and settings from last running state.
3225
3020
if server_settings["restore"]:
3226
3021
try:
3227
3022
with open(stored_state_path, "rb") as stored_state:
3228
if sys.version_info.major == 2:
3229
clients_data, old_client_settings = pickle.load(
3230
stored_state)
3231
else:
3232
bytes_clients_data, bytes_old_client_settings = (
3233
pickle.load(stored_state, encoding="bytes"))
3234
# Fix bytes to strings
3235
# clients_data
3236
# .keys()
3237
clients_data = {(key.decode("utf-8")
3238
if isinstance(key, bytes)
3239
else key): value
3240
for key, value in
3241
bytes_clients_data.items()}
3242
del bytes_clients_data
3243
for key in clients_data:
3244
value = {(k.decode("utf-8")
3245
if isinstance(k, bytes) else k): v
3246
for k, v in
3247
clients_data[key].items()}
3248
clients_data[key] = value
3249
# .client_structure
3250
value["client_structure"] = [
3251
(s.decode("utf-8")
3252
if isinstance(s, bytes)
3253
else s) for s in
3254
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3257
if isinstance(value[k], bytes):
3258
value[k] = value[k].decode("utf-8")
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
# old_client_settings
3264
# .keys()
3265
old_client_settings = {
3266
(key.decode("utf-8")
3267
if isinstance(key, bytes)
3268
else key): value
3269
for key, value in
3270
bytes_old_client_settings.items()}
3271
del bytes_old_client_settings
3272
# .host and .checker_command
3273
for value in old_client_settings.values():
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3277
.decode("utf-8"))
3023
clients_data, old_client_settings = pickle.load(
3024
stored_state)
3278
3025
os.remove(stored_state_path)
3279
3026
except IOError as e:
3280
3027
if e.errno == errno.ENOENT:
3288
3035
logger.warning("Could not load persistent state: "
3289
3036
"EOFError:",
3290
3037
exc_info=e)
3291
3038
3292
3039
with PGPEngine() as pgp:
3293
3040
for client_name, client in clients_data.items():
3294
3041
# Skip removed clients
3295
3042
if client_name not in client_settings:
3296
3043
continue
3297
3044
3298
3045
# Decide which value to use after restoring saved state.
3299
3046
# We have three different values: Old config file,
3300
3047
# new config file, and saved state.
3311
3058
client[name] = value
3312
3059
except KeyError:
3313
3060
pass
3314
3061
3315
3062
# Clients who has passed its expire date can still be
3316
3063
# enabled if its last checker was successful. A Client
3317
3064
# whose checker succeeded before we stored its state is
3350
3097
client_name))
3351
3098
client["secret"] = (client_settings[client_name]
3352
3099
["secret"])
3353
3100
3354
3101
# Add/remove clients based on new changes made to config
3355
3102
for client_name in (set(old_client_settings)
3356
3103
- set(client_settings)):
3358
3105
for client_name in (set(client_settings)
3359
3106
- set(old_client_settings)):
3360
3107
clients_data[client_name] = client_settings[client_name]
3361
3108
3362
3109
# Create all client objects
3363
3110
for client_name, client in clients_data.items():
3364
3111
tcp_server.clients[client_name] = client_class(
3365
name=client_name,
3366
settings=client,
3367
server_settings=server_settings)
3368
3112
name = client_name,
3113
settings = client,
3114
server_settings = server_settings)
3115
3369
3116
if not tcp_server.clients:
3370
3117
logger.warning("No clients defined")
3371
3118
3372
3119
if not foreground:
3373
3120
if pidfile is not None:
3374
3121
pid = os.getpid()
3380
3127
pidfilename, pid)
3381
3128
del pidfile
3382
3129
del pidfilename
3383
3384
for termsig in (signal.SIGHUP, signal.SIGTERM):
3385
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3386
lambda: main_loop.quit() and False)
3387
3130
3131
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3132
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3133
3388
3134
if use_dbus:
3389
3135
3390
3136
@alternate_dbus_interfaces(
3391
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3137
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3392
3138
class MandosDBusService(DBusObjectWithObjectManager):
3393
3139
"""A D-Bus proxy object"""
3394
3140
3395
3141
def __init__(self):
3396
3142
dbus.service.Object.__init__(self, bus, "/")
3397
3143
3398
3144
_interface = "se.recompile.Mandos"
3399
3145
3400
3146
@dbus.service.signal(_interface, signature="o")
3401
3147
def ClientAdded(self, objpath):
3402
3148
"D-Bus signal"
3403
3149
pass
3404
3150
3405
3151
@dbus.service.signal(_interface, signature="ss")
3406
def ClientNotFound(self, key_id, address):
3152
def ClientNotFound(self, fingerprint, address):
3407
3153
"D-Bus signal"
3408
3154
pass
3409
3155
3410
3156
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3411
3157
"true"})
3412
3158
@dbus.service.signal(_interface, signature="os")
3413
3159
def ClientRemoved(self, objpath, name):
3414
3160
"D-Bus signal"
3415
3161
pass
3416
3162
3417
3163
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3418
3164
"true"})
3419
3165
@dbus.service.method(_interface, out_signature="ao")
3420
3166
def GetAllClients(self):
3421
3167
"D-Bus method"
3422
3168
return dbus.Array(c.dbus_object_path for c in
3423
tcp_server.clients.values())
3424
3169
tcp_server.clients.itervalues())
3170
3425
3171
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3426
3172
"true"})
3427
3173
@dbus.service.method(_interface,
3429
3175
def GetAllClientsWithProperties(self):
3430
3176
"D-Bus method"
3431
3177
return dbus.Dictionary(
3432
{c.dbus_object_path: c.GetAll(
3178
{ c.dbus_object_path: c.GetAll(
3433
3179
"se.recompile.Mandos.Client")
3434
for c in tcp_server.clients.values()},
3180
for c in tcp_server.clients.itervalues() },
3435
3181
signature="oa{sv}")
3436
3182
3437
3183
@dbus.service.method(_interface, in_signature="o")
3438
3184
def RemoveClient(self, object_path):
3439
3185
"D-Bus method"
3440
for c in tcp_server.clients.values():
3186
for c in tcp_server.clients.itervalues():
3441
3187
if c.dbus_object_path == object_path:
3442
3188
del tcp_server.clients[c.name]
3443
3189
c.remove_from_connection()
3447
3193
self.client_removed_signal(c)
3448
3194
return
3449
3195
raise KeyError(object_path)
3450
3196
3451
3197
del _interface
3452
3198
3453
3199
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3454
out_signature="a{oa{sa{sv}}}")
3200
out_signature = "a{oa{sa{sv}}}")
3455
3201
def GetManagedObjects(self):
3456
3202
"""D-Bus method"""
3457
3203
return dbus.Dictionary(
3458
{client.dbus_object_path:
3459
dbus.Dictionary(
3460
{interface: client.GetAll(interface)
3461
for interface in
3462
client._get_all_interface_names()})
3463
for client in tcp_server.clients.values()})
3464
3204
{ client.dbus_object_path:
3205
dbus.Dictionary(
3206
{ interface: client.GetAll(interface)
3207
for interface in
3208
client._get_all_interface_names()})
3209
for client in tcp_server.clients.values()})
3210
3465
3211
def client_added_signal(self, client):
3466
3212
"""Send the new standard signal and the old signal"""
3467
3213
if use_dbus:
3469
3215
self.InterfacesAdded(
3470
3216
client.dbus_object_path,
3471
3217
dbus.Dictionary(
3472
{interface: client.GetAll(interface)
3473
for interface in
3474
client._get_all_interface_names()}))
3218
{ interface: client.GetAll(interface)
3219
for interface in
3220
client._get_all_interface_names()}))
3475
3221
# Old signal
3476
3222
self.ClientAdded(client.dbus_object_path)
3477
3223
3478
3224
def client_removed_signal(self, client):
3479
3225
"""Send the new standard signal and the old signal"""
3480
3226
if use_dbus:
3485
3231
# Old signal
3486
3232
self.ClientRemoved(client.dbus_object_path,
3487
3233
client.name)
3488
3234
3489
3235
mandos_dbus_service = MandosDBusService()
3490
3491
# Save modules to variables to exempt the modules from being
3492
# unloaded before the function registered with atexit() is run.
3493
mp = multiprocessing
3494
wn = wnull
3495
3236
3496
3237
def cleanup():
3497
3238
"Cleanup function; run on exit"
3498
3239
if zeroconf:
3499
3240
service.cleanup()
3500
3501
mp.active_children()
3502
wn.close()
3241
3242
multiprocessing.active_children()
3243
wnull.close()
3503
3244
if not (tcp_server.clients or client_settings):
3504
3245
return
3505
3246
3506
3247
# Store client before exiting. Secrets are encrypted with key
3507
3248
# based on what config file has. If config file is
3508
3249
# removed/edited, old secret will thus be unrecovable.
3509
3250
clients = {}
3510
3251
with PGPEngine() as pgp:
3511
for client in tcp_server.clients.values():
3252
for client in tcp_server.clients.itervalues():
3512
3253
key = client_settings[client.name]["secret"]
3513
3254
client.encrypted_secret = pgp.encrypt(client.secret,
3514
3255
key)
3515
3256
client_dict = {}
3516
3257
3517
3258
# A list of attributes that can not be pickled
3518
3259
# + secret.
3519
exclude = {"bus", "changedstate", "secret",
3520
"checker", "server_settings"}
3260
exclude = { "bus", "changedstate", "secret",
3261
"checker", "server_settings" }
3521
3262
for name, typ in inspect.getmembers(dbus.service
3522
3263
.Object):
3523
3264
exclude.add(name)
3524
3265
3525
3266
client_dict["encrypted_secret"] = (client
3526
3267
.encrypted_secret)
3527
3268
for attr in client.client_structure:
3528
3269
if attr not in exclude:
3529
3270
client_dict[attr] = getattr(client, attr)
3530
3271
3531
3272
clients[client.name] = client_dict
3532
3273
del client_settings[client.name]["secret"]
3533
3274
3534
3275
try:
3535
3276
with tempfile.NamedTemporaryFile(
3536
3277
mode='wb',
3538
3279
prefix='clients-',
3539
3280
dir=os.path.dirname(stored_state_path),
3540
3281
delete=False) as stored_state:
3541
pickle.dump((clients, client_settings), stored_state,
3542
protocol=2)
3282
pickle.dump((clients, client_settings), stored_state)
3543
3283
tempname = stored_state.name
3544
3284
os.rename(tempname, stored_state_path)
3545
3285
except (IOError, OSError) as e:
3555
3295
logger.warning("Could not save persistent state:",
3556
3296
exc_info=e)
3557
3297
raise
3558
3298
3559
3299
# Delete all clients, and settings from config
3560
3300
while tcp_server.clients:
3561
3301
name, client = tcp_server.clients.popitem()
3567
3307
if use_dbus:
3568
3308
mandos_dbus_service.client_removed_signal(client)
3569
3309
client_settings.clear()
3570
3310
3571
3311
atexit.register(cleanup)
3572
3573
for client in tcp_server.clients.values():
3312
3313
for client in tcp_server.clients.itervalues():
3574
3314
if use_dbus:
3575
3315
# Emit D-Bus signal for adding
3576
3316
mandos_dbus_service.client_added_signal(client)
3577
3317
# Need to initiate checking of clients
3578
3318
if client.enabled:
3579
3319
client.init_checker()
3580
3320
3581
3321
tcp_server.enable()
3582
3322
tcp_server.server_activate()
3583
3323
3584
3324
# Find out what port we got
3585
3325
if zeroconf:
3586
3326
service.port = tcp_server.socket.getsockname()[1]
3591
3331
else: # IPv4
3592
3332
logger.info("Now listening on address %r, port %d",
3593
3333
*tcp_server.socket.getsockname())
3594
3595
# service.interface = tcp_server.socket.getsockname()[3]
3596
3334
3335
#service.interface = tcp_server.socket.getsockname()[3]
3336
3597
3337
try:
3598
3338
if zeroconf:
3599
3339
# From the Avahi example code
3604
3344
cleanup()
3605
3345
sys.exit(1)
3606
3346
# End of Avahi example code
3607
3608
GLib.io_add_watch(
3609
GLib.IOChannel.unix_new(tcp_server.fileno()),
3610
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3611
lambda *args, **kwargs: (tcp_server.handle_request
3612
(*args[2:], **kwargs) or True))
3613
3347
3348
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3349
lambda *args, **kwargs:
3350
(tcp_server.handle_request
3351
(*args[2:], **kwargs) or True))
3352
3614
3353
logger.debug("Starting main loop")
3615
3354
main_loop.run()
3616
3355
except AvahiError as error:
3625
3364
# Must run before the D-Bus bus name gets deregistered
3626
3365
cleanup()
3627
3366
3628
3629
def should_only_run_tests():
3630
parser = argparse.ArgumentParser(add_help=False)
3631
parser.add_argument("--check", action='store_true')
3632
args, unknown_args = parser.parse_known_args()
3633
run_tests = args.check
3634
if run_tests:
3635
# Remove --check argument from sys.argv
3636
sys.argv[1:] = unknown_args
3637
return run_tests
3638
3639
# Add all tests from doctest strings
3640
def load_tests(loader, tests, none):
3641
import doctest
3642
tests.addTests(doctest.DocTestSuite())
3643
return tests
3644
3367
3645
3368
if __name__ == '__main__':
3646
try:
3647
if should_only_run_tests():
3648
# Call using ./mandos --check [--verbose]
3649
unittest.main()
3650
else:
3651
main()
3652
finally:
3653
logging.shutdown()
3369
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0